Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla stops distribution of WOT addon

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 84 posts

Re: Mozilla stops distribution of WOT addon

#71

Post by jlgaddis »

senorjazz wrote: post #60

Good riddance, a vile site full of self appointed internet police with handpainted badges with a sense of importance They falsely flagged a a website I ran a while back (social media management tools via approved APIs) as: pharmacy, scam and spam. Due to this mails from our server were not getting through. I tried contacting saying they are all false. They updated saying we sold facebook likes and fake followers. We…

I "want to believe you" and I always try to extend the benefit of the doubt whenever possible but it'd be interesting to hear the other side of the story as well.

Among other things, I manage a bunch of mail servers and I keep a close eye on them. I "blacklist" IP addresses of "misbehaving senders" pretty often and the rejection messages provide a way for the sender to get in touch with us. This way, we can work with them to rectify whatever problem caused them to be blacklisted by us -- many times it's that an e-mail account was compromised and used to send out spam.

I can't even begin to count how many times I've had administrators of other mail servers swear to me that they have NEVER sent out any spam whatsoever (or similar statements) and that blacklisting them is a mistake and absolutely 100% our fault.

Except that, in every case, I, personally, have looked at every single message, determined it was spam, tracked down where it came from (verifying Received: headers against Postfix logs), and manually added the IP address to our list. In addition, the first time it happens they don't even get prevented from sending mail to us; only upon the second incident are messages rejected.

Thus, for someone to say that they know absolutely positively 100% without a doubt that their server never sent us spam just makes me laugh because I know that not only did they send us spam but, as a matter of fact, they've done it at least twice!

So, like I said, I want to believe you but I'd want to hear it from the other side before making a conclusion. There's always another version of events and experience has shown me that it's usually drastically different.

Re: Mozilla stops distribution of WOT addon

#72

Post by paulryanrogers »

admax88q wrote: post #66
blub wrote: post #23

Earlier quoted context omitted.

Lateley there's a trend to dismiss the above saying (i.e. if it's free you are the product) in a casual manner. Reality isn't influenced by such dismissals or wishful thinking however. If a company's financial interests aren't aligned with the general interests of its customers, then it will trample over the interests of its customers. Google, Facebook, any company that's selling advertising are not only not your fri…

My issue with that saying is that it prejudices people against Free (as in libre) Software. Free Software is free, and you aren't the product when you use it. In most cases its the only software that actually puts the user first. Saying "If it's free, you are the product" tells people that the only way to get good software is to pay money for it. When in reality lots of payed software harvests your data just as much.

IME free and open software does tend toward abandonment or some form of monetization over time. Just ran into this with Synergy recently.

Re: Mozilla stops distribution of WOT addon

#73

Post by yuhong »

byuu wrote: post #59
raverbashing wrote: post #18

Earlier quoted context omitted.

Do you know what would be a great way to prevent this? Every data send by an extension should be user viewable. Here's the json file (or maybe something better) that we are posting, press Agree to send it

They would just start obfuscating the data (with ciphers, word replacements, encoding, minification, etc.) They'd then claim it was for your security/privacy/protection. You know, like how Microsoft encrypts your Windows 10 usage data it sends them. At least you could use the presence of such obfuscation as a sign there's probably something bad afoot. Presuming only a tiny number of extensions try to encode the data…

This extension already does in fact, with double base64 (see btoa in source).

Re: Mozilla stops distribution of WOT addon

#74

Post by paulryanrogers »

codedokode wrote: post #44
therealmarv wrote: post #8

I wanted to say: And Google did not removed it. But actually it is also gone in Google extension store. Google also seriously needs to think about security in their Chrome extension store. I've seen more than once ads injected by extensions by the auto update (no real security there). Maybe I've been also tracked in the past. Google needs to actively monitor all extensions for ad injection and tracking code (where ar…

There is nothing that can be done. Any moderation can be easily bypassed (for example, obfuscated code, code loaded from external servers etc.). You just should not install software that you don't trust. For example I don't use any browser extensions because I don't have time to inspect their code after every update. I wonder why both Google and Mozilla don't write this at the front page of their extension stores?

Serious question: do you audit code changes in browser updates?

EDIT: I realize there are (probably) fewer authors involved there.

Re: Mozilla stops distribution of WOT addon

#75

Post by cheiVia0 »

codedokode wrote: post #44
therealmarv wrote: post #8

I wanted to say: And Google did not removed it. But actually it is also gone in Google extension store. Google also seriously needs to think about security in their Chrome extension store. I've seen more than once ads injected by extensions by the auto update (no real security there). Maybe I've been also tracked in the past. Google needs to actively monitor all extensions for ad injection and tracking code (where ar…

There is nothing that can be done. Any moderation can be easily bypassed (for example, obfuscated code, code loaded from external servers etc.). You just should not install software that you don't trust. For example I don't use any browser extensions because I don't have time to inspect their code after every update. I wonder why both Google and Mozilla don't write this at the front page of their extension stores?

