Firefox 74

Available Firefox 74.

• The password manager learned to sort entries in reverse order (Z-A).
• Done with globally installed add-ons (for all users in the system, such as in %ProgramFiles%Mozilla Firefoxextensions). This method of distribution is used for pre-installation in distributions as well as for imposing add-ons during third-party software installations. Developers deemed it flawed, as it deprives users of the ability to remove such add-ons via the add-ons manager (for example, if an add-on causes issues, or the user dislikes being forced to use it). Now, add-on management is completely under user control. Already installed add-ons will continue to work (users can now remove them through the add-ons management), and newly installed ones will be ignored. Custom distribution builders (Windows) and maintainers (Linux) will be provided with a special option during the build stage to restore support for globally installed add-ons. Corporate users are given the option to deploy add-ons via group policies.
• Supplement Facebook Container (automatically opens the social network in a separate container) supports a user-defined list of domains that will also be automatically placed in the container.
• The new tab button received a context menu that can be accessed with the right mouse button (works only when containers are enabled containers), from which a container for the new tab can be selected. Additionally, a setting called 'Select a container for each new tab' has been added, allowing the menu to be called with the left mouse button.
• Now includes the ability to prevent tab detachment. Accidental detachment of a tab into a separate window has been annoying users for many years (the corresponding ticket was opened 9 years ago). A setting called browser.tabs.allowTabDetach has been introduced to disable this tab detachment behavior.
• Add-on hotkeys can now not only be reassigned but also disabled.
• For users in the US, the use of DNS over HTTPS is enabled by default. The default resolver is Cloudflare. In the settings, it can be switched to NextDNS or a custom resolver address.
• The builds for Linux have implemented technology RLBox. C++ code of potentially vulnerable third-party libraries is converted into a WebAssembly module, the privileges of which are strictly limited, and then the module is compiled into machine code and executed in an isolated process. The first such library was Graphite.
• For touch screen devices implemented scrolling acceleration.
• In Windows and macOS, importing data from Edgium (Edge on the Chromium engine) has become possible.
• Browser no longer reveals the local IP address of the machine via WebRTC (instead of the local address, a random identifier is used), therefore users are recommended to reset their settings. media.peerconnection.ice.default_address_only and media.peerconnection.ice.no_host (changing these settings used to hide the local address).
• Searching the history now ignores diacritical marks (for example, searching for the word פסח will also find all occurrences of פֶּסַח).
• As announced a year and a half ago, disabled support for TLS 1.0 and TLS 1.1 has been dropped. If the server does not support TLS 1.2, the user will see an error message about establishing a secure connection and a button to enable support for deprecated protocols (support for these will eventually be completely removed). Other popular browsers are also disabling support for these old protocols this year (TLS 1.0 was introduced in 1999, and TLS 1.1 in 2006), as they do not support modern fast and reliable algorithms (ECDHE, AEAD), yet require support for old and weak ones (TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SHA1, MD5). A year ago, the share of traffic using these protocols was less than half a percent, and has decreased even further by now.
• HTTP:
  • Support for the HTTP header Feature Policyhas been added. With it, the website developer can specify which capabilities and APIs the browser should or should not use (for example, to optimize site performance). Feature Policy is somewhat similar to CSP but manages browser capabilities rather than security. As a result, frames () in which another domain is opened, can no longer request access to geolocation, camera, microphone, screen capture, and fullscreen mode, unless expressly allowed using Feature Policy.
  • Support has been implemented Cross-Origin-Resource-Policy (CORP), With it, sites can block certain requests from third-party sources (for example, prohibit access from external resources to scripts and images of the current site), which helps to prevent speculative side-channel attacks (Meltdown and Spectre), as well as attacks using cross-site scripts.
  • The event languagechange_event, which triggers when the user changes their preferred language.
• CSS:
  • Support for the property has been enabled. text-underline-position, allowing the management of the position of the underline (for example, to set the underline below the subscript characters of a chemical formula).
  • Property values text-underline-offset and text-decoration-thickness can now be expressed in percentages.
  • window.name outline-style has gained support for the auto value.
  • Support for the outdated WebVR 1.1 API has been discontinued, which can now be replaced with the support for -moz-column-* properties, for which standard unprefixed properties should be used instead.
• JavaScript:
  • Implemented optional chaining operator (?.)
  • The following packages have been removed: non-standard method Object.prototype.toSource and the global function uneval. They originated during the Netscape era but never received support from other browsers.
• Developer tools:
  • Recognition of non-functional CSS rules now takes into account elements positioning.
  • JavaScript debugger can now to debug nested web workers.
  • Improved integration with the extension React Developer Tools.

Source: linux.org.ru