13 ms·

I find this pretty exciting for (hopefully; someday) wider adoption of alternative protocols: Starting with Firefox 59, several protocols that support decentra

I find this pretty exciting for (hopefully; someday) wider adoption of alternative protocols: Starting with Firefox 59, several protocols that support decentralized architectures are available for use by extensions. The white-listed protocols are: + Dat Project (dat://) + IPFS (dweb:// ipfs:// ipns://) + Secure Scuttlebutt (ssb://)

pfraze 9y ago
Yeah this is pretty great. AFAIK it's limited to only redirecting to a handler website, but that's a big step forward for using these protocols in links and etc. We're still hoping to get full protocol-handling with an API similar to https://github.com/electron/electron/blob/v1.8.2-beta.3/docs/api/protocol.md#protocolregisterstreamprotocolscheme-handler-completion https://github.com/electron/electron/blob/v1.8.2-beta.3/docs...
- fenwick67 9y ago
  Maybe I'm reading this wrong, but it sounds like they've made it so you can develop a webextension that handles DAT:// or IPFS:// URLs. They didn't make IPFS:// URLs redirect to http://ipfs.io/ipfs/$hash http://ipfs.io/ipfs/$hash.
  - deleted 9y ago
    [deleted]
  - classichasclass 9y ago
    Sort of. I think this is based on the `registerProtocolHandler()` means, and if so, you can redirect this to an internal page in your extension. See https://addons.mozilla.org/en-US/firefox/addon/overbitewx/ https://addons.mozilla.org/en-US/firefox/addon/overbitewx/ (disclaimer: authored by yours truly). The more pressing concern is how you would speak these protocols because there's still no direct socket support. In my case, the addon just acts as a history and redirect shim and my server does the actual server access and translation. I'm actually thinking of cobbling together a native messaging-based extension as a stopgap since obviously this is suboptimal.
    - soapdog 9y ago
      Hi, I did just like you said using Native Messaging API[1] to communicate with a local companion app using standard input/output shell calls, this app can handle the socket communication, that is how I am handling it for the scuttlebutt experiments I am doing (I mentioned them above with some URLs if you want to check), I hope to start a conversation soon on the add-ons list about the needs of having UDP and TCP available for WebExtensions. It is suboptimal but it works today...
      - classichasclass 9y ago
        Is this bug 1247628?
        soapdog 9y ago
        oh! I was not aware of that bug! thanks a lot for pointing it to me, I will add myself to the CC list there and join the talk.
        mncharity 9y ago
        https://bugzilla.mozilla.org/show_bug.cgi?id=1247628 https://bugzilla.mozilla.org/show_bug.cgi?id=1247628 https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Native_messaging https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Na... https://developer.chrome.com/extensions/nativeMessaging https://developer.chrome.com/extensions/nativeMessaging
  - soapdog 9y ago
    They made that before that protocol was on the whitelist, now they could ship a native app that has a webextension bundled with it to handle all of it without using that redirect.
kodablah 9y ago
Why does it require a whitelist? If I make my own, do I have to contact Mozilla or is the user prompted when first access is attempted?
- classichasclass 9y ago
  The protocol handler support is restricted to a whitelist to prevent an addon from taking over, say, "http://" http://" (or other protocols which could be used to insinuate unsafe content).
  - pbhjpbhj 9y ago
    [How] do they handle collisions of apps that can manage the whitelisted protocols then?
    - soapdog 9y ago
      When you navigate to a custom protocol URL there is a popup asking how to handle it, it will show all the add-ons in a list (and maybe native apps too). You can select you're chosen one and tell it "not to ask again".
  - inlined 9y ago
    It still seems safe though to set up rules where domain ownership could automatically grant ownership for a protocol. E.g. Facebook.com:// or just Facebook:// if .coms were allowed to be dropped.
- hobofan 9y ago
  I think the whitelist on what you can register as protocol handlers is a security measure. E.g. if Paypal uses "paypal:" links which are handled by a OS native application, you can't write a extension that hijacks those links.
  - kuschku 9y ago
    So how do I make an extension that supports Firefox 57 or later and does mycustomprotocol:// without prefix? Do I have to Rowhammer my access through Firefox' code? I do not see how it is in Mozilla's right to restrict what a user can do with the user's browser.
soapdog 9y ago
Hey! I made that patch! :-D so basically the explanation is simple. There is a whitelist of protocols you can have your WebExtension take over. If the protocol you want to control is not on that whitelist such as an hypothetical "catgifs:" protocol, you need to prefix it like: "web+catgifs" or "ext+catgifs" depending if it will be used from the Add-on or by redirection to another Web page. This makes it inconvenient to use with lots of decentralization protocols because in many other clients we are already using urls such as "ssb:" and "dat:" (eg, check out beaker browser). In essence this allows us to implement many new cool decentralization features as add-ons now that we can take over protocols, so, you could be in Firefox browsing the normal web and suddenly see a "dat:" link, normally you'd need to switch clients to a dat enabled app, now, you can have an add-on display that content in the current user-agent you're using. Still, there is another feature that we need before we can start really implementing decentralization protocols as pure WebExtensions, we need both TCP and UDP APIs like we had in Firefox OS (as an example, Scuttlebutt uses UDP to find peers in LAN and its own muxrpc TCP protocol to exchange data, DAT also uses UDP/TCP instead of HTTP). I have been building little experiments in Firefox for interfacing with Scuttlebutt which can be seen at: https://viewer.scuttlebot.io/%25csKtp9VmxTjJoKy17O7GA6%2F3S8ou9Y9XLi8pZ%2FQgwKs%3D.sha256 https://viewer.scuttlebot.io/%25csKtp9VmxTjJoKy17O7GA6%2F3S8... https://viewer.scuttlebot.io/%25uBev5w8m8iZGVbQDo9fpr%2BCXLBtth0xngs4uUF%2FLFAk%3D.sha256 https://viewer.scuttlebot.io/%25uBev5w8m8iZGVbQDo9fpr%2BCXLB... I hope to start a conversation in the add-ons list about TCP and UDP APIs for WebExtensions soon :-)
- poopslide 9y ago
  Please excuse the inappropriate question, but this one has been bugging me for many years: will there ever be some kind of session manager on Firefox Mobile that can save and recall your browsing session (a group of tabs) to/from a local file, similar to how OneTab or MySessions are working?
- madez 9y ago
  Decentralization and safer protocols are needed. Plain HTTP and even HTTPS are really not the best one could come up with. There are better alternatives, but using them is not always easy. So, thanks a lot for your work on making that easier!
fiatjaf 9y ago
Honest question: who's using ssb://?
- soapdog 9y ago
  Secure Scuttlebutt, check it out at http://scuttlebutt.nz http://scuttlebutt.nz
  - fiatjaf 9y ago
    My question was actually: who's using Secure Scuttlebutt?
    - staltz 9y ago
      I'm using, daily. Also about ~2300 other people, but that's just how much my own local installation holds, they may be more that I'm not aware of.

