Mozilla has successfully addressed a critical bug related to Firefox that caused the web browser to crash on desktop systems powered by Intel’s Raptor Lake CPUs. With the latest stable release of Firefox version 151.01, the company has managed to patch the issue that has been under investigation for more than a year.

Mozilla engineers initially zeroed in on failures in a zlib-rs compression routine where certain dist values appeared incorrect, resulting in index out-of-bounds crashes. However, the root cause was tied to Intel’s Raptor Lake CPU instructions, specifically RPL050 and RPL060, which sometimes caused the CPU cores to read incorrect or outdated data.

Senior Staff Engineer Gabriele Svelto first flagged the issue last year, blaming Intel for its CPU instabilities and highlighting mass browser crash reports coming from systems powered by Intel Raptor Lake, specifically in locations suffering from heat waves.

“If you have an Intel Raptor Lake system and you’re in the northern hemisphere, chances are that your machine is crashing more often because of the summer heat. I know because I can literally see which EU countries have been affected by heat waves by looking at the locales of Firefox crash reports coming from Raptor Lake systems,” said Svelto on Mastodon.

He also noted that while Intel’s newer 0x12c microcode update significantly reduced the number of crashes, the bugs came back with the release of version 0x12F.

Intel’s Raptor Lake CPU instability issues first began surfacing in late 2022 before exploding the following year with users reporting widespread game crashes, browser instability, and system failures on 13th-gen and 14th-gen processors. Intel eventually confirmed after several months that the root cause was tied to a physical degradation issue caused by prolonged exposure to excessive voltage and heat. While the company rolled out several microcode patches, including 0x125, 0x129, 0x12B, and, more recently, 0x12F, these updates were only designed to mitigate the conditions triggering the degradation rather than reverse existing damage. Eventually, Intel announced an extended warranty for customers facing the issue from three to five years.

If you have been facing Firefox crashes on your desktop PC running Intel’s 13th-gen or 14th-gen Raptor Lake CPUs, it is recommended to update the browser to its latest stable version by heading to the official page here.

A Mozilla engineer has shared survey data and calculations suggesting that up to 15% of Firefox crashes are due to a bit flip. For the purposes of this report, a bit flip occurs when a memory cell (RAM, cache, etc) updates its value from 0 to 1, or vice-versa, following some unintentional external input. The most common triggers for bit flips are thought to be electrical issues and instability, thermal effects, underlying manufacturing defects and aging, crosstalk, and even memory cells being flipped by an ionizing cosmic ray.

No one seems to have a hard figure for the biggest bit flip contributor. However, systems sent to space will use specialized components hardened to resist interference from cosmic radiation, extremes of temperature, etc, and to include aggressive error checking.

The Mozilla team received nearly half a million auto-submitted crash reports last week (opt-in feature). Data from a recently introduced “memory tester that runs on user machines after the browser crashes,” guided senior engineer Gabriele Svelto towards his eyebrow-raising bit flips, causing 15% of crashes figure, which he admits “dwarfs all the previous estimates I saw regarding this problem.”

Mozilla employed, self-confessed ‘old school nerd’ Svelto says that an initial 10% estimate was revised up because “If I subtract crashes that are caused by resource exhaustion (such as out-of-memory crashes) this number goes up to around 15%.” Moreover, it was determined that one in two bit flip crashes was due to a “genuine hardware issue.” Svelto notes this could be undershooting the real figure as Mozilla’s memory test on crash feature “only checks up to 1 GiB of memory and runs for no longer than 3 seconds.”

Thus, it is hard to drill down to probably the most fascinating statistic of how many Firefox crashes are precipitated by an errant cosmic ray passing though…

As a parting shot, Svelto doesn’t want fancy Arm-based MacBook owners, or any other niche device owner, thinking this is just about PCs with shaky RAM. Every device with memory can be affected by bit flips, asserts the engineer. That doesn’t matter if it’s a Mac, smartphone, or even a printer or router. From that perspective, PC desktop DIYers are probably in a better position, as they can replace any faulty component without throwing away the whole caboodle. But please, great cosmic ray caster in the sky, please don’t make me think I have RAM issues in 2026…

Firefox rolled out update 141 last month, but there has been an issue simmering under the hood which has only now come to a head. PC enthusiasts don’t like their CPU cycles being wasted, but there is evidence that Firefox v141’s headlining new feature, AI-enhanced tab groups, is chewing through more horsepower than it should. Quell surprise – AI sapping your precious watts for little to no tangible benefit…

The first release of Firefox v141.x was on July 22, but we think that the unsatisfied muttering about AI-enhanced tab groups is only starting to become audible is as this is a feature that is “part of a progressive rollout.” In other words, Mozilla has been quite cautious with switching on this feature to a wider audience.

Leading the throng, who have now found their voices, are the two Reddit threads linked in the intro. IamgRiefeR7 was among the first on the Firefox Subreddit to float the idea that the Mozilla-developed browser was to blame for a recently observed flurry of “rapid CPU and power spikes,” uncharacteristic of the intensity of their browsing activity.

Firefox inference process caught red-handed

Investigations by IamgRiefeR7 pointed to a process called ‘Inference’ fluctuating between 0.05% and an astronomical 130% CPU usage. This was observable in Firefox’s about:processes status page, which you get to by inputting that string into the browser address bar. IamgRiefeR7 tried to kill the process, but such action isn’t recommended, as Firefox subsequently becomes unstable.

Elsewhere, on Reddit (linked top) st8ic88 crafted a very popular Firefox Subreddit thread after noticing “my CPU going nuts for no reason.” This Redditor was clearly exasperated with their laptop CPU overworking, and battery depleting extra fast, all due to some AI process that merely groups tabs.

For those selected for the progressive feature rollout, our only wish is that Mozilla makes this – and future AI shenanigans – easy to toggle on or off. The Firefox browser has a lot of attractive qualities, including its customizability. However, the experience of IamgRiefeR7 – where the browser became unstable when the inference process was killed – isn’t promising.

No signs of Firefox-related inferencing processes here

Mozilla has reportedly been swamped with crash reports for its Firefox browser, the majority of which are coming from Raptor Lake Intel CPUs that are known to suffer from instability that is further exacerbated by heat. Senior Staff Engineer Gabriele Svelto said on Mastodon that a mass of browser crash reports are coming from Intel Raptor Lake-powered systems located in areas that are suffering from heat waves.

“If you have an Intel Raptor Lake system and you’re in the northern hemisphere, chances are that your machine is crashing more often because of the summer heat,” says Svelto. “I know because I can literally see which EU countries have been affected by heat waves by looking at the locales of Firefox crash reports coming from Raptor Lake systems.” The engineer even added that it has gotten so bad that the team disabled the bot, which filed these crash reports automatically, especially since these events almost exclusively happened to Intel Raptor Lake PCs — specifically, the Intel Core i7-14700K model.

The instability issue exploded around the second and third quarters of last year, and it took several months for the company to find its root cause. Since this was a physical degradation problem, no amount of patches can reverse the instability — Intel’s microcode updates only mitigated it and prevent the conditions that triggered the instability from occurring. Just last month, Intel released microcode update 0x12F to address the Vmin shift that’s happening to Raptor Lake CPUs that have been running for several days in a row. However, Svelto says that this version also caused the bugs to “come back in full force”.

Thankfully, Intel extended the warranty for all the affected chips from three to five years. So, if you’re one of the millions of users affected by this issue, and you have a dead Raptor Lake CPU, you can RMA it and get a replacement.

These CPU instability issues have caused Intel to lose ground to AMD in the desktop PC market share, and its Arrow Lake chips performed poorly in sales, exacerbating the company’s financial problems. In comparison, AMD has been releasing excellent gaming processors, especially the AMD Ryzen 7 9800X3D chip, which eclipses even Intel’s latest offerings in several gaming benchmarks.

Linux developer Hector Martin has discovered that YouTube is "deliberately crippling Firefox on Asahi Linux." Martin, also known by the handle Marcan, says YouTube downgrades the video quality and resolutions served to Firefox users on Macs with Arm-based systems, at least when they're not running MacOS. This behavior is particularly galling as Arm-devices can be very powerful in 2023. Asahi Linux, for example, is a project responsible for porting “a polished Linux experience” to Apple Silicon (Arm CPU architecture) Macs.

Marcan confirmed his YouTube downgrade on Arm hunch by changing the browser user agent (UA) and doing some A/B testing. After changing the Firefox UA parameters from ‘aarch64’ to ‘x86_64’ he says "suddenly you get 4K and everything!"

Digging a little deeper, Marcan checked the code that was responsible for the Arm reaction. He noted that YouTube would serve 1080p videos by default to x86_64 machines. However, the default for Arm devices was a mere 240p. Marcan reckons what he observed is an outdated bias, given the plethora of multi-core Arm processors in modern devices.

One of the reasons for the bias might have been uncovered, though. "YouTube thinks aarch64 Firefox is... a HiSense TV?!" noted the developer — specifically a HiSense 65a67gevs. YouTube doesn’t allow the option of 4K playback on this TV for some reason.

With the YouTube / Firefox on Arm relationship analyzed, Marcan wondered what Google's own Chrome browser was doing when running on Arm hardware. He found a surprising little Google hack: "Chromium on aarch64 pretends to be x86_64." Thus, YouTube playback in Chrome using Asahi Linux defaults to 1080p playback and can be nudged to 4K.

After verifying his observations, Marcan decided to act on what he discovered. He filed a bug report with Mozilla, with the hope of getting Firefox updates to "report bull**** architectures." Marcan also decided to add some workaround code to Asahi Linux.

There's some follow-up discussion below the source report on Mastodon and the Hacker News site. Some early comments thought it was reasonable that YouTube defaulted to 240p on Firefox / Arm. However, it was pointed out that the change of UA also facilitated 4K playback, which was not an available option on Firefox + Linux + aarch64. Another interesting comment noted that Firefox, Chrome, and Safari on modern MacOS (running Apple Silicon) all have the UA set "incorrectly" to x86_64 by the developers. Thankfully, it's pretty easy to change your browser UA information, so you can set it to whatever you want to see what benefits may be available.

YouTube has had more than its fair share of headlines recently. It recently started aggressively checking for any kind of browser and extension-based ad-blocking. Not long after YouTube scripts were propagated to do this spying, a privacy consultant based in Ireland decided to file a criminal complaint.  Also, last month Google was alleged to be crippling Firefox's performance by implementing video loading delays. YouTube released a statement in response to this accusation, but sadly the response seemed to be answering a question that hadn’t been asked — something about ad blockers. A UA switcher was again an easy solution to the issues observed.

A performance-sapping conflict between Mozilla Firefox and Microsoft Defender was first discussed on Bugzilla half a decade ago. However, Firefox users can now rejoice, as Mozilla devs and Microsoft worked together to release an update to MsMpEng.exe (a core process of Windows Defender), which is currently being rolled out. Troubled users should notice a significant improvement after the update, with "a ~75% improvement in CPU usage from MsMpEng.exe when browsing with Firefox," according to senior Mozilla software engineer Yannis Juglaret.

So, what has been happening, and why was there an awful interaction between Firefox and Microsoft Defender? Microsoft acknowledged a problem with MsMpEng.exe using too much CPU time when Windows Defender's real-time Protection feature is spurred into action. This change has helped cut the CPU usage observed by Firefox users significantly.

The Firefox app was particularly hard hit by the Microsoft bug, as the browser is said to generate up to 7x more Event Tracing for Windows (ETW) events compared to competitors (Edge, Chrome etc). It sends these ‘VirtualProtect’ calls to the antivirus / anti-malware provider to try and keep the browser safe from harm as it roams the web.

Though Microsoft’s patch of MsMpEng.exe helps a lot, as you can see from the above-quoted figures, Mozilla devs acknowledge that “We should try to reduce the number of events that Firefox generates, which will reduce the CPU usage from [all] AV software.” 

With this in mind, it is also worth noting that other AV solutions, like those from Norton, will also consume a lot of CPU time due to the numerous (7x) Firefox calls for monitoring VirtualProtect. Thus, any program that calls VirtualProtect will benefit from Microsoft’s new MsMpEng.exe, not just Firefox.

An “Explosive” Waste of Time

Mozilla’s Juglaret summed up the prior situation most succinctly when he wrote, “This problem has two sides: Microsoft was doing a lot of useless computations upon each event; and we are generating a lot of events.” He then underlined the impact, “The combination is explosive.”

Using more processing power than necessary is a common irritation for computer users. Those using laptops away from a power outlet will want to avoid CPU-eating applications when there are more efficient alternatives. Meanwhile, if the problem is widespread enough and runs long enough, the math is also scary for desktop users. For example, Hacker News forum members have estimated the energy wasted by Microsoft’s MsMpEng.exe, and the 300M+ users of Firefox could have easily eaten up the entire output of an average coal-fired power plant every day...

In a recent post on the Linux Kernel Mailing List, Linus Torvalds promised “a number of fairly core new things” in Linux kernel 6.1, and the first one seems to have appeared: as reported by The Register, the Rust programming language will be directly supported in the OS.

The news isn't exactly unexpected as patches to add Rust to Linux go back for some time, with version 9 appearing in August 2022. At the recent Open Source Summit Torvalds' keynote indicated that we should expect Rust to appear in 6.1. Right now, Rust has a group of developers working on support for the Linux Kernel and in a pull request made by Kees Cook on October 1, accepted by Torvalds, we see the first steps towards its inevitable arrival in 6.1.

Adding support for Rust adds about 12,500 lines of code to the Linux kernel, which is itself written in C, with which Rust has a certain amount of interoperability. However, GCC, the Gnu Compiler Collection, cannot compile the new language, and Clang, which can, has its own shortcomings if you want to write code for architectures other than x86 and Arm. With Rust set to receive official Linux support, and an eager community of kernel hackers, it can only be a matter of time before Rust is available to more architectures. The new kernel is expected to be available from December this year.

