Hacker News Reader

Comment by rquirk | Hacker News Reader

I worry that desktop Firefox will go the way of the Android version or the neutered Firefox OS browser, where you cannot install the vital security add-on NoScript due to the incompatible add-on model that the mobile versions use. That used to work on Android, but no longer (and it seems the noscript dev is not a fan of the mobile platform). There are many more add-ons that only work on the desktop version. They should all be cross-platform and not desktop specific :(

View on HN

The problem is that most existing extensions are based on XUL, which is terrible and impractical for good mobile UIs.

There is a more abstract addon API (used by restartless addons) and your favourite ones just need to be updated.

Also, NoScript is not a "vital security add-on".

> Also, NoScript is not a "vital security add-on".

The vast majority of exploits depend on JS being available, since (at the very least) it'll be used to unobfuscate/execute some attack code. Remember the Tor browser vulnerability that was exploited? That wouldn't have happened without JS.

(Coincidentally, I find it amusing that not too long after, that Firefox made it even harder to disable JS, by removing the checkbox for global enable/disable.)

That's almost like saying the vast majority of exploits depend on you using a Turing machine.

Breaking most websites for the sake of slightly reducing the attack surface doesn't seem worth it.

You have never been in the Russian-speaking part of the Internet, have you?

The definition of "most websites" varies between people; the majority of the Internet browsing I do (mostly reading content in the form of text or images) does not require JS. If I come across a site in a search that refuses to show content without JS (and Google's cache, text-only, doesn't give me what I want to see either), I'll just move on to the next search result.

It's far better for websites to break, than my machine. The tradeoff will be different for someone who regularly browses a different demographic of sites.

Firefox has no XSS mitigation built in unlike Chrome and even Internet Explorer. NoScript provides that for Firefox, even if you allow global scripts for practicality purposes you're getting XSS protection.

And I realise that there are design trade offs, but it seems sad that mobile has to drag the desktop into the realm of relative uselessness - not all add-ons can be updated to use the new abstract API (since the API will have gaps that the old API used to support).

While I agree, Australis only breaks visual add-ons like Vertical Tabs, and the like. Not sure where NoScript comment is coming from?

For now Australis only breaks visual add-ons, but I can see a drive to align, i.e. remove features from, the desktop version so it is more like the mobile versions. The thinking being - Australis is visually more like the Android version of Firefox, why not make its add-on model more like the Android add-on model? i.e. Neutered.

The NoScript comment is because that is the "killer app" for Firefox for me, and on mobile Firefox it is not available. There's the amusingly titled "NSA" addition - http://noscript.net/nsa/ - but as you can see from that page it is pretty much dead. A forum post from November 2013 (1) indicates that the author is aware of the problem, but the diverging code bases I guess make it difficult to maintain.

1: http://forums.informaction.com/viewtopic.php?f=25&t=17687&si...

We have indeed seen a severe dumbing-down of all of the major desktop browsers over the past few years, as mobile devices have become more widely used. So I think that what you're saying is happening, and will continue to happen.

Desktop browser users should not have to suffer because mobile users choose to use platforms that are crippled in so many ways. Nor should desktop browser users have to install numerous extensions just to bring modern desktop browsers back to the level of usability we had a few years earlier. Yet with each new release of the major desktop browsers, we find ourselves in the position of reduced functionality, and the need for more and more extensions to restore the now-missing functionality.

Instead of dumbing-down desktop browsers to match mobile ones, I think there should be more of a push to getting mobile browsers to desktop usability levels.

It might take a few more levels of UI indirection since the screens are smaller, but I don't see any fundamental reason why a mobile browser couldn't have all the features of a desktop one.

They are doing a major UI overhaul - the design itself is unstable. So there are valid reasons for current visual add-ons not working - the majority of bugs reported by users would be caused by plugins designed for a different user interface, making it useless as feedback. That would defeat the purpose of having an open beta. Meanwhile the plugins should not yet update because the interface can change any update. So for now it's a chicken/egg problem but I'm sure that once the interface stabilises things will be as they used to.

So while it is good to stay on your toes, I don't think you realistically have to worry about this going to be a permanent issue.

NoScript is unavailable because current NoScript only works with the classic 'everything in one process' Gecko model & associated plugin model.

Firefox for Android isolates content into multiple processes (this is literally a requirement on Android due to their horrible memory management), which means plugins written in that fashion simply can't work. Unfortunately, at present this excludes NoScript. It's possible it could be fixed, though; I'm not sure.

Reply on news.ycombinator.com