6 ms·

I think as an extension developer he is particularly sensitive to the tech behind Firefox, which makes him understand some of Mozilla's decisions. For example,

I think as an extension developer he is particularly sensitive to the tech behind Firefox, which makes him understand some of Mozilla's decisions. For example, the move from legacy add-ons to WebExtensions is surely one less maintenance burden for Mozilla. As a user who doesn't think about such issues, it terribly looks like it's becoming a Chrome clone. I think it's Mozilla's responsibility to have a clearer communication if that's not the case.

Paul-ish 9y ago
Also, the move to WebExtensions is a move to a more secure extension model. Traditional XUL extensions were comparable to the extension developer compiling their own code into the browser. Yikes. WebExtensions should be better sandboxed and have better permissions management. You can't get those security benefits if you allow older XUL extensions to stick around. You have to sunset XUL extension at some point.
- Karunamon 9y ago
  To be perfectly honest I'm not at all interested in "better permissions" for plugins when it comes with the removal of flexibility that you get for free. If I've got plugin-installing malware on my system, I've got worse problems than a rogue plugin. Give me more useful over more secure any day of the week.
  - smkdtr 9y ago
    As someone worried about security; I hope that is not the majority opinion.
    - Silhouette 9y ago
      It's not entirely unreasonable. We use software because it's useful. If you make it so secure that it is no longer useful, what have you got left? In the case of Firefox extensions, I'm aware of the risks of the old model, but the fact is that the only observable difference it has made to me so far is that when I accidentally hit back on a page with an unsubmitted form the other day I lost about 20 minutes' worth of work, because the extension I used to use that would have saved everything automatically no longer works. This is not progress.
      - sp332 9y ago
        Lazarus: Form Recovery hasn't been maintained in years. But I don't think there's anything about it that can't be done with web extensions. There's already one that has the base functionality: https://addons.mozilla.org/en-US/firefox/addon/textarea-cache-lite/ https://addons.mozilla.org/en-US/firefox/addon/textarea-cach...
      - jhatax 9y ago
        If you hit Backspace in error, you can disable the “Go Back” action associated with the backspace key using about:config like so: browser.backspace_action = 2 Read [1] for more instructions. If you explicitly used the mouse to click the Back button, I am sorry for the time you lost. 1. http://kb.mozillazine.org/Browser.backspace_action http://kb.mozillazine.org/Browser.backspace_action
        markrages 9y ago
        Allow me to introduce the Thinkpad X61 keyboard: http://i.imgur.com/JitlIPa.jpg http://i.imgur.com/JitlIPa.jpg That's a dedicated "go back" button between up arrow and right ctrl. My webmail is unusable without Lazarus. I've taken to composing in emacs and pasting the result into forms.
        michaelmrose 9y ago
        With the appropriate extension this can be made seemless. Hit a hotkey get an emacs buffer with the current contents of input box. Write some stuff and save and quit. Input box now contains contents of emacs buffer. Annoyingly this requires a service that sits in the background in chrome because security wont let chrome launch such a process. In chrome you can use text-aid-too. Pentadactyl/vimperator can do it with firefox and others.
        fnj 9y ago
        I don't see any control keys at all in that picture! This has to be a joke.
        9y ago
    - floatingatoll 9y ago
      Sadly, it is.
    - mst 9y ago
      I'd like better permissions, but not at the cost of a more flexible, customisable browser than chrome. There should be reasons to use firefox above and beyond muscle memory.
    - ingenuous2 9y ago
      Usability will always beat security. This is why usability is one of the 2 most important concerns in security.
      - vocatus_gate 9y ago
        Security is like Safety: if it is put on a holy pedestal then everything else suffers. I always say "Safety Third."
    - michaelmrose 9y ago
      This would help all the individuals who have inadvertently installed malware addons which do not have pwned systems as soon as there are any, if there are ever any.
