Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gorhill pulls uBlock Origin Lite from Firefox store

neowin.net

Post reply on HN
Print view View original

251–260 of 442 posts

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#251

Post by saulrh »

open-paren wrote: post #117

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…

Every time I hear about the review processes for browser extensions I'm shocked that the it involves humans having to read your README and manually plumb together the build process. Sometimes I hear that reviewers are even reusing VMs when doing reviews, or even not using VMs at all. I'd have expected the review form to have a textbox where you paste your git link and a well-documented automated pipeline that stands up a specified VM with a specified amount of RAM and disk, clones the git, descends into it, and executes `docker build -t ./docker/review/Dockerfile`. I'm surprised that the reviewers themselves haven't outright demanded such tooling from their larger organization, just as a matter of job satisfaction - I can't imagine all the abuse they get from angry app owners.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#252

Post by akira2501 »

ethbr1 wrote: post #245
akira2501 wrote: post #243

Earlier quoted context omitted.

> that assumes the person running it has 0 clue about your extension. I would tend to assume that a person given responsibility for reviewing this software, supposedly to protect end users, would not be this clueless. What value is the "Firefox Store" actually offering then?

> What value is the "Firefox Store" actually offering then? That anyone dumber than such a reviewer cannot sneak malicious extensions in. Which, sadly, is probably a non-trivial number of submissions.

> That anyone dumber than such a reviewer cannot sneak malicious extensions in.

Although people smarter than such a reviewer are free to? What kind of standard is that?

> Which, sadly, is probably a non-trivial number of submissions.

Then they're not, as an organization, actually capable of doing what they're promising here. There are more ways to get this wrong than to get it right, and borrowing the Google strategy of just not caring about your end users seems completely inappropriate for a non-profit like Mozilla.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#254

Post by munch117 »

shadowgovt wrote: post #196
munch117 wrote: post #114

Earlier quoted context omitted.

But this is not about a high profile plugin. The high profile plugin is "uBlock Origin", and this is about "uBlock Origin Lite", which is a big thing for Chrome, but not for Firefox. Why would anyone want to use uBOL, when they have the option to use uBO? Perhaps Mozilla does have a higher tier of review, but it's for specific plugins, not for specific authors.

If it is, indeed, the case that they don't bump the entire account to a higher tier of service if one of their products justifies it, they've fundamentally conflated the technology with the humanity of the system and this is a predictable consequence. They're the browser with 2% market share. They're lucky he didn't also pull uBlock Origin because he felt insulted and let users figure it out. He doesn't owe Mozilla t…

We all agree that this case is a very bad outcome for Mozilla.

What I don't agree with, is that a system that is based on higher tiers for entire accounts, is necessarily better. If such a tier exists, then all the big players will apply pressure to be put in that tier. Suppose Amazon tries for that - surely they'll get it. And then they'll use it, not just for "the Amazon app", but for every crappy outsourced app they make for any purpose. Placing a huge burden on Mozilla, who now will have to spend extra resources to hand-check a lot of crap that could have been auto-rejected, just in case, because effectively the burden of proof has been shifted.

I'd like you all to try to abstract from this case for a second, and think about the strategic choice: Which is the better rule, evaluating apps, or evaluating accounts. Sure, now you're all thinking that you'll make a super-duper amalgam system that looks at both in some combination. That's the benefit of hindsight. But suppose you're making version 1, and you're keeping it simple. What would you start with?

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#255

Post by munch117 »

EasyMark wrote: post #183
munch117 wrote: post #114

Earlier quoted context omitted.

But this is not about a high profile plugin. The high profile plugin is "uBlock Origin", and this is about "uBlock Origin Lite", which is a big thing for Chrome, but not for Firefox. Why would anyone want to use uBOL, when they have the option to use uBO? Perhaps Mozilla does have a higher tier of review, but it's for specific plugins, not for specific authors.

It’s more efficient which can pay dividends in battery life on android, especially for those who have older phones.

