Don't allow animated favicons in Firefox (2001)

Summary: animate site icons → animated site icons

Assignee: hyatt → pavlov

Status: UNCONFIRMED → NEW

Component: Tabbed Browser → ImageLib

Ever confirmed: true

QA Contact: blakeross → tpreston

Summary: animated site icons → animated site icons (favicons)

OS: Windows 2000 → All

Hardware: PC → All

Status: NEW → ASSIGNED

Target Milestone: --- → mozilla1.1

Summary: animated site icons (favicons) → don't allow animated site icons (favicons)

Target Milestone: mozilla1.1 → Future

QA Contact: tpreston → imagelib

Status: NEW → RESOLVED

Closed: 15 years ago

Resolution: --- → WONTFIX

Status: RESOLVED → REOPENED

Resolution: WONTFIX → ---

Component: ImageLib → XUL

QA Contact: imagelib → xptoolkit.widgets

Component: XUL → ImageLib

Component: ImageLib → XUL

Assignee: nobody → bobbyholley+bmo

Assignee: bobbyholley+bmo → nobody

Component: XUL → Tabbed Browser

Product: Core → Firefox

I think this can be closed. Firefox doesn’t support no-JS mode anymore, and it’s always possible to replace the favicon via JS (manually animating it), so even if using animated GIFs would be prohibited, people could still go the javascript route.

There’s easy-to-use libraries and everything: http://lab.ejci.net/favico.js/

(In reply to flying sheep from comment #91)

I think this can be closed. Firefox doesn’t support no-JS mode anymore, and it’s always possible to replace the favicon via JS (manually animating it), so even if using animated GIFs would be prohibited, people could still go the javascript route.

There’s easy-to-use libraries and everything: http://lab.ejci.net/favico.js/

Good find. So my question now shifts to- Why in the world would Firefox ALLOW javascript for/in favicon?

Instead of giving up on this, perhaps that ridiculous "feature" should be removed AND also honor the toolkit.cosmeticAnimations.enabled by disabling animated png/webp/gif/etc.

(In reply to flying sheep from comment #91)

I think this can be closed. Firefox doesn’t support no-JS mode anymore, and it’s always possible to replace the favicon via JS (manually animating it), so even if using animated GIFs would be prohibited, people could still go the javascript route.

There’s easy-to-use libraries and everything: http://lab.ejci.net/favico.js/

There are multiple extensions (eg. NoScript, uMatrix, etc.) which allow disabling JavaScript but, as of yet, I'm unaware of an extension which is capable of blocking GIF or APNG animation in favicons.

(In reply to crxssi from comment #92)

(In reply to flying sheep from comment #91)
Good find. So my question now shifts to- Why in the world would Firefox ALLOW javascript for/in favicon?

JavaScript is able to change a site's favicon. That's how things like the unread message notifications on GMail and Discord work.

Change it frequently enough and you've got animation. (Sort of like how, as a very stupid and inadvisable trick, you can reinvent Ye Olde Statusbar Marquee in the address bar by calling history.replaceState very frequently.)

Exactly what was said in comment 92. The reasoning in comment 91 is essentially "oops, we made this even worse, so that means now it's not a bug!"

Allowing sites to change their favicon via js is not a feature. It's a nuisance, and possibly a critical issue for users with certain disabilities. That capability, along with gif-based animation, should be blockable via configuration. Some of us do not care about "unread message notifications" being possible and consider them a distraction/annoyance.

No, blocking javascript in general is not a solution.

(In reply to Stephan Sokolow from comment #93)

JavaScript is able to change a site's favicon. That's how things like the unread message notifications on GMail and Discord work.

Ah, thanks for that info. So, although it might not be possible to disable JS controlling favicon, it still seems reasonable that we would want to restrict other, easily-controllable animations. No perfect outcome, but it is better than allowing ALL types of animation in something that really shouldn't be animated.

(In reply to Rich Felker from comment #94)

Exactly what was said in comment 92. The reasoning in comment 91 is essentially "oops, we made this even worse, so that means now it's not a bug!"

Allowing sites to change their favicon via js is not a feature. It's a nuisance, and possibly a critical issue for users with certain disabilities. That capability, along with gif-based animation, should be blockable via configuration. Some of us do not care about "unread message notifications" being possible and consider them a distraction/annoyance.

No, blocking javascript in general is not a solution.

I agree with crxssi on this front. I've yet to see someone go to the effort to animate a favicon using JavaScript, and I rely on unread message notification via favicon from sites like Discord, but, whenever I encounter a site using an animated GIF favicon, one of the first things I do is either leave or open up the DOM inspector and deal with the animated favicon manually.

In the era of legacy extensions, I relied on one called Toggle Animated GIFs which prevented animation in favicons and presented "click to play" behaviour for in-page GIFs but its author has yet to find a way to reimplement it as a WebExtension.

Severity: normal → S3

Priority: -- → P3

Summary: don't allow animated site icons (favicons) → Don't allow animated favicons

Whiteboard: [fidefe-quality-foundation]

Accessibility Severity: --- → s3