Some developers have already begun showing what can be done with Rust on Linux, with Western Digital’s principal engineer Andreas Hindborg showing off an NVMe SSD driver for Linux written in Rust at the 2022 Linux Plumbers Summit, which had a whole micro conference dedicated to Rust in Linux.

Rust is a general-purpose programming language influenced by C++ that was created in 2006 and hit version 1.0 in 2015. It grew out of a personal project by Mozilla employee Graydon Hoare, and was sponsored by Mozilla until 2020, when corporate restructuring caused by the Covid pandemic caused the Rust Foundation to be founded in 2021. Amazon Web Services, Huawei, Google, Microsoft and Mozilla now support the foundation, and Google supports Rust in its Android Open Source Project. The language is notable for its elegance, its zero-tolerance approach to memory safety, and the speed of its growth in popularity.

It’s also known as a high-performance language, created with the intention of marrying the flexible syntax of a high-level language with the hardware control and speed of a low-level one. Parallelism is also one of its fortes, and its strong memory safety - it notably doesn’t incorporate a garbage collector to return memory that’s no longer being referenced by a program to the system, as C# and Java do. The memory errors introduced by C programmers could be a thing of the past with Rust’s memory-safe features.

Keeping track of passwords in this digital age is no easy task. The average internet user has around 70 passwords, but only 34% of us manage to change them regularly. That’s according to Nord Security, cybersecurity experts and creators of NordPass.

A password manager like NordPass can make your life a lot easier and more secure. You’ll only need to remember one Master Password – or use your fingerprint on a mobile device – and NordPass handles the rest. 

NordPass isn’t perfect, however. Autofill for forms doesn’t work on mobile, so you’ll need to keep entering your address the old-fashioned way. 

You’ll only need to grab your credit card to scan it into the vault because NordPass doesn’t ask for any money upfront. If the free level has enough features for you, you are welcome to stay on the free plan indefinitely.

Specifications: NordPass

Price and Coverage with NordPass

NordPass has three plans: Free, Premium, and Family. 

The free plan is for one user, with enough features to keep your online presence safe and secure. It saves unlimited passwords, remembers your logins, and allows you to import and export passwords from your browser or other password keepers. 

You can scan your credit card information into the NordPass vault for safe shopping, keep secure notes to remember gate or Wi-Fi codes, and it can fill out a variety of other types of forms with information you provide. 

Tired of thinking of super strong passwords? NordPass can generate unique and highly-secure passwords and remember them for you. Plus, it syncs automatically across multiple devices so you’re secure on your desktop, phone, and tablet. You also have the option of turning on multi-factor authentication.

The Premium level is $4.99 a month and does everything the free level does, plus it offers proactive tools to keep your identity secure. It can scan the web for data leaks and help you replace weak and duplicate passwords. You can build a list of trusted contacts and give access to your account in case of emergency.

The Family level is $7.99 a month and does everything the premium does but for six separate users. This is a great way for every member of your family – including grandparents – to keep their information private and secure while saving money.

Both the Premium and Family levels offer discounts when you buy one or two years in advance. At the time of writing, NordPass was running a 70% off sale on its premium plan, dropping the price to $35.76 for a two-year plan.

Setting Up NordPass

I signed up for the free plan using my desktop PC. I was automatically given a 30-day free trial of the premium plan without needing to enter my credit card information. This is a great opportunity – so take advantage. The premium plan can help clean up weak and duplicate passwords, something that needs to be done occasionally if you’re committed to a more secure website presence.

The account was easy to set up and included two-step verification. However, I was disappointed that I needed to create and memorize two new passwords: A global account for all Nord Security products, and then a stronger Master Password to lock down my password vault.

Once you’re signed in to NordPass, it’s possible to authenticate your global account with Google, your Apple ID or have a one time code sent to your email.

A friendly Welcome page lists five tasks to check off to properly secure your online presence. It wanted me to add or import my first password, add a browser extension, get a recovery code in case I lose the Master Password, and try NordPass on mobile. The first task was setting up my free account.

After I clicked Import, the app offered to pull passwords from my browser or from several other password managers – handy if you’re switching providers. If you don’t bulk add passwords from your browser, you can enter each one individually.

Using NordPass on a Desktop

There are two parts to running NordPass on a desktop computer. There’s the application side where your information can be accessed and where you do maintenance tasks. Then there’s the browser extension, which is where the real magic happens. This is where NordPass seamlessly handles passwords and forms as you surf the internet.

I added the NordPass Chrome Extension to Chrome, my browser of choice. It loaded quickly and asked me to verify a pairing code between NordPass and the extension.

When you visit a website that requires a password, NordPass will pull your information from the vault. You can see it at work when a small green NordPass logo appears in the form.

When you visit a site that’s new to NordPass, a window will pop up asking if you’d like to save this password. It will also offer to make a more secure random password without needing to open the app if you’re using the Premium Plan.

Using NordPass on Mobile

Adding NordPass Mobile was even simpler. It works on Windows, macOS, Linux, Android and iOS. I clicked the “try iOS app” link on the get started page and it jumped to a splash page with a QR code. I pointed my phone at it and was immediately prompted to download the mobile app.

The mobile app synced up immediately and I was ready to use the password manager while on the go. The app handles passwords the same way as it does on a computer, except now you have the option of verifying your ID with a fingerprint instead of typing out your Master Password. You’ll need to enable biometric authentication for NordPass on your device and you’re good to go.

Mobile forms are a problem for NordPass, so you’ll still have to enter your name, address and similar items by hand while shopping. You can cut and paste your credit card information from the NordPass vault to save time hunting down your wallet.

The free plan allows you to load NordPass on all your devices, but you can be logged into one device at a time. This isn’t as limiting as LastPass, which limits free users to one type of device, or Keeper, which limits free users to one mobile device, but logging in and out every time you switch devices is still inconvenient — and there are free password managers, such as Bitwarden, that don’t put limits on your logged-in devices. If you upgrade to the premium plan, NordPass will let you stay logged into as many as six devices at one time.

NordPass Keeps Your Notes and Credit Cards Secure

The ability to sync between your phone and computer is really useful when it comes to reading notes and credit cards. NordPass has optical recognition scanning that allows you to snap a photo of your credit card, which saves you from typing in a long string of numbers. It also works for handwritten notes, which it saves as text instead of images.

It’s not perfect. The scanner was able to read my traditional Visa card, but my PayPal debit card has an unusual format with all the numbers on the back of the card. It didn’t know what it was reading. I could still enter the card’s information by hand.

Shopping with NordPass

I tested NordPass on a small desktop shopping trip. After filling my cart, I clicked over to the checkout. Each box where I would type in my email and address information had a little green NordPass mountain icon. I clicked the first icon and whoosh! The whole form was filled out.

The same happened for the payment information, with NordPass filling in my card number, name, expiration date and security code in about a half second.

It’s not so smooth when you shop on your phone. NordPass doesn’t autofill form data like names and address while on mobile, so you’ll have to enter this by hand or do a copy and paste from your vault.

Password Generator Built into NordPass

It’s impossible to think of really secure passwords and remember them. So let NordPass do it. The service comes with a random password generator that lets you customize the length of the password and if it uses capital letters, digits and/or symbols.

Give Your Passwords a Health Checkup with NordPass

How healthy are your passwords? NordPass can tell what passwords need to be updated – or deleted – when you use the Password Health function. I pulled all my passwords in from Google Chrome and found plenty of old websites that I don’t use and some that don’t even exist anymore.

Some of my “reused passwords” were the result of Google Chrome saving typos thinking they were new usernames, so the number wasn’t as bad as it looked. I found 22 typos associated with my 12-year-old blog, a Target login where I tried to enter my last name instead of my email and several membership sites that I no longer belonged to.

For the record, none of these sites were for banking or credit cards – those I remembered to keep secure on my own.

The best thing you can do is stop using the old passwords and replace them with NordPass’s randomly generated passwords. You should look at all the sites flagged to verify there’s no financial information associated with them. Then go back to the source of the list and delete the information – in this case I need to delete the list of passwords Google has been keeping for me.

Password Health is part of the premium level.

Using the NordPass Data Breach Scanner

If you’re wondering if your passwords have been compromised, NordPass has a Data Breach Scanner as part of the premium plan. Clicking this told me there were several leaked passwords for me to clean up.

NordPass turned up data breaches going back to 2013, which I had already resolved by changing my passwords long ago. But this was a good reminder why we should stay on top of our information and not use those old, simple passwords.

NordPass will tell you what information was compromised, including what email and password were leaked. It will let you know if your information appeared on a hacker’s list or if a website you visited was attacked.

How Secure is NordPass?

NordPass uses a cutting-edge encryption algorithm, XChaCha20, used by companies like Google and Cloudflare. NordPass says this encryption is faster and simpler to use and doesn’t need hardware support.

It also uses a zero-knowledge architecture, so only you know what’s in your vault. No one, not even NordPass, knows your passwords and credit card details. All your data is encrypted and decrypted right locally, right on your device. It’s secure before it even goes online.

If NordPass is ever breached, your data is still safe because everything is heavily encrypted.

Bottom Line

NordPass is a well-respected password manager that’s easy to use on multiple devices. Its free plan is relatively free of restrictions, allowing you to save unlimited passwords and sync across multiple devices, so long as you don’t mind constantly logging in. The premium plan can help you fight data leaks and seek out weak passwords.

The desktop version can autofill forms using contact information you provide, making shopping with NordPass a breeze. The mobile version can’t recognize or fill out these forms, which is disappointing.

Its zero-knowledge architecture means your data is encrypted locally, so even if your data falls into the wrong hands, bad guys won’t be able to read it. The Premium Plan might be pricey compared to other services, but the 30-day free trial gives you plenty of time to clean up your old passwords and find data leaks. 

Linux Mint has announced the latest release of its Debian based operating system Linux Mint Debian Edition (LMDE), codename "Elsie" is based upon the latest Debian "Bullseye" release and is an alternative to the mainstream Ubuntu based Linux Mint. 

LMDE, or Linux Mint Debian Edition, is a backup version of Mint designed to preserve the work put into, and user experience of, Linux Mint should Ubuntu ever disappear to the great software graveyard in the sky. As Ubuntu is itself built on Debian architecture, to the uninitiated the difference is hard to discern. But under the hood there are notable software changes inline with the source operating system's philosophy. Following a successful beta release at the end of February, the time has come for a full version.

LMDE 5, codenamed Elsie, is made using the same Debian 11 Bullseye that Raspberry Pi OS made such a difficult upgrade to last year (as more recently and successfully did Peppermint OS). This, however, seems to be a much more fortunate project than Raspberry Pi’s, displaying the same Cinnamon desktop as the Ubuntu-based version of Mint, but with none of the Snap containerised software packages used by Canonical’s operating system. Instead, it uses the Flatpak application manager, along with a native Firefox app straight from Mozilla. Being a Debian based OS, Linux Mint also comes with the APT (Advanced Packaging Tool) to manage software installation.

The system requirements are modest, with just 2GB of RAM (4GB for a ‘comfortable experience’) and 20GB of disk space required. A screen resolution of 1024 x 768 is recommended, but on coarser displays there's a workaround involving Alt+dragging windows to get them on the screen. 

Whatever the underlying architecture, there's no denying that, for a Windows user at least, Mint is a OS that makes a lot of sense on the desktop. The Menu and taskbar arrangement are familiar, there's some closed-source software such as Spotify and video codecs available, and if you want Ubuntu’s Snap, you can have it. 

Otherwise, the full and familiar selection of Linux software is available, about 30,000 packages in total, including such stalwarts as GIMP, LibreOffice, and Inkscape. Mint celebrated its 15th anniversary last year, having been conceived in February 2006 by Clement Lefebvre, a French developer who wanted to implement solutions to common Linux community problems. The first release was based on Kubuntu, with the Gnome desktop landing in November the same year atop version 2.0 of the OS.

Software can be expensive. That's why some people decide to pirate apps instead of buying licenses for them, but according to Red Canary, hackers are using a fake version of a popular software piracy tool to spread the Cryptbot malware.

The tool in question is called KMSPico, which Red Canary said is used to "activate the full features of Microsoft Windows and Office products without actually owning a license key." Security tools usually block KMSPico, so it often comes with instructions for disabling those protections, thereby leaving systems vulnerable to malware.

Which brings us to Cryptbot. Red Canary said it "harms organizations by stealing credentials and other sensitive information from affected systems." The company said much of that private data is stolen from cryptocurrency-related software like:

• Atomic cryptocurrency wallet
• Ledger Live cryptocurrency wallet
• Waves Client and Exchange cryptocurrency applications
• Coinomi cryptocurrency wallet
• Jaxx Liberty cryptocurrency wallet
• Electron Cash cryptocurrency wallet
• Electrum cryptocurrency wallet
• Exodus cryptocurrency wallet
• Monero cryptocurrency wallet
• MultiBitHD cryptocurrency wallet

Red Canary said that Cryptbot also tries to steal information from Google Chrome, Mozilla Firefox, Opera, Brave, and Vivaldi web browsers and the CCleaner system management tool. But the extensive list of wallet software targeted by Cryptbot makes it clear that crypto enthusiasts are high-value targets.

As far as protecting against this scheme goes, it seems the best option is not to look for KMSPico downloads in the first place. "A pirate's life is not the life for us, especially when it comes to cracked software," Red Canary said. "Save yourself the trouble and go for legitimate, supported activation methods."

Microsoft didn't win any new fans when it changed the default browser behavior in Windows 11. Rather than allowing Windows 11 users to change the browser defaults with a single click, they were forced to individually change default apps for HTM, HTML, PDF, SHTML, SVG, WEBP, XHT, XHTML, FTP, HTTP, and HTTPS formats. Thankfully, app developer Rafael Riviera (via Beebom) discovered that Microsoft reversed course in Windows 11 Insider Preview Build 22509, which was released earlier this week.

