What's in the latest Firefox update? Faster page loads, 'warmer' tabs

With Firefox 61, Mozilla is back to trumpeting performance improvements and faster tab switching for its browser.

Magdalena Petrova/IDG

Mozilla on Tuesday delivered Firefox 61 for Windows, macOS and Linux, claiming that the browser's page-painting speed has been improved and that switching tabs is faster than before.

The developer's engineers also patched 18 vulnerabilities in Firefox, a third of them marked "Critical," the highest threat ranking in a four-step system.

Firefox 61, which can be downloaded from here, updates in the background, so most users need only relaunch the browser to get the latest version. To manually update, pull up the menu under the three horizontal bars at the upper right, then click the help icon (the question mark within a circle). Choose "About Firefox." The resulting page shows that the browser is either up to date or details the updating process.

Mozilla updates Firefox every six to eight weeks; the last time it upgraded the browser, to version 60, was May 9, or just shy of seven weeks ago.

Perform or else

With Firefox 61, Mozilla returned to trumpeting performance, one of the primary touts used when it rolled out the revamped - and newly named - Firefox Quantum in November.

At the top of the list were, well, lists: "Retained display lists."

Those are actual lists the browser composes of the elements needed to display a page, then sorted in a back-to-front fashion for proper painting of each component. Before Firefox 61, the browser built a new display list from scratch each time a page required updating. "This is great for simplicity: we don't have to worry about figuring out which bits changed or went away. Unfortunately, the process can take a really long time," Matt Woodrow, a senior staff software engineer, said in a Monday post to a Mozilla blog.

The re-creation of display lists impacts page-painting performance, particularly with video, which is best viewed with updates 60 times per second. "This has always been a performance problem, but as websites have become more complex and more users have access to higher resolution monitors, the problem has been magnified," Woodrow contended.

Instead, Firefox now retains the parts of the display list that haven't changed from the just-prior compilation, building a new display list "only for the parts of the page that changed since we last painted and then merge the new list with the old," according to Woodrow. The results: Page painting times fell by an average of 33% and there was an almost 40% decrease in dropped frames blamed on list making. Almost as important, freeing the browser from rebuilding the list means the application - and the horsepower behind it in the device's silicon - can be applied to other tasks.

Warm up those tabs

In the Windows and Linux versions of Firefox 61, Mozilla debuted a feature it called "tab warming," that promises faster tab-to-tab switching.

As a user slides the mouse pointer toward and over a tab, Firefox detects the movement. The browser then preemptively renders the layers for the tab's (or tabs') display(s) and uploads those layers to the page compositor, "when we're pretty sure you're likely to switch to that tab," said Mike Conley, a Firefox developer, in a post to his personal blog.

Switching tabs using key combinations - on a Mac, it's Control-Tab - will not receive the same preemptive loading.

Conley downplayed the feature. "For many cases, I don't actually think tab warming will be very noticeable; in my experience, we're able to render and upload the layers2 for most sites quickly enough for the difference to be negligible," he wrote in that same post.

Don't forget security

Mozilla fixed 18 different security flaws in the Firefox 61 update - patches are a part of almost every upgrade - six of which were tagged "Critical," the company's most-serious ranking.

Also on the security front, Firefox 61 set support for the latest draft of TLS 1.3 as on-by-default. TLS 1.3 is an Internet-standard cryptographic protocol for encrypting the traffic between browser and site server; it was officially approved earlier this year.

Browser support for TLS 1.3, at least in an on-by-default setting, has been shaky. Last year, Chrome turned it on, but later back off when site and service incompatibilities popped up. Google's browser has yet to switch TLS 1.3 support on as the default.

Firefox 60

Mozilla this week released Firefox 60 for Windows, macOS and Linux, enabling a previously-only-tested policy engine so IT admins can manage the browser within the enterprise.

