Mozilla blog: Begin your MV3 migration by implementing new features today
blog.mozilla.org
blog.mozilla.org
Let them modify the browser in any way they want. Let them write plugins that can do anything. But inform users who install a third party plugin what that plugin can do. Like "This plugin wants the right to read all data on all websites you visit. In theory it could capture your bank login and transfer it to some other server".
Another bad decision by Firefox to limit users ability to do what they want is that they don't support the File Access API:
https://web.dev/file-system-access/
This gives Chrome users the ability to build simple web pages that can be used like native applications.
An empty html page with a textarea, load and save buttons and you have a text editor!
I hope Firefox will notice that they lose market share because of restricting users freedom. And turn the ship around.
What you are saying might still make sense for firefox because they need to find some sort of niche given their falling market share, and power users is a potential one. However i would disagree that in general its a good strategy for winning the market as a whole.
More importantly, I want my family member's browsers to provide them safety. Because I'll be the one running malware removal code on their computer, etc. I'm going to lean towards something that is safe for them.
E.g. Compare just-workingness between emacs and microsoft word.
That's interesting because their whole initial rise to becoming a dominant browser was based on "power" users back in the aughts.
Can they maintain MV2 while supporting MV3 their own way for easier porting of Chromium extensions? Or is MV2 support getting dropped and all MV2 extensions have a EOL coming up next year?
Even if they provided an easier path to MV3, developers would likely have hurried up anyway because Chrome won't do so.
Couldn't FF support MV2 and MV3 at the same time?
At a more detailed level, well... I'm not that familiar with the area, but it seems like it's a bit of a tangled mess.
The big item of disabling non-declarative content blocking seems safe. Firefox appears to have no reason to turn that part of MV2 off.
The various security tightening measures are another story. My guess is that with Chrome removing higher-risk APIs like dynamic code evaluation, Firefox is using it as an excuse to do the same in order to not have to deal with the issues that arise from them. Which isn't great from the point of view of extension capability. Personally I'd prefer to err on the side of scary permissions notifications for that sort of functionality.
Or at least some of it—I'm not convinced that allowing an extension to execute arbitrary code loaded over an insecure HTTP connection is ever a good idea, except for some temporary development mode thing. (Sure, that's exactly what happens with a random web page containing JS that's served over HTTP. But there's no need to support that case for extensions that are active across all of your browsing activity.)
But it sounds like the removals go well beyond that.
That's be true for some extensions, but it would be a big, big selling point for Mozilla to be able to say: our ad-blockers are better than yours.
There's also some incorrect binary thinking here. Why must Mozilla support only one extension standard? Mindless application of some software engineering principle? It would make total sense for them to support two: one with the features they want, and another for Chrome compatibility.
I know a lot has been said about DNR for Chrome, and while retaining WebRequest is a good step, I wonder how much Firefox's DNR implementation will differ from that of Chrome. As an extension developer, I really like the idea of write-once extensions that run everywhere, and unfortunately today, a lot of that simply means building for Chrome-* browsers and managing Firefox as a "special case" :/
Which will stop accepting MV2 Extensions after the move to MV3
Therefore leaving you without a store again
Calling it now, let's see in a couple of years how deep the state really is.
These moves keep happening in tech all the time. Slippery slope fallacy doesn't work here - if you see something that looks like slippery slope in a tech business, it almost definitely is one.
Quite frankly i feel like every time a web browser is mentioned on hn, everyone reaches to weird conspiracies.
No, because there is no conspiracy needed. Chrome is a product of an adtech company, and Firefox is funded by the very same one. Mozilla is at best fighting a losing battle here, forced to make concessions to survive. Or, it could be argued that Firefox exists only to serve as an antitrust shield for Google.
I disagree
> Or, it could be argued that Firefox exists only to serve as an antitrust shield for Google.
That might well be why google funds them. I can’t say I mind, and it doesn’t make them more user-unfriendly.
Mozilla or Google?
If Mozilla: Do you think that Mozilla would think of their users' privacy if it meant alienating Google and loosing their money? I'm not picking a side here - I have no idea so I'm just asking.
Yes. One example is tracking protection, which blocks Google Analytics on every FF installation by default.
But there are valid technical reasons to support DNR. It really does make more sense from a performance point of view, if it happens to support what you need. If not, then it's good to have blocking web requests available. And there's good reason to be unhappy if Firefox drops them. I don't see any strong incentives for doing so, though.
You actually got it in your first paragraph - for me, it's a trust issue. I don't trust Mozilla to retain web request blocking, particularly when DNR becomes established in Firefox and most extensions migrate: because then, the argument for removal web request blocking will be, "look, there's very few legitimate extensions using this, and it's a Huge Security Hole, and everyone standardized on DNR already".
Sounds to me like uBlock is literally top priority for Mozilla, so I don't see why they would do that.
https://blog.mozilla.org/addons/2020/02/06/ublock-origin-for...
Then you can point to the source of widevine? Something that chrome developers called a core component when they where caught side loading it on dedicated open source distros a few years ago and initially refused to supply an option to disable it?
https://en.m.wikipedia.org/wiki/Mozilla_Application_Suite
It had a reputation for being slow and bloated at the time which prompted the creation of a slimmed down browser, Phoenix which eventually became Firefox
And towards your question: Different times. Both hardware and browser capabilities were vastly different back then, so some technological choices made in the early days might have made more sense.
For me personally, I know that back in the day I was a lot more forgiving of delays than I am now.
----
Some side projects felt useless. Some feel quite relevant to the goal (e.g. Mozilla VPN), some grew to become huge (Rust). Some were maybe an amazing idea at the wrong time (Firefox OS?). I wouldn't want Mozilla to stop doing any side projects.
What's so bad about MV3? Would love to hear your take. Mozilla made it clear it will not adopt changes that prevent extensions like uBlock Origin from working. Many other changes seem to be focused at user security (which is good), and other seem to just follow the "standard", which one can argue is quite important from the perspective of users too, because the fact that extensions can be easily built for Chrome and Firefox together is effectively _the reason_ some of the extensions I use are even available on Firefox.
It's a trust issue. Mozilla burned a lot of it in recent years.
> Mozilla made it clear it will not adopt changes that prevent extensions like uBlock Origin from working.
That's the thing: I don't trust they'll keep good on that promise for more than a year or two. I may be misremembering things, but I'm pretty sure they initially weren't going to adopt MV3 at all, then they weren't going to add DNR, now they're adding DNR but "not removing request blocking, pinky swear". Once DNR lands, I worry they'll start thinking about removing request blocking, under the guise of "security".