Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

> the better approach would obviously be to work with FF developers to add the extra extension APIs they need; I can only assume they took that path but got rejected. If you're a Firefox user, ie someone who inherently places their trust in the security and privacy decisions of Mozilla, that's probably a red flag.

Hi, I'm an engineer at Mozilla working on the address bar of Firefox. We recently released a rewrite of the address bar with the explicit goal of making it easier to extend and experiment with the address bar: https://bugzilla.mozilla.org/show_bug.cgi?id=quantumbar

You're welcome.



sort by: page size:

> I really wish Firefox would make the UI more stable and make user chrome mods some kind of plugin system where I can pick and choose how to deeply customize the interface.

Firefox extensions before Mozilla decided to kill XUL had the capability to radically alter the UI. This is what made FF extensions so powerful.

There were arguably good reasons for them to remove XUL[1], but it created a void of functionality that previously existed. I still think that a more secure version of XUL could offer a better user experience, but unfortunately we're forced to settle on the severely limited WebExtensions standard nobody is happy with except browser developers.

[1]: https://yoric.github.io/post/why-did-mozilla-remove-xul-addo...


>That's what I don't want - Firefox offering services.

That's what I actually want from Mozilla — offering (but not forcing) privacy-enhancing services, preferably for free.


> However, I've been maintaining a small fork

Do you mind elaborating? I'd really just like some "Unmozillaed Firefox" or "Firefoxium" that removes some of the crap Mozilla tries to impose ("no, you can't install extensions from outside of the store", "using a userChrome.css? haha, no"). But all prominent FF forks are full of crazy "privacy enhancements" that mean virtually no web app will work.


> Seems so sad that Mozilla is literally begging people to give Firefox a try.

Your security matters. Google recommends using Chrome, a fast and secure browser. Try it?

https://i.stack.imgur.com/0zXc4.png


> Few people use those forks, for the simple reason that what has been removed from Firefox is not game-changing enough to mandate an exodus.

This is not the reason for me at least to not use it as my main browser.

I recently tested and the speed is good and it is absolutely wonderful to have true full fledged extensions and complete themes.

My reason is that I'm worried if their security is good enough. If we could somehow be sure about that I'd actually happily leave modern Firefox behind for it.

Personally I'm hoping for someone to create a patch set and bulld binaries based on it to re-enable the old stuff, not by letting extensions muck around in the internals but by providing defined extensions points like:

- enable / disable tab bar

- provide your own tab rendering code

- etc


> That is utter garbage.

For real. I understand the security argument, but that poster and Mozilla in general seem to be making the argument that "no, you're wrong, you don't know what you want, we're going to tell you what you want, and it's a less feature-rich Firefox."

Well, I use Firefox, and I evangelize Firefox to everyone I know, on the basis, essentially of the extensions, and most of the popular Firefox extensions would have never come into existence with the new extension model. Mozilla is developing APIs to grandfather some of them in, but they're still reducing the possibility space from "anything" to "what we expose through these APIs", so new extensions that change everything will no longer come into being.

And aside from that, they don't even cover everything; I've already been notified by the developers of two extensions I use that they either can't or won't be switching over.

I really do have to agree with the people who are saying Mozilla has totally lost the plot. I've disabled automatic updates until I can figure out what I'm going to do.


> I am using Firefox because it doesn't belong to anyone.

Others mentioned are in a different league, but even firefox is mostly developed for an organization, that seems to be pushing to enter the service industry.

Have you looked how many connections firefox makes without even opening a page? I tried to silence it, and it was a PITA - ended up using a firewall.

I'd donate to firefox development, like 3, maybe 4 digit numbers, but AFAICT they only accept donations to Mozilla, and don't let you specify types of activities you would like to support.


> If you want the full-blown UI customisation, then I'm afraid extensions are not allowed that anymore due to the associated security risks.

That's total BS. It's my software running on my computer. I get to decide what I consider a security risk, not Mozilla.


> Unsigned extensions are also not for end-users.

Says who???

Part of the problem is the very delineation between developer and end user.

How about Firefox just be a powerful open platform that anyone can develop for easily with as few roadblocks as possible? We should all be one step away from being developers.

