How to waste bandwidth, battery power, and annoy sysadmins

[markerz]

Oh hey, I wrote that last issue linked! What crazy Deja vu. Here’s me discovering the issue that led me to find some wild behavior.

Basically Firefox loaded favicons 4x the number of tabs opened to that website. It would do this every time I opened or closed any tab.

https://aggressivelyparaphrasing.me/2022/12/12/why-does-my-l...

It was resolved a while back so maybe it’s similar symptoms but different root cause, or maybe it’s people using older versions?

[gwd]

Wordpress handles 404s really slowly? I'm kind of surprised it works at all then, as at least in my logs there's a very steady stream of bots probing it for vulnerabilities by trying random URLs.

[seism]

It's an open source project, with a good discussion of the technical issues on GitHub[1]. Probably linked to certain user behaviors, like having hundreds of tabs open, but surely also contingent on the complexity of wedging a browser in iOS. Like maneuvering an excavator into a sandbox.

[1] https://github.com/mozilla-mobile/firefox-ios/issues/12113

[yosefk]

I also wonder how these requests "beat the shit out of the web server." It's requesting the feed and the favicon, both of which could be cached by a CDN. Even if they aren't, how much traffic are you gonna see from this compared to some other page trending on HN? Wasteful, sure, but hardly that big a deal

[WesolyKubeczek]

I can easily have hundreds of Chrome tabs open, and none of this happens. I can have hundreds of tabs inadvertently open in iOS Safari, and none of this happens.

Would you kindly refrain from blaming users for what clearly is a bug in the application?

[seism]

Also, when I saw the headline, I had to think of all the LLM scrapers and bots (soon to be running directly on your AIphone!) roaming the Interwebs.

[AtlasBarfed]

I thought all browsers on iOS were using the apple browser engine and ditto for Android.

That is, they are just skins

[Aardwolf]

I thought firefox on ios was just safari with a reskin because apple doesn't allow other browser engines on their phone?

Firefox on android is amazing with its plugin support, though I still prefer their pre-2021 UI

[loufe]

Given the seriously negative sibling comments, I thought I'd weigh in with my own experience. I'm unaware of anything behind the scenes, but I've always enjoyed the user experience in Firefox on Android, at least for the last couple years before the rewrite. I don't like browsing the web on my phone, but it's made it bearable.

I can't speak to the problems behind the scenes though, and they certainly merit attention.

[butterNaN]

Firefox on Android is a godsend to me, and the secret is that I can install uBlock origin and noscript on my mobile. I get a whiplash when I see someone else browsing the web without these, it is absurd how much attention people will allow to be just stolen away.

[smolder]

Firefox on Android is NOT amazing. For MANY YEARS the user agent included the exact model of your phone. They seem to be incompetent. (Edit: this is a bit harsh, and to clarify, directed at the company and not any specific people in their employ.) Exactly what Google wants -- plausible deniability when it comes to monopoly, but an awful alternative.

[sirn]

iOS requires a browser to use the OS-provided WebKit, but you can still use your own networking layer, and doing your own scripts injection (e.g. for extensions, like what Orion is doing). Firefox for iOS used to use Alamofire as its networking engine, but switched over to NSURLSession/URLSession at some point. Chrome for iOS uses Cronet which was extracted from Chromium's networking stack (or maybe used, I have not followed the development recently).

[tgv]

> I thought firefox on ios was just safari with a reskin

It is. It does avoid some of the tracking/ad content, so I guess it does do some things somewhat differently. But if it's such a scourge, add a favicon.

BTW, I've never seen this, and I regularly use Firefox on iOS to test.

[Twirrim]

I'm another who loves firefox on android. It annoys me that to some degree Android forces chrome on you, even if firefox is set as your default. The full plugin support that got added in the last year really took it up a notch too.

[chithanh]

Firefox on Android is not amazing, it is on the contrary quite annoying and has gotten more so over the years

* Tabs get stuck frequently, and can only be revived by closing, then undoing close.

* Can no longer access about:config in release builds

* Bookmarks got demoted in favor of Pocket, can no longer set bookmarks as default home page

* URL autocompletion got dumbed down, first on mobile and then also on desktop

* etc.

[jepler]

The author of this site usually takes pains to obfuscate whatever big commercial entity she's talking about who did dumb stuff. But when it's Firefox, she names names. Huh.

[yuliyp]

The author obfuscates her employers. Stuff she discovers as an end user will get named.

[batch12]

The post would be pointless if it didn't identify the browser in question.

[Aloha]

No - as someone who reads her on feed - not particularly, and only in certain cases.

[bennettlp]

I remember something similar with Internet Explorer back in the day, where it would ask for the favicon (which we didn’t have setup at the time) so our 404 page would be returned, which then seemed to trigger another request for a favicon. (╯°□°)╯︵ ┻━┻

[jb1991]

Interesting. From a user experience, Firefox for iPhone has been a really excellent app, it’s been my preferred browser for years.

[rrr_oh_man]

Even if it’s basically a skin for Safari?

[userbinator]

It's not part of individual directories. That would be stupid.

Having a path-specific favicon actually sounds like a feature.

[missblit]

And it is a feature.

https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

[Kwpolska]

It is quite easy these days if you define <meta> tags to specify the icon (as opposed to depending on files being in the right places).

[justsomehnguy]

> Having a path-specific favicon actually sounds like a feature.

Can you provide at least a couple of use-cases for a path specific favicons?

[chime]

Long ago, I implemented that by pragma no-cache and checking the referrer. It wasn’t perfect but it worked for most users.

[vasco]

That's the point the author made.

[alexchamberlain]

There are some suggestions on https://stackoverflow.com/q/1321878/961353 for disabling the favicon request completely.

[perfect_wave]

I use Firefox for iPhone. Sorry At least if probably wastes less energy than messing around with generative AI

[johnp_]

Here's the code, for those interested in finding the bug: https://github.com/mozilla-mobile/firefox-ios/tree/main/Brow...

[shantara]

I recall seeing some users complain about getting a temp ban on a niche forum when using Firefox for iOS, which was probably caused by this issue.

[yokoprime]

I get it, everything adds up and over millions of page-loads there will be a bit of wasted bandwidth. But it seems the original author blew this issue out of proportion with this post. Why even be annoyed by such a minor issue?

[ggm]

I have to laugh when the robots fetch the .ico file

[lopkeny12ko]

> And yet, this thing decides to beat the shit out of the web server while trying to get it.

This is an exhorbitant exaggeration. They are duplicated requests for a favicon. Not only is that a tiny resource, most of these requests are 404ing which is cheap. And even if it isn't 404, your favicon is a tiny static asset, it should either be served by CDN or in the server's filesystem cache anyways.

[fnord123]

Now let's see the savings from not talking to ad servers and running the Javascript from those trackers.

[justsomehnguy]

Makes me wonder what it would do if you throw a couple of 301/307/308 at it.

[mock-possum]

Title implies that this article thirdly explains how to waste annoying sysadmins, which is an entertaining prospect.

Are we talking about not putting annoying sysadmins to good use? Or are we talking about, you know, makin sure they don’t cause nobody no trouble again, boss?

[hulitu]

> First up, why in the hell do you need to request the same link 12 times? No, scratch that, 15 times, since it does 3 more after getting the css and feed icon.

It makes a debouncing. It compares the result with the previous to be sure it is OK. /s