5 ms·

This seems like a classic case if thinking people use your software for the core features you develop. I hate to break it to you but people don't use windows fo

by hyperion2010 11y ago

This seems like a classic case if thinking people use your software for the core features you develop. I hate to break it to you but people don't use windows for the control panel. Firefox and other browsers have become development platforms and many of their "users" don't use their platform for its 'control panel,' they use it for some useful tool built on top of it. To use a linux kernel term, this breaks userspace (might be a sign that browsers have some serious OS envy). This is particularly bad because if many of your users use your platform for a tool that only works on an old, unsupported version (think XP), you actually make the security situation WORSE since those users don't care about security, they care about the tools they need to get their jobs done. They are still going to use those tools and you have just left them hanging out to dry from a security perspective. Talk about passing the buck.

pcwalton 11y ago
> To use a linux kernel term, this breaks userspace (might be a sign that browsers have some serious OS envy). No, the equivalent of breaking userspace would be breaking the Web platform. This is more like breaking the in-kernel API for .ko modules—and the official Linux policy on this is [1]. Firefox has always been much less inclined to break its internal XPCOM APIs than the Linux kernel has been to break its internal in-kernel APIs. [1]: https://github.com/torvalds/linux/blob/master/Documentation/stable_api_nonsense.txt https://github.com/torvalds/linux/blob/master/Documentation/...
- tux3 11y ago
  The comparison only goes so far since extensions can't get "mainlined" into Firefox (well, except for that Pocket thing apparently). Mozilla can just replace their API without worrying about updating every extensions their changes broke. That's someone else's problem.
- throwaway2048 11y ago
  The way you keep comparing firefox extensions to kernel modules seems really disingenuous, the paralels are weak at best.
- hollerith 11y ago
  >No, the equivalent of breaking userspace would be breaking the Web platform. Suppose someone secretly believes that the true users of my web browser are the owners of the web sites I visit. (Perhaps they own a web site or they make their living working for web-site owners, which makes it natural for them to care about the freedoms and the interests of site owners more than they care about my freedoms and interests.) That secret belief would tend to make them overestimate the usefulness of the Javascript that the sites I visit cause to execute on my browser and to underestimate the usefulness and importance of any extensions or add-ons I choose to install on my browser. I think the true situation is that there are two important userspaces -- one in which front-end web-app code runs and another in which extensions and add-ons run. (There is some overlap between these two userspaces.) Also, one of the arguments being given for the need to restrict what add-ons can do is security even though most exploits of the browser are caused not by the user's installing a bad add-on, but rather by the user's visiting a bad web page. Yet I see no one on this page mentioning the latter kind of exploits (which an add-on can sometimes protect against, for example, by blocking ads).

pcwalton 11y ago

> To use a linux kernel term, this breaks userspace (might be a sign that browsers have some serious OS envy). No, the equivalent of breaking userspace would be breaking the Web platform. This is more like breaking the in-kernel API for .ko modules—and the official Linux policy on this is [1]. Firefox has always been much less inclined to break its internal XPCOM APIs than the Linux kernel has been to break its internal in-kernel APIs. [1]: https://github.com/torvalds/linux/blob/master/Documentation/stable_api_nonsense.txt https://github.com/torvalds/linux/blob/master/Documentation/...

tux3 11y ago
The comparison only goes so far since extensions can't get "mainlined" into Firefox (well, except for that Pocket thing apparently). Mozilla can just replace their API without worrying about updating every extensions their changes broke. That's someone else's problem.
throwaway2048 11y ago
The way you keep comparing firefox extensions to kernel modules seems really disingenuous, the paralels are weak at best.
hollerith 11y ago
>No, the equivalent of breaking userspace would be breaking the Web platform. Suppose someone secretly believes that the true users of my web browser are the owners of the web sites I visit. (Perhaps they own a web site or they make their living working for web-site owners, which makes it natural for them to care about the freedoms and the interests of site owners more than they care about my freedoms and interests.) That secret belief would tend to make them overestimate the usefulness of the Javascript that the sites I visit cause to execute on my browser and to underestimate the usefulness and importance of any extensions or add-ons I choose to install on my browser. I think the true situation is that there are two important userspaces -- one in which front-end web-app code runs and another in which extensions and add-ons run. (There is some overlap between these two userspaces.) Also, one of the arguments being given for the need to restrict what add-ons can do is security even though most exploits of the browser are caused not by the user's installing a bad add-on, but rather by the user's visiting a bad web page. Yet I see no one on this page mentioning the latter kind of exploits (which an add-on can sometimes protect against, for example, by blocking ads).