Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The likely end of DownThemAll

downthemall.net

Post reply on HN
Print view View original

61–70 of 142 posts

Re: The likely end of DownThemAll

#61

Post by eloisant »

wvenable wrote: post #41
eloisant wrote: post #20

Earlier quoted context omitted.

The truth is Firefox already lost most of its market share to Chrome, so "powerful add-on" doesn't seem to be a strong enough selling point to retain users. It is, however, a big liability. In terms of security but also stability and performances. The way extensions work in Firefox is a bit crazy, it's like opening your belly and say "here, change whatever you want". It's the equivalent of a desktop OS where any inst…

> The way extensions work in Firefox is a bit crazy, it's like opening your belly and say "here, change whatever you want". ...and my god it has been awesome. Certainly more awesome than any instability it may cause. > It's the equivalent of a desktop OS where any installed application runs in kernel Most major operating systems give extension capabilities to enhance them in deep ways. My Windows install has ClassicS…

Well I'd say the worst that can happen is an extension that compromises security of the browser to the point that malicious people can take control of your online accounts such as email, bank accounts, source code on github, etc.

That can happen intentionally but more often unintentionally. For example as you need to communicate between JS living in chrome (not the browser) and the webpage, it's easy to open a hole by mistake. Then someone could build a website to inject code to your browser and pretty much take control of your machine.

Yes Mozilla reviews the add-ons, but they are so many of them that they can't take the time to do a bullet-proof review. They only check for a few basic rules.

Re: The likely end of DownThemAll

#62

Post by wvenable »

pcwalton wrote: post #58
wvenable wrote: post #41

Earlier quoted context omitted.

> The way extensions work in Firefox is a bit crazy, it's like opening your belly and say "here, change whatever you want". ...and my god it has been awesome. Certainly more awesome than any instability it may cause. > It's the equivalent of a desktop OS where any installed application runs in kernel Most major operating systems give extension capabilities to enhance them in deep ways. My Windows install has ClassicS…

> My browser crashes? Hardly disasterous! If that crash leads to RCE (which, empirically, many of them do) then that isn't the characterization I would use.

That's a risk, that as an informed and adult user, I should be able to accept on my own. If I wanted a much less useful but marginally more secure browser, I'd just use Chrome.

Re: The likely end of DownThemAll

#63

Post by [deleted] »

wvenable wrote: post #62
pcwalton wrote: post #58

Earlier quoted context omitted.

> My browser crashes? Hardly disasterous! If that crash leads to RCE (which, empirically, many of them do) then that isn't the characterization I would use.

That's a risk, that as an informed and adult user, I should be able to accept on my own. If I wanted a much less useful but marginally more secure browser, I'd just use Chrome.

[deleted]

Re: The likely end of DownThemAll

#64

Post by pcwalton »

tn123 wrote: post #59
pcwalton wrote: post #50

Earlier quoted context omitted.

I'll copy and paste my comment from earlier: > Reaching into content windows is forbidden [modulo CPOWs] in multiprocess Firefox. That alone is going to break tons of addons. This necessitates a redesign. Since a major redesign is necessary anyway, it makes sense to future-proof the architecture so that addons will work in perpetuity. Ultimately, this ends up being friendlier to addon developers, since addons will br…

So repeating it makes it more true, eh? >Reaching into content windows is forbidden [modulo CPOWs] in multiprocess Firefox. It is not forbidden, it is just different, using frame scripts or CPOWs. >That alone is going to break tons of addons. It will break a ton of add-ons, it will not break a ton of other add-ons. And also the "breakage" varies and would be a in the range of learning a bit about frame scripts and th…

But the Add-on SDK is continuing to be supported.

And the post makes it clear that this is a long-term decision, not motivated by any one change but by the sum of all of them. The removal of the traditional status bar in Firefox 4 broke a bunch of addons. Australis had add-on compatibility implications. Electrolysis has massive add-on compatibility hazards. In the future, HTML-based UI like browser.html would have huge add-on compatibility issues, as would hardened engine components that might not support XUL/XPCOM (because it's essentially impossible to support XPCOM without being Gecko).

