8 ms·

What’s going on in the world of extensions

137 points by Vinnl 4y ago

glasss 4y ago
>ick-inducing ads I guess I'm getting old and grouchy.
contravariant 4y ago
Ah so this is why they messed up the overflow menu. Kind of hoping I can actually order the extensions at some point though, it's a bit messy if you can no longer control which extensions are in the overflow menu or what order they're in.
- roter 4y ago
  extensions.unifiedExtensions.enabled: false
  - contravariant 4y ago
    Ah that is what it was, thanks!
- PurpleRamen 4y ago
  That lack of sorting in the new extension-menu makes question whether the developers are even using their own work. This seems like an obvious problem one would realize early when using it.
Vinnl 4y ago
Some more detail about the control that the new extensions button gives users: https://blog.mozilla.org/addons/2022/11/17/unified-extensions-button-and-how-to-handle-permissions-in-manifest-v3/ https://blog.mozilla.org/addons/2022/11/17/unified-extension... It allows you to disable extensions only on specific sites. (And presumably, that's also the reason you need to dive into about:config to remove it: if you remove it, it's pretty hard for casual users to find out why an extension isn't working. By gating it behind about:config, people who are able to deal with that can still remove it without rendering casual users helpless. That's my personal interpretation though.)
- gnicholas 4y ago
  Does this allow whitelisting as well as blacklisting? Chrome has offered both for a long time, and I remember being surprised to learn that FF didn't offer either. It's a welcome change!
- pentagrama 4y ago
  I was checking this new extension button, I think is useful to give more light to extensions, but what I don't like it at all is that it only shows the extensions that are not present on the nav bar, not all your installed extensions. I think is confusing, it should be the list of all your extensions, and the user can pick which extension also appears more handy on the nav bar.
  - Yaina 4y ago
    That was in the original spec, but had to be changed because of technical constraints in the toolbar code. Hopefully that can be addressed at some point in the near future :)
tomComb 4y ago
Need we play such language games? It's "ad blocking". People use those extensions to block ads. If you asked the average user about their privacy preserving add-on, or their content blocker they would probably be confused. Yes, obviously I understand the privacy dimensions of advertising, and I realize that this is all in the service of the good guys and against the bad guys, but that shouldn't affect our response to what seems to me to be unnecessary spin.
- msla 4y ago
  I see it as a good rhetorical move: Say it's ad blocking, and you get people coming in all po-faced about the need for platforms to make money and how horrible it is to have freeloaders blocking honest, legitimate adtech. Frame it as defense of privacy and malware-blocking and those adtech boosters are on the defensive, to the point they probably don't comment at all for fear of drawing attention to the correlation.
  - tomComb 4y ago
    > I see it as a good rhetorical move I completely agree: it is a good rhetorical move. aka good spin. But I don't think we should celebrate that sort of thing in tech blog posts, or in any writing actually unless your work in marketing.
- dspillett 4y ago
  > It's "ad blocking". People use those extensions to block ads. I use them, and DNS filters, to block stalking. They just happen to block adverts too because it is practically impossible to separate the two ATM. I'll accept ads based on the page I'm looking at and my rough geographical position, but I don't see why I should put up with being followed and profiled everywhere I go.
  - tomComb 4y ago
    Yes, but you are not the typical user, and that is my point. I wasn't denying that cases could be found that would support the language that Mozilla is using.
dessant 4y ago
Firefox no longer allows extensions to have full control over requests in Manifest V3, despite their repeated public statements. https://bugzilla.mozilla.org/show_bug.cgi?id=1786919 https://bugzilla.mozilla.org/show_bug.cgi?id=1786919 They have merged a change that makes it impossible to access and download certain website content the user is viewing and wants to process. Now that Firefox has introduced this limitation without offering an alternative, it is now much easier to port some of my extensions to Manifest V3 on Chrome, despite Chrome not supporting the blocking webRequest API. It's disheartening to see how these changes are introduced without any planning or care for how it affects extensions that are being ported to Manifest V3, and the general lack of respect towards extension developers.
- tommica 4y ago
  No fucking way - I guess its time to setup pihole again
  - evilpie 4y ago
    This doesn't really affect blocking requests in any way, actually it's the opposite: This change doesn't allow extensions to bypass builtin security features. Firefox is going to continue to have more powerful blocking features compared to what a DNS based approach like pihole can provide.
  - NegativeLatency 4y ago
    FWIW I switched to adguard home and it's been much more reliable for me
- RobotToaster 4y ago
  Once again they ruin the extension API to please their overlord google.
  - tannhaeuser 4y ago
    Sad but true. FF devs and fans will complain, but a look over the Mozilla Foundation's balance sheet/annual report [1], and in particular the share of revenue that royalties received from "search engines" have, is all you need to know. [1]: https://assets.mozilla.net/annualreport/2021/mozilla-fdn-2021-fs-final-1010.pdf https://assets.mozilla.net/annualreport/2021/mozilla-fdn-202...
nfriedly 4y ago
Meanwhile in Firefox for Android: absolutely nothing is going on with extensions, because Mozilla disabled nearly all of them.
