News for hackers. Stuff that matters.
Re:Firefox 57 as the first release where only WebExtensions ... by exceptione on Saturday February 18, 2017 @11:20AM (#13675266)
Ouch, the comments over there are extremely negative. As mozilla is our last bastion of hope between advertising giants it pains me to see mozilla having an increasingly hard time to sustain a positive brand image.

It is crazy if you think about it, because Mozilla is the last giant that respects its users. It has a very good proposition with regards to privacy and user-interest alignment.

There are still tons of less-then-smartª people using Chrome. I blame Mozilla for not doing any smart marketing at all.

____

ª Its fair to call it that way. You use a browser more than a car. Yet people do research before buying a car and carefully weigh the downsides versus the upsides. But not for their most important software application in their lifes.

Re:Firefox 57 as the first release where only WebExtensions ... by lucideer on Saturday February 18, 2017 @11:39AM (#13675367)
I agree generally with your points, but this doesn't really address the issues being criticised in comments here. I want to use Firefox (I do currently use Firefox, despite a lot of limitations), but there comes a tipping point where the balance of privacy (and apparent "user-interest") and actual usability and power leads to a not-so-good proposition.

Someone has commented above that it seems like Mozilla management may have been bought off by competitors and may be deliberately trying to run Firefox into the ground. I don't believe this, but given the recent decision-making it's not entirely implausible.

Opera went a similar path ~5 years ago. Most Mozillans don't consider this comparable as Opera was closed-source (and there's this one-track tunnel vision people have around that term), but the similarities are stark. A company with a history of listening to its users and a massive level of contribution to open standards and interoperability, making a product that served a niche userbase extremely well, decided that aping it's mainstream competitor (Chrome) directly would somehow be a good move. Now there's no discernible difference between Opera and Chrome, and no reason whatsoever to choose the former over the latter.

Re:Firefox 57 as the first release where only WebExtensions ... by exceptione on Saturday February 18, 2017 @11:56AM (#13675472)
I can't rule that out either. It might be that it is in Googles best interest to kill firefox.

Here is an alternative view I have in mind. The strategy to mimick chrome makes sense, because the masses think this is how the browser -- or as they call it the "internet" -- should look like. Its imho feasible to launch a television and internet campaign promoting firefox after the transition by stressing the privacy qualities. Mozilla has a quality other venders don't have.

By making it a pain free switch a big market share is possible for firefox.

Still, i doubt the current board has this view really in mind. I am thinking if I should apply for a position :)

Re:Firefox 57 as the first release where only WebExtensions ... by CaptSpify on Saturday February 18, 2017 @12:09PM (#13675550)
> The strategy to mimick chrome makes sense, because the masses think this is how the browser -- or as they call it the "internet" -- should look like.

But that's what FF has been doing for the past ~5 years, and how has their share been doing? Not so well.

Chrome has much more marketing behind it. And it comes from a name that people know and trust. Most people don't know who Mozilla is. And most people don't care about avoiding Google. So if I have two browsers, and the lesser known one is constantly following the other, why would I choose it? I'd rather take the leading browser. It seems as if the FF one is just playing catchup the whole time.

I love Mozilla and FF because it respects me. But it often feels like they are losing that respect just to play follow the leader

Re:Firefox 57 as the first release where only WebExtensions ... by jasonkostempski on Saturday February 18, 2017 @01:00PM (#13675808)
Is it still true you can't do extensions for Chrome on Android? If so, they should just do a commercial showing you can use uBlock Origin with it. That could get a good chunk to move on Android and if they use it there they might switch on desktop too.
Re:Firefox 57 as the first release where only WebExtensions ... by shandor on Saturday February 18, 2017 @02:46PM (#13676342)
Definitely. This is exactly the reason I switched from Chrome ro Firefox. I mean, when I'm on mobile it's even more important than on desktop that I have my adblocker in place, as both bandwidth and screen estate are more limited.
Re:Firefox 57 as the first release where only WebExtensions ... by pjmlp on Saturday February 18, 2017 @03:04PM (#13676414)
Most people, aka normal users, don't care for extensions other than themes, if at all.

So I doubt it would get any new users other than geek folk.

Re:Firefox 57 as the first release where only WebExtensions ... by jasonkostempski on Saturday February 18, 2017 @04:34PM (#13676821)
I'm not talking about showing off extension support, just ad blocking. I hate extensions myself, I wish content blocking with white listing was just built right into the browser which is that last real feature any browser needs. Once people get a few weeks with a good ad blocker they won't ever go back. After that, if they use a browser without it, they'll think they have a virus.
Re:Firefox 57 as the first release where only WebExtensions ... by user5994461 on Saturday February 18, 2017 @08:03PM (#13677610)
> Chrome has much more marketing behind it.

