5 ms·

I don't care about XUL addons. What I cared about was addons with full access to the browser. I understand that they wanted to move, and that addons would break

I don't care about XUL addons. What I cared about was addons with full access to the browser. I understand that they wanted to move, and that addons would break. But I would still love to be able to list non-sandboxed extensions in the store even if they came with a big warning "this extension will probably break with every new version of Firefox". There is still functionality that can't yet be replicated with WebExtensions. For example I was maintaining VimFx as an unsigned extension for a while after it wasn't allowed in the store. Sure, it broke often, but the fixes were generally easy. However what really killed it was the lack of interest from not being able to be listed in the store and not being able to run on stable Firefox releases. If we could attract even a handful more maintainers I'm sure we could have kept it mostly up to date. To this day I can't get back some of the functionality that I lost. Firefox is now just a different chrome. Sure, it is made by a different company, but the user functionality is now almost identical. (Sure, Firefox has about:config, but that is limited to what Mozilla imagined) I'm really glad that Mozilla adopted WebExtensions. I think it is an amazing solution for most extensions. Plus it is safer and cross-browser. However there are a couple of extensions that need full access, and I wish that was still an option, even if there is no stability guarantee.

cycloptic 6y ago
Honestly, your best bet now if you really want to target the stable branch seems to be to maintain a patchset on top of omni.ja. I see no reason that these type of modifications need to be dressed up like they're an extension.
- kevincox 6y ago
  Because it is convenient. I don't want build my own Firefox distribution on every machine I use. All I want is to be able to include a script into the browser's chrome process and have an easy way to publish and share. This is basically Firefox extensions used to be. (well also XUL patches, but that could have been done with JS too)
  - cycloptic 6y ago
    Then build some tools to make it more convenient by applying the patches post-installation, and publish/share it on github? I just don't see how this is any more hassle then having something that you call an extension but that breaks every update and also needs manual fixing.
    - kevincox 6y ago
      You mean like addons.mozilla.org?
      - cycloptic 6y ago
        No, because the things up there don't break every update or require manual fixing.
        kevincox 6y ago
        Why? I don't see a message that says it is only for stable addons. I don't care if they mark them as unstable, or hide them in the search, but I think itt should be possible to distribute them. I don't see why we would create a whole new infrastructure when one already exists. We just need to repeal the policies that they put in place and come up with ones that allow this type of "power extension".
        cycloptic 6y ago
        You can distribute them on any other site. Somewhere like github would be happy to host them. Power users already know how to use those sites to sideload extensions. I don't see what benefit is going to be had from distributing an unstable extension that can potentially break every update, break the entire browser, steal passwords, keylog you, etc, alongside all the other stable extensions.
xg15 6y ago
Question: would it be possible to restore the missing functionality through a companion process outside the browser? Both Firefox and Chrome support the Native Messaging API [1] to communicate with a process outside the browser. This would still be absolutely less than ideal as the process would have to be installed separately (I believe) and maintained separately for each platform - but it would allow the extension to be listed again. [1] https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
- lifthrasiir 6y ago
  Yes, for example I've used Timimi [1] for saving TiddlyWiki [2] to the local disk, and it relies on native programs for its core functionality. [1] https://ibnishak.github.io/Timimi/ https://ibnishak.github.io/Timimi/ [2] https://tiddlywiki.com/ https://tiddlywiki.com/
- kevincox 6y ago
  For some extensions, yes. But the problem isn't so much sandbox from a security perspective, but the lack of access to Firefox internals. For VimFx the primary problem is that it makes major changes to how input is processed. It can't get the level of input access it needs from the WebExtension APIs. You can see this in the WebExtension versions of similar vim-style binding extensions, I've tried maybe a dozen and none of them work as you would expect. It is common for inputs to be missed by the extension depending on what part of the browser is focused at the moment.

cycloptic 6y ago

Honestly, your best bet now if you really want to target the stable branch seems to be to maintain a patchset on top of omni.ja. I see no reason that these type of modifications need to be dressed up like they're an extension.

kevincox 6y ago
Because it is convenient. I don't want build my own Firefox distribution on every machine I use. All I want is to be able to include a script into the browser's chrome process and have an easy way to publish and share. This is basically Firefox extensions used to be. (well also XUL patches, but that could have been done with JS too)
- cycloptic 6y ago
  Then build some tools to make it more convenient by applying the patches post-installation, and publish/share it on github? I just don't see how this is any more hassle then having something that you call an extension but that breaks every update and also needs manual fixing.
  - kevincox 6y ago
    You mean like addons.mozilla.org?
    - cycloptic 6y ago
      No, because the things up there don't break every update or require manual fixing.
      - kevincox 6y ago
        Why? I don't see a message that says it is only for stable addons. I don't care if they mark them as unstable, or hide them in the search, but I think itt should be possible to distribute them. I don't see why we would create a whole new infrastructure when one already exists. We just need to repeal the policies that they put in place and come up with ones that allow this type of "power extension".
        cycloptic 6y ago
        You can distribute them on any other site. Somewhere like github would be happy to host them. Power users already know how to use those sites to sideload extensions. I don't see what benefit is going to be had from distributing an unstable extension that can potentially break every update, break the entire browser, steal passwords, keylog you, etc, alongside all the other stable extensions.

xg15 6y ago

Question: would it be possible to restore the missing functionality through a companion process outside the browser? Both Firefox and Chrome support the Native Messaging API [1] to communicate with a process outside the browser. This would still be absolutely less than ideal as the process would have to be installed separately (I believe) and maintained separately for each platform - but it would allow the extension to be listed again. [1] https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

lifthrasiir 6y ago
Yes, for example I've used Timimi [1] for saving TiddlyWiki [2] to the local disk, and it relies on native programs for its core functionality. [1] https://ibnishak.github.io/Timimi/ https://ibnishak.github.io/Timimi/ [2] https://tiddlywiki.com/ https://tiddlywiki.com/
kevincox 6y ago
For some extensions, yes. But the problem isn't so much sandbox from a security perspective, but the lack of access to Firefox internals. For VimFx the primary problem is that it makes major changes to how input is processed. It can't get the level of input access it needs from the WebExtension APIs. You can see this in the WebExtension versions of similar vim-style binding extensions, I've tried maybe a dozen and none of them work as you would expect. It is common for inputs to be missed by the extension depending on what part of the browser is focused at the moment.