7 ms·

In order to use this supposed privacy-enhancing feature, you must allow the authors of this extension total control over everything you do on the web. Add-ons

In order to use this supposed privacy-enhancing feature, you must allow the authors of this extension total control over everything you do on the web. Add-ons are automatically updated in Firefox by default, so you can review this code now and it will change later. This seems like a poor trade.

hyperpallium 8y ago
Email me to subscribe to my anti-spam service! Enter your credit card details to check if they've been stolen!
- black-tea 8y ago
  There is a site that is very popular here that does just that (haveibeenpwned).
  - TeMPOraL 8y ago
    No it doesn't, it does not ask you to provide your own password.
    - eecc 8y ago
      Or CC details... ;)
    - fwn 8y ago
      This is wrong, since grandparent did not ask for passwords. Quote: > Email me to subscribe to my anti-spam service! This is precisely what haveibeenpwned asks for, as your parent wrote.
    - DavideNL 8y ago
      It does: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
    - auslander 8y ago
      Troy Hunt launched another one, which does ask for password. And sells you 1Password after check :)
skocznymroczny 8y ago
We need a container for the container extension
auslander 8y ago
Yes. That's why Apple moved from JS based extentions to Content Blockers model. App provides a complex list of blocked resources to Safari, and have no access to actual browser content. On iOS, install Firefox Focus, and in Safari settings enable FF provided Content Blocker.
- gcb0 8y ago
  that only covers some 3% of all available extension's capabilities. namely: ad blockers.
  - auslander 8y ago
    But the only capability I need from an extension :)
    - gcb0 8y ago
      typical walled garden user :) guess if you wait 10yrs for something as simple as an ad blocker, your expectations will be very low anyway
dpkonofa 8y ago
To be fair, I can't see any way for this to work without giving them control of the browser. Even with a TLD limited extension, the extension would need permission to access your browser window and giving it permission to do that would give it permission for any TLD.
Koshkin 8y ago
“What three people know, the pig knows.”
Nicksil 8y ago
>Add-ons are automatically updated in Firefox by default, so you can review this code now and it will change later Or, if you'd like, you may disable auto-update.
- h1d 8y ago
  But who has reviewed the code of the version available when you install?
  - ndnxhs 8y ago
    I think Mozilla does a basic review. Not perfect but good enough. The extensions situation has gotten bad enough that I'd support Mozilla having an "approved extensions" section where you pay to have yours reviewed and approved.
    - Springtime 8y ago
      The fact that Stylish managed to remain—and be featured, even—on both the Mozilla and Chrome catalogs for close to two years as it tracked user's browsing history says to me that there must be certain level of trust for pre-reviewed addons.
      - rndgermandude 8y ago
        The mozilla add-ons site actually rejected the version with tracking (the post acquisition one) for some years due to the tracking and still featured the old version without tracking. Chrome's webstore version did have the tracking, tho. Now in the era of WebExtensions (which are SOOO much more secure!!!) it seems they finally approved a version published by those bad actors. No idea tho if and what tracking is in there and if mozilla stuck to their guns and made them remove tracking or not.
        Springtime 8y ago
        > The mozilla add-ons site actually rejected the version with tracking (the post acquisition one) for some years due to the tracking and still featured the old version without tracking. Is there a source you're using for this info? As I visited a couple times during that period (including mid this year) and saved a personal copy of the Versions URL which listed multiple versions post acquisition available [1]. [1] Specifically: 2.1.1 (2017-10-31), 3.0.1 (2017-11-10), and 3.1.1 (2018-05-23).
Semaphor 8y ago
While I agree with you and wouldn't use it myself, it is relevant that Firefox uses human reviewers for their add-ons. So with every update someone will look at what changed and judge if it is benign.
- Vinnl 8y ago
  I don't think this is necessarily true any more, since WebExtensions. I think human reviews are only necessary if extensions use certain constructs. (Or human reviews are now allowed after publishing when an extension passes automated review - I'm not sure.)
  - sveme 8y ago
