Quite a few add-on authors say the direct opposite, that an WebExtensions only future will kill their add-ons and that there is no way mozilla will be able to provide enough APIs to stop that from happening.

Some examples:

- https://github.com/hultmann/multifox

- http://www.chrisfinke.com/2015/08/21/my-future-of-developing...

- http://www.downthemall.net/the-likely-end-of-downthemall/

PS: It goes without saying that Giorgio and NoScript due to their popularity and because Giorgio is very well networked within mozilla get a lot of special treatment an add-on that has only a couple of hundred or thousand users will not. This isn't a bad thing, for NoScript at least, but does not help other add-on developers.

> This isn't a bad thing, for NoScript at least, but does not help other add-on developers.

You should read Giorgio's blog post. The API features NoScript needs also help FlashGot, Ghostery, RequestPolicy Continued, ad blockers, and similar add-ons.

Both multifox and Chris Finke's blog posts are not saying their add-ons aren't possible with the new API, just that they don't want to rewrite them for the new API. Chris Finke is looking for new maintainers for his add-ons. Why don't you become the new maintainer for, say, RSS Ticker (or another of his add-ons) and port it to the new API? See RSS Ticker's page: http://www.chrisfinke.com/addons/rss-ticker/

Yes, try to spin it all you like, it does not change the facts, which are:

* NoScript is getting preferential treatment. That this also has positive outcomes for a handful other (block something) add-ons does not change this or address the situation at large. Add-ons on Firefox are so much more than just fiddling with some web requests.

* Not all add-on authors are happy with WebExtensions or think they will be able to "port" their add-ons, if not for lack of APIs then for time constraints.

* Thousands of add-ons will be broken. While many can be "ported" as you put it (which is usually an entire rewrite), it is far from clear how many will be actually rewritten by the original developers or somebody else, and how many will be just abandoned or cannot be ported at all.

The transition to WebExtensions is absolutely necessary though, from both a security standpoint and developer friendliness standpoint.

The current Firefox extension model is simply too powerful. The API surface (and thus attack surface) is humongous, and extensions can literally change and replace any part of the browser's native UI with little restrictions, leaving the browser open to all sorts of phishing attacks from extensions and making it a nightmare to ensure extensions compatibility because any change whatsoever to the UI can break something. This is a large part of the reason why Firefox extensions still require manual audits while Chrome extensions don't. The status quo is not simply sustainable for Firefox, especially when considering how little resources Mozilla has to spare compared to tech giants like Google.

In addition, XUL is an archaic technology that should eventually be replaced by proper web standards in order to leverage the skills and knowledge of the entire web development community like Chrome has done. Quite a few of my web developer colleagues maintain Chrome extensions in their spare time, and when I ask why they don't offer a Firefox version as well, 9 out of 10 times the answer boils down to not wanting to work with XUL. WebExtensions will alleviate not only the problems with XUL itself, but will also offer great compatibility for building extensions that work across browsers, making the lives of extension developers even better, which will only help make the extension ecosystem even more vibrant than it is today.

The people at Mozilla have been working with extension developers however they can to enable them to port extensions to WebExtensions. If some extension developers simply choose to abandon their extensions instead of working with Mozilla to port them, that's their decision to make, but I feel it's rather unfair to blame Mozilla for this.

I use Firefox as my main browser mostly for the extensions, and needless to say, I'm a huge fan of Firefox's current ecosystem of extensions myself. The potential of losing some of my favorite extensions does suck a lot, so I understand where a lot of the frustration is coming from. However, I'm also extremely optimistic about WebExtensions and the future of the budding cross-browser extension ecosystem, and have no doubt that even if some of my current favorites end up being abandoned, a new wave of great extensions will come to replace them in due time.

Just to clarify, I'm not all all against WebExtensions. You made some good points in particular regarding developer mindshare. Yes, (mostly) cross-browser extensions are the way to go, and it's rather unfortunate that the a lot earlier JetPack/Add-on SDK failed in that regard, among other things. There is no reason for WebExtensions not to exist, and plenty good reasons for them to exist. But that has nothing much to do with the question of whether WebExtensions should be the only supported extension type in Firefox.

