Multi-Account Containers to “Exchange messages with programs other than Firefox”(wh0.github.io)

146 pointsby nabilhatvor 5 Jahren58 comments

wh0.github.io

Multi-Account Containers to “Exchange messages with programs other than Firefox”

https://wh0.github.io/2021/11/02/multi-account-containers.html

61 comments

avianvor 5 Jahren

I wish they fixed the long standing, annoying sync bug that makes Firefox download 7000+ containers every once in a while. Some of us hosed our sync accounts in one way or another (through the container duplication bug in m-a-c itself [1] or the temporary containers extension [2]) and it's impossible to recover - once you reach the storage quota on the sync server, the sync server refuses all write operations and delete call apparently counts as a write.

[1] https://github.com/mozilla/multi-account-containers/issues/1...

[2] https://github.com/stoically/temporary-containers/issues/371

ruinedvor 5 Jahren

it is possible to recover! you just have to reset your account password, which blows away all server data, starting the quota over. but this is ok because you should still have a local copy, and when you log in with the new password you can upload that.

avianvor 5 Jahren

Thanks! I have been following the issues and also spent quite some time trying to fix/work around this on the client side, but it never occurred to me that simply reseting the password deletes everything server-side. I'll try it out.

dessantvor 5 Jahren

There's no obvious reason to grant the nativeMessaging permission during extension installation for an optional feature, nativeMessaging can be declared as an optional permission since Firefox 87 [1], and Firefox Multi-Account Containers 8.0.2 only supports Firefox 91 or newer.

There could be a bug related to declaring nativeMessaging as an optional permission, though that is not mentioned in the pull request [2], so this was probably an oversight.

EDIT: the minimum supported version was bumped to Firefox 91 in a subsequent PR apparently not for technical reasons, but just to follow guidelines [3], and then they forgot to reevaluate the need for the new default permission before a release.

[1] https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

[2] https://github.com/mozilla/multi-account-containers/pull/215...

[3] https://github.com/mozilla/multi-account-containers/pull/218...

rPlayer6554vor 5 Jahren

I think this is a great step. I hate when Mozilla does things other than make their browser better. This seems like a feature pretty unique to Firefox (or if there is another implemention I'm not aware of, it's probably not as tightly integrated) that can make them money.

People can complain about the Mozilla VPN or Brave's BAT but at the end of the day they have to fund themselves somehow. I'd rather it to be through very interesting new ways of using a browser rather than through Google's money. Up until now I'd see the VPN as a lazy cash grab but now it seems like an actual premium feature.

abdullahkhalidsvor 5 Jahren

I would really like Firefox to implement granular permissions per extension. So, if I can choose to not give this extension permission to talk to external programs. And hopefully the extension authors wrote it in a way that it degrades gracefully.

resoluteteethvor 5 Jahren

This permission is harmless because native messaging only allows an extension to communicate with a specific native companion program that has to be installed/enabled outside if firefox.

If you don't install the companion program, this permission won't do anything.

It does not allow the extension to run arbitrary programs.

ComodoHackervor 5 Jahren

Where and how is this program specified? Can malware impersonate itself as a "companion program" and collect user activity data?

resoluteteethvor 5 Jahren

It's just specified in a manifest file in a specific location on Linux or referenced in a registry key on windows, so sure, if you already have malware running on your computer I suppose it could do that (assuming the messages sent by the extension contain browsing data) but there would probably be easier ways for it to collect your data.

dcormiervor 5 Jahren

The permission request should probably be reworded to make that more clear.

rzzztvor 5 Jahren

Bookmark access for the container extension is optional and there is a toggle button for it; for some reason, this one was added to the "Required permissions for core functionality" list which can not be modified.

Vinnlvor 5 Jahren

> for some reason

I think these permissions cannot be optional: https://extensionworkshop.com/documentation/develop/request-...

(Not sure though, I haven't worked with optional permissions for my extensions yet.)

Vinnlvor 5 Jahren

I'm not sure if it's possible for this permission yet, but it did become possible for extensions to dynamically requests access to page contents per site, rather than declaring them all up front. It requires the extension authors to use a different API though, which not everyone has switched to yet.

Teevervor 5 Jahren

I was thinking the same thing when I was reading this link too.

Another thing I'd like is for Mozilla to not be able to deactivate extensions remotely.

rasenganvor 5 Jahren

This is very cool. You can now set a different proxy for every container!

Dylan16807vor 5 Jahren

Now if it could just wait to ask for the permission until it needs it...

