4 ms·

So they are hand-picking extensions now? Is this trend going to continue (i.e. they continue to add more but still with a manual process) or they're aiming to b

So they are hand-picking extensions now? Is this trend going to continue (i.e. they continue to add more but still with a manual process) or they're aiming to be on par with the old Firefox (supports most of extensions automatically)?

kibwen 6y ago
AFAICT the intent is to eventually support the full WebExtensions API, i.e. every extension that runs on Firefox 57 or later. From an older blog post discussing this: "We’re happy to confirm that GeckoView is currently building support for extensions through the WebExtensions API. This feature will be available in Firefox Preview, and we are looking forward to offering a great experience for both mobile users and developers. Bringing GeckoView and Firefox Preview up to par with the APIs that were supported previously in Firefox for Android won’t happen overnight. For the remainder of 2019 and leading into 2020, we are focusing on building support for a selection of content from our Recommended Extensions program that work well on mobile and cover a variety of utilities and features." https://blog.mozilla.org/addons/2019/10/23/fx-preview-geckoview-add-ons-support/ https://blog.mozilla.org/addons/2019/10/23/fx-preview-geckov...
- realharo 6y ago
  The answers here seem to suggest otherwise. https://blog.mozilla.org/addons/2020/02/11/faq-for-extension-support-in-new-firefox-for-android/ https://blog.mozilla.org/addons/2020/02/11/faq-for-extension... My guess would be that they'll try to make it curated-only unless users complain too much. Or maybe allow other extensions behind serious warning screens. If that ends up being the case, depending on their review process, it kinda sucks for any potential new extensions created after the ecosystem lockdown, that won't get a chance to attain enough popularity to be relevant - unless Mozilla agrees to do a review for any project that asks, which doesn't seem likely.
  - fwn 6y ago
    Would also be bad for all extensions Mozilla does not allow in their extension store. All software stores can be pressured to remove content. Keeping the ability to load non-store extensions fixes that specific deplatfoming problem.
    - realharo 6y ago
      The basic assumption is that users are dumb when it comes to security, and if there is a way to install malware, they will be tricked into installing malware (even with no vulnerabilities in the host software itself). Especially since there is such a thing as warning screen fatigue, which makes people not pay attention and just click through due to the sheer amount of benign(ish) warning screens they regularly deal with (https://en.wikipedia.org/wiki/Alarm_fatigue https://en.wikipedia.org/wiki/Alarm_fatigue). Making them explicitly type out "YES I AM AWARE THIS EXTENSION COULD EASILY CONTAIN MALICIOUS CODE AND I TRUST THE SOURCE: " + the domain name, in all caps before proceeding could be enough to catch most cases (unless too much legit software gets forced behind such warnings, where it would lead to that fatigue problem again). Desktop Chrome doesn't let you have an outside extension without showing a warning on every single startup (even if it's an extension you are currently developing), but that could be because on a desktop OS, other applications could add such extension into Chrome without a user action. On mobile, where apps are isolated from one another, that problem doesn't exist, so maybe such strict restrictions shouldn't be necessary.
      - fwn 6y ago
        I don't think any of this is necessary. I know we often say "the user is dumb, therefore software should patronize them", but that really only goes so far. On hindsight it looks like a balancing act where single features are evaluated for their danger, etc. Then, at some point, there's no software left that allows users to achieve their goals, because "you wouldn't want to do that", "stupid people could accidentally use it", "your use case is too fringe to justify catering to it anymore", etc. We're pretty much at this point now regarding browsers on Android, where there's only Chrome and it's skins (that let you do nothing) and Firefox. I can't believe the sensible thing to do would be to cut uncurated, non-store extensions from Firefox as well. It would be a huge loss for the whole ecosystem just to make a few Firefox installs (from an already small install base) a tiny bit less compromisable.
JeremyNT 6y ago
The new version does seem to be a play at creating a walled garden Firefox platform on Android. I'm curious whether the ability to add arbitrary extensions is just ifdef'd out of the play store version, or whether this feature is just fundamentally unimplemented. I don't intend to switch to a different browser from current FF on Android that does not support the extensions I use.

