Live data from Hacker News

Gorhill pulls uBlock Origin Lite from Firefox store

neowin.net

331–340 of 442 posts

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#331
post #118

Earlier quoted context omitted.

On desktop Firefox, you can download an extension from anywhere and install it. All they're gatekeeping is their own repository, which I think most of us would like them to do. I think mobile requires using a nightly build to install extensions from outside Mozilla's repository, and that suggests their thinking is becoming contaminated by the rest of the mobile ecosystem.

No, the normal version blocks (at least permanent) installs. You need the developer version to install unsigned extensions.

Correct. It's incredibly how much misinformation there is about signing, even here where people should know better. It's very tiresome.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#332
post #285

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…

The problem with these types of things is that the people who are qualified to do good reviews are also the sort of people who can typically get a far more interesting job building stuff, rather than just reviewing code. It's work that does require a certain level of skill, but at the same time is also quite boring. And that more interesting job will probably pay better as well.

Not only that, but properly reviewing code would take forever. Heck I don't know how many senior engineers at my fancy tech company could do it and reliably spot problems.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#333
post #310

That sucks. I work for Mozilla, but nowhere near Addons so I don't know what pressures they're under or whatever. But if I ran the zoo... this is gorhill we're talking about. We ought to just make him an add-on reviewer with full rights, and tell him it's ok if the only add-ons he reviews are his own. We do not need to vet either his competence or trustworthiness; we have vastly more historical data backing him up th…

This sounds like a proposal to make the review process giving more weight to reputation, unlike the current process which is supposed to be entirely technical[1]. This might be a good idea, but I can see how Mozilla would get a different set of complaints about reputation not being consistently evaluated. [1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing

That's a fair complaint, and I definitely agree that using reputation as a factor in the decision for an individual addon is a very bad idea. But why is that? (1) Because reputation does not imply trustworthiness. Someone could build up a reputation with a set of very proper addons, and then use that reputation to sneak in problematic ones. (2) Because it's unfair special treatment. The chosen person's addons would be subject to different standards than others'.

Again, this is gorhill. People are offering authors of popular addons some mind-bendingly large sums of money to sell out. (1) does not apply: gorhill is the author of the most popular addon, which implies that he has been offered if not the most money, at least a lot more than most. And the well-known history is that someone did make money off of his original version, that someone isn't him, and in response he rebirthed the addon that he didn't particularly want to maintain. Try to find someone with a more convincing backstory.

(2) is trickier, and it's why the distinction between uBlock Origin getting a free pass and gorhill being a reviewer makes sense to me, even if it seems like I'm just obscuring influence. As a reviewer, gorhill would be expected to not just automatically approve his own addons, but to apply the agreed upon evaluation criteria. This would be a farce if his integrity were in question, but see (1). It's pretty clear to see that he is the person most qualified to make that evaluation (heck, he's already doing it before releasing; he's not new to the game), so it comes down to trust.

Sure, I am not the best person to review my own code, no matter how honest I might be. But read the Technical Code Review portion of the link above[1], since it's the only part that matters here. There are some addons where those criteria might be difficult to evaluate, but we're not talking about those. If significant code changes cause those to be less clear cut, gorhill can always pass it by another reviewer. (Yes, this again requires trust. See (1).)

Plus, you don't even have to depend on (1). People can be skeptical and double-check, and news would get out very very quickly. (Even shortcomings in areas like a reproducible build would get called out.)

I don't see this being a wide open backdoor into the process. Not many people are going to come by with the #1 installed addon, together with the history of uBlock and uBlock Origin. Sure, factoring reputation into the process is fraught with problems, but I'm not suggesting that everyone above 1M installs gets grandfathered in. This slippery slope is bone dry and covered with cobblestones.

[1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#334

Earlier quoted context omitted.

This is exactly why Apple implemented the precursor to Chrome's v3 manifest in Safari (not to mention the performance implications). It's a lot easier to just accuse Google of acting in bad faith, and Mozilla of being their lapdogs, and ignore any possible evidence to the contrary.

> It's a lot easier to just accuse Google of acting in bad faith, and Mozilla of being their lapdogs, and ignore any possible evidence to the contrary. There are two issues at play here. Manifest V3 is, undeniably, a security improvement over Manifest V2. Providing full read/write access to all websites is a huge security risk, and the fact that we're willing to do it is really a testament to how bad the state of the…

It's not just the size of content filters. V2 had the ability to run code to block a web request before it was downloaded. V3 only gives you a (size-limited) set of declarative filters. If you want to block anything else, you'll have to do it after it has been downloaded already.

