4 ms·

> So they're careful. Any add-on that breaks other stuff doesn't really get adopted. This wasn't true at all. A lot of popular addons interacted with the brows

> So they're careful. Any add-on that breaks other stuff doesn't really get adopted. This wasn't true at all. A lot of popular addons interacted with the browser XUL in incredibly intrusive ways. In particular, addons which altered the browser's tabbed browsing interface and/or behavior (like the various Tab Mix extensions, as well as Tree Style Tabs) tended to do so by making radical modifications to XUL, which would often break other extensions which interacted with tabs. > Addon developers just namespace their stuff by putting a prefix on their identifiers. That was not standard practice, unfortunately. Conflicts between extensions were commonplace; it was a rule of thumb to avoid installing multiple extensions which interacted with the same browser feature. > So don't change Firefox so drastically. This would have meant effectively freezing most UI development, to say nothing of more ambitious projects like e10s (multiprocess browsing). It would have led to the inevitable death of the project by stagnation. > Most times, addons are almost like any other program, and should be judged accordingly before installing. You heavily overestimate the degree of scrutiny that users applied to extensions. The fact that they could be installed from a web interface made users treat them very casually. > I imagine even after the restrictions were placed on addons, they're probably still capable of quite a bit of malice. XUL-era extensions had vastly more power than WebExtensions. They were equivalent in power to native executables -- they could run native code, read/write any file on the system, and communicate with any host, all without confirmation -- and there wasn't even any framework to allow developers to voluntarily restrict their power, because they ran in the same context as the rest of the browser chrome.

Reelin 6y ago
> You heavily overestimate the degree of scrutiny that users applied to extensions. I apply scrutiny in the form of very carefully vetting the author's identity and reputation. At the end of the day that seems to be a fairly common and reasonably effective approach. > XUL-era extensions had vastly more power than WebExtensions. They were equivalent in power to native executables That was an important feature, not a bug (IMO). Sure WebExtensions are nicely sandboxed away from the OS, but the threat posed by a malicious version of uMatrix or Dark Reader is nonetheless difficult to understate. Certainly many users made poor decisions. Certainly there were valid technical issues at play. But let's not pretend that all users are irresponsible or that there weren't serious drawbacks to what was done in terms of lost functionality. Some of the modifications I made use of still haven't been replicated in WebExtensions due to lack of ability (AFAIK). The only solution I'm aware of would be to patch the browser myself and recompile it, which is an _incredibly_ high barrier to entry (and that's before the ongoing maintenance burden).
- hire_charts 6y ago
  There's a reason that phishing is the go-to infosec attack vector. It's because we still blame users for being tricked into doing things they shouldn't, rather than taking the time to build systems that prevent such vectors from working. I'm happy that extensions no longer have such wide-reaching access to the system. Whatever we lost in power-user tinkerability isn't worth the high personal cost that the malicious extensions would have on the lives of unsuspecting users.
  - stickfigure 6y ago
    Hmmm. Apple seems to be making that same argument over gatekeeping apps on MacOS right now. I'm not convinced. Maybe it's time to get off the consumer train.
    - majewsky 6y ago
      > Maybe it's time to get off the consumer train. What's that supposed to mean? We put IT in everyone's hands. We're not going to be able to just take it away from them.
  - Reelin 6y ago
    I don't think this sort of security trumps everything else approach is a valid line of argument. Surely there are tradeoffs to be made, and surely one size doesn't fit all. As to phishing in particular, I don't agree that the issue is a lack of willingness to design resistant systems or a misguided assignment of blame. I think it's because solving that problem at scale in the real world is (or at least was) legitimately difficult. The vast majority of people in the world don't carry a YubiKey on them and probably won't any time soon. There are even users in the US that still don't have reliable access to a mobile phone! A product that doesn't work for the actual users simply isn't viable.
  - GoblinSlayer 6y ago
    >There's a reason that phishing is the go-to infosec attack vector. It's because we still blame users for being tricked into doing things they shouldn't, rather than taking the time to build systems that prevent such vectors from working. Such system was already built in the bronze age: Troy.

Reelin 6y ago

> You heavily overestimate the degree of scrutiny that users applied to extensions. I apply scrutiny in the form of very carefully vetting the author's identity and reputation. At the end of the day that seems to be a fairly common and reasonably effective approach. > XUL-era extensions had vastly more power than WebExtensions. They were equivalent in power to native executables That was an important feature, not a bug (IMO). Sure WebExtensions are nicely sandboxed away from the OS, but the threat posed by a malicious version of uMatrix or Dark Reader is nonetheless difficult to understate. Certainly many users made poor decisions. Certainly there were valid technical issues at play. But let's not pretend that all users are irresponsible or that there weren't serious drawbacks to what was done in terms of lost functionality. Some of the modifications I made use of still haven't been replicated in WebExtensions due to lack of ability (AFAIK). The only solution I'm aware of would be to patch the browser myself and recompile it, which is an _incredibly_ high barrier to entry (and that's before the ongoing maintenance burden).

hire_charts 6y ago
There's a reason that phishing is the go-to infosec attack vector. It's because we still blame users for being tricked into doing things they shouldn't, rather than taking the time to build systems that prevent such vectors from working. I'm happy that extensions no longer have such wide-reaching access to the system. Whatever we lost in power-user tinkerability isn't worth the high personal cost that the malicious extensions would have on the lives of unsuspecting users.
- stickfigure 6y ago
  Hmmm. Apple seems to be making that same argument over gatekeeping apps on MacOS right now. I'm not convinced. Maybe it's time to get off the consumer train.
  - majewsky 6y ago
    > Maybe it's time to get off the consumer train. What's that supposed to mean? We put IT in everyone's hands. We're not going to be able to just take it away from them.
- Reelin 6y ago
  I don't think this sort of security trumps everything else approach is a valid line of argument. Surely there are tradeoffs to be made, and surely one size doesn't fit all. As to phishing in particular, I don't agree that the issue is a lack of willingness to design resistant systems or a misguided assignment of blame. I think it's because solving that problem at scale in the real world is (or at least was) legitimately difficult. The vast majority of people in the world don't carry a YubiKey on them and probably won't any time soon. There are even users in the US that still don't have reliable access to a mobile phone! A product that doesn't work for the actual users simply isn't viable.
- GoblinSlayer 6y ago
  >There's a reason that phishing is the go-to infosec attack vector. It's because we still blame users for being tricked into doing things they shouldn't, rather than taking the time to build systems that prevent such vectors from working. Such system was already built in the bronze age: Troy.