Allow me to be more specific.

Chrome is an adware that is distributed by Google. It is bundled with most of Google products and a huge amount of software setup, because Google pays publishers some pennies for every new installation.

I have seen a lot of people who have had Chrome installed without knowing it, some of which transitioned without being aware of it simply because Chrome replaced the default browser and imported all settings. For the non tech savvy folks, it basically came down to "the Internet icon changed" .

Re:Firefox 57 as the first release where only WebExtensions ... by josteink on Sunday February 19, 2017 @12:22AM (#13678309)
> Chrome is an adware that is distributed by Google. It is bundled with most of Google products and a huge amount of software setup, because Google pays publishers some pennies for every new installation.

On top of that gmail/google users receive email SPAM about installing Chrome each time they log into a new computer.

https://www.reddit.com/r/firefox/comments/5srruc/every_time_...

You never asked for it and can't opt out. They've basically crossed the line where they can't be discerned from regular email spammers. All in the name of killing all non-Google browsers.

Re:Firefox 57 as the first release where only WebExtensions ... by CaptSpify on Saturday February 18, 2017 @11:10PM (#13678150)
> Chrome is an adware that is distributed by Google

I don't really disagree. They push it in a lot of ways that Mozilla isn't shady-enough to do (thank you, Mozilla). But whatever you call it, Chrome's tactics work.

Re:Firefox 57 as the first release where only WebExtensions ... by exceptione on Saturday February 18, 2017 @12:16PM (#13675589)
Everything you said is true. However,

> And most people don't care about avoiding Google.

...if that changes, everything changes. Thats the same thing with Signal and WhatsApp. I am positively surprised how easy it is to convert people to Signal and the momentum they are gaining.

Maybe they are betting on the very long term? Tbh, I would expect a more focused marketing from Mozilla if that would be the case. I am almost as much confused as you are.

Re:Firefox 57 as the first release where only WebExtensions ... by CaptSpify on Saturday February 18, 2017 @12:44PM (#13675713)
> ...if that changes, everything changes.

That's a big "if". How likely is it to change? If history shows anything, not very. Don't get me wrong, I strongly hope they can knock Google off the top spot. But hope doesn't ship units.

Re:Firefox 57 as the first release where only WebExtensions ... by exceptione on Saturday February 18, 2017 @01:15PM (#13675876)
Exactly, that's why they should direct their (still huge) funds to create more awareness.
Re:Firefox 57 as the first release where only WebExtensions ... by Certhas on Saturday February 18, 2017 @06:38PM (#13677299)
Also remember that for years people have crucified Firefox for being technically inferior to Chrome. They claim to just use the better browser. And the technical argument they are making, that having so much of the browser exposed made keeping up so much harder (with multi process just rolling out now), makes a lot of sense.

Looking at the decisions made maybe the problem is that they made the multiprocess jump first. If they had said two years ago: we are going multiprocess and we need to deprecate XUL plug ins to do so, it would have gone over a lot better.

Re:Firefox 57 as the first release where only WebExtensions ... by derf_ on Saturday February 18, 2017 @07:50PM (#13677564)
> Ouch, the comments over there are extremely negative.

Humans are loss-sensitive.

When Coca-Cola did blind taste tests for New Coke, it was overwhelmingly preferred. When they told people which was which, the preference for New Coke increased. Instead, when they removed Coca-Cola Classic from the shelves, people clamored for it back. People want the thing they cannot have. Scarcity creates desire.

To some, this is a simple engineering trade-off. You can't have sandboxing, tab isolation, and responsiveness improvements with XUL add-ons in any kind of feasible or sustainable way. You can estimate how many people use add-ons that can't (or won't) be ported to Web Extensions, how many people would benefit from the proposed improvements, what the relative changes in user adoption are likely to be for each, and make a call that gives the best result for the whole Firefox population.

But that won't stop the people who are feeling the loss from being vocal about it, nor others who don't even use those add-ons attaching value to the thing they can no longer have, and resent that it's being taken away.

To reverse course now would fail the other way: if you tell people you're going to hold off on full e10s deployment and the security and responsiveness improvements that will come with it to allow XUL add-ons to remain a while longer, they'll be upset that you've taken away the improvements you promised.

