Plugin activation in Firefox no longer default

Plugin activation in Firefox no longer default

Summary: Mozilla wants to give users more control over plugins in the Firefox browser, and as a result, plugins will no longer be activated by default -- except Flash.

TOPICS: Browser, Security

Plugins downloaded for use with Firefox will no longer be activated by default in order to reduce crashes, security problems and hang-ups in the browser.

On Tuesday, Benjamin Smedberg, Engineering Manager, Stability and Plugins at Firefox wrote on Mozilla'a blog that the change is designed to give users a "better Firefox experience." Now, when a site attempts to enable a plugin, users will have to choose whether to activate the third party system or not. The engineer writes:

"Even though many users are not even aware of plugins, they are a significant source of hangs, crashes, and security incidents. By allowing users to decide which sites need to use plugins, Firefox will help protect them and keep their browser running smoothly."

The only plugin Mozilla Firefox's new system will not effect is Flash, which will remain enabled by default.

"Flash content is so common on the Web, and many websites use "hidden" Flash instances that the user does not see and cannot click on: making Flash click-to-play would be confusing for most users," Smedberg says. "Users with older versions of Flash that are known to be insecure will see the click-to-activate UI and will be prompted to upgrade to the latest version."


A user research study(.pdf) conducted by Mozilla early this year on the prototype implementation of click-to-play plugins found that many users did not understand what a plugin was -- becoming "confused and annoyed" by them -- a main source of frustration was having to enable plugins on the same sites repeatedly. As a result, Firefox's click-to-play feature to focus on enabling plugins per-site, rather than enabling individual plugin instances on the page.

While plugins used to be a useful add-on for browsers to enhance features including video and animation, the developer argues that implementing plugins and technology including WebGL, WebSockets and WebRTC have lessened the importance of plugins -- but their security problems remain. Smedberg commented:

"Plugins are now a legacy technology, and not available on most mobile devices. Mozilla encourages website developers to avoid using plugins wherever possible."

The potential security issues caused by plugins remain of concern to browser providers. From early next year, plugins developed for Google Chrome based on the NPAPI architect will be blocked entirely, as the browser removes support for the system. According to Google, the Netscape Plug-in API 90s-era architecture has become a leading cause of hangs, crashes, security incidents, and code complexity.

Topics: Browser, Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Sign me up

    I uninstalled Java a year ago and haven't had one prompt to use/install it since.
    Other than Flash, the only other plugin I use is Silverlight, and that's on one site (Netflix). After one "Allow and Remember" prompt that'll be done.
    This change sounds like it's good for security and performance, but will have a light impact on usability. Sounds like a change I can believe in.
  • Java plug-in for Firefox disabled by default

    A very good move by Mozilla as Java gets many users into trouble with malware, especially if it's not kept up-to-date. If the user needs the Java plug-in for web browsing certain web sites, then [s]he can enable it.

    In my own case, I run various Java desktop applications and have not yet needed the Java plug-in enabled for my web browser.
    Rabid Howler Monkey
  • Flash restricts how I use the web

    Specifically, I use Firefox as my default browser, and when I receive an email bulletin with multiple links to articles on the web (such as ZDNet and certain political newsletters), I like to "load up" my browser with a tab for each article, then go to the next email, and read all the linked articles later. I have found that, if I have more than some indefinite limit of tabs which use Flash plugins, the keyboard and mouse lock up for perhaps a solid minute; sometimes I get a popup saying that the Flash plugin has crashed, and do I want to report it (did once, that should be enough); and upon looking at the tabs, all but the first have that "robot frowny face" message where the Flash plugin should be (and its an AD! which I wouldn't care to see anyway). And sometimes I have to refresh (F5) tabs that contained a video before I can play it.

    So I now have to restrict my browsing to one tab at a time, while I hold the message containing all those links in my email client. Or else flag the message and get back to it later. Why couldn't the Flash plugin, on detecting that another Flash item has started on another tab, go dormant until (1) the earlier one has finished, followed by (2) the tab for the dormant one is brought up?

    The articles containing a "YouTube or similar" video player which does not WAIT for the Play button are also very annoying when trying to load up tabs, because their sound plays even on a covered or inactive tab. So, while trying to load up Firefox with tabs, after four or five, the first two play on top of each other, and I have to stop the loading up process, find each one, put it in pause and back to the start, then finish the process. Again, the video plugin (whether media player, real player, itunes or whatever) ought to sense that the tab in which it is running is not on top and pause itself.
    • Flashblock add-on for Firefox?

      It prevents all Flash content from loading and allows one to click a placeholder to download and view Flash content on demand.
      Rabid Howler Monkey