Almost two years after Chrome started removing support for NPAPI plugin support, Firefox is following in its footsteps by removing support for most NPAPI plugins, with the exception of Flash, in version 52. Starting with Firefox 54, the browser will also receive more code written in the memory-safe language, Rust. Both moves are meant to improve the security of the Firefox browser.
NPAPI Plugins
As the name implies, the Netscape Plugin Application Programming Interface (NPAPI) was developed for the Netscape browser to allow third-party developers to extend its functionality as they wished. Newer browsers such as Firefox and Chrome continued to support that architecture until 2015, in Chrome’s case, and until the next release of Firefox (version 52).
The move is done primarily to increase security, as NPAPI plugins (Java, Silverlight, Flash, Unity, etc) have tended to create all sorts of security issues over the years. Chrome has continued to support plugins that have transitioned to “PPAPI” (Pepper Plugin Application Programming Interface), a more secure version of NPAPI, which is also utilized by the Flash plugin in Chrome these days. However, it hasn’t solved the security issues completely.
Firefox never adopted the more sandboxed PPAPI architecture, so although it will drop support for most NPAPI plugins in version 52, it will continue to support the NPAPI Flash plugin.
All NPAPI plugins will continue to be supported in the enterprise version of Firefox 52 for another year or so (Firefox ESR’s typical lifecycle).
Firefox 54 To Get A Rust Code Boost
Rust, a programming language developed by Mozilla and its community, promises to be a much safer alternative to C and C++, while bringing similar performance. Mozilla has already been working on an alternative to Gecko, its rendering engine, called Servo. This was meant mainly as an experiment to see how Rust can be used on real-world projects. However, Mozilla recently promised we should begin to see more parts of Servo being included in Gecko this year.
It appears that starting with version 54 of Firefox (which should arrive early this summer), the browser will receive a big infusion of Rust code, to the point where Rust developers won’t be able to build new Firefox versions without having the latest Rust compiler on their machines.
Although it will probably take a few years before significant improvements will be seen, Rust code should ultimately help Firefox achieve both higher performance and better security.
Whether this will help Firefox beat the competition on both of those metrics will depend on how aggressively Mozilla will implement these changes (becausse it’s a significant amount of work) and on whether the competition will try to keep up.
