29 Jul 2026

feedPlanet Mozilla

About:Community: Community Roundup: Project Nova, Tab Groups & more

Firefox keeps evolving, and the community continues to play a big part in shaping what's next.

In this edition, you can get an early look at Project Nova through our latest foxfooding opportunity, explore Tab Groups on Android, join the conversation on Mozilla's latest browser choice research, and meet an Outreachy contributor whose journey reminds us why open source thrives through collaboration.

Get ready to dive in!

Hot from the oven: Join Project Nova foxfooding

We teased it in the last edition, and now it's here. Project Nova has finally arrived on Firefox Nightly, and you're invited to be an early tester! Get a look at Firefox's refreshed design as we put the finishing touches on the experience ahead of its broader release later this year. If you're curious about what's coming next, this is your chance to try it out, share your feedback, and help shape the final product.

Learn more

Monthly Community Call today!

Mozilla Monthly Community Call banner promo

Want to ask questions directly to the people working on Firefox? Join us for today's Monthly Community Call, where we'll discuss Project Nova and Firefox performance feature with members of the teams working on these projects. Join the call today, July 29, 2026, at 5:00 PM UTC, and bring your questions!

Watch our livestream

Tab groups arrives on Android

You've been calling out for tab group functionality on Firefox mobile and now Tab Groups have officially arrived on Firefox for Android! Tab Groups make it easier to organize related tabs into color-coded groups for work, travel, shopping, research, or whatever you're browsing. Give it a try, and if you have ideas for how it could be even better, let us know on Mozilla Connect.

Read more

From the Reddit Community

Mozilla recently shared new independent research examining how browser choice is shaped by the design of operating systems. The report explores the obstacles users can encounter when downloading, setting, or continuing to use their preferred browser, and argues that people should be able to choose their browser without unnecessary friction. Read the report, join the discussion, and share your perspective!

And of course, thanks to you for choosing Firefox!

Access the report

Community spotlight

Every contributor starts somewhere. In a recent blog post, Ananya Shree Sharma reflects on her journey through the Outreachy internship with Firefox. From navigating a large open source codebase for the first time to collaborating with mentors, learning new skills, and shipping meaningful improvements. Her story is a reminder that open source is as much about learning, mentorship, and community as it is about writing code. If you've ever wondered what it feels like to contribute to Firefox, Ananya's reflections offer an inspiring look at the experience and the people who make it possible.

Read more


P.S.

Enjoyed these updates? Subscribe to the Mozilla Community Newsletter and get the latest updates delivered straight to your inbox.

29 Jul 2026 9:04am GMT

27 Jul 2026

feedPlanet Mozilla

Firefox Tooling Announcements: MozPhab 2.15.4 Released

Bugs resolved in Moz-Phab 2.15.4:

Discuss these changes in #engineering-workflow on Slack or #Conduit Matrix.

1 post - 1 participant

Read full topic

27 Jul 2026 4:15pm GMT

Firefox Nightly: Try the New Firefox Design in Nightly

This past May, we shared our vision for the future of Firefox. Starting today, you can try out the next design evolution of Firefox in Nightly.

It's still Firefox, now with a more cohesive look and feel across tabs, menus, panels, and other browser surfaces. You'll notice softer tab shapes, a warmer color palette, updated icons, and - after hearing from many of you - the return of Compact Mode and new theme options to make Firefox your own.

Many of you have already spotted pieces of the new design in Nightly over the past few months. Now they're coming together into one complete experience.

You'll continue to see updates over the coming weeks as we polish the new Firefox design before it reaches Firefox users more broadly later this year. As you browse, we're especially interested in any visual or functional issues you encounter.

Keep an eye out for things like:

Found a bug?

If something doesn't look or behave as expected, please file a bug in Bugzilla.

When possible, include:

If you have broader thoughts or questions about your experience, join the discussion on Mozilla Connect.

Thanks for using Nightly and helping us improve Firefox. Every bug report helps us identify issues and continue refining the new Firefox design before it reaches Firefox users more broadly later this year.

