Firefox Announces User Plugin Control For Greater Stability and Security

[engine]

Mozilla is changing the way Firefox loads third party plugins such as Flash, Java and Silverlight. This change will help increase Firefox performance and stability, and provide significant security benefits, while at the same time providing more control over plugins to our users.

Previously Firefox would automatically load any plugin requested by a website. Leveraging Click to Play Firefox will only load plugins when a user takes the action of clicking to make a particular plugin play or the user has previously configured Click To Play to always run plugins on the particular website.Firefox Announces User Plugin Control For Greater Stability and Security [blog.mozilla.org]

Click to Play allows users to easily choose if they wish to run a plugin on a particular site. Users can also configure sites to never run plugins or conversely always run plugins. This change puts the user in control.

By only activating plugins that the user desires to load, we’re helping eliminate pauses, crashes and other consequences of unwanted plugins.

[Sgt_Kickaxe]

I'd try this out except I've already taken the approach of removing all but a couple of plugins in Firefox. If the plugin isn't there to begin with the potential for problems is greatly reduced.

[bill]

I've removed Java from all my browsers already, and I never added Silverlight so I'm mostly set already. Not to say that this isn't a welcome change from a security standpoint. If I understood this they're going to activate this across all plug-ins?

When will the other browsers follow suit?

[futuresky]

Sounded nice until I started thinking...I guess this will block adsense (unless users click to play the ads)? Not good if it does, as it could effectively remove sites' ability to finance their existence.

[blend27]

It is definitely a step in the right direction!

Now if they would incorporate AdblockPlus, NoScript and BetterPrivacy to be installed by default, it would totally be User Privacy focused browser.

And remove spyware that probably records every site/url the user visits.

about:config

browser.safebrowsing.gethashURL
browser.safebrowsing.keyURL
browser.safebrowsing.reportURL
browser.safebrowsing.updateURL

Just saying...

[SevenCubed]

I guess this will block adsense (unless users click to play the ads)?

There are already plenty of add-ons that block Adsense and others. This probably isn't going to make that much difference?

I recently traded in No-Script for a different plugin called RequestPolicy and like it more. It gives me more flexibility to allow all site-specific javascript to run without restrictions but it blocks all cross-site requests.

I was feeling that even though No-Script has better security measures it was sometimes difficult to get a page to display properly when I needed it to.

RequestPolicy makes it clear in their statement that No-Script offers better security but I feel comfortable enough riding into websites bareback and allowing their javascript to run into my browser. That's primarily due to the nature of websites I hang out on.

And with this plugin I make a point of allowing some cross-site requests to their ad networks by whitelisting them because I know their existence depends on it, such as newspaper sites. But even there I don't allow them all because of the excessive cross-site collusion, it's mind boggling. On the newspaper site that I visit frequently I allow their primary ad network to display ads to me.

It's only google and all their offshoots that get blocked uniformly across all domains with no exceptions. With others I am selective such as here at WW I allow the ones that has a potential to adversely affect revenue if I didn't allow them. Speaking of which I haven't noticed any ads up in the top right hand corner for quite a few weeks now. I miss them!

[futuresky]

There are already plenty of add-ons that block Adsense and others. This probably isn't going to make that much difference?

Thing is, users have to make a specific decision to install the addons like NoScript. If I understand correctly Click to Play will be on (blocking) by default. With Firefox having a 31% browser usage share, could be a big hit to adsense (or other similar ads) maybe?

A couple of quick stats I've found:
About 450 million people use Firefox
Adblock Plus, the most popular add-on has 15,526,434 users (about 3.45% of Firefox users)
NoScript has 2,168,235 users (about 0.48% of Firefox users)

[SevenCubed]

If I understand correctly Click to Play will be on (blocking) by default.

Ah okay in that case it might be a game changer. That's good. For a change it's going to have to be the ad networks who will have to adapt or die. Refreshing.

I've been following a few threads where WW member swa66 has been pointing out that google's delivery solution is behind the times. Maybe it's going to pounce on them real quickly like a bat out of hell before than can evolve.

Well, at least they won't be able to say they weren't warned. Pity.

[futuresky]

Please ignore me and forgive me - I've just tried the Beta after realising Javascript wasn't specified as one of the things being blocked. I can confirm Adsense is still visible - yay! (and phew!)

[SevenCubed]

Oh nuts. Back to the drawing board.