Nobody likes breaking addons, believe me. But I think after 10 years it's clear that the current situation needs to change, or we'll be having this conversation 2 years from now all over again, and then 2 years after that, and so on as long as Firefox is around. With one last round of deprecation we can get to a sustainable future with great addons and minimal breakage.

Re: The likely end of DownThemAll

#65

Post by wvenable »

eloisant wrote: post #61
wvenable wrote: post #41

Earlier quoted context omitted.

> The way extensions work in Firefox is a bit crazy, it's like opening your belly and say "here, change whatever you want". ...and my god it has been awesome. Certainly more awesome than any instability it may cause. > It's the equivalent of a desktop OS where any installed application runs in kernel Most major operating systems give extension capabilities to enhance them in deep ways. My Windows install has ClassicS…

Well I'd say the worst that can happen is an extension that compromises security of the browser to the point that malicious people can take control of your online accounts such as email, bank accounts, source code on github, etc. That can happen intentionally but more often unintentionally. For example as you need to communicate between JS living in chrome (not the browser) and the webpage, it's easy to open a hole b…

I've got a few plugins that provide very useful tasks but aren't very trust-worthy. You might think that's insane but everything has a risk. I do disable those add-ins when I don't need them.

Security is not an absolute -- it's a trade off.

Re: The likely end of DownThemAll

#66

Post by rufugee »

aaron695 wrote: post #49
tptacek wrote: post #18

There is no piece of software in the world harder to secure than a browser. There's almost no other piece of software where compromises have higher stakes. Further, the verdict is probably in on whether browsers should use multi-process sandboxes, and how careful they need to be about privilege-escalated Javascript, which is an enormous loophole for runtime security measures like ASLR and DEP. Firefox's multi-process…

> If that's the short term cost of getting Firefox to the same level of security that Chrome is at, it seems more than worth it. Without the extensions I perhaps see no point to FF. Is secure and dead worth it? Plus is there evidence of issues around this in the wild? Is it worth the risk of being a possible FF killer?

Maybe one valid point is having an internet browser that is not manufactured by an advertising company?

Re: The likely end of DownThemAll

#68

Post by pcwalton »

wvenable wrote: post #62
pcwalton wrote: post #58

Earlier quoted context omitted.

> My browser crashes? Hardly disasterous! If that crash leads to RCE (which, empirically, many of them do) then that isn't the characterization I would use.

That's a risk, that as an informed and adult user, I should be able to accept on my own. If I wanted a much less useful but marginally more secure browser, I'd just use Chrome.

That presupposes a bit of a false dichotomy, doesn't it? If the add-on APIs you need aren't there in the new framework, then the solution is to add them. I don't believe security and power should be in conflict--I want both!

Re: The likely end of DownThemAll

#69

Post by Shebanator »

aaron695 wrote: post #48
geofft wrote: post #42

From a technical point of view, what is DownThemAll? It seems like it looks at the structure of the current web page, identifies all links, and then downloads them (in some cases using range requests, as with '90s-era download accelerators), with options for pausing and resuming downloads and renaming them in certain ways. What prevents this from being done using a Chrome extension to look at the page structure and r…

The main reason people install it I thought is because 1. It allows downloads to start and stop. No more 90% of that iso then having to start again. 2. It opens up 4 thingies on the file and downloads simultaneously. So 4 times quicker if the website is restricting bandwidth per connection.

With the new APIs, you should be able to have 4 web workers do the downloads in parallel still. (Based on how chrome handles such things)

Re: The likely end of DownThemAll

#70

Post by jfb »

rufugee wrote: post #66
aaron695 wrote: post #49

Earlier quoted context omitted.

> If that's the short term cost of getting Firefox to the same level of security that Chrome is at, it seems more than worth it. Without the extensions I perhaps see no point to FF. Is secure and dead worth it? Plus is there evidence of issues around this in the wild? Is it worth the risk of being a possible FF killer?

Maybe one valid point is having an internet browser that is not manufactured by an advertising company?

Albeit one that exists solely at the sufferance of the advertising industry.
Post reply on HN