I'm not convinced about the other points you make, though. Extensions right now are extremely powerful indeed and there are certainly security considerations to be taken into account. But Chrome extensions have most of the same issues: There have been tons of extensions ex-filtrating sensitive user data or doing other shenanigans in the Chrome Store, mostly because the Chrome review model is "automatic review everything after some piece of software tries to check some basic things and ask questions later". You might get a smaller attack surface with a more limited API, but to make sure users don't install malware you'll still need a human to catch malicious people trying to game the system. Given that mozilla plans additional/extended APIs for a lot of things that might be quite powerful in their own right, manual reviews might be still a necessity after all for lots of extensions.

XUL might be archaic as you call it but XUL is not even the point. If Firefox transitioned away from browser.xul to browser.html today, extensions would break but most of the porting would involve replacing <toolbarbutton /> with <button class="toobarbutton"/> or something like that. Most of the "native" XUL can be replaced by web components without anybody noticing, and in fact parts of XUL is already html underneath even today.

The power of current Firefox extensions comes from XUL having a DOM (just like HTML, just with other element names) combined with access to the low(er) level stuff, mainly the browser.xul javascript scope (just like a browser.html javascript scope) and XPCOM scripting (and a browser.html will still need XPCOM or equivalent access). WebExtensions take away that power in favor of a more well-defined but thusly more constrained and limited API. I think the pro of having virtually unlimited extendability as demonstrated by tons of great and creative extensions outweigh the cons of larger attack surface and higher maintenance costs for both mozilla and add-on developers.

Add-on developers wanting "easy" or a single cross-browser codebase would be still free to use WebExtensions, which would also give mozilla a break, while the more/most powerful add-ons could still hack deeply into the browser.

I don't blame mozilla for developers abandoning their add-ons because they lack the resources, motivation or APIs to do a port (or any combination thereof), however developers abandoning their add-ons is still a reality and should not be disregarded just because mozilla might try their best to keep the fallout somewhat low. mozilla, however, made a decision to break existing add-on en masse, and that decision and the reasons and effects should be allowed to be critically inspected.

> I think the pro of having virtually unlimited extendability as demonstrated by tons of great and creative extensions outweigh the cons of larger attack surface and higher maintenance costs for both mozilla and add-on developers.

It looks like our disagreement boils down to this single tradeoff. Firefox's virtually unlimited extensibility definitely resulted in some amazing extensions that wouldn't have been possible with any less flexible system. However, I don't believe the security and maintenance costs imposed by such a system can be justified in the case of a web browser used by millions of people where security and iteration speed is paramount.

Those looking to experiment without limits can still fork the browser codebase itself to build proof of concepts that way. If the proof of concept is compelling and gains enough traction, it would then become much easier to propose the necessary extensions to the WebExtensions spec and have them accepted and built. There is definitely a lot of friction to this process, but the alternative of maintaining Firefox's status quo with respect to extensions is just not going to be viable, in my opinion.

There is no "spin". You're seeing grand conspiracies where there simply aren't any. If you're not going to contribute to add-on or API development then relax and don't worry about it. The prophecies of doom will go unfulfilled and the world will keep on turning (or spinning if you like).

What are you talking about? Conspiracies?

The spin I was referring to is you trying your hardest in all the threads to make it look like everything is great and peachy in the add-on space, including broadly stamping differing opinions as FUD. While I contend the actual picture is a lot more complicated.

Why don't you? instead.

Because I have no interest in RSS Ticker or any of Chris Finke's add-ons. I don't use them and it doesn't matter to me if they're maintained or not. If it matters to you, then the clear way forward is to get involved.

Does the new API support things like tree style tabs [0]? This is one of the things I've failed to see other browsers implement.

[0] https://addons.mozilla.org/en-US/firefox/addon/tree-style-ta...

If it doesn't yet, it will. Support for add-ons like Tree Style Tabs has been on their radar since development of the new API started:

1. https://billmccloskey.wordpress.com/2015/08/21/firefox-add-o...

2. https://wiki.mozilla.org/WebExtensions#Additional_APIs

3. https://wiki.mozilla.org/WebExtensions/RoadMap

That just means that certain popular addons will get the support necessary to have their needs satisfied.

