Firefox to block content based on Java, Reader, and Silverlight

I think this was first introduced in version 15 or 16, and I've been using it almost ever since. It was an opt-in feature (had to be enabled manually in about:config [1]), and it wasn't without issue. It was bad enough that I temporarily disabled it for a while until the next time Firefox upgraded.<p>The problem was that you had to, as the article says, "click" to play content. This was fine on YouTube, Netflix, etc., since there was a very obvious visual cue about how to activate your content [2]. However, not all sites had such obvious cues. SoundCloud, for example, would just silently fail, and I would have to manually disable the feature to get it to play (in practice, I just loaded the URL in Chrome).<p>Since Firefox 18, this has been much better. Now, there is an area next to the address bar that you can use to enable content, even if there is nothing on the actual page that you can click [3]. When you click this area, a pop-up appears asking which plugins you would like to load, and if you would like to always allow plugins on that site.<p>This pop-up is hidden for the most part, and isn't trivially discoverable[4] - something Mozilla really needs to work on - but it <i>does</i> pop-up the very first time you encounter a page with blocked content (per Firefox session, it seems), so there is at least <i>some</i> notification that you can unblock content.<p>If they're planning on having this feature enabled by default, I really doubt it will be the end of the world for most people. They'll just click the notification, and play through.<p>[1] Set the value of `plugins.click_to_play` to `true`. If it doesn't exist, create a new Boolean value for it, setting the name/value as above.<p>[2] <a href="http://i.imgur.com/jhxqoJ9.png" rel="nofollow">http://i.imgur.com/jhxqoJ9.png</a><p>[3] <a href="http://i.imgur.com/RNXw1JO.png" rel="nofollow">http://i.imgur.com/RNXw1JO.png</a><p>[4] Admittedly, this could be because I'm using a non-default theme on my install, so perhaps this is more obvious by default. I haven't checked.

Besides the obvious security benefits, this also makes sense as part of Mozilla's HTML5 campaign. By getting users to think of plugin-based content as "foreign" and "inconvenient," they bolster users' opinions of pure Web-based content. However, by allowing a simple clickthrough, they hopefully prevent users from just getting frustrated and switching to Chrome.

Mozilla has developed a PDF reader addon for Firefox using javascript. I've been running it for about a week as my default PDF reader. It's been acceptable for my needs.<p><a href="https://addons.mozilla.org/en-US/firefox/addon/pdfjs/" rel="nofollow">https://addons.mozilla.org/en-US/firefox/addon/pdfjs/</a>

Please tell me this click_to_play can be completely disabled in about:config. The PDF thing is going to be a nightmare for clients of mine who have researchers going to different university, research center and journal sites (repositories) for papers and articles.<p>Yeah, a user can disable the check for certain sites, but when you have hundreds of such repositories...you get the picture.

I never understood the point of having Reader in the browser. It's not like Flash or Java that is fairly common to be inline with other content. Is there some sites that legitimately use embedded PDFs?<p>I always found it more convenient to open PDFs in stand-alone Reader instead. Sure, it takes one mouse click more, but on the other hand the browser remains usable while the Reader loads and you get full-featured Reader instead of the gimped plugin.

Firefox needs to become the most well-liked browser again, because it's the best and using it is for the Greater Good.

And just thinking about businesses who may still be running "fat" business-required (if not critical) webapps in Java and Flash. Upgrades are cost and time prohibitive, and clicking each time a user wants to start may alienate people.

Will go ever well when Netflix suddenly stops working.

They should block Flash, too.

Chrome's UI works great for this. You can either click-to-play and click a little icon in the url bar to control plugins for that domain. That makes it easy to deal with flash elements used only for sound.

It's sad that after all this time the official Java plugin isn't even secure. I mean, we all knew years ago that it wasn't very <i>useful</i>, but it's insecurity just adds insult to injury. The Sun has truly set. :(

This needs to be done for javascript as well.