Hacker News Reader

Comment by saberworks | Hacker News Reader

It would be really nice if the addons/extensions page showed which addons were listed as compatible and which weren't. I might thus make a decision to disable/delete an addon or two that were blocking me from using multiprocess firefox. As it is, I have no idea if my firefox is using multiprocess at all. All I know is that I use a lot of addons and I'm probably not, then, using multiprocess.

View on HN

You can figure out what add-ons are compatible by cross-referencing http://www.arewee10syet.com/

Seems the only addon I use that isn't compatible is "Disable Ctrl-Q Shortcut". It's an addon I really don't want to get rid of, there have been many cases in the past where I've accidentally pressed ctrl+q instead of ctrl+w, and had Firefox quit on me..

Edit: The page for the addon has a comment saying it does work with multiprocess, so I just forced it on. I'm on Linux, and I don't know of an about:config key to disable ctrl+q

Same. Just found:

https://addons.mozilla.org/en-US/firefox/addon/ctrl-shift-q-...

https://addons.mozilla.org/en-US/firefox/addon/disable-ctrl-... (not yet reviewed)

If you're on OS X, you can override per-Application shortcuts to achieve the same effect. Not sure about other OSes

Does anyone know of such an extension for Chrome and Alt-F4? Chrome seems to handle that all by itself on Debian, which is silly because my window manager doesn't use that for "Close Window".

It's worth letting the addon author know if you haven't already.

I think you can set that in `about:config` without a plugin

If you set browser.showQuitWarning to true (also make sure browser.warnOnQuit is true; that should be default) it will show a dialog to confirm if you want to quit. But if you check the box "do not show next time" it will set browser.showQuitWarning to false.

Apparently the SSL certificate for that site expired a few days ago and nobody renewed it.

Certificate expiration seems like one of the most ridiculous aspects of TLS. Its only use case (apart from generating more money for CAs) seems like "we somehow can't revoke the certificate, but if we wait it'll expire".

If the cert is revoked, the revocation notice only needs to be published until the expiration date instead of forever.

that's kind of also a really important use case. "There is no reason to trust this certificate in perpetuity, so pretending it hasn't been compromised over a long period of time would be stupidly insecure. Let's expire it after X months". There is no reason to trust a certificate that's older than a year, for instance, there's been more than enough time for someone to reverse engineer the keys if they wanted. The real part you should be questioning is why no one renewed it. It's pretty trivial to set up cert renewal, so why didn't they? Maybe the site's no longer maintained, maybe it's not actually intended to be secure. Important questions.

> There is no reason to trust a certificate that's older than a year, for instance, there's been more than enough time for someone to reverse engineer the keys if they wanted.

Cryptography does not work that way.

> It's pretty trivial to set up cert renewal, so why didn't they?

That holds true today, with Let's Encrypt; their short expiration date seems to exist largely to force people to automate it, and in that regard it seems quite effective. But prior to that, many CAs did not have scriptable automated processes to renew certificates.

> There is no reason to trust a certificate that's older than a year, for instance, there's been more than enough time for someone to reverse engineer the keys if they wanted.

> Cryptography does not work that way.

But it kind of does. Imagine if we were still using certificates signed with DES and MD5 hashes because they were available perpetually. Certificate expiration at the very least means that whenever you renew you're keeping up to date with whatever vulnerabilities have been exploited in the past 3-5 years.

It also keeps CRLs short and concise as those certificates that have expired do not need to be included.

> Imagine if we were still using certificates signed with DES and MD5 hashes because they were available perpetually.

We don't rely on expiration or revocation for that; we rely on clients and servers refusing to use insecure algorithms.

Thanks; I disabled quite a few non-critical addons based on this list and was able get the switch in about:support to flip. Will see if it's worth it! All of the addons I disabled are listed as "unknown" so I suspect they will all just work fine if I forced multiprocess but better safe than sorry. Thanks for the information.

