2 ms·

Just to clarify, I'm not all all against WebExtensions. You made some good points in particular regarding developer mindshare. Yes, (mostly) cross-browser exten

Just to clarify, I'm not all all against WebExtensions. You made some good points in particular regarding developer mindshare. Yes, (mostly) cross-browser extensions are the way to go, and it's rather unfortunate that the a lot earlier JetPack/Add-on SDK failed in that regard, among other things. There is no reason for WebExtensions not to exist, and plenty good reasons for them to exist. But that has nothing much to do with the question of whether WebExtensions should be the only supported extension type in Firefox. I'm not convinced about the other points you make, though. Extensions right now are extremely powerful indeed and there are certainly security considerations to be taken into account. But Chrome extensions have most of the same issues: There have been tons of extensions ex-filtrating sensitive user data or doing other shenanigans in the Chrome Store, mostly because the Chrome review model is "automatic review everything after some piece of software tries to check some basic things and ask questions later". You might get a smaller attack surface with a more limited API, but to make sure users don't install malware you'll still need a human to catch malicious people trying to game the system. Given that mozilla plans additional/extended APIs for a lot of things that might be quite powerful in their own right, manual reviews might be still a necessity after all for lots of extensions. XUL might be archaic as you call it but XUL is not even the point. If Firefox transitioned away from browser.xul to browser.html today, extensions would break but most of the porting would involve replacing <toolbarbutton /> with <button class="toobarbutton"/> or something like that. Most of the "native" XUL can be replaced by web components without anybody noticing, and in fact parts of XUL is already html underneath even today. The power of current Firefox extensions comes from XUL having a DOM (just like HTML, just with other element names) combined with access to the low(er) level stuff, mainly the browser.xul javascript scope (just like a browser.html javascript scope) and XPCOM scripting (and a browser.html will still need XPCOM or equivalent access). WebExtensions take away that power in favor of a more well-defined but thusly more constrained and limited API. I think the pro of having virtually unlimited extendability as demonstrated by tons of great and creative extensions outweigh the cons of larger attack surface and higher maintenance costs for both mozilla and add-on developers. Add-on developers wanting "easy" or a single cross-browser codebase would be still free to use WebExtensions, which would also give mozilla a break, while the more/most powerful add-ons could still hack deeply into the browser. I don't blame mozilla for developers abandoning their add-ons because they lack the resources, motivation or APIs to do a port (or any combination thereof), however developers abandoning their add-ons is still a reality and should not be disregarded just because mozilla might try their best to keep the fallout somewhat low. mozilla, however, made a decision to break existing add-on en masse, and that decision and the reasons and effects should be allowed to be critically inspected.

lewisl9029 11y ago
> I think the pro of having virtually unlimited extendability as demonstrated by tons of great and creative extensions outweigh the cons of larger attack surface and higher maintenance costs for both mozilla and add-on developers. It looks like our disagreement boils down to this single tradeoff. Firefox's virtually unlimited extensibility definitely resulted in some amazing extensions that wouldn't have been possible with any less flexible system. However, I don't believe the security and maintenance costs imposed by such a system can be justified in the case of a web browser used by millions of people where security and iteration speed is paramount. Those looking to experiment without limits can still fork the browser codebase itself to build proof of concepts that way. If the proof of concept is compelling and gains enough traction, it would then become much easier to propose the necessary extensions to the WebExtensions spec and have them accepted and built. There is definitely a lot of friction to this process, but the alternative of maintaining Firefox's status quo with respect to extensions is just not going to be viable, in my opinion.

lewisl9029 11y ago

> I think the pro of having virtually unlimited extendability as demonstrated by tons of great and creative extensions outweigh the cons of larger attack surface and higher maintenance costs for both mozilla and add-on developers. It looks like our disagreement boils down to this single tradeoff. Firefox's virtually unlimited extensibility definitely resulted in some amazing extensions that wouldn't have been possible with any less flexible system. However, I don't believe the security and maintenance costs imposed by such a system can be justified in the case of a web browser used by millions of people where security and iteration speed is paramount. Those looking to experiment without limits can still fork the browser codebase itself to build proof of concepts that way. If the proof of concept is compelling and gains enough traction, it would then become much easier to propose the necessary extensions to the WebExtensions spec and have them accepted and built. There is definitely a lot of friction to this process, but the alternative of maintaining Firefox's status quo with respect to extensions is just not going to be viable, in my opinion.