Hacker News Reader

Comment by btdmaster | Hacker News Reader

How? Mozilla has kept the old webRequest API: https://blog.mozilla.org/addons/2021/05/27/manifest-v3-updat...

Back in the day, Firefox plugins were able to execute shell commands, and had complete access to the OS of the user. Some people apparently miss this, but it was a key reason why I moved to Chromium based browsers in the first place.

I'm not talking about Google's Manifest v3 or anything recent. I'm talking about Firefox 57 (~2018) and onward when they abandoned XUL and all the extensions/add-ons had to be re-written as chrome-style web extensions. Unfortunately many of the most complex extensions could not and lost features at best.

If FF didn't do that, it would still be a security nightmare. XULs are available in some FF forks, which are security nightmares.

It's amazing that Sea Monkey, Palemoon, and all the other forks which support XUL have managed to do so securely with incomparibly smaller teams. Multiple proofs of the falsehood of your claims already exist.

Mozilla got rid of XUL because it wouldn't work with the multi-process model of Chrome they were copying in order to speed up the browser for running complex javascript applications. The security justifications were nonsense. The real security problems are in supporting all the new attack surfaces that modern browsers do in the form of exposing bare metal (or just above) functionality for acting as an OS (webgl, websockets, etc) instead of a browser.

Reply on news.ycombinator.com