27 Jul 2026 3:00pm GMT

23 Jul 2026

feedPlanet Mozilla

Firefox Tooling Announcements: Happy BMO Push Day! (20260723.{1,2})

The following changes have been pushed to bugzilla.mozilla.org:

Github Link

Github Link

The following changes have been pushed to bugzilla.mozilla.org:

Discuss these changes in the BMO Matrix Room

1 post - 1 participant

Read full topic

23 Jul 2026 10:34pm GMT

Mozilla Addons Blog: Firefox 153 WebExtensions API updates

We had a bumper release of WebExtensions API updates in Firefox 153. To start, there is a permissions change that affects how your extensions access local files. We then have two contributions from the community members: userScripts.execute() and the new publicSuffix API. We're covering those contributions in more depth, including the people behind them, in a separate post. And there is more, read on…

File access now requires a dedicated permission

Extensions that need to read file:// URLs used to get that access as part of the "Access your data for all websites" host permission. Starting in Firefox 153, file access is a separate, explicit permission, "Access local files on your computer", shown in the extension's permissions settings. It's off by default for every extension, including ones already installed.

This change has a few concrete effects on code:

async function checkFileSchemeAccess() {
  const isAllowed = await browser.extension.isAllowedFileSchemeAccess();

  if (!isAllowed) {
    await browser.notifications.create("file-scheme-access-needed", {
      type: "basic",
      iconUrl: browser.runtime.getURL("icons/icon-48.png"),
      title: "Local file access required",
      message:
        'This extension needs "Allow access to file URLs" enabled to work ' +
        "with local files. Go to about:addons → select this extension → " +
        "turn on that setting, then reload the page.",
    });
    return false;
  }

  return true;
}

devtools.inspectedWindow.eval() calls targeting file:// URLs are affected the same way; they now require this permission to succeed.

If your extension depends on file:// access, expect existing users to see that access stops after upgrading (until they enable the permission), and consider adding a prompt or fallback path, for example by specifying an embedded options page (options_ui) and calling browser.runtime.openOptionsPage() to open about:addons and including instructions to toggle the setting in the "Permissions and data" tab.

userScripts.execute() and publicSuffix: covered in our next post

Firefox 153 adds two community-contributed APIs:

Both APIs were built by contributors motivated by real needs in their extensions. We take an in-depth look at these contributions, their developers, impact, and history in a forthcoming post.

documentId support across more APIs

Firefox 153 introduces documentId, a stable identifier for a document instance, including a new runtime.getDocumentId() method, several webNavigation events and methods, webRequest events, scripting injection targets, and the extension messaging APIs.

Many WebExtension APIs use tabId and frameId to identify where to perform an operation. However, because frameId identifies the frame rather than its content, the loaded document can change and the extension's subsequent operation ends up targeting the new (intended) document. documentId addresses this problem by providing a unique ID for the document. Now, if an extension uses the ID and the frame's document has changed, the operation fails rather than silently targeting the wrong document.

See Work with documentId for the full list of supported events and methods, along with guidance on using it.

Content scripts can read and modify adopted stylesheets

Content scripts can now access document.adoptedStyleSheets and ShadowRoot.adoptedStyleSheets directly.

const sheet = new CSSStyleSheet();
sheet.replaceSync("* { background: pink; }");
document.adoptedStyleSheets = [sheet];

This enables extensions to inspect or modify constructed stylesheets from a content script, without using .wrappedJSObject, a workaround that risks interference from the web page.

Theme manifest key: gradients in additional backgrounds

The theme manifest key's images.additional_backgrounds property now accepts CSS gradients alongside image URLs. A new properties.additional_backgrounds_size property controls the size of each additional background item.

Contextual identities (containers)

If your extension supports contextual identities, you now have access to two new methods: contextualIdentities.getSupportedColors() and contextualIdentities.getSupportedIcons(). These methods return the supported colors and icons, so your extension doesn't need to hardcode either list.

Also, the colors have been updated to align with the new UI theme: "turquoise" is now "cyan", "toolbar" is now "gray", and "violet" has been added. The old names still work for backward compatibility, but your extension should switch to using getSupportedColors() rather than hardcoding either the old or new names.

Add a build-for-amo script

While this isn't about new APIs, I wanted to mention a change that's part of our work to make source code review faster and more reliable. When you submit an extension version, AMO now attempts to build your extensions from the submitted source code and compares the result to the package you uploaded. When the two match, reviewers don't have to verify the build manually. This means submission can move through its review faster.

For now, this applies only if you submit source code that includes a package.json file to build your extension. If your extension has no build step, or you use a different build system, nothing changes. The AMO builder keeps its zero-config approach.

