Waterfox: Why are 64-Bit NPAPI plugins and unsigned extensions listed on your feature page?

[baimafeima]

Among the features there are also the following two listed:

• Allow running of all 64-Bit NPAPI plugins
• Allow running of unsigned extensions

Could you explain why you would continue supporting legacy plugins like NPAPI plugins when they are widely considered unsafe to use? In what way would allow running unsigned extensions be of any advantage to ensuring the safety and privacy of your users?

[foxpy]

That's the users' choice to install unsafe plugins. They do whatever they wish as in freedom.

[baimafeima]

@foxpy How do you define freedom then?

[criztovyl]

Freedom = Do whatever you want.

You could exclude things leading to slavery, but not insecurity :)

[criztovyl]

Regarding your question I would like to contribute my personal opinon on this.
I agree with you that those two features do not actively increase privacy and security, but they also do not decrease it per-se.
More general the aim less at privacy and security and more at freedom, more letting the user decide what's good and bad, not an foreign entity.

[PandaCodex]

Cyberfox has all plugins disabled by default controlled by a user preference, with addition on separate controls for java, flash and silver light including a plugin white list. Be nice if this system could be ported over to Waterfox. This would protect users out of the box from vunrable plugins or outdated ones, but allow users who need these plugins to still be able to use them.

I think its a great security option that would be nice to have in Waterfox

[WagnerGMD]

From my point of view, Cyberfox is one good example but it won't be perfect. Unless one day they clear the little confusion (or mess) about the plugins (like on this article]
Once again from point my of view, it isn't very clear. Because as you can see on this picture, you can guess the fact no all the plugins aren't disabled (by default) and I don't understand why they forgot them... I had read it several times and my point hasn't change (the sentence (or warnging) is about all the plugins and in the reality it's sound like a lie).

[PandaCodex]

@WagnerGMD they are system plugins, shipped in the browser and controlled by a preferences in about:config, they are not Flash, Java or sliver light and are not like other plugins.

They are also written differently than NPAPI plugins, technically they are more a module than a plugin one being a codec for WEBRTC.

If you installed a plugin or have installed plugins they are not shown, message says missing something? then provides information you can view in the browser about it. Easy to understand as that notification only shows if plugins are disabled, its big bright red, unless you fail to read or learn more then onus is on the user as technically the developer can't make you read the information made available. Other notifications about this is shown to think a page opens when install or update not 100% sure.

[WagnerGMD]

No @PandaCodex you didn't understand my point.
Perhaps you could read again ? Nevermind, the answer is simple : It can't be... I have read it (like I said several times) but form my point of view, I was expected another result. That's why I'm wonder if it woudn't be better to disable all of them ? Or to rewrite this sentence to be more precise ?
And I'm aware about the difference between them but I have one reason : because it will avoid the confusion.

PS : It won't be my fault :

• there are all listed on the same page about:addons#Plugins. At the end, we might don't care about the difference and it will remain the same thing (only plugins to resume).
• and the sentence hasn't change : "[...] ships with all plugins disabled by default!"

[baimafeima]

@Rikk You've downvoted my original post. May I know why?

[Rikk]

Because you are defending the second worst change made by Mozilla (the first is discontinuing traditional extensions). Using unsigned extensions is a must for me and for anyone who needs extensions that are not updated anymore, unsupported, or that I modified by myself. And because this is another case where Mozilla is trying to cut down users' choices. Finally, I think 80% or more of existing extensions can't or simply won't be converted to webext format.
PS: Mozilla couldn't even make multi-process mode work properly with a very big amount of extensions, now they simply want to kill the only thing that helped Firefox replace IE and give headaches to Chrome: the diversity of extensions. The new format is not ready to replace the old, and while there aren't enough replacements, this discontinuation is completely unacceptable in my opinion.

[grahamperrin]

Focus: choice

https://web.archive.org/web/20171010/https://www.waterfoxproject.org/

... Waterfox focuses on giving users choice ...

[Squall-Leonhart]

"Those who sacrifice liberty for security deserve neither" - Benjamin Franklin.