1013457 - Remove the browser.frames.enabled pref

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[:Gijs (he/him)]

Because it's basically just a footgun on today's web. Footguns aren't nice. Let's not have footguns.

Comment 1

[:Gijs (he/him)]

Attachment: remove browser.frames.enabled pref,

Try push: remote:   https://tbpl.mozilla.org/?tree=Try&rev=64521a47e4b5

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8427224 [details] [diff] [review]
remove browser.frames.enabled pref,

r=me

Comment 3

[Boris Zbarsky [:bzbarsky]]

Oh, maybe update the comment in content/base/test/chrome/test_bug650784.html ?

Comment 4

[:Gijs (he/him)]

(In reply to Boris Zbarsky [:bz] from comment #3)
> Oh, maybe update the comment in content/base/test/chrome/test_bug650784.html
> ?

Ugh, that got qrefed into the trypush cset. D'oh.

( https://hg.mozilla.org/try/rev/64521a47e4b5 )

will merge before pushing, assuming try comes back green.

Comment 5

[:Gijs (he/him)]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/12cfcb8b79cf

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/12cfcb8b79cf

Comment 8

[Serhiy]

Congratulations, you've shot the most convenient workaround for this security and usability issue without providing any replacement: http://security.stackexchange.com/questions/31991/is-there-any-way-i-can-block-or-conditionally-approve-of-iframes-on-the-client

Comment 9

[daniel92frei]

@Gijs
That's just your opinion. In some cases, security is the preferred option before visual appeal.

Can the choice 'browser.frames.enabled' be an option again? (cause firefox is about choice)

Comment 10

[Boris Zbarsky [:bzbarsky]]

The preference caused a significant maintenance burden, which is why it was removed.  It's not going to be restored, because the tradeoffs are not worth it.

If people just want to block all loads in subframes like the pref did, that's pretty simple to do with an extension.  It's going to break various websites and parts of the Firefox UI, of course...