- briffle 4y ago
  Which is WAY better than Firefox for IOS.
  - Ygg2 4y ago
    You mean Firefox branded Safari (not a dig at Mozilla).
  - heresaPizza 4y ago
    It is Apple’s fault, but the EU’s DMA will force Apple to allow alternative engines. However this raises many doubts: - Will Apple just allow every browser in the App Store or they’ll manage to use side load (which they’ll also be forced to allow) as the only way to comply? (Probably not legal but i expect them to try, would vastly limit an App’s user base as demonstrated by Android). - In the best scenario, wich is Apple letting Mozilla put the full Firefox in the App Store, would they be interested at all to port Gecko to iOS?
- piyh 4y ago
  You can use Firefox nightly and enable any that you want. I'd rather use the version of Firefox that doesn't crash more frequently, but that's the trade-off I gotta make at the moment.
  - burkaman 4y ago
    How? I use Firefox Nightly but I only see the handful of recommended extensions available.
    - keyme 4y ago
      https://addons.mozilla.org/en-US/firefox/collections/ https://addons.mozilla.org/en-US/firefox/collections/ You can create your own "extension collection", and change the default one used by FF on Android. I use the Fennec build of FF from F-droid (Playstore build doesn't support this).
heresjohnny 4y ago
This article seems in search of an audience. It discusses Manifest V3, names uBlock origin, but ends with “don’t worry, you can take your passwords with you if you switch from Chrome!” I had to chuckle from mentally constructing a character that would fit all of this.
jakear 4y ago
It's upsetting to see all this corporate double-speak when Firefox fails to support the most basic extension functionally: the User Agent should allow the User to run their own code on their own machine without any requirement of phoning home to the manufacturer. This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own code on their own machine persistently to file for a developer code signing certificate, essentially copying Apple's approach to marketplace management. Further, this limitation makes auditing the code of extensions you install from third party sources effectively impossible: I don't see any way to stop automatic updates in settings, so at any point the third party code you've installed and enabled to execute on any website you visit can just change out from under you workout warning. This is all trivial in Edge. It is difficult to understand where the HN vulpephillia comes from.
- 4bpp 4y ago
  > It is difficult to understand where the HN vulpephillia comes from. I imagine it is in part backlash, fueled by political impulse. Mozilla's appointment of Mitchell Baker and subsequent course of Firefox development have taken on unmistakable political valence in the US culture war (especially seeing how its drift could be uncharitably glossed as "coddling non-technical users at the expense of power users"), which resulted in criticism invariably sounding like, and, I guess, even really somewhat functioning* as an attack on the political group that Mozilla is associated with. This, in turn, makes those who support said political group, or simply are exasperated with its most vocal opponents, instinctively oppose the criticism. *I'm thinking of something like the affect-loading concept in https://slatestarcodex.com/2014/11/04/ethnic-tension-and-meaningless-arguments/ https://slatestarcodex.com/2014/11/04/ethnic-tension-and-mea....
- Arnavion 4y ago
  >This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own code on their own machine persistently to file for a developer code signing certificate, essentially copying Apple's approach to marketplace management. My distro's firefox package loads extensions I zip'd and placed in /usr/lib64/firefox/browser/extensions , probably because it's compiled with `--with-unsigned-addon-scopes=app --allow-addon-sideload` FOSS authors are catching on to all the tricks that Windows etc closed source authors have been doing - locking down their software, phoning home with telemetry, bundling in closed-source components with non-free licenses and what not. Distro maintainers are the last line of defence against this shit. Don't use upstream binaries.
karaterobot 4y ago
> The panel shows the user’s installed and enabled extensions and their current permissions. Users are free to grant ongoing access to a website or to make that decision per visit and can remove, report, and manage extensions and their permissions directly from the toolbar. Does anybody know whether this change allows me (the user) to grant an extension permission to a specific, arbitrary domain only? That is, to take an extension which wants permission to read and write every website, and sandbox it to only a particular set of user-defined domains? Have wanted this for a while.
- Vinnl 4y ago
  As I understand it, yes. See also https://blog.mozilla.org/addons/2022/11/17/unified-extensions-button-and-how-to-handle-permissions-in-manifest-v3/ https://blog.mozilla.org/addons/2022/11/17/unified-extension...
tryptophan 4y ago
Time to switch to brave I guess.
Am4TIfIsER0ppos 4y ago
You're bringing back XUL? No? You must be removing the DRM on them instead? Also no? Then what are you doing? Copying google again/still.
ultrasaurus 4y ago
We build a browser extension for people to demo their own SaaS ( https://www.demogorilla.com https://www.demogorilla.com ) and while it's never explicitly blocked us, we definitely feel the friction in development from design choices because browsers are being used both as business tools (GSuite) and viewers of webpages funded by ads. We don't touch anything but the websites a customer already owns, but there are a lot of design choices that really seem to focus on making adblockers (or cookie blockers, JS blockers etc) harder to make (in addition to some very reasonable cross-domain security choices that are annoying but 100% legit).

