Temporarily sticking with firefox-52 and tips for firefox-60

[mmogilvi]

I wanted to hold off on the newly stabilized firefox 60 ESR update on some of my machines for a few more days (try it out on others first, see what's broken, search for workaround, etc), but it is slightly more complicated than just masking the new firefox, so I'll document it here:

In /etc/portage/package.mask, add:

[Apheus]

[tholin]

Thanks for the useful info. I've also been struggling with the 60 ESR update and thought I'd share my problems and solutions (workarounds).

• Sound will likely break unless you use pulseaudio. There is a workaround I wrote about in this thread https://forums.gentoo.org/viewtopic-p-8259718.html#8259718
  
  
• The new tab page has been remodeled. The new design is optimized for cramming in as many "sponsored stories" (advertisements) as possible. That bullshit can be disabled in the new tab options but if you disable all of it the new tab page looks barren. By setting browser.newtabpage.activity-stream.topSitesRows=6 you get a lot more "top sites" that you can pin to anything you want like in 52.
  
  
• If you open a youtube video in a new tab to have it play in the background it will no longer play unless you give that tab focus first. That feature can be disabled with media.block-autoplay-until-in-foreground=false.
  
  
• Loading URLs from the clipboard with middle click is disabled by default (not a bad idea). If you are aware of the risks and are careful you can re-enable it with middlemouse.contentLoadURL=true.
  
  
• In 60 ESR it's webextensions or nothing. XUL/XPCOM based extensions won't work. The biggest fallout for me was that my mouse gesture extension, firegestures, didn't work. The best replacement I've found is foxy gestures but it requires firefox-61 and the ESR branch is 60. Webextensions only work on webpages so gestures won't work on setting pages or the new tab page. It's impossible to make a proper mouse gesture extention with webextensions with the current limitations.
  
  The ugly workaround I use is to use x11-misc/easystroke to recognize gestures and inject keypresses to the browser. This limits me to functionality available as keyboard shortcuts but it's good enough for me. Easystroke is abandonware and really bitrotten. It segfaults all the time when changing configuration and have a lot of other glitches with the gui. I couldn't find anything better.
  
  The benefit of easystroke is that the gestures work on all browser even without extension support. That means one less, potentially dangerous, extension. Extensions have become one of the biggest threats to secure browsing. I don't want to base the security of my browser on the assumption that some mouse gesture developer use strong passwords.
  https://krebsonsecurity.com/2018/09/browser-extensions-are-they-worth-the-risk/
  https://yro.slashdot.org/story/17/07/14/183237/popular-chrome-extension-sold-to-new-dev-who-immediately-turns-it-into-adware
  https://it.slashdot.org/story/16/04/04/1730259/chrome-extension-caught-hijacking-users-browsers
  https://news.slashdot.org/story/16/03/12/2328254/google-chrome-extension-caught-stealing-bitcoin-from-users
  
  
• The webextensions version of NoScript was a downgrade. Lots of options disappeared. I decided to say goodbye to NoScript and try out uMatrix instead. uMatrix is a lot more powerful and complicated. It's not obvious how to use it without reading the manual. https://github.com/gorhill/uMatrix/wiki/The-popup-panel is the most important info for how to use it but all the other pages on the wiki are also useful. Once I've learned how it works it both better and easier to use than NoScript.
  
  
• On every major update it's a good idea to look through the list here and disable all the bullshit. https://github.com/pyllyukko/user.js
  Pay extra attention to the "Firefox (anti-)features" sections. The sad truth is that Mozilla can't be trusted anymore:
  
  https://utcc.utoronto.ca/~cks/space/blog/web/MozillaBetraysFirefoxUsers
  
  https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-in-firefox/
  "This experiment also includes the data collection tool Cliqz uses to build its recommendation engine. Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit."
  
  https://blog.mozilla.org/advancingcontent/2014/11/13/announcing-firefox-tiles-going-live-today/
  "Tiles are our first iteration on starting to solve these problems. They create a more useful, attractive and dynamic new tab page. Tiles also represent an important part of our efforts to create new communications, content and advertising experiences over which Firefox users maintain control."
  

[josephg]

[mmogilvi]

More thoughts:

As tholin mentioned, about:config's middlemouse.contentLoadURL default was changed to false (as I noticed within a couple of hours). I explicitly changed it back to true. The underlying logic was much improved several years ago to not try to load the a middle click paste as a URL unless it actually looks like a complete URL, with scheme and everything. Before that, I occasionally would mistakenly paste something sensitive like a password in the wrong place, and not only would it load something I didn't intend, it presumably sent my password out over the unencrypted DNS and/or search engine requests to do so, leaving me compelled to change the now-potentially-compromised password. But that hasn't been a problem for years. (Back then middle click stopped working with "URL"s that left out the scheme, but that seems like a small price to pay to avoid unintentional loads from miss-pasted passwords.)

To summarize the pulseaudio thread linked by tholon, alsa mostly works, but firefox may crash on an assertion when closing a tab with active audio. A workaround (that I haven't tried yet) involves disabling multiprocess rendering. (I was going to say alsa works for me, but then I read the thread and realized I had encountered the indicated crash, although I hadn't realized the cause - I was vaguely thinking some sort of ffmpeg bug.)

The Adwaita/Releigh theme issue was me trying to stick with a gtk2 default theme from the previous major firefox update. At that time I ended up just setting the USE flags to continue to build as much as possible against gtk2 instead of 3, although firefox 60 no longer has that option. Everything using gtk3 had similar theme bugs, so globally (instead of individual app) abandoning Releigh and tweaking Adwaita really seems best overall...