Hacker News Reader

Comment by erikpukinskis | Hacker News Reader

I don’t get it, the concern is that Firefox sends telemetry to Mozilla? Can’t you turn that off?

AFAIK the main selling point is xul (legacy) extension support.

I guess if someone really needs to use a legacy extension, it's a good thing that it's around, but I'm personally glad that XUL is dead both from a developer standpoint and as a user.

Yeah, projects like this give me the heebie-jeebies, to be honest. NPAPI and XUL were discontinued for really good reasons. Some users say they still want them, but that's because (1) people hate change, even when it's good for them and (2) they don't really appreciate all the security baggage those old APIs were lugging around with them. Projects that assure those users that they can keep on trucking with their old plugins like there's no problem just encourage them to do dangerous things they really should not be doing.

The problem is that the replacement is crippled and Google is clearly more interested in stripping features from the extension API. I'm still waiting for a way to hide the tab bar which is a privileged UI feature now.

I'm not sure what Google has to do with this, but Mozilla have been adding features to the extention API since Quantum first came out.

Being compatible with the Extension API doesn't require Mozilla to follow Google on every decision. As long as the deviations are well documented and developers perform feature detection, Mozilla won't ever have to make changes that serve the interests of Google ahead of their users.

> "I'm still waiting for a way to hide the tab bar which is a privileged UI feature now"

userChrome.css to the rescue:

- Tree Style Tab's wiki offers tips to do exactly that: https://github.com/piroor/treestyletab/wiki/Code-snippets-fo... .

- Or you can combine the address and tab bar: https://github.com/rstacruz/firefox-stealthfox

If none is to your exact taste, https://www.reddit.com/r/FirefoxCSS/ may help.

That's the correct solution for now, but we can only hope Mozilla won't disable the ability to use these files. They're disabled by default in FF 69: https://www.ghacks.net/2019/05/24/firefox-69-userchrome-css-...

And the key to reenable them has legacy in the name:

    toolkit.legacyUserProfileCustomizations.stylesheets

Thanks for pointing that out. I'm worried too:

- At first, the discussion on bugzilla [1] is reasonable: user stylesheets off by default for performance, and there's even backward compat code enabling the pref during Firefox 68 if you are using them. All good...

- ... but then comes this legacy in the pref name :-| :-| :-|

I hope Mozilla keeps the feature alive, it's appreciated by many "power" users.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1541233

EDIT good news: re-reading recent comments, in https://bugzilla.mozilla.org/show_bug.cgi?id=1541233#c61 , Florian Quèze (mozilla dev) affirms: "the word 'legacy' was used in the preference name to avoid giving the impression that with this new preference we are adding a new customization feature. I'm not aware of any plan to drop support for these files".

That is good news, thanks.

Ugh, if you're gonna pull this shit make sidebar tabs first class! They knew this way before they switched, gave some lip service to make sure the most popular extensions would get the support they needed, and now however many releases later i still have to dig through hidden files and hash-named profile directories to make this work right. And still no usable alternative to tab groups last time I checked, which they took out of core with the reasoning that it should be an extension. At least adblock still works.

http://www.xuldev.org/scrapbook/ https://github.com/danny0838/firefox-scrapbook/wiki/Intro

There's zero hope of implementing something like the unfortunately named Scrapbook Plus & Scrapbook X research addons. In-browser editing & powerful manipulation, full text search within saved pages, direct access to the saved archives, the sidebar, the specialized capture options and quite a bit more require features (XUL-based and otherwise) that Mozilla won't implement. It's the biggest thing keeping me on Waterfox beyond Mozilla continual slide into sleaziness on privacy and afaik no browser not based on pre-quantum firefox supports anything like it.