137 points by Vinnl 4y ago

>ick-inducing ads I guess I'm getting old and grouchy.

Ah so this is why they messed up the overflow menu. Kind of hoping I can actually order the extensions at some point though, it's a bit messy if you can no longer control which extensions are in the overflow menu or what order they're in.

roter 4y ago
extensions.unifiedExtensions.enabled: false
- contravariant 4y ago
  Ah that is what it was, thanks!
PurpleRamen 4y ago
That lack of sorting in the new extension-menu makes question whether the developers are even using their own work. This seems like an obvious problem one would realize early when using it.

Vinnl 4y ago

Some more detail about the control that the new extensions button gives users: https://blog.mozilla.org/addons/2022/11/17/unified-extensions-button-and-how-to-handle-permissions-in-manifest-v3/ https://blog.mozilla.org/addons/2022/11/17/unified-extension... It allows you to disable extensions only on specific sites. (And presumably, that's also the reason you need to dive into about:config to remove it: if you remove it, it's pretty hard for casual users to find out why an extension isn't working. By gating it behind about:config, people who are able to deal with that can still remove it without rendering casual users helpless. That's my personal interpretation though.)

gnicholas 4y ago
Does this allow whitelisting as well as blacklisting? Chrome has offered both for a long time, and I remember being surprised to learn that FF didn't offer either. It's a welcome change!
pentagrama 4y ago
I was checking this new extension button, I think is useful to give more light to extensions, but what I don't like it at all is that it only shows the extensions that are not present on the nav bar, not all your installed extensions. I think is confusing, it should be the list of all your extensions, and the user can pick which extension also appears more handy on the nav bar.
- Yaina 4y ago
  That was in the original spec, but had to be changed because of technical constraints in the toolbar code. Hopefully that can be addressed at some point in the near future :)

tomComb 4y ago

Need we play such language games? It's "ad blocking". People use those extensions to block ads. If you asked the average user about their privacy preserving add-on, or their content blocker they would probably be confused. Yes, obviously I understand the privacy dimensions of advertising, and I realize that this is all in the service of the good guys and against the bad guys, but that shouldn't affect our response to what seems to me to be unnecessary spin.

