Thunderbird and Addons
gerv at mozilla.org
Mon Aug 24 19:43:02 UTC 2015
On 24/08/15 19:35, R Kent James wrote:
> We need to do some sort of announcement in the Thunderbird blog about
> our plans concerning addons. I'd like to have feedback from folks to see
> if there is any debate about what is the correct direction for us.
> We've at least agreed that we are continuing to support binary addons.
The obvious follow-up questions you will then get are:
* The reason Firefox is deprecating XUL/XPCOM addons is because they
want to move away from those techologies towards things which are more
webby. Do you then plan to continue to support XUL and XPCOM, even if
Firefox moves away from these technologies? If not, what does it mean to
say that you "continue to support binary addons"?
* Will you additionally support some form of stable addon API, analogous
to the Firefox one, or not?
> Concerning signing, we took steps months ago to not move forward on
> requiring addons to be signed, so there are no current plans to require
> signing. There is still some debate about that in bug 1168571. We should
> probably come to a firm decision and announce it. Most commenters were
> opposed to signing, though there were some holdouts.
If the Thunderbird addons ecosystem does not have the problems with
mal-addons that the Firefox one does, then the major use case for
signing goes away. But I'd say that the decision should be driven by a
threat analysis, not by feedback, which will inevitably be from a small
subset of users, and probably those least likely to be affected by
mal-addons, and most likely to be affected by signing.
> This policy must be modified by the caveat "as long as core Mozilla code
> can be used to support it".
Which, in the case of XUL/XPCOM, is a major caveat. It would not be good
for Thunderbird to announce that it plans to continue supporting such
addons, but in practice it ends up not supporting them on the same
timescale that Firefox stops supporting them.
More information about the tb-planning