Opting-in to plugins in Firefox

11 April, 2012 § 84 Comments

Whether you hate them or love them, content accessed through plugins is still a sizable chunk of the web. So much so, that over 99% of internet users have Flash installed on their browser. However, plugins can also carry with them extra vulnerabilities and system slowdowns.

A couple days ago I landed an initial implementation of “click-to-play plugins” in desktop Firefox. To see and play with the feature, download a Nightly build of Firefox, go to about:config, and enable the plugins.click_to_play flag.

When plugins.click_to_play is enabled, plugins will require an extra click to activate and start “playing” content. This is an incremental step towards securing our users, reducing memory usage, and opening up the web.

I’m currently working on implementing the ability for plugin activation settings to be remembered on a per-site basis. I hope to get these changes landed within the next week before the deadline for Firefox 14.

If you are curious and want to learn more about our plans for opt-in activation of plugins, you can take a look at the feature page on our wiki.

Tagged: , , , , ,

§ 84 Responses to Opting-in to plugins in Firefox

  • aceman says:

    The text in the plugin placeholder says “to activate plugins”. I hope clicking it only activates the one plugin instance needed to play that object, and no other ones on the page.

    • msujaws says:

      Many sites have a visible plugin but also some invisible plugin objects to help the visible one do their work. This means that we currently enable all plugins on the page. This behavior isn’t final yet.

  • h.a. says:

    would be great if click to play worked for html5 mediatags too
    sometimes they are as annoying as plugins!

  • Jan! says:

    Thank you! Now I no longer have to switch between completely enablin and disabling Flash just to view those YouTube videos that are “currently unavailable” in the HTML5 version.

  • Marc says:

    Excellent, thanks!

  • [...] developers are considering making web plugins like Adobe Flash an opt-in feature. Although there is still a long way to go before it’s ready for Firefox proper, switching to an [...]

  • Chris Ilias says:

    This looks like more of an annoyance. What problem is it trying to solve?

    • msujaws says:

      Our first priority is to not make it annoying :)

      Our main motivation is based on security, with other motivations around memory and snappiness of the browser.

  • Lozzy says:

    Not sure about others, but I really welcome this new direction. I honestly feel plugins are due to be deprecated in general at this point. I know that’s extreme, but I’ve felt for a long time that the drawbacks of plugins seriously outweigh their advantages. With all major browsers adopting this stance that’s looking more and more like an option. I have to commend Apple’s contribution of prohibiting all plugins in iOS.

    If nothing else, I feel this will help encourage devs against using plugins. Assuming that’s the case, I look forward to a web of increasing openness, and all that brings; more customisation choices for users (Userscripts, browser defaults like disabling autoplay), more attention and collaboration around plugin replacement technologies like video/canvas/WebGL and all the other benefits from getting rid of the black box which plugins are.

    All in all, looking forward to this. Only worry I might have is that some of the proposals around the permissions system seem a little diluted and could easily be harsher to plugins/give users more control.

    • msujaws says:

      Thanks! Getting the permissions system correct will require input from the full Mozilla community, so I appreciate your feedback. Our end goal is a system where websites are easy to use and users have a low chance of getting hit by drive-by exploits in plug-ins.

  • [...] developers are considering making web plugins like Adobe Flash an opt-in feature. Although there is still a long way to go before it’s ready for Firefox proper, switching to an [...]

  • Simon says:

    How does this interact with sites that try to detect whether a particular plugin is available? I’ve sometimes had issues with plugin-blocking extensions, where the site has concluded I don’t have Flash / Java, and never given me the opportunity to use click-to-play.

    • msujaws says:

      We still have some more work to do around this. The first step is to not fallback if the plugin is installed but being blocked by click-to-play. Other issues that may arise is if script on the page is trying to communicate with the plugin and the script times out while trying to interact. This latter issue is a harder one to solve, and may require work by the website authors to add an event listener for the PluginClickToPlay event.

  • zpletan says:

    Been wanting this for a while, but never knew how to ask. I hope this eventually makes it (even if disabled by default) to stable.

    • msujaws says:

      This preference will be in Firefox 14 (mid-July), but disabled by default. We are continuing to work on the feature and hope to get it enabled by default some time after that.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

What’s this?

You are currently reading Opting-in to plugins in Firefox at JAWS.

meta

Follow

Get every new post delivered to your Inbox.

Join 1,004 other followers