In this preview build Microsoft has reverted to the Windows 10-style procedure, which allows users to set a default browser with a single button click. This is a welcome change and something that we feel Microsoft shouldn't have messed with in the first place. As one might expect, Microsoft sets its Edge browser as the default when installing Windows 11. But making it harder for users to change to their preferred browser like Google Chrome or Mozilla Firefox was sure to garner backlash.

For its part, Microsoft confirmed this latest move, telling The Verge, "In the Windows 11 Insider Preview Build 22509 released to the Dev Channel on Wednesday, we streamlined the ability for a Windows Insider to set the 'default browser' to apps that register for HTTP:, HTTPS:, .HTM, and .HTML. Through the Windows Insider Program you will continue to see us try new things based on customer feedback and testing."

However, this isn't the only news in the ongoing war that Microsoft is waging against competing browser manufacturers. Neowin reported yesterday that Microsoft is getting a bit aggressive (with some added humor) when users try to download Google Chrome using the Edge browser. Instead of staying completely out of the way, Microsoft pelts the users with one of the following popups:

• Microsoft Edge runs on the same technology as Chrome, with the added trust of Microsoft"
• "I hate saving money," said no one ever. Microsoft Edge is the best browser for online shopping.
• That browser is so 2008! Do you know what's new? Microsoft Edge.

While it is probably annoying for Windows users who simply want to quickly hop into their favorite browser and get on with life, Microsoft thankfully doesn't put up any onerous roadblocks to downloading the software.

Microsoft this week confirmed to Paul Thurrott that it is forcing the Edge browser on Windows 11 users in specific scenarios (i.e., opening search results from the Start menu). Moreover, the company is taking this action even if customers have a third-party browser like Google Chrome or Mozilla Firefox set as their default browser.

“Windows openly enables applications and services on its platform, including various web browsers,” said Microsoft in a statement to Thurrott. “At the same time, Windows also offers certain end-to-end customer experiences in both Windows 10 and Windows 11, the search experience from the taskbar is one such example of an end-to-end experience that is not designed to be redirected. When we become aware of improper redirection, we issue a fix.”

Microsoft is, of course, talking about EdgeDeflector. Daniel Aleksandersen, the developer of EdgeDeflector, noticed that Windows 11 builds 22483 and 22494 Insider Preview builds blocked his app from functioning. So Aleksandersen designed EdgeDeflector to allow a Windows user’s default browser to display Start menu search results, bypassing Microsoft’s hijacking of the customer’s default browser choice.

When a customer sets Chrome, for example, as their default browser, it’s a reasonable assumption that it would be used within Windows 11 for all browser-related duties. Microsoft disagrees as it cites a disruption to the end-to-end user experience for customers with workaround apps like EdgeDeflector. However, we’d argue that if a customer has chosen to use a third-party browser, forcing Edge upon them for simple tasks is a direct contradiction of this edict.

“It’s clearly a user-hostile move that sees Windows compromise its own product usability in order to make it more difficult to use competing products,” said Aleksandersen last week. “Your web browser is probably the most important — if not the only — app you regularly use. Microsoft has made it clear that its priorities for Windows don’t align with its users’.”

Aleksandersen tells users to complain to local antitrust regulators or switch to a competing operating system like Linux to put pressure on Microsoft. However, if you want a slightly complicated workaround for Microsoft’s latest attack on default browsers, there’s a new script that allows you to maintain the status quo.

This is the latest saga in the default browser battle in Windows 11. The company caught flak recently, most vocally from Firefox developer Mozilla, for making it more difficult for users to switch their default browser.

Mozilla's Firefox browser just achieved a milestone today: It became the first "major" web browser to make its way to the Microsoft Store for both the Windows 10 and Windows 11 operating systems. Mozilla has played a sort of cat and mouse game with Microsoft in the past, particularly when it comes to default browser shenanigans in Windows 11. However, the two companies seem to have buried the hatchet with this latest move.

"Previously, if you were on Windows and wanted to use Firefox, you had to download it from the internet and go through a clunky process from Microsoft," said Mozilla in a statement. In addition, before July 2021, Microsoft prevented browsers using an independent engine from appearing in the Microsoft Store. With the July policy update, both Chromium and Gecko (Firefox's browser engine) are permitted within the Microsoft Store. Interestingly, Chromium also underpins the dominant Chrome browser, but Google has yet to bring its browser to the Microsoft Store.

"Now that Microsoft has changed its Store policies, choosing Firefox as your desktop browser is even more seamless — and it comes with all the latest Firefox features," Mozilla continued. "People deserve choice and we're glad there is an easier option to download Firefox on Windows."

Mozilla says that Windows users will now be able to easily see the benefits of Firefox and take advantage of the following features:

• Strong privacy protections with Total Cookie Protection, Enhanced Tracking Protection, and DNS over HTTPS
• Lightning fast site loading and display using WebRender and Quantum CSS
• Discovering more of the web quicker and smarter with Firefox Suggest
• Taking control of your entertainment with Multi Picture-in-Picture
• Personalizing your experience with seasonal Colorways.

Firefox's new home in the Microsoft Store comes almost two months after Mozilla reverse-engineered Microsoft's "one-click" method for setting the default browser in Windows 11. Microsoft previously only gave its homegrown Edge browser the ability to take on default status with a single click. For users with third-party browsers, it was a more cumbersome process involving navigating to Settings and changing individual file associations (i.e., HTM, HTML, PDF, SHTML, SVG, WEBP, XHT, XHTML, FTP, HTTP, and HTTPS).

"People should have the ability to simply and easily set defaults, but they don't. All operating systems should offer official developer support for default status so people can easily set their apps as default," a Mozilla spokesperson told The Verge back in September. "Since that hasn't happened on Windows 10 and 11, Firefox relies on other aspects of the Windows environment to give people an experience similar to what Windows provides to Edge when users choose Firefox to be their default browser."

You can download Firefox for Windows 10 or Windows 11 by directly visiting the Microsoft Store.

Mozilla said on Wednesday that it patched a zero-day vulnerability in the Firefox browser that could have allowed hackers to take over target systems. The patch is available in the Firefox 72.0.1 and Firefox ESR 68.4.1 updates released yesterday.

The organization explained that "incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion." Attackers could exploit that issue to gain access to, and control over, systems running Firefox.

Mozilla and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) both said that attackers have exploited this vulnerability in the wild. That's why CISA advised all Firefox users to "apply the necessary updates" in its own advisory.

The vulnerability was assigned the CVE-2019-17026 identifier for the National Vulnerability Database, which is maintained by the U.S. National Institute of Standards and Technology (NIST), but it's not currently available via NIST's website.

Aside from those few details, the only thing Mozilla revealed about the vulnerability was that it was disclosed by Qihoo 360, a Chinese security company. Hopefully more information will be shared following the vulnerability's initial disclosure.

Firefox 72.0.1 and Firefox ESR 68.4.1 can be downloaded via Mozilla's website. People who use the browser can also update it by clicking the "About Firefox" option in the Help (Windows) and Firefox (macOS) section of the menu bar.

Nothing convinces people to part with their hard-earned cash like poorly worded notifications that pop up when people visit a website, right? Well, no. But that seems to be what someone thought, as Ars Technica reported today that scammers are exploiting a bug in Firefox to make people think their systems will be deactivated.

The message claims that victims are using a system on which "the Windows registry key is illegal" because "this Windows desktop is using pirated software" and "sends viruses over the internet." People who see the message are urged to "contact Windows support" by calling a 1-888 number that isn't associated with Microsoft in any way. We assume the scammers would then convince any callers to pay out.

There are plenty of ways to realize this is a scam. The first is the broken English--the message reads, "We block this computer for your safety" as if that statement makes sense--used to claim numerous problems with the offending system. The second would be the fact that Microsoft wouldn't use random websites to scan for pirated versions of Windows that it deactivates unless people call a 1-888 number.

Another indicator: this message is displayed to macOS users too. We doubt many of them are pirating Windows, and even if they were, they probably wouldn't feel obliged to call Microsoft about it. These scammers are relying on their victims to panic, call the mysterious number and pay up to make sure their PCs stay unlocked.

The scammers have also exploited a Firefox bug that allows this message to render the browser unusable. Closing the window doesn't help, either, if someone has the "restore tabs" setting enabled. It merely puts them in a never-ending loop until the offending tab is closed. Again, that should be a sign that something isn't on the up-and-up, but the less technically inclined might not question heavy-handed tactics.

Mozilla's reportedly working on a fix for this issue now. In the meantime, if you know anyone who might fall prey to a scam like this, now might be the time to remind them of a few things. One, Microsoft wouldn't show Windows users messages like this. Two, never trust messages demanding you call customer support. And three, if you would pay this ransom, why not just buy Windows in the first place?

Mozilla announced yesterday that Firefox will drop support for sideloaded extensions in 2020. The organization said this change, which is set to be finalized with the release of Firefox 74, will "give users more control over their extensions."

As explained by Mozilla's announcement, sideloading is "a method of installing an extension in Firefox by adding an extension file to a special location using an executable application installer." That almost makes the feature sound so boring that it's hard to care about it going away.

Sideloading extensions can be useful, though, because they make it easy to install an extension across multiple instances of Firefox on a single device. Mozilla also said in its official documentation on sideloading that the feature can be used to install early versions of extensions that developers want to test before publicly releasing them.

But those uses don't appear to outweigh the negatives aspects of sideloading. Mozilla said that sideloaded extensions "frequently cause issues for users since they did not explicitly choose to install them and are unable to remove them from the Add-ons Manager." The feature's also said to have been used to distribute malware.

Firefox 73 will start the transition away from sideloaded extension support. Mozilla said that release (February 11 for the general public)  "will continue to read sideloaded files, but they will be copied over to the user's individual profile and installed as regular add-ons." That way Firefox users shouldn't have to worry about extensions they rely on mysteriously vanishing.

Firefox 74, which will be publicly released on March 10, will then drop support for sideloading entirely. This timeline should give extension-makers enough time to modify their workflows accordingly.

Mozilla released Firefox 70 today with a new feature that lets people know how many online trackers the browser's Enhanced Tracking Protection feature has blocked. The Privacy Protections report offers a glimpse into just how many sites collect information about their visitors.

The browser maker debuted Enhanced Tracking Protection in June and enabled it by default in July. It automatically blocks tracking cookies, tools that hijack system resources to mine cryptocurrency and fingerprinting scripts. Mozilla said in today's announcement that Firefox has blocked more than 450 billion tracking requests since July 2.

The new Privacy Protections report feature shows people how many things Enhanced Tracking Protection has defended them against in the last week. It also includes information gleaned from Firefox Monitor, which compiles lists of credentials affected by data breaches and shows passwords managed by Firefox Lockwise.

These features have been around for a while, but Mozilla introduced the Privacy Protections report to give people an idea of what exactly they're being protected from. Online tracking is mostly invisible, and as Mozilla explained in a separate blog post today, most people couldn't learn more about this for-profit surveillance if they tried:

"The sheer volume of tracker blocking that we see with Firefox’s Enhanced Tracking Protection (around 175 blocks per client per day) confirms that the average individual would never be able to make informed choices about whether or not individual companies can collect their data," it said. "This also highlights how tech companies need to do more if they are really serious about privacy, rather than push the burden onto their customers."

Firefox 70 also updates Lockwise with the ability to generate strong passwords, a new dashboard that makes it easier to manage stored passwords and syncing to mobile devices. Additionally, it automatically strips "path information from the HTTP referrer sent to third-party trackers," so it can offer even more private browsing.

More information is available in Firefox 70's release notes. Mozilla said it improved the browser's security, addressed a few bugs and made other tweaks meant to bolster Firefox's performance. 

The privacy updates are the real draw, though, and the Privacy Protections report should make it clearer than ever why that's the case.

Update, 10/07/2019 2:45pm PT: Intel has provided us with the following statement, indicating a fix is on the way:

“The reliability of our products is a top priority for Intel. Under a complex set of micro architectural conditions, end users may potentially experience application crashes on systems based on Intel Pentium Silver and Intel Celeron Processors (codename Gemini Lake). Intel has released a microcode update to our customers and partners that mitigates this issue, and is working with them to make it available to end users.”

Original Article, 10/07/2019 8:50am PT:

Phoronix reported that Google and Mozilla have been experiencing many "impossible" crashes on Intel Gemini Lake-based processors. These crashes have been confirmed to happen on Chrome and Firefox when using the 64-bit version, and other software might also be affected. Google and Mozilla have investigated the issue and devised a workaround for it.

For anyone unaware, Gemini Lake is Intel's Atom-based low power solution for cheap mobile devices, primarily laptops. It is not like Intel's mainstream Core architecture (currently represented by Sky Lake, Coffee Lake, Cascade Lake, and Ice Lake), so the bugs present in the handful of Gemini Lake-based processors that exist should not be present in Intel's other offerings, like the Xeon and Core families.

Google started its investigation in May and by September had issued a workaround based on forcing the processor to read instructions without "crossing select 16-byte boundaries." Mozilla, the parent of the Firefox browser, also investigated and discovered the issue was introduced by a microcode update, meaning there is likely no inherent hardware issue causing the problem.

The easiest solution to the issue is switching to 32-bit programs, but now that 32-bit is getting phased out, you might have some trouble finding 32-bit versions of some software. Luckily, as this is likely just a microcode issue, Intel might be able to fix it without needing to issue a hardware revision.

We've reached out to Intel for comment on the matter and will update as necessary.

Google announced that Chrome 76 would deprecate the FileSystem API starting with July 30. The API has been giving some media publishers and other companies the ability to detect when someone uses the Incognito Mode and bypass it (thus tracking the user and defeating the purpose of the Incognito Mode). 

