Opt-in activation for plugins

Feature	Status	ETA	Owner
Opt-in activation for plugins		N/A	Justin Dolske

Summary

Unknown, slow or insecure plugins shouldn't be allowed to run without user interaction.

Meant to help with multiple scenarios:

1. Accidental/malicious install: "Hey, we suddenly found a new SketchyWare.dll plugin on your system. Did you actually want to use it?"
2. Performance: The "Java makes my system asplode when a page loads, but sometimes I want to use it" problem.
3. Security: Users who don't trust Flash, as well as giving us a way to soft-block a plugin that a user needs to use on legit sites (YouTube, intranet, whatever).

Team

• Feature Manager: Justin Dolske
• Lead Developer:
• Product Manager:
• QA:
• UX: Alex Limi
• Accessibility:
• Security:
• Privacy:

Release Requirements

• Ability to set autoplay, click-to-play or never play on any plugin
• Built-in whitelist for the most common plugins

Designs

• Settings: Render this plugin: (Always|when clicked|never)
• When you have clicked a particular plugin on a given site 3 times or more, we should enable it automatically from then on if you haven't explicitly said otherwise.
• Optional, but interesting: Ability to soft-block 0-day using click-to-play.

Next Steps & Open Issues

• Get estimates from Justin

Goals

Make it harder for plugins to slow down Firefox.

Other Stuff

Chrome already does something similar.