Mozilla will begin signing Mv3 extensions for Firefox next week
Nightly and Developer Edition users will be able to test the new cruelty
Mozilla plans to add support for Manifest v3 browser extensions to its online store – addons.mozilla.org – so developers can have them cryptographically signed for distribution.
Manifest v3 (Mv3) refers to a set of APIs and capabilities that are intended to become the new standard for browser extensions. It's a software architecture revision initially proposed by Google for Chromium-based browsers and subsequently endorsed by Mozilla for Firefox (Gecko-based) and by Apple for Safari (WebKit-based).
Starting Monday, November 21, developers will be able to upload Mv3 extensions for signing. As a result, those using Firefox Nightly and Developer Edition will be able to test extensions refactored for the new rules, prior to the spec's general availability with the scheduled January 17, 2023 release of Firefox 109.
This should help developers revise legacy extension code before the discontinuation of Manifest v2, which was recently delayed. Previously Mv2 extensions in the Google Chrome ecosystem were set to stop working in January 2023, but the deadline has been made less definitive. The general public should see Mv2 extensions stop working in Chrome around June 2023.
Browser extensions under the outgoing Mv2 regime provided powers that could be abused – it's not particularly difficult to create a malicious extension using Mv2. And reports of such abuse became commonplace.
Rather than choosing to scrutinize Chrome Web Store extension submissions more carefully, Google decided in 2018 to limit the capabilities of extensions with an architectural revision. The company claimed Mv3's revised capabilities – which continue to be hammered out – will make extensions more secure, performant, and private.
Despite forceful objections from the Electronic Frontier Foundation – which makes a privacy enhancing extension called Privacy Badger – and others, who all hold that Mv3 will make content blocking more difficult, browser makers have agreed to go along. At least in part.
- Mozilla Foundation launches ethical venture capital fund
- Firefox patches Windows 11 Ctrl+C hang, introduces new bug
- Firefox 106 will let you type directly into browser PDFs
- Google delays execution of doomed Chrome extensions
Mozilla's implementation of Mv3 will differ in two critical ways from Google's. First, it will provide developers with access to the APIs Google considers too troublesome to retain.
"While other browser vendors introduced declarativeNetRequest (DNR) in favor of blocking Web Request in Mv3, Firefox Mv3 continues to support blocking Web Request and will support a compatible version of DNR in the future," said Shane Caraveo, engineering manager for WebExtensions at Mozilla, in a blog post. "We believe blocking Web Request is more flexible than DNR, thus allowing for more creative use cases in content blockers and other privacy and security extensions."
(However, Caraveo says Firefox also intends to support DNR for its performance and compatibility characteristics. The blocking version of Web Request can slow things down if coded clumsily, so Mozilla wants developers to have the option to use the less intrusive and less dynamic DNR API.)
Second, Mozilla is supporting Event Pages in Firefox's Mv3 implementation. Mv3 dispenses with persistent background pages – scripts that run in the background, potentially slowing things down and consuming resources. As an alternative, the spec provides Service Workers – scripts that run and then shut down.
But the Service Workers API – which Mozilla intends to support eventually – does not have access to the Document Object Model (DOM) or other WebAPIs. So Event Pages – non-persistent background pages – provide more options for developers.
According to Caraveo, the Unified Extensions button already available in Firefox Nightly will provide Firefox users with more granular control. Users of Mv3 extensions will be able to review extension permissions for any website and can grant or revoke access for specific sites.
Next year, Caraveo says, Mozilla intends to expand Firefox Mv3 compatibility. ®