Intent to remove about:permissions

Tom Schuster tom at
Sat Nov 7 12:54:45 UTC 2015

I find the about:permissions to be super useful and I actually use it more
often than the page info dialog.

It seems like you could build a [hosts -> permissions] table from
[permissions -> hosts] even when you might get strange results sometimes
with, and/or This UI
is only for advanced users anyway.

I am totally against removing this UI before we have a centralized

Honestly all those changes required for about:permissions seems to be
totally trivial.
get/set code looks almost identical to above. The rest is some bookkeeping.
The observer registration/removal code could be simplified a bit.
Copy and paste from above, with fullscreen changed to push.
Same change three times, why is that not one file?


On Sat, Nov 7, 2015 at 12:30 PM, Dao Gottwald <dao at> wrote:

> about:permissions was implemented in 2011 but never intentionally exposed
> to end users, i.e. we don't link to it from about:preferences#content or
> from the control center a.k.a. identity panel or anything. The reason for
> that is that we're not happy with the UI, and there's no clear path
> forward; in a sense it's already dead code. Two years ago, bug 933917 was
> filed on removing about:permissions. We should finally do this.
> The [hosts -> permissions] mapping used by about:permissions is
> fundamentally flawed. It doesn't work well with different permissions that
> may apply to either a full host or eTLD + 1, or permissions that
> differentiate between http and https. It's hard to communicate these
> nuances in this kind of UI where users are supposed to pick a "site"
> (whatever that means) first. There's a good chance users would get stuck at
> that first step.
> I do think we should have a place for advanced permission management
> besides the control center (where users need to visit a site so they can
> change its permissions). Host whitelists and blacklists for various
> permissions are currently scattered across about:preferences#content,
> about:preferences#security, about:preferences#advanced and probably other
> places I don't even remember. Obviously this is far from ideal. However, I
> think any attempt to centralize these UIs ought to keep their [permissions
> -> list of hosts] mapping. So about:permissions with its [hosts ->
> permissions] approach isn't even a good starting point for future work.
> You may wonder, since about:permissions is quite self-contained, why not
> just keep it around for the time being for those who few who accidentially
> discovered it? More than two years ago I introduced SitePermissions.jsm in
> bug 885366. It has proven useful as the backend for the control center and
> for Page Info > Permissions, making it trivial to add new permissions
> there. Unfortunately, it can't be used easily as a backend for
> about:permissions. This makes about:permissions and ongoing tax that a
> number of developers have paid over the years. As an example, these changes
> were needed to add Push notifications to the control center and Page Info:
> ... whereas these changes were needed to add them to about:permissions:
> So from this perspective as well, we really should have gotten rid of
> about:permissions a long time ago. We've been wasting way too many
> resources on it.
> Thoughts? Have I missed something?
> Dao
> _______________________________________________
> firefox-dev mailing list
> firefox-dev at
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the firefox-dev mailing list