The Future of Developing Firefox Add-ons - <AUTHOR> https://blog.mozilla.org/addons/2015/08/21/the-future-of-developing-firefox-add-ons/https://blog.mozilla.org/addons/2015/08/21/the-future-of-developing-firefox-add-ons/ <comment><USER2> A funny comment on the post:

"BTW, if you really want to show us that you trust this much in these new WebExtensions, the first ones to appear at AMO should be Pocket and Hello.

Remove that code from the core Firefox and put it where it always should have been: an extension that anyone interested can easily install."

And a more serious comment from a developer of DownThemAll!:

"I was thinking of abandoning add-on development for a while now, mostly because of the Walled Garden signing approach that went live, which I strongly objected to and still strongly object to… I might have come to terms with it, once I see it play out in an actual implemention…

But "deprecating" XUL-based add-ons with XPCOM access takes the cake. Once that happens, I will abandon ship for sure. Simply because I cannot continue developing most add-ons at all as they will not and cannot fit into any "WebExtensions" API. The flexibility of what XUL-based add-ons can do IS the major selling point of the Firefox add-ons ecosystem and therefore IS one of the last remaining selling points of Firefox itself that isn't purely ideological. In comparison, the APIs that Chrome and competitors offer, that the Firefox Jetpack/ Add-on SDK offers, are just… toys.

To give a little background about myself to show that I'm not just the random hater shooting a drive-by comment: I wrote some more or less successful add- ons in the past, including DownThemAll!, and reviewed many, many add-ons as an AMO volunteer."

[https://blog.mozilla.org/addons/2015/08/21/the-future-of- dev...](https://blog.mozilla.org/addons/2015/08/21/the-future-of-developing- firefox-add-ons/comment-page-1/#comment-218580)

<comment><USER3> I use Tab Mix Plus for multi-row tabs in Firefox. It's so important to how I browse that it's the main reason why I use Firefox. If it goes away, then I have no reason to use Firefox.

<comment><USER4> Tab Mix Plus is explicitly mentioned as something they'll support: [https://wiki.mozilla.org/WebExtensions#Additional_APIs](https://wiki.mozilla.org/WebExtensions#Additional_APIs)

<comment><USER3> Lets be clear; they won't be supporting Tab Mix Plus. They will be providing an API that might allow something similar to be built by someone. This is a good thing but nothing is guaranteed.

<comment><USER5> It's not guaranteed, but they said they are hiring people to work with addon developers to update their addons. It seems very likely Tab Mix Plus would be on the top of that list, since it's already mentioned as an addon they want to work in the new model.

</comment></comment></comment></comment></comment><comment><USER6> > The Beta and Release versions of Firefox based on 42 and above (Beta 42 will > be released at the same time as Firefox 41) will remove the preference that > allows unsigned extensions to be installed, and will disable and/or prevent > the installation of unsigned extensions.

This is very bad news for me. I'm a power user that prefers the balance of new features/chance of breakage that the Beta channel offers and I take full responsibility for the addons I install and the security decisions I make. I don't need Mozilla to be "defending" me in this case.

<comment><USER7> _«The Nightly and Developer Editions of Firefox based on 42 and above will retain the preference to disable signing enforcement, allowing the development and /or use of unsigned add-ons in those versions»_

So I think running the Developer Edition (which I expect to be much more stable than Nightly) is probably your best bet.

<comment><USER6> The thing is, I'm not a web developer and I don't think I should be forced to use the Developer Edition just so I can remain in charge of what I install in my browser. Now that I'm writing this it occurs to me that after this change it's not really _my_ browser anymore, is it?

<comment><USER8> I hear you on the control thing. You mention you are a power user above so my two cents is that likely puts you outside of the user base Mozilla covets. In the last couple years, the words "Firefox" and "power user" went hand-and-hand but I'd wager Mozilla would trade customer bases with Google in a heartbeat.

FWIW, the Developer Edition feels pretty lean and mean. I haven't tried since I am a web developer, but it looks like you can remove most or all of the parts that make it web developer-y if you are so inclined.

<comment><USER9> _" You mention you are a power user above so my two cents is that likely puts you outside of the user base Mozilla covets."_

Mozilla's business model needs users who can't figure out how to turn off Yahoo search. That pays for their new Firefox offices on the waterfront in San Francisco.[1]

[1] [https://email@example.com,-122.3883498,3a,36y,...](https://email@example.com,-122.3883498,3a,36y,261.2h,88.58t/data=!3m6!1e1!3m4!1smc9fpZTq_- zg0zkcnud46g!2e0!7i13312!8i6656)

</comment></comment></comment></comment></comment><comment><USER10> So on the one hand I love that they're moving forward. Sometimes it's good to get rid of cruft (and boy is XPCOM crufty). On the other hand, the rich extension ecosystem is one of the highlights of Firefox.

I honestly don't know what I'll do if my TreeStyleTab extension is disabled. I lucked out because the Beta version has the preference to use unsigned extensions. But that extension is so fundamental to my Firefox experience that if they remove that preference in the new version then I think I'll have no choice but to turn off updates and live with my current version indefinitely. And that doesn't make me happy.

<comment><USER11> Furthermore, I doubt that such extensions will work without XUL/XPCOM, at least if WebExtensions work like Chrome extensions.

<comment><USER12> That's why they're also working on browser.html so vigorously

[https://github.com/mozilla/browser.html](https://github.com/mozilla/browser.html)

Web standards are fully capable of rendering entire user interfaces now. GUI toolkits are just needless dependencies for web rendering engines.

<comment><USER13> Exactly. Once all your front-end is in html, including the part that manages tabs, nothing prevent a WebExtension to implement TreeStyleTabs.

Also note that the same extension support is landing in Firefox OS (we are working on the missing apis), and will let you install the same extensions everywhere.

I understand people mourning xpcom access. You can do fun things with that, but I've also seen my share of horrors when I was reviewing add-ons (let's override the http protocol handler, what could go wrong!).

<comment><USER14> if i wanted something that has limited addons like chrome, why wouldn't I just run chrome, rather than some inferior "me too" edition?

I choose firefox because of the power of its addons, this is a huge issue for me as a user.

And yes, I know that you will be consulting with addon authors about api functionality, but i guarantee tons of stuff is still going to be lost...

<comment><USER15> >And yes, I know that you will be consulting with addon authors about api functionality, but i guarantee tons of stuff is still going to be lost...

Not to mention all the potential extensions that nobody has thought up yet that will no longer be possible and probably never will be. The ability to experiment and try out new ideas that nobody had thought of before is what gave us a lot of the extensions people use today. An API that tried to imagine all the possible features people might need and then locked down everything else would have prevented a bunch of the extensions that are popular today.

This problem exists for the web in general though (being a tightly controlled sandbox where only features agreed on by all the vendors are allowed). So I think Mozilla is probably institutionally incapable of understanding the problem, since it undermines the central mission of the entire organisation - which is to convert all end user software into software that runs in a vendor controlled sandbox. People who appreciate the creative cost of tightly controlled sandboxes probably wouldn't go to work for Mozilla.

</comment></comment></comment></comment></comment></comment><comment><USER16> Disabling unsigned extensions without any opt-in is a terrible decision. Putting up barriers to entry for addon developers in a browser that survives primarily based on the addon ecosystem is suicidal. Addon developers do not want to run unstable alpha channel builds, they don't want to have to manage multiple profiles, they don't want to build Firefox from scratch because the version they need is not available via a package manager. I really don't care about the rest of these changes, but they need to rethink their stance on unsigned extensions.

<comment><USER17> I agree.

One possible workaround would be to provide a way to add keys from which you would accept extensions. Then as part of the extension development process, you could sign your extension with your key when you are ready to install it.

If the issue Mozilla is _really_ concerned about is security, this should be an acceptable solution.

<comment><USER18> I think you have a good idea, but

> If the issue Mozilla is _really_ concerned about is security, this should be > an acceptable solution.

I don't know what you're implying here. That they're not concerned about security? What are they concerned about?

<comment><USER17> No, indeed I do hope that security is the primary thing they are concerned about.

But it is _possible_ they have other motivations (like control). I hope that is not the case, but I think it would be foolish to not even consider the possibility.

</comment></comment></comment></comment><comment><USER19> Long time coming, the FF extensions system has been a security risk and a development burden for years. Yes, it offered unique advantages, at a significant cost though.

Judging by the number of users on Chrome, it's hardly a dealbreaker change for most. Signing & locking down extensions is a necessity. Anyone who has to deal with the user side of IT will attest to that.

You can't bury your head in the sand and expect the problem to go away or wipe your hands of it and insist users should know better. The fact of the matter is, browser extensions are one of the most common malware attack vectors nowadays and vendors should be concerned about that.

It's going to be an unpopular change amongst hard-core Firefox users and FF- only extension developers, but you can't let diehards force you to drown with the ship. They'll live and find a way. It's regular users who will happily jump ship to Chrome, Edge and Safari without a second thought.

<comment><USER20> Chrome doesn't sign extensions though, and getting them listed isn't anything more specific then a 5$ charge—how can you judge whether its "hardly a dealbreaking change" based on that?

<comment><USER19> Chrome has moved quite steadily towards only installing extensions listed in the Chrome Web Store, which results in roughly the same restriction.