Firefox, which can be downloaded from here, updates in the background, so most users need only relaunch the browser to get the latest version. To manually update, pull up the menu under the three horizontal bars at the upper right, then click the help icon (the question mark within a circle). Choose "About Firefox." The resulting page shows that the browser is either up to date or details the updating process.

Mozilla usually updates Firefox every six to eight weeks; the last time it upgraded the browser, to version 59, was March 13, or eight weeks ago.

Quantum Enterprise goes live

In March, Mozilla asked for corporate volunteers to help it test a new policy engine that it would add to Firefox Quantum - the secondary name the developer slapped on its browser in late 2017 after a major redesign and recoding - so IT could administer the application through Group Policy on Windows.

As planned, Mozilla enabled the policy engine in Firefox 60, making it possible for the first time to manage the browser. "Firefox now supports a long-requested feature  - the ability for IT professionals to easily configure the browser using Windows Group Policy or a cross-platform JSON file," crowed Ryan Pollock, who leads Firefox product marketing, in a post to a company blog Wednesday.

Windows Group Policy is the de facto standard for software administration in the enterprise and is well-known to IT. Shops also running macOS or Linux - or those few that rely only on those operating systems - can instead add a .json (JavaScript Object Notation) file to Firefox's installation folder/directory. Mozilla has provided Group Policy templates and documented the construction of .json files on GitHub or its own support site. A listing of all the policies currently supported are also posted on GitHub.

Organizations can deploy either the standard Firefox, which Pollack referred to as "Rapid Release" in a nod to its every-six-week update cadence, or the long-available Extended Support Release (ESR). The latter remains feature-stable for about a year, receiving only security fixes during that time. At the end of a year, a new ESR build is produced from the then-latest Firefox.

Pollack touted Firefox's speed, something Mozilla has hung much of its Quantum marketing around, the Mozilla Foundation's emphasis on user privacy, and, of course, the new management skills in his pitch to corporations. Left unsaid was Mozilla's historical neglect of the enterprise: It kicked off ESR in 2012, but then took six years to add basic management through Group Policy.

The move also signals that Mozilla is actively after customers anywhere it can find them. Although Quantum collected praise from many reviewers when it launched last year, the overhaul has not returned the browser to growth, as tracked by independent metrics companies. U.S.-based vendor Net Applications, for example, has recorded an 11% decrease in Firefox's user share since Quantum's November debut.

Tokens replace passwords

Firefox 60 also added support for the WebAuthn API (application programming interface), which is enabled by default.

A W3 (World Wide Web Consortium) standard - albeit not finalized - WebAuthentication (truncated to WebAuthn) provides two-factor authentication for website log-ins using hardware keys that generate FIDO U2F tokens. Those keys, typically USB devices, are sold under names such as U2F Zero, ePass and Yubikey at prices ranging from $9 to $50.

Although Firefox 60 is the first browser to support WebAuthn, Google was a major driver of FIDO U2F; its Chrome has supported the keys since version 38 in 2014.

"WebAuthn is a set of anti-phishing rules that uses a sophisticated level of authenticators and cryptography to protect user accounts," Nick Nguyen, Mozilla's vice president of product strategy, wrote in a company blog post Wednesday. "It supports various authenticators, such as physical security keys today, and in the future mobile phones, or biometric mechanisms such as face recognition or fingerprints."

So, while Firefox 60 does not do away with log-on passwords, by supporting WebAuthn - and assuming site developers adopt the standard - Firefox in the future may do so with next-generation hardware keys.

Mozilla also patched 26 security vulnerabilities in Firefox 60, two of which were marked "Critical," the company's most serious threat ranking.

The next edition, Firefox 61, should reach users June 26, according to the browser's release calendar.

Firefox 59

Mozilla on Tuesday released Firefox 59 for Windows, macOS and Linux, continuing the trend of pushing performance improvements begun late last year.

Firefox, which can be downloaded from here, updates in the background, so most users need only relaunch the browser to get the latest version. To manually update, pull up the menu under the three horizontal bars at the upper right, then click the help icon (the question mark within a circle). Choose "About Firefox." The resulting page shows that the browser is either up to date or details the updating process.