  - maxerickson 9y ago
    It isn't just malware installing plugins, it is the plugins increasing the attack surface for people trying to use the browser to install malware.
  - deleted 9y ago
    [deleted]
  - bugmen0t 9y ago
    But the flexibility did not come for free! Whenever they changed internal interfaces, they'd either have to create a clone, call it interface2 or break all extensions using them. That's for internal interfaces. The new model also means actual public support for a well-defined API. It's so much better for developers. Besides, it also enables some big performance and security wins.
- gsnedders 9y ago
  And, similarly, you can't go to any sort of multiprocess architecture (or multithread) model if extensions can mutate more or less anything at any point, and that's not just about security, that's also about what plenty of users have been asking for for years—performance.
- Aissen 9y ago
  > Also, the move to WebExtensions is a move to a more secure extension model. Traditional XUL extensions were comparable to the extension developer compiling their own code into the browser. Yikes. Not if you previously moved to the Jetpack, err addon-sdk with cfx, err jpm tool. Now there's yet-another API to move to. At least this one will make it easier to develop portable extensions (but still not straight-forward).
sp332 9y ago
But as a user, you're probably just going to want to know if there is an extension that does what you need. Are you worried about the underlying APIs if you're not a developer?
- spiznnx 9y ago
  I care about the direction of the project.
  - sp332 9y ago
    Something like the Mozilla Hacks blog https://hacks.mozilla.org/2017/08/firefox-55-supports-webvr/ https://hacks.mozilla.org/2017/08/firefox-55-supports-webvr/ or the Add-ons Blog https://blog.mozilla.org/addons/2017/08/03/extension-examples-see-apis-action/ https://blog.mozilla.org/addons/2017/08/03/extension-example... or just the main Mozilla blog? https://blog.mozilla.org/blog/2017/07/20/firefox-focus-android-hits-one-million-downloads-today-launching-three-new-user-requested-features/ https://blog.mozilla.org/blog/2017/07/20/firefox-focus-andro...
- yjftsjthsd-h 9y ago
  I don't care for myself, but the author of one of my favorite extensions has stated that he's not porting to a webextension because he doesn't want to rewrite (again) and because (at the time he looked, at least) the APIs didn't really support it. I don't care about the API directly, but I absolutely care when they're insufficient.
  - sp332 9y ago
    The API is expanding pretty quickly and FF developers are taking input from addon devs. https://wiki.mozilla.org/WebExtensions#Firefox_57 https://wiki.mozilla.org/WebExtensions#Firefox_57 There are even some people who have "office hours" available to give advice for porting old plugins to the new APIs. https://blog.mozilla.org/addons/2017/03/09/office-hours-support-transitioning-porting-webextensions/ https://blog.mozilla.org/addons/2017/03/09/office-hours-supp... They really don't want the APIs to be insufficient either.
HannibalLecter 9y ago
The apparent view that Mozilla would articulate their product line as a Fortune 500 company with Google's track record is patently false. Mozilla is required via its pledge to put open source solutions forward as their central focus. They only earn money in the interest of the public which supports the good, which further supports their central mandate. Google is a greedy, nosy monster of a company that erratically reacts either with self-interest or blatant marketing attempts at taking a higher road. And at times, Google acts solely upon the whim of minimal oversight. Sure some of the unilateral decisions are in line with a hipster's view of the world, but often they are in line with a corporation's lust. To what extent will Google "do no evil"? Enough only until they decided to strike that from their mandate. See more info here: https://en.wikipedia.org/wiki/Criticism_of_Google https://en.wikipedia.org/wiki/Criticism_of_Google
badsectoracula 9y ago
> For example, the move from legacy add-ons to WebExtensions is surely one less maintenance burden for Mozilla. On the other hand it is an annoyance for many extension developers and users of those extensions. Half of the extensions i use (like DownThemAll, FireFTP and MAFF) are not WebExtensions compatible and there aren't any alternatives.