Google adopted the FileSystem API in Chrome when it was still an IETF draft to allow Chrome Apps and extensions to store their data locally on a PC almost a decade ago. However, the IETF draft was never ratified, nor was it adopted by the W3C, which left Chrome as the only major browser to support it. Firefox and other browsers moved on to support IndexDB for local storage.

Google disables the FileSystem API in Incognito Mode so that users don’t leave traces of their browsing activity when in Incognito Mode. However, years later, publishing sites that use paywalls for their articles while giving away a few stories per month for free have begun (ab)using the FileSystem API to block people from reading too many of their stories for free. The publishers can detect who uses Incognito on Chrome because they can detect if the FileSystem API is not present in the browser.

Google argues that the publishers’ soft paywall model of detecting how many stories each individual has read by tracking them through browser cookies was already porous as users have had multiple ways of eliminating those cookies from their browsers and reset the free story meter.

The company also recommended publishers not to be too reactive to the change and eliminate the free stories for everyone as a consequence of not being able to detect who uses the Chrome Incognito Mode anymore. Google re-emphasized that the goal of the Incognito Mode was to allow users to browse privately. They can’t do that if other companies can detect when they use the Incognito Mode, defeating its purpose.

Although Google is fixing a privacy loophole that has existed in its browser's Incognito Mode for almost a decade, it still seems to consider browsing on the internet an "option" it wants to give users. Meanwhile, other browsers such as Firefox, Safari, Brave, and even Microsoft's new Edge browser are all much farther along in the privacy protections aspect than Chrome is.

Firefox, Safari and the new Edge all have some kind of tracking protection enabled by default, while Brave (created by former Mozilla CEO and JavaScript inventor, Brendan Eich) offers adblocking and third-party tracking also enabled by default, along with a more advanced Tor-based private mode that Mozilla has also promised for Firefox.

Windows 10 on Arm users might finally have something to look forward to: Thurrott reported on June 6 that the new Chromium-based Edge browser for ARM64 devices leaked. That should mean the official release isn't too far off, which means Arm-based devices could soon have a decent browser option.

Microsoft has been trying to make Windows 10 on Arm happen for a while now. (Almost as long as Gretchen Wieners tried to make "fetch" happen in "Mean Girls.") But the effort has faced numerous obstacles, from products not performing up to the expectations set by their prices to devices shipping with a version of Windows 10 that didn't technically support them, that have all contributed to x86 processors remaining the CPUs of choice.

Browser support is another of those problems. People had to use emulated versions of popular browsers, which meant they didn't perform as well as expected. Things are improving on that front, though, as Microsoft and Google reportedly worked together on a version of Chrome for Windows 10 on Arm while Mozilla worked on a native version of Firefox for the platform. Yet tests for the new Edge browser started in April without ARM64 support.

Thurrott reported that a leaked version of the Microsoft Edge Canary test browser fixes that problem. The leak isn't available from Microsoft's servers--it has to be downloaded from an outside source--but it's reportedly legit. Just be warned that installing pre-release software can always lead to problems, and one should demonstrate caution before installing a leaked version of an upcoming app from a source they might not know particularly well.

Solving the browser problem could go a long way towards making Windows 10 on Arm more viable. Most people spend a lot of time in their browsers, which is why Google's original Chromebooks were basically hardware shells for a browser window, and having to deal with poorly performing browsers could significantly dampen their excitement for a system. There are still other problems to solve, but at least progress is being made on this one.

The addition of ARM64 support could also mean the new Edge is closer to release. Microsoft announced in December 2018 that it planned to use the open source Chromium project--which provides the foundation for Google Chrome--in a new version of Edge. The company introduced add-ons for the browser in March, started broader testing in April, and then announced in May that it would also make Edge available for macOS for the first time.

Coca-Cola used to be a cocaine-filled beverage available in exactly one flavor. Now the company's replaced the cocaine with vanilla, orange, cherry, diet, zero calorie, and who-knows-how-many combinations of each flavor. Mozilla's taken a similar approach with Firefox: It started as just a simple web browser, yet today the organization announced updates to its wide variety of privacy-focused features and services.

The first update introduces Enhanced Tracking Protection that blocks third-party tracking cookies by default. Mozilla said the feature will rely on a list of known trackers maintained by Disconnect and that, if everything works as expected, it should result in Firefox automatically blocking thousands of the technological creeps without user intervention. Sites can also be white-listed in case something breaks.

Facebook Container is like Enhanced Tracking Protection with a very specific target. (Kinda like how Coca-Cola took the very broad market of "people who like Vanilla Coke" and then decimated it by combining it with orange flavoring.) The add-on is made simply to prevent Facebook from tracking people's browsing activity, and Mozilla said it's been installed more than 2 million times since its March 2018 debut.

Today's update to Facebook Container allows the add-on to stop Facebook's trackers from working on sites that use its Share and Like buttons. Facebook Container stops those buttons from loading, which in turn prevents Facebook from indirectly gathering information about someone, with Mozilla claiming the add-on would make it much harder for the social networking company to create "shadow profiles."

Mozilla said the Enhanced Tracking Protection and Facebook Container updates are available now. (Enhanced Tracking Protection will roll out to all Firefox users in the coming weeks; it can also be manually activated in the browser's settings.) The only indication that either feature is active on a given site will be a green shield (Enhanced Tracking Protection) or purple fence (Facebook Container) icon in the address bar.

The organization also headed outside the browser with updates to the Firefox Lockwise--nee Lockbox--password manager and Firefox Monitor. In addition to rebranding the password manager, Lockwise brings the Lockbox ecosystem from Android and iOS devices to the desktop. It works like one would expect--people can use it to manage a saved list of passwords and then access those passwords anywhere.

Firefox Monitor debuted in September 2018 as a service that allowed people to receive notifications if their emails were hacked. The feature was developed in collaboration with the Have I Been Pwned? breach disclosure website. Rather than having to manually check the site whenever they fear a new data leak has occurred, Firefox Monitor users would get an email as soon as a monitored account was affected.

Mozilla said that more than 635,000 people have signed up for Firefox Monitor since its release. Now the organization has updated it with a "breach dashboard" that can be used to keep track of multiple email addresses. That was said to be one of the most-requested features for Firefox Monitor. Now it's here! And, unlike the Vanilla Orange Coke we mentioned earlier, we suspect its debut will be universally lauded.

Microsoft is taking a step towards ending the password with Windows Hello. The company announced at its Build developer conference in Seattle today that as of the Windows May 2019 Update, its secure login tech will be FIDO2-certified for passwordless logins.

Adherence to the FIDO2 specification will make millions of PCs - primarily laptops with Windows Hello facial and fingerprint recognition built in, but also any Windows 10 PC with a PIN - closer to ditching passwords. Instead, Windows Hello will let users log into supported apps and websites. 

At a technical keynote, Aashima Narula, principal group engineering manager for Microsoft Identity showed password free login with Windows Hello and authentication codes for personal and professional accounts. She said developers need to use no extra code to add this feature. Apps have to be registered with Microsoft Identity.

And you won’t be forced to use Microsoft’s Edge browser to get the benefits. The company said that once it’s ready on Edge for Windows 10, it will also support Mozilla Firefox and “other browsers.” Microsoft didn’t come out and say it will be ready for Chrome, but with Edge moving to Chromium, we think it’s a safe bet.

Firefox support will be available with the release of Firefox 66, with other browsers getting the option later in 2019, the company said.

This summer, gamers will be able to download Firefox Reality, Mozilla’s browser for VR and augmented reality (AR), from SteamVR. The browser is already available through the Oculus, Google Daydream and HTC Vive Viveport store.

Firefox’s head of mixed reality strategy, Andre Vrignaud, made the announcement via a blog post today, saying that since HTC Vive headsets received the browser in January, Mozilla’s been working with Valve to bring Firefox Reality to SteamVR.

Notably, Valve also announced today that it will start shipping its own VR headset, the Valve Index, this June. Clearly, Valve’s interest in the browser was not just about making Firefox Reality accessible to SteamVR users, but also about ensuring its Index HMD has the same capabilities as its competitors.

“With a few simple clicks, users will be able to access web content, such as tips or guides or stream a Twitch comment channel, without having to exit their immersive experiences,” Vrignaud said in the blog post.

He added that users will only need to log into Firefox once in order to share bookmarks and cookies between Firefox Reality and Firefox on a PC.

Those eager to download Firefox Reality via SteamVR can sign up to receive a notification when it’s by going to the Steam store and adding the browser to their Wishlist.

You can get a taste of Firefox Reality for SteamVR in Mozilla's video below:

Mozilla announced that the latest Firefox beta is now available for Windows 10 devices that are powered by Qualcomm’s 64-bit Snapdragon Arm processors. Mozilla has been working with Qualcomm on this Firefox port since December of last year.

Firefox Quantum on Windows 10 Arm-Powered Devices

“Project Quantum” was Mozilla’s effort to overhaul and rejuvenate its browser with high-performance and memory-safe components written in the Rust programming language. The overhaul is now paying off in more ways than one, as the Rust programming language has allowed Firefox to become much more optimized for multi-core systems.

This is good news for Firefox, perhaps to the detriment of competitors, because computing systems are now starting to have a high number of cores, including on mobile devices. Smartphones with eight CPU cores are basically available at almost every price range today, while on the desktop AMD has made the case that mainstream systems should come with at least six or eight CPU cores, instead of only two or four.

Windows 10 on Snapdragon

Qualcomm’s Snapdragon processor is the main Arm-based platform to support the full version of Windows 10, unlike previous “Windows RT” devices that only supported Universal Windows Platform applications. Qualcomm has been working with Microsoft for the past few years so that Windows 10 can run with high performance and high efficiency on 64-bit Arm chips.

Now, Qualcomm has also started to work with developers of popular applications, such as Mozilla, to port their apps to the 64-bit Arm architecture on Windows 10. Firefox already supports Arm-based Android devices, as well as iOS devices and Amazon’s Fire TV.

Mozilla encourages those that want to try the latest Firefox beta on their own Snapdragon Windows 10 devices to report bugs and crashes so that the organization can improve the application for everyone more quickly.

Updated, 3/19/19, 7:30am PT: Mozilla has released Firefox 66 to the public. In addition to blocking auto-play content, the release introduces support for web authentication using Windows Hello, scroll anchoring to prevent web pages from jumping around when additional content loads, and various improvements to search. More information about Firefox 66 can be found in the release notes on Mozilla's website.

Original article, 2/5/19, 7:54am PT:


Many of us can hardly remember a time when visiting a website didn’t result in a pop-up requesting permission to send notifications, a fly-over snidely prompting us to sign up for a newsletter and at least one video that starts playing as soon as the page loads. Mozilla announced today that it wants to address one of those problems by preventing videos from automatically playing in its upcoming Firefox 66 browser. 

Firefox 66 is expected to debut on March 19, and when it does, it will stop any source of audio from playing until you ask it to. Muted videos will continue to play automatically—much to the chagrin of people who don’t have the RAM to spare.

There are some exceptions. The most important one is for sites that Firefox users “whitelist” themselves.

“There are some sites on which users want audible autoplay audio and video to be allowed. When Firefox for Desktop blocks autoplay audio or video, an icon appears in the URL bar. Users can click on the icon to access the site information panel, where they can change the ‘Autoplay sound’ permission for that site from the default setting of ‘Block’ to ‘Allow’. Firefox will then allow that site to autoplay audibly. This allows users to easily curate their own whitelist of sites that they trust to autoplay audibly," Mozilla explained. 

Firefox 66 will also let sites that people have allowed to access their camera or microphone to automatically play audible content. This is supposed to ensure “that sites which have explicit user permission to run WebRTC should continue to work as they do today.” 

The initial version of this tool will only block audio played via HTMLMediaElement. Audio served via the Web Audio API won’t be blocked via the initial version of this tool because Mozilla hasn’t finalized its implementation for that feature. However, Mozilla said  “we expect to ship with autoplay Web Audio content blocking enabled by default sometime in 2019.” Until that happens, Firefox 66 will only block a portion of the annoying noises emanating from web pages, (and yes, we understand that Tom’s Hardware is throwing a stone inside a glass house).

Mozilla officially released Firefox Send today. The file sharing service uses end-to-end encryption to keep shared files private.

Firefox Send has been available as a “Test Pilot” experiment since August 2017, but it took Mozilla some time to iron out all the kinks and ensure that the service will work for more than a handful of people at a time.

Users’ files are first encrypted in the browser and then stored in the cloud, so Mozilla will have to pay for both the bandwidth and the storage of those files. The upside is that the files are ephemeral, as they delete themselves as soon as the intended recipient finishes downloading the file. That means Mozilla doesn't have to hold large files indefinitely, as other file storage services, such as Google Drive or Dropbox, do.

Private File Transfers

Nowadays, just about every file sharing service keeps the users’ uploaded files unencrypted, or they may even mine the users’ data for information the services could use to target you with more personalized ads. There are few tools or services out there that can keep users’ files truly private. Firefox Send aims to use not just the trustworthiness as a Mozilla as a privacy-focused, non-profit organization, but also in-browser end-to-end encryption to keep users’ files private.

Unlike most other file sharing services, Firefox Send doesn’t encrypt users’ data after it arrives on the company’s servers (thus allowing the company itself or anyone with access to that company’s servers to see what’s in the files), but before, on the user’s local machine.

The files can’t be decrypted neither in transit to the servers nor after they’ve arrived on the servers. Only the sender has access to the files and the intended receiver of the files, who will be able to decrypt the files automatically when they finish downloading.

Firefox Send allows you to send files up to 1GB in size, and you can also upload files as large as 2.5GB if you sign-up for a Firefox account.

Learn more via Mozilla's video below. 

Mozilla announced that it’s been working on a new security-related project for Firefox, called “Project Fission” (not to be confused with “Project Fusion,” the merger between Firefox and the Tor browser) that aims to protect users against existing and future Spectre attacks, as well as other potential vulnerabilities.