[http://blog.chromium.org/2015/05/continuing-to-protect- chrom...](http://blog.chromium.org/2015/05/continuing-to-protect-chrome-users- from.html)

Each vendor is moving at their own pace and in their own way, but the endgame is clear. With that comment, I was also referring to the depreciation of XUL more than the signing requirement.

<comment><USER20> No, its absolutely not. The new firefox addon signing requirements are a hundred percent more restrictive then the requirements to get listed on the chrome store.

<comment><USER21> Wrong. Chrome IS more restrictive, they don't allow non-Chrome Store add-ons AT all. With Mozilla's implementation all non-AMO add-ons need to do is go through the automated signing process. Which only takes a couple of minutes, at most.

<comment><USER22> > they don't allow non-Chrome Store add-ons AT all

This is wrong. You can drag and drop an extension into the Chrome extensions folder (or enable the developer mode in the extensions page) to install any extension in Chrome.

<comment><USER23> You used to be able to. You can't now.

<comment><USER24> You can, it just shows a warning about developer mode.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Standardizing the basic means of browser extension is something that I've been eagerly awaiting ever since Microsoft announced that Edge will support both Firefox (Jetpack) extensions and Chrome extensions. But how will future versions of Firefox handle the extensions that just can't exist in Chrome, such as NoScript and Tree Style Tabs?

EDIT: I'm also excited at the idea that this could give Servo a running start at an extensions story, since Servo will never in a million years support XUL or XPCOM and hence all non-Jetpack Firefox addons are destined to fail there anyway.

<comment> micro-ram I use ScriptSafe (formerly ScriptNo) in Chrome similar to NoScript on Firefox. Also check out uMatrix.

[https://code.google.com/p/scriptno/](https://code.google.com/p/scriptno/)

<comment><USER26> For one, it only a subset of Noscript: "A simple extension that brings ___SOME OF_ __NoScript 's functionality to Chrome"

Secondly, in order to achieve its goal, it's relying on a hack:

         ...
         if (getElSrc(this) && getElSrc(this).toLowerCase().substr(0,11) != 'javascript:' && getElSrc(this).toLowerCase().substr(0,17) != 'chrome-extension:')
         ...

Not taking anything away from this extension, just that this illustrates what everyone's saying - concerns about reduced functionality.

</comment></comment></comment><comment><USER27> "A major challenge we face is that many Firefox add-ons cannot possibly be built using either WebExtensions or the SDK as they currently exist. Over the coming year, we will seek feedback from the development community, and will continue to develop and extend the WebExtension API to support as much of the functionality needed by the most popular Firefox extensions as possible."

So to all extension developers leaning on the current permissive features or XUL/XPCOM, please contact Mozilla and help them with finalizing their WebExtension API in the upcoming year.

Also, in the future if all XUL in Firefox is replaced by browser.html, there might be full customization options again based on html/css/js (thanks to nwah1 for pointing that out).

</comment><comment><USER28> As a decade+ Firefox user I think this is fabulous news, not because it'll be easier for Chrome exts to come to Firefox, but because the old extension 'API' was a heap of junk and made it trivial for third parties to really gum up Firefox internals. Also huge kudos to Mozilla for not bikeshedding some new/slightly incompatible API, which I'm not sure Google would have been capable of. :)

Chrome's API is much better designed, I suppose, because they had the first chance in 15 years to actually sit down and design a modern/safe API for this specific purpose. XPCOM just exposed JS to endless unsafe internal Firefox interfaces.

<comment><USER29> Chrome doesn't have nearly as many useful plugins. If Firefox ends up that way, I'll probably use something else...

</comment></comment><comment><USER30> We at Opera have called on for a single (or at leat a shared) API for making browser extensions, which I think will benefit the developer community immensely (instead of making one set for each browser).

I think now the time is right to take a look again at NEX [https://dev.opera.com/blog/introducing- nex/](https://dev.opera.com/blog/introducing-nex/) and standardising core parts of browser extensions.

</comment><comment><USER31> It used to be that Firefox extensions could have the same capabilities as Firefox itself. It seems that this move is relegating them to second-class status.

Here's a list of things missing from the Chrome/WebExtensions API that our extension currently does:

\- Customization of the browser UI beyond a single, simple toolbar button or a few other specially implemented widgets.

\- Reading/writing arbitrary files to the file system. There is chrome.fileSystem, but it's limited in what it allows, and it isn't available to extensions, only Chrome apps.

\- Interfacing with other applications. This typically requires using platform-native APIs, which was possible with js-ctypes ([https://developer.mozilla.org/en-US/docs/Mozilla/js- ctypes](https://developer.mozilla.org/en-US/docs/Mozilla/js-ctypes)). Chrome has a socket API, but it's not really the best way to do IPC, and it isn't available to extensions anyway.

\- Some kind of SQL database. Firefox has an SQLite interface (MozStorage), but it's not part of the WebExtensions API. Chrome actually has WebSQL, but Firefox never implemented that (with good reason, IMO; it's tied to a SQLite and shouldn't be used on the web). I guess you'd better like IndexedDB.

\- Native-looking UI widgets. This is certainly possible to do in HTML, but it's not always so easy. For example, we have yet to find any reasonable HTML- based replacement for our tree view that's both visually appealing on all platforms and reasonably performant with thousands of items. (If you have suggestions, let us know!)

I guess Mozilla's viewpoint is that, since everyone is already supporting Chrome, they don't need these things. However, for our extension, the difference between the Chrome and Firefox implementations is that the Chrome implementation needs to talk to a separate app, while the Firefox implementation can do everything itself. Firefox used to give us a very powerful toolkit for writing apps, the same toolkit they used to create Firefox. Now it looks like all we'll have is a toolkit for writing simple browser extensions.

I think many people use Firefox because they can customize it the way they want to. Soon you won't be able to customize Firefox any more than Chrome. Maybe Mozilla is banking on Servo being so fast/secure that people will use it over Chrome even when all the other advantages are gone.

<comment><USER32> > relegating them to second-class status

That's the _goal_. "Web apps" are always going to be 2nd class apps, because it is _insanity_ to allow the spoofing of the native UI. The security sandbox will always have significant restrictions, by definition. If you don't like this, _write a native app_ instead.

> Reading/writing arbitrary files to the file system.

Are you _trying_ to open up a massive security hole? Filesystem access is banned on purpose. Writing an extension in a way that guarantees arbitrary filesystem access cannot be exploited through some complex interaction with the rest of the browser environment is probably impossible (see: the Halting Problem). It would certainly fail in practice.

Seriously, stop treating the browser as the OS+desktop. If your platform doesn't offer any true "native" access that has the features you want, then take that up with the platform's vendor.

<comment><USER33> > Are you trying to open up a massive security hole?

Firefox extensions run in a privileged context. They essentially are not really different from components of firefox itself.

Firefox components can obviously access the filesystem. So can extensions.

An extension in itself is not any more a security hole than firefox itself.

> Seriously, stop treating the browser as the OS+desktop.

While I agree with you there, what's needed to get to that point would be browsers actually talking to the native environment more. Pipes, sockets, filesystem access (chroot-style) even limited process launch capabilities.

If web or extension APIs allowed that it would be far easier to integrate with native instead of having to build it straight into the browser.

But that just addresses the "app" kind of extension.

Other extensions instead customize the web browsing experience. For example if you have a file form and want to do automation (filling in the right files?) then you already need access to the file system. This has nothing to do with native apps and yet needs access to native resources.

<comment><USER34> > Firefox components can obviously access the filesystem.

Which is a hole that should be plugged.

Beyond its home subdirectory and a tmpfs Downloads location an Internet- connected browser should be prevented from writing anywhere.

Bonus points for preventing read access to non-runtume locations too. Not only prevent bad data from coming in but prevent good data from being sucked out.

<comment><USER31> Sandboxing extensions' access to the file system would be acceptable. We could work with that, just as OS X app developers have. But Chrome and the current WebExtensions API don't allow extensions _any_ file system access beyond what webpages get.

</comment></comment></comment></comment></comment><comment><USER35> Well, this is all terrible. They mention having to use the nightly or developers releases instead of their walled garden versions. But both of those are unstable and very crashy. And how likely are they to keep the unbranded version up and updated as time goes on?

And getting rid of the entire firefox add-ons community is just insane. The add-ons are what makes firefox good. It's why people use Firefox. I guess if they just want us to use Chrome this series of changes will work great.

<comment><USER36> I don't have sufficient command of the English language to fully express how strongly I disagree with this. I have an extension which I made for Chrome and Firefox. The Chrome version basically consists of a single Javascript file, and a tiny json file with about 15 entries. I spent perhaps an hour to learn the basics from scratch. I don't have space here to describe all the crap I went through to get the same extension working on Firefox - and I was using their _easy_ API. The Firefox extension development process is one of the most confusing, complicated, experiences I've ever had on a computer. Good riddance!

<comment><USER10> Nobody said Firefox was _easy_ to develop add-ons for, the GP said _" The add- ons are what makes firefox good"_. The add-on API itself might be arcane and confusing and horrible, but you basically have access to _everything_. Since the entire browser is written in XUL, add-ons can override and recreate anything at any level.

The end result is that Firefox users have a much wider array of add-ons to use (despite the add-on system being somewhat crazy by today's standards).

