5 ms·

The problem is that most existing extensions are based on XUL, which is terrible and impractical for good mobile UIs. There is a more abstract addon API (used

by lucian1900 13y ago

The problem is that most existing extensions are based on XUL, which is terrible and impractical for good mobile UIs. There is a more abstract addon API (used by restartless addons) and your favourite ones just need to be updated. Also, NoScript is not a "vital security add-on".

userbinator 13y ago
> Also, NoScript is not a "vital security add-on". The vast majority of exploits depend on JS being available, since (at the very least) it'll be used to unobfuscate/execute some attack code. Remember the Tor browser vulnerability that was exploited? That wouldn't have happened without JS. (Coincidentally, I find it amusing that not too long after, that Firefox made it even harder to disable JS, by removing the checkbox for global enable/disable.)
- lucian1900 13y ago
  That's almost like saying the vast majority of exploits depend on you using a Turing machine. Breaking most websites for the sake of slightly reducing the attack surface doesn't seem worth it.
  - sentenza 13y ago
    You have never been in the Russian-speaking part of the Internet, have you?
  - userbinator 13y ago
    The definition of "most websites" varies between people; the majority of the Internet browsing I do (mostly reading content in the form of text or images) does not require JS. If I come across a site in a search that refuses to show content without JS (and Google's cache, text-only, doesn't give me what I want to see either), I'll just move on to the next search result. It's far better for websites to break, than my machine. The tradeoff will be different for someone who regularly browses a different demographic of sites.
rquirk 13y ago
Firefox has no XSS mitigation built in unlike Chrome and even Internet Explorer. NoScript provides that for Firefox, even if you allow global scripts for practicality purposes you're getting XSS protection. And I realise that there are design trade offs, but it seems sad that mobile has to drag the desktop into the realm of relative uselessness - not all add-ons can be updated to use the new abstract API (since the API will have gaps that the old API used to support).

userbinator 13y ago

> Also, NoScript is not a "vital security add-on". The vast majority of exploits depend on JS being available, since (at the very least) it'll be used to unobfuscate/execute some attack code. Remember the Tor browser vulnerability that was exploited? That wouldn't have happened without JS. (Coincidentally, I find it amusing that not too long after, that Firefox made it even harder to disable JS, by removing the checkbox for global enable/disable.)

lucian1900 13y ago
That's almost like saying the vast majority of exploits depend on you using a Turing machine. Breaking most websites for the sake of slightly reducing the attack surface doesn't seem worth it.
- sentenza 13y ago
  You have never been in the Russian-speaking part of the Internet, have you?
- userbinator 13y ago
  The definition of "most websites" varies between people; the majority of the Internet browsing I do (mostly reading content in the form of text or images) does not require JS. If I come across a site in a search that refuses to show content without JS (and Google's cache, text-only, doesn't give me what I want to see either), I'll just move on to the next search result. It's far better for websites to break, than my machine. The tradeoff will be different for someone who regularly browses a different demographic of sites.

rquirk 13y ago

Firefox has no XSS mitigation built in unlike Chrome and even Internet Explorer. NoScript provides that for Firefox, even if you allow global scripts for practicality purposes you're getting XSS protection. And I realise that there are design trade offs, but it seems sad that mobile has to drag the desktop into the realm of relative uselessness - not all add-ons can be updated to use the new abstract API (since the API will have gaps that the old API used to support).