Project Fission, Milestone 1

Mozilla assigned the Project Fission codename because it will try to “split the atom,” so-to-speak. The nonprofit is aiming to isolate not just the UI and content of a web page, but also the various domains that may connect to it.

This would ensure that a website’s data would be out of reach for attackers exploiting speculative side-channel attacks, such as Spectre and Meltdown. Spectre-class attacks allow an attacker to exfiltrate data stored in memory from other applications or web pages.

The damage caused by malicious JavaScript code injected into sites from other domains should be more limited once Project Fission is fully enabled. Google’s Chrome enabled a similar protection, called Site Isolation, last year.

Mozilla announced that it would achieve the first milestone for Project Mission by the end of this month. This will include support for out-of-process iframes, meaning that iframes will render within a different process than the one of the parent web page.

Revamping "Electrolysis"

Project Fission is a revamp of the multi-process "Electrolysis" architecture that Firefox adopted back in 2016. Initially, the Electrolysis architecture would isolate only the UI of the browser from all web content.

Later on, Mozilla enabled an additional three sandboxes/processes, for a total of 5 by default: one for the UI, and four for various web content. Users were also able to customize how many content sandboxes they wanted their Firefox browser to have.

At the time, Mozilla argued that even though this architecture was not as strict as Chrome’s “one process for each tab or extension” architecture, this was an advantage due to the lower memory requirements. Chrome has long been criticized for using too much memory.

However, it now seems that both Google and Mozilla have learned that these architectures were not strict and secure enough and that the isolation will need to go even deeper to a more granular level within a website’s content. In a world where most CPUs don’t come with hardware mitigations against speculative attacks, this is what is now required to protect users properly.

It looks like Google is finally adding “drive-by” download protection to its latest Chrome 73 browser version. Due for release in either March or April of this year, possibly along with the controversial adblock changes, Chrome will no longer allow hidden iframes to activate, and potentially download files directly to your PC without user consent.

Although a security feature already offered in Mozilla’s Firefox and Microsoft’s Edge internet browsers, at least since 2015, it’ll be another feather in Chrome’s market leading cap for sure.

As ZDNet reports, it’s understood that, according to Google, roughly 0.002117% of web pages accessible through Chrome, are infected with drive-by downloads, potentially installing malware, and other malicious programs onto unsuspecting user’s systems. Although that is seemingly a minute percentage, if you consider the fact that there’s an estimated 1.952 billion websites currently out there, that equates to 41,327 separate compromised domains, or at least at time of writing.

Although this change no doubt comes as a relief to many, it’s worth noting that if malicious entities still have access to the compromised site, all they need to do is allocate the iframe attribute into the source code once more and, instruct Chrome to disable the drive-by protection for those iframes.

This protection should be coming to all versions of Chrome 73, except that found on Apple’s iOS, as it doesn’t take advantage of the Chromium web engine. Also you can expect to see this make its way to both Opera, and the soon to be released Chromium version of Microsoft Edge as well some time during the year.

A Windows Central report Monday claimed Microsoft is replacing the EdgeHTML rendering engine in its Edge browser with Blink, a rendering engine from Chromium, the open source version of Google Chrome. Google forked Blink from Apple’s open source WebKit rendering engine, which is used by the Safari browser and previously by Chrome and other Android browsers. 

According to Windows Central’s anonymous sources, Microsoft intends to replace the Edge browser with a new browser code-named Anaheim on the Windows 10 operating system. It’s not clear if the new browser would keep the Edge brand name or get a new name. It’s also unknown whether or not the new browser will use the Edge UI. 

Microsoft has already made this move on Android and iOS, where its Edge browser uses the Blink and Webkit rendering engines, while using the Edge UI on top. When Microsoft’s Sean Lyndersay, the Principal Program Mananger Lead for Edge, announced the Android and iOS browsers last year, he said the company is committed to EdgeHTML, despite its replacing it with Blink and WebKit on Android and iOS.

"Part of our strategy with EdgeHTML is to build an engine that, instead of replicating (and, in some senses, competing with) the underlying platform, integrates and works with it to deliver the best possible security, accessibility, battery life, interactivity, just pure raw performance on that platform. We are proud of the work we’ve done with EdgeHTML on Windows 10, all while driving the web forward with new capabilities and supporting interoperable standards. We are fully committed to continuing to do so into the future, across the full spectrum of Windows 10 platforms and form factors."

If the new report is true, that commitment to EdgeHTML has all but disappeared, as EdgeHTML will live in nothing but name (if that) inside all of Microsoft’s browsers, as Microsoft replaces it on each platform with either Blink or WebKit.

Chromium Dominance

Chrome and other Chromium-based browsers, such as Opera and other Android browsers, already dominate in browser market share. Some, including Mozilla developers, have been worried that as Blink and WebKit’s (a very similar rendering engine to Blink) market share increases, developers will have no interest in testing their websites on other browsers.

Steve Fink, a developer working for Mozilla on performance and tooling issues, warned back in 2013, right after Opera switched to WebKit (and later to Chromium/Blink), that rendering engine monoculture will create a myriad of problems for the web, including:

• WebKit bugs becoming part of the web platform because fixing them would break too many websites at once
• A slow down in innovation
• Giving third-parties, such as music studios, more control over what features can be developed for the web
• Feature bloat

This warning came five years ago, but not too many web developers (or browser users) took heed. Therefore, it may now be too late to do anything about it, and it may also be why Microsoft is reportedly planning to replace EdgeHTML with Blink.

Usually, lack of competition is a negative for end users. However, it’s a little different for open source projects because they aren't usually controlled by a single entity. And if they are, other people can just fork them and develop their own version.

However, if even a company like Microsoft is no longer willing to develop a new rendering engine or a fork of an existing open source rendering engine, then it may no longer be practical enough to fork such large projects. Therefore, the future of the web may depend on how Google and Apple continue to develop the Blink and WebKit rendering engines.

Mozilla this week announced a partnership with ProtonVPN, the virtual private network (VPN) service offered by the same company behind ProtonMail, the popular end-to-end encrypted email service.

What Is A VPN Service?

The company said that many of its users have consistently asked for a solution to protect their privacy on public networks such as those offered in cafes and airports.  A VPN is a secure tunnel through which your internet traffic passes. It’s most useful when the vites you visit don’t use HTTPS encryption.

Sometimes, even HTTPS encryption is not enough if an attacker can interpose themselves between you and the site you intend to visit as a “man-in-the-middle.” An HTTP Strict Transport Security (HSTS) server policy can protect against that, but most websites don’t yet make use of it. A VPN obviates the need for either HTTPS or HSTS.

Mozilla will start offering the ProtonVPN service for $10 a month (the “Plus” version of the ProtonVPN service) starting with October 24. The majority of the revenue from the subscriptions will go to Mozilla, while the rest will go to ProtonVPN to pay for the operating costs of the service.

Mozilla to Offer ProtonVPN in Firefox

Mozilla said that over the next few months it will run an experiment in which it will offer the ProtonVPN service to a small group of Firefox users. These users would have to sign-up for a $10 per month ProtonVPN subscription and then download the application for Windows, macOS, Linux, iOS, or Android. The VPN software can be disabled and enabled at will and the subscription can also be cancelled at any time.

Offering a VPN service seems to be a synergistic move for Mozilla, in the sense that it both furthers the company’s privacy focus and it also provides it with an alternative revenue source. Mozilla makes it money primarily from search services - in other words, from Google, which is also Mozilla’s primary competitor in the browser space. It makes sense for Mozilla to diversify its revenue sources, especially if the new sources don’t depend on advertising and tracking users.

Why Mozilla Chose ProtonVPN

Mozilla said that its security team considered a “long list of market-leading VPN services. Our team looked closely at a wide variety of factors, ranging from the design and implementation of each VPN service and its accompanying software, to the security of the vendor’s own network and internal systems. We examined each vendors’ privacy and data retention policies to ensure they logged as little user data as possible." Mozilla also considered other factors, such as track record, transparency and quality of support, it said. 

At the end of this evaluation, Mozilla selected ProtonVPN, which is operated from Switzerland, a country with strong privacy laws, is operated by a well known privacy-focused company, and also has an easy-to-use interface.

Apple, Google, Microsoft and Mozilla all announced today that they will disable TLS versions 1.0 and 1.1 in their respective browsers by default by the first half of 2020. The TLS protocol is what browsers, instant messengers and even email servers primarily use to secure communications.

TLS 1.0, 1.1 Deprecated

Over the past few years, we’ve seen new attacks that exploit weaknesses in the design of the TLS 1.0 and TLS 1.1 protocols and algorithms that were used alongside them. These attacks include BEAST, which allows malicious actors to steal the TLS authentication tokens, Logjam and FREAK, which allow attackers to downgrade the security of a connection to a server, as well as insecure hash functions, such as MD5 and SHA-1.

In addition to all of this, the TLS 1.2 protocol is more than a decade old, so both browsers and web developers have little excuse not to use it by now. Earlier this year, the IETF also finalized the TLS 1.3 specification, which further streamlines and upgrades the TLS protocol to be stronger and less easy to break cryptographic algorithms.

What Is the TLS Protocol?

The TLS (stands for Transport Layer Security) protocol is an upgrade to the previously used Secure Sockets Layer (SSL) protocol. Netscape invented SSL because it realized that at least some uses of the internet required secure communications over computer networks.

Netscape kept SSL 1.0 private because it later learned it was deeply flawed. The company made SSL 2.0 public in 1995, but outside security researchers proved soon afterwards that it also had many flaws. In 1996, cryptographer Paul Kocher together with Netscape released version 3.0 of SSL, on top of which TLS 1.0 was developed in 1999. TLS 1.1 came in 2006 and TLS 1.2 in 2008.

Chrome 72 will stop supporting TLS 1.0 and 1.1 in the first half of next year, while Apple’s Safari, Mozilla's Firefox and Microsoft’s Edge and Internet Explorer 11 browsers will drop support for the two protocol versions a year later, in the first half of 2020.

People browse the web on practically every device they own. Mozilla knows that as well as every other browser maker, which is why Firefox is available for PC, mobile devices and, as of today, the Viveport, Oculus and Daydream platforms via the new Firefox Reality browser.

Firefox Reality is based off the Firefox Quantum core Mozilla developed for mobile devices. The organization said this allows its browser to perform well on VR, AR and mixed reality devices because it doesn't expect the full power of a connected PC to be devoted to browsing the web. Firefox Reality also features private browsing, just like other versions of Firefox, if you don't want someone knowing what you're up to in VR.

Mozilla said the rest of the browser was designed with VR, AR, and mixed reality headsets in mind. Firefox Reality windows are presented on top of a cutesy woodland background and support for voice search means you won't have to use the on-screen keyboard too much (though it's still an option when you're, ahem, browsing in private).

That's about the extent of Firefox Reality's current VR, AR, or mixed reality-specific features. The browser's also missing some basic tools, like bookmarks and Firefox Account support, but Mozilla said it plans to release those features and 360-degree video support "in the coming months." The organization is also calling for immersive content creators to share what they're working on to see if they can be promoted in the browser.

Those promotions could hint at Mozilla's real plans for Firefox Reality. The organization said it's "working with creators around the world to bring an amazing collection of games, videos, environments and experiences that can be accessed directly from the home screen." Offering easy access to those immersive experiences could allow Firefox Reality and Mozilla to make the web a more viable platform for that kind of content.

Currently, developing for a specific platform is a lot like releasing something on a video game console. Large developers can probably afford to develop their product for multiple platforms, but smaller outfits will likely have to focus on a single platform. This creates a disparity in content that the web (as well as standards like OpenXR) could fix. 

This is just version 1.0 of the browser; Mozilla said that version 1.1 is "right around the corner." People who want to contribute to the project can do so via GitHub or the organization's support website. In the meantime, Mozilla will continue to court devs so it can bring more immersive experiences to the web.

You can download Firefox Reality from the Oculus Store, Play Store and Viveport store by searching for "Firefox Reality."

Mozilla, the nonprofit behind the Firefox browser, announced that it hired Alan Davidson, a former Google executive and Commerce Department digital director as its new vice president of global policy, trust and security.

Defending the Open Web and Privacy

Mozilla said that it hired Davidson to be in charge of issues such as the company’s policies, trust and security work, compliance and investigations. In his role, Davidson will defend the open web, net neutrality, and user privacy, according to the company.

Davidson will report directly to Denelle Dixon, Mozilla’s Chief Operating Officer, who said:

“At a time when people are questioning the impact of technology on their lives and looking for leadership from organizations like Mozilla, Alan will add considerable capacity to our public policy, trust and security efforts, drawing from his extensive professional history working to advance a free and open digital economy.”

Public Policy Experience

This is not Davidson’s first time working with Mozilla. From 2017 to 2018, he worked with Mozilla as a Tech Fellow on advanced policies and practices to support the nascent field of public interest technologists. These are experts in technology and public policy that will need to guide the society through the coming technological challenges posed by artificial intelligence, autonomous vehicles, blockchain, etc.

Previously, Davidson was the first director of digital economy at the U.S. Department of Commerce, as well as a senior advisor to the secretary of commerce.  Penny Pritzker, the former United States secretary of commerce, called Davidson a “tremendous asset to the Commerce Department in our groundbreaking work to promote a strong and prosperous digital economy for all Americans.”

Before this, Davidson worked as a director of New America’s Open Technology Institute, and prior to that he opened and grew Google’s Washingon D.C. office, where he was in charge of the company’s public policy and government relations.

Over the past few years, Mozilla has increasingly focused on promoting the open web and building privacy features into Firefox for its users. More recently the company announced that it will block trackers by default. Davidson should have a primary role in further enhancing Mozilla’s image as an organization that fights for the users’ interests.

