Re: Extensions Infrastructure Work

[John Stowers <john stowers lists gmail com>]

> As I played around with it, I found the HTTP approach more feasible
> and less ugly than the mimetype handler approach. At first I figured
> the idea of running a local HTTP server would be a bit ugly, and Owen
> thought of some security concerns, but there's nothing too critical
> (or unsolvable) that I know of. The only "ugly" thing from a code
> perspective is that there's a magic port number: 16269. It's not on
> the IANA Registered Ports list, so I doubt there's going to be a
> collision.
> So the local HTTP server is really just the implementation detail to
> achieve the installing, enabling and disabling goals.

Sure. I don't really substantively disagree with anything you have said.

When I said 'completely inside or outside' the shell, I didnt mean to
suggest that the mimetype handler was my preferred solution for the
'outside the shell' approach. In that case I would implement a
rich/separate extension browser application communicating with the
extension website but doing things like dependency and version checking,
installing, communicating with the shell, etc all on the client side.

I would only choose the naked mimetype handler if the extension
website/service was only going to offer extension installation (no
upgrades, deps, rollback, etc).

John