Paul-ish 9y ago

Also, the move to WebExtensions is a move to a more secure extension model. Traditional XUL extensions were comparable to the extension developer compiling their own code into the browser. Yikes. WebExtensions should be better sandboxed and have better permissions management. You can't get those security benefits if you allow older XUL extensions to stick around. You have to sunset XUL extension at some point.

Karunamon 9y ago
To be perfectly honest I'm not at all interested in "better permissions" for plugins when it comes with the removal of flexibility that you get for free. If I've got plugin-installing malware on my system, I've got worse problems than a rogue plugin. Give me more useful over more secure any day of the week.
- smkdtr 9y ago
  As someone worried about security; I hope that is not the majority opinion.
  - Silhouette 9y ago
    It's not entirely unreasonable. We use software because it's useful. If you make it so secure that it is no longer useful, what have you got left? In the case of Firefox extensions, I'm aware of the risks of the old model, but the fact is that the only observable difference it has made to me so far is that when I accidentally hit back on a page with an unsubmitted form the other day I lost about 20 minutes' worth of work, because the extension I used to use that would have saved everything automatically no longer works. This is not progress.
    - sp332 9y ago
      Lazarus: Form Recovery hasn't been maintained in years. But I don't think there's anything about it that can't be done with web extensions. There's already one that has the base functionality: https://addons.mozilla.org/en-US/firefox/addon/textarea-cache-lite/ https://addons.mozilla.org/en-US/firefox/addon/textarea-cach...
    - jhatax 9y ago
      If you hit Backspace in error, you can disable the “Go Back” action associated with the backspace key using about:config like so: browser.backspace_action = 2 Read [1] for more instructions. If you explicitly used the mouse to click the Back button, I am sorry for the time you lost. 1. http://kb.mozillazine.org/Browser.backspace_action http://kb.mozillazine.org/Browser.backspace_action
      - markrages 9y ago
        Allow me to introduce the Thinkpad X61 keyboard: http://i.imgur.com/JitlIPa.jpg http://i.imgur.com/JitlIPa.jpg That's a dedicated "go back" button between up arrow and right ctrl. My webmail is unusable without Lazarus. I've taken to composing in emacs and pasting the result into forms.
        michaelmrose 9y ago
        With the appropriate extension this can be made seemless. Hit a hotkey get an emacs buffer with the current contents of input box. Write some stuff and save and quit. Input box now contains contents of emacs buffer. Annoyingly this requires a service that sits in the background in chrome because security wont let chrome launch such a process. In chrome you can use text-aid-too. Pentadactyl/vimperator can do it with firefox and others.
        fnj 9y ago
        I don't see any control keys at all in that picture! This has to be a joke.
        9y ago
  - floatingatoll 9y ago
    Sadly, it is.
  - mst 9y ago
    I'd like better permissions, but not at the cost of a more flexible, customisable browser than chrome. There should be reasons to use firefox above and beyond muscle memory.
  - ingenuous2 9y ago
    Usability will always beat security. This is why usability is one of the 2 most important concerns in security.
    - vocatus_gate 9y ago
      Security is like Safety: if it is put on a holy pedestal then everything else suffers. I always say "Safety Third."
  - michaelmrose 9y ago
    This would help all the individuals who have inadvertently installed malware addons which do not have pwned systems as soon as there are any, if there are ever any.
- maxerickson 9y ago
  It isn't just malware installing plugins, it is the plugins increasing the attack surface for people trying to use the browser to install malware.
- deleted 9y ago
  [deleted]
- bugmen0t 9y ago
  But the flexibility did not come for free! Whenever they changed internal interfaces, they'd either have to create a clone, call it interface2 or break all extensions using them. That's for internal interfaces. The new model also means actual public support for a well-defined API. It's so much better for developers. Besides, it also enables some big performance and security wins.
gsnedders 9y ago
And, similarly, you can't go to any sort of multiprocess architecture (or multithread) model if extensions can mutate more or less anything at any point, and that's not just about security, that's also about what plenty of users have been asking for for years—performance.
Aissen 9y ago
> Also, the move to WebExtensions is a move to a more secure extension model. Traditional XUL extensions were comparable to the extension developer compiling their own code into the browser. Yikes. Not if you previously moved to the Jetpack, err addon-sdk with cfx, err jpm tool. Now there's yet-another API to move to. At least this one will make it easier to develop portable extensions (but still not straight-forward).

sp332 9y ago

But as a user, you're probably just going to want to know if there is an extension that does what you need. Are you worried about the underlying APIs if you're not a developer?

spiznnx 9y ago
I care about the direction of the project.
- sp332 9y ago
  Something like the Mozilla Hacks blog https://hacks.mozilla.org/2017/08/firefox-55-supports-webvr/ https://hacks.mozilla.org/2017/08/firefox-55-supports-webvr/ or the Add-ons Blog https://blog.mozilla.org/addons/2017/08/03/extension-examples-see-apis-action/ https://blog.mozilla.org/addons/2017/08/03/extension-example... or just the main Mozilla blog? https://blog.mozilla.org/blog/2017/07/20/firefox-focus-android-hits-one-million-downloads-today-launching-three-new-user-requested-features/ https://blog.mozilla.org/blog/2017/07/20/firefox-focus-andro...
yjftsjthsd-h 9y ago
I don't care for myself, but the author of one of my favorite extensions has stated that he's not porting to a webextension because he doesn't want to rewrite (again) and because (at the time he looked, at least) the APIs didn't really support it. I don't care about the API directly, but I absolutely care when they're insufficient.
- sp332 9y ago
  The API is expanding pretty quickly and FF developers are taking input from addon devs. https://wiki.mozilla.org/WebExtensions#Firefox_57 https://wiki.mozilla.org/WebExtensions#Firefox_57 There are even some people who have "office hours" available to give advice for porting old plugins to the new APIs. https://blog.mozilla.org/addons/2017/03/09/office-hours-support-transitioning-porting-webextensions/ https://blog.mozilla.org/addons/2017/03/09/office-hours-supp... They really don't want the APIs to be insufficient either.

HannibalLecter 9y ago

The apparent view that Mozilla would articulate their product line as a Fortune 500 company with Google's track record is patently false. Mozilla is required via its pledge to put open source solutions forward as their central focus. They only earn money in the interest of the public which supports the good, which further supports their central mandate. Google is a greedy, nosy monster of a company that erratically reacts either with self-interest or blatant marketing attempts at taking a higher road. And at times, Google acts solely upon the whim of minimal oversight. Sure some of the unilateral decisions are in line with a hipster's view of the world, but often they are in line with a corporation's lust. To what extent will Google "do no evil"? Enough only until they decided to strike that from their mandate. See more info here: https://en.wikipedia.org/wiki/Criticism_of_Google https://en.wikipedia.org/wiki/Criticism_of_Google

badsectoracula 9y ago

> For example, the move from legacy add-ons to WebExtensions is surely one less maintenance burden for Mozilla. On the other hand it is an annoyance for many extension developers and users of those extensions. Half of the extensions i use (like DownThemAll, FireFTP and MAFF) are not WebExtensions compatible and there aren't any alternatives.