(all here is iiuc; I've never used any of these)

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#335

Earlier quoted context omitted.

>Browser extensions really seem like they're slowly failing and just not supported. Kinda like PWAs. Ya, totally! lmao ublock origin has 8mil users on Firefox alone.

I don't think OP means for the lack of need or popularity, more so because vendors and platforms do not want them to be.

Yeah especially with Mozilla's new focus on promoting less-tracked advertising wih their anonym acquisition. Ublock origin of course hampers those efforts. I wouldn't be surprised if they want it gone just like Google does.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#336

Earlier quoted context omitted.

>Google's review team all are in India and they cannot write clear English. Which is ironic considering the reason they went to India and not other countries with cheap labor is that English is an official language there.

The problem is that the set of "Indians who can speak fluent English" and the set of "Indians who will work for the absolute lowest bid" are exclusive. And I don't blame them, really. These execs mistake "English is an official language" for "English is a widespread first language". Only 0.02% of Indians speak English as their first language, while total speakers (of first, second, or third language) are 10.6% of the…

While English is not a first language for the vast majority, it is used a lot in daily life because the native languages vary wildly by area and nobody understands them all. English is the common denominator, not just for communicating with foreigners but also to other Indians from other areas.

The focus on primary language makes it seem less used than it actually is.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#337
post #265

Earlier quoted context omitted.

> What kind of standard is that? That's the standard of all currated stores. We can argue about whether Mozilla's reviewer skillset is too low, but there's always going to be someone smarter than a reviewer, when reviewing is a cost center that companies want to spend the minimum amount of money on.

> That's the standard of all currated stores. This seems to ignore how boutique stores and high end retail operates. This is the standard of rent seeking middlemen stores. You still haven't answered why this model is appropriate for Firefox. > We can argue about whether Mozilla's reviewer skillset is too low We're not. I'm pointing out how simply taking the opposing view reveals that your reasoning could not possibly…

You think the best analogy for the Firefox extension store is boutique brick and mortar retail?

A minimal cost reviewer model isn't appropriate to Firefox.

But, example counterargument as to why it might be: Firefox needs to ensure they don't open themselves up liability but doesn't want to fully fund/staff a review team.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#338
post #288

Earlier quoted context omitted.

This is simply not true. I've been using unsigned extensions for years. You drag-drop a zip file into the extensions window and it will let you install it.

I looked at this just a few months as I have a few extensions with some very me-specific stuff that I don't really need/want to distribute – it's just not going to be useful for anyone except me. I couldn't find a good way to permanently install an unsigned or self-signed extension. You can temporarily add unsigned extensions in about:debugging, but those are lost on restarts, which is pretty annoying. I used this fo…

> So my solution now is to just create "unlisted" extensions and sign them with the web-ext CLI. It works and it's not entirely horrible, but it's a lot more hassle than I'd like.

Wait. web-ext allows the signing of arbitrary extensions without review? Wouldn't that defeat the purpose Mozilla is sacrificing technical users for?

While I didn't come across web-ext, I also tried my hand at working around firefox's limitations for my own extensions, but eventually decided it would be easier to give up and switch to a chrome-based browser instead. To this day, I still don't understand the "significant" threat that Mozilla sees (and other browser vendors apparently don't) that warrants such heavy-handed Apple-esque control over their users' ability to control their browser. Whatever it is, I no longer care.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#339

Tangentially has anyone else noticed chrome extensions management page now saying unlock origin will soon be disables and to please find a replacement?

Yep. Fuck Google, I won’t use a desktop browser without it.

I wouldn't use a mobile browser without it either.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#340

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…

Similar boat. I release an extension with about 1 million installs across Chrome/Firefox/Edge for work. Firefox (despite being the smallest usage) is utterly insane with regards to process. They demand a reproducible build, but then can't do things like install the right version of yarn (no - npm install -g yarn is not correct, our readme says it in bold like 5 times and provides the exact correct command to install…

Reproducible builds and open source sounds like a good thing.

I wouldn’t expect the reviewers to deal with every add-ons bespoke snowflake build. Even less so if it requires access to a private module. Mozilla should provide a baseline of how a build is intended to be done, then extensions just have to follow this template. Though yes, you would expect them to have some familiarity with basic stuff like yarn and that the baseline supports a few of the most popular builders.

Post reply on HN