<comment><USER36> Well I disagree with him/her there too. What _made_ Firefox good was that it was a lightweight, simple browser, that rendered content exactly the same on three OSes. It's still my main browser, but that's only because I want less Google in my life, and because Safari aspires to be a motion picture instead of a tool. But I haven't considered Firefox actually "good" since probably 2010, or whenever it was that they dumped a bucket of LSD on the interface. Since then it's become a bloated mess.

If someone wants to add toolbars and skins, etc, I suppose the new API would disappoint. But it's hard for me to relate, because I'm not that adventurous. The ones I really care about, generally AdBlock and privacy extensions, just interact with web content, not chrome. That sort of add-on is just as available on Google Chrome.

<comment><USER35> Tell it to NoScript.

<comment><USER36> Ha, well you do have a point there.

</comment></comment></comment></comment></comment></comment><comment><USER11> I switched to Firefox in part because XUL-based extensions can heavily customize the user interface. Things like Tile Tabs, Tab Mix Plus, and other extensions have been extremely useful to me. Despite my dislike of XUL as a language, I'm sad to see XUL extensions go; I suspect that WebExtensions will, like Google Chrome extensions, be much more limited.

In fact, I had always hoped that FF would move in the opposite direction, and split itself apart into a bundle of extensions, so that even more customization could be possible.

I've also always enjoyed being able to run the latest versions of extensions, which sometimes take a while to get Mozilla's approval.

Are there any plans to maintain a fork of Firefox that will not include these changes?

<comment><USER11> In short, I would like to find a web browser that follows the Unix philosophy to a greater extent than Firefox/Chrome/IE.

<comment><USER37> wget piped to less.

<comment><USER38> To state the obvious, that won't have Javascript support.

<comment><USER37> Javascript is not compatible with the Unix Philosophy.

</comment></comment></comment></comment></comment><comment><USER39> And this is how Google killed Firefox. Why do people use Firefox? For extensions. What breaks extensions, frequent updates and extension API changes.

Google managed to suck Mozilla into frequent releases and now extension API changes that make Firefox yet another generic easy to substitute browser. Wow, just wow.

<comment><USER40> Frequent releases aren't a bad thing, per se. Although, huge API changes like this, without a valid plan for supporting existing ones a large community depends on seems like a disaster in the making.

The impression I get is that Mozilla wants to be more involved in the user experience around their codebase, but personally I preferred firefox's lack of involvement. I think the UI is poorly designed and getting worse, but as long as it was easy to modify, it wasn't an issue. The real value in firefox for me is gecko. Most other things largely get in the way, and it seems like that's what's becoming the focus.

I can understand the need for a better designed add-on API, but there should probably be a non-compulsory reason for people to switch.

</comment></comment><comment><USER17> "we will require all extensions to be validated and signed by Mozilla starting in Firefox 41"

I hope there is an "opt out" option to this for people who know what they are doing. I understand the reasoning behind it, but what about an extension I write just for myself that I don't wish to share with Mozilla? I don't particularly like having that option taken from me.

Yeah, I know, I could edit the source and work around it -- but based on past attempts to just _build_ firefox, that could be a real pain.

<comment><USER33> There will be unbranded builds that provide that option, branded builds will enforce signature verification.

<comment><USER17> Are you referring to iceweasel? Or are you referring to an unbranded build provided by Mozilla?

I honestly don't remember any other browsers that have the Mozilla branding removed, but I haven't really tried to find any.

<comment><USER41> Mozilla will provide these unbranded builds in the en-US locale.

See "What are my options if I want to install unsigned extensions in Firefox?" in the FAQ for more info: [https://wiki.mozilla.org/Addons/Extension_Signing#FAQ](https://wiki.mozilla.org/Addons/Extension_Signing#FAQ)

</comment></comment></comment></comment><comment><USER42> It doesn't mention addon permissions, which I would assume is something WebExtensions has, since that's how addons work in chrome. At least I hope this is the case, lack of permissions in firefox addons is a little scary, and probably one of the reasons I have the minimum addons installed

Anyone have more info on this?

<comment><USER43> Same permissions model as Chrome - [https://wiki.mozilla.org/WebExtensions#Permission_Model](https://wiki.mozilla.org/WebExtensions#Permission_Model)

<comment><USER42> Excellent, that's what I wanted to hear! Thanks

</comment></comment></comment><comment><USER44> I worry that extensions that implement their own navigation and user experience will no longer be possible.

I use Vimperator extensively and would hate to see it go.

Chrome does have Vimium, but it is quite clunky and limited compared to the couple of Firefox solutions.

</comment><comment><USER45> I was under the impression that add-ons like ublock / umatrix were possible only in firefox due to its very permissive add-on model, if mozilla is going to deprecate XUL / XPCOM would it mean this kind of add-on won't be possible anymore?

<comment><USER43> uBlock - [https://chrome.google.com/webstore/detail/ublock- origin/cjpa...](https://chrome.google.com/webstore/detail/ublock- origin/cjpalhdlnbpafiamejdnhcphjbkeiagm)

uMatrix - [https://chrome.google.com/webstore/detail/umatrix/ogfcmafjal...](https://chrome.google.com/webstore/detail/umatrix/ogfcmafjalglgifnmanfmnieipoejdcf)

<comment><USER45> thanks for the clarification, I haven't looked at add-ons for other browsers for quite a while, and at the time I remember discussions about adblock not being possible to be done anywhere else like in FF due to the add-on model, glad to see this does not seem to be the case anymore

<comment><USER46> I think the big difference is being able to pre-emptively block/modify requests, vs. changing what is displayed after the fact.

<comment><USER45> that was what I thought as well, however I went to the umatrix github page and if you look at the top it links this page[1] that discusses how umatrix needs permission to disable prefetching so no network connections are made for blocked sites, which seems to imply it can do the pre-emptive blocking as opposed to just hiding of elements.

I am wondering though now if I am mixing things up in my brain and the issues were with safari add-ons as opposed to chrome/chromium: there is no umatrix for safari[2] that I can see, ublock seems available but not ublock origin, but I am not sure if ublock on safari just hides or actually pre-emptively blocks.

[1] [https://github.com/gorhill/uMatrix/releases/tag/0.9.1.2](https://github.com/gorhill/uMatrix/releases/tag/0.9.1.2)

[2] [https://github.com/gorhill/uMatrix/issues/96](https://github.com/gorhill/uMatrix/issues/96)

<comment><USER47> > umatrix needs permission to disable prefetching so no network connections > are made for blocked sites

Disabling pre-fetching is to prevent a TCP connection to be established at all, and this is something that needs to be also dealt with in Firefox -- it's not just a Chromium thing. This ensures that no TCP connection is established before it has been decided whether a network request must be blocked or not.

Chromium used to not be able to support the pre-emptive blocking of network requests, but that has been remediated in 2012 with its webRequest API in Chrome 17.

[1] [https://developer.chrome.com/extensions/webRequest](https://developer.chrome.com/extensions/webRequest)

<comment><USER33> Which brings us back to the point that one cannot develop any new, unforseen kind of extension unless you either have the option to directly interface with the browser's internals or somehow get that API included in the browser.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Great news. With the current system, firefox's stability, upgrade compatibility and performance were entirely dependent on every author of every extension I use being sufficiently careful. It meant a lot of periodic purges, housekeeping, and reduced trust. I'm sure the overhead helped users move to chrome, despite Firefox's vanilla install being lighter. Reducing the API surface was a necessity.

Also, it takes a lot of effort to cope with the churn in internal APIs, and I had to get rid of promising extensions like Pentadactyl because they broke too often. With a smaller, stable API, that problem doesn't exist. I don't believe that the current tradeoff of power vs responsibility was working out in the majority of cases, and I've seen enough evidence in the form of lagging addons and neglected ports.

<comment><USER33> > It meant a lot of periodic purges, housekeeping, and reduced trust.

> I don't believe that the current tradeoff of power vs responsibility was > working out in the majority of cases,

For me those tradeoffs are worth it. Sometimes it means installing a beta builds of an addon or nagging its developer on github or even finding a replacement. But that's still better than not having the addons at all because the APIs simply make it impossible to have them in the first place.

If mozilla separated addons into "uses stable APIs only" and "might break at any time, we may even turn them off if they cause to many crashes" that might allow users to choose which kind of model they want to follow.

<comment><USER4> XPCOM has support for stable, versioned APIs, but no one cared about using that subset since the rest was also available; it stagnated and the supposedly unstable APIs ended up bearing the compatibility burden. Now there will only be a supported subset, and the trickier stuff will require getting a patch accepted instead of monkey-patching and letting the user cope with the breakage. Your coping skills are above average, I've submitted patches too, it's still yak shaving and not a very productive use of time. Working out APIs is a hard problem, it should be handled as part of the development phase instead of being completely disconnected.

</comment></comment></comment><comment><USER48> WebExtensions is very good news. One of the biggest pains is to develop extensions compatible both with FF and Chrome so it would make our lives a lot easier.

</comment><comment><USER49> The title is a bit misleading:

> We are implementing a new extension API, called WebExtensions—largely > compatible with the model used by Chrome and Opera—to make it easier to > develop extensions across multiple browsers.

