Why does this tool require a server (profiler.firefox.com)?

[yay]

Is it a necessary dependency?

[julienw]

By making the profiler UI a simple web page, we get a lot of advantages:

• the page has no special privileges, which improves the security
• we can deploy new versions much faster
• we use the web in a more common way, which is more performant

The obvious drawback is that you need an internet connection for your first capture. The next captures won't need internet because the web app will be cached in a service worker cache.

[userse31]

-"the page has no special privileges, which improves the security"
But, why? What security issues existed with the old profiler? Preventing a web page from hijacking the web development window maybe? (Im just grasping at straws here) This feels unnecessary.

-"we can deploy new versions much faster"
That makes sense. I can get behind this. Pushing software updates to many different platforms takes time, with some lagging behind others.

-"we use the web in a more common way, which is more performant"
What does that even mean? I've read that sentence multiple times and I still don't understand what its saying. This bullet point is so incredibly vague, abstract, and nondescript.

[julienw]

Let me try to explain more.

The tools inside the devtools toolbox are written in HTML/JavaScript nowadays (they used to be developed with XUL a long time ago). That's usually not the same type of javascript code running in webpages. For example there was a concept called "javascript modules", that's now slowly removed in favor of the standard ESM (but that wasn't existing before).
They also run in the main process of Firefox, this is the same process where all the UI runs. There are currently some efforts to move them out of this process but this isn't trivial.
They are dealing with data coming from webpages, that can be virtually anything.
All this code is inside Firefox, despite that it's not used by the vast majority of our users, but just the web developers. It's also in mozilla-central, the mercurial repository that contains the Firefox source code. This has some advantages (common tools inside Mozilla) but also some drawbacks (very different tools than what the web developers use, and some constraints).

By moving the UI out of Firefox to a separate webpage, we're using the web in the usual way, like normal webdevelopers do, and we can leverage all the tools that the web developers use and develop. This also has the indirect advantage that we can give early feedback to firefox engineers about some problems with the web, or give them some insights when needed, because we're web developers developing a complex application inside Mozilla.

About the security: by being inside a normal webpage, we leverage all the security that comes for granted when using the web: a sandbox protecting your system from evil code. When running inside Firefox, this sandbox doesn't exist. This is just another level of protection.

I hope this is clearer! Keep the questions coming :-)

[userse31]

Okay, that makes more sense.

I will say, as someone who develops code on an old pentium m laptop (I want to make sure my stuff will run on anything, this is a good way to do it) the slowdown that this causes does sting...