What’s going on in the world of extensions

Firefox is going to continue to have more powerful blocking features compared to what a DNS based approach like pihole can provide.

[1]: https://assets.mozilla.net/annualreport/2021/mozilla-fdn-202...

(Most recent example that I have in mind: they switched content dark mode from matching OS theme to matching browser theme in 95, despite quite a few immediate and detailed objections as soon as the patch landed on Nightly—and yes, I’m willing to admit that the change will match what some, perhaps more, users want—but didn’t expose it in about:preferences until 100; to my eye, they should fairly obviously have reverted the change until they had that setting, or at the very least mentioned the about:config pref to restore the old behaviour in the release notes. At least in that case there was still a pref for it.)

It's certain that 2 years from now extension developers will still be getting support requests and receive negative reviews because of that commit, even if an alternative API is released in the next few months. But who cares, it's not you who has to find a solution and deal with users.

All of this could have been averted by simply offering an alternative API in the same browser version in which the new restriction was implemented. There was no pressing need to immediately restrict the API.

> Disallowing the modification of Access-Control-Allow-* response headers will impact extensions that need to download page content.

> Search by Image sets CORS headers for some images in order to download them from the content script before uploading to a search engine. In many cases an asset will only be served if the request contains the correct origin, referrer and cookies. Reproducing such a fetch request was impossible from a background page last time I tested, and even if configuring all aspects of a request becomes possible, it could still open up extensions to security issues, because it's difficult to figure out if certain data types would be sent by the browser if the request would be made from the page context, such as the referrer. We would also need to request additional permissions, such as access to HTTP cookies.

> Extensions used for archiving pages would no longer be able to create faithful representations of the tab content. Advanced ad blockers such as uBlock Origin would be impacted as well. There is a general issue of extensions not being able to access certain parts of the page, such as a tainted canvas in Chrome, or a closed shadow DOM in Safari, and this restriction would make the problem worse.

Thanks, my bad for looking for settings in Settings.

> Is it? I can't find the toggle for extension autoupdates in Edge, and a search only turns up hacky methods for Chrome, nothing specific to Edge.

I can't speak to extensions downloaded from the store, as I only sideload. But when sideloaded, the extensions of course do not update unless you explicitly pull changes in or make changes yourself. Sideloading itself is trivial, even Stable builds provide a "Developer Mode" toggle that allows loading unsigned unpacked extensions from local directories.

Hopefully that can be addressed at some point in the near future :)

Currently I'm using Iceraven which is essentially just Firefox with about a thousand extensions enabled instead of 17.

I completely agree: it is a good rhetorical move. aka good spin. But I don't think we should celebrate that sort of thing in tech blog posts, or in any writing actually unless your work in marketing.