Beyond research or archiving pages I think will disappear If I want to yank the content from posts across five sites, clean it up quickly, merge it into a single document and export it for conversion with calibre it's trivial with Scrapbook X and a pain with anything else I've tried. If I want to archive everything that I look at while digging into a topic or site I just turn on auto-save and start browsing. I'm fairly certain having no replacement for a major part of my workflow & browsing habits doesn't mean that I'm anti-security* or I'm scared, but that Mozilla no longer supports the tools I need. I'm grateful that Waterfox does.

*It's almost a hobby: Firejail, uMatrix & NoScript in paranoid mode, rejecting all cookies by default & extensive use of containers, different vpn connections and separate profiles for different kinds of browsing, etc.

Saying that "people hate change, even when it's good for them" has to be the most arrogant thing I've read today. If someone is most comfortable using their browser with a certain extension for which there is no good WebExtensions-based alternative, how can you say that forcing them to stop using that extension is "good for them"? Even if there is a suitable alternative, which requires re-learning a bunch of things the user is used to, how is that change "good for them"?

The move away from XUL and NPAPI is great for Mozilla, it makes it easier to maintain and develop the browser, it's probably good for extension developers (except for those who now can't port their extension to the new API because it's more limited), but it's not good for users who are forced to take time out of their day to find and alternatives or users who just have to accept that what they were previously using their browser for just isn't possible anymore with Firefox.

Saying that change is "good" for users even if the users don't realize it and resist, prevents us from considering the very real negative effects of introducing breaking changes or removing features of our software.

> If someone is most comfortable using their browser with a certain extension for which there is no good WebExtensions-based alternative, how can you say that forcing them to stop using that extension is "good for them"?

If supporting that extension requires exposing the user to security risks.

The downside of “extensions can do anything!” is that it means extensions can do, well, anything, including things that are hostile to the user’s interests. A more restrictive API means some things extensions used to be able to do aren’t possible anymore, but that’s as true of the bad things as it is of the good. And the bad things were bad enough that it was worth losing the good ones to protect users from them.

Look, I get it, it sucks to lose an extension you like and rely on. I lost a couple of these in the move myself. But the browser’s first responsibility to the user is primum non nocere: “first, do no harm.” And those old APIs, which were naïvely designed twenty years ago in a time when the Internet was far less weaponized than it is today, were exposing an awful lot of people to a great deal of harm.

> The downside of “extensions can do anything!” is that it means extensions can do, well, anything, including things that are hostile to the user’s interests.

This is also arrogant: why do you think it is OK to say I can't do something I want to do because it is possible that I use that freedom to do something that harms my own interests? People fundamentally should be allowed to do things that harm them if blocking them from harm restricts their ability to do things they wanted to do; I mean, you aren't even suggesting some kind of user-controlled sandbox: you are advocating for putting the user themselves in a sandbox because you think they are too stupid to handle power.

I'm not trying to argue that Firefox shouldn't have deprecated XUL or NPAPI. I'm one of the people who didn't depend on any add-ons which aren't available anymore; I just had to update the add-on I wrote to work with the new API, which was easy because it's one of those add-ons which essentially just needs some javascript to be injected into all web pages.

I'm just saying that when Mozilla decided to break the browser for many people, it wasn't "good for" the people who ended up with a browser which doesn't let them do what they want. It's not even "good for" the people who "only" had to invest hours into learning a new workflow with a new set of add-ons. Pretending that it is, is harmful; there are very real drawbacks which have to be weighed up against the advantages of a cleaner API which it's easier to maintain and which might be more secure. I think Mozilla absolutely made the right choice; I just don't think we can focus exclusively on the benefits and pretend that the costs don't exist.

I'm also kind of curious about how the security angle works. Currently, any WebExtension which asks for the proper permission can just read the content of your banking websites if it wants, and send what it finds (your social security number, your password, your bank account numbers, etc) to an attacker. With the new API, you still have to make sure not to install malicious add-ons. How is that different between XUL and WebExtensions?

And (3) they are still having to support old broken shit at work which requires NPAPI plugins or even shudders java. Not everyone lives in a tech utopia.

