11 ms·

> Removed support for Netscape Plugin API (NPAPI) plugins other than Flash. Silverlight, Java, Acrobat and the like are no longer supported. Good bye, you will

by kamac 10y ago

> Removed support for Netscape Plugin API (NPAPI) plugins other than Flash. Silverlight, Java, Acrobat and the like are no longer supported. Good bye, you will be missed (not).

_ZeD_ 10y ago
I will miss them...
pjmlp 10y ago
They will return as WebAssembly, just wait.
- Spivak 10y ago
  And we'll be better off because of it.
  - Karunamon 10y ago
    Until 20 years in the future when Firefox 66 (if Mozilla is still around after murdering the only reason people use their browser) when the new hotness is whatever WASM's successor is, after it's widely deployed and in use everywhere, people making snarky comments about how they're glad WASM is dead, and we get to piss away another tens of millions of man hours and annoy tens of millions of users by changing things for the sake of change rather than objective technical benefit. Yes, I'm slightly bitter. I'm starting to think the Suckless guys have the right idea...
  - pjmlp 10y ago
    I have my doubts, at least I could disable plugins when I wanted to. Now I have to disable dns entries.
indexerror 10y ago
With this goes the support for DivX player and VLC plugin for Firefox. I'd surely miss the ability to play any format in my browser until PPAPI replacements come up.
- extra88 10y ago
  Firefox is not implementing PPAPI. Additional audio or video codecs can be added to a browser but that doesn't require a plug-in architecture. Firefox's UI makes it a little confusing because things like the OpenH264 video codec from Cisco is listed under Plugins in about:addons and the description starts with "This plugin is automatically installed by Mozilla..." Maybe they'll make an addons section called Codecs for listing things like that and the junk like the Widevine DRM.
kuschku 10y ago
They were the only way to get hardware accelerated video on Linux. Even today, Firefox decodes all video (even h264) on CPU. Which causes, with 4K 60fps video, 50% CPU load on an entire core for me.
- RussianCow 10y ago
  I think this is only true on Linux. On my Windows and macOS installs, hardware video decoding works fine.
  - kuschku 10y ago
    Definitely. Mozilla removed hardware decoding on Linux in Firefox 3.6, and never added it back. The bugs on bugzilla are all marked "WONTFIX", and Linux seems to be an afterthought.
    - RussianCow 10y ago
      To be fair, I've looked through the Bugzilla threads about this (here are some for reference: [0][1]) and it seems to be a very difficult thing to implement. It's a bit beyond my reach, but my understanding is the tricky part is compositing the frames decoded by ffmpeg onto the document, and getting that all to work with all possible CSS transformations and such. So it's not just a matter of the Firefox devs neglecting Linux. [0]: https://bugzilla.mozilla.org/show_bug.cgi?id=563206 https://bugzilla.mozilla.org/show_bug.cgi?id=563206 [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1210729 https://bugzilla.mozilla.org/show_bug.cgi?id=1210729
      - kuschku 10y ago
        Except that Chrome manages to do this, as do all other linux browsers. And Mozilla, which explicitly writes Out of Scope - Linux testing On their QA pages in the wiki regarding this, well, doesn’t inspire confidence. I'm still using Firefox, still supporting Mozilla, but I'm disappointed nonetheless.
- 10y ago
josefx 10y ago
> Java Another internal tool to rewrite from scratch, yay. > Acrobat and the like are no longer supported. Is the build in PDF viewer still burning through battery power like the electric heater it turned my laptop into the last time I used it? Been some time so that would be interesting to know.
- lomnakkus 10y ago
  > > Java > Another internal tool to rewrite from scratch, yay. If you care about security in the slightest, you should probably already have done that. > > Acrobat and the like are no longer supported. > Is the build in PDF viewer still burning through battery power like the electric heater it turned my laptop into the last time I used it? Been some time so that would be interesting to know. You can still use an external reader of your choosing; for example I'm using the marvellous Okular. You just can't use an NPAPI-based PDF reader plugin.
  - josefx 10y ago
    > If you care about security in the slightest, you should probably already have done that. Signed internal only use tool. Not running untrusted applets anywhere. Also no time to rewrite bug free working code. > You can still use an external reader of your choosing; So the answer is that it is still that bad? I guess I can just browse the web using wget and less if external tools are the next big thing. /s
  - Silhouette 10y ago
    If you care about security in the slightest, you should probably already have done that. These plugins have been click-to-play in the major browsers for a long, long time. Obviously they still provide some attack surface, but the biggest threats today don't come from plugins, they come from the main browser functionality, thanks in no small part to all the things browsers now have to provide so we can still do useful things that we used to do with plugins.
  - keray 10y ago
    > > > Java > > Another internal tool to rewrite from scratch, yay. > If you care about security in the slightest, you should probably already have done that. What has one to do with the other
Pxtl 10y ago
Crap. The city council in my town uses Silverlight to stream their meetings. I know, I know. Still, it means I'll be missing that silverligh support.
- cpeterso 10y ago
  Do they support Chrome without Silverlight?
  - Pxtl 10y ago
    Nope.
- giancarlostoro 10y ago
  Firefox ESR will still support it in their release of v52.
- coldpie 10y ago
  Well, hopefully some web guy at least got a nice lunch from the MS rep out of that deal.
snuxoll 10y ago
> Good bye, you will be missed (not). I'd like to say they won't be missed, but I've got a state Medicaid portal that uses some annoying Java applet to handle authentication I have no choice but to deal with (I've actually got a little flask web service that uses Selenium and Firefox in Xvfb just to log into the stupid thing and return the authentication cookies, since Chrome ditched NPAPI a while ago and IE isn't a sane option). I won't be sad when applets finally go away, but that day is not today for me and it's going to really screw things up :/
- rhelmer 10y ago
  Does Java Web Start support applets? I haven't had to use it in years but I seem to recall that it does.
  - dblohm7 10y ago
    I believe that is Oracle's official recommendation for dealing with NPAPI deprecation.
cesarb 10y ago
Several banks here in Brazil require a "security" plugin (which acts more like malware) for one to be allowed to use online banking. I wonder how the end of NPAPI will affect this.
- 341j4j1k4 10y ago
  If you're really Brazilian/in Brazil, you don't really wonder. You just know the answer: all those bank sites will tell you to use Chrome instead. Bradesco's fortunately works on any browser.
  - cpeterso 10y ago
    Is the Brazilian "security" plugin an NPAPI plugin or a Chrome extension? Chrome doesn't support NPAPI plugins, so these banks either have non-plugin solution for Chrome or they don't support Chrome. Many Chinese ecommerce and government sites require their own "security" NPAPI plugins. These don't work in Chrome, but the large majority of users in China run hybrid browsers that use both Blink and Trident (IE) engines so these sites that require NPAPI plugins can be seamlessly loaded in a Trident tab. The user doesn't know the difference.
  - cesarb 10y ago
    I know Chrome stopped supporting NPAPI plugins long before Firefox, so simply "use Chrome" won't be the answer. I doubt they will give up these "security" plugins, so the answer will most probably be an even more invasive system process. It seems that some banks are migrating to Warsaw, which is known for among other things causing problems with IPv6 (http://ipv6.br/post/bug-em-plugin-de-seguranca-de-bancos-bloqueia-internet/ http://ipv6.br/post/bug-em-plugin-de-seguranca-de-bancos-blo...).
k_sze 10y ago
I don't understand why they removed support for Silverlight and Java, but kept Flash. Are Java applets and Silverlight apps demonstrably less secure than Flash? Just as a naive metric, if you look at the CVE database, there have been a total of three CVEs for Silverlight last year; whereas for Flash... well, I stopped counting. I don't know of any bank or government agency that uses Flash, but I certainly know that the Hong Kong government uses Java on some of its websites. It feels like Mozilla is keeping Flash around just because it's more popular with browser gamers and video watchers. I don't think that's doing the right thing.
- untoreh 10y ago
  > I don't understand why they removed support for Silverlight and Java, but kept Flash. drm something something...shall I remind spotify web player still uses flash.
- nnethercote 10y ago
  > It feels like Mozilla is keeping Flash around just because it's more popular with browser gamers and video watchers. That's exactly right. The amount of Flash content dwarfs the amount of other plugin content. Banning other NPAPI plugins doesn't avoid the Flash security problems but it does avoid the other security problems. It's a step forward, but it's not the final step.
- comex 10y ago
  It's not about security. As you said, it's because Flash is more popular, so killing it will disrupt more users' workflows. It's a pragmatic decision… Personally, I'm hoping we see a WebAssembly build of Flash eventually (once WA is featureful enough to support it), at which point the native plugin can die without breaking (as many) old sites.
bigbugbag 10y ago
Just drop flash already, this thing has been agonizing the slowest death ever.

by kamac 10y ago

> Removed support for Netscape Plugin API (NPAPI) plugins other than Flash. Silverlight, Java, Acrobat and the like are no longer supported. Good bye, you will be missed (not).