Gigachadvor 5 Jahren

The extension is direct from Mozilla. If I didn’t trust it to request literally any permission, I should just delete Firefox entirely because it could do just about anything without having to ask me.

usr1106vor 5 Jahren

I even distrust myself. I don't run everything as superuser / with admin rights whole day long just because it's me.

The point is you should use elevated privileges when you need them. Not because some use case which is currently irrelevant for you might need them.

ComodoHackervor 5 Jahren

You do know the reasoning behind the Least Privilege Principle, don't you?

It's not that developers are untrustworthy, it's that software have vulnerabilities, and they get exploited.

Gigachadvor 5 Jahren

The permissions being requested are things that all native apps get by default. I’m not worried about trusted code getting permission to something I trusted a hundred other apps with previously.

ComodoHackervor 5 Jahren

Those other apps don't regularly download and execute arbitrary third-party code, though.

solohanvor 5 Jahren

Note that this still leaks DNS lookups. You can use https://github.com/bekh6ex/firefox-container-proxy instead until they fix that.

contravariantvor 5 Jahren

That part I like, it means I no longer need a separate extension for that purpose. I could have done without the Mozilla VPN spam though.

nunezvor 5 Jahren

This actually solves a problem for me that I previously solved by using completely separate Firefox processes. That's awesome!

PufPufPufvor 5 Jahren

You don't really need this extension to use containers -- it just adds some convenience, but the main functionality (creating containers, opening tabs in containers, moving tabs between containers, ...) is in Firefox core.

There are also other convenience extensions that use containers -- like Simple Tab Groups, which allows creating groups and assigning them to containers. I use it and have no need for the "Multi-Account Containers" extension.

troydavisvor 5 Jahren

If anyone else removes the extension like I just did:

1. The extension provides the ability to map certain sites to certain containers (more: https://support.mozilla.org/en-US/kb/containers#w_what-you-c... #5). If you use this feature, as far as I can tell, you need the extension.

2. You'll need to enable these about:config flags to get the container options: https://news.ycombinator.com/item?id=29347284#29348057. Also, removing the extension and then enabling those flags still reset my container settings to the defaults.

I use the site-to-container mappings, so I reinstalled the extension.

nicolaslemvor 5 Jahren

My only extension for containers is "Sticky Window Containers": the container used for the first tab in a window is used for all subsequent tabs.

rwkyvor 5 Jahren

I didn't know that, now I can remove this extension thanks :)

[deleted]vor 5 Jahren

usr1106vor 5 Jahren

Annoying change. Saw it yesterday and did not dare to accept. Good it comes up on HN, I might have forgotten.

I have never looked into extensions. Could I just repackage it without requesting the additional privilege? Well, if the code called it unconditionally even if I don't really need it the extension would stop working.

rzzztvor 5 Jahren

I also saw it, and accepted, but the current version is 8.0.1 and its release notes say "Restoring previous version for some users who may have been accidentally updated prematurely 8.0.". So now I'm not sure what this means :/

Edit: aaah, now I have 8.0.2 and am a member of the club!

Vinnlvor 5 Jahren

Should be possible, but not sure if the code calls it unconditionally. You can also take the old version of the source code and publish it yourself. Though possibly you can also just download and install that directly? https://github.com/mozilla/multi-account-containers/releases...

ezconnectvor 5 Jahren

You don't need it to use containers, just uninstall or disable it.

rmyorstonvor 5 Jahren

It's possible to benefit from containers without using the extension:

   https://support.mozilla.org/en-US/kb/containers#w_for-advanced-users

usr1106vor 5 Jahren

What functionality / convenience are you losing by doing so?

Vinnlvor 5 Jahren

I think the menu in your toolbar that allows you to open a new tab in a particular container (you then have to do it via a long press or right-click on the new tab button), to re-open a current tab in a different container, and this new container-specific VPN functionality.

extra88vor 5 Jahren

Without the extension, you can't set a domain to always open in a particular container, at least I couldn't find a UI to do so. To me, that is a very important part of using containers.

You extension also lets you sort open tabs by container but that doesn't sound very useful.

troydavisvor 5 Jahren

I experienced the same thing. Without the extension but with these flags enabled, there's no way to bind certain hostnames to certain containers.