Mozilla usually updates Firefox every six to eight weeks; the last time it upgraded the browser, to version 58, was Jan. 23, or seven weeks ago.

Pages load faster after cache changes

Firefox 59 stayed on Mozilla's 2017 theme train - more speed - that debuted with November's launch of the first named edition, tagged as "Quantum," with claims of faster load times for the content on the browser's Home page. That content ranges from a series of frequently-visited websites and recommendations from the user-driven Pocket URL saver to examples of pages the user recently bookmarked.

Mozilla also switched on something called "Race Cache with Network" (RCWN), technology that alters the standard method of caching pages to memory that have been rendered previously. Caching, one of the most basic techniques to speed up the display of web pages in a browser, normally saves those pages to computer memory or the local disk drive.

RCWN, however, adds a network cache - in other words, off-site storage of the page - to the mix, then pits that against a local cache in a race to see which source delivers first. (Many ISPs, or Internet service providers, cache the most popular websites on multiple servers, placed throughout its area of service, to reduce the time it takes for customers to grab content.)

"When we detect that disk I/O may be slow, we send a network request in parallel, and we use the first response that comes back," wrote Valentin Gosu, a Mozilla engineer, in a 2017 post to a developers' discussion thread. "For users with slow-spinning disks and a low-latency network, the result would be faster [page] loads."

Finally, the "Off-Main-Thread painting" that Mozilla added to Firefox 58 for Windows in January has made it to macOS this iteration. Off-Main-Thread shifts some of the page rendering work - executing the graphics draw commands and thus generating the pixels to be put on the display - to a processor thread all its own. By reducing the main thread's workload, it's more likely that Firefox will be able to compose pages in time to keep high frame rate jobs from skipping frames.

More new tab page customization options

Firefox 59 also introduced additional customization choices for the Home page, which doubles as the new tab page (what appears when creating a new tab through, say, pressing Ctrl-T in Windows or Command-T in macOS). The "Top Sites" thumbnails of the most-frequently visited URLs can now be dragged and dropped to rearrange the small images.

Mozilla

Firefox 59, which began reaching users March 13, includes new settings to customize the Home page, which also acts as the new tab page for the browser. Users can strike the Pocket recommendations, for example, and double the number of site favorites which display as thumbnails.

Other elements in the new tab page may also be personalized to show more than a single line of top sites, or to eliminate, for example, the Pocket or Highlight sections entirely.

Elsewhere, Firefox's preferences now include opt-in settings that will block all future requests to turn on in-browser notifications, switch on the device's camera or microphone, or enable location detection. While all of those features have been, and are, used in reasonable fashion by legitimate websites, less courteous - or simply scammy - URLs have poisoned the well by demanding those permissions without good reason.

Trusted sites can be allowed access or individual websites blocked through a combination blacklist/whitelist.

Testing starts for Quantum Enterprise

As Mozilla delivered Firefox 59, it also began taking requests from company IT administrators to participate in an invitation-only beta of Firefox Quantum for Enterprise.

While the enterprise browser will be identical to that issued to everyone else, Mozilla intends to provide a policy engine, one compatible with Windows Group Policy - the de facto standard for software administration - with the browser. That will be a first for the open-source developer.

"Firefox 60 will include a policy engine that increases customization possibilities and integration into existing management systems," Mozilla said in January when it announced the plan.

Although the initial release will support a "limited number" of policies, Mozilla said it would expand that list based on enterprise user feedback. That feedback is what the company is after now, in fact: The beta is intended to gather impressions and make changes before May, when Firefox 60 and the policy engine, are slated to ship.

Administrators can sign up for the beta here.

For more information on the policy engine, admins should steer for the introductory instructions on this page.

Mozilla also patched 18 security vulnerabilities in the just-released version, two of which were marked "Critical," the company's most serious threat ranking.

