51–60 of 81 posts
Earlier quoted context omitted.
How? I use Firefox Nightly but I only see the handful of recommended extensions available.
https://blog.mozilla.org/addons/2020/09/29/expanded-extensio... has the full instructions. In addition to creating an add-on collection you need to go to the About page and tap the Firefox logo 5 times to get the proper menu items.
It's upsetting to see all this corporate double-speak when Firefox fails to support the most basic extension functionally: the User Agent should allow the User to run their own code on their own machine without any requirement of phoning home to the manufacturer. This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own…
xpinstall.signatures.required
At least I think thats the one. Also extension updating can be disabled globally or on a per extension basis in the addons setting page.
Edit: note that you have to package (zip) the extension. You can't keep an unpacked extension loaded.
Firefox no longer allows extensions to have full control over requests in Manifest V3, despite their repeated public statements. https://bugzilla.mozilla.org/show_bug.cgi?id=1786919 They have merged a change that makes it impossible to access and download certain website content the user is viewing and wants to process. Now that Firefox has introduced this limitation without offering an alternative, it is now much ea…
That bug reads to me like that functionality is not yet implemented, because they're still figuring out how to securely add that back in. However, since MV2 is still supported, I don't see the problem here — this is just the first public release of some MV3 functionality, but full feature parity is still being worked on (Service Workers aren't supported yet either, for an example that affects my extension).
(Most recent example that I have in mind: they switched content dark mode from matching OS theme to matching browser theme in 95, despite quite a few immediate and detailed objections as soon as the patch landed on Nightly—and yes, I’m willing to admit that the change will match what some, perhaps more, users want—but didn’t expose it in about:preferences until 100; to my eye, they should fairly obviously have reverted the change until they had that setting, or at the very least mentioned the about:config pref to restore the old behaviour in the release notes. At least in that case there was still a pref for it.)
Firefox no longer allows extensions to have full control over requests in Manifest V3, despite their repeated public statements. https://bugzilla.mozilla.org/show_bug.cgi?id=1786919 They have merged a change that makes it impossible to access and download certain website content the user is viewing and wants to process. Now that Firefox has introduced this limitation without offering an alternative, it is now much ea…
Once again they ruin the extension API to please their overlord google.
Firefox no longer allows extensions to have full control over requests in Manifest V3, despite their repeated public statements. https://bugzilla.mozilla.org/show_bug.cgi?id=1786919 They have merged a change that makes it impossible to access and download certain website content the user is viewing and wants to process. Now that Firefox has introduced this limitation without offering an alternative, it is now much ea…
For reference for people who haven't read the linked bug: the change makes it forbidden to alter CORS and related security headers via extensions, and invites developers to provide use cases where it is necessary so that proper permissions can be designed to permit this. OP complains that this is unreasonable, because... well, "the use case [is] already obvious to your team".
It's upsetting to see all this corporate double-speak when Firefox fails to support the most basic extension functionally: the User Agent should allow the User to run their own code on their own machine without any requirement of phoning home to the manufacturer. This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own…
The official branded releases only require signatures because everything else they tried to stop malware hijacking the browser ultimately failed. Mozilla are not trying to copy iOS, they don't stop you leaving the walled garden if you want to.
Meanwhile in Firefox for Android: absolutely nothing is going on with extensions, because Mozilla disabled nearly all of them.
Install Iceraven. Get the Mozilla browser installer from F-Droid, and choose Icerave.
Firefox no longer allows extensions to have full control over requests in Manifest V3, despite their repeated public statements. https://bugzilla.mozilla.org/show_bug.cgi?id=1786919 They have merged a change that makes it impossible to access and download certain website content the user is viewing and wants to process. Now that Firefox has introduced this limitation without offering an alternative, it is now much ea…
Having looked at that bug, and seen your reaction to somebody else asking about why you are so concerned about this, I am now of the opinion that your worrying here is a manifestation of https://xkcd.com/1172/ . For reference for people who haven't read the linked bug: the change makes it forbidden to alter CORS and related security headers via extensions, and invites developers to provide use cases where it is neces…
It's certain that 2 years from now extension developers will still be getting support requests and receive negative reviews because of that commit, even if an alternative API is released in the next few months. But who cares, it's not you who has to find a solution and deal with users.
All of this could have been averted by simply offering an alternative API in the same browser version in which the new restriction was implemented. There was no pressing need to immediately restrict the API.
> Disallowing the modification of Access-Control-Allow-* response headers will impact extensions that need to download page content.
> Search by Image sets CORS headers for some images in order to download them from the content script before uploading to a search engine. In many cases an asset will only be served if the request contains the correct origin, referrer and cookies. Reproducing such a fetch request was impossible from a background page last time I tested, and even if configuring all aspects of a request becomes possible, it could still open up extensions to security issues, because it's difficult to figure out if certain data types would be sent by the browser if the request would be made from the page context, such as the referrer. We would also need to request additional permissions, such as access to HTTP cookies.
> Extensions used for archiving pages would no longer be able to create faithful representations of the tab content. Advanced ad blockers such as uBlock Origin would be impacted as well. There is a general issue of extensions not being able to access certain parts of the page, such as a tainted canvas in Chrome, or a closed shadow DOM in Safari, and this restriction would make the problem worse.
Earlier quoted context omitted.
Having looked at that bug, and seen your reaction to somebody else asking about why you are so concerned about this, I am now of the opinion that your worrying here is a manifestation of https://xkcd.com/1172/ . For reference for people who haven't read the linked bug: the change makes it forbidden to alter CORS and related security headers via extensions, and invites developers to provide use cases where it is neces…
I have taken the time to comment on the pull request before it was merged. I have mentioned several use cases, and offered an explanation for why the feature is important. If that is not enough for you and for Mozilla engineers, then perhaps the correct response is to simply abandon their platform. I've done my part, and I'm not going to further sacrifice my free time because some people have no concern about how the…
> All of this could have been averted by simply offering an alternative API in the same browser version in which the new restriction was implemented.
You mean like manifests v2, which wasn't affected?
I will also note, it was this comment in particular that set me off:
> It must be possible to prevent a patch from being released in the stable version of Firefox. You must be aware that this change will make it difficult to port extensions that need to access arbitrary page content. Extension developers have enough work on their hands already, and we shouldn't need to spend more time submitting feature requests and then defending use cases that are already obvious to your team.
This kind of "I demand you do what I want, and I'm going to refuse any attempt to answer why you should" comment is one that I believe it reasonable for a developer to ignore.