3 ms·

Isnt Firefox trying to copy EXACTLY what Chrome is doing with extensions?

wodenokoto 3y ago
Yes, except for the parts that stops adblockers.
Svip 3y ago
Firefox is also supporting Manifest V3, like Chrome, but Firefox is not removing support for Manifest V2, unlike Chrome.
- ekianjo 3y ago
  How long is that going to last?
pythux 3y ago
No, there are some meaningful differences in the Manifest v3 implementation in Firefox: https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-firefox-recap-next-steps/ https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-fi... One such difference (and not the least) is: > Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest.
INTPenis 3y ago
Can you elaborate? Firefox had extensions before Chrome existed. Firefox has always been the most versatile and secure way to browse the web. The only reason Chrome is even in the discussion is because Google abused its monopoly to push it on people. And yes a lot of people will say it's faster, all that speed lead you straight into the claws of Google doing whatever they want with you.
- rfoo 3y ago
  > Firefox has always been the most versatile and secure way to browse the web. Currently, a Chrome full-chain is notably harder than a Firefox full-chain, with the former being at "state actor ITW" level, and the latter being at "your friends started a never-heard of consultancy and they decided to do the classical trick - pwning Firefox at Pwn2Own" level.
  - INTPenis 3y ago
    Yeah but if Google keeps removing the ability to block content then Firefox will be more secure simply by filtering dynamic content from unknown domains. Drive by attacks are the most common way to spread malware, this is exactly what extensions like noscript prevent. This isn't the first time Chrome has crippled user ability to filter content on a deep level. So it doesn't matter how much hardening Chrome has if it allows for drive by download attacks from unknown domains.
    - rfoo 3y ago
      Sure, I just hope people move to contribute hardening features to Firefox, and the first step would be singing out loud that Firefox is not the most secure browser right now. Oh, and I suffer from using NoScript (currently on Chrome, unfortunately) every day, I very much want to have a secure enough browser to not giving me decisions like "do you want to whitelist cdn.jsdelivr.com [1] or click four times for each page you read". [1] It distributes arbitrary shit on github, so good luck whitelisting this "known" domain.
  - broodbucket 3y ago
    I don't think these are especially relevant to the threat models of average users. Security for most people means not getting malware from random sites and not having all their data given away, and noone is blowing an 0day sandbox escape on an average internet user. Adblocking extensions go a very long way in terms of keeping average users safe. If you're a potential target of sophisticated actors (of any level of sophistication above script kiddie) then you're not really the target audience of generic browser advice.
    - rfoo 3y ago
      Indeed. Consider my view points biased cause my threat model does contain being popped by North Korean hackers. And I can't use the Internet without a functioning ad blocker so :(
- ekianjo 3y ago
  Firefox has dropped its own extensions to follow Chromes extension model for a long time now
  - nicman23 3y ago
    the issue was more of a security / architecture than just following chrome. xul needed to change and webextensions was already open and tested. that said, i still miss a couple of xul extensions
    - ekianjo 3y ago
      > more of a security / architecture than just following chrome They could have gone for something entirely different but instead they decided to blindly copy Chrome.
gman83 3y ago
They're not making Manifest V3 mandatory. They're implementing it, sure, but that makes sense to ensure compatibility with Chrome extensions.
foepys 3y ago
Google's marketing is sooo good. Instead of giving Mozilla the benefit of the doubt, many people are instead instantly complaining that Firefox is not better and it's worth sticking with Chrome anyways. Chrome has not been supporting proper content blocking for years. E.g. Chrome will not wait for content blockers to initialize before sending out requests, so the first website that opens when you start Chrome is probably not content blocked. https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
- charcircuit 3y ago
  I'm pretty sure this is fixed with the new API for blocking network requests MV3 added. This list of rules is persisted between browser sessions.
abhinavk 3y ago
Firefox is supporting Manifest V3 but with extra APIs which are needed by adblockers like uBlock Origin.

Yes, except for the parts that stops adblockers.

Svip 3y ago

Firefox is also supporting Manifest V3, like Chrome, but Firefox is not removing support for Manifest V2, unlike Chrome.

ekianjo 3y ago
How long is that going to last?

pythux 3y ago

No, there are some meaningful differences in the Manifest v3 implementation in Firefox: https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-firefox-recap-next-steps/ https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-fi... One such difference (and not the least) is: > Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest.

INTPenis 3y ago

Can you elaborate? Firefox had extensions before Chrome existed. Firefox has always been the most versatile and secure way to browse the web. The only reason Chrome is even in the discussion is because Google abused its monopoly to push it on people. And yes a lot of people will say it's faster, all that speed lead you straight into the claws of Google doing whatever they want with you.

rfoo 3y ago
> Firefox has always been the most versatile and secure way to browse the web. Currently, a Chrome full-chain is notably harder than a Firefox full-chain, with the former being at "state actor ITW" level, and the latter being at "your friends started a never-heard of consultancy and they decided to do the classical trick - pwning Firefox at Pwn2Own" level.
- INTPenis 3y ago
  Yeah but if Google keeps removing the ability to block content then Firefox will be more secure simply by filtering dynamic content from unknown domains. Drive by attacks are the most common way to spread malware, this is exactly what extensions like noscript prevent. This isn't the first time Chrome has crippled user ability to filter content on a deep level. So it doesn't matter how much hardening Chrome has if it allows for drive by download attacks from unknown domains.
  - rfoo 3y ago
    Sure, I just hope people move to contribute hardening features to Firefox, and the first step would be singing out loud that Firefox is not the most secure browser right now. Oh, and I suffer from using NoScript (currently on Chrome, unfortunately) every day, I very much want to have a secure enough browser to not giving me decisions like "do you want to whitelist cdn.jsdelivr.com [1] or click four times for each page you read". [1] It distributes arbitrary shit on github, so good luck whitelisting this "known" domain.
- broodbucket 3y ago
  I don't think these are especially relevant to the threat models of average users. Security for most people means not getting malware from random sites and not having all their data given away, and noone is blowing an 0day sandbox escape on an average internet user. Adblocking extensions go a very long way in terms of keeping average users safe. If you're a potential target of sophisticated actors (of any level of sophistication above script kiddie) then you're not really the target audience of generic browser advice.
  - rfoo 3y ago
    Indeed. Consider my view points biased cause my threat model does contain being popped by North Korean hackers. And I can't use the Internet without a functioning ad blocker so :(
ekianjo 3y ago
Firefox has dropped its own extensions to follow Chromes extension model for a long time now
- nicman23 3y ago
  the issue was more of a security / architecture than just following chrome. xul needed to change and webextensions was already open and tested. that said, i still miss a couple of xul extensions
  - ekianjo 3y ago
    > more of a security / architecture than just following chrome They could have gone for something entirely different but instead they decided to blindly copy Chrome.

gman83 3y ago

They're not making Manifest V3 mandatory. They're implementing it, sure, but that makes sense to ensure compatibility with Chrome extensions.

foepys 3y ago

Google's marketing is sooo good. Instead of giving Mozilla the benefit of the doubt, many people are instead instantly complaining that Firefox is not better and it's worth sticking with Chrome anyways. Chrome has not been supporting proper content blocking for years. E.g. Chrome will not wait for content blockers to initialize before sending out requests, so the first website that opens when you start Chrome is probably not content blocked. https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...

charcircuit 3y ago
I'm pretty sure this is fixed with the new API for blocking network requests MV3 added. This list of rules is persisted between browser sessions.

abhinavk 3y ago

Firefox is supporting Manifest V3 but with extra APIs which are needed by adblockers like uBlock Origin.