This is basically the creation of a new, multi-browser API standard for browser extensions. This isn't them just adopting a single competitor's ecosystem. There is also a slim chance IE and Safari will join the plugin ecosystem.

EDIT:

Ty mods, this title is more reasonable.

<comment><USER50> > There is also a slim chance IE and Safari will join the plugin ecosystem.

You mean Edge. IE development is pretty much dead except for maintenance releases, and it now exists solely to handle legacy websites (read: corporate dinosaurs that rely on ActiveX).

<comment><USER49> Edge is basically IE in purpose and function. I don't really buy into the rebrand.

</comment></comment></comment><comment><USER51> Ya know, my initial reaction to this was pretty negative. As a developer, I don't like the idea of losing access to a more powerful technique in favor of a less powerful one. If I want to write an add-on, I _want_ XPCOM / XUL, etc., at least as an option.

However, giving it more thought, I think this might actually be a Good Thing in the long-run. OK, it's a stretch, but hear me out... I've been a vocal opponent of this whole idea of making the browser a poor man's operating system for a while. I want a Web where browsers are really good at, well, _browsing_ hypermedia, and other applications handle "application stuff". So maybe, in a roundabout fashion, making it a little bit harder to extend the browser even further, will encourage people to shift back to a model of handing off some kinds of requests to an entirely different app, rather than trying to shoe-horn the kitchen sink, bathtub, 3d printer, milling machine, jumper cables, semiautomatic pistol, bandsaw, swimming pool, and clown suit all into the browser.

Or maybe not. Hey, a guy can wish, right?

<comment><USER52> I think the opposite is more likely: Firefox and Chrome using the same extension mechanism -- and, inevitably, that means two-way chasing on implementing APIs that prove useful -- means that even if the ability to do more complex apps in Firefox falls in the short run, the ability to more complex apps in the _browser_ in general (or, at least, Firefox, Chrome, and their descendants and others who adopt the same framewoek) is going to accelerate over a longer term.

<comment><USER51> Yeah, I'm afraid you're right. :-( But like I said, a guy can wish.

A more interesting question might be: "What would it take to slow down this movement towards doing everything (and then some) IN the browser"?

</comment></comment></comment><comment><USER53> I still don't like that the AMO review process can take weeks and months. Mozilla even says it themselves!

But hopefully with WebExtension and a permission model things will get easier for getting through reviews.

</comment><comment><USER9> _" A major challenge we face is that many Firefox add-ons cannot possibly be built using either WebExtensions or the SDK as they currently exist."_

That's so Mozilla. There's a long history in add-on development of Mozilla deprecating the old thing before the new thing works.

XUL/XPCOM had to go. The mobile browser, "Fennec", doesn't use it at all.

But the "Jetpack" API, the one Mozilla wanted everyone to use instead of XUL/XPCOM, is apparently being deprecated as well. The announcement says it will "continue to work", but the new API seems to be completely separate from Jetpack. That probably means bugs in Jetpack won't be fixed, and bug reports will be answered with "convert to (new thing)".

 _Mozilla AMO. Embrace the pain._

<comment><USER54> Jetpack was such a clusterfuck. Horribly documented, released while not ready for prime time, missing basic functionality, and progressing as slowly as Italian criminal trials. I can see the point of them starting from scratch.

It would have been nice if they had learnt their lesson and actually started communicating changes _after_ they had something real to show, but alas, it seems like they're doing the same thing, just a little bit faster (maybe).

<comment><USER9> " _Jetpack was such a clusterfuck. "_

Yes, and now that it pretty much works, after years of bug reports and nagging to get bugs fixed, they're deprecating it.

</comment></comment></comment><comment><USER50> I'm really disappointed with them deprecating XUL extensions.

I use a number of extensions that extensively modify the UI (e.g. Tab Mix Plus), and honestly I'd rather just stick with an older version of Firefox than use Firefox without these extensions.

<comment><USER4> They're using the WebExtension model of isolated extensions with permissions. They're not going to limit themselves to any competitor's API, they'll build a superset by consulting with the developers of popular extensions. Tab Mix Plus being the 15th most popular extension, it's pretty certain they'll be consulted on the new APIs.

Quoting from the announcement:

> A major challenge we face is that many Firefox add-ons cannot possibly be > built using either WebExtensions or the SDK as they currently exist. Over > the coming year, we will seek feedback from the development community, and > will continue to develop and extend the WebExtension API to support as much > of the functionality needed by the most popular Firefox extensions as > possible.

</comment></comment><comment><USER55> I loved this: " We would like add-on development to be more like Web development: the same code should run in multiple browsers according to behavior set by standards, with comprehensive documentation available from multiple "

</comment><comment><USER56> >Blink-compatible API in Firefox called WebExtensions

Does anyone know why they are calling this API Blink-compatible rather than Chromium-compatible? My understanding is that Blink is just the rendering engine and extension code can be found within the main Chromium project.

My best guess is that they are referring to it this way since I think that currently the list of browsers that use Blink is the same as the list of browsers that use Chromium code and people are more used to categorizing browsers based on their rendering engine rather than where the code originated.

<comment><USER52> > Does anyone know why they are calling this API Blink-compatible rather than > Chromium-compatible?

That's a good question, since the two sources they link to (from Chrome and Opera) both refer, directly or indirectly, to Chromium extensions, and neither refers to "Blink" at all.

</comment></comment><comment><USER54> It looks like a bad case of Big Rewrite. Which is mildly unsurprising, coming from an organization that was created to undertake a Big Rewrite; however, after the dismal Jetpack experience, I'm surprised they want to do it all over again, just harder and with no safety net.

How can you tell your own developer community "what you're doing now, it won't be allowed next year; but what will be, we don't know yet"? You might as well tell them to go home.

</comment><comment><USER57> We all know too well what happens when a backwards-breaking change is imposed without strong functional justifications : most developers don't actually put the effort to upgrade and as a result the vast majority of extensions break. Case in point : python modules, after tremendous effort and years of waiting about 2/3rd of the existing modules have been ported from python 2 to 3.

This is relatively "mitigated" in the case of add-ons because backwards- incompatibility has become the norm so old add-ons are likely to break anyway at some point, but this still seems like a very bad idea for Mozilla to kill a large portion of their ecosystem in that single move, especially if in the bunch are very differentiating extensions like Tree Style Tabs.

Justifying the decision by becoming even more interchangeable with Chrome is especially baffling, what is the strategic point of this?

<comment><USER23> Python 2/3 yielded very little benefit.

That's not the case for Firefox's migration: WebExtensions are easier to write and work with other browsers.

</comment></comment><comment><USER58> >We have decided on an approximate timeline for the deprecation of XPCOM

Thank god, this undocumented crap is a nightmare to use

</comment><comment><USER2> They want to kill XUL for Firefox, so they must first kill XUL for add-ons so that the add-on situation sucks so bad with XUL Firefox that people don't lose anything by moving to non-XUL Firefox.

And once they kill XUL, they can kill gecko, the maintenance of which is the bane of their job.

<comment><USER59> That's not the plan.

We've identified that XUL is a growing impediment to Firefox's continued success. Exactly what that means (there are dozens of reasons and dozens of ways forward), and how we're going to tackle it, is a big topic that we're digging into.

Yes, removing XUL implies that XUL-based add-ons are not going to last forever. That doesn't mean there won't be a path from here to there: everyone involved recognizes that add-ons are important, and we're increasingly going to be shipping parts of Firefox itself using add-on mechanisms.

And I haven't seen anyone seriously consider killing Gecko: it continues to be awesome, and one of the motivations for deXULification is to allow our platform developers the freedom to only focus on supporting HTML UIs, not a mix of HTML and XUL.

</comment></comment><comment><USER60> Uh-oh. The main reason I use firefox is vimperator. Followed by the open source, easy to self-host sync framework, noscript and adblock.

One thing I don't see anything about wrt extensions is user control. If ff is to remain relevant - signing extensions will need to come with a trust management framework. I might want to run extensions signed by Debian and myself - but not mozilla (in iceweasel). RedHat (or other vendor) might want their unbranded ff fork to only use RedHat extstensions by default; maybe with an option to also allow upstream ff signed exstensions.

Without that; I see no point in signing support in a free software product?

<comment><USER61> Regarding Vimperator:

[https://billmccloskey.wordpress.com/2015/08/21/firefox- add-o...](https://billmccloskey.wordpress.com/2015/08/21/firefox-add-on- changes/)

<comment><USER60> Well, that's more regarding Noscript and Tree Style Tabs, actually -- it only mentions vimperator/pentadactyl in passing. Either way, thank you for the link -- hopefully the development of new APIs won't lead to a regression wrt. the add-on ecosystem :-)

</comment></comment></comment><comment><USER62> Frankly the only reason I keep using Firefox instead of Chrome is because of TreestyleTabs.

If this change means TreestyleTabs will not work/won't get updated, then I don't see myself continuing to use it.

</comment><comment><USER63> We can talk about "only approved extensions" after they have taken time to consider the pinboard extension.

For now I am happy someone have told me that Pale Moon exist.

</comment><comment><USER64> > ... [cross-process object wrappers] are much slower than the equivalent DOM > operations in single-process Firefox, and can affect the user experience > negatively. Also, some accesses aren't supported by the compatibility layer > and will throw exceptions.