So, if your extension's source code uses a package.json file, add an npm script named build-for-amo that runs the commands needed to build your extension for Firefox:

{
  "scripts": {
    "fx-build": "some commands to build your add-on for Firefox",
    "build-for-amo": "npm run fx-build"
  }
}

If you've a Firefox-specific build command, just point build-for-amo at it. When present, the builder invokes this script instead of guessing how to build your extension. And while you are at it, make sure all your dev dependencies are listed in the package.json file.


For more information, including documentation and Bugzilla links, see the Changes for add-on developers section of the Firefox 153 for developers release notes on MDN.

As always, file extension-related issues on Bugzilla under the WebExtensions product, cross-browser API proposals are discussed in the W3C WebExtensions Community Group, and questions are welcome on the Add-ons Discourse.

The post Firefox 153 WebExtensions API updates appeared first on Mozilla Add-ons Community Blog.

23 Jul 2026 11:35am GMT

22 Jul 2026

feedPlanet Mozilla

Thunderbird Blog: Thunderbird 153 “Meadow” is out now!

As we head into the summer months, a new Extended Support Release (ESR) is in full bloom. Thunderbird 153 "Meadow" is out now, and from all of us at MZLA, the Thunderbird Council, and our global community of contributors, we can't wait for you to try it out.

"Meadow" builds on Thunderbird 140 "Eclipse," along with the steady stream of features and improvements that have landed in the Monthly Release channel over the past year. This release makes first-time setup smoother with a redesigned Account Hub, brings native Microsoft Exchange support out into the open, and lets Thunderbird take on the colors of your desktop. Add privacy-minded networking, friendlier notifications, and a healthy crop of refinements, and Meadow is ready to grow with you.

Easier Account Creation

The all-new Account Hub makes setting up accounts faster and more intuitive than ever, with improved autodiscover, automatic protocol detection, and automatic setup of connected calendars and address books.

Address Book Setup

The new Account Hub modal lets you set up all types of local and remote address books. Existing email accounts are automatically scanned to detect available address books that haven't been configured yet.

Microsoft Exchange Support

We've added full support for Exchange email servers via Exchange Web Services: set up Microsoft Exchange accounts natively to read, manage, and write emails, no add-ons required. Experimental Microsoft Graph support is already in core but temporarily disabled behind a preference while we finish it, with full support plus Calendar and Address Book integration aimed for later this year.

Accent Colors

Meadow now inherits your operating system's accent color to match your preferred look. You can also customize your colors with the new accent color settings in the Appearance tab.

Do More From Your Notifications

Mark an email as read, delete it, flag it as spam, and more right from the native notifications on your operating system.

In addition to these headline features, there's a whole host of other updates you'll love, including:

OAuth in Browser

Thunderbird now supports OAuth authentication directly in your default browser.

Login With Thundermail

If you have a Thundermail account, you can sign in to Thunderbird with one-click authentication in the Account Hub.

Folder Sorting

An improved UI and better visual indicators make sorting your emails easier than ever.

Bug Fixes and Improvements

Thousands of bug fixes and performance improvements bring you the smooth, reliable Thunderbird experience you expect.

Looking Forward

Thunderbird 153 "Meadow" might seem soothing and calm, but we're excited to get these features into your hands. And if you'd like updates like these more often, there's no need to wait for the annual release: switching to Thunderbird Release gets you new updates on a monthly basis.

Thunderbird 153 Availability for Windows, Linux, and macOS

Even with QA and beta testing, any major software release may have issues that only surface after significant public use. That's why we're rolling out automatic updates gradually, enabling them more broadly as we confirm everything is stable.

Manual upgrade to 153 is now enabled via Help > About - you can upgrade now or wait to receive automatic updates. Thunderbird 153.0 is also offered as a direct download from thunderbird.net. Be sure to select 'Thunderbird Extended Support Release' in the 'Release Channel' drop-down menu.

For Linux users running Thunderbird from the Snap or Flatpak, 153 will be available within the next few weeks. Likewise, Thunderbird 153 will arrive on the Microsoft Store by mid-July.

Full release notes can be found here.

If you have any issues, please reach out to support.

Have an idea? We want to hear it! Submit your ideas here.

The post Thunderbird 153 "Meadow" is out now! appeared first on The Thunderbird Blog.

22 Jul 2026 9:45pm GMT

Firefox Tooling Announcements: July 22nd Deploy

The latest version of PerfCompare is now live!

Check out the change-log below to see the updates:

[kala-moz]

[moijes]

[sumairq]

Thank you for the contributions!