pfraze 9y ago

Yeah this is pretty great. AFAIK it's limited to only redirecting to a handler website, but that's a big step forward for using these protocols in links and etc. We're still hoping to get full protocol-handling with an API similar to https://github.com/electron/electron/blob/v1.8.2-beta.3/docs/api/protocol.md#protocolregisterstreamprotocolscheme-handler-completion https://github.com/electron/electron/blob/v1.8.2-beta.3/docs...

fenwick67 9y ago
Maybe I'm reading this wrong, but it sounds like they've made it so you can develop a webextension that handles DAT:// or IPFS:// URLs. They didn't make IPFS:// URLs redirect to http://ipfs.io/ipfs/$hash http://ipfs.io/ipfs/$hash.
- deleted 9y ago
  [deleted]
- classichasclass 9y ago
  Sort of. I think this is based on the `registerProtocolHandler()` means, and if so, you can redirect this to an internal page in your extension. See https://addons.mozilla.org/en-US/firefox/addon/overbitewx/ https://addons.mozilla.org/en-US/firefox/addon/overbitewx/ (disclaimer: authored by yours truly). The more pressing concern is how you would speak these protocols because there's still no direct socket support. In my case, the addon just acts as a history and redirect shim and my server does the actual server access and translation. I'm actually thinking of cobbling together a native messaging-based extension as a stopgap since obviously this is suboptimal.
  - soapdog 9y ago
    Hi, I did just like you said using Native Messaging API[1] to communicate with a local companion app using standard input/output shell calls, this app can handle the socket communication, that is how I am handling it for the scuttlebutt experiments I am doing (I mentioned them above with some URLs if you want to check), I hope to start a conversation soon on the add-ons list about the needs of having UDP and TCP available for WebExtensions. It is suboptimal but it works today...
    - classichasclass 9y ago
      Is this bug 1247628?
      - soapdog 9y ago
        oh! I was not aware of that bug! thanks a lot for pointing it to me, I will add myself to the CC list there and join the talk.
      - mncharity 9y ago
        https://bugzilla.mozilla.org/show_bug.cgi?id=1247628 https://bugzilla.mozilla.org/show_bug.cgi?id=1247628 https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Native_messaging https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Na... https://developer.chrome.com/extensions/nativeMessaging https://developer.chrome.com/extensions/nativeMessaging
- soapdog 9y ago
  They made that before that protocol was on the whitelist, now they could ship a native app that has a webextension bundled with it to handle all of it without using that redirect.