msla 4y ago
I see it as a good rhetorical move: Say it's ad blocking, and you get people coming in all po-faced about the need for platforms to make money and how horrible it is to have freeloaders blocking honest, legitimate adtech. Frame it as defense of privacy and malware-blocking and those adtech boosters are on the defensive, to the point they probably don't comment at all for fear of drawing attention to the correlation.
- tomComb 4y ago
  > I see it as a good rhetorical move I completely agree: it is a good rhetorical move. aka good spin. But I don't think we should celebrate that sort of thing in tech blog posts, or in any writing actually unless your work in marketing.
dspillett 4y ago
> It's "ad blocking". People use those extensions to block ads. I use them, and DNS filters, to block stalking. They just happen to block adverts too because it is practically impossible to separate the two ATM. I'll accept ads based on the page I'm looking at and my rough geographical position, but I don't see why I should put up with being followed and profiled everywhere I go.
- tomComb 4y ago
  Yes, but you are not the typical user, and that is my point. I wasn't denying that cases could be found that would support the language that Mozilla is using.

dessant 4y ago

Firefox no longer allows extensions to have full control over requests in Manifest V3, despite their repeated public statements. https://bugzilla.mozilla.org/show_bug.cgi?id=1786919 https://bugzilla.mozilla.org/show_bug.cgi?id=1786919 They have merged a change that makes it impossible to access and download certain website content the user is viewing and wants to process. Now that Firefox has introduced this limitation without offering an alternative, it is now much easier to port some of my extensions to Manifest V3 on Chrome, despite Chrome not supporting the blocking webRequest API. It's disheartening to see how these changes are introduced without any planning or care for how it affects extensions that are being ported to Manifest V3, and the general lack of respect towards extension developers.

tommica 4y ago
No fucking way - I guess its time to setup pihole again
- evilpie 4y ago
  This doesn't really affect blocking requests in any way, actually it's the opposite: This change doesn't allow extensions to bypass builtin security features. Firefox is going to continue to have more powerful blocking features compared to what a DNS based approach like pihole can provide.
- NegativeLatency 4y ago
  FWIW I switched to adguard home and it's been much more reliable for me
RobotToaster 4y ago
Once again they ruin the extension API to please their overlord google.
- tannhaeuser 4y ago
  Sad but true. FF devs and fans will complain, but a look over the Mozilla Foundation's balance sheet/annual report [1], and in particular the share of revenue that royalties received from "search engines" have, is all you need to know. [1]: https://assets.mozilla.net/annualreport/2021/mozilla-fdn-2021-fs-final-1010.pdf https://assets.mozilla.net/annualreport/2021/mozilla-fdn-202...

nfriedly 4y ago

Meanwhile in Firefox for Android: absolutely nothing is going on with extensions, because Mozilla disabled nearly all of them.

briffle 4y ago
Which is WAY better than Firefox for IOS.
- Ygg2 4y ago
  You mean Firefox branded Safari (not a dig at Mozilla).
- heresaPizza 4y ago
  It is Apple’s fault, but the EU’s DMA will force Apple to allow alternative engines. However this raises many doubts: - Will Apple just allow every browser in the App Store or they’ll manage to use side load (which they’ll also be forced to allow) as the only way to comply? (Probably not legal but i expect them to try, would vastly limit an App’s user base as demonstrated by Android). - In the best scenario, wich is Apple letting Mozilla put the full Firefox in the App Store, would they be interested at all to port Gecko to iOS?
piyh 4y ago
You can use Firefox nightly and enable any that you want. I'd rather use the version of Firefox that doesn't crash more frequently, but that's the trade-off I gotta make at the moment.
- burkaman 4y ago
  How? I use Firefox Nightly but I only see the handful of recommended extensions available.
  - keyme 4y ago
    https://addons.mozilla.org/en-US/firefox/collections/ https://addons.mozilla.org/en-US/firefox/collections/ You can create your own "extension collection", and change the default one used by FF on Android. I use the Fennec build of FF from F-droid (Playstore build doesn't support this).

