Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I applaud the MemShrink team for their effort in finally fixing FF. Forgive my ignorance but why are these leaks possible in the first place? Shouldn't the browser manage and constrain plugins (sandbox?) to prevent issues like mem leaks from even being possible? I understand the high level description of the patch but I don't understand why this wouldn't have already been part of FF's plugin management system. It seems like a pretty basic and core concept.


Remember that Firefox was originally intended as a minimalist platform, with the expectation that users would use its extension mechanism to build it up according to their needs. As a result, Firefox's extension mechanism is quite liberal. The upside is that its extensions are capable of much more than, for example, addons in Chrome. The downside is that extensions are responsible for much more, and can touch basically any part of the program (which is why powerful addons are so prone to breaking with new versions of Firefox: they're effectively targeting an unstable API).

Chrome addons are less prone to breakage and mischief, because Chrome addons target a stable API with a limited set of functionality. Firefox introduced just such an API last year, called the Jetpack API (it may have been renamed since then). You can tell if an extension is using the Jetpack API if it doesn't require a browser restart to install.


"You can tell if an extension is using the Jetpack API if it doesn't require a browser restart to install."

Not necessarily. "Traditional" extensions can be extended to support being restartless as well if they implement the necessary hooks.


I assumed it was something along these lines, thanks for making it clear.


There is a tradeoff between how powerful addons can be and how much they are sandboxed. Firefox errs on the side of letting the user control their browsing experience. This patch reins in addons a tiny amount to eliminate a very common source of addon leaks.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: