29 ms·

> If someone is most comfortable using their browser with a certain extension for which there is no good WebExtensions-based alternative, how can you say that f

> If someone is most comfortable using their browser with a certain extension for which there is no good WebExtensions-based alternative, how can you say that forcing them to stop using that extension is "good for them"? If supporting that extension requires exposing the user to security risks. The downside of “extensions can do anything!” is that it means extensions can do, well, anything, including things that are hostile to the user’s interests. A more restrictive API means some things extensions used to be able to do aren’t possible anymore, but that’s as true of the bad things as it is of the good. And the bad things were bad enough that it was worth losing the good ones to protect users from them. Look, I get it, it sucks to lose an extension you like and rely on. I lost a couple of these in the move myself. But the browser’s first responsibility to the user is primum non nocere: “first, do no harm.” And those old APIs, which were naïvely designed twenty years ago in a time when the Internet was far less weaponized than it is today, were exposing an awful lot of people to a great deal of harm.

saurik 7y ago
> The downside of “extensions can do anything!” is that it means extensions can do, well, anything, including things that are hostile to the user’s interests. This is also arrogant: why do you think it is OK to say I can't do something I want to do because it is possible that I use that freedom to do something that harms my own interests? People fundamentally should be allowed to do things that harm them if blocking them from harm restricts their ability to do things they wanted to do; I mean, you aren't even suggesting some kind of user-controlled sandbox: you are advocating for putting the user themselves in a sandbox because you think they are too stupid to handle power.
mort96 7y ago
I'm not trying to argue that Firefox shouldn't have deprecated XUL or NPAPI. I'm one of the people who didn't depend on any add-ons which aren't available anymore; I just had to update the add-on I wrote to work with the new API, which was easy because it's one of those add-ons which essentially just needs some javascript to be injected into all web pages. I'm just saying that when Mozilla decided to break the browser for many people, it wasn't "good for" the people who ended up with a browser which doesn't let them do what they want. It's not even "good for" the people who "only" had to invest hours into learning a new workflow with a new set of add-ons. Pretending that it is, is harmful; there are very real drawbacks which have to be weighed up against the advantages of a cleaner API which it's easier to maintain and which might be more secure. I think Mozilla absolutely made the right choice; I just don't think we can focus exclusively on the benefits and pretend that the costs don't exist. I'm also kind of curious about how the security angle works. Currently, any WebExtension which asks for the proper permission can just read the content of your banking websites if it wants, and send what it finds (your social security number, your password, your bank account numbers, etc) to an attacker. With the new API, you still have to make sure not to install malicious add-ons. How is that different between XUL and WebExtensions?

saurik 7y ago

> The downside of “extensions can do anything!” is that it means extensions can do, well, anything, including things that are hostile to the user’s interests. This is also arrogant: why do you think it is OK to say I can't do something I want to do because it is possible that I use that freedom to do something that harms my own interests? People fundamentally should be allowed to do things that harm them if blocking them from harm restricts their ability to do things they wanted to do; I mean, you aren't even suggesting some kind of user-controlled sandbox: you are advocating for putting the user themselves in a sandbox because you think they are too stupid to handle power.

mort96 7y ago

I'm not trying to argue that Firefox shouldn't have deprecated XUL or NPAPI. I'm one of the people who didn't depend on any add-ons which aren't available anymore; I just had to update the add-on I wrote to work with the new API, which was easy because it's one of those add-ons which essentially just needs some javascript to be injected into all web pages. I'm just saying that when Mozilla decided to break the browser for many people, it wasn't "good for" the people who ended up with a browser which doesn't let them do what they want. It's not even "good for" the people who "only" had to invest hours into learning a new workflow with a new set of add-ons. Pretending that it is, is harmful; there are very real drawbacks which have to be weighed up against the advantages of a cleaner API which it's easier to maintain and which might be more secure. I think Mozilla absolutely made the right choice; I just don't think we can focus exclusively on the benefits and pretend that the costs don't exist. I'm also kind of curious about how the security angle works. Currently, any WebExtension which asks for the proper permission can just read the content of your banking websites if it wants, and send what it finds (your social security number, your password, your bank account numbers, etc) to an attacker. With the new API, you still have to make sure not to install malicious add-ons. How is that different between XUL and WebExtensions?