Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gorhill pulls uBlock Origin Lite from Firefox store

neowin.net

Post reply on HN
Print view View original

421–430 of 442 posts

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#421

Post by anticensor »

thatguy288 wrote: post #382
sfink wrote: post #310

That sucks. I work for Mozilla, but nowhere near Addons so I don't know what pressures they're under or whatever. But if I ran the zoo... this is gorhill we're talking about. We ought to just make him an add-on reviewer with full rights, and tell him it's ok if the only add-ons he reviews are his own. We do not need to vet either his competence or trustworthiness; we have vastly more historical data backing him up th…

Probably a big ask, but could you find out why one is not allowed to add your own root cert to FF and sign an addon yourself, instead being forced to use an ESR/develop/nightly version and setting xpinstall.signatures.required to false, significantly reducing your security?

And, when a self-signed certificate is in use, the browser should show a prominent icon of self-configured security.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#422

Post by silverliver »

arp242 wrote: post #360
silverliver wrote: post #338

Earlier quoted context omitted.

> So my solution now is to just create "unlisted" extensions and sign them with the web-ext CLI. It works and it's not entirely horrible, but it's a lot more hassle than I'd like. Wait. web-ext allows the signing of arbitrary extensions without review? Wouldn't that defeat the purpose Mozilla is sacrificing technical users for? While I didn't come across web-ext, I also tried my hand at working around firefox's limit…

> web-ext allows the signing of arbitrary extensions without review? Wouldn't that defeat the purpose Mozilla is sacrificing technical users for? It takes about ten minutes to sign, and only seems like it uses automatic checks. I do get an email that "any extension may be reviewed by a human at any time". I don't know if it matters that it's unlisted, or that they're all very simple extensions with very limited permi…

Given that 90% of normal people use browsers that don't have this restriction, I don't think Mozilla's threat model makes sense. Also, users who are susceptible to being tricked into installing an addon can just as easily be tricked into going to bank.com.h4xx0r.ru, editing hosts file, changing DNS settings, or even installing chrome or a different browser.

Franky, I don't think this move is motivated by security concerns at all. (Not that it matters anymore)

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#424

Post by medstrom »

fsckboy wrote: post #276
medstrom wrote: post #274

Earlier quoted context omitted.

This isn't about uBlock though. Just uBlock Origin Lite.

you mean, this isn't about uBlock Origin though. Just uBlock Origin Lite . plain old uBlock is another add-on which may no longer exist. (uBlock was the original original, but the same developer, gorhill, mistakenly let it slip into the wrong hands and it became a pay-to-play leaky ad blocker)

I knew that, but the person I replied to just said uBlock. Still, good to point it out.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#425

Post by anacrolix »

sfink wrote: post #333
omoikane wrote: post #328

Earlier quoted context omitted.

This sounds like a proposal to make the review process giving more weight to reputation, unlike the current process which is supposed to be entirely technical[1]. This might be a good idea, but I can see how Mozilla would get a different set of complaints about reputation not being consistently evaluated. [1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing

That's a fair complaint, and I definitely agree that using reputation as a factor in the decision for an individual addon is a very bad idea. But why is that? (1) Because reputation does not imply trustworthiness. Someone could build up a reputation with a set of very proper addons, and then use that reputation to sneak in problematic ones. (2) Because it's unfair special treatment. The chosen person's addons would b…

off of = from

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#426

Post by cholantesh »

thoroughburro wrote: post #369
EasyMark wrote: post #323

Earlier quoted context omitted.

I suspect he will simmer down a bit (I do not at all blame him for what he did, it has to be frustrating to dedicate thousands of hours into something just to have some clueless person pull it). I think it will be back inside of a week, it’s important and can save battery over regular ublock origin on Firefox.

> it’s important and can save battery over regular ublock origin on Firefox That sounds like a reason for Mozilla to simmer down and compromise, not gorhill.

They already did? In this specific context, acknowledging the mistake and reinstating the extension is materially all they can do. Maybe it is necessary to reform the extension review process, but getting UBOL back onto AMO would then just be a positive side effect of a much longer-term project.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#427

Post by horsawlarway »

xelamonster wrote: post #404
horsawlarway wrote: post #379

Earlier quoted context omitted.

We use a relatively simple build. at the base of it, if you have node and npm, a complete build is as easy as yarn npm login yarn --immutable yarn build Personally - I don't really find it reasonable to place demands on build tooling for an external company. I'm assuming you would also find it reasonable for Google to suddenly ship chromium with a requirement that you use "google-pack" for all js builds or they don't…

> I don't really find it reasonable to place demands on build tooling for an external company. I'm not sure I agree, plenty of OS distributions do this. If you want to distribute on Arch in the official AUR you're going to need a PKGBUILD file. The difference though is they make it very easy to integrate custom distribution channels where you can build the package however you want, and I would really love to see brow…

> I'm not sure I agree, plenty of OS distributions do this. If you want to distribute on Arch in the official AUR you're going to need a PKGBUILD file.

This is fine. This is actually also roughly in line with what you need for an extension (a manifest.json file).

What the poster here is proposing is rather this: You cannot build that PKGBUILD file using any tooling other than the standard. Ex - you want to script how that PKGBUILD file get made? Fuck off, not allowed.

That's a COMPLETELY different take. It's not dictating limitations on the output (which I find reasonable as a required integration between products) it's dictating limitations on how a company produces that output (I find this monopoly behavior, why should they get to tell me what tools or processes to use? My output is the SAME.).

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#428

Post by dotproto »

adrian17 wrote: post #212
giancarlostoro wrote: post #190

Earlier quoted context omitted.

> that's because you didn't follow instructions and are in the wrong directory. You just need to have a shell script in the root directory that assumes the person running it has 0 clue about your extension. Also some of this reminds me of Apple. They clear something up, then bring it up again the next time review is needed.

Even this we had issues with - we wrapped the entire build environment and script in a dockerfile, but depending on system configuration you may or may not have to run docker with sudo - it just so happened that reviewer's environment required it, while ours didn't, and the reviewer needed specific instructions on what to do in this case. Another time, they failed the review because the reviewer's VM _ran out of disk…

Simeon from the Firefox Add-ons team here. Sorry about the rocky experience. I realize this is a bit late for your situation, but earlier this year the source code submission docs were updated with information about the default reviewer build environment[1].

It's not a huge improvement, but it sounds like one thing we could do to improve the communications process around build errors is to include a link to this documentation in the notification email sent to developers. I'll create a ticket for this now.

[1]: https://extensionworkshop.com/documentation/publish/source-c...

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#429

Post by salesynerd »

ilrwbwrkhv wrote: post #171
open-paren wrote: post #117

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need…

That's not just mozilla. Google's review team all are in India and they cannot write clear English. It's a mess.

Why make such a generalized statement?

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#430

Post by EasyMark »

spacechild1 wrote: post #237
EasyMark wrote: post #184

Earlier quoted context omitted.

To have a reviewer under your employ that doesn’t know what UBO is or it’s dev, makes me feel pretty confident in siding with gorilla on this, but I hope that he does calm down a bit and put the extension back up.

> in siding with gorilla on this Off topic, but this is such a funny autocomplete accident :)

I saw it after the fact, but I left it to alleviate some of the seriousness :)
Post reply on HN