Both times the conversation will only be about one side of the equation. No amount of marketing will fix that. Just ask Coca-Cola.

Re:Firefox 57 as the first release where only WebExtensions ... by alphapapa on Monday February 20, 2017 @03:51PM (#13690787)
> To some, this is a simple engineering trade-off. You can't have sandboxing, tab isolation, and responsiveness improvements with XUL add-ons in any kind of feasible or sustainable way.

Certainly you can: it's software--anything is possible.

The issue is that they don't want to make the effort. I think this is because the developers are no longer the people who built Firefox, and they want to reinvent Firefox and put their own stamp on it--IOW, it's NIH.

I think it's also a matter of the higher-up execs and board members having non-technical goals. It's similar to when a successful, focused company is bought by a larger one, and its popular product is canceled, its development team reassigned to other tasks in the new company. The users are left hanging, their software/product/service being yanked out from under them. At least Firefox is FOSS, so it can be continued, but of course that takes a lot of manpower nowadays. Hopefully Pale Moon will sustain the vision of the original Phoenix.

Re:Firefox 57 as the first release where only WebExtensions ... by bzbarsky on Tuesday February 21, 2017 @03:09AM (#13694124)
> Certainly you can: it's software--anything is possible.

As the IRC channel topic on #jsapi on irc.mozilla.org says, "Nothing is hard to implement in isolation."

No, not everything is possible given finite resources. Some things are possible only if you sacrifice others. That might be actual things you need to remove, or the opportunity cost of adding more complexity to satisfy contradictory constraints and hence not improving something else.

As a concrete example here, if you have an extension model that relies on synchronous access to the page DOM _and_ the UI at the same time, and now you want to put those two things in different processes, you have a few options:

1) You can throw out the extension model. 2) You can write some complicated synchronous IPC proxies.

Make no mistake, option 2 _does_ mean trading off responsiveness: if the web renderer process you are trying to poke at is busy, then you will end up having to wait, and if you wait in a sync proxy that's a pause in the UI process. And that's what you're trying to avoid in the first place.

Note that people did in fact create the sync proxies, as a temporary measure, while working on providing better APIs to be used instead, to make the transition easier for extension authors. There are conflicting opinions on whether this is the right time to get rid of the sync proxy bits, but it does in fact need to happen at some point.

As for your opinion that "the developers are no longer the people who built Firefox", here's another data point. My first commit to Gecko (this is before there was a Firefox) was sometime in June 2001. I'm not trying to reinvent anything for the sake of reinvention. But I do think there are fundamental problems with both supporting the existing XUL addon ecosystem and making a number of long-delayed architectural changes that we don't feel like we can delay any longer. Again, we can argue about whether this is the right time for those changes. But I think it is. As a simple example, needing to support the existing XUL addon ecosystem would make the Stylo project (using the Servo style system in Gecko) harder. So if we're trying to get Stylo done by sometime this year (which we are), that gives you an end-of-life of ... well, right about the Firefox 57 release.

Re:Firefox 57 as the first release where only WebExtensions ... by MiddleEndian on Saturday February 18, 2017 @11:46AM (#13675419)
A car analogy is perfect here.

Google Chrome is kind of like a sedan, something convenient for most people.

Firefox is kind of like a pickup truck, less convenient for a lot of people but more powerful and useful for the people who need them.

This move is kind of like a pickup truck manufacturer realizing that sedans are more common than pickup trucks, then thinking sedans don't have beds in the back, and removing the bed from their pickup truck. Then afterwards, they're confused why people don't like this change.

Re:Firefox 57 as the first release where only WebExtensions ... by msbarnett on Saturday February 18, 2017 @03:18PM (#13676471)
A more accurate metaphor would involve the sedan have modern safety features the lack of which make the truck increasingly risky to drive but which the truck is unable to adopt without shedding technical limitations imposed by the bed.
Re:Firefox 57 as the first release where only WebExtensions ... by MiddleEndian on Saturday February 18, 2017 @03:55PM (#13676625)
Except in this case it's like removing the bed so I can't hypothetically transport large quantities of nitroglycerin (addons with tracking) but they're preventing me from transporting anything of interest (tab mix plus).

I'll just use the Firefox LTS until it stops working with the modern web. By then hopefully the issue will be solved (perhaps by me, as I'm a dev).

Re:Firefox 57 as the first release where only WebExtensions ... by msbarnett on Saturday February 18, 2017 @04:12PM (#13676713)
> Except in this case it's like removing the bed so I can't hypothetically transport large quantities of nitroglycerin (addons with tracking)

No? That's not what's motivating this at all.