I am so glad I was on the old Firefox 12 years ago. I'm glad that I was able to quickly whip up extensions and share them with my friends. Wanting to automate bypassing my school's wifi captive portal, or wanting to change how the bookmark menu was displayed encouraged me to experiment.

The fact that Mozilla now sees only an audience of consumers that need to be protected from themselves and marketed to is the problem. Mozilla is afraid of their precious precious brand being sullied.


>Recently, they artificially limited the extensions available in Firefox mobile. I uninstalled Firefox immediately on all my machines.

They did not "artificially limit" the extensions available, you are misinformed.

They rewrote the engine of their mobile browser, and swapped the old engine for the new one before the new one had 100% support for all of the extension APIs. They have been working on this, and over the past few months I've seen several of my extensions which were previously disabled start re-enabling themselves as support for those APIs has been added. The eventual goal is to support all of the extensions that were supported before.

You can track that progress here: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

It sucks that, for the span of a couple months, I lost a couple of my addons, but as someone whose team has struggled for years supporting two very different versions of a piece of software simultaneously, I understand why they did it. And the new browser is so much faster and more responsive that my annoyance about the addons was tempered somewhat.

>Now they're firing the Rust team? Are these people stupid? Rust is pretty much the only thing Mozilla has going for it. I guess it's time for Thunderbird to go as well.

They did not fire the Rust team. They laid off a few of the people who had been working primarily on Rust, and retained several others. But significant components of Firefox are written in Rust, and the people who are working on those components are still employed. And significant amounts of new code is being written in Rust - but essentially they can't swapping out hundreds of thousands of lines of code at a time anymore.


> I can think of several ways to drastically improve the privacy of web extensions by providing audit logging or more fine-grained control over permissions.

You were talking about API surface though. Neither of these things are API surface in itself. They are after the fact, informing the user what it can do and what it did with those APIs.

> It's just pointless to have the most advanced content blocking mechanisms when you allow browser extensions to circumvent them all.

I don't think so. It's not pointless. It just means you need to trust more than mozilla, you ALSO need to trust the extensions, just like you need to trust many other things in your system. The error here is assuming that everything should be reducible or can be reduced to a single source of trust.

> There are countless studies that show most non-expert users don't know what is happening with their data and are not able to judge the risks they're taking when installing software like browser extensions.

Perhaps. But if you follow that argument then you end up with a locked-down system with little flexibility, which I was referring to as apple-style walled garden. Some people may value such a thing, but I wouldn't use or recommend firefox if it became something like that. I would flee in terror.

Also consider that privacy is not an exclusive goal for mozilla: https://www.mozilla.org/en-US/about/manifesto/details/#princ...

Principles 2, 5 and 6 would be endangered by a single global actor (no matter how benevolent) being in control of your software.


> I used to have a useful feature that worked.

> Now I don't.

Well, imagine for a moment that you're whoever is in charge of firefox development at mozilla:

- You want to take advantage of modern hardware such as multiple cores, GPU's etc.

- You want to get rid of XUL which is an evolutionary dead end.

- You have an existing extension model which basically allows extensions to more or less freely poke about in the internals of the browser

- You want to improve security for users, both against malicious sites and (to a lesser extent, I suppose, but still) malicious browser extensions.

Now, what would YOU do if the constraint is that you can never ever break existing extensions?


>They disabled many loved extensions by power users for absolutely no reason at all!

The reasons were stated repeatedly. They rewrote the mobile browser engine, which broke extension API support since all of the internal APIs changed, and they didn't have the resources to support both browsers simultaneously for a long period of time, so they prioritized the most-used extensions first and will enable more extensions as the APIs are hooked back up underneath.

This had tangible benefits - the new browser is significantly snappier and uses less power in my experience.

>We should take firefox out of their hands before it is too late.

It's open source, if you aren't satisfied with the speed of their progress, you can always help out. You say you'd like to take this work out of their hands? Well, here it is.

https://mzl.la/3jgCsW3

These are, specifically, unimplemented APIs and known API bugs in the new Firefox Mobile, that are on the Mozilla TODO list, and for which contributions would presumably be welcome. Enjoy.

Unless when you said "we", you actually meant "other people".


