Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gorhill pulls uBlock Origin Lite from Firefox store

neowin.net

Post reply on HN
Print view View original

431–440 of 442 posts

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#431

Post by Etherlord87 »

xelamonster wrote: post #406
Etherlord87 wrote: post #350

Earlier quoted context omitted.

What kind of harmful code could you put in WASM? You could return a string that you eval on the javascript side, so the reviewers could possibly ask for the WASM source if they saw the eval, but other than that the purpose of WASM is to be a safe sandbox after all, right?

I'm not familiar with the security guarantees of WASM in the browser but I imagine they're more along the lines of preventing data exfiltration from the browser/OS, it would be difficult to prevent something like abusing your CPU resources to mine Bitcoin in the background for example.

One way to protect yourself from bitcoin mining is to not give a WASM program both an access to get incoming data and send data both into a 3rd party server. Another possibility is to threshold computation power on the WASM interpreter so that there's a limit of opcodes processed.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#432

Post by fwn »

anticensor wrote: post #421
thatguy288 wrote: post #382

Earlier quoted context omitted.

Probably a big ask, but could you find out why one is not allowed to add your own root cert to FF and sign an addon yourself, instead being forced to use an ESR/develop/nightly version and setting xpinstall.signatures.required to false, significantly reducing your security?

And, when a self-signed certificate is in use, the browser should show a prominent icon of self-configured security.

> And, when a self-signed certificate is in use, the browser should show a prominent icon of self-configured security.

..and there should of course be a way to disable that prominent icon of self-configured security.

Because Firefox, unlike most software, is designed to be a user agent.

While it may be natural for Google, for example, to constantly nag Chrome users for non-standard behaviour, Mozilla should not do the same with Firefox.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#433

Post by fwn »

chimeracoder wrote: post #128
munch117 wrote: post #114

Earlier quoted context omitted.

But this is not about a high profile plugin. The high profile plugin is "uBlock Origin", and this is about "uBlock Origin Lite", which is a big thing for Chrome, but not for Firefox. Why would anyone want to use uBOL, when they have the option to use uBO? Perhaps Mozilla does have a higher tier of review, but it's for specific plugins, not for specific authors.

> But this is not about a high profile plugin. The high profile plugin is "uBlock Origin", and this is about "uBlock Origin Lite", which is a big thing for Chrome, but not for Firefox. Why would anyone want to use uBOL, when they have the option to use uBO? uBlock Origin requires giving the extension full read and write permissions on every site you visit, which is a huge liability, security-wise. uBlock Origin Lite…

> Perhaps you trust gorhill with that power, but it's pretty understandable why others might not want to give that power to a third party.

I have been using the extension, now called ublock origin, for longer than I have been using the Firefox browser. Mozilla is the third party in this relationship.

In all those years, the extension project's principles were very strict, and the authors never disappointed. Mozilla, meanwhile, is just a constant stream of disappointments.

It's so many things, really. Magic opt-out tracking here and there, ads in new tab windows, nuking almost the entire extension ecosystem on Android for a couple of years just to grind down the user base, etc. It never ends.

You can also communicate with gorhill like a real person. Mozilla press communication is always a psychopathic mess of corporate speak. There is hardly anything in there.

I'm not even sure which project, ublock origin or Firefox, has more users by now.

My loyalties are pretty well sorted at this point.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#434

Post by 99112000 »

horsawlarway wrote: post #379
Too wrote: post #340

Earlier quoted context omitted.

Reproducible builds and open source sounds like a good thing. I wouldn’t expect the reviewers to deal with every add-ons bespoke snowflake build. Even less so if it requires access to a private module. Mozilla should provide a baseline of how a build is intended to be done, then extensions just have to follow this template. Though yes, you would expect them to have some familiarity with basic stuff like yarn and that…

We use a relatively simple build. at the base of it, if you have node and npm, a complete build is as easy as yarn npm login yarn --immutable yarn build Personally - I don't really find it reasonable to place demands on build tooling for an external company. I'm assuming you would also find it reasonable for Google to suddenly ship chromium with a requirement that you use "google-pack" for all js builds or they don't…

Docker

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#435

Post by fwn »

paulryanrogers wrote: post #400
thoroughburro wrote: post #370

Earlier quoted context omitted.

