> I did some research to find why this took so long. 13 years ago, extensions.json used to be extensions.sqlite. Nowadays, extensions.json is serialized and rewritten in full on every write debounced to 20 ms, which works fine for 15 extensions but not 84,194.
I'm slightly worried how they arrived at that debounce value. Which extensions need to write to extensions.json continuously, several times a second?
The eternal tension between "this service mesh is completely overengineered for our usecase" and "our broker is far to slow for our 84.205 microservices"...
I'm laughing so hard at the video, I imagine this is what browsing the web is like for the elderly that barely know how to use a computer. Can someone do this in Chrome?
Loved the brutal realization that came when the seemingly broken Extensions button the author was mashing for solid 30 seconds turned out to be a fake, extension-supplied one. One... of three.
If you turn loose a completely untrained person to click yes/accept/download/OK/I agree on every type of user interface popup, particularly a person who has no ability to distinguish between a user interface question presented by the operating system itself and something inside of a browser window, that's what you'll get...
I have a vivid memory of once looking over someone's shoulder in the IE days and being horrified to see toolbars taking up about 80% of the available screen real estate, leaving only maybe 150-200 pixels of vertical space for actual web browsing. I have no idea how they got anything done, and my guess was they never actually used any of the installed toolbars and just thought that was normal.
Seeing this article, and how much webextensions manage to mess up the browser, I'm wondering how bad this experiment would've been with the legacy XUL extensions. Maybe they had a point in getting rid of them...
> I did some research to find why this took so long. 13 years ago, extensions.json used to be extensions.sqlite. Nowadays, extensions.json is serialized and rewritten in full on every write debounced to 20 ms, which works fine for 15 extensions but not 84,194.
This is probably a good example of the opposite. It would be a mistake to design for the fleetingly rare case. If you’re dealing with a handful of extensions, a json file that’s rewritten is fine.
But the software already has multiple database systems built in. There's not exactly overhead to use what plumbing is already there, instead of writing to disk.
In an ideal world, software with 100 million users would be optimised for energy usage. It all adds up. This does pale in comparison to everything else, though.
"In terms of implementation, the most interesting one is “Іron Wаllеt” (the I, a, and e are Cyrillic). Three seconds after install, it fetches the phishing page’s URL from the first record of a NocoDB spreadsheet and opens it [...] The API key had write access, so I wiped the spreadsheet."
> Dr. B is the king of slop, with 84 extensions published, all of them vibe coded.
> How do I know? Most of their extensions has a README.md in them describing their process of getting these through addon review, and mention Grok 3. Also, not a single one of them have icons or screenshots.
> Personally, I’m shocked this number is this low. I expected to see some developers with hundreds!
This is really surprising. Either because Firefox is not that popular ir mozilla has an automatic filter?
I'm pretty sure that there were much more XUL and XPCOM extensions back then +10 years ago before mozilla pulled out the plug for that platform and moved to WebExtensions
Other examples I recall when looking into this: Zotero browser connector for Firefox, Chrome Remote Desktop for Firefox (I think it adds a few features for connections to remote desktops)
> I did some research to find why this took so long. 13 years ago, extensions.json used to be extensions.sqlite. Nowadays, extensions.json is serialized and rewritten in full on every write debounced to 20 ms, which works fine for 15 extensions but not 84,194.
I'm slightly worried how they arrived at that debounce value. Which extensions need to write to extensions.json continuously, several times a second?
I won the "Middle Finger Emoji Sticker" Award! (https://jack.cab/blog/every-firefox-extension#the-middle-fin...)
I quickly wrote up how: https://www.arnevogel.com/firefox-permissions/
Brings back the memories of using Internet Explorer when every other installer was fighting for toolbar space!
Every Internet café had at least 2, with Ask.com, Google, Yahoo and later on, Bing being the main contenders.
Sad that no real pages can load successfully, but I thoroughly enjoyed the writing.
> We turned on crash reporting on the way.
I haven't burst out laughing like this in a while! You'll probably make for some horror stories to a poor Mozilla team.
Firefox crash reports are public though unfortunately I was unable to find their crashes: https://crash-stats.mozilla.org/
EDIT: if they still have the profile they can actually find the crash ID for their crash report: https://support.mozilla.org/en-US/kb/troubleshoot-firefox-cr...
All those extensions probably crashed the crash reporter
The eternal tension between "this service mesh is completely overengineered for our usecase" and "our broker is far to slow for our 84.205 microservices"...
This article is wonderful crazy.
The icing on the cake is the discovery of a potential performance bug in one or more of the about: pages, that's definitely worthy of following up.
I'm laughing so hard at the video, I imagine this is what browsing the web is like for the elderly that barely know how to use a computer. Can someone do this in Chrome?
Loved the brutal realization that came when the seemingly broken Extensions button the author was mashing for solid 30 seconds turned out to be a fake, extension-supplied one. One... of three.
My favorite part was the metal pipe sound effect. Wish the author investigated which extension does that.
Maybe it was this?
https://addons.mozilla.org/en-US/firefox/addon/random-metal-...
1 reply →
That will be one hell of a bug report.
Where is the video, I scanned through and only saw still images.
https://jack.cab/blog/every-firefox-extension#attempts-4-10-...
It's inline. Search the page for (and heed): epilepsy warning
If you turn loose a completely untrained person to click yes/accept/download/OK/I agree on every type of user interface popup, particularly a person who has no ability to distinguish between a user interface question presented by the operating system itself and something inside of a browser window, that's what you'll get...
I have a vivid memory of once looking over someone's shoulder in the IE days and being horrified to see toolbars taking up about 80% of the available screen real estate, leaving only maybe 150-200 pixels of vertical space for actual web browsing. I have no idea how they got anything done, and my guess was they never actually used any of the installed toolbars and just thought that was normal.
2 replies →
You can just say AI
I’m aware, that’s exactly what my grandfathers (rest in peace grandpa, I miss you) IE window looked and felt like in the early 2010s!
Alternatively you may be able to list the extensions using the sitemap: https://addons.mozilla.org/sitemap.xml
Chrome Web Store has something similar: https://chromewebstore.google.com/sitemap
And Edge: https://microsoftedge.microsoft.com/sitemap.xml
"I got basically all the extensions with this, making everything I did before this look really stupid."
I geel this on a deep personal level.
Seeing this article, and how much webextensions manage to mess up the browser, I'm wondering how bad this experiment would've been with the legacy XUL extensions. Maybe they had a point in getting rid of them...
Reminds me of the NPM package that depended es on all other NPM packages https://uncenter.dev/posts/npm-install-everything/
In this blog post: Let's Game It Out[1] meets web browsing.
[1]: https://www.letsgameitout.tv/
I love the small few who take the time to do crazy stuff like this. Very entertaining.
Absolutely unhinged and very entertaining. Thanks for sharing!
This article is interesting but hard to read in certain places because it contains distracting information.
Better to organize it into main findings and side stories.
The website of this blog and their connections listed are a sight to behold. I miss that version of the internet.
This obviously showcases that Firefox needs to work on their support for having all browser extensions at once. Users want and need this.
> I did some research to find why this took so long. 13 years ago, extensions.json used to be extensions.sqlite. Nowadays, extensions.json is serialized and rewritten in full on every write debounced to 20 ms, which works fine for 15 extensions but not 84,194.
Occasionally, databases are useful. ;)
This is probably a good example of the opposite. It would be a mistake to design for the fleetingly rare case. If you’re dealing with a handful of extensions, a json file that’s rewritten is fine.
But the software already has multiple database systems built in. There's not exactly overhead to use what plumbing is already there, instead of writing to disk.
4 replies →
In an ideal world, software with 100 million users would be optimised for energy usage. It all adds up. This does pale in comparison to everything else, though.
Dang this is so good. Well done.
"In terms of implementation, the most interesting one is “Іron Wаllеt” (the I, a, and e are Cyrillic). Three seconds after install, it fetches the phishing page’s URL from the first record of a NocoDB spreadsheet and opens it [...] The API key had write access, so I wiped the spreadsheet."
The extension is actually still up: hxxps://addons[.]mozilla[.]org/en-US/firefox/addon/%D1%96ron-w%D0%B0ll%D0%B5t/
Did you just admit to a CFAA violation?
What do you mean by "you"? Do you know what quotes are?
Won't someone think of the poor phishers!
> Dr. B is the king of slop, with 84 extensions published, all of them vibe coded. > How do I know? Most of their extensions has a README.md in them describing their process of getting these through addon review, and mention Grok 3. Also, not a single one of them have icons or screenshots. > Personally, I’m shocked this number is this low. I expected to see some developers with hundreds!
This is really surprising. Either because Firefox is not that popular ir mozilla has an automatic filter?
In general concept this reminds me a bit of adding every possible installer .EXE based Internet Explorer browser toolbar to Windows 98
https://www.reddit.com/media?url=https%3A%2F%2Fi.redd.it%2Fz...
https://fergido.wordpress.com/wp-content/uploads/2011/06/too...
> It turns out there’s only 84 thousand Firefox extensions.
On addons.mozilla.org, but you can distribute Firefox extensions without posting on addons.mozilla.org. I do.
I'm pretty sure that there were much more XUL and XPCOM extensions back then +10 years ago before mozilla pulled out the plug for that platform and moved to WebExtensions
Other examples I recall when looking into this: Zotero browser connector for Firefox, Chrome Remote Desktop for Firefox (I think it adds a few features for connections to remote desktops)
Is this the digital version of Supersize Me?
Turns out even browser extensions can be comedy.
Good Luck Remembering all those icons.. Amazing