... And (3) we lost perfectly good extensions that we were using.

Not me. I lost DownThemAll[1] and TabWheelScroll after the extension overhaul

[1] https://en.wikipedia.org/wiki/DownThemAll!

I loved DownThemAll, but I'm not sad to see it go because I realised how rarely it was actually needed these days. The downloading interface built into Firefox really is fine 99% of the time.

On the rarer occasions that I need to download extremely large files, I send them to an HTTP download client (pyload) that runs directly on my NAS in docker.

I didn't really use the segmented downloads feature. The important part of it for me was the fact that I could download all the files of a particular type and download URL ranges. Stuff like https://example.com/[0-999].png.

You can do that rather easily with curl (comes with Windows nowadays) or wget. Just copy the resource location of the object you want as curl command line string from developer tools (cf https://stackoverflow.com/a/33384016 ) and adjust the range (same syntax as DownThemAll) and download it manually.

One thing that DownThemAll got right that I am not sure any other downloader I have found does is that if a download is terminated by the server before the reported file size of the file had been downloaded, it would see that as a failure and retry. Unreliable servers often terminate the download partway through and it seems most other download mangers, browsers etc. will just leave the truncated file on the disk and report the download as successful, not allowing you to continue from where it got to.

Yes, and I remember really appreciating DownThemAll's quite robust architecture back when I had a 1.5 megabit ADSL connection. But now that I have a 100 megabit connection at home, I'm rarely downloading anything that doesn't finish within 5 minutes. In the exceedingly rare event that a 10GB download fails, it's just not a big deal to start it again.

Obviously this doesn't apply to everyone.

And FireFTP http://fireftp.net/! Man did I love FireFTP

I don't care about the technical details as a user as long as I can get the functionality I want. I want to be able to move UI elements around like menu bars, tabs, bookmarks bar, address bar. I need DownThemAll or something equal to it to work because I use it a dozen times a day.

I am glad Mozilla made the much needed change and don't have long-term problems with Mozilla other than perhaps lack of trust. I did not like how Mozilla made the swift change with little announcement for long-term add-ons though, particularly making the change right after allowing for multi-processing.

My recollection of the change is that they did announce it well in advance, but left many of the needed replacement APIs missing or broken until it was far too late for many developers to make the switch before XUL got deprecated. (We're still feeling the effects of the lacking WebExtenions APIs, actually.)

It was a bit of both as I see it. Tab-groups developer quit soon after rewriting the add-on to fit the multi-processing update (which was announced several years in advance I believe, and was anticipated nonetheless), and then right after Mozilla announced the depreciation of XUL in favor of WebExtensions in a year's time, forcing another rewrite and wouldn't be fully functional until the replacement API's are developed.

Besides, that replacement API's haven't even now been fully developed points all the same to Mozilla forcing WebExtensions much too quick, as waiting more would have fixed this problem from occurring.

I'm still waiting for a working vertical tabs extension that doesn't leave the tab bar across the top wasting space. Dumping XUL is why it's hard to see firefox as a viable browser.

You can still remove the top tab bar in the current version of Firefox, though it is significantly more annoying to do so than it used to be.

https://github.com/piroor/treestyletab/wiki/Code-snippets-fo...

To this day I miss vimperator. There are substitutes but they don't come near the glory of vimperator.

That was my determination as well. Reading the features of the browsers just lead me to believe they were unhappy with the changes Mozilla was making to Firefox which both improve security and performance.

I wonder what performance is like? I can't imagine it's great.

I suppose the difference is that in Firefox you have to opt out of it, and in Waterfox you opt in (?). The default makes a difference, since most users don't know about it.

It's about the audience. People who don't know or care about telemetry tracking are also probably not going to know about Waterfox.

The ones that do know about waterfox are probably technically savvy enough to disable telemetry in regular old Firefox.

Reply on news.ycombinator.com