Hmm, that sounds... bad?

<comment><USER65> I don't see why cross-process XPCOM would have to be particularly slow. Windows is built on cross-process COM.

<comment><USER23> Windows isn't built on COM, Windows is built on Win32 which is a 1980s API hurriedly updated to 32-bit.

</comment></comment></comment><comment><USER66> "This post really marks the final end of Firefox. The end of a truly robust Add-On model is the only thing remaining at all that sets Firefox apart. The Foundation's constant running after being a Chrome-alike has finally run the browser into the ground fully."

This comment hit the nail on the head.

Really in general the browser vendors are all killing the web day by day. Maybe ~2004 to around 2013/2014 or so will be remembered as the golden age of web browsers. NPAPI worked in major browsers, you were allowed to install extensions without Mozilla or Google's permission, and Firefox had yet to mutilate its interface in an attempt to be a Chrome lookalike.

</comment><comment><USER67> The last Symbian in Nokia phones was also very strict with signed applications. I bypassed it, but it is my impression that most people did't bother.

</comment><comment><USER68> There used to be a time when I loved firefox..the new versions are slow and sluggish. If I open the developer console, its super slow.

<comment><USER4> The developer console can disable the cache so that you can edit websites live, is that what you're seeing?

Also, I wonder if it's still slow if you restart with extensions disabled. There's a lot of hidden interactions in the current model.

</comment></comment><comment><USER69> though its late, security review is a great thing! (maybe firefox realized its urgency after a major security flow found in Pocket.)

</comment><comment><USER70> "To make sure that some of our users are more secure, we're going to implement a change that will cause some of our users to refuse to update their browser - potentially making them less secure."

I've disabled updates in FF.

Palemoon removed Tab Groups and the addon is _extremely_ buggy and doesn't restore properly when the browser crashes. Waterfox had several issues with plugins I use.

I guess it's time to fork FF and maintain my own version, implementing security patches as they come in?

<comment><USER71> >I guess it's time to fork FF and maintain my own version, implementing security patches as they come in?

AKA Iceweasel?

<comment><USER70> Is Iceweasel able to be compiled on Windows? I don't see why they would distribute/maintain it outside of Debian/*Nix distribution. Although maybe they decided not to touch the makefile? (And any currently available "Iceweasel for Windows" is hosted on malware sites.)

GNU IceCat could also be an alternative along the same lines, and I know for sure that IceCat can be compiled on Windows and they distribute a Windows binary.

The only problem being GNU IceCat doesn't seem to work on my work computer..

<comment><USER71> I have no idea, but I'd guess not, sorry. But if you want to have control over what your computer does, why are you using Windows? :P

<comment><USER70> I want control over what my _browser_ does, not necessarily my _operating system_.

I'm highly selective over my software as I require it to fulfill very precise goals in the exact manner of my choosing. If it fails to do so, I'll find better software.

For example, I have yet to find an image viewing software that is satisfactory for my usage that exists for Unix distribution. I use an extremely niche, unheard of software that is 'Windows Only'. It's so niche that searching for the name of this software on Google only results in posts of me talking about the software. (I decline to name for privacy reasons.)

My operating system is a platform to run software. I'd hop to Debian or Arch in seconds if I could find existing software that meets my needs. While the image browser is one example, there are more that do not exist to my desired standards outside of Windows applications.

My desire for software that performs certain functions and in the manner I want outweighs my desire for privacy from my government and control over every system of my operating system.

ps:

I know your question was probably meant rhetorically.

</comment></comment></comment></comment></comment><comment><USER72> Well, that might make me look into SeaMonkey again...

</comment><comment><USER73> You know, I had plenty of reasons to list about how useless signed extensions are for what they're trying to achieve...

I'm even _already_ running an "unbranded" firefox in all my devices (iceweasel, fennec), for the same reasons I have to run chromium, so I won't even be _directly_ affected....

But there's only one thing I really want to say to Mozilla right now, as a developer:

Fuck you Mozilla.

And there's another, as an user of which most extensions are unsigned:

Fuck you again, Mozilla.

aaah feels better.

<comment><USER66> I agree, the web gets less and less open and free by the minute. It's actively hostile to user choice half the time.

<comment><USER73> When Mozilla will decide, apple/google style, what is and what is not acceptable as an extension for their browser, people will maybe realize that this is just the tipping point.

But maybe that won't be necessary anyway. By adopting a very limiting standard for extension development and dropping xul (which might be a good idea for other reasons though), there won't be any significant difference between firefox and (say) chrome. A few tweaks in the browser frame won't attract masses of people. Switching from Chrome to Firefox on Android require a pretty _big_ incentive.

Right now, I'm on firefox only for the extensions. I have really no other compelling reasons.

</comment></comment></comment><comment><USER74> It's only surprising if you don't understand that Mozilla's core mission now is to promote a permanent JavaScript monopoly. Mozilla has committed to blocking any technology which could ever offer equal support to any other languages. Now they cannot even allow plugins unless they are based on JavaScript. "The Web" used to mean web pages and HTTP, now "The Open Web" and "Web Technologies" mean we are forced to work with a growing mountain of ill- considered, weird and unsafe "bad parts" forever.

In a strikingly similar parallel dimension, vendors have applied pressure to ensure that networked PCs would only run COBOL, and other languages could only be supported by compiling to a subset of COBOL that inherited its semantics so that nothing would ever be faster than COBOL. In that parallel dimension, this restriction is known as "Open Web", although nobody knows what is open about it.

<comment><USER75> It sounds like you might not like JavaScript. You should know that there are good languages that compile to JavaScript.

<comment><USER74> They have the same basic semantics as JavaScript.

It's not about that. Even if I liked COBOL, I wouldn't want a world where only COBOL can be used. And it doesn't make sense that this world has to be artificially enforced when there is demand for variety.

<comment><USER75> Not sure what you mean by the "same basic semantics". I think the semantics of Go and Elm are quite far away from JavaScript. Dart less so, but it's enough to change the developer experience quite a bit.

I don't particularly like x86 instructions, but they also don't bother me that often.

Granted that JavaScript isn't sufficiently hidden yet, particularly in debuggers. That will take a few years. On the other hand, it's significantly more readable than assembly and getting better, so as a compiler target language, I think it will work out okay.

The forces here are no more artificial than the ones that made the industry standardize on x86 and (later) ARM. Popular, accepted standards become more popular when the barriers to alternatives are very high, as can be shown by the people who tried and failed with strong alternatives.</comment></comment></comment></comment>


Yahoo in talks to buy MySpace from News Corp? (original source) - <AUTHOR> http://business.timesonline.co.uk/tol/business/industry_sectors/media/article1957867.ece <comment><USER2> The deal would be in stock, not cash, and so is more a reflection of the value of MySpace to Yahoo, not the value of MySpace to everyone using the dollar as a standard. If MySpace is lined up to be trounced by Facebook, then I would imagine that Yahoo has some reason to be concerned as well (their problems are showing more and more through the seams). Remember when Google bought YouTube and within a couple of days the increase in Google stock price paid for the acquisition cost? Perhaps MySpace is indeed this valuable to Yahoo.

</comment><comment><USER3> the people at Yahoo! must have smoked quite some pot...

they paid 2 billion dollars for geocities back when money had no value, and they are ready to throw away as much as 11 billion for MySpace - which, btw, is getting and will get hammered by Facebook.</comment>


Show HN: Quickly enable popups that support any HTML - <AUTHOR> https://madprops.github.io/Msg/ <comment><USER2> Nice one. Starred :)

Also opened two issues..</comment>


Unilever will not invest in online platforms that create division - <AUTHOR> https://www.unilever.com/news/Press-releases/2018/unilever-will-not-invest-in-online-platforms-that-create-division.html <comment><USER2> Without division you cannot have dissent. This sanctimonious BS is exactly the kind of thing ordinary people scoff at. Cutting down on online bullying, stalking, and harassment is great. Figuring out what news to believe because you presume people are too stupid to figure it out for themselves is just degrading.

<comment><AUTHOR> Incorrect.</comment></comment>


Amazon's ML University is making its online courses available to the public - <AUTHOR> https://www.amazon.science/latest-news/machine-learning-course-free-online-from-amazon-machine-learning-university <comment><USER2> I took a number of these courses as an Amazon software engineer and I found them very useful.

Amazon's goal of the internal program is to train Software Engineers to know enough about data science to be effective as "machine learning engineers." Once trained, software engineers can either implement models themselves, or more likely, partner with a data science team to productionize a model.

The courses by Brent Werness are particularly good, he has a knack for explaining the intuition behind the math, pulling back the layers of abstraction, so it's not just "call scikitlearn and cross your fingers."

Some of the more advanced topic courses like Natural Language Processing are particularly challenging, as the material is more of a survey of the latest research papers, to give you an idea of the state of the art, but understanding the mathematical tools is non trivial.

</comment><comment><USER3> Links to course playlists on youtube: [https://www.youtube.com/channel/UC12LqyqTQYbXatYS9AA7Nuw/pla...](https://www.youtube.com/channel/UC12LqyqTQYbXatYS9AA7Nuw/playlists)

and the corresponding github repos: [https://github.com/search?q=org%3Aaws- samples+%22aws-machine...](https://github.com/search?q=org%3Aaws- samples+%22aws-machine-learning%22)

</comment><comment><USER4> I really appreciate this kind of courses. And I would like to see more produced from public institutions. As good as Google or now Amazon courses are, I have seen too many colleagues that instead of engineers are Google extperts or Amazon experts and lack a broad view of software engineering.

