Mozilla on Tuesday released Firefox 75 on schedule, unlike rivals Google and Microsoft, which postponed browser releases by weeks and scratched one version entirely because of the COVID-19 pandemic.
The upgrade’s most visible changes were to Firefox’s address bar, which has been tricked out with several enhancements designed to make for more productive searches.
The company’s developers also patched a half dozen vulnerabilities, three labeled “High,” Firefox’s second-most-serious label. As has regularly been the case, Mozilla addressed multiple memory safety flaws that criminals might have been able to exploit had they known of them.
Firefox 75 can be downloaded for Windows, macOS and Linux from Mozilla’s site. Because Firefox updates in the background, most users can just relaunch the browser to get the latest version. To manually update on Windows, pull up the menu under the three horizontal bars at the upper right, then click the help icon (the question mark within a circle). Choose “About Firefox.” (On macOS, “About Firefox” can be found under the “Firefox” menu.) The resulting page shows that the browser is either up to date or describes the refresh process.
This was the second version of Firefox to be released four weeks after its predecessor — Mozilla last upgraded the browser on March 10. In September 2019, the company announced it would accelerate the browser’s release pace by shortening the interval between upgrades from six weeks to five as an interim step, finally to four weeks.
Mozilla: We don’t do delays
It was notable that Firefox 75 appeared on time, as it had been scheduled months earlier. Three weeks ago, first Google, then Microsoft, announced that they had temporarily suspended Chrome and Edge releases, respectively.
A week later, Google said it would release Chrome 81 on April 7 (it did), scrub Chrome 82 from the launch list and debut Chrome 83 three weeks earlier than originally scheduled (on May 19). Microsoft again said its Edge — like Chrome, built on technologies provided by the open-source Chromium project — would mimic Google’s browser’s return.
Mozilla held to its calendar. “We believe we can maintain our 2020 Firefox release schedule as we navigate this global crisis together,” Joe Hildebrand, vice president for Firefox web technology, and Selena Deckelmann, vice president of Firefox desktop, wrote in a joint post to a company blog. And the two took shots at the competition, noting that their teams were familiar with working remotely.
“These strengths are what allow us to continue to make progress where some of our competitors have had to slow down or stop work.”
But Hildebrand and Deckelmann didn’t promise that Mozilla would never deviate from the every-four-week tempo. “We will continue to monitor both internal and external feedback and remain open to making future adjustments,” they said.
Augmenting the address bar
With its 50% faster release cadence – every four weeks rather than every six – users have to expect fewer new features and smaller amounts of new functionality in each upgrade. That’s the case with Firefox 75, which adds to the address bar and that’s about all.
Among the improvements to the bar, one stood out: A click in the address bar now drops down a list of the first eight sites from the new tab page. The click-and-list function works at all times, saving the need to first open a new tab before zipping to a favorite site (as long as the site is one of the first eight).
To change the contents of the list or the order of the sites within it, users must add to or subtract from the thumbnails on the new tab page, or reshuffle those already there.
Other changes to the address bar’s user interface (UI) and user experience (UX) included boldfaced keywords based on the search string being entered – “to narrow your search even further,” Mozilla asserted – and a variable-sized field and font, both which expand when typing a search string and contract to standard size when finished.
Mozilla highlighted several developer- and enterprise-specific changes as well, ranging from the loading attribute on elements to support for client certificates from the macOS certificate store. More information can be found in Firefox 75’s release notes.
The next Mozilla upgrade, Firefox 76, should appear May 5.
Microsoft may have the next Windows 10 upgrade burning a hole in its pocket, but if it’s smart, the Redmond, Wash. developer will keep that code to itself for now.
In fact, software developers could do all tech users a big favor by slapping a moratorium on all non-security, feature-filled updates and upgrades until further notice.
Call it “software distancing,” but rather than make versions stand six feet apart force them to keep six months’ separation.
Why hold Windows 10 2004? Because we’re busy, in case you haven’t noticed
Microsoft must be eager to dispatch Windows 10 2004, the year’s spring feature upgrade: It’s been working on the refresh for more than a year now. But really, what’s the rush? After 13+ months of testing, testing and more testing, another half dozen isn’t going to hurt.
In fact, there are several reasons why postponing the upgrade makes good sense.
IT and users have higher priorities right now
At the top of the list is the simple fact that everyone has more important things to do than process a feature upgrade to Windows 10.
That item may be short-lived – it will get scratched out at some point – but that’s why timing must play a part in Microsoft’s decision (and outsiders’ appeals). Even for faster-acting companies, such as Microsoft itself, as well as Amazon and Google, it has been just one month since they told employees to head home and, if possible, work remotely.
Everyone is still settling in, especially those who have never worked at home or from the field for extended periods. Ditto for the IT staffs with little experience managing devices outside the office perimeter. Employees of all kinds, line workers and IT alike, are heads-down getting used to the situation, stressed out, if by nothing else (and there are many elses here), than by the newness of it all.
It won’t be like this the entire time America (and elsewhere) are locked down. People and organizations will adapt. But right now? They’re busy.
Bandwidth doesn’t grow on trees
Microsoft has already begun prepping IT personnel n the nuts and bolts of updating large numbers of remote PCs. One of the items it has focused on has been potential chokepoints, notably the VPN (virtual private network) many firms mandate when outside-the-perimeter machines access corporate assets and information.
Because workers now located at home are likely connecting to the corporate network via VPN, updates and upgrades may get shoved through the latter, overwhelming the VPN’s capacity. In several technical posts, including here and here, Microsoft has been showing admins how best to manage updates when VPNs are in place.
Ideally, Microsoft said, updates should not go through the VPN but directly to the Internet. “The Microsoft recommended approach is to configure the VPN client to only send traffic bound for corporate resources located on-premises via the VPN connection, allowing all other traffic to go directly to the Internet and to be routed accordingly,” the company asserted. “This is how the VPN is configured internally at Microsoft.”
Upgrades, of course, are significantly larger (measured in gigabytes) than the monthly updates on, say, Patch Tuesday – all the more reason why they would negatively impact the connections between remote clients and the company’s on-premises infrastructure.
And it’s all the more reason for Microsoft to back off on Windows 10 2004 until IT sorts out the VPN situation, or better yet, the bulk of the workforce returns to the office and its internal network.
In a more general sense, bandwidth is simply a precious commodity. Not everyone has a fat pipe for a home connection to the Internet, for instance. (Some may not have an Internet account at all, relying instead on their smartphone and a metered – and expensive – data plan from a mobile carrier.) What bandwidth is at hand is occupied with more important traffic.
“The last thing we need right now coming down our already-full pipes filled with Zoom and Team meetings is a feature release,” contended Susan Bradley, a computer network and security consultant, the moderator of the PatchMangement.org mailing list and the contributor known as “The Patch Lady” to the AskWoody.com Windows tip site.
Help desk personnel are stretched thin
Everyone is busy adjusting to the new regimes, but the help desk is busier than most. Personnel have scrambled to get remote workers up and running, helping employees diagnose problems with systems and network configurations outside the corporate standard, forwarding cables and monitors to at homers. And while much of what the reps did – and continue to do – could and can be done remotely, there are parts of their jobs that required them to be at a specific somewhere, like when they needed to do an in-person examination of a system to uncover the root of a problem.
Those cubicle calls are now so much history, forcing the help desk to make adjustments.
Throw in a feature upgrade, even one that goes smoothly, and the calls might well overwhelm the help resources. And if the upgrade goes south? (As some of Windows 10’s have.) No one even wants to think about that.
“We don’t have the excess help desk capacity,” argued Bradley. “We need to focus on security and not features at this time.”
By holding back Windows 10 2004, Microsoft could put more in it
For an upgrade that has been in the works – and in public testing with Insider participants – for more than a year, Windows 10 2004 looks light on the new features and functionality.
It’s not clear what within 2004 – at least of what Microsoft has revealed – required the extra effort. In February 2019, when Microsoft departed from its established schedule and began beta testing the first upgrade of 2020 before starting to test the second for 2019, the firm said “some things we are working on in 20H1 require a longer lead time.” (20H1 was Microsoft-ese for the first feature upgrade of 2020, or what later was numbered Windows 10 2004.)
Late last year, Microsoft severed the links between under-development features and future upgrades, saying that it would put the former into one of the latter “when they are ready.”
Microsoft has been testing numerous features that didn’t make it into 2004 – which was locked down, feature-wise, in late 2019 – and could put its money where its mouth is by using the additional time to add some to the upgrade.
Holding Windows 10 2004 would be a great excuse to scale back to one upgrade a year
Yet another reason 2004 should be postponed has nothing to do with the coronavirus pandemic. But Microsoft could take advantage of circumstances to do what many users want from the company: a single upgrade annually.
Microsoft, in fact, showed its hand last year when it downgraded the second upgrade to little more than a repeat of the first, a minor upgrade that included so few new features it was dubbed a “service pack.” During 2019, there was really just the one feature upgrade worthy of the name, even though Microsoft went through the distribution process twice.
Earlier changes by Redmond, including the lengthening of support for Windows 10 Enterprise and Education customers, then Microsoft’s abdication of control of when upgrades occur, put most customers on a once-a-year cadence. Microsoft would be smart to simplify Windows 10’s maintenance by reducing the number of upgrades issued to the number customers are typically installing.
Which is one per year.
If Microsoft were looking for an opportunity to downshift to one feature upgrade annually, this is it. Even those who still hewed to the Windows-as-a-service concept and saw value in multiple upgrades each year would likely accept the news that 2020 would offer just a single feature upgrade. (Microsoft, as it has done in the past, could couch the move as temporary but make it permanent after the crisis subsides.)
Giving the decision positive spin, a sacrifice for the greater good, should be a snap for Microsoft’s PR, enough perhaps to make many forget that Microsoft set great stock in a faster release tempo and explained the multiple yearly upgrades as necessary to keep pace with technology’s changes.
Microsoft should think of it as a win-win.
But, but…what about support and deadlines?
True, Microsoft would have to massage the schedule if it postpones the launch of Windows 10 2004, no matter the reason for the delay.
Fortunately, that’s as easily done as making an announcement, like the one last month when Microsoft added six months of support to the I-didn’t-know-you-could-still-run-that version, Windows 10 1709.
Windows 10 1903, which according to analytics company AdDuplex accounted for 51% of all Windows 10 versions as of March 25, would be one Microsoft would have to modify. Normally, Microsoft would begin to replace 1903 on PCs running Windows 10 Home or unmanaged systems running Windows 10 Pro, with 2004 around the end of July or start of August. (Windows 10 1903 is currently scheduled to end support Dec. 8.) A 2004 launch set for anything beyond late June or early July would make that difficult or impossible. Instead, Microsoft would likely extend 1903’s end-of-support, maybe by the same six months as 1709. (That would make 1903’s support run until June 8, 2021, a month later than 1909’s retirement of May 11. 2021. In this scenario, both 1903 and 1909 would be upgraded to 2004 by Microsoft early next year.)
On the other hand, if Microsoft took advantage of the COVID-19 crisis to scale back to an annual cadence, it would need to do more.
First, it should rename the feature upgrade to a more accurate four-digit number, like 2009, if it waits until September or October. By Microsoft’s rules, 2009 (née 2004) would receive 30 months of support on Windows 10 Enterprise and Windows 10 Education. Assuming an October launch, the version would exit support in April 2023. That would be a problem, seeing as how there wouldn’t be an upgrade released in the spring of 2023.
If Microsoft issues one upgrade annually, it would make sense to extend support to 36 months. As the following figure shows, enterprises would have to be fairly agile to run an every-two-years upgrade tempo when support ends at 30 months. Stretch support an additional six months, however, and companies would be able to upgrade on a two-year cycle and still take 12 months to test, pilot and deploy each version.
Microsoft could stay stingy on Home and Pro, retaining the 18-month support span for those SKUs (stock-selling units), forcibly upgrading devices as the previous version neared retirement. Those systems would continue to be upgraded approximately every 12 months.
Next, Microsoft should spell out the new tempo and any associated changes necessary to make the every-12-month rhythm workable.
It’s tough to talk about Project Treble without getting lost in a forest of technical gobbledygook.
And it’s no wonder: Project Treble (take a deep breath) is Google’s ambitious effort to rearchitect Android in order to establish a modular base in which the lower-level code created by silicon vendors is separated from the main Android operating system framework so that device manufacturers can update the OS code without having to rely on silicon vendors to refresh the lower-level code for every release.
Whew! See what I mean?
In reality, though, Project Treble doesn’t have to be so complicated. Let’s break down what Treble is actually all about, in real-world terms — and what it actually means for you, as someone who uses Android and doesn’t necessarily speak the language of mumbo-jumbo.
We’ll start at the beginning:
What is Project Treble — in plain English?
I just fed the technical explanation into my patented Geek-to-English Translation Machine, and here’s what came out: Project Treble, at its core, is all about making it faster, easier, and cheaper for phone makers to process Android software updates and get them out to users.
That’s the short version. Now, the context: In the past, every time a new Android version came along, phone makers had to wait for the chipset vendors — the companies like Qualcomm, which supply the processors and other pieces inside the devices — to update the areas of the code related to all of that internal hardware. It was only when that effort was finished that the phone-maker was able to start its part of the process: integrating the new Google-provided software with its own interface customizations and feature additions, then testing it all thoroughly and getting it ready to roll out.
What Treble does is separate that lower-level stuff — the areas of the code related to a phone’s processor, modem, and so on — from the rest of the operating system. That way, those lower-level elements don’t have to be updated every time a new Android version comes along; they just exist as a constant foundation beneath everything else, and that first part of the process is no longer required.
To borrow an analogy from an earlier analysis, you can think of the whole thing like a pie: Up till recently, all of Android was mixed together, and that meant each ingredient had to be updated and stirred into the batter from scratch with every single OS update. Thanks to Treble, all the hardware-specific elements now exist as a crust — one that remains in place for a device’s entire life. And so whenever a new Android release arrives, the phone maker can focus solely on its part of the process — the filling — without first having to wait for someone else to provide a freshly made foundation.
Google actually started this process with its Android 8.0 Oreo release, in 2017, by creating the initial boundary between the operating system and the lower-level code. Rather fittingly, however, 2018’s Android 9 Pie software marked the first time the setup was complete and operational — with chipset vendors ready to support it and with a significant number of Treble-ready devices out in the wild and waiting.
Why is Project Treble even necessary?
Over the past several years, Android upgrades have devolved into a big, hot mess — and that’s putting it mildly: Aside from Google itself, with its Pixel line of phones, no Android device maker provides consistently timely and reliable software updates. And it’s the users who suffer, getting stuck with dated software that lacks not only features and interface improvements from newer releases but also privacy and security enhancements and a variety of other under-the-hood improvements that only OS updates can provide.
And that’s why Project Treble came about — to try to cut out some of the time and cost associated with processing OS updates so that manufacturers would step up their games and users could start getting current software more quickly.
How much difference is Project Treble actually making?
That’s the million-dollar question — and with two years of Treble-aided updates now in front of us, the answer isn’t especially uplifting.
According to my interview with one of Google’s Treble architects, Treble should shave about three months off the typical upgrade process by eliminating that initial lower-level phase. But scrutinizing the data from device-makers’ performance with both the Pie upgrade and the more recent Android 10 rollout, it’s clear that hasn’t exactly happened.
Let’s start with Pie: As my February 2019 analysis of that rollout makes all too apparent, nearly every major Android flagship device-maker (from a U.S. perspective) saw little to no improvement with the first true Treble test. Some companies even did meaningfully worse with the initial post-Treble rollout than they did with earlier, non-Treble-affected Android releases.
Samsung, notably, did a touch better with Pie than it did with Oreo, the year before — but it’s hard to frame its success as a Treble-related victory. The company went from 213 days between the software’s release and its first U.S. flagship phone rollout with Oreo to 177 days with Pie. That’s an improvement of 36 days, which is certainly something — but it isn’t nearly enough to account for the estimated 90 days of work Treble was supposed to save.
Plus, looking back even further, Samsung took 179 days to deliver Nougat to its then-current flagship the previous cycle — basically the same amount of time it took with Pie. Before that, the company took 155 days with Marshmallow and 105 days with Lollipop. So all that really happened was that Samsung had an especially bad year with Oreo and then went back to its still-underwhelming Nougat-level performance a year later — without even going as far as to match its slightly less embarrassing Marshmallow- or Lollipop-era performances from the years before that.
One company actually did achieve the 90-day improvement window Treble was designed to provide: OnePlus, the relatively small-scale maker of phones that have long been popular within the Android enthusiast community and have just recently started to see some more mainstream success. That’s a promising indication of the type of improvement Treble can theoretically enable — but the success is somewhat diminished by the fact that OnePlus simultaneously took 47 days longer to get Pie out to its previous-gen flagships than it did with Oreo the previous year (and in the case of OnePlus, those phones were indeed all Treble-ready).