Bugs or feature requests can be filed on Bugzilla. The team can also be found on the #perfcompare channel on Element. Come and chat!

1 post - 1 participant

Read full topic

22 Jul 2026 5:36pm GMT

This Week In Rust: This Week in Rust 661

Hello and welcome to another issue of This Week in Rust! Rust is a programming language empowering everyone to build reliable and efficient software. This is a weekly summary of its progress and community. Want something mentioned? Tag us at @thisweekinrust.bsky.social on Bluesky or @ThisWeekinRust on mastodon.social, or send us a pull request. Want to get involved? We love contributions.

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official
Newsletters
Project/Tooling Updates
Observations/Thoughts
Rust Walkthroughs

Crate of the Week

This week's crate is xan, a TUI toolkit to work with CSV files.

Thanks to Simeon H.K. Fitch for the suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

576 pull requests were merged in the last week

Compiler
Library
Cargo
Rustdoc
Clippy
Rust-Analyzer
Rust Compiler Performance Triage

The two most notable changes this week were #159115, which resulted in pretty nice instruction count wins for full incremental builds on several benchmarks, and #159091, which enabled PGO for rustdoc, which makes it ~3-4% faster across the board.

There were two large rollups with tiny performance regressions, which made it difficult to find the offending PRs.

Triage done by @Kobzol. Revision range: 5503df87..d527bc9b

Summary:

(instructions:u) mean range count
Regressions ❌
(primary)
0.4% [0.2%, 1.0%] 40
Regressions ❌
(secondary)
0.7% [0.2%, 4.6%] 69
Improvements ✅
(primary)
-2.0% [-6.2%, -0.2%] 136
Improvements ✅
(secondary)
-2.6% [-8.4%, -0.2%] 119
All ❌✅ (primary) -1.4% [-6.2%, 1.0%] 176

2 Regressions, 3 Improvements, 6 Mixed; 4 of them in rollups 34 artifact comparisons made in total

Full report here.

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

Tracking Issues & PRs

Rust

Compiler Team (MCPs only)

Leadership Council

Unsafe Code Guidelines

No Items entered Final Comment Period this week for Cargo, Language Reference, Language Team or Rust RFCs.

Let us know if you would like your PRs, Tracking Issues or RFCs to be tracked as a part of this list.

New and Updated RFCs

Upcoming Events

Rusty Events between 2026-07-22 - 2026-08-19 🦀

Virtual
Africa
Asia
Europe
North America
Oceania
South America

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

We were planning on publishing a blog post announcing this at the same time as making the repo public, but ran out of private repo CI usage 😭.

- Carl Lerche on r/rust about the launch of topcoat

Despite a lamentable lack of suggestions, llogiq is glad to have found this quote.

Please submit quotes and vote for next week!

This Week in Rust is edited by:

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

22 Jul 2026 4:00am GMT

21 Jul 2026

feedPlanet Mozilla

Firefox Developer Experience: Firefox WebDriver Newsletter 153

WebDriver is a remote control interface that enables introspection and control of user agents. As such, it can help developers to verify that their websites are working and performing well with all major browsers. The protocol is standardized by the W3C and consists of two separate specifications: WebDriver classic (HTTP) and the new WebDriver BiDi (Bi-Directional).

This newsletter gives an overview of the work we've done as part of the Firefox 153 release cycle.

Contributions

Firefox is an open source project, and we are always happy to receive external code contributions to our WebDriver implementation. We want to give special thanks to everyone who filed issues, bugs and submitted patches.

Firefox 153, multiple WebDriver bugs were fixed by contributors:

WebDriver code is written in JavaScript, Python, and Rust so any web developer can contribute! Read how to setup the work environment and check the list of mentored issues for Marionette, or the list of mentored JavaScript bugs for WebDriver BiDi. Join our chatroom if you need any help to get started!

All Changes

A complete list of developer-facing changes included in this Firefox release is available in the MDN Firefox 153 Release Notes.

21 Jul 2026 8:18pm GMT

The Mozilla Blog: Your Android tabs just got a lot more organized with Firefox

Tabs pile up fast on mobile. Imagine you're planning a summer barbecue, and you start by searching for the best rib recipe. Twenty minutes later, you're 17 tabs deep: comparing marinades, debating side dishes, checking the weather, making a grocery list and adding songs to a playlist.

None of those tabs are organized. They're mixed in with everything else you've been browsing, making it hard to keep track of what you're saving for later.

