It is, however, a big liability. In terms of security but also stability and performances. The way extensions work in Firefox is a bit crazy, it's like opening your belly and say "here, change whatever you want". It's the equivalent of a desktop OS where any installed application runs in kernel land where they can slow down everything, crash everything, make the browser unusable...
Not only a bad written extensions can have disastrous consequences, it's impossible for the Firefox team to keep backward compatibility because they have no idea what XUL file the extensions developers are overlaying or what core JS object they've monkey-patched.
...and my god it has been awesome. Certainly more awesome than any instability it may cause.
> It's the equivalent of a desktop OS where any installed application runs in kernel
Most major operating systems give extension capabilities to enhance them in deep ways. My Windows install has ClassicShell as a start menu replacement and DisplayFusion for multi-monitor taskbars. I have explorer plugins for Zip files, Git, and Subversion. Any one of those tools can crash and take down the whole desktop process.
What you're describing isn't a modern power user OS -- you're describing iOS. A safe secure place where nothing interesting happens; only exactly what Apple has already imagined you could want.
> Not only a bad written extensions can have disastrous consequences
My browser crashes? Hardly disasterous! And then I can just uninstall any unstable extensions.
If that crash leads to RCE (which, empirically, many of them do) then that isn't the characterization I would use.
You cannot add them in the new system without having the same security hole as the old system. e.g access to filesystems
You cannot have the power to access filesystems while also remaining secure. It's an all-or-nothing deal.
No, it's not. There are many secure applications that can access the filesystem.
Imagine this. I need read/write access of the host file or an equivalent functionality of mapping any arbitrary domain name to any arbitrary IP address.
There is absolutely no way to keep that secure while allowing it because the functionality itself can be used for the wrong reasons. You either allow said functionality or you don't. There is absolutely no gray area.
That can happen intentionally but more often unintentionally. For example as you need to communicate between JS living in chrome (not the browser) and the webpage, it's easy to open a hole by mistake. Then someone could build a website to inject code to your browser and pretty much take control of your machine.
Yes Mozilla reviews the add-ons, but they are so many of them that they can't take the time to do a bullet-proof review. They only check for a few basic rules.
Security is not an absolute -- it's a trade off.
It is great that you are security aware but what about the masses?
Hardly. Windows, Linux and OS X do not let you monkeypatch the entire system.
And it's not unlikely that Apple will break them at any time. Apple won't even go through the trouble of making an announcement when they do so.
Some discussion of the politics of this issue: http://atp.fm/episodes/128
[1] haven't read enough to know the exact mechanism, but presumably restricting some forms of IPC like Mach messages?
As a user I am unhappy about their decision. For me, the whole point of the existence of Firefox is the freedom to customize the browser in whatever way I want to. They shouldn't change that. If they really think that all their users are stupid then perhaps they could display a special warning when a "dangerous" piece of software (i.e one that uses XUL) is about to be installed.
I've stopped the version madness here, I have some plugins that I love that preclude me from going forward. I'd rather see the team go "Hey we have 2.3 million person years of backlogged bugs, we are going to fix them before we make a fundamental change to the browser.
Security is an issue, but with my work machine I'm not hitting sites that would put me at risk.
How can you possibly know this for certain?
What add-ons do you use on this extremely restricted set of internal-only websites?