kodablah 9y ago

Why does it require a whitelist? If I make my own, do I have to contact Mozilla or is the user prompted when first access is attempted?

classichasclass 9y ago
The protocol handler support is restricted to a whitelist to prevent an addon from taking over, say, "http://" http://" (or other protocols which could be used to insinuate unsafe content).
- pbhjpbhj 9y ago
  [How] do they handle collisions of apps that can manage the whitelisted protocols then?
  - soapdog 9y ago
    When you navigate to a custom protocol URL there is a popup asking how to handle it, it will show all the add-ons in a list (and maybe native apps too). You can select you're chosen one and tell it "not to ask again".
- inlined 9y ago
  It still seems safe though to set up rules where domain ownership could automatically grant ownership for a protocol. E.g. Facebook.com:// or just Facebook:// if .coms were allowed to be dropped.
hobofan 9y ago
I think the whitelist on what you can register as protocol handlers is a security measure. E.g. if Paypal uses "paypal:" links which are handled by a OS native application, you can't write a extension that hijacks those links.
- kuschku 9y ago
  So how do I make an extension that supports Firefox 57 or later and does mycustomprotocol:// without prefix? Do I have to Rowhammer my access through Firefox' code? I do not see how it is in Mozilla's right to restrict what a user can do with the user's browser.

soapdog 9y ago

Hey! I made that patch! :-D so basically the explanation is simple. There is a whitelist of protocols you can have your WebExtension take over. If the protocol you want to control is not on that whitelist such as an hypothetical "catgifs:" protocol, you need to prefix it like: "web+catgifs" or "ext+catgifs" depending if it will be used from the Add-on or by redirection to another Web page. This makes it inconvenient to use with lots of decentralization protocols because in many other clients we are already using urls such as "ssb:" and "dat:" (eg, check out beaker browser). In essence this allows us to implement many new cool decentralization features as add-ons now that we can take over protocols, so, you could be in Firefox browsing the normal web and suddenly see a "dat:" link, normally you'd need to switch clients to a dat enabled app, now, you can have an add-on display that content in the current user-agent you're using. Still, there is another feature that we need before we can start really implementing decentralization protocols as pure WebExtensions, we need both TCP and UDP APIs like we had in Firefox OS (as an example, Scuttlebutt uses UDP to find peers in LAN and its own muxrpc TCP protocol to exchange data, DAT also uses UDP/TCP instead of HTTP). I have been building little experiments in Firefox for interfacing with Scuttlebutt which can be seen at: https://viewer.scuttlebot.io/%25csKtp9VmxTjJoKy17O7GA6%2F3S8ou9Y9XLi8pZ%2FQgwKs%3D.sha256 https://viewer.scuttlebot.io/%25csKtp9VmxTjJoKy17O7GA6%2F3S8... https://viewer.scuttlebot.io/%25uBev5w8m8iZGVbQDo9fpr%2BCXLBtth0xngs4uUF%2FLFAk%3D.sha256 https://viewer.scuttlebot.io/%25uBev5w8m8iZGVbQDo9fpr%2BCXLB... I hope to start a conversation in the add-ons list about TCP and UDP APIs for WebExtensions soon :-)

poopslide 9y ago
Please excuse the inappropriate question, but this one has been bugging me for many years: will there ever be some kind of session manager on Firefox Mobile that can save and recall your browsing session (a group of tabs) to/from a local file, similar to how OneTab or MySessions are working?
madez 9y ago
Decentralization and safer protocols are needed. Plain HTTP and even HTTPS are really not the best one could come up with. There are better alternatives, but using them is not always easy. So, thanks a lot for your work on making that easier!

fiatjaf 9y ago

Honest question: who's using ssb://?

soapdog 9y ago
Secure Scuttlebutt, check it out at http://scuttlebutt.nz http://scuttlebutt.nz
- fiatjaf 9y ago
  My question was actually: who's using Secure Scuttlebutt?
  - staltz 9y ago
    I'm using, daily. Also about ~2300 other people, but that's just how much my own local installation holds, they may be more that I'm not aware of.