So that’s year one of living in a Treble-enhanced world, in a nutshell. In year two, with 2019’s Android 10 update, some device-makers managed to improve their delivery times a bit further — but the results are rather scattered and still don’t seem to point specifically to any Treble-connected success.
Samsung, for instance, got about a hundred days faster with both its current-gen and previous-gen flagship rollouts in the Android 10 cycle — certainly nothing to write off. But at the same time, that level of improvement actually just brought the company back (almost) to its 2014 performance, with Lollipop. So can we really credit a return to a six-year-old standard — one that wasn’t even particularly impressive back then — to a change that came about in the last couple of years? It seems like a stretch.
LG also almost matched its 2014 level of mediocrity with the Android 10 rollout, on the current-gen flagship front, and is doing significantly worse than it did in 2014 with its previous-gen flagship phone support. (As of this writing, the company has yet to send Android 10 to its previous-gen flagship in the U.S. and is already two months and counting behind its 2014 standard.) HTC and Motorola, meanwhile, have yet to send Android 10 to any U.S. flagships, well over six months after the software’s release.
Again, the one exception to the rule is OnePlus, which brought its current-gen flagship delivery down to a mere 18 days with Android 10 — compared to 47 days with Android 9 and 138 days with Android 8. OnePlus did better with its previous-gen flagship, too, with a 93-day delay for Android 10 delivery. That’s still too long of a wait to be commendable, though, and it’s also essentially just bouncing back from a bad year to match the company’s previous-gen upgrade performance in 2017.
All these numbers are a lot to process, but the main takeaway is that it’s tough to square the data — even in areas where improvements are present — with any sort of narrative about Treble being the driver of the change.
More than anything, what we’re seeing serves to highlight a stark reality of the Android upgrade situation: Regardless of what improvements are made to the technical part of the process, most manufacturers simply aren’t motivated to make timely and reliable upgrades a priority. And why should they? Post-sales software support requires a fair amount of time and resources, even with Treble’s adjustments in place, and all of that effort brings little tangible benefit to the typical third-party Android device maker.
In fact, one could argue that providing timely and reliable software enhancements actively works against most companies’ interests, as it makes phone owners less likely to feel the need to spend money on a new device. Treble, unfortunately, can’t address that part of the equation; if phone makers see no reason to take post-sales software support seriously, all the optimization in the world won’t make an ounce of difference.
All considered, what we can say is that Treble absolutely does cut out a significant portion of the work required for phone makers to process and deliver OS updates — and that can and should make it possible for upgrades to be delivered faster without any additional investments. How things play out from there, however, is ultimately in each manufacturer’s hands, as these first two years of evidence illustrate.
This article was originally published in September 2018 and most recently updated in April 2020.
Although Microsoft has not yet said how it will deal out the year’s Windows 10 feature upgrades, it’s becoming clear there’s next to no reason for the company to diverge from 2019’s major-minor cadence.
As the death toll from the COVID-19 pandemic continues to climb worldwide, and the disruption of modern life and business continues to sow chaos, 2020 will be a tough year no matter how one cuts it. In a time of unprecedented changes triggered by the novel coronavirus, there’s no rationale to change what worked for Windows 10 last year.
Microsoft, of course, will do what it wants – and commercial customers will have to deal with the results. But there are good reasons why the Redmond, Wash. company should seriously rethink any plan to mess with 2019’s release scheme.
First, a short recap of last year
For the two years 2017 and 2018, Microsoft’s Windows 10 feature upgrade practice consisted of two more-or-less-equally-robust refreshes containing new features and functionality. Those upgrades arrived in the spring and fall, typically in April and October, and were tagged as yy03 and yy09, respectively.
But last year Microsoft altered that schedule. The spring upgrade, 1903 was a feature-and-functionality refresh. But the fall’s 1909 was little more than a rerun of its predecessor, albeit with a small number of additional minor features. (It was so like the long-unused “service pack” concept Microsoft relied on through Windows 7 that older customers immediately labeled it as such.) The two, 1903 and 1909, shared the same code by October, allowing Microsoft to deliver the latter as a standard monthly update, which users who migrated from spring to fall could install much faster than a typical feature upgrade.
