logoalt Hacker News

kevincox10/01/20241 replyview on HN

> removing XUL

Nah, XUL had to go. The other stuff wasn't really related. It was a more "if we are going to break most extensions we may as well use this time to push everything else we want". If anything XUL is a scapegoat.

I know because I maintained VimFx for a while after the XUL removal. It was difficult to keep up with internal APIs that are changing, but I can't blame them, they need to develop their product. The thing that really made me give up on maintaining VimFx was the signing enforcement. They just keep tightening the screws so that I couldn't even run "my own" code with any reasonable UX.

What I would have like to have seen:

1. Provide WebExtensions as the recommended way to do things with some compatibility and deprecation guarantees.

2. Stop caring about compatibility of other APIs.

3. Still allow outside "full access" extensions that use those internal APIs. You can give warnings in the store "this extensions uses unsupported APIs and may break at any time and steal all of your personal data" and make the install button bright red but still allow it.

4. Keep supporting self-distributed extensions with developer managed signing keys and update URLs.

Since there are no compatibility guarantees on these APIs it wouldn't have been much extra work. Just a bit of UX work to add scary warnings and maintenance of the non-store update code.


Replies

irq-110/01/2024

> 4. Keep supporting self-distributed extensions with developer managed signing keys and update URLs.

Mozilla followed the big corps in the 'store' model, instead of keeping it open free-form. We might have a viable developer certification trust system by now, but with that too, only the corps have enforced signing systems (that are closed and fragmented.)

show 1 reply