_ZeD_ 10y ago

I will miss them...

pjmlp 10y ago

They will return as WebAssembly, just wait.

Spivak 10y ago
And we'll be better off because of it.
- Karunamon 10y ago
  Until 20 years in the future when Firefox 66 (if Mozilla is still around after murdering the only reason people use their browser) when the new hotness is whatever WASM's successor is, after it's widely deployed and in use everywhere, people making snarky comments about how they're glad WASM is dead, and we get to piss away another tens of millions of man hours and annoy tens of millions of users by changing things for the sake of change rather than objective technical benefit. Yes, I'm slightly bitter. I'm starting to think the Suckless guys have the right idea...
- pjmlp 10y ago
  I have my doubts, at least I could disable plugins when I wanted to. Now I have to disable dns entries.

indexerror 10y ago

With this goes the support for DivX player and VLC plugin for Firefox. I'd surely miss the ability to play any format in my browser until PPAPI replacements come up.

extra88 10y ago
Firefox is not implementing PPAPI. Additional audio or video codecs can be added to a browser but that doesn't require a plug-in architecture. Firefox's UI makes it a little confusing because things like the OpenH264 video codec from Cisco is listed under Plugins in about:addons and the description starts with "This plugin is automatically installed by Mozilla..." Maybe they'll make an addons section called Codecs for listing things like that and the junk like the Widevine DRM.

kuschku 10y ago

They were the only way to get hardware accelerated video on Linux. Even today, Firefox decodes all video (even h264) on CPU. Which causes, with 4K 60fps video, 50% CPU load on an entire core for me.

RussianCow 10y ago
I think this is only true on Linux. On my Windows and macOS installs, hardware video decoding works fine.
- kuschku 10y ago
  Definitely. Mozilla removed hardware decoding on Linux in Firefox 3.6, and never added it back. The bugs on bugzilla are all marked "WONTFIX", and Linux seems to be an afterthought.
  - RussianCow 10y ago
    To be fair, I've looked through the Bugzilla threads about this (here are some for reference: [0][1]) and it seems to be a very difficult thing to implement. It's a bit beyond my reach, but my understanding is the tricky part is compositing the frames decoded by ffmpeg onto the document, and getting that all to work with all possible CSS transformations and such. So it's not just a matter of the Firefox devs neglecting Linux. [0]: https://bugzilla.mozilla.org/show_bug.cgi?id=563206 https://bugzilla.mozilla.org/show_bug.cgi?id=563206 [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1210729 https://bugzilla.mozilla.org/show_bug.cgi?id=1210729
    - kuschku 10y ago
      Except that Chrome manages to do this, as do all other linux browsers. And Mozilla, which explicitly writes Out of Scope - Linux testing On their QA pages in the wiki regarding this, well, doesn’t inspire confidence. I'm still using Firefox, still supporting Mozilla, but I'm disappointed nonetheless.
10y ago

josefx 10y ago

> Java Another internal tool to rewrite from scratch, yay. > Acrobat and the like are no longer supported. Is the build in PDF viewer still burning through battery power like the electric heater it turned my laptop into the last time I used it? Been some time so that would be interesting to know.

lomnakkus 10y ago
> > Java > Another internal tool to rewrite from scratch, yay. If you care about security in the slightest, you should probably already have done that. > > Acrobat and the like are no longer supported. > Is the build in PDF viewer still burning through battery power like the electric heater it turned my laptop into the last time I used it? Been some time so that would be interesting to know. You can still use an external reader of your choosing; for example I'm using the marvellous Okular. You just can't use an NPAPI-based PDF reader plugin.
- josefx 10y ago
  > If you care about security in the slightest, you should probably already have done that. Signed internal only use tool. Not running untrusted applets anywhere. Also no time to rewrite bug free working code. > You can still use an external reader of your choosing; So the answer is that it is still that bad? I guess I can just browse the web using wget and less if external tools are the next big thing. /s
- Silhouette 10y ago
  If you care about security in the slightest, you should probably already have done that. These plugins have been click-to-play in the major browsers for a long, long time. Obviously they still provide some attack surface, but the biggest threats today don't come from plugins, they come from the main browser functionality, thanks in no small part to all the things browsers now have to provide so we can still do useful things that we used to do with plugins.
- keray 10y ago
  > > > Java > > Another internal tool to rewrite from scratch, yay. > If you care about security in the slightest, you should probably already have done that. What has one to do with the other

