Yes, just by Google. The others follow in some aspects. But NaCl is not the same as NPAPI, and is in one aspect not a valid substitution: there is
no access to system calls, not even in a controlled manner. They state that in their self-congratulatory video here:
https://developer.chrome.com/native-client
Somewhere at minute 18:50. And having not even controlled access to system calls is problematic if you want to, say, access proprietary hardware from within web applications or really
want users of a web application to have access to the file system etc., and users can trust you.
I mean I agree that NPAPI plugins are unsafe in that they can be used to do harmful things with the system at user space, but that does not mean that this is the sole purpose of plugins. In the same way you could say that every computer program written in C is unsafe, because it can be distributed over the internet and the C API has full access to the system.
Quote
guenter
While Mozilla will not move there currently.
epper" rel="nofollow" >https://wiki.mozilla.org/NPAPI
epper
Yes and I at least understand that point. Since PPAPI does not really bring an advantage but is to some extend just a reinvention of the wheel with some minor enhancements especially for mobile browsers, there is not really a need to support it for Mozilla. Their main platform is the desktop, still.
But I don't understand why they drop NPAPI support entirely on the other hand side. It has been there from the beginning, and it still fits well in the Mozilla ecosystem. Instead of throwing out the baby with the bath water and dropping the whole NPAPI, they could make it more secure, e.g. by implementing trust mechanisms (only cert signed or reviewed plugins are executed, something like this).
Quote
guenter
Another round of propriety plugin architectures like started with MS ocx?
It seems so... I guess the NaCl/PPAPI thing was not really taking off for Google since 5 years or so. Now they try to push it by disabling NPAPI and pay Mozilla to do so as well. Next, Mozilla includes NaCl/PPAPI into their browser eventually after some more years, when their usage share has dropped more significantly.
Then all of a sudden they recognize that system calls are not that entirely bad, and that in some cases it would be really cool to have them. Then they reimplement that in NaCl, and then we have the same as NPAPI, but it looks different, its from Google and the turn over is complete
I am going to link this topic in the developer forum, maybe thats a better place for discussion (didn't know that a developer forum exists).