Thanks for the info. Wikipedia describes uBOL solely as a reaction to Manifest V3, and that's what I was going by.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#256

Post by 01HNNWZ0MV43FF »

saulrh wrote: post #251
open-paren wrote: post #117

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…

Every time I hear about the review processes for browser extensions I'm shocked that the it involves humans having to read your README and manually plumb together the build process. Sometimes I hear that reviewers are even reusing VMs when doing reviews, or even not using VMs at all. I'd have expected the review form to have a textbox where you paste your git link and a well-documented automated pipeline that stands…

Browser extensions really seem like they're slowly failing and just not supported. Kinda like PWAs.

I want to write a chat program, but it has to work on phones, and the DevEx for native phone frameworks compared to desktop apps looks like hell, and PWAs seem to be barely supported.

It's easier than ever to make a CLI or desktop app, but phones seem like the worst of all Microsoft dev history - Learn these arcane lifecycle vocab words that make no sense, like using Win32 directly, but also it changes every year or two like when MS invents a new GUI framework, but also if you can't get into The Store, nobody but your power user friends will be able to run your app anyway. What is this shit?

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#257

Post by kccqzy »

sureIy wrote: post #151
Timshel wrote: post #70

Earlier quoted context omitted.

It can run with way less permission as opposed to UBO.

I don’t think people care about giving permissions to one of the most popular extensions ever. The advantages of giving that extension full access are quite clear and the dangers minimal.

I do care. I trust Gorhill but that doesn't mean mistakes can't slip through. Maybe criminals attacked his system to steal his credentials, or maybe criminals just used old fashioned violence to force Gorhill to release a malicious extension update. Exactly because this is the most popular extension ever, criminals have so much higher incentive to take over his trusted extension to do criminal things.

Of course all of us have our own assessment of trust and danger.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#258

Post by Jalad »

xnx wrote: post #234
yojo wrote: post #74

Earlier quoted context omitted.

I think it’s reasonable to expect that one of Firefox’s most popular extension publishers gets a higher tier of review service. Gorhill (and other top extension devs) are providing real value to Firefox, and have demonstrated good behavior for years. This doesn’t mean they should get to publish whatever they want, but if a reviewer is about to reject a high profile plugin, they should get a second set of eyes on it.…

Firefox is a thick wrapper around the core functionality of uBlock on Android. Without uBlock, the case for using Firefox is very weak.

uBlock on Firefox pretty much is the only reason I haven't ditched Android yet

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#259

Post by cxr »

adrian17 wrote: post #212
giancarlostoro wrote: post #190

Earlier quoted context omitted.

> that's because you didn't follow instructions and are in the wrong directory. You just need to have a shell script in the root directory that assumes the person running it has 0 clue about your extension. Also some of this reminds me of Apple. They clear something up, then bring it up again the next time review is needed.

Even this we had issues with - we wrapped the entire build environment and script in a dockerfile, but depending on system configuration you may or may not have to run docker with sudo - it just so happened that reviewer's environment required it, while ours didn't, and the reviewer needed specific instructions on what to do in this case. Another time, they failed the review because the reviewer's VM _ran out of disk…

Everything described here sounds like your team, your extension, and your software development process are the problem. Demanding >9GB of disk space to build a browser extension is capital F, capital I Fucking Insane. Go yell at the Rust folks about their shitty toolchain and your engineering lead for buying into it instead of blaming people who have enough problems as it is just coming into contact with the quagmire you described.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#260

Post by irq-1 »

kevincox wrote: post #140
sunaookami wrote: post #75

It's very annoying you have to submit your extension to gatekeepers to even distribute them to normal users. As gorhill said on GitHub it took days for a self-hosted version to be approved - that's unacceptable. Imagine you would need approval from Microsoft to distribute software. Not even Android is this closed. Enforcing signatures and removing XUL were the worst things Mozilla has ever done. And yes, Google does…

> removing XUL Nah, XUL had to go. The other stuff wasn't really related. It was a more "if we are going to break most extensions we may as well use this time to push everything else we want". If anything XUL is a scapegoat. I know because I maintained VimFx for a while after the XUL removal. It was difficult to keep up with internal APIs that are changing, but I can't blame them, they need to develop their product.…

> 4. Keep supporting self-distributed extensions with developer managed signing keys and update URLs.

Mozilla followed the big corps in the 'store' model, instead of keeping it open free-form. We might have a viable developer certification trust system by now, but with that too, only the corps have enforced signing systems (that are closed and fragmented.)

Post reply on HN