Mozilla is finally adding a worthwhile feature to Firefox

[TeknoBug]

I must live a charmed life. I browse far and wide for decades, use FF almost exclusively with a few popular plugins , and have never been infected with anything.

The way ya'll talk, you have to reload your op sys 52 times a year after the weekly infection.

I browse with care, actually I only browse to a handful of the same sites, I don't wander off into the unknown forest on the internet. My wife is a different story, I locked down her browser where it just won't accept cookies, flash and java when she goes to an unknown site- and in some occasions some sites still managed to install extensions in her browser, I discovered one last week when her browser was acting strangely so that's another step Firefox (and Chrome) needs to do is add a prompt to ask for user consent before installing a requested extension.

 

[TheRyuu]

I browse with care, actually I only browse to a handful of the same sites, I don't wander off into the unknown forest on the internet. My wife is a different story, I locked down her browser where it just won't accept cookies, flash and java when she goes to an unknown site- and in some occasions some sites still managed to install extensions in her browser, I discovered one last week when her browser was acting strangely so that's another step Firefox (and Chrome) needs to do is add a prompt to ask for user consent before installing a requested extension.

I believe you can use the enterprise features to disable all but approved extensions (at least in Chrome) to further lock down the browser. I've not used them myself but you may be able to set it up as an enterprise installation where essentially you're the one providing the extensions so no others could be installed. This would likely require the user to be running as a regular user with a separate administrator account to manage it (which is how you should have a system setup regardless).

 

[Chiefcrowe]

Thanks again TheRyuu for the detailed response, I appreciate it! I have read somewhere that Mozilla is planning to redesign the whole plugin system, maybe later this year? There was some concern if the major plugins would all make the switch over. So perhaps this is when they will move to PPAPI or similar architecture.

Ah, I found the article. I guess they are going to replace plugins with something?? They probably will have to at least for a while.

https://www.engadget.com/2015/10/09/firefox-stops-plugin-support-by-end-of-2016

Well like I said in my first post in this thread I'll believe it when I see it. However with that said I do believe they have that as one of their goals with the new e10s model although I'm not sure they've specified plugins exactly (and plugins are very much different from all the other stuff they're doing with e10s I suppose). I do know they've said they plan to slowly roll out sandboxing and isolation of extensions/tabs with it coming in phases (i.e. first isolation, then sandboxing).

For 32-bit Firefox Flash is already isolated with a Chrome like sandbox (it does actually use Chrome's sandbox AFAIK) running at a low integrity level among other restrictions (it's not as restrictive as using Flash in Chrome though).

This does actually bring up a good question though. Plugins are very much different from tabs, web pages and extensions since they're not being ran with the browsers javascript interpreter/JIT. Will Firefox drop NPAPI support and move to the Pepper Plugin API (PPAPI)[1][2] that's currently used in Chrome and other Blink based browsers (e.g. Opera)? The PPAPI was designed to be ran in a separate process from the browser so it lends itself to sandboxing/isolation. All of the major plugins on Chrome use the out-of-process model for this and other reasons.

I suppose there are some issues with attempting to implement the PPAPI on Firefox since AFAIK it was designed with Blink in mind. I'm not even sure if a formal specification was ever published outside of the source code in Chromium/Blink as the PPAPI Wiki section mentions[1]. It'll be interesting to see what Adobe does with Flash in the future and if they ever completely drop support for the NPAPI architecture. Google also has the added advantage of having access to the Adobe Flash source code although this has increased security on all browsers across operating systems and not just Chrome[3][4].

It'll be interesting to see who blinks (no pun intended) first, Firefox caving in to implement it or Adobe forcing their hand to provide some alternative (or maybe none at all). Sure you can live without Flash for a lot of things but there are still sites which are reliant on it so could Firefox get away with simply dropping all NPAPI support without a valid alternative? I know they already plan to drop NPAPI plugin support save for Flash but is that just the beginning?

tl;dr I think Firefox has to have a new plugin model before we're going to see isolated/sandboxed plugins, possibly implementing the Pepper Plugin API (PPAPI) that Chrome and other Blink based browsers currently use.

