Hacker News new | ask | show | jobs
by sfink 1321 days ago
At a high level, I believe that's the plan.

At a more detailed level, well... I'm not that familiar with the area, but it seems like it's a bit of a tangled mess.

The big item of disabling non-declarative content blocking seems safe. Firefox appears to have no reason to turn that part of MV2 off.

The various security tightening measures are another story. My guess is that with Chrome removing higher-risk APIs like dynamic code evaluation, Firefox is using it as an excuse to do the same in order to not have to deal with the issues that arise from them. Which isn't great from the point of view of extension capability. Personally I'd prefer to err on the side of scary permissions notifications for that sort of functionality.

Or at least some of it—I'm not convinced that allowing an extension to execute arbitrary code loaded over an insecure HTTP connection is ever a good idea, except for some temporary development mode thing. (Sure, that's exactly what happens with a random web page containing JS that's served over HTTP. But there's no need to support that case for extensions that are active across all of your browsing activity.)

But it sounds like the removals go well beyond that.