5 ms·

I worry that desktop Firefox will go the way of the Android version or the neutered Firefox OS browser, where you cannot install the vital security add-on NoScr

by rquirk 13y ago

I worry that desktop Firefox will go the way of the Android version or the neutered Firefox OS browser, where you cannot install the vital security add-on NoScript due to the incompatible add-on model that the mobile versions use. That used to work on Android, but no longer (and it seems the noscript dev is not a fan of the mobile platform). There are many more add-ons that only work on the desktop version. They should all be cross-platform and not desktop specific :(

Ygg2 13y ago
While I agree, Australis only breaks visual add-ons like Vertical Tabs, and the like. Not sure where NoScript comment is coming from?
- rquirk 13y ago
  For now Australis only breaks visual add-ons, but I can see a drive to align, i.e. remove features from, the desktop version so it is more like the mobile versions. The thinking being - Australis is visually more like the Android version of Firefox, why not make its add-on model more like the Android add-on model? i.e. Neutered. The NoScript comment is because that is the "killer app" for Firefox for me, and on mobile Firefox it is not available. There's the amusingly titled "NSA" addition - http://noscript.net/nsa/ http://noscript.net/nsa/ - but as you can see from that page it is pretty much dead. A forum post from November 2013 (1) indicates that the author is aware of the problem, but the diverging code bases I guess make it difficult to maintain. 1: http://forums.informaction.com/viewtopic.php?f=25&t=17687&sid=579082bb6448130609947fa1f466eed5 http://forums.informaction.com/viewtopic.php?f=25&t=17687&si...
  - Pacabel 13y ago
    We have indeed seen a severe dumbing-down of all of the major desktop browsers over the past few years, as mobile devices have become more widely used. So I think that what you're saying is happening, and will continue to happen. Desktop browser users should not have to suffer because mobile users choose to use platforms that are crippled in so many ways. Nor should desktop browser users have to install numerous extensions just to bring modern desktop browsers back to the level of usability we had a few years earlier. Yet with each new release of the major desktop browsers, we find ourselves in the position of reduced functionality, and the need for more and more extensions to restore the now-missing functionality.
    - userbinator 13y ago
      Instead of dumbing-down desktop browsers to match mobile ones, I think there should be more of a push to getting mobile browsers to desktop usability levels. It might take a few more levels of UI indirection since the screens are smaller, but I don't see any fundamental reason why a mobile browser couldn't have all the features of a desktop one.
  - vanderZwan 13y ago
    They are doing a major UI overhaul - the design itself is unstable. So there are valid reasons for current visual add-ons not working - the majority of bugs reported by users would be caused by plugins designed for a different user interface, making it useless as feedback. That would defeat the purpose of having an open beta. Meanwhile the plugins should not yet update because the interface can change any update. So for now it's a chicken/egg problem but I'm sure that once the interface stabilises things will be as they used to. So while it is good to stay on your toes, I don't think you realistically have to worry about this going to be a permanent issue.
  - kevingadd 13y ago
    NoScript is unavailable because current NoScript only works with the classic 'everything in one process' Gecko model & associated plugin model. Firefox for Android isolates content into multiple processes (this is literally a requirement on Android due to their horrible memory management), which means plugins written in that fashion simply can't work. Unfortunately, at present this excludes NoScript. It's possible it could be fixed, though; I'm not sure.
lucian1900 13y ago
The problem is that most existing extensions are based on XUL, which is terrible and impractical for good mobile UIs. There is a more abstract addon API (used by restartless addons) and your favourite ones just need to be updated. Also, NoScript is not a "vital security add-on".
- userbinator 13y ago
  > Also, NoScript is not a "vital security add-on". The vast majority of exploits depend on JS being available, since (at the very least) it'll be used to unobfuscate/execute some attack code. Remember the Tor browser vulnerability that was exploited? That wouldn't have happened without JS. (Coincidentally, I find it amusing that not too long after, that Firefox made it even harder to disable JS, by removing the checkbox for global enable/disable.)
  - lucian1900 13y ago
    That's almost like saying the vast majority of exploits depend on you using a Turing machine. Breaking most websites for the sake of slightly reducing the attack surface doesn't seem worth it.
    - sentenza 13y ago
      You have never been in the Russian-speaking part of the Internet, have you?
    - userbinator 13y ago
      The definition of "most websites" varies between people; the majority of the Internet browsing I do (mostly reading content in the form of text or images) does not require JS. If I come across a site in a search that refuses to show content without JS (and Google's cache, text-only, doesn't give me what I want to see either), I'll just move on to the next search result. It's far better for websites to break, than my machine. The tradeoff will be different for someone who regularly browses a different demographic of sites.
- 13y ago

by rquirk 13y ago

Ygg2 13y ago

While I agree, Australis only breaks visual add-ons like Vertical Tabs, and the like. Not sure where NoScript comment is coming from?