Mozilla actually manually reviews the extensions and updates to the extensions, and would reject obfuscated code. See for example:

https://blog.mozilla.org/addons/2016/08/19/a-simpler-add-on-...

https://blog.mozilla.org/addons/2010/02/15/the-add-on-review...

Re: Mozilla stops distribution of WOT addon

#76

Post by nitrogen »

codedokode wrote: post #46
nitrogen wrote: post #27

Earlier quoted context omitted.

All the AI experts in the world won't be able to solve the problem of people thinking a problem is equivalent to the halting problem. You don't need perfect performance, you only need to stay ahead of most of the attempts. Fighting fraud is similar -- it's not possible to stop 100%, but you can get close, and try to make it easy to minimize/undo the damage done by the false negatives.

You are probably over optimistic about what AI is. AI is not a human-like mind that sits inside a computer and solves any problem you give.

I am aware :). But don't you think that a finer grained permissions model, combined with even a simple Bayesian classifier (or a NN classifier) that triggers manual review, could catch a lot of suspicious extensions? E.g. P(malware|reads url+calls third party) > P(malware)

Re: Mozilla stops distribution of WOT addon

#77

Post by jlgaddis »

sammoth wrote: post #38
LinuxFreedom wrote: post #22

All the other addons are completely trustable, of course. It also really helps that Firefox never deletes cookies by default and never tells you about this. We 'respect' your privacy, yes, we do! Really! Look, you will have only one google cookie when you start a very new firefox. We really respect your privacy, yes! We will reiterate that until you believe it, but never change our privacy destroying default settings…

Do you really think being logged out of every website every time you start your browser would be an acceptable default?

I only browse in (incognito|private) windows. My browsers are configured to startup that way automatically.

It "works for me" and it'd probably work for a lot of (perhaps even most) other users so maybe it would be an acceptable default. I don't know.

I think there's a happy medium somewhere between these two extremes that absolutely would be an acceptable default, though. Firefox could certainly come with better defaults if Mozilla truly valued privacy that high.

(FWIW, my mozilla.cfg -- pointed to by general.config.filename -- currently has 127 settings in it. It's been added to over the years, though, so some of those are certainly deprecated by now.)

Re: Mozilla stops distribution of WOT addon

#78

Post by codedokode »

nitrogen wrote: post #76
codedokode wrote: post #46

Earlier quoted context omitted.

You are probably over optimistic about what AI is. AI is not a human-like mind that sits inside a computer and solves any problem you give.

I am aware :). But don't you think that a finer grained permissions model, combined with even a simple Bayesian classifier (or a NN classifier) that triggers manual review, could catch a lot of suspicious extensions? E.g. P(malware|reads url+calls third party) > P(malware)

There will be ways to bypass those checks. The easiest is to wait a week after installation before doing anything bad. Or extension could download and execute code from remote server that would serve one version of code for users from Mountain View and another version to everyone else. Or the code could check whether it is run on a real device.

Re: Mozilla stops distribution of WOT addon

#79

Post by codedokode »

paulryanrogers wrote: post #74
codedokode wrote: post #44

Earlier quoted context omitted.

There is nothing that can be done. Any moderation can be easily bypassed (for example, obfuscated code, code loaded from external servers etc.). You just should not install software that you don't trust. For example I don't use any browser extensions because I don't have time to inspect their code after every update. I wonder why both Google and Mozilla don't write this at the front page of their extension stores?

Serious question: do you audit code changes in browser updates? EDIT: I realize there are (probably) fewer authors involved there.

Browsers are made by reputable organizations like Mozilla Foundation or (not so reputable) Google. And extensions are usually written by some anonymous person from Internet (or sold to anonymous person after gaining popularity).

Re: Mozilla stops distribution of WOT addon

#80

Post by nitrogen »

codedokode wrote: post #78
nitrogen wrote: post #76

Earlier quoted context omitted.

I am aware :). But don't you think that a finer grained permissions model, combined with even a simple Bayesian classifier (or a NN classifier) that triggers manual review, could catch a lot of suspicious extensions? E.g. P(malware|reads url+calls third party) > P(malware)

There will be ways to bypass those checks. The easiest is to wait a week after installation before doing anything bad. Or extension could download and execute code from remote server that would serve one version of code for users from Mountain View and another version to everyone else. Or the code could check whether it is run on a real device.

This is where the classification heuristics and fine-grained permissions come in. Code that does anything conditioned on dates is higher risk. Code that uses location services is higher risk.

Also, many of these checks can be done by the browser in situ, so an extension that suddenly changes its behavior can be flagged for review. And pre-release malware scans can be run on banks of actual hardware that simulates different dates and locations.

Sure, there will be an arms race, but that's better than an anarchical free for all.

Post reply on HN