Doctors spend a lot of time figuring out the differences between a patient's symptoms and their actual problem. A fever needs to be treated, sure, but it's also just the body's way of indicating the presence of an underlying issue. Mozilla announced today that it wants upcoming releases of Firefox to address the real issue many people have with browsing the web--hidden trackers built into pretty much every website--instead of just relieving the symptoms.

The most obvious symptom of internet tracking is the weirdly personal and oddly persistent advertisement. Sometimes it seems like the same ad, which just happens to relate to something you were discussing with a friend not that long ago, is appearing on every single website. That's because so many websites use tracking with the express intent of showing more relevant ads.

Tracking also makes it take longer for web pages to load. Not everyone who uses some form of ad-blocker does so because they want to protect their privacy; some just want to make browsing the web faster. In today's announcement, Mozilla cited a study by Ghostery showing that 55.4 percent of the time it takes to load a web page was spent loading third-party trackers. Note, however, that Ghostery's business relies on blocking trackers.

Those are just two obvious symptoms. According to Mozilla, "many of the harms of unchecked data collection are completely opaque to users and experts alike, only to be revealed piecemeal by major data breaches. In the near future, Firefox will—by default—protect users by blocking tracking while also offering a clear set of controls to give our users more choice over what information they share with sites."

The company's going to release a series of features to Firefox meant to help address the problem of internet tracking. The first will automatically block trackers that slow down page load times, with a shield study in September leading to a full release in Firefox 63 if all goes well. The second will prevent cross-site tracking. It's already available in Firefox Nightly, will be tested in September and is meant to debut with Firefox 65.

The final new feature is devoted to "mitigating harmful practices," including "fingerprinting" users based on the devices they use to make it easier to monitor their activity on multiple websites. It also includes the increasingly common practice of deploying cryptocurrency mining scripts, or cryptojacking, to mine cryptocurrencies like Ethereum without visitors' knowledge or consent. There's no timeline for this feature's debut.

All of these updates should help Firefox users feel better about browsing the web. Mozilla said it can't totally cure the problem, but it can at least make sure people are protected by default and that website operators ask permission to track people instead of just doing it automatically. As companies like Google face increasing scrutiny for their monitoring practices, Dr. Firefox is here to treat as many problems as it can.

A team of Belgian researchers has discovered some new online tracking techniques that can bypass most existing anti-tracking tools by exploiting design and implementation flaws in how browsers manage cookies.

Breaking Cookie Policies

Anti-tracking tools, such as Firefox’s Tracking Protection and certain ad-blockers with such features, typically rely on well-behaving advertisers that follow browsers’ standard cookie policies. However, what happens if some advertisers try to bypass those cookie policies? That’s the question that the Belgian researchers asked themselves too.

As it seems, if trackers can circumvent the standard cookie policies, then they can also evade anti-tracking tools. The group said:

"In our research, we created a framework to verify whether all imposed cookie- and request-policies are correctly applied. Worryingly, we found that most mechanisms could be circumvented: for instance for all ad-blocking and anti-tracking browser extensions we discovered at least one technique that could bypass the policies.”

The researchers tested seven browsers, 31 ad-blockers and 15 anti-tracking extensions. They identified seven techniques that could be used to bypass all of these anti-tracking tools.

These techniques exploit:

• The deprecated but still supported AppCache API, as well as its successor, the ServiceWorker API
• JavaScript used in PDF files
• HTML tags
• Response headers
• Various redirects
• Some JavaScript APIs

Mitigation

The researchers reported all of the flaws to the browser vendors, and most of them should be fixed soon. Some of them, such as the AppCache API, will not be fixed because it’s already deprecated, so it will soon no longer be used.

Other methods, such as tracking through embedded JavaScript code inside PDF files that are opened in Chrome’s PDF viewer, can’t be mitigated, so it will not be fixed. Chrome’s sandboxing doesn’t allow any extension to intercept data from other extensions, which means extensions (including anti-tracking tools) won’t be able to block trackers embedded in PDF files either.

For this research, the Belgium academics won the Distinguished Paper prize and the Internet Defense Prize at the Usenix Security Symposium in Baltimore, Maryland, this week.

Most people notice when their homes are broken into. How could you not? There's often some form of property damage, disheveled possessions, or, plainly, items missing. Knowing you've been digitally compromised, however, is much harder. That's why Mozilla partnered with Cloudflare and Have I Been Pwned? (HIBP) on a new Firefox Monitor security tool that promises to securely check to see if your accounts have been hacked.

HIBP already lets you enter your email address to see if it's present in databases publicly released by hackers. Firefox Monitor aims to make searching HIBP even more secure and to expand the service's audience to hundreds of millions of people.

Mozilla said Firefox Monitor was also designed to prevent third parties from learning your email address as you search, so no one will know you're afraid you've been attacked.

Mozilla said it plans to test Firefox Monitor with roughly 500,000 people, mostly in the U.S., to start and that this will be limited to the experimental Firefox Quantum browser. It will eventually expand to all Firefox users, presumably after Mozilla, HIBP and Cloudflare see how the first iteration of the tool works out. 

You can learn more about the technical details from blog posts by Mozilla and Cloudflare.

HIBP creator and operator Troy Hunt discussed the Mozilla partnership in a blog post of his own:

"I'm really happy to see Firefox integrating with HIBP in this fashion, not just to get it in front of as many people as possible, but because I have a great deal of respect for their contributions to the technology community. In particular, Mozilla was instrumental in the birth of Let's Encrypt, the free and open certificate authority that's massively increased the adoption of HTTPS on the web. Arguably, the work done by Mozilla's Josh Aas and Eric Rescorla (still the Mozilla CTO today) has been one of the greatest contributions to online privacy and security we've seen, and Mozilla remains a platinum sponsor to this day."

Hunt said that HIBP has also been integrated in the online version of 1Password, a password manager available on macOS, Windows and mobile devices. The utility has been included as part of 1Password's Watchtower feature, which aims to help the app's users figure out if their passwords are secure, and is likely to expand to the desktop versions of 1Password after the online implementation helps the developers work out the kinks.

The expansion of HIBP should make it easier than ever for people to find out if they've been affected by a data breach. Companies have gotten better about informing their users about breaches, but they aren't perfect, and giving people more ways to investigate their own security is always welcomed.

The Tor Project announced that it’s working with Mozilla to integrate Tor into Firefox. Eventually, this should completely eliminate the need for the Tor Browser, as most of its features would be merged into Firefox’s new “super-private mode.”

Tor Browser Development Largely Redundant

The Tor Browser is based on the Extended Support Release (ESR) version of Firefox, because it’s a more stable development cycle that only patches bugs and doesn’t add new features for 11 months or so. This means it doesn’t disrupt how the Tor Browser works too much, and the Tor Project developers don’t have to integrate many new features into their browser every few weeks.

Despite this, the Tor Project developers said that it takes a lot of time to rebase Tor Browser patches to new versions of Firefox. This is why Mozilla has started integrating Tor’s patches into Firefox on its own through the “Tor Uplift Project.”

Firefox has also adopted new security features from the Tor Browser such as first party isolation (which prevents cookies from tracking you across domains) and fingerprint resistance (which blocks user tracking through canvas elements). However, first party isolation is off by default in Firefox and fingerprint resistance can break some websites. You can enable first party isolation in about:config or by installing this add-on for it.

Enter Project Fusion

The Tor Project developers said that the main objectives of Project Fusion are:

• Fingerprinting resistance, make more user friendly and reduce web breakage
• Implement proxy bypass framework
• Figure out the best way to integrate Tor proxy into Firefox
• Real private browsing mode in Firefox: Will turn on First Party Isolation, Fingerprinting Resistance, and Tor proxy

The developers said all  these features would enable a “real” private mode in Firefox, which could completely replace the need for the Tor Browser to exist.

This “super-private mode” could be used by hundreds of millions of users eventually, which is why Mozilla first needs to ensure that the Tor network can scale with such usage. That means more people will need to run Tor relays. Mozilla may be able to help here by donating money to nonprofits that can run Tor relays.

A Firefox Competitive Advantage

The Tor Project developers said that Project Fusion has the accord of Mozilla’s CEO and CTO, which probably means it has a high chance of coming to fruition. However, many issues have to be considered first, such as developing private telemetry, fixing the problem with fingerprinting resistance breaking websites, and so on.

Additionally, Mozilla wants to first standardize the Tor client specification, write conformance tests for it, and open the documentation. All of that means that more people could look at how Tor is implemented in Firefox and see if there are any issues with that implementation.

The main reason why Mozilla would even want to integrate Tor into Firefox is because it could provide its users real private browsing, something that most competitors will not be able to offer. Mozilla has taken an increasingly strong pro-privacy stance in the past few years, and Project Fusion could further boost its pro-privacy image.

It could also put Firefox in a much more direct contrast with Chrome, a browser developed by Google, which is heavily invested in user tracking in order to serve more targeted ads.

Google announced that its security indicators for HTTPS and HTTP pages will change starting this fall, in versions 69 and 70 of Chrome. HTTPS websites will not longer be shown as "Secure," while HTTP pages will be shown as "Not Secure" in red font, when users enter data.

Evolution Of Web Security Indicators

Over the past couple of years, both Chrome and Firefox have started encouraging web developers to adopt HTTPS encryption by giving them small incentives such as showing their websites’ address next to a padlock icon with a “Secure” label in green. This was supposed to make users trust these websites more, because the data exchange between the user and the server would be encrypted.

Since then, and due in no small part to the Let’s Encrypt project, which is backed by Mozilla, EFF, and others and has been offering free HTTPS certificates to everyone, many more websites have adopted encryption.

Now, Google believes that users should expect that the web is “safe by default.” Therefore, users shouldn’t need bright green labels and padlocks to know whether or not the website they visit is secure.

Chrome 69 To Lose The “Secure” Label

Starting with Chrome 69, which should land this September, Google’s browser will lose the green “Secure” wording, and its padlock will turn from green to grey. The company added that eventually Chrome will also use the padlock, too, and all you’ll see will be the web address without HTTP, HTTPS, or any other label or symbol next to it.

It’s possible Google also doesn’t want internet users to believe that a site is “secure” just because it's using HTTPS encryption. A site could use HTTPS encryption and then still lose all of your account data to hackers due to poor server security hygiene. HTTPS encryption only guarantees that your connection to the site is secure, but it says nothing about how secure your data is on a company’s server.

Chrome 70 To Add “Not Secure” Warning In Red

Chrome 56 started showing users a “Not Secure” warning in grey on login pages. Starting with Chrome 70, this fall, users will see a “Not Secure” warning in red when they enter data on HTTP pages. The HTTP pages will also be labeled “Not Secure” in grey at all times.

Perhaps the most controversial change in Google’s announcement is Google’s statement that users should expect the web to be safe. Whether we’re talking about HTTPS, PGP, S/MIME, or other encryption and security protocols, it may not serve users to hide what protocols are being used to protect their data. At the end of the day, this is also an issue of transparency, and users deserve to know how their traffic and data are protected.

Google expects that when the “Secure” label and padlock are gone, users will continue to believe that the same sites are just as secure. However, this may not happen because users have been trained for decades to expect no security unless claimed otherwise.

The FIDO Alliance and the W3C have been working together on the FIDO2 project, which promises to allow users to authenticate their identities to websites from their desktops or mobile devices without using a password. The two groups announced that FIDO2 is now in the the Candidate Recommendation stage for W3C’s Web Authentication (WebAuthn) protocol, which is the precursor stage before the final approval.

At the same time, Yubico announced a new Yubikey that supports the new FIDO2 specifications.

FIDO2 And WebAuthn

WebAuthn has been developed as a core component of the FIDO2 project, which also includes FIDO’s Client to Authenticator Protocol (CTAP) specification. CTAP enables an external authenticator such as a security key or a mobile device to communicate strong authentication credentials over NFC, Bluetooth, or USB to a user’s primary computing device such as a PC or another smartphone.

The main idea behind the FIDO2 project was to make logging in to websites as easy and as secure as using a FIDO U2F security key, which enables public-key cryptography. The private key is stored locally on the device, while the server to which the user authenticates would receive the corresponding public key. This way, even if there is a data breach, the hackers would have no passwords to steal, which should minimize your risk of exposure online.

Brett McDowell, executive director of the FIDO Alliance, said:

With the new FIDO2 specifications and leading web browser support announced today, we are taking a big step forward towards making FIDO Authentication ubiquitous across all platforms and devices. After years of increasingly severe data breaches and password credential theft, now is the time for service providers to end their dependency on vulnerable passwords and one-time-passcodes and adopt phishing-resistant FIDO Authentication for all websites and applications.

Google, Microsoft, and Mozilla have already committed to supporting the new specifications. Microsoft was one of the first to mention it for Edge in 2015 with its passwordless login feature for Windows 10.

Apple has avoided joining the FIDO Alliance so far. However, now that the specifications are expected be standardized soon by the W3C under the WebAuthn protocol, Apple will probably also integrate them in its devices sometime in the future.

There will be two ways to implement the new specifications:

a) Simpler authenticationSimpler authentication: users simply log in with a single gesture using:Internal or built-in authenticators (such as fingerprint or facial biometrics) in PCs, laptops and/or mobile devicesConvenient external authenticators, such as security keys and mobile devices, for device-to-device authentication using CTAP, a protocol for external authenticators developed by the FIDO Alliance that complements WebAuthnb) Stronger authentication: FIDO Authentication is much stronger than relying only on passwords and related forms of authentication, and has these advantages: User credentials and biometric templates never leave the user’s device and are never stored on serversAccounts are protected from phishing, man-in-the-middle and replay attacks that use stolen passwords

New FIDO 2 Yubikey

Yubico, the creator of the Yubikey security keys typically used for two-factor authentication, is one of the co-creators of the FIDO U2F standard (along with Google). The company announced a new hardware token called “Security Key by Yubico” that supports the new FIDO 2 protocols, including WebAuthn and CTAP.