kibwen 6y ago

AFAICT the intent is to eventually support the full WebExtensions API, i.e. every extension that runs on Firefox 57 or later. From an older blog post discussing this: "We’re happy to confirm that GeckoView is currently building support for extensions through the WebExtensions API. This feature will be available in Firefox Preview, and we are looking forward to offering a great experience for both mobile users and developers. Bringing GeckoView and Firefox Preview up to par with the APIs that were supported previously in Firefox for Android won’t happen overnight. For the remainder of 2019 and leading into 2020, we are focusing on building support for a selection of content from our Recommended Extensions program that work well on mobile and cover a variety of utilities and features." https://blog.mozilla.org/addons/2019/10/23/fx-preview-geckoview-add-ons-support/ https://blog.mozilla.org/addons/2019/10/23/fx-preview-geckov...

realharo 6y ago
The answers here seem to suggest otherwise. https://blog.mozilla.org/addons/2020/02/11/faq-for-extension-support-in-new-firefox-for-android/ https://blog.mozilla.org/addons/2020/02/11/faq-for-extension... My guess would be that they'll try to make it curated-only unless users complain too much. Or maybe allow other extensions behind serious warning screens. If that ends up being the case, depending on their review process, it kinda sucks for any potential new extensions created after the ecosystem lockdown, that won't get a chance to attain enough popularity to be relevant - unless Mozilla agrees to do a review for any project that asks, which doesn't seem likely.
- fwn 6y ago
  Would also be bad for all extensions Mozilla does not allow in their extension store. All software stores can be pressured to remove content. Keeping the ability to load non-store extensions fixes that specific deplatfoming problem.
  - realharo 6y ago
    The basic assumption is that users are dumb when it comes to security, and if there is a way to install malware, they will be tricked into installing malware (even with no vulnerabilities in the host software itself). Especially since there is such a thing as warning screen fatigue, which makes people not pay attention and just click through due to the sheer amount of benign(ish) warning screens they regularly deal with (https://en.wikipedia.org/wiki/Alarm_fatigue https://en.wikipedia.org/wiki/Alarm_fatigue). Making them explicitly type out "YES I AM AWARE THIS EXTENSION COULD EASILY CONTAIN MALICIOUS CODE AND I TRUST THE SOURCE: " + the domain name, in all caps before proceeding could be enough to catch most cases (unless too much legit software gets forced behind such warnings, where it would lead to that fatigue problem again). Desktop Chrome doesn't let you have an outside extension without showing a warning on every single startup (even if it's an extension you are currently developing), but that could be because on a desktop OS, other applications could add such extension into Chrome without a user action. On mobile, where apps are isolated from one another, that problem doesn't exist, so maybe such strict restrictions shouldn't be necessary.
    - fwn 6y ago
      I don't think any of this is necessary. I know we often say "the user is dumb, therefore software should patronize them", but that really only goes so far. On hindsight it looks like a balancing act where single features are evaluated for their danger, etc. Then, at some point, there's no software left that allows users to achieve their goals, because "you wouldn't want to do that", "stupid people could accidentally use it", "your use case is too fringe to justify catering to it anymore", etc. We're pretty much at this point now regarding browsers on Android, where there's only Chrome and it's skins (that let you do nothing) and Firefox. I can't believe the sensible thing to do would be to cut uncurated, non-store extensions from Firefox as well. It would be a huge loss for the whole ecosystem just to make a few Firefox installs (from an already small install base) a tiny bit less compromisable.

JeremyNT 6y ago

The new version does seem to be a play at creating a walled garden Firefox platform on Android. I'm curious whether the ability to add arbitrary extensions is just ifdef'd out of the play store version, or whether this feature is just fundamentally unimplemented. I don't intend to switch to a different browser from current FF on Android that does not support the extensions I use.