I love company specific courses to get knowledge that helps my company to evaluate which product to purchase. But, I dread to work with colleagues that invest their curriculum in a company and become radical protectors of that company. Software engineering is more that knowing the API for product A or B.

<comment><USER5> > Software engineering is more that knowing the API for product A or B.

You're confusing software engineering for computer science.

Software engineering on average is indeed knowing the APIs of a few frameworks or products well.

<comment><USER6> I'm inclined to agree with you, but I'm guessing OP is referring to "craftsmanship in software engineering", which is probably a mix of both computer science and other habits formed over many years of conscious focus on improvement?

One of those habits could be how to generally solve a problem, versus how to just duct-tape together a solution. If we don't understand something from first principles, we don't really understand it in my opinion.

I'm lucky to mostly work with people who're both good at their craft, as well as good at "getting the job done". For me personally it would be frustrating to be subjected to massive tech-debt generation and sub-optimal solutions just because the team is unwilling to step outside a walled garden.

<comment><USER7> _If we don 't understand something from first principles, we don't really understand it in my opinion._

How many modern developers have written a single line of assembly yet alone written production assembly code? How many have even written C or used any other language that doesn't have garbage collection.

Everyone who started working on a technology before abstractions make it more accessible think that you really need to understand deeper to be effective.

I had to get out of that mode of thinking myself as I've been in the software field either as a hobbyist or professionally for 35 years and I did start off writing assembly as a hobbyist (and some as a professional) and spent a decade writing C.

But then, I also see the same attitude from old school infrastructure guys now that I live part of my life on that side of the world when they say I really need to understand the "fundamentals" of IT and I can't possibly be effective as a consultant if my only experience standing up infrastructure is writing a yaml file.

At the end of the day not everyone needs to understand the fundamentals to get their work done and create business value no more than your software as a service CRUD developer needs to know how to reverse a binary tree on the whiteboard.

</comment></comment></comment></comment><comment><USER8> What would be the criteria to say ML is becoming another commoditized skillset sort of like how cloud computing or mobile app development eventually became? I feel like there is a big increase in these types of resources that make it possible for anyone (with necessary background) to learn.

<comment><USER9> There are resources out there to learn _any_ tech skill with the necessary background—and resources to pick up the necessary background if you don't have it. At the same time, tech as a whole is not (fully) commoditized, at least in the sense that there is a wide range to the market and a lot of differentiation towards to top end of the skill distribution.

My impression is that ML is getting to the point where you can do useful ML for _some_ businesses without needing particularly deep expertise or creativity so I could see a commoditized lower end to the market developing (just like you can get a generic mobile app from a random consultancy), but there will still be a lot of important business problems that are too hard to tackle that way, leaving a lot of room for experts in the market as well.

</comment></comment><comment> barry-cotter This is a fantastic initiative, like the Career Certificates Google announced lately [1]. I do wonder why Amazon didn't partner with Coursera, EdX or similar to offer certification along with the knowledge. Anything that makes learning more legible is to Amazon's benefit as a giant hiring machine limited by the attention of technical talent. If they offered certs they could (perhaps) allow the holders to skip one stage of interviews, like a phone screen, or even just automatically allow them access to Amazon's coding screen like Hacker Rank.

[1] [https://grow.google/certificates/](https://grow.google/certificates/)

<comment><USER7> _If they offered certs they could (perhaps) allow the holders to skip one stage of interviews_

For all that is holy I hope not - speaking as a consultant who works at AWS. I held a number of AWS certifications before being hired. I used them mostly as a guided learning path to help me know what I didn't know. I also had "enough" real world experience as both a developer and working with AWS's fiddly bits to be useful relatively quickly when I started working here.

I saw far too many "paper tigers" when I was in the real world who have all of the certifications you could imagine but couldn't pass my relatively simple tech screen when I was hiring operations people to take some of the load off of me so I could concentrate on some development projects.

Certifications in no way prove competency.

</comment></comment><comment><USER10> My guess: using all amazon tools to get you tied into their stack. This is an Amazon MO I don't likeand have seen frequently (along withmany stockholm syndromed users). I hope I'm wrong though.

<comment><USER11> When I took some of these courses at Amazon, they were taught using open source tools like numpy and mxnet. Assignments and enrollments used an internal platform, and most hands-on work used a Jupyter-like platform that I don't believe is offered as an external service.

There was a special session offered at one point that covered how to apply what you had learned using AWS services like SageMaker, but it wasn't integrated into the curriculum. (Not sure if this is still the case; I took MLU courses in early 2019.)

</comment></comment><comment><USER12> This is exciting for all the learners!

On a different note, recently I was looking to learn AWS concepts through online courses. After so much of research I finally found this e-book on Gumroad which is written by Daniel Vassallo who has worked in AWS team for 10+ years. I found this e-book very helpful as a beginner.

This book covers most of the topics that you need to learn to get started:

If someone is interested, here is the link :)

[https://gumroad.com/a/238777459/MsVlG](https://gumroad.com/a/238777459/MsVlG)

</comment><comment><USER13> I'm very interested in giving these classes a shot when they become available. I have been working on a tool (for 4 years now) for a hockey simulation that tracks growth of players and I try to do some predictive analysis, but I have limited knowledge on that subject. I would love to use proper ML techniques to predict player success based on the data points I capture.

I'm fine to use Amazon's cloud services for the course, but I hope they are not required. That will severely limit the usefulness of the course for me.

</comment><comment><USER14> I hope Apple will eventually open up their internal university.

<comment><USER15> Is it known to be particularly good?

</comment></comment><comment><USER16> Is this free? I would expect a release blog post to contain more basic details and fewer internal marketing links.

<comment><USER17> Scroll up. There's a link to the videos and code in one of the comments.

</comment></comment><comment><USER18> Lack of this in the past is what led to the founding of Cloud Academy, several years ago.

I played an important role in giving shape to the company, and in 2019 we sold it to QA Learning. Great experience. Good $$$ outcome.

</comment><comment><USER19> Why doesn't Amazon have amazing or even just 'good' product recommendations if they have all these ML experts?

<comment><USER20> I think it's just a much harder problem than Netflix or Youtube recommendations - Amazon has at least 500 million products, and people aren't buying individual products at the same scale as they watch videos. Has anyone with >1000 products really nailed product recommendations without large precision losses?

<comment><USER21> That's so true. And it's not just the relevance part of it, we have to even incorporate few operational cues as well while recommending products. Not for Amazon but for a different marketplace, I manage the recommendation engine as a product and we have incorporated product serviceability to customer's address as one of the parameters. Then the usual e-comm stuff kicks in like, out of stock issues, price elasticity during sale periods, new product/category launches etc.

Obviously, I do not want to discount other non-commerce recommendation engines like Spotfiy's or Netflix. They are great in their own ways, but e-comm is quite a different ball game. The cross sell model is really hard to crack if you have 1000s of competing sub categories and millions of products in them to fill in your top 10-20 slots.

</comment></comment></comment><comment><USER22> I am observing many companies have released their courses. In the process what any of that makes them special?

<comment><USER23> Special?

I think what makes them _interesting_ is that now I have a lot of choice in which classes to take... maybe someone will set up a "Rotten Tomatoes" site to rate online classes.

I don't want to take every single NLP class, but if I take one here, and don't quite get it, perhaps the Google (or Stanford, or whoever) course will make it click for me, or offer some alternative insight or useful method.

So I'm glad they're putting them up. Thanks Amazon!

<comment><USER24> Do you mean something like this?

[https://www.classcentral.com/collection/top-free-online- cour...](https://www.classcentral.com/collection/top-free-online-courses)

It already contains some really interesting ones that I wouldn't have found out otherwise.

<comment><USER23> Awesome! Thanks for posting this!

</comment></comment></comment></comment><comment><USER25> Awesome! They're great courses.</comment>


What's with weak AAA sales? - <AUTHOR> https://medium.com/steam-spy/whats-with-weak-aaa-sales-dcd7744ef205#.xbr795w1w <comment><USER2> I am surprised one of the most important point was not covered in the article: the "completeness" of recent AAA games. In recent times, there have been an incredible amount of quality issues with new AAA titles, from releasing an unfinished games to games being full of bugs, glitches and crashing. There have also been the case that these games are overmarketted and full of false promises. A lot of the publishers think they can get away with it due to the current culture of pre-ordering of games. I'm just glad that the gamer community is finally catching on to their scam and calling out their bluffs.</comment>


Android no longer reveals app permission changes in automatic updates - <AUTHOR> http://arstechnica.com/security/2014/06/android-no-longer-reveals-app-permission-changes-in-automatic-updates/ <comment><USER2> I think one day in the near future, there will be a major malware attack on mobile phones. There are few checks that go into updates on mobile phones. All someone needs to do is find an app that has a large install base and put together a malicious update package. Many popular apps are written by hobbyists and one-man operations. An attacker could just pay off the original authors or find some sort of simple backdoor (such as an author accidentally uploading their account information to a public repo).