The Security Key can be used to authenticate to websites that support the FIDO2 standards directly, without needing any password. However, users can optionally enable the use of a PIN or biometric, too, to turn it into a two-factor authentication solution.

The difference between this solution and how things worked before is that the password was mandatory, and the user could only use a security key as a second-factor. Now it’s the password or biometric that’s optional.

The new Security Key by Yubico costs $20 and will start shipping globally from its website on April 13. The company will demonstrate its FIDO2 functionality at the RSA South Expo hall at Booth #2241.

The Alliance for Open Media (AOM) announced the first version of AV1, a next-generation open and royalty-free video codec, developed by major players in the technology and video streaming industries. 

A Next-Generation Royalty-Free Codec

AV1 was born out of a necessity to bring an open and royalty-free video codec to the web for which video platforms or device makers wouldn’t have to pay royalties to the Moving Picture Experts Group (MPEG), the developer of video codecs such as h.264 and HEVC. As we saw with the HEVC codec, MPEG wasn’t the only group that could ask for royalties. Other patent groups and companies came out saying that users of HEVC infringe on their patents.

The AOM brought together Google, which developed the VP9 and was working on the VP10 codec; Mozilla, which was working on "Daala"; and Cisco, which was also developing its own “Thor” codec. However, the three joined together to create one codec to beat them all, while also avoiding all the potential patent infringements. AOM’s founders’ list also included companies such as Amazon, Netflix, and Microsoft.

The IETF has also been watching closely these companies’ efforts, as it plans to make the codec an official IETF standard, that could get the name NETVC.

AV1 Specification

AOM’s announcement said that AV1 can deliver a 30% and even up to 40% greater compression over competing codecs such as VP9 and HEVC, based on multiple tests done by the alliance members.

AOM also said that AV1 will enable cross-platform 4k UHD video playback, deeper colors, brighter highlights, darker shadows, and other enhanced UHD imaging features, all while using less data.

Paul Gray, a Research Director at IHS Markit, a global business information provider, said the following:

We expect that the installed base of 4K television sets to reach 300 million by the end of 2019 and therefore there is already latent demand for UHD services over today’s infrastructure. AV1 will be widely supported across the entire content chain, especially including services. We forecast rapid introduction of AV1 content delivery to help the widespread proliferation of UHD streaming.

The release of the AV1 video codec includes a bitstream specification for future chips, an experimental software decoder and encoder to create and consume the bitstream, as well as reference streams for product validation.

AVIF vs HEIC/HEIF

Although Apple recently embraced HEIF/HEIC, and Google and Microsoft also plan to adopt it in their next versions of their operating systems, HEIC remains a proprietary format developed by MPEG, with many of the same potential issues as HEVC.

Some of the AOM members, led by Netflix, have started the development of a next-generation open image format called AV1 Still Image File Format (AVIF). The format will presumably be competitive with HEIF in terms of file size and quality but will do away with royalty and patent issues.

A More Open Web

Google’s VP8 codec, which it purchased along with On2 Technologies, never really caught on, because it took too long to achieve performance parity with MPEG’s h.264 codec. By the time it reached performance parity, MPEG’s HEVC had already arrived.

Later, although Google’s VP9 still arrived a little late on the market, it was more competitive performance wise. This along with Google’s decision to encode YouTube videos with it and convince chip makers to support it, too, helped VP9 achieve moderate success.

AV1 should succeed because virtually all the main tech players support it, it has significantly better performance than HEVC, and MPEG hasn’t had time to come up with a better alternative. Plus, all the patent issues likely didn't help. Depending on how soon Netflix and other AOM members can develop a free and open alternative to HEIF, the next-generation image format will also be an open format.

Mozilla has built an extension for its Firefox browser that can “contain” all of Facebook’s tracking and stop its trackers from following you outside of that container and around the web.

The extension uses an experimental technology that Mozilla has been developing for Firefox Nightly for the past two years, but that is also available as a separate Multi-Account Containers extension for Firefox.

Firefox Containers

Two years ago, Mozilla announced a new experimental feature called “containers” that would essentially create ephemeral browser accounts or identities within the same browser window. These containers would allow you to keep your browsing identities separate. Mozilla created four main browsing activity containers called: Personal, Work, Banking, and Shopping. 

Mozilla's containers are also a different take on Google’s own multiple browser profiles idea, which allows you to create different accounts in Chrome. However, those accounts are more permanent, and you have to use a different browser window for each one of them.

As a response to the recent Facebook and Cambridge Analytica scandal, Mozilla wanted to make things even easier for its users, so it created an extension that only enables a Facebook container that will keep all of Facebook’s tracking isolated within that container.

New Facebook Container Extension

Unlike another one of Firefox’ features, called Tracking Protection, which blocks most tracking scripts on the web, the new extension will not block the Facebook’s tracking completely, but it will isolate the tracking within the Facebook container. The advantage of something like this is that you shouldn’t experience any breaking of the web, as you can sometimes experience with anti-trackers, unless Facebook stops its service from working inside this container somehow.

According to Mozilla, when you install this extension, it will delete all of the existing Facebook cookies and log you out of the service. The next time you visit the Facebook site, it will open it in a blue-colored browser tab (a container tab). When you click on a non-Facebook link, that link will open outside of the Facebook container.

If you click on any Facebook Share or Like buttons on the web, even when browsing within other tabs, those links will open in the Facebook tab, further ensuring that all Facebook-related activity happens inside the Facebook container. As the tracking is not actually blocked within the container, the sharing or liking activity will still be recorded and sent to Facebook, as per usual.

Mozilla mentioned a couple of issues with this extension. One is that you can’t login to other websites using Facebook credentials, because the purpose of the container is to isolate Facebook from other services and websites. The second issue is that even if you may be logged into Facebook, you will not be able to see embedded Facebook comments outside of the container, for the same reason as mentioned before.

Mozilla has been slowly but steadily embracing an increasingly stronger privacy stance. The company has been adding privacy-preserving features to its browser over the past few years. Although the company’s revenue still depends on advertising, it recently also "paused" its Facebook ads over the Cambridge Analytica scandal, to let Facebook know that such data sharing practices are not acceptable. The new Facebook container extension is another step in the same direction, for the benefit of its users.

The 3dRudder is an interesting peripheral, and the company behind it keeps coming up with new reasons to own one. The newest feature to grace the foot-based input device enables you to control web content with your feet. 3dRudder today released a WebSocket server and JavaScript client that enables developers to incorporate 3dRudder control into cloud-based applications, WebVR content, and other browser tools.

Along with the WebSocket server and JavaScript client for developers, 3dRudder also released a sample Chrome extension to demonstrate the web control features' potential. 3dRudder’s Video Playback Control extension enables basic control over videos such as play/pause, forward/rewind, and volume in HTML5 video players. 3dRudder said the extension supports YouTube, Daily Motion, Vimeo, Amazon Prime Video, and Twitch, but it should also work with any other HTML5 video player.

The first version of the 3dRudder Video Playback Control extension is available only for Google’s Chrome browser. 3dRudder said that it is working on releases for the Mozilla Firefox and Microsoft Edge browsers, but the company didn’t say when those versions would be available.

Installation Procedure

To install the 3dRudder Video Playback Control extension, first make sure that you have the 3dRudder Dashboard and drivers installed. Without these, the web extension won’t do you much good. It’s also a good idea to ensure that you have the latest firmware installed on your device. Once your 3dRudder is installed, updated, and configured, you can proceed with the extension installation.

3dRudder created a tutorial page for the installation process where you’ll find links to everything you need along with instructions to install them. The first step involves installing the 3dRudder WebSocket server. Click on the download button to access RootCertificat.zip and extract it to a folder. Locate and launch the InstallRootCertificat.exe file in the folder you extracted. (Spelling errors 3dRudder's.) The installer will run in a command window. When it completes, you’ll see a prompt to “press any key to continue.” 

Next, locate the 3dRudder Video Control extension in the Chrome Webstore and click on "Add to Chrome." If you add the extension before installing the WebSocket server, it will redirect your browser to the tutorial page on 3dRudder’s website. Once you have the extension installed, locate 3dRWSServerStandAlone.exe in the folder you extracted earlier and launch it. A command window should open, and you should see “server started” followed by an IP address and a port.

With the WebSocket server running, you can now use the browser extension. You should see a 3dRudder icon in the upper right corner of your browser. Click on the icon to access the control settings, where you can adjust the input sensitivity, and remap the controls. You should see a green “server online” message at the top of this screen. If the server is offline or malfunctioning, you’ll see a red warning.

When everything's working properly, you should see a 3dRudder icon hovering over the upper left corner of the next video you watch.

Surprisingly Useful

3dRudder suggests that the use of a 3dRudder device to control videos frees your hands for other tasks such as “snacking, taking notes, or grabbing a soda.” The company could have come up with less vapid examples, but to be honest, all three suggestions lived up to our satisfaction. In fact, we were surprised at the usefulness of the note-taking concept. 3dRudder’s video control extension allows you to control video playback even if the video window isn’t active and your mouse and keyboard are accessing another application.

You can take notes in Word, and if you need to stop the clip, so you don’t miss details while you jot something down, simply rock your feet backwards to pause it without interrupting your typing. When you’ve caught up with your notes, tilt your feet forward to resume playback. You can also rewind or fast forward videos by rocking the 3dRudder to the left or the right or adjust the volume down with a twist to the left and up with a twist to the right.

Having control over video playback while accessing another application truly empowers multitasking. We also see a lot of potential for accessibility. Foot-based web navigation could be a huge benefit to people who lack mobility in their upper limbs, or amputees who are missing an arm altogether. Simple foot-based gestures to control videos are a neat gimmick to a non-disabled person, but could be a major benefit to a disabled person.

3dRudder’s video control extension is just a simple example of what you can do with the 3dRudder WebSocket server and the JavaScript client. We can’t wait to see what other web functions people create for the 3dRudder peripheral.

Two CPU architecture flaws called Meltdown and Spectre were recently unveiled to affect primarily Intel, but also ARM and AMD (Spectre-only). Microsoft, Mozilla, and Google have now come out and said that attackers could exploit these flaws through your browser. However, temporary fixes are coming soon.

Microsoft Edge

A feature called “SharedArrayBuffer” was recently introduced in the Windows 10 Fall Creators Update. This was a JavaScript performance optimization for the Edge browser that allowed different execution threads to share the same data instead of passing the data from one thread to another each time one of them needed it.

Microsoft said it will disable this feature in order to “substantially increase the difficulty of successfully inferring the content of the CPU cache from a browser process.” This will decrease the resolution of the performance.now() timer from 5 microseconds (µs) to 20µs. The variable jitter will see an additional 20µs increase.

The company added that it will continue to investigate the two CPU flaws and will also take another look at how it can implement the SharedArrayBuffer feature in a more secure way in the future.

Mozilla Firefox

Mozilla said that its experiments have proven that attackers could exploit the recently discovered CPU flaws through the browser and read user’s private information.

According to Mozilla, the new flaws allow an attacker to use precise timers in the browser to do side-channel attacks when the cryptographic algorithms are executed (also called timing attacks). Therefore, the company is taking steps to disable all the precise timers in its browser, as well as the SharedArrayBuffer feature, that Firefox also recently implemented. The resolution of Firefox’s timers will also be reduced to 20µs.

Mozilla added that it will consider reimplementing the SharedArrayBuffer feature after it experiments with ways in which to do that in a safe manner. The organization noted that the high-resolution timers are important for the future of the web platform.

Google Chrome

The Chromium team also made a similar announcement, saying that the next version of Chrome (v64), which should arrive later this month, will disable the SharedArrayBuffer feature by default and modify the behaviour of its performance.now API.

As Chrome has always focused on on a higher-level of process sandboxing compared to other browsers, it seems that Google was already working on a feature, called Site Isolation, that that protect against Meltdown and Spectre on its own. However, users will have to enable it manually at chrome://flags/#enable-site-per-process.Researchers also found earlier this year that Site Isolation is effective against many other types of attacks.

The Chromium team also laid out some mitigations that web developers can also implement on their own sites:

Where possible, prevent cookies from entering the renderer process' memory by using the SameSite and HTTPOnly cookie attributes, and by avoiding reading from document.cookie.Don’t serve user-specific or sensitive content from URLs that attackers can predict or easily learn. Attackers can load such URLs in their attack pages (e.g. ) to get the sensitive information into the process rendering their page, and can then use out-of-bounds reads to discover the information. Use anti-CSRF tokens and SameSite cookies, or random URLs to mitigate this kind of attack.Make sure your MIME types are correct and specify a nosniff header for any URLs with user-specific or sensitive content, to get the most out of cross-site document blocking for users who have Site Isolation enabled.

Apple Safari

Apple hasn’t released an official statement on how it intends to patch its Safari browser, but it seems that it has already partially patched macOS 10.13.2 against Meltdown. More fixes should be coming soon.

What we're seeing from both the kernel patches as well as the browser patches is that Meltdown and Spectre can only be fixed by incurring at least some performance penalties. To remove these performance penalties, CPU makers will likely have to redesign parts of their CPU architectures in the near future.

RISC-V (pronounced risc-five) is a brand-new instruction set architecture (ISA) that’s open to customize and free to use by anyone. The ISA is only a few years old, but both large and small companies, such as Nvidia, Western Digital, and Esperanto, are now planning to use RISC-V chips to power their products.

Why RISC-V Was Created

The initial version of the RISC-V ISA started development at the University of California, Berkeley, in 2010. The academics there wanted to develop a more modern and more efficient ISA for the 21st century that removes the legacy cruft and many mistakes built into multi-decade old instruction sets such as x86 and ARM. The researchers also wanted an ISA that is fully open and free for anyone to use for any purpose without having to pay any royalties to anyone.