The problem is the XUL/XPCOM API are fundamentally incomposable with completely sandboxed per-tab processes a la Chromium and other isolating security changes, because of assumptions they impose on Firefox internals.

If you turn on multiple processes in Firefox there's a bunch of complicated shims that half-keep some extensions working some of the time, but it's an uphill battle to support an API that never conceived of the idea. It needs to be shitcanned to move forward.

Re:Firefox 57 as the first release where only WebExtensions ... by barrkel on Saturday February 18, 2017 @04:30PM (#13676796)
Sufficient extension points with APIs to reimplement the interesting addons should have been made available and working years before dropping compatibility. From the conversations happening around the most popular addons, that has not been the case.

It may be that the old APIs need to die; but this way isn't the way to kill the old API. You need as near to complete overlapping for a long time to get people to port over. You don't do cliff edges. That's how you kill your userbase.

Re:Firefox 57 as the first release where only WebExtensions ... by GraemeLion on Saturday February 18, 2017 @05:12PM (#13676993)
But this is not a secret. This has been discussed repeatedly for at least 5 years now. The current XUL methodology CANNOT sustain, and everyone knew this.

But everyone also knew Mozilla was famous for putting off being confrontational, so nobody actually thought this was going to happen, so nobody really communicated with mozilla on what would be needed to avoid this happening. Now Mozilla has finally set a date (which maybe they won't push back YET AGAIN), and people who've not been doing work on their extensions in preparation for this, or who did not talk to Mozilla about what they need when Mozilla repeatedly asked for that information, are suddenly afraid that they're going to be left in the cold.

Mozilla does almost absolutely everything on public lists. This is all completely readable. The common thought was "they're not really ever going to do this, so we don't really need to present them with what we need, because we know they won't do this." So what else can Mozilla do? Nobody actually believed they were going to really set a cut off date. Everyone thought it'd just be pushed back over and over like it always has been.

Re:Firefox 57 as the first release where only WebExtensions ... by pseudalopex on Saturday February 18, 2017 @10:02PM (#13677980)
The problems with XUL have been discussed for over 5 years, but there hasn't been a solution. WebExtensions was announced 18 months ago, was deemed stable for developers 8 months later, and only just got a reasonable migration path with embedded WebExtensions in Firefox 51.

There's been plenty of communication from developers on Bugzilla. People are alarmed because Mozilla's original estimate fell way short, the deprecation roadmap is a lot more specific than the implementation roadmap[1], and migration is going to suck for extensions that need APIs missing from Firefox 52.

[1] https://trello.com/b/PC9kB14s/webextensions-roadmap

Re:Firefox 57 as the first release where only WebExtensions ... by alphapapa on Monday February 20, 2017 @04:00PM (#13690848)
I don't think this is accurate. The handwriting has been on the wall for years, and I've had no doubt that Mozilla would actually rip out XUL and leave millions of loyal users hanging. Mozilla has been on an anti-existing-user trajectory for years now.

We have loudly protested. We have explained in excruciating detail how Firefox without XUL is not Firefox, and how a non-XUL Firefox will not meet our needs.

The correct response from Mozilla would have been to make XUL work with e10s, regardless of whether it's easy or fun to do so. The actual response from Mozilla has been, "Nah, that would be too hard. Besides, you don't really want XUL, because it lets in the malware bogeyman. We'll just rip it out. Don't worry, you'll thank us later."

This is heard as, "We don't care about you. We don't want your kind of users. We want those users, the ones who have switched to Chrome. You can sit on an old, outdated version until it won't load web sites anymore, and you can be constrained to the dustbin of history, where you belong."

I've no doubt there are Mozillians who do not feel that way (e.g. the Pentadactyl developers who work at Mozilla and quietly update it to work with newer versions), but that is how the message from Mozilla comes across. Most importantly, that is the net effect of Mozilla's policy.

Re:Firefox 57 as the first release where only WebExtensions ... by kuschku on Saturday February 18, 2017 @05:46PM (#13677121)
> The current XUL methodology CANNOT sustain, and everyone knew this.

Yet we still don't have a replacement for even a tenth of what it could do today!

Once Firefox 57 is released, I'll lose the ability to use Firefox at all, and won't be able to regain it for several years. Just because no one though to consider what APIs one might have to provide before deprecating the old ones.

