My contributions to today’s Firefox release

Today marks a new release for Firefox, version 15. For this release I spent most of my time working on two larger areas along with some other bugs in various places. The new plugin click-to-play setting continued to gain features and stability, and there was also some follow-up site identity work to take care of.

Work on our plugin click-to-play continues to this day, as it will be the ground work for soft-blocking malicious plugins in the future. If you’d like to help test out the feature, you can go to about:config and enable the plugins.click_to_play preference.

Enabling the feature will disable plugins by default, increasing your security and reducing memory usage while you browse the web. For more information about click-to-play plugins, see my two previous blog posts about the initial rollout as well as site-specific permissions.

Firefox 14 introduced a refresh to our site-identity area of the location bar. Most of the changes to the site-identity got “uplifted” to our Firefox 14 release so as to not introduce back-to-back changes. The most notable change in the site-identity area between Firefox 14 and Firefox 15 is higher contrast security icons in the location bar. The locks are now darker and should be easier to differentiate from the globe.

Two smaller changes that are worthy of note for Firefox 15 are related to Windows integration and our standalone image styling.

Firefox 15 brings with it unique icons for the three jumplist tasks that are associated with Firefox. I blogged previously about them, so you can read more if you are interested.

Since we released our new styling for standalone images, we got a lot of feedback from people who had trouble with the way that we rendered transparent images. Starting with Firefox 15 we have reverted to showing transparent images on a white background.

We took special care to bring the best experience that we could to this situation. Images that are slow to load or need to be re-decoded will not have the white background flash in to view. This new white background is only applied after the image has finished decoding, so if you are loading an opaque image you should never see the white background. Try it out with this image.

Site-specific permissions for Firefox’ opt-in plugins

Today I landed an implementation of site-specific permissions for Firefox’ opt-in plugins. I previously wrote about Firefox 14’s non-default support for opt-in (also known as click-to-play) plugins last week.

That blog post garnered a lot of attention. Over 25 news sites covered the news, and the blog post was viewed close to 3,000 times.

Many people downloaded the Nightly version of Firefox to test out the feature, and a few people have told me how they are now using the feature full-time. Today’s addition of site-specific permissions makes using the feature much easier.

With site-specific permissions, users can whitelist sites that they visit often and trust. Sites that are whitelisted will activate plugins automatically upon load.

To add site-specific permissions, click on the plugin block in the location bar. The doorhanger that appears contains a dropdown with options to: Activate plugins; Always activate plugins for this site; Never activate plugins for this site; and Not Now.

To manage these permissions, users can click on the site-identity block next to the website address. From there, click on “More Information…“. The Page Info dialog will now appear. Clicking on the Permissions tab of the dialog will show any site-specific permissions that are stored for the current site, as well as the ability to change any of those permissions.

This feature will remain disabled by default in Firefox 14. David Keeler is also helping implement the feature, and has most recently been working on adding the ability to only enable plugins of a specific runtime (Flash, Java, Silverlight, etc). For more information on the status of the feature, see our feature page for Opt-in Activation of Plugins.

Opting-in to plugins in Firefox

Whether you hate them or love them, content accessed through plugins is still a sizable chunk of the web. So much so, that over 99% of internet users have Flash installed on their browser. However, plugins can also carry with them extra vulnerabilities and system slowdowns.

A couple days ago I landed an initial implementation of “click-to-play plugins” in desktop Firefox. To see and play with the feature, download a Nightly build of Firefox, go to about:config, and enable the plugins.click_to_play flag.

When plugins.click_to_play is enabled, plugins will require an extra click to activate and start “playing” content. This is an incremental step towards securing our users, reducing memory usage, and opening up the web.

I’m currently working on implementing the ability for plugin activation settings to be remembered on a per-site basis. I hope to get these changes landed within the next week before the deadline for Firefox 14.

If you are curious and want to learn more about our plans for opt-in activation of plugins, you can take a look at the feature page on our wiki.