5 ms·

There was no excuse, they should just bring xul back

michaelmrose 4y ago
https://yoric.github.io/post/why-did-mozilla-remove-xul-addons/ https://yoric.github.io/post/why-did-mozilla-remove-xul-addo... People wanted a faster, more secure, multi-threaded experience. > Note: Having read in comments that some users apparently do not care about security, let me add that being secure is a really, really important point for Mozilla and has been since the first day. Regardless of add-ons, not having security means that an exploit is eventually going to show up that will steal user’s passwords and use them to steal their bank accounts – and that exploit will get sold around and will soon show up everywhere. Firefox developers fight this threat daily by all sorts of means, including code reviews, defensive programming, crash scene investigations, several types of sandboxing, static analysis, memory-safe languages, … Consequently, for Mozilla, if a feature prevents us from achieving great security, we always pick security over features. You should read the link.
- cultureulterior 4y ago
  I did. The security argument is a poor one- tab managers are way more "secure" than the millions of chrome extensions that require total control of all websites you browse to. The multi-threaded and faster experience is just a matter of redesign. If UI people followed Linus's adage of never breaking compability with APIs we'd all be happier
  - michaelmrose 4y ago
    The XUL addon system essentially allowed addons and official components alike to monkey patch any aspect implemented in XUL and indeed each other. The potential for interaction between them is therefore unlimited. When you say that its "just a matter of redesign" you are saying that if only infinite resources could be expended to avoid you never having to change anything at all the world could be a grand place. What you are failing to understand is that the browser is being secured first and foremost not against extension developers but against malicious actors. If the entire way the browser interacts is it self subject to monkey patching its infinitely harder and perhaps impossible to properly secure the single most exposed application vs the outside world. Ideally the functionality once implemented as monkey patching can be provided by a defined interface with the addon system and indeed this is exactly what one sees today with most broadly useful extensions ported. Incidentally if you want to analogize Firefox vs Linux the interface that is not supposed to break is the interaction with the web itself to the degree that this is possible. Linux actually makes external out of tree addons which touch let alone modify the kernel break/update themselves constantly. Linus would never have been stupid enough to commit to something like XUL for the kernel wherein he himself would be responsible for keeping thousands of monkey patching addons working while trying to evolve the kernel.
  - The_Colonel 4y ago
    When basically whole implementation is API (which is the case for XUL), you can't really change anything to never break it. Which is what happened - Firefox stagnated, yet managed to break extensions with every minor release.

https://yoric.github.io/post/why-did-mozilla-remove-xul-addons/ https://yoric.github.io/post/why-did-mozilla-remove-xul-addo... People wanted a faster, more secure, multi-threaded experience. > Note: Having read in comments that some users apparently do not care about security, let me add that being secure is a really, really important point for Mozilla and has been since the first day. Regardless of add-ons, not having security means that an exploit is eventually going to show up that will steal user’s passwords and use them to steal their bank accounts – and that exploit will get sold around and will soon show up everywhere. Firefox developers fight this threat daily by all sorts of means, including code reviews, defensive programming, crash scene investigations, several types of sandboxing, static analysis, memory-safe languages, … Consequently, for Mozilla, if a feature prevents us from achieving great security, we always pick security over features. You should read the link.

cultureulterior 4y ago
I did. The security argument is a poor one- tab managers are way more "secure" than the millions of chrome extensions that require total control of all websites you browse to. The multi-threaded and faster experience is just a matter of redesign. If UI people followed Linus's adage of never breaking compability with APIs we'd all be happier
- michaelmrose 4y ago
  The XUL addon system essentially allowed addons and official components alike to monkey patch any aspect implemented in XUL and indeed each other. The potential for interaction between them is therefore unlimited. When you say that its "just a matter of redesign" you are saying that if only infinite resources could be expended to avoid you never having to change anything at all the world could be a grand place. What you are failing to understand is that the browser is being secured first and foremost not against extension developers but against malicious actors. If the entire way the browser interacts is it self subject to monkey patching its infinitely harder and perhaps impossible to properly secure the single most exposed application vs the outside world. Ideally the functionality once implemented as monkey patching can be provided by a defined interface with the addon system and indeed this is exactly what one sees today with most broadly useful extensions ported. Incidentally if you want to analogize Firefox vs Linux the interface that is not supposed to break is the interaction with the web itself to the degree that this is possible. Linux actually makes external out of tree addons which touch let alone modify the kernel break/update themselves constantly. Linus would never have been stupid enough to commit to something like XUL for the kernel wherein he himself would be responsible for keeping thousands of monkey patching addons working while trying to evolve the kernel.
- The_Colonel 4y ago
  When basically whole implementation is API (which is the case for XUL), you can't really change anything to never break it. Which is what happened - Firefox stagnated, yet managed to break extensions with every minor release.