Now you can group related tabs in Firefox for Android, keeping them together in labeled, colored groups so you can actually find what you need when you need it.

Animation showing related tabs being grouped together in Firefox for Android, then displayed as a single labeled tab group in the tab tray.

How it works

Drag one tab onto another, or select a few and tap "Add to group." Name it, pick a color, and you're done.

Each group appears as a single card in the tab tray rather than a dozen separate tabs. You can open it, rename it, recolor it, or delete it whenever you want. Search still finds tabs inside a group, too.

Illustration of Tab Groups in Firefox for Android, showing tabs being grouped, named and color-coded, then displayed together in a single organized group.

So when you're standing in the produce aisle looking for that rib recipe, you won't have to scroll past dozens of unrelated tabs just to find it. Everything for your barbecue is organized together in one place, ready when you need it.

Finally sorted, as it should be

Tab grouping was the most requested feature from Firefox mobile users in 2025. And we get it: your tabs shouldn't get harder to manage the more you use your browser. Download the latest version of Firefox for Android now to try Tab Groups, with iOS support on the way.

The post Your Android tabs just got a lot more organized with Firefox appeared first on The Mozilla Blog.

21 Jul 2026 4:00pm GMT

The Mozilla Blog: Quick Answers: For the questions in between

You're planning a trip. Reading an article. Following a recipe.

Then a question pops into your head. Sometimes it leads down a rabbit hole - with more searches, more tabs and plenty to explore. Other times, you just need a little context so you can get back to what you were doing.

That's why we're introducing Quick Answers for Firefox on iOS.

With Quick Answers, you can ask a question using your voice and get a concise answer. Just open a new tab, long-press the voice button and ask.

For example:

If a quick answer is all you need, you're done.

If you want to dig in deeper, the links to supporting sources are there for exploration.

Built with transparency and privacy in mind

We've built Quick Answers to be transparent about how it works and what data is shared.

Voice is processed on your device using Apple's speech recognition technology. No raw audio is stored or sent to the server, and Firefox doesn't share your browsing history or personal context with the AI model. Only the transcribed text of your question is sent to generate an answer. You can turn the feature off at any time in Settings → AI Controls.

Quick Answers is starting to roll out today to Firefox for iOS users in the U.S. using English.

Oh, and if you're wondering…

The Firefox logo

Take control of your internet

Download Firefox

The post Quick Answers: For the questions in between appeared first on The Mozilla Blog.

21 Jul 2026 4:00pm GMT

The Mozilla Blog: Experience Better Browsing: Introducing Native Containers in Firefox 153

Today, we're excited to announce the Preview of Containers in Firefox version 153, which lets you keep separate parts of your online life (work, shopping, personal, banking) logged into different accounts in the same browser window, but keeps your cookies and ad tracking isolated inside each container.

This means that stuff you do in one container isn't seen by other containers. No longer will you search for a new hat to wear to a party, only to be inundated with ads for hats at every twist and turn on the internet for weeks to come.

For almost a decade, many of you have relied on our Multi-Account Containers extension to keep work, personal, and privacy-sensitive browsing separate without needing multiple browsers or profiles.

We've heard your feedback and understood the value you find in that separation. Now, we're bringing the power of the Multi-Account Containers extension directly into the heart of Firefox for all to benefit from.

Why bring Containers into Firefox?

Whether you're managing multiple social media accounts, separating work projects from personal shopping, or simply keeping your banking activity distinct, Containers are designed to help you organize your digital space. By making Containers a native, first-party feature in Firefox 153, we are:

What to expect in the Preview

In this preview release, you can:

If you're already using the Multi-Account Containers, there's nothing special you need to do. Not all of the features of the add-on are available in the first-party version of containers just yet, we're still building them out. You can continue to use the add-on alongside the built in containers, no need to uninstall the add-on.

This release represents our first step in making Firefox more adaptable to how you actually live and work online. While this is just the beginning, we have plans to refine this experience and build a foundation for future features that make context separation even more seamless.


Join the Conversation

We're eager to hear how this native experience fits into your daily routine. As you explore the new Containers Preview in Firefox 153, please let us know what you think by posting your feedback in this Mozilla Connect thread. Your feedback helps us shape the future of these tools and ensures we're building features that truly matter to you.

The Firefox logo

Take control of your internet

Download Firefox

The post Experience Better Browsing: Introducing Native Containers in Firefox 153 appeared first on The Mozilla Blog.

21 Jul 2026 4:00pm GMT

Firefox Tooling Announcements: Firefox Profiler Deployment (July 21, 2026)

The latest version of the Firefox Profiler is now live! Check out the full changelog below to see what's changed:

Highlights:

Other Changes:

Big thanks to our amazing localizers for making this release possible:

Find out more about the Firefox Profiler on profiler.firefox.com! If you have any questions, join the discussion on our Matrix channel!

1 post - 1 participant

Read full topic

21 Jul 2026 12:44pm GMT

Martin Thompson: Why in Building Protocols, Like Code, Starting Over Is Dumb

Today, the IETF held the CURRENT BoF, where the goal was to develop a new protocol. That protocol would be substantially like TLS, reusing its record layer and basic structure, but it would drop in MLS for key exchange.

This is somewhere between a pretty bad idea and a horrible idea.

The wholesale replacement of a huge chunk of protocol architectures is a hallmark of a lot of the AI-generated protocol proposals that have flooded the IETF. A small blemish is identified, then the fix is a whole new protocol, or a major piece of surgery. No regard for the wisdom of Chesterton's Fence or the accumulated knowledge and usefulness embodied in what exists.

Experienced engineers know that rewriting a code module is not something you do lightly. There's lots of literature out there about why this is a bad idea generally, and some emerging discussion about how AI might just change that.

The reasons not to rewrite a software component still largely apply to a protocol component. The reasons that AI might make it easier to do that safely, less so. Protocols are different.

Wholesale Change Will Miss Use Cases

Just like with a code change, a protocol component that changes will miss use cases that people really care about.

The usual concerns with code apply:

Unlike code changes, you probably don't have a test case for existing features that you didn't know about. We found that with HTTP/2, where a number of use cases got lost in the process of "upgrading" HTTP.

In HTTP/1.1, performing client authentication in the middle of request was possible. Losing that capability in HTTP/2 affected few enough people that it was not badly damaging for the ecosystem. It still sucked.

A lot of work was done to try to find these issues, but we did not learn about these problems until fairly late in the process.

Proposing a protocol change means asking a whole lot of other people, many of whom are not invested in your goals, to do that work.

Changing a protocol by replacing a chunk of it, no matter how much care is taken, either asks the entire ecosystem to change with you.

That means asking everyone to move with you. If they don't, you are not changing the protocol, you are forking it.

Forking A Protocol Destroys Interoperability

The real value of having a protocol like TLS is that a great many things can all talk to each other.

Forking a protocol - and sometimes profiling a protocol, a subject for another post - destroys that. You now have two ways to achieve the same goal, and a choice to join one of two clubs. You can join both, but that means constantly translating back and forth, something that can only get harder over time as protocol semantics diverge.

And yes, in case you were asking, this applies to the entirety of the IETF IoT sphere, which has parallel HTTP, TLS, and other analogues. Ostensibly, these address the needs of highly constrained hardware, but the cost is an ecosystem cut off from the mainstream.

But Fixing Protocols Is Hard

Yes, existing protocols come with baggage or technical debt. Maybe they aren't perfectly optimized for your use.

The value that an existing protocol carries is that you are sharing the burden of its maintenance with a great many more people. Fixing it, maybe by adding extensions to support your needs, comes with opportunities to improve the protocol even beyond that immediate need. Every change is a chance to work off some of the accumulated cruft.

Major refreshes, like the TLS 1.3 reworking, cleared out a ton of cruft in the process. You get to benefit from the work that others do to improve that protocol too.

Do the Work

It is hard to be a responsible steward for the fabric of the Internet. We do it because it is worthwhile. Ignoring the lessons of the past is not helpful.

21 Jul 2026 12:00am GMT

17 Jul 2026

feedPlanet Mozilla

Mozilla Privacy Blog: Beyond technical fixes: Protecting kids online without breaking the internet

This is part one of a two-part series in which we explore approaches to protecting children online while safeguarding privacy, security and the open web. Part one covers our concerns regarding age gates, and alternative policy proposals that address the root causes of online harms.

Young people today have unprecedented opportunities to learn, connect, and explore - not just the web and the world, but also themselves. With the increased ubiquity of digital technologies and devices, worries around the relationship between these technologies and young people's well-being have grown, too. While concerns about the societal implications of new technologies is not a new phenomenon, experts argue that the accelerating speed of deployment of new technologies has outpaced scientists' capacity to feed into policy recommendations addressing risks. A growing body of research documents the harms experienced by young people online and the challenges reported by parents attempting to mediate their kids' technology use. At the same time, experts highlight the importance of contextual factors like existing mental health conditions, socio-economic circumstances and parental mediation to understand the real-world effects of digital technologies.