Some niche ideas won't get support and thus die.

That's the problem with a gated system where you can only do things approved by HQ.

I think this is the bug for implementing a sidebar API:

https://bugzilla.mozilla.org/show_bug.cgi?id=1208596

It doesn't seem to be getting much traction so far -- maybe jump in and encourage?

Chromium has wontfix-ed their sidebar API:

https://bugs.chromium.org/p/chromium/issues/detail?id=344870... https://bugs.chromium.org/p/chromium/issues/detail?id=51084#... https://bugs.chromium.org/p/chromium/issues/detail?id=477424...

I was sad to see that -- Tree Style Tabs is the killer Firefox feature for me. Maybe if Firefox can show the sidebar API works it'll get another hearing with Chrome as well.

The second link in the article goes to the WebExtensions overview page, which mentions "Tree Style Tabs" by name as something that new APIs need to be build for. https://wiki.mozilla.org/WebExtensions

The old XUL (non-restartless/jetpack) extensions are currently about the only way I know to actually hack on the browser's core without having to patch omni.ja and having to set disable_xul_cache, which is quite a terrible way to extend the browser.

If even those are removed or blocked, there won't ever be a way (ok, a way without explicit Mozilla's blessing) to implement custom password stores (think OS X Keychain, KDE KWallet or GNOME Keyring), or a custom sync engine, or tree-style tabs.

And with WebExtensions I can't find (maybe that's me, though!) an equivalent of preferences/service Add-on SDK API.

Regarding needing to implement a custom sync engine, what would you want that isn't provided by https://wiki.mozilla.org/WebExtensions/chrome.storage.sync?

Genuinely curious.

I had always assumed chrome.storage.sync API is all about using sync rather than implementing it. I.e. extension acts as a client, rather than provider. I mean, that API already provides a localStorage-like objects that one can use to put and get data. Technically, one can listen for events and have a custom backend this way, from my understanding, this is extension-local, and not browser-wide interception.

Now I wonder - maybe I got it all wrong? Does it actually allow to completely override built-in Firefox Sync (and either ditch Firefox Accounts requirement for Sync engine to start[1], or override those as well) and replace those parts with a custom implementation?

Say, I don't want any Mozilla nonsense, and want Firefox to sync with a simple WebDAV storage (rather than their proprietary protocol), and do so authenticated with a sane(r) X.509 client cert rather than an ugly mess of BrowserID, HAWK and OAuth2. Is that possible?

____

[1] This part is probably easy through messing with browser's preferences (the ones in about:config), but I'm not sure there's a WebExtensions API for this. Have looked for it and haven't found anything.

What about DownThemAll? Is this just uninformed FUD? http://www.downthemall.net/the-likely-end-of-downthemall/

I'd say it's FUD from 8 months ago. In that blog post they say that NoScript and Tree Style Tabs will no longer be possible with the new API. Meanwhile the author of NoScript says the new API works for him and Mozilla is making sure the new API provides the features that add-ons like Tree Style Tabs need. No need for fear, uncertainty, or doubt.

probably just unintentional fud

what is needed for a DTA-like, is some way to make arbitrary connections with arbitrary headers (which I would be surprised if it isn't provided), some way to write to a file with some reasonable control over how that file is written (writing and seeking, not the most needed thing, but would obviously be preferred), and some way to display UI (a html panel)

This might be harder or easier to implement than DTA is, but there probably won't be a direct port of DTA ever due to how tightly coupled it is with firefox

> What do you believe you'll be missing?

Old extensions have access to js-ctypes. Which means it can do anything libc/any native library does. Spawning processes, filesystem access, interacting talking to native applications (no, connectNative definitely does not count, because it requires opt-in and special support and thus does not provide interoperability)

They can also freely manipulate the browser UI.

Chrome extensions can't do either of those.

Mozilla has some future plans on providing extensibility, but as long as those are just plans without any schedule or implementation i'll remain pessimistic that it'll still result in a reduction of available feature space.

Effectively, what we need, is the ability to modify 100% of the browser chrome as if it was just another website.

If they want to drop XUL, they should first finish browser.html