The next edition, Firefox 60, should reach users May 9, according to the browser's release calendar.

Firefox 58

Mozilla last week released Firefox 58 for Windows, macOS and Linux, building on the break-from-the-past Quantum edition of November by boosting page load speeds with changes to how the browser handles JavaScript.

Firefox, which can be downloaded from here, updates in the background, so most users need only relaunch the browser to get the latest version. To manually update, click the help icon - the question mark within a circle -- after pulling up the menu under the three horizontal bars at the upper right. Choose "About Firefox." The ensuing page shows that the browser is either up to date or details the updating process.

Mozilla usually updates Firefox every six to eight weeks, although the interval tends to lengthen around the end of each year; the last time it upgraded the browser, to version 57, aka "Quantum," was Nov. 14, or 10 weeks ago.

New JavaScript cache

Firefox 58 continued Quantum's theme of 2017 - a need for speed - with changes to the browser's storage and retrieval of JavaScript code. Dubbed "JavaScript Startup Bytecode Cache" (JSBC), the enhancements trade memory for faster page load times.

"The JSBC aims at improving the startup of web pages by saving the bytecode of used [JavaScript] functions in the network cache," Nicolas Pierron, a compiler engineer at Mozilla, wrote in a December post to a company blog. To reach a reasonable balance - one that increases speed with the best return from the additional memory used by the cache - JSBC only kicks into gear at the fourth visit to a website. On sites that frequently load JavaScript, JSBC cut load times by as much as 12% (on Facebook), although most test results, said Pierron, were in single digits (Amazon: 5%; Wikipedia: (8%).

The downside: More memory is consumed by dedicating it to storing the JavaScript. Pierron did not spell out the memory cost of implementing JSBC, however.

More multi-threading

Firefox 58 also introduced another speed-centric change, this one consistent with Mozilla's work to separate into different CPU processes the steps used to compose a web page. Characterizing the change as one that "more efficiently paints your screen, using a dedicated CPU thread," particularly to improve JavaScript frame rate, Mozilla labeled it as "Off-Main-Thread painting." The effort is for Windows only, Mozilla noted.

Previously, the bulk of the page composition was done on a single processor thread, but Off-Main-Thread shifts some of the work - executing the graphics draw commands and thus generating the pixels to be put on the display - to a thread all its own. By reducing the main thread's workload, it's more likely that Firefox will be able to compose pages in time to keep high frame rate chores from skipping frames.

Like JSBC, Off-Main-Thread takes aim at JavaScript, because it's often JavaScript code that is producing the content with high frame rates. On Windows, Mozilla claimed a 30% boost to frame rate on a benchmark that stressed the processor with JavaScript.

Better Tracking Protection

Mozilla also spent time in its standard on-release blog post to hype an older feature, Tracking Protection. With Firefox 57 (Quantum), Mozilla opened the opt-in to all sessions, not just the private browsing mode in which Tracking Protection debuted two years ago.

Tracking Protection does just what the label implies: When enabled, it blocks a wide range of content, not just advertisements but also in-page trackers that sites or ad networks implant to follow users from one site to another.

Historically, Mozilla has touted Tracking Protection as a win for individuals' online privacy, a message in line with the company's broader theme that its products, Firefox in particular, are designed as privacy-first. Now, however, Mozilla has bent that pitch to align with its overall need-for-speed mantra.

"In addition to protecting their privacy, users actually have a better, faster experience with the web when pages load without trackers," argued Nick Nguyen, Mozilla's top Firefox executive, in a post to a company blog last week. On average, page load times were cut in half compared to Firefox with Tracking Protection disabled, Nguyen said.

Many content blockers - ranging from those that specialize in stymying ads to those that remove everything but a page's text - make the same claim, of course. By stripping a page of some of its content, it will load faster.

Mozilla patched 32 security vulnerabilities in the just-released version, only one of them marked "Critical," the firm's highest ranking.

The next edition, Firefox 59, should reach users March 12, according to the browser's release calendar.