Re:Firefox 57 as the first release where only WebExtensions ... by GraemeLion on Saturday February 18, 2017 @05:53PM (#13677149)
Partially because when Mozilla initially said "XUL is going away, what do you guys need?" Everyone just laughed at them and said "No, it's not, you'll never replace it because it is too important in extensions", and then all went away.

Where are the specs for what replaces it supposed to come from? And when they asked for those specs and got little answers, what were they supposed to do? Run around screaming "No we're serious this time, we really are going to drop this, and we really need you guys to work on getting requirements voiced? And also it'd be great if you took us seriously about e10s too!"

One of my favorite extensions is vimperator. There are comments going back over a YEAR that there would be problems with e10s and XUL, and they were always just pushed off and ignored because it wasn't a current situation. I've got two or three other extensions whose github issues section mirrors the same situation. Some of them thought Mozilla would put in a "allow me to run dangerous addons" button and leave the code in play, but if add on developers can do that, then malicious add on developers can too.

Re:Firefox 57 as the first release where only WebExtensions ... by alphapapa on Monday February 20, 2017 @04:05PM (#13690879)
This call for, "Just tell us what APIs you need!" is missing the point.

1. There's no guarantee that Mozilla will actually implement such APIs, and no guarantee that they will actually support them in the future. If past behavior indicates future behavior, they will support them for 12-18 months and then say, "It's not worth the effort anymore. But here's a new bundled Facebook plugin that we're totally not being paid to put in. Have fun!"

2. More importantly, many of these extensions would never have come to exist if their authors had had to beg Mozilla to implement an API first. If XUL had never existed, would ad-blocking extensions have ever been created? I can imagine the Bugzilla pages now: "This is not a priority for our limited manpower. Restricting this issue due to advocacy. You can discuss it further on the mailing list."

Firefox - XUL != Firefox

Re:Firefox 57 as the first release where only WebExtensions ... by kuschku on Saturday February 18, 2017 @06:52PM (#13677346)
For me, I have requested the same since the beginning — just allow me to modify the UI with a markup language.

Or I'll fork, merge all upstream patches down, and work with that.

Currently I have to rely on the AutoHiDPI addon because firefox is otherwise unusable on my system (linux with two screens with very different DPIs).

I also asked for a way to get tab thumbnails done, and to replace the entire bookmark and omnibar system.

But no. Now I'll have to fork Firefox to get a usable browser.

Re:Firefox 57 as the first release where only WebExtensions ... by GraemeLion on Saturday February 18, 2017 @09:17PM (#13677851)
Did you request this with your plugin/addon developers, or with mozilla yourself through their many methods of contact for this if you are a plugin/addon developer?

I don't get why addon/plugin developers not communicating upstream is the problem of upstream.

Re:Firefox 57 as the first release where only WebExtensions ... by kuschku on Sunday February 19, 2017 @05:26AM (#13679060)
I communicated it through the bugtracker comments and the comments on the Mozilla blog.

On every announcement regarding this for the past months.

I’ve not gotten any answer, nor has any solution been implemented or suggested.

Re:Firefox 57 as the first release where only WebExtensions ... by alphapapa on Monday February 20, 2017 @04:06PM (#13690891)
It's troubling that your comment has been downvoted.
Re:Firefox 57 as the first release where only WebExtensions ... by Kubuxu on Saturday February 18, 2017 @06:58PM (#13677369)
Yup, this is one of the developers that took it serious [0]. You can see, he started preparing in August of 2015. If other developers did that, this info wouldn't be a problem.

[0]: https://github.com/lidel/ipfs-firefox-addon/issues/20

Re:Firefox 57 as the first release where only WebExtensions ... by trome on Sunday February 19, 2017 @04:59AM (#13678988)
IPFS is a one off though, it has multiple paid developers who can spend their full time rewriting their addons at the drop of a hat. Plus that IPFS addon didn't require deep access to Firefox's internals, which many popular addons do.
Re:Firefox 57 as the first release where only WebExtensions ... by Kubuxu on Sunday February 19, 2017 @06:46AM (#13679254)
This addon is not worked on by paid developers.

> didn't require deep access to Firefox's internals

Quite contrary, it needs to handle new URI schema, override URL origin policy, scan pages, do DNS queries and so on.

Re:Firefox 57 as the first release where only WebExtensions ... by CaptSpify on Saturday February 18, 2017 @04:08PM (#13676689)
> unable to adopt

I'd argue that they are able to adopt a better security model, they are choosing not to.

Re:Firefox 57 as the first release where only WebExtensions ... by SilasX on Saturday February 18, 2017 @04:29PM (#13676794)
Yes, Firefox is supposed be more like a hobbyist's car, optimized for tinkering and non-mainstream features.

