search

lkosson / full-address-column

Thunderbird add-on to show full sender and recipient address column in message list
MIT License
39 stars 11 forks source link

Reduced requested Thundebird permissions to reasonable level? #11

Open johnnyutahh opened 2 years ago

johnnyutahh commented 2 years ago

This add-on (thus far) does exactly what I want in Thunderbird (v91.5.1) -- nice job.

However, it's uncomfortable for me--and I suspect others might feel the same--to give the add-on access to basically do "anything it wants with no restriction" (I'm paraphrasing; I did not record the exact syntax; something like "Full access to Thunderbird and all of your computer") when you install it.

Is there a feasible way to reduce the permissions to a more-reasonable level, and then release a new version with only the requested-permissions change?

lkosson commented 2 years ago

Since Thunderbird 78 there are two types of extensions available: new ("MailExtension") and legacy ("experiments"). New ones support fine-grained permissions, but offer much more limited set of APIs. Legacy addons don't have any permission control - they use same access model as pre-78 extensions, meaning they have access to everything.

As far as I can tell, new APIs don't support changing message pane UI nor allow direct access to raw message headers to extract sender/recipient. Until such APIs are added to Thunderbird - only way to make this addon work is to use old style (permissionless) APIs.

johnnyutahh commented 2 years ago

Very helpful, thanks @lkosson for the background.

Does the following place/community offer some means to make this better, or minimize the problem? eg: is it feasible to file a bug/request to provide an API that could serve this (full-address-column) or any other add-on without having to resort to the dreaded "requires all permissions"?

https://bugzilla.mozilla.org/buglist.cgi?product=Thunderbird&component=Add-Ons%3A%20Extensions%20API&resolution=---&list_id=15976970

(I'm quite unstudied in the land of Mozilla/Thunderbird APIs and extensions--please pardon my ignorance. There's so much stuff out there and I've not yet discovered comprehensive-yet-concise summary of this world/community, making it harder for me to learn this context quickly.)

johnnyutahh commented 2 years ago

A side note: if welcomed, I would like to donate a few dollars to this project.

lkosson commented 2 years ago

I don't have much experience in Mail/WebExtensions (or any proper JavaScript) development either - apart from hacking this addon together. If I understand Mozilla's plan correctly, the intended use of "experiments" (legacy-style APIs in new extensions) is for developers to provide a prototype of an API to include in future versions of Thunderbird if it is deem useful. The way my addon works is by grossly overusing it by defining a single experiment API that basically does all the work like pre-78 extension and that most definitely won't be accepted as an official API. A proper way would be to implement experiment API that does the exactly one thing that's missing from official APIs, build whole add-on based on that and hope your API will eventually be integrated.

It turns out there already is a request posted on bugzilla for a proper API allowing creating custom columns but it seems it's not getting merged any time soon.

johnnyutahh commented 2 years ago

Remarkbly-helpful feedback, once again. I inquired at the above request about the API-addition status, details below.

An aside: it might be useful to make a comment about the permisions at the add-on home page, where at least a couple recent reviews were discussing/complianing it: https://addons.thunderbird.net/en-US/thunderbird/addon/full-address-column/

also fyi:

I checked in at the above request to see if they have any movement: https://bugzilla.mozilla.org/show_bug.cgi?id=1615801#c8

Additional, related discussion (where I discovered the full-address-column add-on) here: https://addons.thunderbird.net/en-US/thunderbird/addon/full-address-column/

jobisoft commented 2 years ago

The message tree is going to be rewritten (in core) and the way columns are handled will change. I think I will provide the missing API as soon as the new tree model has been implemented. Sorry if that answer is not what you were looking for. As long as the old tree model is used, the Experiment approach will work.

johnnyutahh commented 2 years ago

Seems encouraging to me, thanks @jobisoft for the super-timely reply. Alas, I'm not the add-on's developer/commentor on this thread (@lkosson), and I defer to him.

@jobisoft writes:

The message tree is going to be rewritten (in core) and the way columns are handled will change. I think I will provide the missing API as soon as the new tree model has been implemented. Sorry if that answer is not what you were looking for. As long as the old tree model is used, the Experiment approach will work.

johnnyutahh commented 2 years ago

Also: I just now requested (referencing this issue-discussion-thread here) that the add-ons/extension leaders document/summarizing the general state of extensions and such... so as to minimize future developer-and-power-user confusion:

https://bugzilla.mozilla.org/show_bug.cgi?id=1752706

jobisoft commented 2 years ago

Besides the documents I listed in my answer in the bug, I like to point out our community channels, where you can get in touch with other developers, or me (I am Thunderbirds add-on coordinator and support engineer).

https://developer.thunderbird.net/add-ons/community