Is everyone who claims the Internet cannot work without advertising only 20 years old? Why try to gaslight so many people who remember the Internet without advertising just fine. It was just a few decades ago!

I remember the BBS's, Compuserve, AOL, and the Internet before (ubiquitous) advertising. It was fun yet spartan. In light of the alternatives (like paying for everything with discrete purchase or subscriptions), I'd prefer that advertising survive. Ideally with less invasive ways of detecting my interests. My intention is certainly not to gaslight anyone. Not sure how you came to that conclusion. Full disclosure, I w…

There's nothing wrong with wanting advertising to survive. It's a creative powerhouse and a huge cultural influence.

But what most people really mean when they say that is: I want to preserve ways of coercing or tricking people into consuming content that they do not actually want to consume at the time of consumption.

And I think that is a very bad idea, regardless of the expectations people put into that ability.

No one should be force-fed advertising.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#436

Post by account42 »

EasyMark wrote: post #323
sfink wrote: post #310

That sucks. I work for Mozilla, but nowhere near Addons so I don't know what pressures they're under or whatever. But if I ran the zoo... this is gorhill we're talking about. We ought to just make him an add-on reviewer with full rights, and tell him it's ok if the only add-ons he reviews are his own. We do not need to vet either his competence or trustworthiness; we have vastly more historical data backing him up th…

I suspect he will simmer down a bit (I do not at all blame him for what he did, it has to be frustrating to dedicate thousands of hours into something just to have some clueless person pull it). I think it will be back inside of a week, it’s important and can save battery over regular ublock origin on Firefox.

> can save battery over regular ublock origin

Comparing battery usage for tools with wildly different capabilites does not make sense.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#437

Post by account42 »

4bpp wrote: post #53

If I understand the timeline correctly here, it seems that gorhill overreacted, and I say that as someone who is usually harshly critical of everything Mozilla has done in the past 5+ years. It's hardly practical for Mozilla to manually review every add-on revision for safety in a timely manner, so they had the choice between automation and delays that would make add-on development a slog; automation though inevitabl…

So? Mozilla inserted themselves as middlemen into addon delivery. Even for the so-called selfhosted addons. They can just not do that if doing it properly and without undue delays means more work than they can handle.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#438

Post by account42 »

breakingcups wrote: post #378
greentxt wrote: post #57

Earlier quoted context omitted.

Because there was a privacy policy it's hard to understand how that could be a mistake. The insinuation is the reviewer was not acting in hood faith.

Lot of people in this thread not familiar with Hanlon's razor.. Obviously this could all just be incompetence. It's just a convenient excuse to do some more Mozilla-bashing, (lack of) facts be damned. Not that any of this excuses the experience Gorhill had, of course.

You can be familiar with Hanlons's razor and disagree that it is a good rule for dealing with faceless corporations. If you excuse everything as bening incompetence then that's exactly how malicious actors will hide.

Re: Gorhill pulls uBlock Origin Lite from Firefox store

#439

Post by account42 »

JimDabell wrote: post #106
busterarm wrote: post #95

Earlier quoted context omitted.

We're at a really dangerous point with browsers at the moment where there's really no consumer-friendly option available. I'm scared to say that Safari comes closest but you're just in Apple's walled garden then instead of someone elses'. Our only hope seems to lie with Ladybird, if that even ends up being good and it seems extensions aren't on the agenda at least for a while.

The issue is bigger than that. The web standards process relies on two independent implementations for something to become a web standard. This just about works when there are three big players, but if Mozilla drops out, then it’s just Google and Apple arguing. It’s bad enough that two out of the three rendering engines that participate in the web standards process are funded by Google. We really need another indepen…

Less churn in web standards would be a good thing though.
Post reply on HN