I love the change to prohibit non-whitelisted plugins. Together with the changes to Chrome to move away from NPAPI, hopefully we can kill off the majority of plugins across all browsers.
If we can get it down to just Flash and nothing else, hopefully a few years from now Mozilla's HTML5 implementation of Flash will take off (similar to PDF.js), which pushes Flash inside the browser sandbox, and ensures that it has no more privileges or capabilities than normal in-browser content.
Herm... I just want to point out the elephant in the room:
A new proprietary plugin is coming (which might reduce the need for Flash, but still), the EME CDM (content decryption module).
I'm afraid you'll never have "just Flash and nothing else". W3C EME is coming, unfortunately.
Note: If I'm not mistaken, most other browsers won't have CDM as a 'plugin' per se. Because they are proprietary browsers (IE, Safari, Opera, and Chrome, too), they can afford to make deals with devilish entities to make your machine execute code that makes your computer slower for no good reason (Because video decryption is useless. Come on, everything is already torrented anyway! This is so that CDM deciders can allow or disallow playback devices at will for the default user, and have power over device vendors). I don't know if Chromium will ever support EME, but it is in the same boat as firefox: plugin necessary.
So the proprietary browsers will integrate directly the CDM in their code, while for open-source browsers this would be repugnant (and impossible).
Hopefully it will be easy to keep the CDM plugin from ever being installed in firefox. I don't plan on ever using it - if a website requires a DRM plugin, then I will just abstain from viewing their content. I just hope I don't have to recompile firefox on my own just to make this possible.
ClickToPlugin on Safari is reeeeally good at finding the html5 alternative for Flash videos. It's actually the only thing that's keeping me on Safari, if only someone could port it to firefox…
Actually click-to-play is what made YouTube usable to me. Now it is broken and I had to write a user script to fix it. When I brows YouTube and search for something, I want to open several search results/related videos in background tabs. But idiotic YouTube auto-plays videos. Autoplay is one of my most hated anti-patterns. I wrote a user script/chrome plugin that replaces all video page links with base64 URLs that insert a hop to the actual video page (including preview image) so I can keep using YouTube like I want it. I made it so that when i directly click a link it still goes to the watch page directly.
The only problem with click-to-play is a lot of sites did their feature detect wrong and only try the HTML5 player if the browser doesn't list Flash support. If you use click-to-play, it still lists the Flash plugin as available so e.g. YouTube, Vimeo, etc. will load the Flash UI rather the faster, higher-quality path.
I allow my FF to have Flash click to play enabled on all sites except on YouTube. It can be set to be click to play for all sites and then you can add specific sites to be the exception.
I've looked for the interface to add exceptions in the plugin menus and couldn't find it...where is it? I'm currently using Flashblock, which is nice, but I'd rather deal with the problem "natively" if possible.
IIRC the site-specific permissions interface is getting an overhaul, but you can currently get there by right-clicking the page -> view page info -> permissions.
> IIRC the site-specific permissions interface is getting an overhaul
I had completely forgotten about that page but you're probably thinking about:
about:permissions
Don't think there's any GUI way to get to it, it feels like years since I last saw it. Also, I don't have any plug-ins so can't check if it lists those there.
Why does everyone around here want to kill off plugins? There are some jobs they simply do much more efficiently than an html5+javascript solution. All of the Javascript-based PDF readers I've had the displeasure of using have been slow and buggy. Flash is nice for animations and some kinds of games (javascript + html5 games have in my experience always had little errors like misaligned text, key input issues with existing browser use, the browser highlighting parts of the game as if it's a text document, and the bigger issue of speed - they've always been slow on more complex games compared to the same amount of complexity in a flash game. This makes me highly doubt that an "HTML5 implementation of Flash" will take off within a few years. It would probably be just as bad as PDF.js.)
Installers on Windows run with administrator privilege and can do anything they want, including modifying the Firefox binaries. We might end up with an arms race between adware vendors forcing their stuff into Firefox and Mozilla trying to disable it.
If an installer modified the binary, Firefox couldn't stop that. What installers actually do is move some plugin files into the global Firefox plugins folder, so they get loaded on next startup. Because you can't uninstall the global plugins from the user's account, they added a per-user setting that keeps track of which "global" plugins that user has allowed.
That wouldn't be anything new, and the system's malware detection should help. Although it's a hard problem if users insist on running random binaries, of course.
If we can get it down to just Flash and nothing else, hopefully a few years from now Mozilla's HTML5 implementation of Flash will take off (similar to PDF.js), which pushes Flash inside the browser sandbox, and ensures that it has no more privileges or capabilities than normal in-browser content.