Gorhill pulls uBlock Origin Lite from Firefox store • Hacker News Board

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#211

Post by Ekaros » Tue, Oct 01, 2024, 6:01 PM UTC

4bpp wrote: post #53

If I understand the timeline correctly here, it seems that gorhill overreacted, and I say that as someone who is usually harshly critical of everything Mozilla has done in the past 5+ years. It's hardly practical for Mozilla to manually review every add-on revision for safety in a timely manner, so they had the choice between automation and delays that would make add-on development a slog; automation though inevitabl…

No he did not. Mozilla is in situation where they should bend backwards with very popular extensions, which I believe both uBlock Origin versions must be. Ensure anything you do with them is absolutely correct.

In general quite many extensions are done for passion. And any chance of destroying that passion will make your product less desirable to work with and thus in long run less popular.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#212

Post by adrian17 » Tue, Oct 01, 2024, 6:01 PM UTC

giancarlostoro wrote: post #190

open-paren wrote: post #117

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…

> that's because you didn't follow instructions and are in the wrong directory. You just need to have a shell script in the root directory that assumes the person running it has 0 clue about your extension. Also some of this reminds me of Apple. They clear something up, then bring it up again the next time review is needed.

Even this we had issues with - we wrapped the entire build environment and script in a dockerfile, but depending on system configuration you may or may not have to run docker with sudo - it just so happened that reviewer's environment required it, while ours didn't, and the reviewer needed specific instructions on what to do in this case.

Another time, they failed the review because the reviewer's VM _ran out of disk space_ (which we only learned after digging into the issue, as the first report just mentioned "build errors"; according to later inquiries the VM had ~9GB available) and we had to add some extra build logic to delete intermediate files, just for them. The build is quite large because it involves rust->wasm compilation, but I'd still expect the reviewer's machine to have a bit more space...

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#213

Post by adrian17 » Tue, Oct 01, 2024, 6:07 PM UTC

open-paren wrote: post #117

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…

> We cannot reproduce your source

This is the biggest issue we had, and we had to add a decent bit of complexity to our builds to support reproducible builds in the exact way they want. But the silly part is that our extension involves building a wasm file from Rust, and after some back and forth it turned out that they don't require it to be reproducible (despite being core of our extension and containing 99% of our logic), which honestly feels like it defeats the point - who cares if JS reproduces if you can hide any arbitrary possibly-malicious code in wasm.

For a while we were seriously considering putting our prebuilt wasm in the source package or on npm, just to make the "reproducible build" on AMO side simpler, despite this making it even further from how it's actually built.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#214

Post by mod50ack » Tue, Oct 01, 2024, 6:12 PM UTC

mmwelt wrote: post #91

SSLy wrote: post #54

Earlier quoted context omitted.

Because it's lighter on power usage, and that matters for firefox on android.

But now it's not even possible to use the add-on in Firefox for Android, as only add-ons from AMO can be installed.

That's not true anymore. You have to press the Firefox logo on the about screen a few times, which will make the menu option appear in settings to install an extension from the local filesystem

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#215

Post by kevingadd » Tue, Oct 01, 2024, 6:12 PM UTC

mort96 wrote: post #205

EasyMark wrote: post #191

Earlier quoted context omitted.

What?You can install extensions in Firefox easily without going through the Firefox extension store. XUL had to go.

No, you can't. Extensions must be signed by Mozilla for Firefox to let you install them.

This is simply not true. I've been using unsigned extensions for years. You drag-drop a zip file into the extensions window and it will let you install it.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#216

Post by Lerc » Tue, Oct 01, 2024, 6:12 PM UTC

It seems to me that any platform with a review gateway should treat failing a review erroneously as a critical failure.

In fact it does literally constitute denial-of-service.

When a failure like this occurs, it needs more than an apology, it should have an incident report to show that the failure was understood and steps were taken to prevent future failures.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#217

Post by jeffchien » Tue, Oct 01, 2024, 6:20 PM UTC

open-paren wrote: post #117

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…

The reproducible build requirement seems to be a major blocker for many addons, including one I use for Twitch: https://github.com/FrankerFaceZ/FrankerFaceZ/issues/1495#iss...

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#218

Post by rgreekguy » Tue, Oct 01, 2024, 6:22 PM UTC

solarkraft wrote: post #100

It‘s not only that, Firefox also forces you to use the Developer edition (which updates about daily, FORCING you to restart it) if you want to install extensions that aren’t signed by Mozilla (e.g. your own). This behavior reminds of Apple. They say it‘s for security (where have I heard that before), yet Chrome doesn’t seem to need such a restriction. To me it seems like another step in many of Mozilla‘s enshittifica…

I am pretty sure Chrome has also added the forced restart for a bit now. It might not show up right after the update, but it doesn't take long. I don't remember if it was straighforward, or just crashed new tabs.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#219

Post by chimeracoder » Tue, Oct 01, 2024, 6:25 PM UTC

wtallis wrote: post #204

chimeracoder wrote: post #147

Earlier quoted context omitted.

> It's a lot easier to just accuse Google of acting in bad faith, and Mozilla of being their lapdogs, and ignore any possible evidence to the contrary. There are two issues at play here. Manifest V3 is, undeniably, a security improvement over Manifest V2. Providing full read/write access to all websites is a huge security risk, and the fact that we're willing to do it is really a testament to how bad the state of the…

> Providing full read/write access to all websites is a huge security risk, and the fact that we're willing to do it is really a testament to how bad the state of the web is without adblockers. That seems to be completely ignoring that extensions aren't just independent self-contained programs. They're intended to extend and modify the capabilities of your user agent to better suit the needs of the user. Trusting the…

> Sure, it's nice when you can sandbox a helper, but it's irresponsible to suggest there's anything wrong or unusual about having the kind of powerful extensions that Google doesn't want you to have.

You're arguing against a straw man here.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#220

Post by maest » Tue, Oct 01, 2024, 6:27 PM UTC

SuperNinKenDo wrote: post #45

Fair play. uBO is THE killer extension, and apparently it never occured to Mozilla that if they were going to insist on using some hideous, Google style, machine led review process for extensions, perhaps they should at least make a carve out for one of the single most important extensions that exists. I can totally understand gorhill becoming completely insensed by the whole thing and refusing to play ball when Mozi…

> uBO is THE killer extension

Now that you say that, I wonder if that's Google's end game: keep Mozilla on the payroll, disincentivise them from innovating on their product and wait for Firefox to slowly bleed users until nobody is using them and solidify Chrome's position. And that's how they take care of adblockers. They already have wide control over Chromium so that would only leave Safari as the last viable browser alternative (a much harder product to attack).

Now, Google can't stop Firefox from allowing ad blocker extensions, but they can encourage Mozilla to run Firefox in all but abandonware mode, until it dies out.

It's embarrassing how hard the Mozilla Foundation has fumbled their position and I'm having a hard time attributing their actions simply to incompetence.