In 2014, version 2.0 of the ISA was released, and that’s when many of the big players in the technology industry started becoming interested in it. If 1.0 was more of a research curiosity, 2.0 showed that the ISA could actually be used in production by large players who wanted to save money on royalties or simply wanted a much larger degree of freedom when designing their own CPUs.

In 2015, the RISC-V Foundation was created with more than 100 members and a board of directors that included companies such as Google, Nvidia, Western Digital, NXP, Microsemi, and Bluespec, as well as a representative from UC Berkeley. Since then, chip companies such as AMD, Qualcomm, and IBM have also joined the members list.

The foundation released version 2.2 of the RISC-V ISA specification earlier this year. Mozilla also recently announced that the memory safe Rust programming language, which the organization is now using to rewrite core components of the Firefox browser, supports the RISC-V ISA as a compilation target.

Western Digital Commits To Shipping “Billions” Of RiSC-V Cores

At the a recent RISC-V Workshop event, Western Digital, one of the largest manufacturers of storage devices, announced that it’s going to lead the industry in the switch to the more open RISC-V ISA by committing to ship over one billion RISC-V cores per year in its devices.

WD said that the purpose for implementing more powerful RISC-V cores into its products is that this will bring computation closer to data. The movement of the data will be minimized, which should bring increased performance and efficiency to its customers.

WD hopes that after switching all of its product lineups to using RISC-V microcontrollers, it will be able to ship over two billion RISC-V cores across its product categories.

Esperanto Promises “AI At The Edge” With RISC-V Cores

Esperanto Technologies a chip designer from Mountain View, California, also announced at the latest workshop that it will start developing energy-efficient AI chips using the RISC-V ISA.

"Esperanto's goal is to make RISC-V the architecture of choice for the most demanding AI and machine learning applications which will drive computing innovation for the next decade," said Esperanto CEO Dave Ditzel.“RISC-V is so simple and extensible that we can deliver world class TeraFlop levels of computing without needing to resort to proprietary instruction sets, thereby greatly increasing software availability,” he noted.

He also added that the company will build a 16-core "ET-Maxion" 64-bit chip, which will have single-thread performance, as well as a 4,096-core "ET-Minion" energy-efficient chip, with each core having its own floating point unit.

Dave Ditzel has a long history of supporting RISC instruction sets. He was founder of Transmeta, a company that tried to build RISC chips that could emulate x86 programs on them, and he worked on the SPARC architecture at Sun Microsystems. Ditzel also worked at Intel for six years, working on various high-performance chip projects.

Western Digital CTO Martin Fink also announced at the RISC-V workshop that they’ve made a strategic investment in Esperanto in order to help build the RISC-V ecosystem.

Nvidia Quietly Adopting RISC-V, Too

Last year, Nvidia quietly revealed that it’s going to build its next-generation GPU microcontroller on the RISC-V ISA. The new RISC-V microcontroller is expected to improve performance by more than three times compared to its existing Falcon microcontroller. The RISC-V microcontroller will also include some significant security features that the current microcontroller is lacking, which could be of use in the autonomous driving industry, for instance.

We’re not going to see RISC-V take the market by storm and compete with Intel and ARM in high-end smartphones, PCs, and servers for at least a few more years. However, RISC-V’s modern ISA, which brings high efficiency, better security, as well as the openness of the architecture combined with the royalty-free license, may prove irresistible to many companies.

Mozilla today announced the public release of the latest update to its Firefox browser called Quantum boasting that it's twice as fast as the previous version of its open-source browser.

Firefox 57 introduces a revamped user interface that introduces several new features, including square tabs, 'smooth' animations, as well as a Library that provides quick access to anything the user saves such as bookmarks, Pocket, history, downloads, tabs and screenshots. The biggest selling point, though, is the sheer speed of its latest update to the browser.

According to Mozilla’s benchmark tests, Quantum is twice as fast as Firefox 52. That performance increase is complemented by an architecture upgrade that, according to the company, uses 30% less memory than Google Chrome.

The optimization to make Firefox Quantum run as smoothly as it does is carried out through a brand new GPU-accelerated rendering engine that was written in Rust named “WebRender.” Web rendering is now carried out at 60FPS. Improvements also see the browser paint every pixel on the screen for each frame, making the web rendering both quicker and smoother.

Mozilla also applied several performance enhancements to the browser’s core, which is accompanied by a new CSS engine, Stylo, which offers better support for the nigh-ubiquitous multi-core devices used today.

Mozilla also emphasized its work on tabs. The tab a user is on gets prioritized over the rest of the tabs, which the company says consequently makes better use of one's system resources.

As for the user interface, Mozilla details: "We call this initiative Photon, and its goal is to modernize and unify anything that we call Firefox while taking advantage of the speedy new engine. You guessed it: the Photon UI itself is incredibly fast and smooth. To create Photon, our user research team studied how people browsed the web."

Those who already use Firefox should receive an automatic upgrade to Quantum after restarting their browser. If you're not currently using the browser, Firefox Quantum is available for Windows, macOS, Linux, iOS, and Android via a free download.

Lin Clark, an engineer on the Mozilla Developer Relations team, revealed how Firefox will soon become silky-smooth via a new GPU-accelerated rendering engine written in Rust called “WebRender.”

Overhauling Firefox For Performance

Over the past year or so, Firefox has undergone a major overhaul of its architecture. Firefox first switched to Electrolysis, its multi-process architecture that enabled significant improvements in performance. The user interface, content, and add-ons didn’t have to slow each other down anymore, as each could run in a different process powered by a different CPU thread.

Security should have improved significantly, too, due to the stronger isolation mechanisms, but just how much it has improved remains to be seen. We'll know more once both white hat and black hat hackers have had time to put the new Firefox to a test.

Recently, Mozilla also announced that the next version of Firefox (v57) will be twice as fast. This improvement was brought by the replacement of some core parts of the browser engine with faster and more secure (written in the memory safe Rust language) components. The project has been compared to replacing a jet engine while the jet is still in flight.

Web Rendering At 60FPS

Rendering a page refers to two processes: painting the pixels on the screen as well as the compositing of layers. To save CPU cycles and improve performance, browsers would draw certain elements of the page on different layers, and at the end the layers would be combined. This is what compositing is.

The downside to this approach is that if users scroll on the page or highlight a few words, some pixels and layers need to be drawn all over again. For the scrolling and animations to look smooth, they need to run at 60 frames per second (fps).

Clark compared this to a book of static drawings, where if you flip quickly through the pages, it would look as if they are animated. In this example, for the animation to look smooth, you would have to flip 60 pages for every second in the animation. The reason why “60” is the magical number for smooth animations is because most computer screens refresh 60 times per second.

Mozilla intends to bring 60fps rendering to its web browser, a feat no other browser can currently claim, by using GPU acceleration for both the painting and the compositing of the layers.

Allowing compositing to be accelerated by the GPU wasn’t so hard, so eventually other browsers ended-up doing that. However, doing GPU-accelerated painting was more difficult, especially for cross-platform browsers, so it’s only recently that some browsers started making this transition, according to Clark.

WebRender Works Like A Game Engine

Even with both painting and compositing being accelerated by the GPU, a performance bottleneck is still created by the division of the two processes. Mozilla aims to fix this with “WebRender,” which removes the distinction between painting and compositing. Instead, every pixel will be painted on the screen on each frame, just as it happens in PC games.

This improvement will not only make web rendering faster, but also much smoother, without any "jank." The benefits of this enhancement will be even more obvious when rendering on 4k displays or on WebVR-capable headsets.

The reason why painting the whole screen directly wasn’t done before is because it’s a more compute intensive process. In the past, a single CPU thread used to do all of the browser’s work, so it didn’t make sense to add “unnecessary” or lower priority features such as “scrolling smoothness” to the rendering engine.

However, now that browser vendors are learning how to use the GPU to accelerate their browsers, this isn’t an issue anymore. After all, GPUs are orders of magnitude more efficient at painting pixels on the screen than CPUs are.

One side benefit of Mozilla making its web rendering engine act as a gaming engine does is that Firefox could become the best browser for 3D web games. Coupled with WebAssembly, which will allow game developers to port their C++ 3D games and run them at near-native speed, Firefox could become a compelling deployment platform for gaming developers.

According to Clark, WebRender will arrive in Firefox a few versions after the initial Firefox Quantum release (v57), which could mean the first half of 2018.

Almost a year ago, Mozilla announced “Project Quantum,” which promised to bring over significant changes to Firefox’s Gecko engine from the “Servo” research project. Only an initial phase of Project Quantum has been completed so far, but Mozilla said that the new changes have already made Firefox twice as fast as it was a year ago. You can experience these changes in the new beta and developer versions of Firefox, or wait until Firefox 57 becomes stable on November 14.

Towards A Next-Generation Browser

A few years ago, Mozilla started working on “Servo,” a new web rendering engine that was written completely in Rust, a new fast and memory safe programming language whose development Mozilla is also sponsoring. The rendering engine was also written from the ground up to provide modern features such as being able to render all components of a web page in parallel on multiple CPU threads.

We can see from an older Mozilla slide below that Servo looked quite promising compared to Gecko, the old rendering engine used by Firefox.

However, Mozilla admitted that it’s not quite possible to directly port Servo to Firefox, and that instead it would have to gradually take parts of Servo and port them to Gecko over time. It’s still not clear whether or not this means that Gecko will eventually reach parity with Servo in performance and security, but Mozilla has at least implied that much of the same benefits should be seen in upcoming versions of Firefox.

Quantum CSS, DOM, And Compositor

According to Mozilla, what makes the new beta version of Firefox so fast is Quantum CSS, a Servo component written in Rust that was previously called “Stylo,” and Quantum DOM, which overhauled how Firefox prioritizes work to eliminate bottlenecks. These two components along with the fixing of 369 performance bugs are responsible for doubling Firefox’s performance compared to a year ago.

The test was done in a Speedometer 2.0 benchmark, which simulates real-world performance of modern web applications. We can see in the video below that the new Firefox seems to win often (but not always) against Chrome.

Mozilla’s engineers assure us that despite performance tuning often being in conflict with memory usage, Firefox is still able to use about 30% less memory than Chrome for the same work. This is due to Firefox’s new multi-process architecture that doesn’t isolate every website or extension in its own process and sandbox. Instead, multiple content items are put together in a single process to save memory. This can be a good strategy to lower memory usage, but it remains to be seen if it also offers similar security to Chrome in the long term.

The company also said that the new browser comes with a new “Quantum Compositor,” which will significantly reduce crashes caused by buggy graphics drivers.

Photon UI

To complement the doubling of Firefox’s performance due to all the “Quantum” improvements, Mozilla also decided to give Firefox a fresh look with a new “Photon” UI. The new UI includes redesigned menus, square tabs, and a new “Library” that includes all of your bookmarks, downloads, history, and so on. Firefox will also combine the URL and search bars into one, making it work more like Chrome in this respect.

The “New Tab” page has also been redesigned to include an “Activity Stream” that will include highlights from your recent history and bookmarks, as well as recommendations from Pocket, an application that manages articles you’ve saved to read later. Pocket was acquired by Mozilla last year and it will be integrated into Firefox 57. Mozilla noted that the New Tab page can still be customized by users via add-ons.

Firefox 57’s settings will also become searchable, making it easier to configure the browser.

More “Quantum” Features To Arrive

Project Quantum doesn’t end with the features enumerated above. Mozilla is still working on a new GPU-optimized rendering engine that could clearly put Firefox ahead of other browsers in terms of performance. The new rendering engine is called Quantum Render and is based on Servo’s WebRender. As we can see from an older benchmark, it looks quite promising.

Quantum DOM Scheduler is also a planned feature that promises to stop background tabs from slowing down active tabs.

Mozilla’s new focus on performance (as well as security and privacy), along with a fresh UI and a hint of new branding (Quantum, etc) should make Firefox a browser that will be hard to ignore by enthusiasts. If Mozilla can gain back the large number of enthusiasts that have left it for Google’s Chrome years ago, then it could be a matter of time before its market share starts growing again, too, as these enthusiasts start evangelizing the Firefox browser to their friends and family once more.

Update, 8/8/17, 6:25am PT: Firefox 55 is set to debut today with support for WebVR. Mozilla said in a developer update that WebVR support will be enabled by default on Windows, but macOS users will have to install a nightly build of the browser to use the API. You can find those builds (as well as beta and developer builds) on the Firefox website.

Original article: 6/1/17, 11:30am PT:

Mozilla announced that it will enable the WebVR API by default in Firefox version 55, due for release on August 8.

Virtual Reality On The Web

The WebVR API was born out of a necessity to enable virtual reality experiences on the web. For instance, Google Cardboard, HTC Vive, or Oculus Rift owners could use their devices to experience virtual reality content packaged by a web game or web app. This should make VR more accessible to a larger number of people, which could also make developers more interested in creating VR content.

Mozilla and Google have been working closely together for more than a year on the WebVR API. The two announced the first version of the proposed WebVR specification in March 2016. A few months later, Microsoft also announced that it would support the standard in its Edge browser.

WebVR Progress

Initially, WebVR support will arrive only on the Windows version of Firefox. Mozilla encouraged developers to use technologies such as the WebGL 3D graphics API, and tools for building VR content such as the A-Frame or React VR.

Mozilla said that in the next few months all the major browser vendors will be working to ensure their browsers pass the WebVR compliance tests. Right now, Apple doesn't seem to officially support the specification in its Safari browser, but it may be preparing an announcement at the next WorldWide Developers Conference (WWDC), which starts on June 5.

For now, other than Mozilla, Microsoft seems to have taken the lead in passing the compliance tests for WebVR 1.1. Microsoft has recently made some major VR-related announcements for its Windows Mixed Reality platform. The platform seems to focus on VR capabilities for the moment, but it could potentially expand to include support for augmented reality, too, in the future.

Version 2.0 of the WebVR specification seems to be still in the draft stage right now, and browser vendors are recommended to avoid trying to implement it before the specification is more stable.