> Mozilla has put a ton of resources into improving Firefox

I think most Firefox users on Hacker News would dispute this. Judging by the average thread on Firefox, most of us think that Mozilla's efforts have mostly been to make Firefox worse. I don't know that I'd go that far, but the issue seems to be that most of the user facing changes have been the kind of pointless changes for the sake of change, and side projects most people don't use or want in their browser.

A sibling comment mentions breaking the addon API. If the addons I want to use are broken for months at a time, that's going to get me to consider using a different browser, even one with less capabilities. (This doesn't have to be a rational process; ideally you want your users to never think "ugh, why isn't this working, hmm I haven't checked out Chrome in a while". Even if Chrome is worse, some of them are going to switch.)

Then there's Pocket, which (let's admit) exists only because it's a direct source of revenue for Mozilla via advertisements placed in the browser chrome.

Then there's the pointless change to the URL bar, which drew an absurd amount of outrage. That much anger over a small UI change is not justified of course, but that's not the point. Stuff like this breaks the cardinal rule of not pointlessly pissing off your dwindling user base.

There's whatever the hell the mobile team is up to, with some new perpetual beta project every 12 months and putting an enormous amount of effort into a new Firefox for Android with a worse, slower UI that's not significantly faster for actual browsing and currently only has support for a handful of addons (which are the only reason anyone uses FFA).

There's enhanced tracking protection, which in the good ol' days of Firefox would have been an addon. Granted, it seems like it's doing something genuinely useful.

The RSS viewer got removed in version 64.

Then there are the fiascos, like the time Mozilla broke all users' addons, the hotfix sideloading scandal, the Mr Robot thing...

To be clear I do recognize that at least some parts of Mozilla are interested in improving Firefox, but the issue is that most of the improvements there are not obvious to anyone. Personally I've enjoyed the feature to automatically block notification permission requests (the UI for that is great). The addition of WebP support was nice, and ongoing work to support AVIF is also appreciated. The work on WebRender and introducing Rust code into Firefox is appreciated and has made Firefox noticeably faster. There have been some nice improvements to the developer tools too.

The problem is that most of this stuff isn't visible to ordinary users, even to power users. That's a problem for attracting new users, to be sure. But the attempts Mozilla has made to attract new users seem to largely be failing. And so the worst thing they could possibly do is to piss off the dedicated users who remain, but that seems to be what they've mostly accomplished.


>Firefox is an open source project. You're welcome to contribute and make things better.

Well no because they won't accept a patch that lets us plebs turn off the signed extension requirement.


> Still, I like the idea of using a browser from a company that does not want to access my data on their own servers.

Mozilla's motives alone for creating a web browser are why I trust FF. I don't like the idea of Chrome subsisting (to the point it's their actual business model) on my personal info


> Now a similar thing is happening with Firefox Android and their extensions. Firefox can easily run most extensions but it's hidden behind a config in a canary release of the browser. No doubt there are some good reasons for it but we simply do not know. Ultimately this is a fault common among almost every product designer. They refuse to explain their decisions fearing (perhaps justly) that they may be proven wrong.

There were no good reasons for Mozilla to restrict extensions on Firefox for Android. It was a stupid decision that alienated Firefox's user base on Android with no real benefits.

However, Mozilla has finally listened to the negative feedback and custom add-on collections are now available on Firefox Beta for Android:

https://www.ghacks.net/2022/10/20/firefox-beta-for-android-n...

Mozilla also said they would start working on WebExtensions on Firefox for Android this year. The goal is to have feature parity with desktop Firefox, which includes retaining the Manifest v2 features that uBlock Origin uses:

https://blog.mozilla.org/addons/2022/12/15/new-extensions-av...

While Mozilla has made numerous missteps in the past, it looks like they're finally moving in the right direction.


> Can Mozilla even make a Firefox browser for ChromeOS?

Apparently they can: https://github.com/mozilla/browser.html


> I do not see Mozilla taking any steps toward privacy at all

https://bugzilla.mozilla.org/showdependencytree.cgi?id=12609... are some concrete steps being taken.

Or the containers work. Or the tracking protection work. If you're not seeing those, it's because you're not looking.

next

Legal | privacy