[1] https://en.wikipedia.org/wiki/Google_Native_Client#Pepper
[2] https://en.wikipedia.org/wiki/NPAPI#PPAPI
[3] https://googleprojectzero.blogspot.com/2015/07/significant-flash-exploit-mitigations_16.html (just one example)
[4] https://googleprojectzero.blogspot.com/2016/03/life-after-isolated-heap.html

 

[balloonshark]

I browse with care, actually I only browse to a handful of the same sites, I don't wander off into the unknown forest on the internet. My wife is a different story, I locked down her browser where it just won't accept cookies, flash and java when she goes to an unknown site- and in some occasions some sites still managed to install extensions in her browser, I discovered one last week when her browser was acting strangely so that's another step Firefox (and Chrome) needs to do is add a prompt to ask for user consent before installing a requested extension.

I rarely go to shady sites and Firefox is fairly locked down but I've never had an add-on just install on it's own. I think I always get a warning when I purposefully install an add-on. Perhaps it just for unsigned add-ons.

She is probably clicking to allow the add-on install. Go to options - security - general and you will see "Warn me when sites try to install add-ons". Also check the exceptions. I have two by default. If you want you can remove the exceptions but they should be fairly safe.

Also tell her to say no to everything while surfing. Teach her "if you didn't go looking for it you probably don't need it".

 

[TheRyuu]

I rarely go to shady sites and Firefox is fairly locked down but I've never had an add-on just install on it's own. I think I always get a warning when I purposefully install an add-on. Perhaps it just for unsigned add-ons.

She is probably clicking to allow the add-on install. Go to options - security - general and you will see "Warn me when sites try to install add-ons". Also check the exceptions. I have two by default. If you want you can remove the exceptions but they should be fairly safe.

Also tell her to say no to everything while surfing. Teach her "if you didn't go looking for it you probably don't need it".

I don't think Chrome will even let you install add-ons from anywhere that's not their extension store or whatever it's called.

 

[balloonshark]

I don't think Chrome will even let you install add-ons from anywhere that's not their extension store or whatever it's called.

That's good for your average user.

Here is what I see in firefox when I try to install the nosquint addon from https://addons.mozilla.org/. The add-on does download but does not install. When I click cancel the download disappears from my add-ons list and is not installed.

 

[JimmiG]

Adding this is what finally did it for me after similar frustration:
'browser.tabs.remote.force-enable' set to true
But it breaks my extension that makes dragging a link open in a new tab, which is largely the reason I'm still even using Firefox.

Yeah a few addons break. In my case, Ants video downloader and Free Download Manager both seem to fail at detecting clicked links, probably because the UI and browser engine live in separate processes now. Should be easy for the authors to fix, though.

 

[ninaholic37]

something about Flash 11.2 and Linux

 

[TheRyuu]

I don't think Firefox switching to PPAPI is as likely as either Adobe or Firefox just killing NPAPI Flash dead but who knows.

I find it interesting that Firefox has basically gone from the browser that you could literally do anything with (e.g. configuration, look and feel, etc) to being almost the exact opposite. I can't say I really have an issue with stuff like WebExtensions since I honestly don't care that much about messing with the interface but it's just interesting to see Firefox at a crossroads and seemingly having an identity crisis.

 

[bononos]

But after this update, we would be able to compare it to other browsers right? I know that it doesn't work exactly like chrome but I believe it does separate plugins into another process and maybe other objects too?

Anyone know if Vivaldi separates processes?

Vivaldi is another chromium project so it does separate everything. Theres a built in task manager as well.

 

[Carfax83]

yes firefox has not been as fast as chrome but it has always been much faster than internet explorer.

A bit hyperbolic perhaps? I know it's fashionable to mock IE, but if there's one thing Microsoft has always done well with their browsers, it's hardware acceleration.

Ever since they first implemented it in IE9, they've managed to hold, and even widen that advantage with subsequent iterations of IE, and now especially with their Edge browser.

Chrome is very fast, but Edge renders most web pages noticeably faster from my experience and this is due solely to it's superior hardware acceleration. This is especially evident with scrolling, and even with videos. Load up a 1080p 60 FPS YouTube video with Chrome, and then load up the same video with Edge and you'll see that Edge has lower CPU utilization..

Well if not IE then Edge might be a more fair comparison when it comes to the "modern browser". I realize that it's lacking extensions outside of the fast track channels but there are certain areas where Edge is faster than everything else (e.g. GPU acceleration, certain javascript performance).

Very true!

 

[ninaholic37]

something about 1995 and IE memes

 

[Magic Carpet]

A bit hyperbolic perhaps? I know it's fashionable to mock IE, but if there's one thing Microsoft has always done well with their browsers, it's hardware acceleration.

Ever since they first implemented it in IE9, they've managed to hold, and even widen that advantage with subsequent iterations of IE, and now especially with their Edge browser.

Chrome is very fast, but Edge renders most web pages noticeably faster from my experience and this is due solely to it's superior hardware acceleration. This is especially evident with scrolling, and even with videos. Load up a 1080p 60 FPS YouTube video with Chrome, and then load up the same video with Edge and you'll see that Edge has lower CPU utilization..

Agreed. Even IE10/IE11 outdo Chrome/FF in some video decoding tasks (CPU % wise). Edge is smoking fast, the only reason Chrome is still my primary browser is because of some extensions I require.

 

[Carfax83]

You're basing your "IE is fast" on only IE9 and Edge? lol. Have you been living under a rock? Internet Explorer has been around since 1995! IE has had severe and random lag issues in all versions I can remember. Why do you think memes like this were created? I don't know whether to be angry at your obliviousness at people's pain dealing with the atrocity that is IE or brush it off because you are "new gen" or have twelve i7-supercomputers attached together to run IE or whatever, but the bottom line is Nemesismk2 is absolutely 100% correct.

I thought it was painfully obvious from the context of my comments, and from the overall context of this thread, that I was talking about modern browsers since I specifically brought up hardware acceleration

What IE was like in 1995 has sweet f0ck all to do with what we are talking about.. The fact is, Microsoft has a demonstrably superior hardware acceleration implementation that gives them the "Edge" in many scenarios.

GPU acceleration test that includes IE11, Firefox and Chrome.

Test is two years old, but it backs up what I and others are saying.

 

[Carfax83]

Agreed. Even IE10/IE11 outdo Chrome/FF in some video decoding tasks (CPU % wise). Edge is smoking fast, the only reason Chrome is still my primary browser is because of some extensions I require.

Another thing I've noticed about Edge as well, is that it doesn't write as much information to disk as Chrome, which saves SSDs some writes. Edge holds more information in RAM, but as a consequence uses a lot more RAM than Chrome.

More RAM usage is fine though, as modern computers typically have large amounts of RAM these days.

 

[ninaholic37]

something about XP

 

[Chiefcrowe]

This could be good too if it makes it into a regular release -

Contextual Identities on the Web

https://blog.mozilla.org/tanvi/2016/06/16/contextual-identities-on-the-web

 

[TheRyuu]

Load up a 1080p 60 FPS YouTube video with Chrome, and then load up the same video with Edge and you'll see that Edge has lower CPU utilization..

If we're talking about Edge on the latest stable Windows version (1511) then it does not support VP9 which means that it's using h264 which can be hardware accelerated which directly leads to lower overall CPU usage. I believe Edge already added webm/VP9 support in one of the fast track/experimental versions so that's something to look forward to with the anniversary update. I think the behavior they've chosen to go for is to prefer h264 if you've got hardware accelerated support and if not it'll use VP9 (this should be configurable though so you can prefer VP9 if you want it).

On Chrome it's probably using VP9 which means it's using libvpx (not even ffvp9 which would be faster) so it's not using hardware accelerated decoding which as you might have already guessed leads to higher CPU usage. This isn't necessarily a bad thing but it's just one thing to keep in mind is that you can't just judge based on CPU usage whether one is better than the other. Also those VP9 encoded videos probably look slightly better than the h264 ones.

Another thing I've noticed about Edge as well, is that it doesn't write as much information to disk as Chrome, which saves SSDs some writes. Edge holds more information in RAM, but as a consequence uses a lot more RAM than Chrome.

More RAM usage is fine though, as modern computers typically have large amounts of RAM these days.

I don't think you can really compare the two in RAM usage. Their process model is very much different and obviously a certain percentage of that RAM is from javascript which will vary widely from site to site (plus garbage collection). Then there's plugins... which Edge doesn't even support yet.

This could be good too if it makes it into a regular release -

Contextual Identities on the Web

https://blog.mozilla.org/tanvi/2016/06/16/contextual-identities-on-the-web

Well this looks like a good first step. Lets hope that it is just that, a first (well second I suppose) step out of many.