The damaging code could be obfuscated and compiled into a binary module. In order to prevent Google (or Apple) from shutting down updates before it reaches too many people, the malware payload could trigger at a certain time or based on a network command once the update is installed everywhere.

Imagine someone flooding Verizon's network with traffic at a coordinated time and bringing the network down. Or rending a large percentage of iOS products inoperable during a WWDC keynote. There would be a lot of money to be made by shorting the stock of the affected companies.</comment>


Google two factor authentication for your web app - <AUTHOR> https://bitbucket.org/thejeshgn/g2fa

<comment><AUTHOR> will write an how-to when I get time</comment>


Network of 'Scouts' Spreads Money Through Silicon Valley - <AUTHOR> http://www.wsj.com/articles/secretive-sprawling-network-of-scouts-spreads-money-through-silicon-valley-1447381377 <comment><USER2> I'm not sure if or why this is news? Everywhere you read, VCs say- don't cold call- come through a warm introduction which makes it clear that there are insider groups and people that carry weight. Not necessary that their scout circle has insight into every great idea/company.

<comment><USER3> There's a pretty significant difference between a warm referral and a kickback, and especially a kickback that makes use of a shell company that disguises from entrepreneurs and other investors the kickback's existence and the origin of the funds used.

If it's not illegal, it should be. Investments typically involve disclosure for good reason.

<comment><USER4> The lack of disclosure that the scouts are agents acting on behalf of Sequoia is definitely wrong, though it is unclear if it's the norm or the exception. However, the shell company that disguises the source of the investment from other investors does serve a useful purpose to the entrepreneur in minimizing signaling risk in the follow on round. If Sequoia invests in your seed round but passes on the subsequent series A, every other investor you're talking to is going to wonder why one of the top VC firms is passing on the investment.

</comment></comment></comment><comment><USER5> As a founder, the whole world of startup finance is incredibly depressing and very easy to become cynical about.

</comment><comment><USER6> I wonder if it would make sense at some point for VCs to make seed investments at infinite valuations -- that is, taking no equity at all -- in order to obtain information rights. Even if there are no follow-on investment rights attached, having insider information on how well a startup is doing must be worth something...

(For legal and tax reasons I'm guessing the "infinite" valuation would instead need to merely be astronomically high; the point remains however that in an economic sense they would be buying information rights rather than shares.)

<comment><USER7> > I wonder if it would make sense at some point for VCs to make seed > investments at infinite valuations -- that is, taking no equity at all -- in > order to obtain information rights. Even if there are no follow-on > investment rights attached, having insider information on how well a startup > is doing must be worth something...

Somewhat incidentally, I think this is one of the reasons why YC is such a powerful force. YC recently invested in their 1000th startup -- couple that with the many other thousands of applications they've gotten (when you submit an application to YC, you're spilling a lot of beans already about yourself / your startup to YC), all of that put together is quite the house of knowledge. And on top of it all, it owns HN and thus to some extent has the power to frame the prevailing narrative of tech, I think there is no other entity in the world more in tune with the spirit and direction of startups than YC.

<comment><USER6> I'm sure YC benefits tremendously from the information they've gathered about all the companies they've funded. Probably less so for the applications... I suspect those are incredibly noisy signals and the effort required to extract meaning from them would be prohibitive.

On the other hand, YC Fellowships might be pretty much the "infinite valuation investment" idea I mentioned -- while there's no formal information rights attached, I'm sure they're getting a strong signal for which companies they'll want to fund.

</comment></comment></comment><comment><USER8> Not sure why WSJ thinks this is exposé-worthy. Just a clever tactic on Sequoia's behalf, probably a good example of why they've been considered top dog in VC for so long.

</comment><comment><USER9> When a startup receives investment from a VC firm, are all the limited partners in the fund disclosed? If so, how do you know those aren't also shell corporations, etc?

</comment><comment><USER3> As a former CS50 student and Mark's classmate, I personally find it depressing that Harvard's current CS50 professor, who is widely praised, is secretly on Sequoia's payroll via a shell company so that they can have the inside track on the "next Zuckerberg."

If professors want to teach, they should teach. If they want to invest, they should invest. But they shouldn't be doing both without making it clear to students what they've actually signed up for.

Actually, all of it is deceptive (to entrepreneurs, to students, to the public, to other investors) and depressing. But that part is particularly disturbing.

<comment><USER8> What makes you think there's a conflict of interest here?

<comment><USER10> The fact that entrepreneurs are regularly encouraged to drop out, so the investor and professor roles are potentially in conflict?</comment></comment></comment>


It is scary how thin the startup layer really is - <AUTHOR> http://sten.tamkivi.com/2008/02/it_is_scary_how_thin_the_start.html

<comment><USER2> This is the kind of fairytale analysis that gives blogging a bad name. First, not every startup would be willing to sell at their current valuation. Facebook wasn't willing to sell to yahoo for 3 billion last year. Most VCs and a lot of founders are quite willing to decline immediate gratification for the promise of a much larger return in the future. Second, its not like you can just place an order for every startup in existence on Amazon. There would be significant acquisition costs and the overhead on buying 44 billion worth of startups would run into billions itself. Third, the previous issues pale in comparison with the problem of what to do with all the startups once you've bought them. Do you let them continue running independently? Do you integrate them all into Microsoft? Do pick and choose and do both? In any case, they'll need large amounts of funding which previously the market would have provided. How do you manage all of them together to get the optimal outcome that again the market would have provided? Its not clear to me that Microsoft, or any other company, could feasibly do all this. The likely scenario is that Microsoft would be paralyzed and go bankrupt, or most of the startups would be neglected into oblivion.

What the article is really talking about is replacing a distributed market with a centralized system. It is well known that this is grossly inefficient.

The real lesson here is the incredible efficiency of markets. In this case a market can use only 44 billion to create something that a centralized system wouldn't be able to replicate for even a trillion dollars (warning: this number pulled out of a hat to make a point).

<comment><USER3> it was 1 billion and the 15B evaluation will proove wrong in 1 year

</comment></comment><comment><USER4> _For $44 billion, Microsoft could buy every Silicon Valley and Silicon Alley venture-backed start-up in existence. That includes Facebook at $15 billion. It includes Slide, RockYou, and every other elemental company. It would be a Moe Green kind of scene like at the end of the Godfather when Michael Corleone takes out all the heads of the five families. It would turn Microsoft's Internet business around overnight. It would be the ultimate coup._

That is indeed the scariest thing that I have read this year.

<comment><USER5> Sure, they could buy every startup in existence. But could they _hold_ them?

If you buy a startup and then put it on a shelf, the employees quit and use the money you gave them to make another startup, or retire to Barbados. You have to keep them busy, and interested, and to do that you have to challenge them, flatter them, help them to grow. Who has the time to do that with all the companies in the Valley at once?

The flip side of this paradox is: Steve Ballmer controls billions of dollars, but he can't buy time. There's only one Steve Ballmer, and he can only make so many decisions in a year, no matter how much he spends.

Frankly, I think giving Microsoft the gift of every startup in the Valley might be a very effective way to kill the company. They wouldn't have any idea what to do with them all. The flood of brilliant new employees would overwhelm the existing corporate culture. Everyone would spend five years sitting in cubicles, editing .emacs files, upmodding posts on news.yc, going to the occasional meeting to talk to the shell-shocked managers who are desperately trying to bolt everything together into some kind of strategy, and waiting for vesting day -- when they will all leave and start another bunch of tiny companies. In other words, it would be like Microsoft probably is now, only more so.

</comment></comment><comment><USER6> _For $44 billion, Microsoft could buy every Silicon Valley and Silicon Alley venture-backed start-up in existence._

Yes, and that money would go right back in to new venture investments. There's an endless supply of two guys in garages and bored PhD students.

</comment><comment><USER7> Microsoft buying every company in Silicon Valley would just be an indication that the chance of being bought out is even greater than previously thought, leading yet more people to create startups. The whole thrust of startups is that they are "started up". It's not like our current number of startups is all we have for the foreseeable future.</comment>


There will be no 'back to normal' - <AUTHOR> https://www.nesta.org.uk/blog/there-will-be-no-back-normal/ <comment><USER2> While it does make for an interesting read, most of the conclusions seem too far-fetched to me. In fact, I expect everything to be back to more or less where it was within a year or two, with only a couple of major lasting changes related to: (1) the political dynamics within the EU, (2) the position of China in the world economy, (3) specific industries and regions being disproportionately impacted (cruise ships gone, airlines forced to consolidate further across country borders, tourism-dependent economies heavily affected and slow to recover, etc.).

In particular I don't believe anything like the following will happen:

> We will see moves away from 'just-in-time' manufacturing, and major shifts > towards practices which reinforce resilience (e.g. stockpiles, redundant > capacity, duplicated systems) at the expense of efficiency.

Perhaps, for a year or two, at which point all the "resilience" will be optimized away.

> We anticipate lasting interest in remote working models

> The normalisation of remote working might also slow the trend of people > moving from countryside to cities, whilst prompting more interest in > distributed organisations

People working remotely will be the first to get fired, at which point they'll have to get another job, and it'll likely be a traditional one again.

> More people will voluntarily surrender personal data (such as medical and > genomic data, contact data, location data, etc.) to help the common good.

