NPAPI

~ the obit ~

npapi was on every browser i used from 1998 to 2015. every non-microsoft one anyway. netscape 4, mozilla, firefox 1 all the way through firefox 50-something, opera, safari, chrome. all of them loaded plugins through the same api that netscape had shipped in navigator 2.0 in 1995. when you installed the flash player, the java runtime, or realplayer, or shockwave, the installer dropped a dll or a bundle into a plugins directory and the browser found it through npapi. that was how the plugin era worked.

i was on a 33.6k modem in ankara when this started to matter for me. friends and i were installing macromedia flash 4 to see the newgrounds animations that everyone was linking. installing the java runtime because you needed it for the runescape client or a chat applet on some forum. installing realplayer for streaming radio. all of that landed through npapi. it was not something you thought about as an api. it was invisible plumbing. plugins just worked or they crashed the browser.

by around 2005-2008 the same plumbing had become the security nightmare of the web. java applet exploits were the standard drive-by attack vector for years. flash player exploits were second. every couple of months there was a critical cve, adobe or oracle would ship a patch a week or two later, and the intervening window was open season. by university years i was uninstalling the java plugin on new machines by default and only reinstalling it when a specific site forced it, usually a turkish bank login page that had not been updated since 2003.

the interesting thing about npapi as an artifact is that nobody killed it because they hated the api itself. what killed it was that every plugin sitting on top of npapi had become the reason browsers were exploited. chrome's argument in september 2013 was straightforward. plugins were the crashiest, most-exploited part of the browser. html5 could do most of what flash and silverlight did. the plugin architecture would go. the api came along with it.

~ the rap sheet ~

~ the removal ~

chrome announced the deprecation in september 2013 on the chromium blog. by then chrome was already the majority browser. the timeline was staged. linux support removed may 2014. windows and mac disabled by default april 2015. chrome 45 in september 2015 shipped without npapi support entirely. that was the moment the era ended in mainstream. once chrome removed the api, every plugin vendor knew the timer had started on the other browsers too. firefox 52 in march 2017 removed npapi for everything except flash. firefox 85 in january 2021 removed flash. safari 12 in september 2018 removed everything except flash. safari 14 in september 2020 finished it.

~ what got buried with it ~

the whole first-generation web plugin catalog died on the chrome-45 clock. java applets went first because oracle had already stopped pretending it was a client-side language. microsoft silverlight was next, quietly discontinued in 2021 after everyone had already left. realplayer's plugin business had faded before npapi did. shockwave sunset in 2019. flash was the last one to actually be missed, and adobe took it out of service on 31 december 2020. by then flash content on the open web was already unreachable from any current browser.

~ the long tail ~

i wrote plugins against npapi exactly once in an undergraduate class around 2007. really though, the api was famously miserable to work with. c-style function pointers, no threading model to speak of, per-browser bugs, memory ownership rules that made valgrind cry. it was designed in 1995 for a world where browsers were single-threaded and the plugin was small. by 2015 browsers had process sandboxes and multiprocess architectures and the plugin api had become the sandbox-escape everyone worried about. what got buried with npapi was really twenty years of accumulated web-plugin code, most of it never open sourced, sitting on install disks and archive.org copies of adobe download pages. the pattern of running arbitrary native code inside the browser had been the default for the entire era before it. it stopped being the default around chrome 45.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »