4 ms·

An aside: Mozilla's approach to Firefox extensions is both 1) responsible (they require extensions to be reviewed and signed by Mozilla), 2) untenable for devel

by spenvo 11y ago

An aside: Mozilla's approach to Firefox extensions is both 1) responsible (they require extensions to be reviewed and signed by Mozilla), 2) untenable for developers (mine took forever to be reviewed). I published three Chrome extensions last year, and decided to port my more ambitious one to Firefox. (all at http://www.metafruit.com http://www.metafruit.com) Now I feel somewhat bad for complaining since I'm not an extension reviewer myself, and I feel they've taken on a tall order for the betterment of their community. But my Firefox port took four months to get to the front of the review process. Needless to say, my next extension is targeted only for Chrome. Chrome's approach is easy for developers but almost reckless for end users.

GunboatDiplomat 11y ago
It's completely absurd that an open source project has taken it upon themselves to mandate extension signing. It's as if Debian declared that you couldn't install packages which weren't signed by them, but don't worry, you can always recompile Debian yourself with that feature turned off.
- akkartik 11y ago
  Seriously. I have a private extension that I wrote and gave up on getting reviewed because the process is painful, and now I can't run it on Firefox. They've successfully pushed me to the less stable nightly release. It's only a matter of time before some bug gets me off Firefox entirely, and it's back to the bad old pre-firefox days.
- zanny 11y ago
  I have no problem with a Linux distro doing this. Though I'd consider several to already be doing this - any distro you cannot click to install through a GUI a package archive with I'd call blocking casual users from installing non-official software. Though most distros (I know at least Ubuntu / Suse enable this) let you just click package archives to install them.
- kbrosnan 11y ago
  How does one protect the majority of users in the wide open case? For example see https://bugzilla.mozilla.org/show_bug.cgi?id=1251911 https://bugzilla.mozilla.org/show_bug.cgi?id=1251911 where the extension downloaded another extension and disabled the signing pref.
  - GunboatDiplomat 11y ago
    You don't. It's not the browsers job. Users need to educate themselves, and they won't unless there are consequences for ignorance.
Bulk70 11y ago
If you weren't aware you may be interested in this: https://wiki.mozilla.org/WebExtensions https://wiki.mozilla.org/WebExtensions It probably won't affect the review process, but it will at least make targeting both browsers from a dev perspective potentially (hopefully!) trivial.
- reitanqild 11y ago
  Only problem IIRC is it won't support the things we depend on extensions for :-/
  - yuhong 11y ago
    But for Servo it probably will be the only option.
    - reitanqild 11y ago
      Exactly the problem.
- spenvo 11y ago
  Since I'm not dependent on XUL-type apis, this is very relevant! The porting process was already not-bad, but anything to smooth it over for others would be cool. Thanks, i'll see where it is when I start my next project!
cpeterso 11y ago
Mozilla announced, just yesterday, some big improvements in the extension review process, including adding more reviewers: https://blog.mozilla.org/addons/2016/03/04/breakthroughs-in-the-add-on-review-queues/ https://blog.mozilla.org/addons/2016/03/04/breakthroughs-in-...
- spenvo 11y ago
  Oh excellent! I missed this announcement; I won't be afraid to do it again. Looking at those charts, looks like I rode through the most extreme backlog you guys experienced. Another aside: At least for extensions featured in a store, it makes sense to me to have a vetting process. Also, I believe that anyone should be able to read, unminified, the code they run on their computers if they so wish. (Especially if the software gets to view/change the content of the pages they visit.) So, I appreciate the general rule in Moz's review process against minified code and large unknown libraries.

by spenvo 11y ago

GunboatDiplomat 11y ago

It's completely absurd that an open source project has taken it upon themselves to mandate extension signing. It's as if Debian declared that you couldn't install packages which weren't signed by them, but don't worry, you can always recompile Debian yourself with that feature turned off.

akkartik 11y ago
Seriously. I have a private extension that I wrote and gave up on getting reviewed because the process is painful, and now I can't run it on Firefox. They've successfully pushed me to the less stable nightly release. It's only a matter of time before some bug gets me off Firefox entirely, and it's back to the bad old pre-firefox days.
zanny 11y ago
I have no problem with a Linux distro doing this. Though I'd consider several to already be doing this - any distro you cannot click to install through a GUI a package archive with I'd call blocking casual users from installing non-official software. Though most distros (I know at least Ubuntu / Suse enable this) let you just click package archives to install them.
kbrosnan 11y ago
How does one protect the majority of users in the wide open case? For example see https://bugzilla.mozilla.org/show_bug.cgi?id=1251911 https://bugzilla.mozilla.org/show_bug.cgi?id=1251911 where the extension downloaded another extension and disabled the signing pref.
- GunboatDiplomat 11y ago
  You don't. It's not the browsers job. Users need to educate themselves, and they won't unless there are consequences for ignorance.

Bulk70 11y ago

If you weren't aware you may be interested in this: https://wiki.mozilla.org/WebExtensions https://wiki.mozilla.org/WebExtensions It probably won't affect the review process, but it will at least make targeting both browsers from a dev perspective potentially (hopefully!) trivial.

reitanqild 11y ago
Only problem IIRC is it won't support the things we depend on extensions for :-/
- yuhong 11y ago
  But for Servo it probably will be the only option.
  - reitanqild 11y ago
    Exactly the problem.
spenvo 11y ago
Since I'm not dependent on XUL-type apis, this is very relevant! The porting process was already not-bad, but anything to smooth it over for others would be cool. Thanks, i'll see where it is when I start my next project!

cpeterso 11y ago

Mozilla announced, just yesterday, some big improvements in the extension review process, including adding more reviewers: https://blog.mozilla.org/addons/2016/03/04/breakthroughs-in-the-add-on-review-queues/ https://blog.mozilla.org/addons/2016/03/04/breakthroughs-in-...

spenvo 11y ago
Oh excellent! I missed this announcement; I won't be afraid to do it again. Looking at those charts, looks like I rode through the most extreme backlog you guys experienced. Another aside: At least for extensions featured in a store, it makes sense to me to have a vetting process. Also, I believe that anyone should be able to read, unminified, the code they run on their computers if they so wish. (Especially if the software gets to view/change the content of the pages they visit.) So, I appreciate the general rule in Moz's review process against minified code and large unknown libraries.