Pxtl 10y ago

Crap. The city council in my town uses Silverlight to stream their meetings. I know, I know. Still, it means I'll be missing that silverligh support.

cpeterso 10y ago
Do they support Chrome without Silverlight?
- Pxtl 10y ago
  Nope.
giancarlostoro 10y ago
Firefox ESR will still support it in their release of v52.
coldpie 10y ago
Well, hopefully some web guy at least got a nice lunch from the MS rep out of that deal.

snuxoll 10y ago

> Good bye, you will be missed (not). I'd like to say they won't be missed, but I've got a state Medicaid portal that uses some annoying Java applet to handle authentication I have no choice but to deal with (I've actually got a little flask web service that uses Selenium and Firefox in Xvfb just to log into the stupid thing and return the authentication cookies, since Chrome ditched NPAPI a while ago and IE isn't a sane option). I won't be sad when applets finally go away, but that day is not today for me and it's going to really screw things up :/

rhelmer 10y ago
Does Java Web Start support applets? I haven't had to use it in years but I seem to recall that it does.
- dblohm7 10y ago
  I believe that is Oracle's official recommendation for dealing with NPAPI deprecation.

cesarb 10y ago

Several banks here in Brazil require a "security" plugin (which acts more like malware) for one to be allowed to use online banking. I wonder how the end of NPAPI will affect this.

341j4j1k4 10y ago
If you're really Brazilian/in Brazil, you don't really wonder. You just know the answer: all those bank sites will tell you to use Chrome instead. Bradesco's fortunately works on any browser.
- cpeterso 10y ago
  Is the Brazilian "security" plugin an NPAPI plugin or a Chrome extension? Chrome doesn't support NPAPI plugins, so these banks either have non-plugin solution for Chrome or they don't support Chrome. Many Chinese ecommerce and government sites require their own "security" NPAPI plugins. These don't work in Chrome, but the large majority of users in China run hybrid browsers that use both Blink and Trident (IE) engines so these sites that require NPAPI plugins can be seamlessly loaded in a Trident tab. The user doesn't know the difference.
- cesarb 10y ago
  I know Chrome stopped supporting NPAPI plugins long before Firefox, so simply "use Chrome" won't be the answer. I doubt they will give up these "security" plugins, so the answer will most probably be an even more invasive system process. It seems that some banks are migrating to Warsaw, which is known for among other things causing problems with IPv6 (http://ipv6.br/post/bug-em-plugin-de-seguranca-de-bancos-bloqueia-internet/ http://ipv6.br/post/bug-em-plugin-de-seguranca-de-bancos-blo...).

k_sze 10y ago

I don't understand why they removed support for Silverlight and Java, but kept Flash. Are Java applets and Silverlight apps demonstrably less secure than Flash? Just as a naive metric, if you look at the CVE database, there have been a total of three CVEs for Silverlight last year; whereas for Flash... well, I stopped counting. I don't know of any bank or government agency that uses Flash, but I certainly know that the Hong Kong government uses Java on some of its websites. It feels like Mozilla is keeping Flash around just because it's more popular with browser gamers and video watchers. I don't think that's doing the right thing.

untoreh 10y ago
> I don't understand why they removed support for Silverlight and Java, but kept Flash. drm something something...shall I remind spotify web player still uses flash.
nnethercote 10y ago
> It feels like Mozilla is keeping Flash around just because it's more popular with browser gamers and video watchers. That's exactly right. The amount of Flash content dwarfs the amount of other plugin content. Banning other NPAPI plugins doesn't avoid the Flash security problems but it does avoid the other security problems. It's a step forward, but it's not the final step.
comex 10y ago
It's not about security. As you said, it's because Flash is more popular, so killing it will disrupt more users' workflows. It's a pragmatic decision… Personally, I'm hoping we see a WebAssembly build of Flash eventually (once WA is featureful enough to support it), at which point the native plugin can die without breaking (as many) old sites.

bigbugbag 10y ago

Just drop flash already, this thing has been agonizing the slowest death ever.