The next talk is about where are we with our arms or something similar to that?
Have fun.
Thank you very much.
Hello everyone, it's a pleasure to be here.
This is my second time at Boston.
I will pretend that I know what I'm doing.
Last time Rob and I well ran over, I think this time I'm going to come in under.
So we can actually have Q&A this time.
So my name is Simeon Vincent.
I'm a developer relations engineer on the Firefox Atoms team and I want to give you a quick
recap of some of the stuff that we've been working on, some kind of major features and improvements
over the past year and some of the collaboration that we're doing with other browsers.
So let's start on a answer in the question.
What is the current state of Firefox Atoms and spoiler?
I'm biased, but I think it's pretty good.
And we are continuing to work on it and make it even better, both the Firefox team and the surrounding
community that we're very happy to be a part of.
So some quick stats to set ground rules or kind of expectations on where we are today.
At the moment we have about 46.5,000 extensions published on AtomsAtmosil.org and that number
I believe is growing, I don't have historical data right now, but about a year ago, actually
December 2023, we launched support for Android or more accurately, we opened up extensions
to be generally available on Android.
Where we had a limited curated tiny set of about 20 add-ons and since then we've gotten
a total of almost 100,900 add-ons available on Android and we've seen steady growth
in this category that developers continue to adopt at a pretty good clip and they continue
to publish useful extensions that people are getting real value out of on a regular basis.
Add-on usage continues to grow over the past five years, you can see a steady increase
in the number of individual users that have at least one add-on installed in the browser.
And I think this one is pretty interesting.
The distribution of users that have a given set, these numbers are kind of small, but
so the first column is people that have zero or a hidden number of add-ons.
Sorry, the number of users that are using a given add-on, the next category is up to 10 users
and then we have 10 to 100, 100 to 1000, 1000 to 10,000, et cetera.
What this tells me is that we have one of the things that makes add-ons really interesting
and powerful is that there's an incredibly long tail that people are finding
value for themselves and for their small communities and being reaching users that way as
opposed to just everybody piling on to the kind of current most popular experience.
I think that it's also a unique differentiator compared to other ecosystems.
Over the past year, we've done a number of improvements to the Firefox client, the platform
and I want to start with a quick look at some user experience improvements that we've made.
First, user scripts is a feature that we're going to be relaunching.
There was an existing user scripts API and in collaboration with other browser vendors
and members of the community, we've developed a new user scripts API for the latest version
of the platform, manifest me three.
In Firefox, we're going to be shipping that in a belief, we're flipping the flag for 134.
136, thank you, Rob, as the engineer has been working on that.
So I want to take a quick look at the user scripts experience here.
As you can see, when you first install in add-on, or in this case, the add-on is exposing
the ability to opt into using the user scripts API in its options page.
By default, when you install it and add-on that uses the user scripts API, it doesn't just get access to it,
because it's a very dangerous, very powerful capability with power comes danger.
We want to keep user safe and informed, so users have to choose to invoke this grant access to user scripts API.
The extension is going to request access from it when the user clicks the button.
And then the user has to choose to allow the add-on access to this capability.
This says, allow unverified third-party scripts to access your data.
Again, very dangerous, we want to make sure that the people who are doing this know what they're doing.
If they don't, then we want to make it hard for them to do it by accident.
And once you've enabled that checkbox, you can allow it, and then you now, that extension can now give you these powerful capabilities.
I also realized I didn't actually say what users scripts are.
The current user script model is essentially like a piece of JavaScript that you inject into a page,
and that JavaScript usually is developed by a third-party, but you can write it yourself.
And it will allow you to customize how a web page behaves.
And users scripts notably, Greece Monkey, was a really popular user script manager.
That the developer of Greece Monkey worked on Chrome's extension model,
and then Chrome's extension model is what Firefox adopts, and is the current platform that's being adopted across all browsers.
So in addition to that user flow, you can always go to the add-on settings page and manually enable it yourself as opposed to the extension having to ask you.
This is important because you have control, even after you've installed it, even after you've enabled it,
you can go through the permissions and make sure that the things that you want the extension to have access to are the only things that it has access to.
In the past year, we've also done some pretty big improvements to the debugging experience.
