401–410 of 442 posts
Earlier quoted context omitted.
People don't want 3P cookies tracking them around the web. They also don't want to pay to visit sites. Mozilla is trying to provide a middle path, I salute the effort.
Is everyone who claims the Internet cannot work without advertising only 20 years old? Why try to gaslight so many people who remember the Internet without advertising just fine. It was just a few decades ago!
Earlier quoted context omitted.
> What I don't agree with, is that a system that is based on higher tiers for entire accounts, is necessarily better. Almost every business looks after their biggest customer better than their smallest customer.
Sure. But now you're talking about the policy you expect, not the policy you want.
I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…
Similar boat. I release an extension with about 1 million installs across Chrome/Firefox/Edge for work. Firefox (despite being the smallest usage) is utterly insane with regards to process. They demand a reproducible build, but then can't do things like install the right version of yarn (no - npm install -g yarn is not correct, our readme says it in bold like 5 times and provides the exact correct command to install…
I do have half an idea to deal with it that I plan to try, thought it might be helpful to suggest: implement a Fisher-Price build system that checks and automates every single step and cannot go wrong. Ideally if the reviewers can run Docker, do it all in a container. Wrap package.json scripts with functions to validate the build environment before proceeding and either fix it automatically or fail and print clear instructions to the console. A preinstall hook could verify they have proper NPM auth and prompt for it if needed.
Annoying to have to do that at all though. I'm starting to come to similar conclusions on Firefox, using it currently but I've been thinking about jumping ship for a while. What browser would you recommend now? I wanted to get away from Google but I'm considering just Chromium since any remotely comparable options I've found are poorly thought out wrappers of it.
Earlier quoted context omitted.
Reproducible builds and open source sounds like a good thing. I wouldn’t expect the reviewers to deal with every add-ons bespoke snowflake build. Even less so if it requires access to a private module. Mozilla should provide a baseline of how a build is intended to be done, then extensions just have to follow this template. Though yes, you would expect them to have some familiarity with basic stuff like yarn and that…
We use a relatively simple build. at the base of it, if you have node and npm, a complete build is as easy as yarn npm login yarn --immutable yarn build Personally - I don't really find it reasonable to place demands on build tooling for an external company. I'm assuming you would also find it reasonable for Google to suddenly ship chromium with a requirement that you use "google-pack" for all js builds or they don't…
I'm not sure I agree, plenty of OS distributions do this. If you want to distribute on Arch in the official AUR you're going to need a PKGBUILD file. The difference though is they make it very easy to integrate custom distribution channels where you can build the package however you want, and I would really love to see browsers move more in that direction. Requiring centrally managed signatures from a corporation to install extensions in a purportedly open and community-driven product is just absurd to me.
Earlier quoted context omitted.
Yeah but despite how much HN hates Google everyone here will do whatever it takes to get on their app store. Google has the power to make the entire industry their bitch. Mozilla not so much.
So much this. Mozilla barely breaks 10k installs out of our total 1million installed base. We had a really frank internal discussion about just dropping support for Mozilla because their review process is also the most expensive out of every client we currently ship (And not "reasonable expensive"... Useless time sink expensive, back and forths with folks who I would frankly not hire as a junior because they can't re…
Earlier quoted context omitted.
> We cannot reproduce your source This is the biggest issue we had, and we had to add a decent bit of complexity to our builds to support reproducible builds in the exact way they want. But the silly part is that our extension involves building a wasm file from Rust, and after some back and forth it turned out that they don't require it to be reproducible (despite being core of our extension and containing 99% of our…
What kind of harmful code could you put in WASM? You could return a string that you eval on the javascript side, so the reviewers could possibly ask for the WASM source if they saw the eval, but other than that the purpose of WASM is to be a safe sandbox after all, right?
Earlier quoted context omitted.
Similar boat. I release an extension with about 1 million installs across Chrome/Firefox/Edge for work. Firefox (despite being the smallest usage) is utterly insane with regards to process. They demand a reproducible build, but then can't do things like install the right version of yarn (no - npm install -g yarn is not correct, our readme says it in bold like 5 times and provides the exact correct command to install…
This sounds super frustrating, as someone who has an idea or two for browser extensions I'm not looking forward to all the bureaucracy. I actually love the idea of requiring and validating reproducible builds but they really should invest in reviewers competent enough to manage that. I do have half an idea to deal with it that I plan to try, thought it might be helpful to suggest: implement a Fisher-Price build syste…
Programming is a race between the programmers, trying to build better, idiot-proof software, and the Universe, trying to build better idiots. Do not underestimate the Universe.
Earlier quoted context omitted.
> removing XUL Nah, XUL had to go. The other stuff wasn't really related. It was a more "if we are going to break most extensions we may as well use this time to push everything else we want". If anything XUL is a scapegoat. I know because I maintained VimFx for a while after the XUL removal. It was difficult to keep up with internal APIs that are changing, but I can't blame them, they need to develop their product.…
> 4. Keep supporting self-distributed extensions with developer managed signing keys and update URLs. Mozilla followed the big corps in the 'store' model, instead of keeping it open free-form. We might have a viable developer certification trust system by now, but with that too, only the corps have enforced signing systems (that are closed and fragmented.)
Don't we already have that system, in the form of distributions? More specifically, I'm thinking of something like Ubuntu's PPA system, where each developer publishes their packages with their own signing key.
Earlier quoted context omitted.
I don't think OP means for the lack of need or popularity, more so because vendors and platforms do not want them to be.
Yeah especially with Mozilla's new focus on promoting less-tracked advertising wih their anonym acquisition. Ublock origin of course hampers those efforts. I wouldn't be surprised if they want it gone just like Google does.
Earlier quoted context omitted.
People don't want 3P cookies tracking them around the web. They also don't want to pay to visit sites. Mozilla is trying to provide a middle path, I salute the effort.
I pay to visit many sites on the internet. Netflix, Hulu, Disney, Max, Twitch, etc. They provide value for my money. I don’t pay for news. Intelligent employees of news organizations would learn from that but no… Instead we get advertising apologists trying to gaslight me into thinking tracking is ok.
They did learn from it, that's why many "news" sites are now content-free entertainment, and why intelligent non-employees of news organizations complain that they're not providing news.