Faced with this complexity, and mounting public pressure, policymakers around the world are urgently seeking ways to improve child safety online. Driven by a sense of time running out and promises of new technical solutions to difficult questions, this has led, across jurisdictions, to proposals to restrict young people's access to certain technologies or platforms by introducing age assurance mandates.

Privacy and user empowerment have always formed a core part of Mozilla's mission. As we have said before, we support safer spaces for minors, but we caution against approaches that rely on identity checks, surveillance-based enforcement, or exclusionary defaults. Such interventions rely on the collection of personal and sensitive data and, thus, introduce major new privacy and security risks.

While many technologies exist to verify, estimate, or infer users' ages, fundamental tensions around accessibility, their effectiveness and effects on user's privacy, security and free expression remain. Technological approaches must be part of wider efforts to address the root causes of online harms. However, the deployment of age assurance technologies will not solve the complex challenge of preparing young people to navigate an increasingly online world and ensure their wellbeing. That will require more holistic approaches: offering education and support to navigate the web safely, addressing harmful business practices and acknowledging the offline factors shaping children's lives including social inequality, poverty or disparate access to (mental) health care services.

Ineffective age-gating mandates and the dangerous shift toward VPN restrictions

As jurisdictions around the world gain experience with government-mandated age gates for certain services, evidence is mounting that age restrictions are not an effective policy tool. Avoiding age gates is widespread and trivially easy: In Australia, where minors under 16 year of age have been banned from certain social media platforms since December 2025, the government's Compliance Update reports that seven out of ten young Australians remain online, often skirting age checks by simply entering a fake birthdate. A recent study on the implementation of the UK's Online Safety Act found that a third of children have bypassed age gates with fairly trivial steps like faking their birthdate, borrowing someone else's login credentials, or even drawing on facial hair, and that a quarter of parents have helped their children to bypass age assurance systems. In the US, studies indicate that as far back as 2011, 64% of parents who were aware their child under 13 had a social media account were also ones who helped them create that account.

Confronted with the apparent ineffectiveness of age gates, policymakers around the world seem to be shifting their attention to alleged circumvention tools. While research shows that many young people bypass age barriers by using other people's devices and accounts or tricking age estimation tools by making themselves look older, virtual private networks (VPNs) are increasingly framed as primarily a "loophole" to age gates. VPNs create encrypted "tunnels" between a user's device and the internet, protecting all internet traffic from that device and concealing users' IP addresses. VPNs are an essential privacy and security resource for millions of users worldwide, including young people.

Utah's recent age verification law holds websites hosting age-restricted content liable for verifying the age of anyone physically located in Utah, including individuals using VPNs or proxies. While the law does not ban VPNs outright, it forces websites to either block known VPN IP addresses or verify the age of every visitor globally. In the UK, policymakers debated age gates for VPNs extensively, but stopped short of restricting VPNs after new evidence confirmed that VPNs are not a relevant pathway for children seeking to bypass age checks. In Brazil, the ECA Digital law empowers the regulatory authority to order technical countermeasures against circumvention tools such as VPNs. These developments suggest a worrying trend: well-meaning but ineffective attempts to protect children risk undermining the fundamental rights to privacy, security, and free expression of all users, as well as the health and openness of the web itself.

We are convinced, however, that there are rights-respecting alternatives policymakers can pursue to empower young people online and improve their safety and well-being.

Moving beyond access bans

We strongly believe that online safety frameworks should be grounded in children's rights, striking a balance between their right to protection and their right to participate in society, express themselves freely, and access media and information. Such frameworks must also be proportionate and should not undermine the fundamental rights and access to tools like VPNs for all users.

Rather than focusing on limiting access, we believe that policymakers should prioritize interventions that tackle the root causes of online harm. Before considering new instruments, this work starts with ensuring that independent regulatory authorities have the necessary resources to enforce existing online safety frameworks. In Europe, preliminary findings against Meta and TikTok find these companies' addictive design features to be in breach of the Digital Services Act, underlining the potential of frameworks like the DSA to address key concerns.

