Doesn't this behavior from Mozilla staff indicate that using Firefox extensions at all is a security issue?
This shows that the reviewers may not be competent enough to catch actual malware uploaded to their add-ons site.
Gorhill pulls uBlock Origin Lite from Firefox store
161–170 of 442 posts
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#162Earlier quoted context omitted.
On desktop Firefox, you can download an extension from anywhere and install it. All they're gatekeeping is their own repository, which I think most of us would like them to do. I think mobile requires using a nightly build to install extensions from outside Mozilla's repository, and that suggests their thinking is becoming contaminated by the rest of the mobile ecosystem.
You can no longer package extensions yourself and if you try using "Load add on from file" you get that extension loaded but it's gone after a restart. All extensions have to be signed first to be permanent and Mozilla denied to fix that on their bug tracker.
Signing is such a low bar to pass I agree that not offering that as an option is reasonable. It takes seconds to do.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#163If I understand the timeline correctly here, it seems that gorhill overreacted, and I say that as someone who is usually harshly critical of everything Mozilla has done in the past 5+ years. It's hardly practical for Mozilla to manually review every add-on revision for safety in a timely manner, so they had the choice between automation and delays that would make add-on development a slog; automation though inevitabl…
Exactly. And this is why we need paid browsers. If the ad-supported/donation-supported browsers like Firefox need to apply low-quality automated solutions to approving/rejecting even their most popular addons, then clearly the business model isn't working.
You jump immediately to money. But less crappy automation in this case is almost certainly a question of configuration and then thoughtfulness on the part of follow up reviewers, not just throwing money at the problem. It feels like you are shoehorning your own agenda in the conversation a bit.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#164Earlier quoted context omitted.
But now it's not even possible to use the add-on in Firefox for Android, as only add-ons from AMO can be installed.
I was curious if trying to load it via file:///storage/emulated/0/Download/... would work (as my recollection is that .xpi installation is content-type: sensitive) but insult-to-injury is that FF Nightly for Android searches for the string "file:///storage...", so they seemingly have nuked even the file: protocol handler for Android. Good times over there at Mozilla
Pretty sure file:// is very broken in different ways on every android browser.
For example, on kiwi browser typing in a file URL causes it to be searched, but using the "go to URL in clipboard" button (with the file url in your clipboard) works. Except when you randomly run into some weird android file permission issue and the browser just can't see certain files...
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#165Earlier quoted context omitted.
The author is a volunteer and the software is a labor of love: of course it's personal. Such projects thrive when the author feels like they are giving a valuable gift to a community which is receiving and appreciating it. Being required to submit your creation through an impersonal "review" process which rejects you in such a way that it's obvious nobody cared enough to even look is not just a buzzkill: it's an insu…
> when the author feels like they are giving a valuable gift to a community which is receiving and appreciating it. Who is the "community" in this case? Mozilla? Or is it us users? If the former then fine, but if the latter, then who is being hurt by this, and how does Mozilla being annoying reflect ingratitude in the community?
> who is being hurt by this
See Raymond’s comment five days ago:
https://github.com/uBlockOrigin/uBOL-home/issues/197
Who is being hurt is Raymond Hill (their sanity / mental stability / desire to work on this popular extension); Firefox users who preferred the Lite version; Firefox users on Android; Everyone who would’ve been recommended this extension and now won’t (see other comments in this thread); Mozilla (taking yet another hit to their reputation) and by extension the open web as more reasons to abandon Firefox lead to less browser diversity.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#166The sooner people realize Mozilla is not your friend, the better. They’ve been compromised by the Google money. Want an alternative to Chromium? Go support Servo or Ladybird, Firefox can’t be saved.
Neither of those work with ublock. I'd sooner disconnect from the net than not use ublock. (Same reason i don't use qutebrowser.)
I like SeaMonkey, it works with a legacy version of ublock. It's like using firefox back when it didnt suck.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#167Earlier quoted context omitted.
I can’t fault gorhill for not wanting to play the “give large rich organization infinite second chances” game. Sometimes enough is enough even if you think you’d act differently in his shoes. > Mozilla apologized No they didn’t. Now I’m not here to play apology police or anything. But that’s just a perfunctory customer service voice statement which happened to include the word “apologize”. And that’s fine. Nobody exp…
What could the email have said that would have made you believe they had apologised? If the literal string “we apologize” isn’t it, what is?
"Statistically your extensions are one of the most used on Firefox. We will handle all related matters with higher priority and care in the future, and are deeply sorry about this."
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#168If I understand the timeline correctly here, it seems that gorhill overreacted, and I say that as someone who is usually harshly critical of everything Mozilla has done in the past 5+ years. It's hardly practical for Mozilla to manually review every add-on revision for safety in a timely manner, so they had the choice between automation and delays that would make add-on development a slog; automation though inevitabl…
I think that the alternative is some form of "per review", where the effort of performing reviews is spread out among a volunteer f with reasonable "reputation" management and in which a party can accelerate their own review by contributing to the reviews for others.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#169Earlier quoted context omitted.
Mozilla is definitely doing the right thing by reviewing the extensions, but the issue here is that were wrong, they found issues that didn't exist (such as claiming it contained obfuscated code and collected private data). It appears the issues were found using simple heuristics (e.g they detected string pagead2.googlesyndication.com in a comment) and these detections weren't then manually reviewed as claimed, which…
Why does lying about manual review seem so commonplace? For example, during basically any YouTube copyright or moderation controversy, there is always "manual review" of videos that have obviously been caught in automated systems that in case of actual manual review, would be cleared of problems by any reasonable human.
Maybe "manual review" here is that someone "manually" runs the automation tool for that specific entity.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#170Because no one ever have taken over and compromised high profile extensions? Chrome battles with it a lot, see eg. https://news.ycombinator.com/item?id=36146278 I find Mozilla's process to be quite reassuring, but would be good to have alternative "addon stores" that also have a review process
> I find Mozilla's process to be quite reassuring
The fact that a review process exists might be reassuring, but the way they went about it surely isn’t.
https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco...