Opting-in to plugins in Firefox
11 April, 2012 § 84 Comments
Whether you hate them or love them, content accessed through plugins is still a sizable chunk of the web. So much so, that over 99% of internet users have Flash installed on their browser. However, plugins can also carry with them extra vulnerabilities and system slowdowns.
A couple days ago I landed an initial implementation of “click-to-play plugins” in desktop Firefox. To see and play with the feature, download a Nightly build of Firefox, go to about:config, and enable the plugins.click_to_play flag.
When plugins.click_to_play is enabled, plugins will require an extra click to activate and start “playing” content. This is an incremental step towards securing our users, reducing memory usage, and opening up the web.
I’m currently working on implementing the ability for plugin activation settings to be remembered on a per-site basis. I hope to get these changes landed within the next week before the deadline for Firefox 14.
If you are curious and want to learn more about our plans for opt-in activation of plugins, you can take a look at the feature page on our wiki.
The text in the plugin placeholder says “to activate plugins”. I hope clicking it only activates the one plugin instance needed to play that object, and no other ones on the page.
Many sites have a visible plugin but also some invisible plugin objects to help the visible one do their work. This means that we currently enable all plugins on the page. This behavior isn’t final yet.
would be great if click to play worked for html5 mediatags too
sometimes they are as annoying as plugins!
There is a pref in about:config to disable autoplaying of HTML5 media if you are interested. It is called media.autoplay.enabled, and if you set it to true then the “autoplay” attribute should have no effect.
see https://bugzilla.mozilla.org/show_bug.cgi?id=667357
Thank you! Now I no longer have to switch between completely enablin and disabling Flash just to view those YouTube videos that are “currently unavailable” in the HTML5 version.
Excellent, thanks!
[...] developers are considering making web plugins like Adobe Flash an opt-in feature. Although there is still a long way to go before it’s ready for Firefox proper, switching to an [...]
This looks like more of an annoyance. What problem is it trying to solve?
Our first priority is to not make it annoying
Our main motivation is based on security, with other motivations around memory and snappiness of the browser.
Not sure about others, but I really welcome this new direction. I honestly feel plugins are due to be deprecated in general at this point. I know that’s extreme, but I’ve felt for a long time that the drawbacks of plugins seriously outweigh their advantages. With all major browsers adopting this stance that’s looking more and more like an option. I have to commend Apple’s contribution of prohibiting all plugins in iOS.
If nothing else, I feel this will help encourage devs against using plugins. Assuming that’s the case, I look forward to a web of increasing openness, and all that brings; more customisation choices for users (Userscripts, browser defaults like disabling autoplay), more attention and collaboration around plugin replacement technologies like video/canvas/WebGL and all the other benefits from getting rid of the black box which plugins are.
All in all, looking forward to this. Only worry I might have is that some of the proposals around the permissions system seem a little diluted and could easily be harsher to plugins/give users more control.
Thanks! Getting the permissions system correct will require input from the full Mozilla community, so I appreciate your feedback. Our end goal is a system where websites are easy to use and users have a low chance of getting hit by drive-by exploits in plug-ins.
[...] developers are considering making web plugins like Adobe Flash an opt-in feature. Although there is still a long way to go before it’s ready for Firefox proper, switching to an [...]
How does this interact with sites that try to detect whether a particular plugin is available? I’ve sometimes had issues with plugin-blocking extensions, where the site has concluded I don’t have Flash / Java, and never given me the opportunity to use click-to-play.
We still have some more work to do around this. The first step is to not fallback if the plugin is installed but being blocked by click-to-play. Other issues that may arise is if script on the page is trying to communicate with the plugin and the script times out while trying to interact. This latter issue is a harder one to solve, and may require work by the website authors to add an event listener for the PluginClickToPlay event.
Been wanting this for a while, but never knew how to ask. I hope this eventually makes it (even if disabled by default) to stable.
This preference will be in Firefox 14 (mid-July), but disabled by default. We are continuing to work on the feature and hope to get it enabled by default some time after that.