 

[Carfax83]

On Chrome it's probably using VP9 which means it's using libvpx (not even ffvp9 which would be faster) so it's not using hardware accelerated decoding which as you might have already guessed leads to higher CPU usage. This isn't necessarily a bad thing but it's just one thing to keep in mind is that you can't just judge based on CPU usage whether one is better than the other. Also those VP9 encoded videos probably look slightly better than the h264 ones.

AFAIK, Chrome still has h.264 support. Here's a YouTube h.264 test video that I just played back with Edge and Chrome. Both browsers had GPU utilization during playback, but Edge had higher GPU utilization and lower CPU utilization. With Chrome, it was the opposite; higher CPU utilization and lower GPU utilization.

I don't think you can really compare the two in RAM usage. Their process model is very much different and obviously a certain percentage of that RAM is from javascript which will vary widely from site to site (plus garbage collection). Then there's plugins... which Edge doesn't even support yet.

It wasn't just RAM usage that lead me to believe this. After a lengthy browsing session I usually run CCleaner, and I noticed that Edge usually has a lesser footprint than Chrome in that regard.

 

[TheRyuu]

AFAIK, Chrome still has h.264 support.

Yes, I never said it didn't. It just prefers VP9 irrespective of your hardware. Chrome still has GPU accelerated rendering for videos, just not decode. You'll want to look at VPU usage in Nvidia Inspector to see if it's actually using GPU accelerated decoding not just overall GPU usage although you may very well be right about your point.

 

[jhansman]

Well if not IE then Edge might be a more fair comparison when it comes to the "modern browser". I realize that it's lacking extensions outside of the fast track channels but there are certain areas where Edge is faster than everything else (e.g. GPU acceleration, certain javascript performance).

This. I still depend on FF, but occasionally will use Edge and am always surprised as how quickly it comes up and connects to sites that takes FF at least three times as long. Once Edge gets some useful plugins, it will likely become my go-to browser. lets just hope said plugins don't turn it into a turtle.

 

[Carfax83]

Yes, I never said it didn't. It just prefers VP9 irrespective of your hardware. Chrome still has GPU accelerated rendering for videos, just not decode. You'll want to look at VPU usage in Nvidia Inspector to see if it's actually using GPU accelerated decoding not just overall GPU usage although you may very well be right about your point.

Checked using NVidia inspector and you were right. Chrome doesn't use my GPU's VPU for decoding, but Edge does.

 

[Carfax83]

This. I still depend on FF, but occasionally will use Edge and am always surprised as how quickly it comes up and connects to sites that takes FF at least three times as long. Once Edge gets some useful plugins, it will likely become my go-to browser. lets just hope said plugins don't turn it into a turtle.

One tip to make Edge even faster, is to disable the smartscreen filter under advanced settings.

It's a useful feature, but it noticeably slows down the browser as it checks every website you go to against a whitelist. However if you already have a good third party AV/Firewall solution then you don't need it.

 

[TeknoBug]

Also tell her to say no to everything while surfing. Teach her "if you didn't go looking for it you probably don't need it".

Yeah I taught her that principle with emails, she gets lots of fake emails and she now knows which to send to spam folder or delete forever, a few years ago she once got an email saying her FB account was being compromised and that she needs to log in, she clicked the link inside the email and started to type the login and I stopped her because I knew she was already logged into FB, turned out the link in the email was an Indonedian url.

One tip to make Edge even faster, is to disable the smartscreen filter under advanced settings.

It's a useful feature, but it noticeably slows down the browser as it checks every website you go to against a whitelist. However if you already have a good third party AV/Firewall solution then you don't need it.

Not sure if turning smartscreen off is a good idea but for experimentation sake on some of the PC's at work (they're still i3 640's) where Edge is dog slow, it actually sped it up a bit.

 

[Carfax83]

Not sure if turning smartscreen off is a good idea but for experimentation sake on some of the PC's at work (they're still i3 640's) where Edge is dog slow, it actually sped it up a bit.

Well like I said, you should only turn it off if you have a third party AV/Firewall solution, as those already have antiphishing and antimalware algorithms which are most likely superior to what Edge/IE11 gives you.