Firefox 45.0 released [LWN.net]

Firefox 45.0 has been released. This release features instant browser tab sharing through Hello, Tabs synced via Firefox Accounts from other devices are now shown in dropdown area of Awesome Bar when searching, Synced Tabs button in button bar, introduces a new preference (network.dns.blockDotOnion) to allow blocking .onion at the DNS level, and more. See the release notes for details.

to post comments

Firefox 45.0 released

Posted Mar 9, 2016 18:55 UTC (Wed) by fratti (subscriber, #105722) [Link] (11 responses)

>introduces a new preference (network.dns.blockDotOnion) to allow blocking .onion at the DNS level

Can somebody explain to me what the purpose of this is?

Firefox 45.0 released

Posted Mar 9, 2016 18:58 UTC (Wed) by jzb (editor, #7867) [Link] (10 responses)

https://bugzilla.mozilla.org/show_bug.cgi?id=1228457

Firefox 45.0 released

Posted Mar 9, 2016 19:34 UTC (Wed) by Karellen (subscriber, #67644) [Link] (9 responses)

So I've just gone and read the RFC[0] the bug is based off, and come across:

> Applications that do not implement the Tor protocol SHOULD generate an error upon the use of .onion and SHOULD NOT perform a DNS lookup.

So, every single application that uses getaddrinfo(3), which does not natively know anything about tor, should know enough about tor that it knows to check every single name it was going to look up to see if it ends in .onion, and if it does then NOT look it up at all?

WTF? Seriously?

At this point, does it not occur to anyone to re-think their approach? Like, just off the top of my head, requesting that system libraries add an option for TOR-using applications to *opt-in* to .onion look-ups (hints->ai_flags |= AI_ONION)?

[0] https://www.rfc-editor.org/rfc/rfc7686.txt

Firefox 45.0 released

Posted Mar 9, 2016 19:52 UTC (Wed) by MoSal (guest, #103113) [Link]

Too late to the party:
https://lists.w3.org/Archives/Public/ietf-http-wg/2015Oct...

Firefox 45.0 released

Posted Mar 9, 2016 20:05 UTC (Wed) by khim (subscriber, #9252) [Link]

Your suggestion would work for tiny percentage of population - users of Linux distros who regularly update system libraries.

Firefox change tries to fix the issue for the other 99% of the population. Of course users of Chromium would still be affected, but this is still better than leave ALL these users with an information leak.

Firefox 45.0 released

Posted Mar 9, 2016 20:55 UTC (Wed) by cruff (subscriber, #7201) [Link] (6 responses)

Why didn't they just define tor://... instead?

Firefox 45.0 released

Posted Mar 9, 2016 21:27 UTC (Wed) by simcop2387 (subscriber, #101710) [Link] (5 responses)

You can run any kind of service over a Tor Hidden Service: http, https, gopher, ftp, ftps, telnet, ssh, nfs, cifs, etc. tor:// implies that there's a specific protocol involved for just tor which isn't the case. Tor proxies any type of connection you want to throw at it.

Firefox 45.0 released

Posted Mar 9, 2016 23:01 UTC (Wed) by summentier (subscriber, #100638) [Link] (4 responses)

Okay, why not "tor+http://", "tor+gopher://", etc. then?

And yes, this does exist in the wild: "svn+ssh://" is an example.

Firefox 45.0 released

Posted Mar 9, 2016 23:55 UTC (Wed) by MoSal (guest, #103113) [Link] (3 responses)

Because they are trying to make it possible to transparently proxy
TCP connections. They are not ,and can't feasibly be, trying to add special protocol support to each and every server and client out there.

If you pick obscure client X that talks application protocol Y. It should just work as is, provided that it supports proxying.

Firefox 45.0 released

Posted Mar 10, 2016 3:31 UTC (Thu) by drag (guest, #31333) [Link] (2 responses)

Except they failed because instead the application needing to be aware of tor proxy the application needs to be aware of possible information leakage via name lookups.

Either way the application needs to be aware of tor and be programmed specifically to work properly with it.

Firefox 45.0 released

Posted Mar 10, 2016 5:59 UTC (Thu) by Karellen (subscriber, #67644) [Link] (1 responses)

No, they failed because now *every non-tor-using application* needs to be aware of possible information leakage via name lookups.

*And* the tor-using applications have to be programmed specifically to work with it.

Firefox 45.0 released

Posted Mar 10, 2016 11:16 UTC (Thu) by MoSal (guest, #103113) [Link]

> No, they failed because now *every non-tor-using application* needs to be aware of possible information leakage via name lookups.

