Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

nakedsecurity.sophos.com

Post reply on HN
Print view View original

41–50 of 104 posts

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#41

Post by Lawtonfogle »

acdha wrote: post #38
onli wrote: post #21

The problem here is not the signing. It is a perfectly valid reasoning: Addons can be like malware, and that is something Mozilla should protect its users from. Reviewing and then signing extensions is an ok way to do that. But the focus here is not the signing, it is the reviewing. The problem is not the reviewing either. That may take time and is unpleasant, but it offers something good in return. The problem is th…

Microsoft already disproved this belief with Window’s UAC mechanism. Unless you have an unusually savvy user-base, you have to assume that a non-trivial percentage of people will approve any prompt which is claimed to give music, games, coupons, porn, etc. Just to illustrate how unworkable this is currently, Facebook had to include a huge warning in the developer console telling you not to XSS yourself because people…

In which case they will also download and run SomethingSagaCheats.exe without second thought. Should Firefox disable exe downloads without a setting to turn them on? What about users who download SomethingSagaCheats.jpg and rename it to exe before running? We should disable all downloads then, no?

In general I do not like restricting rights to protect people. Now Mozilla is no government, but the same basic idea is going on here. Removing (instead of disabling or discouraging) features in the name of safety. At some point you have to tell someone they are responsible for their own online safety, give them the resources to educate themselves, and let them face the consequences if they choose not to.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#42

Post by Lawtonfogle »

sonnyp wrote: post #25
onli wrote: post #21

The problem here is not the signing. It is a perfectly valid reasoning: Addons can be like malware, and that is something Mozilla should protect its users from. Reviewing and then signing extensions is an ok way to do that. But the focus here is not the signing, it is the reviewing. The problem is not the reviewing either. That may take time and is unpleasant, but it offers something good in return. The problem is th…

true but if Malware.exe ships with an addon, it could tweak Firefox user profile to allow the addon install

In which case, for the user's safety, we need to remove the ability to download exe's. Disabling won't be good enough; they may follow steps to enable it not knowing what they are doing.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#44

Post by nailer »

userbinator wrote: post #40

It's funny to read this and the previous articles about the loss of freedom in Firefox, then see the description on its download page ( https://www.mozilla.org/en-US/firefox/new/ ): "Download Mozilla Firefox, a free Web browser. Firefox is created by a global non-profit dedicated to putting individuals in control online." I find the "appeal to security" argument that's being increasingly popular these days as nothing…

It seems like you haven't read the article. Users are still allowed to install any extension from outside the garden they want.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#45

Post by hiou »

byuu wrote: post #2

With each passing day, Mozilla tries harder and harder to get me to stop using their browser. If not for Chrome being the only viable alternative, they would have long since succeeded. Wreck the address bar algorithm? Ugh. Move the tabs on top? Ugh. Force me to keep download history? Ugh. Bury all the configuration options (like JS features) into about:config? Ugh. Turn the UI into a poor Chrome imitation? Ugh. Turn…

I upvoted you to get you out of the grey because I didn't feel like your comment was too inflammatory and did bring up specific issues which are relevant in a big picture view to this change. That said, the CEO comment was a bit unproductive.

One thing I would like you to consider is that Firefox has to maintain a certain marketshare in order to continue to serve their mission. Which includes fighting for web standards and other things outside directly working on the browser/phone os. Unfortunately, that causes them to serve the larger market than what you or I might enjoy. I'm definitely not a big fan of the dummification trend in UX right now(which most of your complaints seem to stem from), but I'm sure it's just that, a trend, and we'll see some of the more ridiculous parts of that trend move back toward the middle soon enough. Design trends are like the weather, if you don't like it now, just wait a bit and it will be sure to change.

So, hopefully you can cut Mozilla a little slack as they have a many headed dragon to feed and that set of compromises will leave everyone a bit hungry, but on the whole I feel more comfortable depending on Mozilla than the alternatives of Apple and Google.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#46

Post by daw___ »

From the announcement:

For developers hosting their add-ons on AMO, this means that they will have to

either test on Developer Edition, Nightly, or one of the unbranded builds.

Does this mean that developers won't be able to test the add-ons on official stable binaries end users will consume their add-ons on? Good luck with that.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#47

Post by mikegerwitz »

mschuster91 wrote: post #35

Normally, I dislike "walled garden" approaches. The problem with browser extensions is that there are too many bad players on the field, preying on the non-technical people. The situation is not as bad as in the IE heydays where I regularly cleaned up 10+ (!) toolbars from customers' computers, but it's still a problem. And I, unfortunately, don't see any way to avoid a walled garden approach - as long as there is a…

https://wiki.debian.org/DebianMaintainer

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#48

Post by userbinator »

Lawtonfogle wrote: post #41
acdha wrote: post #38

Earlier quoted context omitted.

Microsoft already disproved this belief with Window’s UAC mechanism. Unless you have an unusually savvy user-base, you have to assume that a non-trivial percentage of people will approve any prompt which is claimed to give music, games, coupons, porn, etc. Just to illustrate how unworkable this is currently, Facebook had to include a huge warning in the developer console telling you not to XSS yourself because people…

In which case they will also download and run SomethingSagaCheats.exe without second thought. Should Firefox disable exe downloads without a setting to turn them on? What about users who download SomethingSagaCheats.jpg and rename it to exe before running? We should disable all downloads then, no? In general I do not like restricting rights to protect people. Now Mozilla is no government, but the same basic idea is g…

give them the resources to educate themselves

Exactly. Instead of encouraging an environment of healthy suspicion and "I don't know what this does, maybe I should find out more first; else I shouldn't run it" type of attitude, we've gotten into a situation where people are seemingly loathe to educate themselves - and have been conditioned to trust whatever some piece of software says about whether something is malware or not.

As this comment a few days ago mentions:

https://news.ycombinator.com/item?id=9032087

Exposure to malware helps build the "immune system" in users. This is similar to the biological concept too:

http://en.wikipedia.org/wiki/Hygiene_hypothesis

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#50

Post by Mahn »

My startup, that shall go nameless, provides a service used mainly by the tech illiterate. Early in our first beta we determined we needed to log client side errors since there is quite a lot going on in there, so we quickly implemented a system that phones homes for every uncaught exception and error. Since we didn't filter the source, immediately after we were getting flooded with third party javascript errors. But not the innocuous facebook like button or google analytics kind of errors, mind you, but errors coming from javascript sources we had never added, that is, injected javascript.

Upon further inspection at the source code of these scripts and some googling, we found out that it was ad injecting malware in the form of Chrome extensions. Basically and long story short, some 40-50% of our customer base browses the web with ad injecting malware installed, and that's only counting malware that caused errors client side, which is obviously not all.

This was naturally disheartening for us, because you pour your heart and soul into building the best product you can deliver only to hear a very large amount of your customers will never experience anything other than a very subpar version of it...

Browser malware is a very real problem, and I don't know if Mozilla's approach is the best way to tackle it, but there definitively needs to be more people thinking about it, and in particular the Google Chrome team.

Post reply on HN