There have been a number of bug fixes, but the one that I want to call out in particular is the debugging experience for background scripts.
So there was kind of a longstanding bug where as you're developing your code and making changes,
you would save a change, you would refresh it in Firefox, and you would not see any update in DevTools.
And that affix for that has recently landed.
So now, after you make a change, you can click the reload button and put the console.log there a few years at the end,
because that was the new line of code that I added.
Content scripts are a piece of code that the extension can inject into the websites that you visit.
And we've had a couple of improvements and new features related to content scripts over the past year as well.
Specifically in DevTools here, we now have the ability to go into the sources tab, select the gear icon,
and then select ShowContents scripts, and now you can see all of the content scripts.
Previously, you had to go into the extensions debug experience that was separate from the pages you were visiting.
And needless to say that was a little cognitive dissonance.
So this is another great improvement to just the general productivity of building extensions.
Another thing that has recently landed, I believe it was in 135 and not 100%.
Is the ability to switch the context for the console.
So specifically here, we just loaded the content script so we can see the utility asked from privacy
Badger in the bottom right.
I just, in this case, type of browser, because browser is the global namespace that extension
capabilities are exposed on. And normally, the browser global doesn't exist on a web page.
That's only exposed to extensions. So what you can see here is in the bottom right.
You can click on this selector, and we can go into privacy Badger specifically into the
content script context for it. And then when we type type of browser, we can see that this is now an object.
The global variable that we expected to exist is now present.
The other thing I want to call out is over the past year, we've had a good bit of collaboration
with other browser vendors. A quick crash course on web standards. I know a decent number of people
here are involved in this space, but some folks may not be. So the W3C is kind of the premier
organization's web standards. The worldwide web consortium, they are the body that handles a lot
of standardization of web platform APIs. They have a variety of groups and kind of substructures
where specific people are bringing on different areas. We have about three and a half years ago
established the web extensions community group, which is a body, as the statement flies, it's a
community group as opposed to a standard body. But this is the forum that the various browser vendors
and members of the community developers have been coming together to talk about what the platform
is and where we want it to go in the future. So our kind of main goal, the main things that we're
focusing on are reducing inconsistencies across implementations and evolving how browser extensions
look and feel. And if you're at all interested in this process, we meet every week,
meetings, everybody's favorite topic. We meet every other Thursday at 8 a.m. Pacific to discuss
issues and try to advance the current state of the platform where we have also for the past two years
been joining in the W3C's annual conference, T-pack. It's a terrible name. I don't want to
explain what it means. Pretend it doesn't exist. It's the W3C's annual conference. We're also meeting
on the other half of the year at face-to-face meeting. Last year Apple hosted the first one at their
San Diego campus. This year Mozilla is going to host one and Berlin. And we're going to be
formally announcing that in just a couple days. There's much more that I wish I could talk about,
but I think that we're going to go over to questions now. If you're interested in getting into
extension development, I have a couple of resources, strongly encourage you to visit the
Mozilla discourse in the Adon's channel. Ask questions. I'm happy to do whatever I can to
support your work and explorations there. Extension workshop is where you can find a lot of information
about developing Firefox Adon specifically. And obviously, MDN has general web platform API documentation,
including on the web extension platform. And if you have questions for me,
you can reach me on Maskevon and Luskai. And I also hold open office hours where you can
schedule time with me to talk about your development experience. No, no, they're going to ask
the questions now. Thank you. Do we ask questions?
I noticed that, well, many extensions have used the permission to access the data on all websites.
And it's very capability to, like, revoke that permission. Because many of those extensions
are still usable without that capability. Is it possible to just revoke,
whatever they're asking in their manifest, some of them? If in Firefox, it isn't currently
possible to, that's actually kind of a lie. It is possible to revoke access, but it's not as granular
as we would like it to be. That's a feature that we're investigating, I believe, more generally
at the standardization or cross browser development level. I think we all recognize that
access to all pages that user visits are super powerful and dangerous, especially passive access.
So it's something that we want to improve, that we want to change, but it's also really hard,
both reclaiming or restricting the abilities capabilities that people currently have.
Nobody's excited to give up power. And figuring out how we can build a better extension
experience in a way that minimizes access is an ongoing area of discussion or exploring ways
to design new APIs that will hopefully enable that stuff in the future.
Hello. I would like to ask you that extensions, which modify new new
top, lost their ability in last versions to clear the URL bar, and there's open issue for that,
and there is no closure to it. If do you plan to look into it or do you have people decided
if this API will come back? I am not familiar with that particular change.
If one of the Firefox engineers here is able to speak to it, otherwise I'm happy to follow up with
you asynchronously to look into it. There are a handful of people that work on the add-ons team here,
that probably has more technical expertise on the details.
This is question from the chat. I see some extensions of Firefox Marketplace have this kind of
disclaimer. It's not active, monitored by for security, by much help, make sure you trust it
before you're installing it. How does this happen and how can the developer avoid this?
That, I don't think I have a great answer there. So, by default,
when somebody publishes a new extension, it will fall into that category of extensions that are
unmongered. Generally speaking, I believe the scrutiny applied increases as user count does,
but I actually would prefer to defer to Andreas, if you don't mind, to give a little bit more detail.
Andreas, as a member of the add-ons team and focuses on operations.
One way to remove that banner removed is through our recommended extension set.
So, we have a curated set of extensions that Mozilla officially recommends. They get a shiny new batch,
they get boosted in the search results, and they also have that banner removed.
Actually, on the extensions workshop site, if you go to that website and search for recommended extensions,
you will find a page about what recommended extensions are, what our criteria are,
for considering recommended extensions, and also how to apply for an extension to become recommended
either your own extension or an extension that you just like as a user, you can nominate your own
or any other extension that you found.
I was hoping I would be able to find it as you were talking.
Alright, thanks for the presentation.
I only have two extensions installed. One of it is authored by Mozilla itself.
I was, because it's hard to trust third-party, so I narrowed down.
Is there any sort of framework to basically promote an add-on into Firefox itself?
Is it not the end of it?
I'm going to say not exactly. In fact, I think there's been a history of taking some features
that were originally implemented in the browser and moving them into extensions that are
separate and maintained. The multi-account containers is an example of that.
Again, I want to look to the engineer and team to say,
do you have more experience on the rolling something into Firefox?
Or has there been any capabilities that have been developed externally in the added?
For the audience, Luca, stop.
So we had a reply, but it was an audio. We're going to get the same reply on audio now.
So screenshot is the best example that comes to mind. It started as an experiment,
so it was user installs the extension. It was a test pilot, I think, experiment.
Then it was promoted to be like a system add-on, which is like same code-based, but integrated
into the Firefox build, so you don't need to install it. And more recently, we
turn it into an integrated component, so it doesn't leverage the extension framework
is more integrated, so it's kind of more performant in some ways.
I think there have also been a couple of projects, most notably PDFJS. I think isn't
integrated into Firefox and Chrome. It's like correct Chrome.
There's another question. We'll come back to it and it was like it.
Yeah, I'd just like to echo the first commenter with, we need some kind of restrictions,
because there's no reason my crypto wallet extension needs to access my bank in website.
So there needs to be something there.
In particular, I think one of the features that we've been considering is the ability to
add exclusion sites, so you can specifically prevent extensions from accessing your most sensitive
component. And the second is just saying thank you to whoever approved the video background fix
in the early set of Firefox mobile, because it managed to sell the browser to my friends.
It's a perfect YouTube plant.
Just building on that, I have one of the things that I really like about extensions.
Why I'm kind of dedicated to this space is they enable user choice to a degree that you don't
see in other computing environments that we give people the opportunity to choose the experience
that they want on the web. And I think that's part of why we continue to see growth in extension
adoption across the browser users. I think there was a question in the back.
Sure, coming. And that's the last question, because if we don't stop questions, then the next talk can't happen.
I noticed that extensions don't fall, the cannot use SSO information.
And so you come to have single sign-on through an extension. It doesn't have access to the
guru or sticket. Is there any way to get fixed?
I'd be happy to dig into that a bit more. I don't quite follow because if extensions have
host permissions for the single sign-on origin, then they have access to the cookies on that.
And it should be possible to implement a single sign-on experience in a way that works in a browser extension.
Thank you very much.