Applications need to be aware if they want to comply to the RFC. They can also ignore it. A lot of people
are not happy with the RFC as shown in the discussion I linked to above.

> *And* the tor-using applications have to be programmed specifically to work with it.

Not really. All applications that use TCP connections could be tor-using. And name resolution always worked via
proxies.

-----

In practice, most security-conscious users have been using isolated environments to connect for years. Whether you are using an isolated VM, or just a separate network namespace, DNS leaks should not be possible.

Those users are way more concerned about the possibility of being de-anonymized by certain adversaries, than this whole discussion.

Firefox 45.0 released

Posted Mar 10, 2016 1:08 UTC (Thu) by cjwatson (subscriber, #7322) [Link] (2 responses)

I'm pretty confused by the changes to Hello. Just last week I was able to use it as a basically straightforward video call system to talk to my family while I was abroad: create a conversation, give them the URL out of band, they open it, bam, done. Now it seems I can only do this if I want to share my tabs as well, which seems kind of over the top.

Has anyone worked out a way to turn this off and get some approximation of the old behaviour?

Firefox 45.0 released

Posted Mar 10, 2016 5:37 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

Use a separate profile? I have one for Google Hangouts since it seems to just keep wanting to escape whatever fence I try to keep it penned up in with uBlock and uMatrix. Better to just shunt it off than to keep whitelisting different URLs.

Disabling hello tabsharing

Posted Mar 10, 2016 5:52 UTC (Thu) by Duncan (guest, #6647) [Link]

I was pretty confused by the wording in the change notes as well, but after a bit of googling, I found a reddit discussion (which started with a complaint on the same thing) with a comment that explains rather better how it works. Unfortunately, I don't see a way to link the specific comment with that explanation, so I'll provide the link to the entire discussion and the author's name and let you find it if you like, and paraphrase him here as well.

Link:
https://www.reddit.com/r/firefox/comments/47dfd/firefox_h...

Look for comment author: Syl0s

In his test on FF47 (IOW, might not quite work like this in 45 just yet), when you click the firefox hello start conversation button, it'll be in tab-sharing mode by default. However, at that point you haven't actually given anyone the link, so nobody should be connected. If you disable tab sharing before you give them the link to connect to, they can't see the page, or any further pages (see below).

Alternatively, if you start the conversation from the about:blank page or the about:newtab page (and I suppose it extends to pretty much all about: pages, which are generally browser-internal config and the like), it won't share the page link at all, thus allowing you to start-conversation without sharing your current page even if someone somehow connects before you give them the conversation link.

However, once someone connects, if you haven't disabled sharing they'll get the pages you click on, as long as they aren't about: pages and thus local.

So to be sure no pages are shared, start the conversation on an about:blank or similar page so none are shared at conversation start, and disable tab sharing before clicking on other tabs, so they aren't shared. Alternatively, be selective with the tabs you click on while the conversation is going, as apparently, those you don't actually view during the conversation aren't shared.

(Two things, however, weren't quite clear from that. First, what about other firefox windows showing pages, as opposed to tabs of the same window? Are they shared, possibly only if given focus? I actually use multi-window mode more than multi-tab, tho sometimes I do a few tabs, so the answer to this question makes a big difference, here. Second, he said "livestream" which to me implies actual local view, including, for instance, the contents of this edit-box as I type it, but also mentioned page links, which actually seems more reasonable to me, particularly for cross-browser connection to say chrome, as that would let chrome open and render the same commonly viewable page, but wouldn't live-stream the actual local rendering and thus broadcast what's filled in on forms in the page or the contents of company-internal pages, for instance. Page-links so the other person can only see the same page as they load it themselves, seems more reasonable to me, but it's not clear from the description.)

Anyway, bottom line, there's still a way to do a conversation without sharing browser pages. It's just that (as the other comments on that reddit discussion suggest) the firefox devs have, apparently, repurposed the feature to be by default more of a "see, this is the page I was talking about", kind of thing, either about a specific page, or continued from there as a shared browsing experience. Which does if you think about it make a bit more sense as a browser-based feature, than a more global conversations about anything feature, for which most people would normally consider some other app, skype being apparently one of the more popular ones, for instance.

Finally, FWIW, I've disabled the hello feature entirely, here, via the configuration mania extension, which as it's generally simply providing a GUI for more advanced but still reasonably commonly used configuration options otherwise available via about:config, should mean it can be disabled there, as well, tho I've not investigated what specific setting it might be. Because I don't really have a use for it in normal usage, and don't even have a mic or webcam hooked up, and would rather not worry about it. But if I want it, and actually get a mic and/or webcam to hookup to use it with, I know where to turn it back on to get it. =:^)

Duncan