Except that one day they're suddenly disallowing core features that such hobbyists care about. Suddenly, they don't allow manual transmissions "for security reasons" (you try to plug one in and the internal computer shuts down and refuses to boot, even though you set the computer to expect a manual).

And they've worked with transportation agencies to ensure that their cars get pulled over when they're using a manual.

I was so upset that I wrote a hitler parody when FF stopped supporting unsigned addons even when the user finds the settings and authorizes it.

https://youtube.com/watch?v=taGARf8K5J8

"Why not just shrink wrap the browser and make me buy it from Microsoft at Walmart!"

Re:Firefox 57 as the first release where only WebExtensions ... by lossolo on Saturday February 18, 2017 @02:02PM (#13676107)
Your comment is insulting, people are not "less than smart" because have different priorities or different view than you. I am using mostly Chrome because I had a lot of performance/memory usage issues with Firefox and because of security. You forget how someone got access to internal not disclosed list of vulnerabilities in Firefox?

Compare amount of code execution CVEs[0][1]

Chrome = 80

Firefox = 700!

And I don't call Firefox users stupid.

[0]http://www.cvedetails.com/product/15031/Google-Chrome.html?v...

[1]http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?...

Re:Firefox 57 as the first release where only WebExtensions ... by VodkaHaze on Saturday February 18, 2017 @03:34PM (#13676543)
Now, now, I doubt FF has 700! ~= 10^174 CVEs
Re:Firefox 57 as the first release where only WebExtensions ... by hasenj on Saturday February 18, 2017 @11:21AM (#13675276)
Implying people who use Chrome are stupid is .. not a very nice thing to say.
Re:Firefox 57 as the first release where only WebExtensions ... by exceptione on Saturday February 18, 2017 @11:24AM (#13675292)
You are right. I did and do not say every chrome user is stupid, there might be legitimate use-cases. But the vast amount of people just install chrome or get it side-loaded with some freeware and don't even think about their options and the impact of their choice. Now that is less than smart.
Re:Firefox 57 as the first release where only WebExtensions ... by greggman on Saturday February 18, 2017 @11:39AM (#13675371)
Go look at the CVE reports for each browser. Your taking a > 10x risk running anything other than Chrome. These changes Mozilla is making are to fix that.
Re:Firefox 57 as the first release where only WebExtensions ... by michaelmrose on Saturday February 18, 2017 @02:46PM (#13676343)
Making up numbers doesn't help the discussion. Can you prove that firefox users are at all more likely to be infected in practice? I doubt it. You surely can't prove they are 10x.
Re:Firefox 57 as the first release where only WebExtensions ... by fulafel on Monday February 20, 2017 @01:02AM (#13684715)
Chrome comes with Flash, and Flash vulnerabilities are not counted against Chrome. So this is highly skewed. (Never mind CVE counts being a poor proxy of risk)
Re:Firefox 57 as the first release where only WebExtensions ... by icebraining on Saturday February 18, 2017 @11:46AM (#13675420)
If I want to reduce computing security risks I'll use a calculator. Everything else comes with tradeoffs, and for many of us, these aren't worth it.
Re:Firefox 57 as the first release where only WebExtensions ... by aseipp on Saturday February 18, 2017 @02:03PM (#13676110)
The answer to "This piece of software has a track record of being more secure than this one, due to its design, and these changes in part help fix that disparity" IS NOT "I'm going to use a calculator now because nothing can be secure so what's the point anyway stop trying to force me to eat my dinner vegetables i'm not listening".

I don't even know why this needs to be said, because it's fairly obvious nobody on Earth actually does risk analysis this way. I mean, unless you're a programmer with some sort of brain worm infestation, who cannot read between the lines, and have an inability to understand how people in the real world do (and must) operate, clearly.

Re:Firefox 57 as the first release where only WebExtensions ... by icebraining on Saturday February 18, 2017 @04:28PM (#13676788)
From your other posts you seem like a reasonable person, so I'll try to explain myself better despite the verbal abuse.

I realize that some software is more secure than others, and that changes can be made to make it more secure. My point is that you can't simply say "therefore these changes are necessarily good", because there is more to software than security, and those changes often involve tradeoffs in other areas, which have to be weighted. For some of us, in this case, those tradeoffs aren't worth it.

