Indistinguishable from Jesse

I updated a few of my Greasemonkey scripts to work with versions of Greasemonkey that use XPCNativeWrappers. Greasemonkey 0.5 introduced the use of XPCNativeWrapper for the document object (but only when running on "Deer Park" builds of Firefox that were leading up to Firefox 1.5, not when running on Firefox 1.0.x). Greasemonkey 0.6.4 uses XPCNativeWrappers for everything except unsafeWindow, including the script's global scope. Using XPCNativeWrappers increases security but requires some scripts to be modified.

Most of my scripts didn't require any changes. Several only required minor changes to work with XPCNativeWrappers, such as using addEventListener instead of setting the onclick property.

The trickier scripts to fix had relied on the ability to set properties on DOM objects. I refactored Valid XHTML and Drag 43 Things to use closures instead.

Another problem I ran into was that the normal XMLHttpRequest syntax does not work with XPCNativeWrappers (bug 318489). Bash.org instant voting used XMLHttpRequest, so I modified it to use GM_xmlhttpRequest instead.

I also updated Pike's Google Maps Mousewheel Zooming script to work with Greasemonkey 0.6.4. This was the most difficult script to update because it interacts with page scripts rather than just interacting with a DOM. The normal way for a Greasemonkey 0.6.4 script to interact with page scripts is to use unsafeWindow, but using it allows the page to see the source of your script, and in some cases allows the page to call GM_ functions. (It would be bad if an evil web page were able to use GM_xmlhttpRequest, since it is not restricted with a same-host policy.) One might argue that I trust Google, which is true, but I don't trust maps.google.evil.com, which is also matched by the script's URL pattern. My version of the script works by setting location.href to a "javascript:" URL when it wants to call in-page functions. I think this is safe and hides the Greasemonkey script's functions from the JavaScript stack seen by webpage functions.

I also found out that my Valid XHTML script was broken in Greasemonkey 0.6.4 because it uses DOMParser, probably for the same reason scripts using XMLHttpRequest are broken. I gave up and used unsafeWindow to access DOMParser.

Firefox 1.5 has been released! If you've been using Firefox 1.5 Release Candidate 3, congratulations: you already have Firefox 1.5.

Power users upgrading from Firefox 1.0.7 will appreciate draggable tabs, a much faster Back button, and the replacement of many error dialogs with error pages. Web developers and can now take advantage of SVG, Canvas, E4X, and several new CSS selectors and properties. See the release notes or my detailed changelog for more about what's new.

Firefox 1.5 also includes a number of security fixes, as well as architectural changes that should reduce the number of security holes without us having to enumerate the holes. These changes can also be thought of as making it easier to write code that doesn't contain security holes. For example, XPCNativeWrappers, which isolate JavaScript in extensions and Firefox itself from JavaScript in web pages they manipulate, have been improved and turned on by default for extensions.

Equally important for security is an overhaul to the software update system. From now on, security updates will be small binary patches, usually between 200KB and 500KB. These updates can be installed with one click, in contrast to using the new version's installer (like you would to update from Firefox 1.0.6 to Firefox 1.0.7). Update notification has also been improved; the subtle red button in the menu bar has been replaced with a dialog. The result of these changes is that it's now much easier to keep your copy of Firefox up to date.

For an idea of the size of updates, the update from Firefox 1.5 RC2 to RC3 (fixing two bugs) on Windows was 218K, while the update from RC1 to RC2 (fixing about ten bugs) was 390K. Major updates, such as the update from Firefox 1.5.0.x to Firefox 2.0, will likely be bigger but I don't know how much bigger. The binary patch system is based on bsdiff; you can read about the algorithm if you're interested.

I released a new version of Search Keys to make it work with current versions of the Google and del.icio.us web sites. (Search Keys is a Firefox extension that lets you press a number to go to a result in a search engine, so you don't have to remove a hand from the keyboard after typing a search query.)

Steps to reproduce:

1. Select "About Mozilla Firefox" from the "Help" menu.
2. Click the "Credits" button.
3. Read the credits as they scroll by.
4. After the end of the credits list (don't bother trying to read the copyright stuff at the bottom), look at somthing else, such as the titlebar of the About Mozilla Firefox dialog.

Result:

At least for me, the titlebar appears to sag.

Mook and I updated the Delicious Delicacies extension for Firefox 1.5. The extension had to be largely rewritten because the Firefox Options window was rewritten for Firefox 1.5, so this version of the extension won't work in Firefox 1.0.x.

I've been working with crash bugs in Firefox a lot lately, so I wrote a Greasemonkey script called Bug attachment source to make it easier to view the source of a Bugzilla attachment that would crash the browser if loaded normally. It adds a "source" link next to the mime type of attachments, except for text/plain attachments such as patches.

I have only tested it with Greasemonkey 0.6.3 and today's Firefox build from the Firefox 1.5 branch.

jesus_X, who made the icons for my Thumbs and How'd I Get Here? extensions, is now offering to make icons for other artistically challenged extension authors.

I have a bunch of ideas for extensions. I'll blog about a few in detail, but here are the ideas I can describe in one or two sentences.

Find and search

• Improve Find by showing the locations of matches on the scrollbar (like some IDEs) (bug 259640).
• Automatically turn frequently used "I'm Feeling Lucky" address bar searches into keyword bookmarks, which are faster and don't change unexpectedly.
• Highlight Google search terms in a page you reached by clicking a Google search result.

Removing web annoyances

• DisableAutoRefresh (like RefreshBlocker) but only for refreshes to the same URL or refreshes longer than 30 seconds.
• Disable insecure connections to certain hostnames (e.g. mail.google.com), redirecting to https if possible.
• Show onclick events (bug 229055).

Keyboard shortcuts

• Make Alt+D always work to focus the address bar (ignore accesskey="D").
• One-handed shortcuts (single-key shortcuts, or not).
• Assign keyboard shortcuts to bookmarklets.
• Ctrl+Alt+click to save images.

Other

• Patch manager for installing patches to browser chrome or JavaScript components.
• Show favicon in title bar for trusted sites.
• Edit this page with NVu.
• Warn me if I load Slashdot too many times in an hour.
• Caps lock warning (oops, already exists).
• QuickLaunch: stay in memory even after the last window is closed on Windows.
• Dump all open urls to clipboard or text file (bug 33328).
• Tab Manager (list of tabs and windows) (bug 159853).
• Back to previous site (like "Rewind" in Opera) (bug 182138) (DomNav sorta something like this but with a user interface I don't like).
• User stylesheet manager (like Greasemonkey but for user stylesheets) (hint: use user stylesheet API and site-specific rules). Stylish
• Planet-like view of feeds to which I am subscribed.
• Right-click any form control, "Set as default". (For example, I should be able to set a default departure city on southwest.com and a default zip code on weather.com.)
• Automatically correct dumb typos in the address bar (e.g. "google.cmo") (bug 175634). URL Fixer
• Automatically back up text typed into textareas. Built into Firefox 2.
• Ajaxify Bugzilla.

For more ideas, see the comments on my October 2004 post, Request for extension ideas. Feel free to base extensions on these ideas, but I'd appreciate a mention on the home page for your extension if you got the idea from me.

Update 2007-06-01: Crossed out three of the ideas, since I've seen extensions that do those things or Firefox now does those things.