    When I submitted my webextension-based extension, there was an automatic review followed by a human review. But obviously it's unclear what the quality of that review was and I'm not sure whether any update triggers another round of reviews.
    - Semaphor 8y ago
      I know that at least for decentraleyes, the human reviewers have a script to check all the checksums of the included libraries after updates get submitted.
_nalply 8y ago
Fork the repository and maintain the extension yourself. I know, it's a hassle and only possible for programmers, but...
- czechdeveloper 8y ago
  Or you can just setup google container manually, it's not so much work in Firefox.
- oelmekki 8y ago
  That was my usual extension management method for chrome, but sadly each time I tried that on firefox, it didn't fly (IIRC, you _can_ load extension from your local FS, but they only lives for the time of the session). By the way, if someone from firefox team is reading this : I would _really_ love to be able to just load directories from my FS as extensions rather than having to trust someone on the internet that it does what it says it does. I love building extensions myself, but I just don't install extensions from the web anymore because I don't know what's in there (note that referring to a github repos is not enough : I have no guarantee the content of the extension is the same).
cmroanirgo 8y ago
...Or, you can use "Firefox Multi-Account containers" by Mozilla. [0] This is what I use. I have everything that I log into google for in one container, social media in a second, and everything else is nicely sand-boxed away from those horrors. [0] https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account...
- amelius 8y ago
  Does it support mobile yet?
- tjoff 8y ago
  It bothers me that they for some reason doesn't support containers in private windows. I guess a substitute could be to wipe the firefox profile on start or something but haven't attempted that route yet.
  - Aissen 8y ago
    You don't need to, Firefox has had an option to clear history (and cookies, etc.) on close, since… forever.
    - tjoff 8y ago
      I guess I just haven't trusted that that feature really does what I want it to. But I should check it out, thanks!
  - speedplane 8y ago
    Is anyone else bothered by Google Chrome's new attempt to suggest long and complicated passwords when you create an account anywhere? Sure this is a nice bonus for security, but it also means that you can't log into websites anymore unless you're using chrome signed into your Google account.
    - oarsinsync 8y ago
INTPenis 8y ago
Considering that a lot of people still use Chrome I think just using Firefox is a great start. But yeah there is always nitpicking to do when it comes to security. No one is ever truly secure.
- vorticalbox 8y ago
  I use the brave browser which is based on chromium, blocks ads, trackers, has tor private tabs and soon will pay you for seeing ads which you can then use pay BAT to the websites you want to support. All this without breaking user privacy.
  - h1d 8y ago
    How do you track that each update hasn't turned evil?
    - chazhaz 8y ago
      I mean, you don't. You have to trust the maintainers of the software you use, to a certain degree, or spend a majority of your time auditing the software you use. That being said, Brave is pretty upfront about the security of their software. They've paid $25k in bug/security bounties so far and their browser is open source. So if an update turns evil, it stands to reason that someone is going to notice.
  - auslander 8y ago
    > I use the brave browser which is based on chromium ... Two points against it: 1. You stand out from the crowd with this User-Agent, easy to fingerprint you. 2. Chromium is Google (Ad company) software, like Android. Un-googling it may not be complete or full. Safest way is not using any Google software.
andyjohnson0 8y ago
I agree. I have no idea who the author is and, while they may well have the best of motives, that's not a basis for trust. FF extensions just have too much power and too little end-user control. At a minimum I'd like to be able to selectively disable them in private browsing mode, as Chrome allows.
opencl 8y ago
Feel free to read the source code (the entire thing is 400 lines) and disable extension auto updates. Or sideload the addon from the github repo so there's no way for it to auto update in the first place.
mtgx 8y ago
There's a Facebook container by Mozilla. I wonder why they didn't make one for Google themselves: https://addons.mozilla.org/en-US/firefox/addon/facebook-container/ https://addons.mozilla.org/en-US/firefox/addon/facebook-cont...

hyperpallium 8y ago

Email me to subscribe to my anti-spam service! Enter your credit card details to check if they've been stolen!