The design of online interfaces, and the affordances and constraints they offer, significantly influences users' interactions, decisions and overall wellbeing. 'Dark patterns' or deceptive interfaces are key drivers of harms experienced by users, and especially young people: they can compel people to consent to extensive data collection and processing, resulting in hyper-personalized feeds, personalized ads that may exploit cognitive vulnerabilities and promote unhealthy or excessive consumer choices, and an overall erosion of privacy.

This is why we support proposals like EU Digital Fairness Act (DFA) and the American Innovation and Choice Online Act (AICOA) that could fill regulatory gaps. Specifically, we advocate for the prohibition of harmful design, guided by harmonized definitions of core concepts like "dark patterns", "deceptive design," and "addictive design" and anti-circumvention clauses to prevent companies from avoiding regulation through small tweaks. Platforms should be responsible for demonstrating that their design choices are fair, non-manipulative and non-exploitative. And services that are likely to be accessed by children should be required to refrain from enabling certain design features, including excessive notifications, endless feeds and gambling-like features by default, and only with parental consent.

Further, we urge policymakers to adopt a privacy-first approach to online harms. Many of the risks encountered by young people online are related to the collection and processing of personal data. Platforms collect enormous amounts of personal data, including sensitive data, to personalize and target services, ranging from algorithmic recommender systems to online ads. While the systems that target and display ads and curate online content are distinct, both are based on the surveillance and profiling of users.

Such profiling is the basis for young people being targeted with personalized ads and content recommendations, which can segment, exclude, or steer people into inequitable options and towards harmful content. Providers should thus be prohibited from using sensitive personal data (e.g. ethnicity, religious belief, health status, sexual orientation, political affiliation) to personalize content recommendations or ads, and they should be mandated to enable privacy-protective settings by default, including restricting access to users' location, camera, microphone, contacts, and camera roll. Policymakers should also extend the fairness and transparency obligations to personalization systems and advertising actors, including intermediaries and data brokers.

Additionally, everyone online, including families and young people, should be fully in control of their online experiences and navigate the web according to their preferences and needs. There is a significant opportunity to empower users with easy, effective opt-out rights and granular user controls. In practice, users should have the right to opt out of personalized content and targeting without being penalized with a downgraded version of the service. Some frameworks already strengthen choice - in those cases, we advocate for their robust enforcement.

Across jurisdictions, choice can be strengthened by ensuring that preferences explicitly expressed (e.g. settings selected, feedback signals, customization choices made, survey responses) are respected and "sticky", so do not get reset without being explicitly requested by the user. Interoperability mandates should let people integrate third-party content moderation systems or recommendation algorithms that better match their preferences and help them break out of the walled gardens of a few dominant companies. Parental controls are another important lever to operationalize user controls: Providers should deploy easy-to-use and effective parental controls that allow families to tailor online experiences to their preferences, across platforms.

We appreciate that this is a long list of complex policy recommendations which are also impacted by broader (geo)political developments. The fact remains that current age assurance approaches are not a silver bullet, and will create more, rather than solve, problems in the long term.

Where policymakers consider age signals as necessary to ensure age-appropriate online experiences, we believe that there are technical approaches better suited to balance users' rights than those currently pursued. We will explore these developments and approaches in the second part of this series.

The post Beyond technical fixes: Protecting kids online without breaking the internet appeared first on Open Policy & Advocacy.

17 Jul 2026 9:05am GMT

16 Jul 2026

feedPlanet Mozilla

The Rust Programming Language Blog: Announcing Rust 1.97.1

The Rust team has published a new point release of Rust, 1.97.1. Rust is a programming language that is empowering everyone to build reliable and efficient software.

If you have a previous version of Rust installed via rustup, getting Rust 1.97.1 is as easy as:

rustup update stable

If you don't have it already, you can get rustup from the appropriate page on our website.

What's in 1.97.1

Rust 1.97.1 fixes a miscompilation in an LLVM optimization.

We have backported both an LLVM fix and a disable of the underlying change in Rust 1.97.0 of Rust's generated IR that increased the likelihood of this happening. However, note that the underlying miscompilation has been present since at least Rust 1.87.

If you'd like to help us out by testing future releases, you might consider running your code's CI or locally using the beta channel (rustup default beta) or the nightly channel (rustup default nightly). Please report any bugs you might come across!

Contributors to 1.97.1

Many people came together to create Rust 1.97.1. We couldn't have done it without all of you. Thanks!

16 Jul 2026 12:00am GMT