>>> Tree Style Tab 105,213 users compatible

That is all that matters to me

That site listed a few of my addons as incompatible, but turned out that that site hasn't been updated in a while. Example, it lists Lastpass as incompatible, but it works just fine for me.

Lastpass definitely was rough at the beginning, but it's been stable for months for me. And I'm one of the crazy ones running multiple content processes.

You can see on the Add-ons Manager page if a particular add-on is compatible.

about:support shows you if multi-process is enabled " Multiprocess Windows".

> You can see on the Add-ons Manager page if a particular add-on is compatible.

You can? Where? (Of course, it may be a version thing.)

You need an add-on for that: https://addons.mozilla.org/en-US/firefox/addon/add-on-compat...

That's not enough though. In about:addons all my add-ons are listed as compatible, but about:support still says that multiprocess is "disabled by add-ons". So YMMV.

EDIT: The gotcha is that the current release uses a whitelist of only about 20 extensions. If you have anything else, you need to force-enable the feature, even if your extensions are supposed to be compatible. https://hg.mozilla.org/releases/mozilla-release/file/FIREFOX...

How great would it be if that add-on were incompatible with multiprocess?

Firefox: Trouble managing your addons? Here, have this other addon!

But don't worry, we've bundled all these other tools that nobody wants into FF itself!

Yeah, as it turns out, when I installed it actually reported misleading info. (But then the official site misreported too.).

Uninstalled some of the tab extensions I had running and went for "Tab Center" from Test Pilot instead. I'm now running on multi-process and it seems quite a bit snappier overall. :)

How would you force-enable that feature?

Ah ok thanks, didn't realize that this info was only available because I have the add-on installed.

How to check: https://wiki.mozilla.org/Electrolysis#Testing.

I figured this out for myself by doing a force opt-in to multiprocess, and then I removed extensions which were obviously broken.

If you're only using a few extensions (not parent), this could work very well for you.

Simply look under "about:support" tab for Multiprocess Windows to see if enabled or not. You can also force enable it in "about:config" by setting browser.tabs.remote.autostart to TRUE if its not already (note this does circumvent having to disable non-compatible plugins such as Firebug).

I'm stuck as half the addons I find useful aren't compatible.

The two most notable are 1password and Self Destructing Cookies

1Password isn't compatible with multi-process? That sucks. :(

I use 1Pass for everything but I use Chrome right now. I've been eyeing Firefox again (it used to be my primary browser) but that kinda kills the deal for me. I'll probably start integrating it slowly. I can't imagine 1Pass will hold out for too long.

Here is the e10s bug about 1Password and it was resolved fixed in 2015. It might not be included in the initial extension whitelist for the Firefox Release channel but should work if you force-enable e10s or use Firefox Nightly.

https://bugzilla.mozilla.org/show_bug.cgi?id=1042195

I've been using 1Password and a multi-process Firefox without any issues.

It's only the 1Click bookmark feature that doesn't work, no apparent issues with the rest of the extension. Details here:

https://discussions.agilebits.com/discussion/67388/browser-e...

Lastpass + Self Destructing Cookies for me :(

I upgraded to the latest version of the LastPass plugin direct from the LastPass site and it seems to work fine. For whatever reason, the one they have listed on AMO is a whole major version behind.

https://lastpass.com/lastpassffx/

it works, thank you :)

FWIW, I use Lastpass with e10s and it all seems to work OK :).

you have manually enabled the multi process. How ?

Looks like you can either set browser.tabs.remote.autostart=true to soft-enable it, or browser.tabs.remote.force-enable=true to force it on. The wiki[1] does not encourage the latter, but suggests the former may only be available for beta (and more frequent) builds.

[1] https://wiki.mozilla.org/Electrolysis#Testing

I forced it in nightly just now and Self Destructing Cookies appears to be working.

Check about:support.

i.e. Multiprocess Windows 1/1 (Enabled by default)

I forced multiprocessing anyway but i don't know is there any bad effect.

Reply on news.ycombinator.com