Earlier quoted context omitted.
On desktop Firefox, you can download an extension from anywhere and install it. All they're gatekeeping is their own repository, which I think most of us would like them to do. I think mobile requires using a nightly build to install extensions from outside Mozilla's repository, and that suggests their thinking is becoming contaminated by the rest of the mobile ecosystem.
No, the normal version blocks (at least permanent) installs. You need the developer version to install unsigned extensions.
Gorhill pulls uBlock Origin Lite from Firefox store
331–340 of 442 posts
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#332I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…
The problem with these types of things is that the people who are qualified to do good reviews are also the sort of people who can typically get a far more interesting job building stuff, rather than just reviewing code. It's work that does require a certain level of skill, but at the same time is also quite boring. And that more interesting job will probably pay better as well.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#333That sucks. I work for Mozilla, but nowhere near Addons so I don't know what pressures they're under or whatever. But if I ran the zoo... this is gorhill we're talking about. We ought to just make him an add-on reviewer with full rights, and tell him it's ok if the only add-ons he reviews are his own. We do not need to vet either his competence or trustworthiness; we have vastly more historical data backing him up th…
This sounds like a proposal to make the review process giving more weight to reputation, unlike the current process which is supposed to be entirely technical[1]. This might be a good idea, but I can see how Mozilla would get a different set of complaints about reputation not being consistently evaluated. [1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing
Again, this is gorhill. People are offering authors of popular addons some mind-bendingly large sums of money to sell out. (1) does not apply: gorhill is the author of the most popular addon, which implies that he has been offered if not the most money, at least a lot more than most. And the well-known history is that someone did make money off of his original version, that someone isn't him, and in response he rebirthed the addon that he didn't particularly want to maintain. Try to find someone with a more convincing backstory.
(2) is trickier, and it's why the distinction between uBlock Origin getting a free pass and gorhill being a reviewer makes sense to me, even if it seems like I'm just obscuring influence. As a reviewer, gorhill would be expected to not just automatically approve his own addons, but to apply the agreed upon evaluation criteria. This would be a farce if his integrity were in question, but see (1). It's pretty clear to see that he is the person most qualified to make that evaluation (heck, he's already doing it before releasing; he's not new to the game), so it comes down to trust.
Sure, I am not the best person to review my own code, no matter how honest I might be. But read the Technical Code Review portion of the link above[1], since it's the only part that matters here. There are some addons where those criteria might be difficult to evaluate, but we're not talking about those. If significant code changes cause those to be less clear cut, gorhill can always pass it by another reviewer. (Yes, this again requires trust. See (1).)
Plus, you don't even have to depend on (1). People can be skeptical and double-check, and news would get out very very quickly. (Even shortcomings in areas like a reproducible build would get called out.)
I don't see this being a wide open backdoor into the process. Not many people are going to come by with the #1 installed addon, together with the history of uBlock and uBlock Origin. Sure, factoring reputation into the process is fraught with problems, but I'm not suggesting that everyone above 1M installs gets grandfathered in. This slippery slope is bone dry and covered with cobblestones.
[1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#334Earlier quoted context omitted.
This is exactly why Apple implemented the precursor to Chrome's v3 manifest in Safari (not to mention the performance implications). It's a lot easier to just accuse Google of acting in bad faith, and Mozilla of being their lapdogs, and ignore any possible evidence to the contrary.
> It's a lot easier to just accuse Google of acting in bad faith, and Mozilla of being their lapdogs, and ignore any possible evidence to the contrary. There are two issues at play here. Manifest V3 is, undeniably, a security improvement over Manifest V2. Providing full read/write access to all websites is a huge security risk, and the fact that we're willing to do it is really a testament to how bad the state of the…
(all here is iiuc; I've never used any of these)
https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#335Earlier quoted context omitted.
>Browser extensions really seem like they're slowly failing and just not supported. Kinda like PWAs. Ya, totally! lmao ublock origin has 8mil users on Firefox alone.
I don't think OP means for the lack of need or popularity, more so because vendors and platforms do not want them to be.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#336Earlier quoted context omitted.
>Google's review team all are in India and they cannot write clear English. Which is ironic considering the reason they went to India and not other countries with cheap labor is that English is an official language there.
The problem is that the set of "Indians who can speak fluent English" and the set of "Indians who will work for the absolute lowest bid" are exclusive. And I don't blame them, really. These execs mistake "English is an official language" for "English is a widespread first language". Only 0.02% of Indians speak English as their first language, while total speakers (of first, second, or third language) are 10.6% of the…
The focus on primary language makes it seem less used than it actually is.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#337Earlier quoted context omitted.
> What kind of standard is that? That's the standard of all currated stores. We can argue about whether Mozilla's reviewer skillset is too low, but there's always going to be someone smarter than a reviewer, when reviewing is a cost center that companies want to spend the minimum amount of money on.
> That's the standard of all currated stores. This seems to ignore how boutique stores and high end retail operates. This is the standard of rent seeking middlemen stores. You still haven't answered why this model is appropriate for Firefox. > We can argue about whether Mozilla's reviewer skillset is too low We're not. I'm pointing out how simply taking the opposing view reveals that your reasoning could not possibly…
A minimal cost reviewer model isn't appropriate to Firefox.
But, example counterargument as to why it might be: Firefox needs to ensure they don't open themselves up liability but doesn't want to fully fund/staff a review team.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#338Earlier quoted context omitted.
This is simply not true. I've been using unsigned extensions for years. You drag-drop a zip file into the extensions window and it will let you install it.
I looked at this just a few months as I have a few extensions with some very me-specific stuff that I don't really need/want to distribute – it's just not going to be useful for anyone except me. I couldn't find a good way to permanently install an unsigned or self-signed extension. You can temporarily add unsigned extensions in about:debugging, but those are lost on restarts, which is pretty annoying. I used this fo…
Wait. web-ext allows the signing of arbitrary extensions without review? Wouldn't that defeat the purpose Mozilla is sacrificing technical users for?
While I didn't come across web-ext, I also tried my hand at working around firefox's limitations for my own extensions, but eventually decided it would be easier to give up and switch to a chrome-based browser instead. To this day, I still don't understand the "significant" threat that Mozilla sees (and other browser vendors apparently don't) that warrants such heavy-handed Apple-esque control over their users' ability to control their browser. Whatever it is, I no longer care.
Re: Gorhill pulls uBlock Origin Lite from Firefox store
#339Re: Gorhill pulls uBlock Origin Lite from Firefox store
#340I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…
Similar boat. I release an extension with about 1 million installs across Chrome/Firefox/Edge for work. Firefox (despite being the smallest usage) is utterly insane with regards to process. They demand a reproducible build, but then can't do things like install the right version of yarn (no - npm install -g yarn is not correct, our readme says it in bold like 5 times and provides the exact correct command to install…
I wouldn’t expect the reviewers to deal with every add-ons bespoke snowflake build. Even less so if it requires access to a private module. Mozilla should provide a baseline of how a build is intended to be done, then extensions just have to follow this template. Though yes, you would expect them to have some familiarity with basic stuff like yarn and that the baseline supports a few of the most popular builders.