Pundits and news outlets, including Computerworld, labeled the 2019 cadence as “major-minor” to describe the volume of change in each and their relative value. Enterprises that deployed 1909 – under Microsoft’s policy, that version provided 30 months of support to Windows 10 Enterprise and Windows 10 Education, a year’s worth more than 1903 – were generally upbeat about the fall upgrade, simply because there was less to it.
Still, Microsoft has so far declined to say how it would deliver Windows 10 upgrades in 2020. Two feature-rich releases? Or one real upgrade and a follow-up that is one in name only?
The company hasn’t yet shown its cards.
Delay Windows 10 2004
Microsoft may have finished 2004, the year’s first Windows 10 feature upgrade, but it’s not announced when it will release it.
But really, what’s the rush?
While the moniker may foretell April as its release (or even May, acknowledging the company’s habit of delivering upgrades a month after the designation), there’s no reason why Microsoft couldn’t delay its delivery to the summer or even later.
All these calls were made because of the pandemic’s impact on business, motivated by developers’ own decisions to send workforces home and by the realization that upgrades are superfluous when a crisis is at hand. IT personnel have enough to do to keep the technological lights on and users don’t need the kind of stress a botched upgrade would provoke when there is already a stress surplus generated by the virus.
“If it’s not broken, don’t fix it” never made so much sense.
If Microsoft issues Windows 10 2004 later than its numeric name implies – mid-to-late summer, say, for argument’s sake – the need for another feature-filled upgrade during the remainder of the year falls to zero when next year’s 2103 should land in April.
A service-pack-esque release in the vein of 1909 would do just fine.
Why not just bag 2009 altogether?
If times are so tough that Microsoft shouldn’t go back to its 2017-2018 pattern, why can’t the company just forget about the fall upgrade and be done with it?
Microsoft can, of course. (It’s the one making the rules, and there’s no referee saying different.)
But the fall upgrade serves a crucial purpose under Redmond’s current policies: It’s the version that awards 30 months of support to Windows 10 Enterprise and Windows 10 Education customers. Sans Windows 10 2009, IT admins whose charges are running 1903 or earlier would be between the rock of no upgrade and the hard place of no security patches.
Enterprise/Education customers will not want to adopt a yy03 version because it offers only 18 months of support, far too little (as Microsoft acknowledged when it bent to customer pressure and debuted the 30 months nearly two years ago). But with 2009 out of the picture, the next fall refresh, a putative 2109, won’t be available until around October 2021, probably not reliable enough for businesses until early 2022.
Only Windows 10 1909 has an end-of-support date after that: Its retirement is currently to be May 10, 2022.
Expecting organizations to be able to migrate to a new version in just a few months? That’s a fool’s errand.
Dumping 2009 would put enterprises in a bind, not this year but at the end of the next and the beginning of the year after that (hopefully long after COVID-19 is in the rearview mirror). They would be forced to migrate to one of the spring upgrades and settle for just 18 months of support, knowing that they would have to shortly do it all over again.
By “shortly,” Computerworld means sooner than wanted. Let’s say Microsoft does scratch 2009. An enterprise with PCs running Windows 10 1809 would normally target 2009 as the replacement, aiming to upgrade every two years. But with Windows 10 2009 missing, the firm would have only poor choices, as the following figure shows.
More options for Microsoft
One option would be to accelerate migration to annually and upgrade to Windows 10 1909 starting in the last months of 2020 or the first of 2021. (Windows 10 1809 falls off support in May 2021.) Later, the company could return to the every-two-year tempo by moving from 1909 to 2109 during the opening months of 2022.
Another would be to deploy the delayed 2004 later this year, even though that version comes with only 18 months of support, then get back to a release with 30 months of support, such as 2109. Making that might be tough, though, as 2004’s support would expire just six months into 2109’s lifespan. (If Microsoft doesn’t shove 2004’s release back several months, this move would be impossible.)
A missing fall upgrade, even one in the mold of a feature-free service pack, would clearly ruin the rhythm businesses have set for managing Windows 10. That’s why Microsoft would almost certainly issue something other than 2004 this year.
Mozilla on Tuesday shipped Firefox 74. Wait, didn’t we just get a new Firefox a minute or two ago?
It may feel that way. Firefox 74 arrived just four weeks after its predecessor, continuing the faster release cadence promised last year.
