{"id":213,"date":"2009-11-16T15:29:02","date_gmt":"2009-11-16T22:29:02","guid":{"rendered":"http:\/\/blog.mozilla.org\/security\/?p=213"},"modified":"2009-11-16T15:29:02","modified_gmt":"2009-11-16T22:29:02","slug":"component-directory-lockdown-new-in-firefox-3-6","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/","title":{"rendered":"Component Directory Lockdown – New in Firefox 3.6"},"content":{"rendered":"

[This post originally appeared on Mozilla Developer News<\/a>]<\/em><\/small><\/p>\n

We hate crashes. When Firefox crashes, we try to get you back on your feet as quickly as possible, but we’d much rather you not crash in the first place. In Firefox 3.6, we are changing the way that some third party software hooks into Firefox which should eliminate a good chunk of those crashes without sacrificing our extensibility in any way. In the process, we’ll also be giving you greater control over the code that runs in your browser. <\/p>\n

Background<\/h2>\n

Firefox is built around the idea of extensibility – it’s part of our soul. Users can install extensions that modify the way their browser looks, the way it works, or the things it’s capable of doing. Our add-ons community is an amazing part of the Mozilla ecosystem, one we work hard to grow and improve.<\/p>\n

In addition to the standard mechanism for extending the browser via add-ons and plugins, though, there has historically been another way to do it. Third-party applications installed on your machine would sometimes try extend Firefox by just adding their own code directly to the “components<\/tt>” directory, where much of Firefox’s own code is stored.<\/p>\n

There are no special abilities that come from doing things this way, but there are some significant disadvantages. For one thing, components installed in this way aren’t user-visible, meaning that users can’t manage them through the add-ons manager, or disable them if they’re encountering difficulties. What’s worse, components dropped blindly into Firefox in this way don’t carry version information with them, which means that when users upgrade Firefox and these components become incompatible, there’s no way to tell Firefox to disable them. This can lead to all kinds of unfortunate behaviour: lost functionality, performance woes, and outright crashing – often immediately on startup.<\/p>\n

In Firefox 3.6 (including upcoming beta refreshes), we’re closing this door. Third party applications can still extend Firefox via add-ons and plugins the way they always could, but the components directory will be for Firefox only.<\/p>\n

What Does This Mean For Me?<\/h2>\n

If you’re a Firefox user, this should be 100% positive. You don’t have to change anything, your regular add-ons should continue to work properly – you just might notice fewer crashes or odd bugs. If you do notice that something has stopped working, particularly a third party addition to Firefox, you might want to contact the producer of that addition to ensure they know about the change.<\/p>\n

If you’re a Firefox component developer, this shouldn’t be a big change, either. If you’re already packaging your additions as an XPI, installed as an add-on it’s business as usual. If you have been dropping components directly, though, you’ll need to change to an XPI-based approach. Our migration document<\/a> on the Mozilla Developer Connection outlines the changes you’ll need to make, and should be pretty straightforward. The good news is that once you’ve done this, your add-on will actually be visible to users and will support proper version information so that our shared users are guaranteed a more positive experience.<\/p>\n

If you haven’t downloaded the new Firefox beta yet, and want to give it a spin, you can find a copy here<\/a>.<\/p>\n

Johnathan Nightingale
\nHuman Shield<\/p>\n","protected":false},"excerpt":{"rendered":"

[This post originally appeared on Mozilla Developer News] We hate crashes. When Firefox crashes, we try to get you back on your feet as quickly as possible, but we’d much … Read more<\/a><\/p>\n","protected":false},"author":107,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[47,30],"tags":[],"coauthors":[],"yoast_head":"\nComponent Directory Lockdown - New in Firefox 3.6 - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Johnathan Nightingale\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/\",\"name\":\"Component Directory Lockdown - New in Firefox 3.6 - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"datePublished\":\"2009-11-16T22:29:02+00:00\",\"dateModified\":\"2009-11-16T22:29:02+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/0fac3a8789f3a9867a034db23e22d21d\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Component Directory Lockdown – New in Firefox 3.6\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/0fac3a8789f3a9867a034db23e22d21d\",\"name\":\"Johnathan Nightingale\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/a7045d6e4465774d94d0755aad2e257f\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f1db41d9af38ab72e6716dbb616e1268?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f1db41d9af38ab72e6716dbb616e1268?s=96&d=identicon&r=g\",\"caption\":\"Johnathan Nightingale\"},\"description\":\"Vice President of Firefox\",\"sameAs\":[\"http:\/\/blog.johnath.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Component Directory Lockdown - New in Firefox 3.6 - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/","twitter_misc":{"Written by":"Johnathan Nightingale","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/","url":"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/","name":"Component Directory Lockdown - New in Firefox 3.6 - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"datePublished":"2009-11-16T22:29:02+00:00","dateModified":"2009-11-16T22:29:02+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/0fac3a8789f3a9867a034db23e22d21d"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2009\/11\/16\/component-directory-lockdown-new-in-firefox-3-6\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"Component Directory Lockdown – New in Firefox 3.6"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/0fac3a8789f3a9867a034db23e22d21d","name":"Johnathan Nightingale","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/a7045d6e4465774d94d0755aad2e257f","url":"https:\/\/secure.gravatar.com\/avatar\/f1db41d9af38ab72e6716dbb616e1268?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f1db41d9af38ab72e6716dbb616e1268?s=96&d=identicon&r=g","caption":"Johnathan Nightingale"},"description":"Vice President of Firefox","sameAs":["http:\/\/blog.johnath.com"]}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/213"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/107"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=213"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/213\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=213"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=213"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=213"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=213"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}