rquirk 13y ago
For now Australis only breaks visual add-ons, but I can see a drive to align, i.e. remove features from, the desktop version so it is more like the mobile versions. The thinking being - Australis is visually more like the Android version of Firefox, why not make its add-on model more like the Android add-on model? i.e. Neutered. The NoScript comment is because that is the "killer app" for Firefox for me, and on mobile Firefox it is not available. There's the amusingly titled "NSA" addition - http://noscript.net/nsa/ http://noscript.net/nsa/ - but as you can see from that page it is pretty much dead. A forum post from November 2013 (1) indicates that the author is aware of the problem, but the diverging code bases I guess make it difficult to maintain. 1: http://forums.informaction.com/viewtopic.php?f=25&t=17687&sid=579082bb6448130609947fa1f466eed5 http://forums.informaction.com/viewtopic.php?f=25&t=17687&si...
- Pacabel 13y ago
  We have indeed seen a severe dumbing-down of all of the major desktop browsers over the past few years, as mobile devices have become more widely used. So I think that what you're saying is happening, and will continue to happen. Desktop browser users should not have to suffer because mobile users choose to use platforms that are crippled in so many ways. Nor should desktop browser users have to install numerous extensions just to bring modern desktop browsers back to the level of usability we had a few years earlier. Yet with each new release of the major desktop browsers, we find ourselves in the position of reduced functionality, and the need for more and more extensions to restore the now-missing functionality.
  - userbinator 13y ago
    Instead of dumbing-down desktop browsers to match mobile ones, I think there should be more of a push to getting mobile browsers to desktop usability levels. It might take a few more levels of UI indirection since the screens are smaller, but I don't see any fundamental reason why a mobile browser couldn't have all the features of a desktop one.
- vanderZwan 13y ago
  They are doing a major UI overhaul - the design itself is unstable. So there are valid reasons for current visual add-ons not working - the majority of bugs reported by users would be caused by plugins designed for a different user interface, making it useless as feedback. That would defeat the purpose of having an open beta. Meanwhile the plugins should not yet update because the interface can change any update. So for now it's a chicken/egg problem but I'm sure that once the interface stabilises things will be as they used to. So while it is good to stay on your toes, I don't think you realistically have to worry about this going to be a permanent issue.
- kevingadd 13y ago
  NoScript is unavailable because current NoScript only works with the classic 'everything in one process' Gecko model & associated plugin model. Firefox for Android isolates content into multiple processes (this is literally a requirement on Android due to their horrible memory management), which means plugins written in that fashion simply can't work. Unfortunately, at present this excludes NoScript. It's possible it could be fixed, though; I'm not sure.

lucian1900 13y ago

The problem is that most existing extensions are based on XUL, which is terrible and impractical for good mobile UIs. There is a more abstract addon API (used by restartless addons) and your favourite ones just need to be updated. Also, NoScript is not a "vital security add-on".

userbinator 13y ago
> Also, NoScript is not a "vital security add-on". The vast majority of exploits depend on JS being available, since (at the very least) it'll be used to unobfuscate/execute some attack code. Remember the Tor browser vulnerability that was exploited? That wouldn't have happened without JS. (Coincidentally, I find it amusing that not too long after, that Firefox made it even harder to disable JS, by removing the checkbox for global enable/disable.)
- lucian1900 13y ago
  That's almost like saying the vast majority of exploits depend on you using a Turing machine. Breaking most websites for the sake of slightly reducing the attack surface doesn't seem worth it.
  - sentenza 13y ago
    You have never been in the Russian-speaking part of the Internet, have you?
  - userbinator 13y ago
    The definition of "most websites" varies between people; the majority of the Internet browsing I do (mostly reading content in the form of text or images) does not require JS. If I come across a site in a search that refuses to show content without JS (and Google's cache, text-only, doesn't give me what I want to see either), I'll just move on to the next search result. It's far better for websites to break, than my machine. The tradeoff will be different for someone who regularly browses a different demographic of sites.
13y ago