firefox/mozilla doesn't really make it easy (compared to chrome)

mozilla now requires "add-on signing" [0]; extensions now have to be "signed" (By mozilla) before you can permanently side-load your own private extension onto regular firefox. they also require you to use 2FA [1] when setting up a firefox.com account (which is required in order for you to upload extensions so they can be signed).

at least with chrome you can just enable 'developer mode' and drag and drop your own extensions and use it right away without having to deal with any of that.

[0] https://blog.mozilla.org/addons/2020/03/10/support-for-exten...

[1] https://blog.mozilla.org/addons/2021/03/11/two-factor-authen...

Yep. Firefox is my browser, but their add-on story is garbage.

Huh? To the best of my knowledge, to get a development extension working in FF:

1. Ctrl-shift-a to open add-ons page

2. Click the cog, and select "debug add-ons"

3. Click "load temporary add-on"

4. Select a file in your extension.

5. Done.

This worked for me earlier this week.

Hm. I tried this with an super simple extension[1] I had lying around and couldn't get any network requests to work. The error thrown in console was a generic "NetworkError", but the network tab shows no relevant entries at all. Not a great developer experience, especially compared to chromium.

https://github.com/JacksonKearl/FeelingBlue/blob/main/extens...

Odd! Were you trying to fetch a public, CORS-enabled API? That should just work. If you were trying to make a network request for a non-CORS endpoint (eg fetch the google homepage or something), you'll need to add the domain to your permissions section.

Eg:

"permission": [ "storage", "https://google.com" ]

Not OP, I built an extension for a site that sent CSP headers. Because the browser extension wasn't allowed in the list of JS sources, it all borked.

Not certain that's this user's issue, but that is another thing to check.

I suspect this is it. There were a lot of things logged to console for twitter violating its own CSP, but I didn’t see any for my script.

It seems the overall handling of network errors in add-ons has a lot of room for improvement.

It should be noted that chromium allows the network request regardless of the CSP. This is the correct, User-Empowering approach. Firefox’s deference to the Origin to control the code the User is attempting to run is the antithesis of what a User Agent ought to be.

I have CORS configured to allow the https//twitter.com/ origin. I could see firefox perhaps using a different origin for worker scripts? But hard to tell since the network tab doesn’t show any of the requests.

I could set up server logs locally, but there’s only so many hours in my life.

Key word from the grandparent post: "permanently"

Key word from the parent post: "temporary"

Ah I reckon what you meant was "Oh this approach only temporarily installed the add-on, your parent post was asking about a way to permanently install an add-on." Took me a while to figure out what you meant.

Ah missed that; yep, the add-on will remain installed until the browser is restarted. That is a little annoying!

The signing requirement only applies to the stable and beta versions of Firefox. It can be disabled in about:config in Firefox Developer Edition (which is basically the same as beta), as well as in Nightly, ESR, and Unbranded builds [1].

[1]: https://wiki.mozilla.org/Add-ons/Extension_Signing

this is not true. with Android version at least, an AMO account is also required.

I was referring to desktop, not Android here. To my knowledge, Android currently requires a custom collection on AMO for installing anything outside the default list.

It is great they require 2FA, it increases everyone security in case a developer account is compromised.

I'd prefer to choose how much risk I want to take when installing extensions. Just give me a warning and let me do what I want.

Signed extensions can be loaded into release versions of FF. A compromised dev account can create signed malicious extensions. TFA protects everyone.

yes, thats all true. however people should be able to choose their own level of protection. not have the most secure (and most cumbersome) rammed down their throats.

I can understand why the first example is burdensome and don't have any quarrel with it but I can't help but lack sympathy for the second example. If your barrier as a developer is setting up 2FA I can't help but doubt you ever cared much about supporting Firefox anyway. This is like a taxi driver complaining about needing to have proof of insurance and a driver's license.

I'm just an old-fashioned programmer, I don't think I should have to register with an authority and submit all of my code to them just to be able to run something I've written for myself on my own computer.

I think mail confirmation or yubikey is fine but I never understood why I need an app on my phone for authentication. What if I lose the phone? How would I get my account back? Tried some authenticator app on the desktop once also and got locked out of my account after that because my computer crashed and I had to reinstall it. Never again.

i very much care about supporting firefox users. for example, i maintain a separate, mozilla-signed, manifest v2 version of an extension i made [0] just so firefox users can keep using it. i do so even though this compromises my own ideals about not wanting to use 2FA out of principle.

[0] https://github.com/fanfare/googleimagesrestored/releases

The problem with supporting Firefox is that it doesn't yet support manifest v3. I know this support is coming, but seeing as Chrome right now disallows new extensions that don't use v3 it feels pretty delayed. It's also unclear how to test manifest v3 Firefox extensions before the support is officially out there (though maybe there isn't even beta support yet?)

It is coming on Tuesday with the release of Firefox 109.

Svelte / Sveltekit also works great and is a bit more lightweight / performant while being easier / faster to develop with.

I have an implementation on GitHub for my personal hybrid bookmark-manager / hackernews-reader newtab extension[0]. Its still a wip but i use the website version[1] daily as it doesn’t need to be installed and can still be set as my newtab page (warning as I’ve never opened it on mobile).

[0] https://github.com/fractalhq/nutab [1] https://nutab.vercel.app

Do you have any pointers on effective profiling strategies of extensions on Firefox? I tried to contribute to an open source extension and ran into an issue where the "Performance" tab won't work [1]. I tried using the Firefox Profiler, but that's for the whole browser. It can work, but it gives too much noise. I love Firefox, but this put a huge damper on my willingness to work on browser extensions.

[1] -- https://bugzilla.mozilla.org/show_bug.cgi?id=1766271

FWIW, I also shipped Twemex on Firefox, but the userbase is comparatively tiny—-about 20x more users on Chrome (or Chromium-based browsers using the Chrome store) compared to Firefox.

I’m excited about the ongoing push towards cross-browser standards in this area; Safari has become way more compatible recently as well.

Haha, thanks for that, I am one of your few Firefox users for Twemex. Congrats on the acquisition, how is that going?

Firefox’s signing process is terrible. I’ve made several extensions and I would rather just stick to chrome.

I have made this even easier with Rosegarden, so that you can just use a promisified browser object in both Firefox and Chrome!

The library is tiny, under 5 kb.

https://github.com/peterhil/rosegarden