Geode - add to FUEL?

[tones]

Are there any plans to add geolocation to FUEL so that extension
developers have an easy way to access the browsers location, not just
websites?

Given the injection method demoed in geode, the only way I can see
this is possible to do so far is to load an xul or html file in the
tab browser, which kind of limits things a bit (caveat, only had a
brief look, so apologies if there is an obvious way to do this from
3pd addons anywhere in the chrome).

Cheers, Tony

PS. the blog spammed my comment, one suggestion I have (that could be
fulfilled by addons through a geolocation FUEL library ;-) ) is to
develop the concept of locations or zones within Firefox, so that if I
go to work with the laptop, firefox starts up, detects this and sets
the homepage to the company intranet, maybe alters my bookmarks
toolbar, perhaps even enables/disables certain extensions (a 'work'
profile). Go back home and the 'home' profile is reinstated.

[Doug Turner]

Thanks for the question Tony. Your examples are pretty awesome. I
can't wait until there is a whole set of killer geolocation enabled
addons!

So, for exposing geolocation to extensions is something we have
thought about. It will be possible, but not very easy in 3.1 beta. I
filed a bug to remind me that we should clean this up:

https://bugzilla.mozilla.org/show_bug.cgi?id=459073

I don't think it is hard to fix this up and when we do, it will get
extension developers a easy way to ask "where am I". The
complications are around privacy (of course!):

1) how do extension provide a consistent "mother may i" notification?

2) do we need to change the addon review process (for
addons.mozilla.org) so that device apis get an extra set of eyes?

I hope this helps,
Doug Turner

[Shawn Wilsher]

On 10/8/08 11:19 AM, Doug Turner wrote:
> 1) how do extension provide a consistent "mother may i" notification?

Do we really care about that? I mean, an add-on can do whatever it
wants already. It could easily re-implement this code without the
asking notification, so I'm not really sure I agree with this concern here.

Cheers,

Shawn

[tones]

Thanks for the reply Doug, much appreciated.

> 1) how do extension provide a consistent "mother may i" notification?

I kind of figured something like addon developers providing the
geolocation API with a chrome://myextension/content/geoloc_info.rdf
file, wherin they would put a few resources like title and description
of location use, the API then uses this info to alert the user that
exension foo, wants to use your location to do bar. Another option
could just be the use of chrome://myextension/content/can_I_use.html
page, hooking into the existing notification.
Once the user agrees, the addon is allowed to read from the API, which
permits any code to run from chrome://myextension/content/ to such and
such fuzzing from anywhere within chrome.

By resticting to chrome://myextension/content/ it would then stop (?)
chrome://mysneakyextension/content/ from hijacking any chrome
privelaged approval from another addon.

> 2) do we need to change the addon review process (for
> addons.mozilla.org) so that device apis get an extra set of eyes?

I think that the current review process should sufice, in that if the
reviewer picks up that locations are being sent to a server, for
example, they do not publish on AMO until the developer adds a privacy
statement on AMO.

[Justin Dolske]

Shawn Wilsher wrote:
> On 10/8/08 11:19 AM, Doug Turner wrote:
>> 1) how do extension provide a consistent "mother may i" notification?
> Do we really care about that? I mean, an add-on can do whatever it wants
> already.

Well, that's the interesting part of the question.

As you note, it's not really useful from a security point of view. But
it might have value for convenience/consistency if multiple extensions
are doing privacy-sensitive things and they want to give the user
control over permissions and fuzzing. In other words, make it easy for
extensions to do the right thing when they want to.

Justin

[Michael Connor]

And of course, I would be adamantly opposed to any extension which
exposed location info in a cavalier way being on AMO, so I would
prefer to have a sane/coherent API.

-- Mike

[Michael Vincent van Rantwijk, MultiZilla]

OT: And where can we find this new API?

I can only hope that some sane person adds a permission (UI) for this
feature, just like cookies, install, popups and what not, because why
work on removing dialogs in Firefox, and add/introduce a new feature
that keeps nagging you for every site that you visit (at least for sites
that use this feature)?

Thanks,
Michael

[Michael Connor]

On 8-Oct-08, at 5:43 PM, Justin Dolske wrote:

And of course, I would be adamantly opposed to any extension which