People already surrender all of their data, most of which happens involuntarily. Governments might attempt to use more of this data but they're unlikely to have the wherewhittal to do so consistently.

\----

Many of the changes on the list have little to do with the virus and were already underway before, at most the pandemic will have only accelerated them.

<comment><USER3> Yep.

1) It's against human nature - in aggregate - to prefer working in solitude at home. WFH may increase, but remote won't anywhere be the "mainstream"

2) No, the position of China in world economy will ironically grow. Getting supply chain out of China will introduce unwanted inflation into developed nations in EU and US - that's not what these countries need after printing many trillions of dollars.

</comment></comment><comment><USER4> There are a lot of baseless claims here. As far as I can see, the authors are just making big claims hoping the readers' prejudices will prevent them from questioning it.

We all yearn for at least some major reform. But this (coronavirus) isn't it. And this definately isn't 101 different major societal changes all wrapped up in one.

</comment><comment><USER5> I hate to be that person, but I find the use of an accordion collapse for the article sections to be unnecessary and exasperating. I tried a page search for "automation" and the browser showed one hit, but I couldn't find _where_ the word was due to the collapse feature. What does hiding text with an accordion add to the experience? Why not just publish a full article? Ugh.

<comment><USER6> On my mobile browser, as I open one accordion, the others collapse, but the browser doesn't scroll to the top of the opened section. Pretty annoying.

That presentation plus the IMO shallow insights left me unsatisfied.

</comment></comment><comment><USER7> It's a _little_ unfair to say that I'm strongly reminded of this very funny tweet, but only a little: [https://twitter.com/NicholasDanfort/status/12464658526329569...](https://twitter.com/NicholasDanfort/status/1246465852632956930)

</comment><comment><USER8> "alternative schooling methods (e.g. AI remote teaching, virtual classroom environments)"

My bullshit indicator went far into the red...

Let my try: "alternative schooling methods (e.g. AI remote teaching, blockchain enabled holistic virtual classroom environments)"

</comment><comment><USER9> We don't tend to change that much after things like this.

Economic and political forces still end up pushing the same wheels.

Yes this may push some things in the direction they were already going. Like more people working from home. But this is not likely going to fundamentally change the world. Not any more so than the twin towers attack or the 2008 crash. Little changes to a massive system.

<comment><USER10> What about hyperinflation?

<comment><USER11> Inflation, sure, but hyperinflation mainly happens in countries that have to borrow foreign currencies. That was the case for Weimar Germany, for example. If you can sell bonds in your own currency you're much better off.

<comment><USER12> Could you explain more, or provide a link?

<comment><USER11> Let's say your currency is marks and you owe dollars to foreign investors. You have trouble paying so you print more marks. The marks devalue relative to your debt, making it even harder to pay off, requiring even more printing.

Now say your currency is dollars and you owe debt in dollars. If you print more dollars, they devalue, but the value of your debt goes down right along with your currency. It's bad for the lenders and you might have to promise more interest to borrow more, but you don't spiral into oblivion just trying to pay off your existing debt.

</comment></comment></comment></comment></comment><comment><USER13> I truly don't understand why so many people think it will be a V-shaped recovery. It certainly can happen (everything can), but have they looked at the data? Nobody alive has ever seen this kind of volatility in the "fundamentals", and not just in some of them - in all of them. Literally, doesn't matter what you look at, as long as it has a fresh enough measurement.

Social and political volatility is not here yet, but the potential is _huge_.

Financial volatility is currently hiding / being suppressed, but again, the potential is _massive_. I'm not just talking about a normal white swan like a stock market drop - I'm talking about the "true black swans", like a potential collapse of the current iteration of the concept of money.

<comment><USER14> I think it's hard to understand for a lot of people. I know it is for me. If you're cooped up at home, working remotely but basically normally and haven't really been impacted by things so far other than the inconvenience it's pretty easy to expect things will just go back to normal. All the local indicators aren't visible and the news slips into this comfortably surreal space where there is a dream like dissonance between life and the reality outside our own homes.

<comment><USER6> Your comment got me thinking, there must be a lot of anxious people out there, out without a job and/or worried about dying. At least where I live the social system is very robust (here's hoping my judgement is right), so there should be less of said anxiety; in India there are millions of day workers who had zero savings before the crisis and are now jobless and homeless, and unable to travel to their hometowns because the train network is shutdown. A week or two more of the shutdown and there will probably be riots there.

Elsewhere, anxiety will lead to bad behaviors and crimes...

</comment></comment></comment><comment><USER15> Some people have a lot to gain from changes like these and want the changes to be socially accepted through conditioning. In general it's worse for the general population. This can include things like swapping the USD for another money, extreme inflation, travel bans, additional tracking of your actions and movement, new taxes, etc.

See past wars, 9-11, etc.

</comment><comment><USER16> What's normal changes all the time. The pandemic certainly will accelerate some changes and move other changes in a new direction but modern society doesn't stand still anyway. Normal just doesn't stay normal very long anymore.

</comment><comment><USER17> The coronavirus crisis seems to be an excuse for pundits to peddle all sorts of wild clickbaity speculation. I hope that after all this is over we go back and tell people look at all the silliness you wrote, look at all the opportunistic political angling you did here on no evidence, look at how contradictory you were under pressure, etc, etc.

</comment><comment><USER18> See you guys in 2022 July

</comment><comment><USER19> I don't really believe this. There was a "back to normal" after 20% of the human race died off in the Spanish Flu pandemic, and we're not going to lose 20% this time.

I've thought about this a lot and I think once things are safer (everyone got it, there's a vaccine, whatever), people are going to go back to normal. People are dying to eat at a restaurant. They have watched 100s of hours of travel vlogs and want to visit the places they've learned about while locked inside.

I guess I'll pick apart each "technology" point this article makes:

> Working from home

I think employers are probably seeing a massive drop-off in productivity with everyone at home, and are probably going to want to go back to normal. They have 10 year leases and probably want to get some value out of that.

> Telemedicine and online learning

Telemedicine has been pushed aggressively on me through my insurance plan. I've never used it; I never have those problems where I just need to see a doctor to get drugs. I either have a cold and there's nothing they can do, or I have to go in to get allergy shots. I don't see telemedicine helping me much there. (I suppose if someone mailed me a flu shot, I could do it myself, though.)

> Regulatory barriers to online tools will fall

I think things are going in the opposite direction. See the "EARN IT Act".

> Cyber-crime will increase.

I doubt it. More and more tools are becoming available to make systems easier to secure. You get mTLS for free with GKE, and languages and libraries are getting better. TLS certificates have never been easier to get. Browsers have never been more likely to drop shady CAs. Even governments have a hard time intercepting traffic for criminal investigations. Things are far from perfect, but they're getting better. A bunch of people with the flu doesn't change that.

> VR tools will flourish

Maybe, maybe not. VR tools are expensive, and nobody's going to spend a million dollars on a house after seeing a photoshopped virtual tour. They are going to show up in person before writing the check. It might not be possible to buy a house in person at this exact instant, but someday it will be.

Meanwhile, people seem to be enjoying Beat Saber -- COVID or not.

> Collective intelligence and open science.

No idea whether anything changes here. Arxiv exited before the pandemic, and will exist after the pandemic.

> Interest in digital trust will increase

Yeah probably. This is why people use Facebook Messenger instead of Email. Less spam, because you can ban accounts. Again, I don't see a connection to COVID-19 here.

> The trend towards online shopping has hugely accelerated.

I can count on one hand the number of times I've gone to a store to buy something in the last decade. The trend is already here. (I do love things like B&H and Microcenter for same-day purchases, but I have never walked into B&H just to browse. The only thing I know about that store is where to pick up my online order.)

> Food security concerns will prompt increased interest in AgTech.

Maybe. I went grocery shopping today and everything seemed normal. I managed to get meat, frozen pizzas, and bread that isn't hot dog buns for the first time since the outbreak. Will some computer program improve this situation? Maybe?

> More people will surrender personal data to help the common good.

They already surrender it to help random tech companies. 2020 is a census year and everyone is mailing in their personal information to the government. (They did it in 2010, and 2000, and 1990, and 1980, and...) Don't see a big change here.

> "AI is reinventing the way we invent"

Yes, fund my startup, we use "AI". Totally new idea, all due to the pandemic.

> We are seeing an increase in 'frugal innovation'.

People have been hacking together industrial equipment on the cheap pretty much forever. You can find articles on how to build your own CNC mill, atomic clock, single-board computer... whatever you want. This is nothing new. (Prusa sure did a good job marketing the whole "we printed out some curved pieces of plastic". But people have been making neat things with 3D printers for quite a while.)

TL;DR: I regret reading clicking this link and I regret replying to this drivel. But it's too late, so now I'm clicking "add comment".

<comment><USER20> > 20% of the human race died off in the Spanish Flu pandemic

The most generous estimate for the 1918 flu death toll is 100 million, which is 5% of the population. Still massive, but not 20%.[1]

Perhaps you're confusing it with the % of the population that contracted it?

1\. [https://en.wikipedia.org/wiki/Spanish_flu](https://en.wikipedia.org/wiki/Spanish_flu)

</comment></comment><comment><USER21> Great article. Sums up many of my concerns about the post-COVID19 world.</comment>