Re:Firefox 57 as the first release where only WebExtensions ... by pvg on Saturday February 18, 2017 @11:38AM (#13675360)
It's the most secure browser available. That's a not a 'might be legitimate' use case.
Re:Firefox 57 as the first release where only WebExtensions ... by smnscu on Saturday February 18, 2017 @11:41AM (#13675388)
Citation needed. I found this [0] but maybe you have a better source. This was interesting though:

> In the most recent Pwn2Own hacking competition, Chrome came out ahead of every other browser with only one exploit being successfully executed.

0: https://tiptopsecurity.com/what-is-the-most-secure-web-brows...

Re:Firefox 57 as the first release where only WebExtensions ... by McCirculaire on Saturday February 18, 2017 @02:41PM (#13676306)
http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?.... http://www.cvedetails.com/product/15031/Google-Chrome.html?v....

Just compare the amount of code execution CVEs found on a yearly basis and the level of severity of each. Then think of how Firefox has much less marketshare than Chrome (FF sits around 8% and its share keeps going down year by year), so Chrome should be a more interesting target for hacking.

Then come back and tell us which browser has the lesser amount, and when some are found, which is most likely to have the more severely exploitable vuln.

Re:Firefox 57 as the first release where only WebExtensions ... by hackuser on Saturday February 18, 2017 @02:10PM (#13676141)
FWIW, though I'm an avid supporter of Firefox and use it, my very consistent observation is that security experts believe,

* Chrome/Chromium is more secure against attacks by governments or criminals (i.e., attacks against the integrity of the system; I can't think of the right word).

* Firefox may be more secure against advertising and corporate confidentiality attacks.

* Firefox with certain add-ons, too technical for most users, may be as secure as Chrome/Chromium.

Re:Firefox 57 as the first release where only WebExtensions ... by pvg on Saturday February 18, 2017 @02:56PM (#13676380)
The fundamental difference is that Google is a gigantic engineering organization that dedicates enormous resources to security, benefiting Chrome directly and indirectly. Over the years, lots of work has been done to ensure and improve its security at a design and architectural level.

Firefox, as this announcement shows, is just getting around to freeing itself from design decisions which may have made sense over a decade ago when Mozilla had 'software suite' ambitions but we now know are a liability for something with the security demands of a browser.

Re:Firefox 57 as the first release where only WebExtensions ... by johnsmith21006 on Saturday February 18, 2017 @03:18PM (#13676470)
Plus Google has much broader view and data to secure Chrome well beyond FF is going to be able to accomplish. Plus Google has far more to loose.
Re:Firefox 57 as the first release where only WebExtensions ... by hackuser on Saturday February 18, 2017 @04:30PM (#13676797)
> design decisions which may have made sense over a decade ago when Mozilla had 'software suite' ambitions

It doesn't change your overall point, but I think this part is incorrect. AFAIK abandoning those ambitions was the reason they left Seamonkey behind and developed Firefox.

Re:Firefox 57 as the first release where only WebExtensions ... by pvg on Saturday February 18, 2017 @05:00PM (#13676939)
Firefox started well before Seamonkey was spun out, and they continued with Thunderbird anyway. But the details of the history of the ambitions don't matter, what matters is that these architectural decisions were made a long, long time ago but their consequences are still there. You can decide you're not going make an app suite, that doesn't magically re-architect the internals of the product you have. Take a look at this announcement from Netscape, in 2000 (AD):

https://gilbane.com/2000/03/netscape-announces-gecko-adoptee...

Support for XUL addons is being dropped now. That's a long echo.

Re:Firefox 57 as the first release where only WebExtensions ... by hackuser on Sunday February 19, 2017 @03:06AM (#13678667)
> You can decide you're not going make an app suite, that doesn't magically re-architect the internals of the product you have.

I'm not sure how that applies. Firefox wasn't magic; Mozilla rewrote their browser intentionally and put a lot of resources into it.

> Firefox started well before Seamonkey was spun out

My understanding of that statement is that they didn't drop the old product until the new one was succeeding in the marketplace. I'm not sure how that impacts what I said.

Re:Firefox 57 as the first release where only WebExtensions ... by pvg on Sunday February 19, 2017 @06:04AM (#13679154)
Firefox wasn't magic; Mozilla rewrote their browser intentionally and put a lot of resources into it.

No no, they didn't. Firefox and Mozilla (and even later versions of Netscape) share the same architectural underpinnings. That's sort of the intent and cleverness of it, it's really an entire system for writing cross-platform apps, with its own 'language independent' component model, gui layer, etc. The things that made Firefox possible also made all-powerful Firefox extensions possible. Much of that architecture is still around. In the intervening years, it's become obvious this is not necessarily a good way to build a browser. Which is why they are dropping XUL/XPCOM extensions. If they'd 'rewritten' it, they wouldn't need to do that.

My understanding of that statement is that they didn't drop the old product until the new one was succeeding in the marketplace.

I'm talking about common architecture, not products. If you're unfamiliar with it, just scroll through this

https://en.wikipedia.org/wiki/XPCOM

If you are familiar with it, I guess I don't understand what your objection is.

Re:Firefox 57 as the first release where only WebExtensions ... by josteink on Sunday February 19, 2017 @12:41AM (#13678355)
> It's the most secure browser available. That's a not a 'might be legitimate' use case.

It may be Jesus on a popsicle, but I'm not going to trust something distributed via drive-by-installers, marketed through SPAM and made by the world's biggest data-hoarder and privacy-invader no matter what.

It's adware/malware short and simple.

Make it 100% FOSS. Remove any technical connection to Google. Don't require Google-logon to sync. Only distribute it to users who actually asked to have it installed. Etc etc.

At that point I might consider starting trusting it. Not before.

Re:Firefox 57 as the first release where only WebExtensions ... by pvg on Sunday February 19, 2017 @02:57AM (#13678650)
So, like https://www.chromium.org/Home

Personally, I'd at definitely consider using Jesus on a popsicle, if the opportunity arose, just to see what it's like. Not that it has so far, sadly.

Re:Firefox 57 as the first release where only WebExtensions ... by josteink on Sunday February 19, 2017 @04:27AM (#13678890)
Chromium still requires you to log into a google account and share your private data with google to sync.

Definitely not an option.

Re:Firefox 57 as the first release where only WebExtensions ... by pvg on Sunday February 19, 2017 @06:06AM (#13679159)
To sync what? I use Chrome and never log into a non-web google account. In fact, I'm able to browse the web without 'syncing' anything.
Re:Firefox 57 as the first release where only WebExtensions ... by josteink on Sunday February 19, 2017 @07:40AM (#13679414)
Bookmarks, history, passwords etc.

I don't want to give those to google. Is that unreasonable?

Re:Firefox 57 as the first release where only WebExtensions ... by pvg on Sunday February 19, 2017 @11:46AM (#13680522)
No, not at all but by the vehemence of your reply, you make it sound like Chrome or Chromium force you to give these things to google. And I don't think they do.
Re:Firefox 57 as the first release where only WebExtensions ... by mtgx on Saturday February 18, 2017 @05:05PM (#13676970)
It's innovator's dilemma. The same thing that made Mozilla popular ("advanced" add-ons) is what kept it from moving to the "dumb" Chrome extension model that Google's browser adopted a long time ago. The older add-on model is what kept it from having better security and having less memory problems for so long.
Re:Firefox 57 as the first release where only WebExtensions ... by mlhaufe on Saturday February 18, 2017 @08:49PM (#13677778)
Don't forget about Brave: https://brave.com/
Re:Firefox 57 as the first release where only WebExtensions ... by ReverseCold on Sunday February 19, 2017 @01:12AM (#13678409)
I last used Firefox in December 2017, and there was something else weird that made me stop using it.

I'm waiting for Mozilla servo to be released as a standalone browser that doesn't use more memory than chrome, and doesn't have trash font support. Right now it's worse than chrome for battery life and RAM usage on Windows.

Re:Firefox 57 as the first release where only WebExtensions ... by antisthenes on Monday February 20, 2017 @01:50PM (#13689825)
I would be more concerned that you have figured out how to travel forward in time.
Re:Firefox 57 as the first release where only WebExtensions ... by maxerickson on Monday February 20, 2017 @01:51PM (#13689831)
It's moving backwards that is the hard part.
Re:Firefox 57 as the first release where only WebExtensions ... by ReverseCold on Tuesday February 21, 2017 @10:30AM (#13696179)
Oops
Re:Firefox 57 as the first release where only WebExtensions ... by tw04 on Saturday February 18, 2017 @06:23PM (#13677250)
There are still tons of technical people (myself included) who use Chrome because Firefox became bad. The only reason I even have Firefox installed at this point is for extensions like DownThemAll - which will disappear after this move.

The years of firefox memory leaks completely turned me off the product.

Re:Firefox 57 as the first release where only WebExtensions ... by angry-hacker on Saturday February 18, 2017 @12:43PM (#13675703)
Politics killed the company. They have lost the plot, the leadership is more interested in ideology than technology.