The release of the web browser has taken place , as well as Firefox 68.4 for the Android platform. Additionally, an update has been prepared with long-term support . Soon moving to the stage of for the transition to Firefox 73, with a release date scheduled for February 11 (the project to a 4-week ).
:
- In the default standard mode for blocking unwanted content protection against user tracking through hidden identification methods ("browser fingerprinting"), which is carried out by the Disconnect.me list, which includes hosts found using cookies for hidden identification. Hidden identification refers to storing identifiers in areas not meant for permanent information storage ("Supercookies"), and generating identifiers based on indirect data such as , a list of supported MIME types, specific parameters in headers ( and ), analysis of installed , availability of certain Web APIs specific to graphics cards rendering using WebGL and Canvas, with CSS, analyzing the peculiarities of working with and .
- methods with intrusive requests for granting the site additional permissions (Notification.requestPermission(), PushManager.subscribe(), and MediaDevices.getDisplayMedia()). Permission confirmation requests will no longer interrupt browser usage, but will only lead to the display of an indicator in the address bar after user interaction with the page has been recorded (mouse click or key press). Many sites abuse the ability to request permissions in browsers, primarily by periodically displaying push notification requests. Telemetry analysis has shown that 97% of such requests are declined, including in 19% of cases where the user immediately closes the page without clicking the accept or decline button.
- experimental HTTP/3 protocol (to activate in about:config, you need to set the option "network.http.http3.enabled"). HTTP/3 support in Firefox is based on , a Rust-based implementation of the QUIC protocol client and server (HTTP/3 using the QUIC protocol as a transport for HTTP/2).
- In accordance with the requirements of the enacted law (California Consumer Privacy Act) the ability to delete telemetry data from Mozilla servers. Data deletion occurs if telemetry collection is disabled in the section "about:preferences#privacy" ("Firefox Data Collection and Use"). When unchecking the box "Allow Firefox to send technical and interaction data to Mozilla," which controls telemetry sending, Mozilla to delete within 30 days all data collected up until the telemetry transmission was refused. Data that remains on Mozilla's servers during telemetry collection includes information about performance, Firefox security, and general metrics, such as the number of open tabs and session duration (information about visited websites and search queries is not transmitted). Full details about the collected data can be viewed on the 'about:telemetry' page.
- For Linux and macOS, the ability to view videos in Picture-in-Picture mode has been added, allowing users to detach a video into a floating window that stays visible while browsing. To view in this mode, you need to click on the tooltip or select 'Picture in picture' from the context menu that appears when right-clicking the video. On YouTube, which uses its own context menu handler, you need to double-click right or click while holding the Shift key.
- When displaying the scroll bar the background colors of the current page.
- Public Key Pinning (PKP), which allows defining the certificates from specific certificate authorities that may be used for a given website through the HTTP header Public-Key-Pins. The reason cited for low usage is the risk of compatibility issues (support for PKP in Chrome) and the potential to lock oneself out of their own site due to pinning the wrong keys or losing keys (e.g., accidental deletion or compromise due to hacking).
- finalrd , allowing in OpenBSD system calls and for additional isolation of the file system and processes.
- Support for blocking images from specific domains has been removed. The removal reason is the lack of demand for the feature among users and the inconvenient interface for blocking.
- In the builds for Windows, an experimental ability to use client certificates from the operating system's shared certificate store has been implemented (to enable it in about:config, the option security.osclientcerts.autoload should be activated).
- Support for CSS Shadow Parts is enabled by default, including the attribute '' and the pseudo-element '', allowing selective display of specified elements from .
<custom-element>
<p part="»example»">A paragraph</p>
</custom-element>… in CSS for selecting elements related to the part attribute:
custom-element::part(example) {
border: solid 1px black;
border-radius: 5px;
padding: 5px;
} - Support has been added for the specification , which allows defining the trajectory of animation objects using CSS without the need for JavaScript code and without blocking the rendering and input processes during animation playback. To control the animation, the following CSS properties are provided:
,
,
,
and
. - Separate transformation CSS properties are enabled by default , and , not tied to the property (i.e., in CSS you can now specify 'scale: 2;' instead of 'transform: scale(2);').
- A logical union operator has been implemented in JavaScript '??, which returns the right operand if the left operand is NULL or undefined, and vice versa. For example, "const foo = bar ?? 'default string'" returns the string or the value of bar if bar is null, including when bar is 0 and '', unlike the "||" operator.
- Added API and event , which enables the use of handlers in JavaScript to add data to the form at the time of submission without needing to store it in hidden input elements.
- API updated to comply with the new specification, for example, renaming Coordinates to GeolocationCoordinates, Position to GeolocationPosition, and
PositionError to GeolocationPositionError. - In the JavaScript debugger, support for conditional breakpoints (), which trigger on changing or reading certain properties of objects.
- The startup of the JavaScript debugger has been sped up in cases of opening a very large number of tabs (priority is now given to visible tabs).
- In Responsive Design Mode, simulation of different meta viewport values has been implemented. In the page inspection mode, a simulator for the "prefers-color-scheme" values has been added.
- In in multiline mode of JavaScript interpretation added support for saving and opening files using Ctrl + O and Ctrl + S combinations.
- setting javascript.options.asyncstack for visual separation of asynchronous messages in the web console. When enabled, complete stacks of asynchronous operation calls are displayed for console.trace() and console.error(), allowing for understanding the scheduling of timer, event, promise, generator, etc.
- In WebSocket inspection mode, parsing and clear display of metadata for the SignalR format used in ASP.NET Core messages has been implemented. Additionally, counters showing the total amount of sent and received data have been added.
- In the network activity monitoring tool on the Timings tab, separately timing data for queuing for download, starting download, and completion of each resource's loading.
- The Scratchpad environment has been excluded from the web development tools, In addition to innovations and bug fixes in Firefox 72,
11 issues were fixed, collected under CVE-2019-17025 and ) marked as potentially capable of executing malicious code when opening specially crafted pages. Recall that memory issues, such as buffer overflows and accessing already freed memory areas, have recently been marked as dangerous but not critical. The CVE-2019-17017 issue in the XPCVariant.cpp code also deserves special attention, as it could potentially lead to code execution.
Source: opennet.ru