The refreshed browser dropped support for the now-obsolete TLS 1.0 and 1.1 cryptographic protocols, blocked all add-on “side-loading” except that allowed by enterprise-managed group policy, and enabled support for a header element designed to safeguard against attacks based on the Meltdown and Spectre hardware-based vulnerabilities first revealed two years ago.
Mozilla’s security engineers also patched a dozen vulnerabilities, half of them labeled “High,” Mozilla’s second-most-serious threat label. As usual, some of the flaws might be used by criminals.
“We presume that with enough effort some of these could have been exploited to run arbitrary code,” the firm wrote of two of the bugs. Two others were discovered and reported by members of Google Project Zero, the search company’s team of researchers who root out unpatched flaws in Google and non-Google software.
Firefox 74 can be downloaded for Windows, macOS and Linux from Mozilla’s site. Because Firefox updates in the background, most users can simply relaunch the browser to get the latest version. To manually update on Windows, pull up the menu under the three horizontal bars at the upper right, then click the help icon (the question mark within a circle). Choose “About Firefox.” (On macOS, “About Firefox” can be found under the “Firefox” menu.) The resulting page shows that the browser is either up to date or describes the refresh process.
This was the first version of Firefox to be released four weeks after its predecessor — Mozilla last upgraded the browser on Feb. 11. In September 2019, the company announced it would pick up the development and release pace by shortening the interval between upgrades from six weeks to first five, then to four.
Say farewell to TLS 1.0, 1.1
As expected, Firefox 74 pulled the plug on the outdated encryption protocols of TLS (Transport Layer Security) 1.0 and 1.1. When users try to connect to a site secured with either TLS version, Firefox now shows a “Secure Connection Failed” error page.
But as when Mozilla delivered Firefox 73, this month’s upgrade included an override button letting users temporarily enable TLS 1.0 and 1.1. That button will remain “for a couple of release cycles,” said Chris Mills, content team manager at the Mozilla Developer Network, in a March 10 post to a company blog. “You won’t be able to rely on it for too long,” Mills also warned. (A “couple of release cycles” might mean through, say, Firefox 76, which will be supplanted by the next version on June 2.)
Firefox 74 also put a stop to sideloading, the term describing how a third-party application installs an associated add-on in Firefox. (One example from times past was the “Web Clipper” add-on that Evernote installed in browsers, including Firefox.) Sideloading has been, if not banned outright, certainly frowned upon by browser makers, who have cited security concerns regarding the practice.
In October 2019, Mozilla said that it would ban sideloading, noting malware opportunities as well as the lack of user control; sideloaded add-ons were installed without user approval and could not be deleted by the normal method of heading to Firefox’s Add-ons Manager portal. At the time, Mozilla targeted Firefox 74 as the version that would drop support for sideloading.
Users must now take an explicit action to install a sideloaded add-on in Firefox — blocking the hands-off kind of installs sideloading was known for — and can delete them from the Add-Ons Manager. Add-ons that were sideloaded previously won’t be removed by Mozilla (that’s for users to do if they wish), but no new sideloaded browser add-ons will be permitted from Firefox 74 forward.
As is almost always the case with Firefox, this change-up can itself be stymied in the enterprise if IT deploys the appropriate group policies to employees’ copies of the browser.
More information on Firefox 74’s stance on sideloading can be found in this Mozilla post of March 10.
Enhances security, privacy
Mozilla enabled support for the “Cross-Origin Resource Policy” (CORP) header, which can be used by site developers to opt in to protection against cross-origin requests, or those from outside the domain of the website itself.
Using CORP can help safeguard against attacks by the likes of Spectre and Meltdown, the side-channel, hardware-based vulnerabilities that went public in early 2018 and triggered major efforts by browser makers, OS developers and chip company Intel to provide patches.
Firefox 74 also took the time to trumpet the Mozilla-made Facebook Container, an add-on that locks the social network and a user’s interactions with it inside a separate container, or sections of the browser’s memory. Anything done inside the container cannot be tracked outside the container; the result is that Facebook then cannot track one of its users when she goes elsewhere on the web.
Facebook Container is not new: Mozilla launched it almost two years ago. (The latest version now lets users add custom sites to a list so that Facebook’s credentials can be used for logging on to those websites.) Rather, once Firefox 74 has been installed — or Firefox was upgraded to version 74 — Mozilla uses the opportunity to pitch the add-on.