Mozilla will automatically block browser addons installed by other software until users approve them when it rolls out Firefox 8.
Software-bundled addons have been a problem for Firefox users, who have sometimes been surprised to find browser extensions show up on their machines without their consent.
An addon included with Skype, for example, caused such a high number of browser crashes that Mozilla added it to a list of banned extensions last January. And in 2009, an addon that Microsoft silently slipped into Firefox left browser users open to attack, a fact that Microsoft itself admitted.
"While some of these applications seek the user's permission beforehand, others install addons into Firefox without checking to make sure the user actually wants them," said Justin Scott, product manager for addons, on a Mozilla company blog.
Scott ticked off numerous issues with such addons, ranging from slowing down Firefox's startup and page loading times to not keeping up with Firefox's feature and security updates. "Most importantly, they take the user out of control of their addons," Scott said.
Changes slated for Firefox 8, which will hit Mozilla's "Aurora" preview channel next week and is scheduled to release in final form on 8 November, will return control to users, argued Scott.
If Firefox 8 finds that another program has installed an addon, the browser will automatically disable it until the user has agreed to its installation. "Users that want the functionality provided by a third party-installed addon can easily allow the installation, while users who don't can cancel or ignore the prompt," said Scott.
Previously installed addons will also be tagged when users upgrade to Firefox 8, and won't be enabled until the user explicitly agrees.
Developers who follow Mozilla's rules, asking users to opt-in, will be affected as well as those who try to slip an addon by users, something that immediately raised questions.
"We have an installer on Windows that installs an add-in to Firefox (via an .exe). Its only job is to install the addon and the user is agreeing to install the addon," said Michael Kaply, a former IBM developer who now consults with corporations on customising Firefox for their workers or clients. How do we keep this prompt from appearing in this case?" Kaply asked in a comment appended to Scott's blog.
Firefox 8 will detect addons installed by other software and require the user's permission before enabling the extension.
Mozilla didn't have an answer for Kaply.
"Firefox unfortunately doesn't have any way of knowing if the user was ever asked about installing the extension," acknowledged Alex Faaborg, a principal designer at Mozilla, in another comment. "So the only way to ensure user control is to ask them when Firefox launches."
Scott echoed that, saying that impact of bad addons outweighed the pain that will be felt by developers who abide by the rules. "Unfortunately, the extent of unwanted addons installed through these methods has caused us to take action, but we're confident that users who truly want such addons to be installed will opt in when Firefox prompts them," he said.
Users can try out the new addon management features by downloading Firefox 8 after it lands on the Aurora channel next week.