This is sort of documented in https://support.mozilla.org/en-US/kb/containers#w_what-you-c... #5. That page covers it but doesn't clearly spell out that the itemized features are only possible with the extension. As far as I can tell, the extension is called "Multi-Account Containers" while the feature is called "containers" and readers are expected to know the difference when reading that doc. (Suggestion to Firefox docs maintainers: if that's correct, change all occurrences of "Multi-Account Containers" to "Multi-Account Containers Extension")

usr1106vor 5 Jahren

Oh, I had never discovered that feature... So I won't miss it yet. Need to think whether that makes it worth to use the extension again. For now I just enabled the manual configuration and have not noted any differences yet.

bucksfizzvor 5 Jahren

Nothing. The containers support is in the WebExtension API.

Firefox's multi-account container extension has no special access, beyond usual extension permissions.

d1sxeyesvor 5 Jahren

I checked that page, and I don't see how to enable this natively. This page just seems to point people to install the add-on.

Vinnlvor 5 Jahren

The anchor link doesn't scroll properly for me, but it's supposed to point to the heading "for advanced users".

The tl;dr is:

> you can set privacy.userContext.enabled to true and privacy.userContext.ui.enabled to true in about:config.

d1sxeyesvor 5 Jahren

Thanks!

vxNsrvor 5 Jahren

This is actually something I wanted, kinda. I like that they integrate the container proxy extension with the regular container extension, I just would rather they not try to sell the VPN thing so much.

usr1106vor 5 Jahren

It certainly sounds useful for users who need different VPNs / proxies in different tabs. But not everbody needs that, so not everbody should he forced to grant more privileges.

I don't need a VPN that often, so I have not investigated: Does it support any kind of VPN or just Firefox VPN?

jffryvor 5 Jahren

It looks like you can specify a per-container proxy URL. I imagine under the hood that's how the per-container Mozilla VPN support must work too.

ubbrvor 5 Jahren

I am super satisfied with the Containerise extension https://addons.mozilla.org/firefox/addon/containerise/) as alternative for Multi-Account Containers. It lets you map whole classes of domains to unique containers, which is an awesome and robust solution for logins involving a lot of redirects. Here are some example mappings which also catch all real subdomains (but not "fakeamazon.com"):

@^(.+\.|)amazon\.(de|com) , Amazon

@^(.+\.|)spotify\.(de|com) , Spotify

yepthatsrealityvor 5 Jahren

There is also this extension: https://addons.mozilla.org/en-US/firefox/addon/container-pro...

ComodoHackervor 5 Jahren

endgamevor 5 Jahren

I see - once again, instead of just letting people fund the damn browser, Mozilla is continuing with its tried-and-true strategy of randomly integrating things into other things.

evolve2kvor 5 Jahren

I’ve heard this comment so many times and had the same view.

Then recently I found out they do take donations.

Donate here for anyone who wants to :)

I’d guess it’s not enough currently to cover for the millions they need to replace once they need to sunset their Google Search funding deal.

https://donate.mozilla.org/en-AU/

gilrainvor 5 Jahren

It has been confirmed that none of the donated money (Mozilla Foundation) goes to Firefox development (Mozilla Corporation). You hear the comment often because it is true.

Traubenfuchsvor 5 Jahren

Donating to mozilla considered harmful.

https://itdm.com/mozilla-firefox-usage-down-85-but-why-are-e...

evolve2kvor 5 Jahren

Wow ouch. Didn’t realise the exec were taking so much pay. Really disappointing.

Someone help me out.. where can we find the constitution for the Mozilla foundation?

Who makes up the voting membership who could act on this sort of stuff at a governance level?

wodowvor 5 Jahren

https://foundation.mozilla.org/en/who-we-are/public-records/

evolve2kvor 5 Jahren

Just reviewed the articles of incorporation and the bi laws. I can see the problem.

The bilaws state that the foundation has no members. So there’s no accountability mechanism around the performance of the board.

I’d suggest the conversation we need to have is towards adding voting members to the foundation and its bilaws.

martin_avor 5 Jahren

There's no option to donate to a specific project, though. As much as I'd like to support Firefox, I do not want to support any other shiny projects that they'll kiff of in a year or two.

[deleted]vor 5 Jahren

AshamedCaptainvor 5 Jahren

The number of ads for mozilla VPN in Firefox is getting to ridiculous levels, even when I explicit disable all "featured" stuff in options.

Fortunately, you can still get rid of all of them by disabling stuff in about:config

[deleted]vor 5 Jahren

LilBytesvor 5 Jahren

Not at all related to this but posting for visibility.

Firefox never updates automatically for me and I've uninstalled, removed my account and other basic troubleshooting steps I've found through Googling never help.

I have to run the installer with every update. And that would be fine but it resets some settings that don't sync with your profile, as an example, it always changes language spell check back to US English from British or Australian English. Its giving me the shits.

How do I fix the above?