Available Firefox 72. This is the first release, the preparation time for which reduced from 6 to 4 weeks.
- Mode "picture-in-picture" enabled on Linux and macOS platforms.
- In builds for OpenBSD involved file system isolation using unveil().
- Tracking Protection start By default, block requests to resources found to be collecting digital fingerprints.
- Sites can no longer ask users for permission (to use geolocation, camera, notifications) until the user begins to interact with the page (mouse click, keyboard key press, tap). Telemetry shows the following:
- requests to display notifications are extremely unpopular (only 1% are approved, 48% are rejected, in other cases the request is ignored). Within a month, users received one and a half billion requests, of which only 23,5 million were approved.
- asking permission again does not make the user more likely to agree. 85% of approvals were received on the first try.
- webmasters, in general, do not wait for the user to begin interacting with the page, but throw out requests immediately.
- requests that wait for the user to interact with the page are approved twice as often.
Starting with this release, if a request was created without waiting for user action, it will only be presented icon in the address bar.
- Twist stripe color automatically adjusts match the page background color.
- Added image/webp support to the Accept HTTP header. Although this behavior is contrary to specification, it is used in Chromium, so many sites look at this header to determine whether the browser supports the WebP format.
- Firefox learned use policies located in /run/user/$UID/firefox/policies.json
- Appeared ability to use client certificates from the Windows store (security.osclientcerts.autoload).
- If you disable telemetry sending, all related data will be deleted from Mozilla servers within 30 days, as required California Consumer Privacy Act.
- The number of recent folders in the bookmark dialog has been increased from 5 to 7. For those who need even more, the browser.bookmarks.editDialog.maxRecentFolders setting has been added.
- Completely redesigned bookmark synchronization mechanism. This allowed us to solve many problems: duplication, loss and shuffling of bookmarks, shuffling of folders, problems with synchronizing new or moved bookmarks.
- The built-in ability to block loading images from specific domains has been removed (it was hidden deeply and was not popular). Add-ons like uMatrix cope with this task much better.
- discontinued support HTTP Public Key Pinning. The website may have informed the browser that the SSL certificate used should only be considered valid if issued by a specific certificate authority. Unfortunately, HPKP not only failed to gain popularity, but also opened the door for extortion. The attacker, having gained access to the web server settings, deployed HPKP and forced clients to cache this information for a couple of years in advance. When the owner regained control and deleted the attacker's certificate, clients were unable to connect to the server. In addition, the technology turned out to be an easy way to “shoot yourself in the foot” by mistakenly blocking access to your own website. A year ago, support for HTTP Public Key Pinning was dropped in Chrome, and it was never implemented in IE, Edge, and Safari.
- Opened Pocket proxy code that allows you to receive sponsored content in new tabs without threatening user privacy.
- CSS:
- JavaScript: support added NULL union operator.
- API: support enabled FormDataEvent.
- Service workers: added support for property WindowOrWorkerGlobalScope.crossOriginIsolated.
- Developer Tools:
- Debugger now supported conditional breakpoints (triggered when reading or changing the properties of an object).
- network monitor learned show information about the request time, the beginning and end of loading of each resource.
- The responsive design mode now supports the simulation of different meta viewport values.
- Inspector Allows simulate different values prefers-color-scheme.
- Websocket inspector from now on shows the volume of received and transmitted data, as well as the ASP.NET Core SignalR format.
- Removed "Simple JavaScript Editor" because it was successfully replaced multi-line console input mode.
Source: linux.org.ru