Comments on: Evolving Firefox Extensions

By: blindmurray

blindmurray — Tue, 11 May 2010 21:57:29 +0000

Hello Atul - re security issues (see Generative/Principal Least Auth posts) in JetPack: we use XBL binding and anonymous content markup to insert a glorified textbox (we call it a ’slide’) on a webpage. Using this anonymous-markup widget users can communicate with each other using some backend XHR communications. We have no fear of a malicious webpage trying to scrape the text of the messages people send to each other using our widget (before we have a chance to encrypt it) because the anonymous bits make it invisible to the web page.

Will JetPack retain/offer some kind of ‘anonymous’ content methodology? Will it use/allow XBL bindings?

By: Neues Add-on-System f�r Firefox: Zeitplan steht - Software | News | ZDNet.de

Fri, 29 Jan 2010 12:01:52 +0000

[...] das in der endg�ltigen Version “Reboot” hei�en soll, war 2009 gestartet worden, musste aber wegen anderer Firefox-Projekte warten. Aktuell [...]

By: Status update: January 15, 2009 < Saturn Valley

Status update: January 15, 2009 < Saturn Valley — Sat, 16 Jan 2010 07:44:48 +0000

[...] be used but helped me learn more about how the new platform works. Started a reboot FAQ with Atul and submitted a small patch. Would like to port the prototype’s simple JSON-backed storage to [...]

By: Tase

Tase — Thu, 14 Jan 2010 00:16:38 +0000

So you’re not just restarting the browser, you’re rebooting now… Great…

By: Mark Finkle’s Weblog » Add-ons and Restarts – Yuck!

Mark Finkle’s Weblog » Add-ons and Restarts – Yuck! — Wed, 13 Jan 2010 14:29:24 +0000

[...] mechanism. In fact, Fabrice Desré found a nice bit of news on an upcoming feature (via comments on Atul’s post): Fabrice: Does the fact that jetpacks are now XPIs mean that the “no restart after install” [...]

By: Atul

Atul — Tue, 12 Jan 2010 17:47:59 +0000

Yarr, what Mossop said. Right now the XPIs generated by the Jetpack reboot don’t even have a chrome.manifest, and while they currently have an XPCOM component to “bootstrap” themselves, this will be converted into a separate “bootstrap.js” script once support for loading such a script is added to the Extension Manager.

By: Mossop

Mossop — Tue, 12 Jan 2010 17:33:17 +0000

@Fabrice: I’ll just elaborate a little. Plans are naturally in flux right now but the idea is to allow XPI packages to install without restarts if they wish, however there will be constraints. They will be responsible for doing everything themselves, which means (at least in my head right now) we won’t automatically load chrome or components from these extensions. Instead we will just do startup and shutdown calls into the extension and allow it to register/unregister what it needs by itself. This means that just marking an existing extension to work without restarts wouldn’t get you anywhere, you still need to do the extra work to handle the startup/shutdown parts.

By: Atul

Atul — Tue, 12 Jan 2010 16:45:51 +0000

@Fabrice: That’s correct! We don’t have a bug filed for it yet, still need to do that, but the idea is that if an extension includes certain metadata in its install.rdf that essentially tells Firefox “look, I know how to unload all my resources reliably”, then Firefox will trust it and call a certain function whenever the extension needs to unload itself.

That said, actually making an extension capable of unloading all its resources on demand isn’t easy, though, but Jetpack itself is being designed from the ground-up with this in mind. Nonetheless, we’d like to leave the ‘hook’ in there for traditional extensions to take advantage of, if extension authors are willing to put the effort in to add resource unloading functionality to their code.

By: Fabrice

Fabrice — Tue, 12 Jan 2010 14:49:38 +0000

Does the fact that jetpacks are now XPIs mean that the “no restart after install” feature will be implemented for traditionnal add-ons ?

By: Atul

Atul — Tue, 12 Jan 2010 14:22:00 +0000

@dafi: Yep, we’re using the CommonJS module standard.

@Fabrice: Sorry for that confusion; we’ll have to update the link on the labs post. I’ll post a comment to your bug so we can continue working on that in the reboot—thanks for contributing!