Mozilla pulls Bypass Paywalls from Firefox add-ons store

Post by the8472 » Fri, Nov 30, 2018, 5:03 PM UTC

zaarn wrote: post #176

the8472 wrote: post #174

Earlier quoted context omitted.

They could add a way to add signing keys to the stables. This gives you security updates and user freedom without significant downsides because the user would still be in charge of signing.

That would allow any third party software running on your computer to add malicious plugins to the browser (which has happened in the past and is in part why it requires Moz' signature now). Most users, ie, the average user plus a significant amount, don't really care that they can't install random addons from outside the addon store.

Post by the8472 » Fri, Nov 30, 2018, 5:04 PM UTC

kbenson wrote: post #189

the8472 wrote: post #167

Earlier quoted context omitted.

I am aware of mozilla's given rationale (and I disagree with the implementation), I was just pointing out that patrolling an addon store is orthogonal. And the decision to not even let users add additional signing root keys is yet another axis on the decision space that was totally neglected.

The problem is that it's essentially just another dialog or control to be scripted or socially engineered around. You can make it more onerous because it's basically a one-time action that's not something most users will do, but to what degree is adding a signing key before install different that a dialog asking you if you really want to install this third party extension? Until you have different access levels and c…

Post by the8472 » Fri, Nov 30, 2018, 5:12 PM UTC

zaarn wrote: post #190

zeveb wrote: post #185

Earlier quoted context omitted.

What would prevent malicious software running on the computer from installing a malicious version of Mozilla? What's their attack model?

The attack model is largely that fairly normal software wants to install adware on the computer. The software isn't direct malware but will attempt to install and activate addons, redirect the users homepage and search engine as well as setting various other options on the user behalf that are ultimatively harmful to the user experience in Firefox. Mozilla wants their branded Firefox to be something the user can trus…

Post by iicc » Fri, Nov 30, 2018, 5:14 PM UTC

dmortin wrote: post #12

laktak wrote: post #2

I don't want to subscribe, I also don't want to see ads or be tracked. I wish there was a universal micropayments way of paying for what I read.

If you mean automatic micropayments when reading articles then you'll still be tracked, because the payment provider has to track what you read to make the payments and even has to be able to provide a log of it in case there is a payment dispute, so they will store what urls you visit and when. Without a proper log payment disputes can't be resolved legally.

Post by iicc » Fri, Nov 30, 2018, 5:17 PM UTC

matt4077 wrote: post #4

laktak wrote: post #2

I don't want to subscribe, I also don't want to see ads or be tracked. I wish there was a universal micropayments way of paying for what I read.

publishers don’t like micropayments because (a) they don’t work, and (b) what people read doesn’t correlate with what’s important. It becomes a lot harder for journalists to justify spending months on a subject when the business side has hard data showing it brings in barely more than reprinting the soccer scores. What’s potentially workable is a Spotify-style subscription model.