Efficient method to script embedded pages in an addon

Add-ons Development
6

This issue is best resolved with a new flag in package.json. (In my opinion, contentaccessible should default to no for resource URIs.)

Proposed steps:

  1. Deprecate the use of contentaccessible resource URIs in the core Firefox. Add-ons are not affected. (just print a warning) Also, add a option to set
    contentaccessible=no in package.json. resource URIs (or equivalents) should be web-inaccessible by default for WebExtensions.
  2. Make contentaccessible=no the default for add-ons. Notify the developers of the add-ons that rely on availability of resource URIs from the Web. contentaccessible=yes will be an opt-in for resource URIs.

More on the core Firefox (a bit off topic here):

  • Firefox now reports 45.0 in UA strings for the real version 45.0.1. (And the same 45.0 for 45.1.1esr etc.) This is a good Firefox thing for privacy/security compared to Chromium/Chrome.
  • However, precise scanning of resource URIs often reveals the real versions to Web contents.
  • Privacy add-ons can spoof OS or other information to Web. However, resource URIs from the core of Firefox reveals everything. Moreover, such add-ons (and precise versions) are easily detected by scripts on a Web page.