Hacker News Reader

Comment by eloisant | Hacker News Reader

The truth is Firefox already lost most of its market share to Chrome, so "powerful add-on" doesn't seem to be a strong enough selling point to retain users.

It is, however, a big liability. In terms of security but also stability and performances. The way extensions work in Firefox is a bit crazy, it's like opening your belly and say "here, change whatever you want". It's the equivalent of a desktop OS where any installed application runs in kernel land where they can slow down everything, crash everything, make the browser unusable...

Not only a bad written extensions can have disastrous consequences, it's impossible for the Firefox team to keep backward compatibility because they have no idea what XUL file the extensions developers are overlaying or what core JS object they've monkey-patched.

View on HN

> The way extensions work in Firefox is a bit crazy, it's like opening your belly and say "here, change whatever you want".

...and my god it has been awesome. Certainly more awesome than any instability it may cause.

> It's the equivalent of a desktop OS where any installed application runs in kernel

Most major operating systems give extension capabilities to enhance them in deep ways. My Windows install has ClassicShell as a start menu replacement and DisplayFusion for multi-monitor taskbars. I have explorer plugins for Zip files, Git, and Subversion. Any one of those tools can crash and take down the whole desktop process.

What you're describing isn't a modern power user OS -- you're describing iOS. A safe secure place where nothing interesting happens; only exactly what Apple has already imagined you could want.

> Not only a bad written extensions can have disastrous consequences

My browser crashes? Hardly disasterous! And then I can just uninstall any unstable extensions.

> My browser crashes? Hardly disasterous!

If that crash leads to RCE (which, empirically, many of them do) then that isn't the characterization I would use.

That's a risk, that as an informed and adult user, I should be able to accept on my own. If I wanted a much less useful but marginally more secure browser, I'd just use Chrome.

That presupposes a bit of a false dichotomy, doesn't it? If the add-on APIs you need aren't there in the new framework, then the solution is to add them. I don't believe security and power should be in conflict--I want both!

You can't have power without the choice to use it wrongly.

You cannot add them in the new system without having the same security hole as the old system. e.g access to filesystems

You cannot have the power to access filesystems while also remaining secure. It's an all-or-nothing deal.

> You cannot have the power to access filesystems while also remaining secure. It's an all-or-nothing deal.

No, it's not. There are many secure applications that can access the filesystem.

But they have restrictions that limit their functionality, so they are trading power for security...

Imagine this. I need read/write access of the host file or an equivalent functionality of mapping any arbitrary domain name to any arbitrary IP address.

There is absolutely no way to keep that secure while allowing it because the functionality itself can be used for the wrong reasons. You either allow said functionality or you don't. There is absolutely no gray area.

Well I'd say the worst that can happen is an extension that compromises security of the browser to the point that malicious people can take control of your online accounts such as email, bank accounts, source code on github, etc.

That can happen intentionally but more often unintentionally. For example as you need to communicate between JS living in chrome (not the browser) and the webpage, it's easy to open a hole by mistake. Then someone could build a website to inject code to your browser and pretty much take control of your machine.

Yes Mozilla reviews the add-ons, but they are so many of them that they can't take the time to do a bullet-proof review. They only check for a few basic rules.

I've got a few plugins that provide very useful tasks but aren't very trust-worthy. You might think that's insane but everything has a risk. I do disable those add-ins when I don't need them.

Security is not an absolute -- it's a trade off.

I would wager that your attention to security as it relates to addons puts you in the minorty when compared to the Firefox user base.

It is great that you are security aware but what about the masses?

> What you're describing isn't a modern power user OS -- you're describing iOS.

Hardly. Windows, Linux and OS X do not let you monkeypatch the entire system.

Actually, they pretty much do. Take for example Dropbox. Windows officially 3rd party applications adding overlays to icons which dropbox uses to provide sync status for items in the dropbox folder. OS X has no such feature or API for icon overlays. Through lots of trial and error, swizzling, mach_inject, and mach_override they managed to provide this feature in OS X as well.

> Through lots of trial and error, swizzling, mach_inject, and mach_override they managed to provide this feature in OS X as well.

And it's not unlikely that Apple will break them at any time. Apple won't even go through the trouble of making an announcement when they do so.

In fact, I believe they are doing exactly this in El Capitan. Under the umbrella of "Rootless", you will no longer be able to arbitrarily modify [1] some special blessed OS processes, like Finder.app.

Some discussion of the politics of this issue: http://atp.fm/episodes/128

[1] haven't read enough to know the exact mechanism, but presumably restricting some forms of IPC like Mach messages?

I'm sure they understood the risk when they did it.

Reply on news.ycombinator.com