heresjohnny 4y ago

This article seems in search of an audience. It discusses Manifest V3, names uBlock origin, but ends with “don’t worry, you can take your passwords with you if you switch from Chrome!” I had to chuckle from mentally constructing a character that would fit all of this.

jakear 4y ago

It's upsetting to see all this corporate double-speak when Firefox fails to support the most basic extension functionally: the User Agent should allow the User to run their own code on their own machine without any requirement of phoning home to the manufacturer. This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own code on their own machine persistently to file for a developer code signing certificate, essentially copying Apple's approach to marketplace management. Further, this limitation makes auditing the code of extensions you install from third party sources effectively impossible: I don't see any way to stop automatic updates in settings, so at any point the third party code you've installed and enabled to execute on any website you visit can just change out from under you workout warning. This is all trivial in Edge. It is difficult to understand where the HN vulpephillia comes from.

4bpp 4y ago
> It is difficult to understand where the HN vulpephillia comes from. I imagine it is in part backlash, fueled by political impulse. Mozilla's appointment of Mitchell Baker and subsequent course of Firefox development have taken on unmistakable political valence in the US culture war (especially seeing how its drift could be uncharitably glossed as "coddling non-technical users at the expense of power users"), which resulted in criticism invariably sounding like, and, I guess, even really somewhat functioning* as an attack on the political group that Mozilla is associated with. This, in turn, makes those who support said political group, or simply are exasperated with its most vocal opponents, instinctively oppose the criticism. *I'm thinking of something like the affect-loading concept in https://slatestarcodex.com/2014/11/04/ethnic-tension-and-meaningless-arguments/ https://slatestarcodex.com/2014/11/04/ethnic-tension-and-mea....
Arnavion 4y ago
>This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own code on their own machine persistently to file for a developer code signing certificate, essentially copying Apple's approach to marketplace management. My distro's firefox package loads extensions I zip'd and placed in /usr/lib64/firefox/browser/extensions , probably because it's compiled with `--with-unsigned-addon-scopes=app --allow-addon-sideload` FOSS authors are catching on to all the tricks that Windows etc closed source authors have been doing - locking down their software, phoning home with telemetry, bundling in closed-source components with non-free licenses and what not. Distro maintainers are the last line of defence against this shit. Don't use upstream binaries.

karaterobot 4y ago

> The panel shows the user’s installed and enabled extensions and their current permissions. Users are free to grant ongoing access to a website or to make that decision per visit and can remove, report, and manage extensions and their permissions directly from the toolbar. Does anybody know whether this change allows me (the user) to grant an extension permission to a specific, arbitrary domain only? That is, to take an extension which wants permission to read and write every website, and sandbox it to only a particular set of user-defined domains? Have wanted this for a while.

Vinnl 4y ago
As I understand it, yes. See also https://blog.mozilla.org/addons/2022/11/17/unified-extensions-button-and-how-to-handle-permissions-in-manifest-v3/ https://blog.mozilla.org/addons/2022/11/17/unified-extension...

tryptophan 4y ago

Time to switch to brave I guess.

Am4TIfIsER0ppos 4y ago

You're bringing back XUL? No? You must be removing the DRM on them instead? Also no? Then what are you doing? Copying google again/still.

ultrasaurus 4y ago

We build a browser extension for people to demo their own SaaS ( https://www.demogorilla.com https://www.demogorilla.com ) and while it's never explicitly blocked us, we definitely feel the friction in development from design choices because browsers are being used both as business tools (GSuite) and viewers of webpages funded by ads. We don't touch anything but the websites a customer already owns, but there are a lot of design choices that really seem to focus on making adblockers (or cookie blockers, JS blockers etc) harder to make (in addition to some very reasonable cross-domain security choices that are annoying but 100% legit).