Firefox OS apps and beyond

I have written two Firefox OS apps, which are both not very popular. You may stop reading here if you haven't used either squeezefox or wallabag-fxos. This article is about how I think they should evolve, while Firefox OS is currently transitioning into a community-led B2G OS.

The apps I have written are both simple web clients for specific API endpoints. My first app, Squeezefox is a remote control for Logitech Squeezebox Wifi Radios. The other one, wallabag-fxos is a Firefox OS client for the Pocket clone Wallabag.

The only feature that makes both of these apps so Firefox OS specific is their use of systemXHR: In Firefox OS, an XMLHttpRequest (XHR) instantiated with the {mozSystem: true} parameter is allowed to issue HTTP requests towards all origins. This is what allows my apps to be configured to talk with the user's wallabag instance (or squeezebox device).

I myself do not use those apps very heavily myself anymore and don't think I would make a great maintainer. But I do strongly believe in webapps and the future of the web regardless of the success of particular platforms, and I want these apps to be useful - regardless of the user agent.

For this reason, I suggest re-architecting applications who rely on it to be freed from proprietary technologies like systemXHR: The idea is to suggest users they self-host these apps on the same origin where they already host their main endpoint. Both wallabag and squeezebox servers (aka logitech media servers) allow hosting additional static files besides those which are built-in. By removing some app-specific endpoint settings and defaulting to request against location.href, those apps can become more universally usable in its current form without any extra permissions or vendor-specific extensions.

Users who want to keep my apps in their Firefox OS/B2G OS specific nature, may keep using them as is. I have saved their current state in branches called fxos-legacy.

I will continue to welcome contributions to both the new architecture as well as the legacy branches, but I strongly recommend forking my projects if folks intend to use them productively in the future. But starting now, I will not commit to actively drive the development of either.

Other posts

  1. Help Test Firefox's built-in HTML Sanitizer to protect against UXSS bugs
  2. Remote Code Execution in Firefox beyond memory corruptions
  3. XSS in The Digital #ClimateStrike Widget
  4. Chrome switching the XSSAuditor to filter mode re-enables old attack
  5. Challenge Write-up: Subresource Integrity in Service Workers
  6. Finding the SqueezeBox Radio Default SSH Passwort
  7. New CSP directive to make Subresource Integrity mandatory (`require-sri-for`)
  8. Firefox OS apps and beyond
  9. Teacher's Pinboard Write-up
  10. A CDN that can not XSS you: Using Subresource Integrity
  11. The Twitter Gazebo
  12. German Firefox 1.0 ad (OCR)
  13. My thoughts on Tor appliances
  14. Subresource Integrity
  15. Revoke App Permissions on Firefox OS
  16. (Self) XSS at Mozilla's internal Phonebook
  17. Tales of Python's Encoding
  18. On the X-Frame-Options Security Header
  19. html2dom
  20. Security Review: HTML sanitizer in Thunderbird
  21. Week 29 2013
  22. The First Post