black-tea 8y ago
There is a site that is very popular here that does just that (haveibeenpwned).
- TeMPOraL 8y ago
  No it doesn't, it does not ask you to provide your own password.
  - eecc 8y ago
    Or CC details... ;)
  - fwn 8y ago
    This is wrong, since grandparent did not ask for passwords. Quote: > Email me to subscribe to my anti-spam service! This is precisely what haveibeenpwned asks for, as your parent wrote.
  - DavideNL 8y ago
    It does: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
  - auslander 8y ago
    Troy Hunt launched another one, which does ask for password. And sells you 1Password after check :)

skocznymroczny 8y ago

We need a container for the container extension

auslander 8y ago

Yes. That's why Apple moved from JS based extentions to Content Blockers model. App provides a complex list of blocked resources to Safari, and have no access to actual browser content. On iOS, install Firefox Focus, and in Safari settings enable FF provided Content Blocker.

gcb0 8y ago
that only covers some 3% of all available extension's capabilities. namely: ad blockers.
- auslander 8y ago
  But the only capability I need from an extension :)
  - gcb0 8y ago
    typical walled garden user :) guess if you wait 10yrs for something as simple as an ad blocker, your expectations will be very low anyway

dpkonofa 8y ago

To be fair, I can't see any way for this to work without giving them control of the browser. Even with a TLD limited extension, the extension would need permission to access your browser window and giving it permission to do that would give it permission for any TLD.

Koshkin 8y ago

“What three people know, the pig knows.”

Nicksil 8y ago

>Add-ons are automatically updated in Firefox by default, so you can review this code now and it will change later Or, if you'd like, you may disable auto-update.

h1d 8y ago
But who has reviewed the code of the version available when you install?
- ndnxhs 8y ago
  I think Mozilla does a basic review. Not perfect but good enough. The extensions situation has gotten bad enough that I'd support Mozilla having an "approved extensions" section where you pay to have yours reviewed and approved.
  - Springtime 8y ago
    The fact that Stylish managed to remain—and be featured, even—on both the Mozilla and Chrome catalogs for close to two years as it tracked user's browsing history says to me that there must be certain level of trust for pre-reviewed addons.
    - rndgermandude 8y ago
      The mozilla add-ons site actually rejected the version with tracking (the post acquisition one) for some years due to the tracking and still featured the old version without tracking. Chrome's webstore version did have the tracking, tho. Now in the era of WebExtensions (which are SOOO much more secure!!!) it seems they finally approved a version published by those bad actors. No idea tho if and what tracking is in there and if mozilla stuck to their guns and made them remove tracking or not.
      - Springtime 8y ago
        > The mozilla add-ons site actually rejected the version with tracking (the post acquisition one) for some years due to the tracking and still featured the old version without tracking. Is there a source you're using for this info? As I visited a couple times during that period (including mid this year) and saved a personal copy of the Versions URL which listed multiple versions post acquisition available [1]. [1] Specifically: 2.1.1 (2017-10-31), 3.0.1 (2017-11-10), and 3.1.1 (2018-05-23).

Semaphor 8y ago

While I agree with you and wouldn't use it myself, it is relevant that Firefox uses human reviewers for their add-ons. So with every update someone will look at what changed and judge if it is benign.

Vinnl 8y ago
I don't think this is necessarily true any more, since WebExtensions. I think human reviews are only necessary if extensions use certain constructs. (Or human reviews are now allowed after publishing when an extension passes automated review - I'm not sure.)
- sveme 8y ago
  When I submitted my webextension-based extension, there was an automatic review followed by a human review. But obviously it's unclear what the quality of that review was and I'm not sure whether any update triggers another round of reviews.
  - Semaphor 8y ago
    I know that at least for decentraleyes, the human reviewers have a script to check all the checksums of the included libraries after updates get submitted.

_nalply 8y ago

Fork the repository and maintain the extension yourself. I know, it's a hassle and only possible for programmers, but...

czechdeveloper 8y ago
Or you can just setup google container manually, it's not so much work in Firefox.
oelmekki 8y ago
That was my usual extension management method for chrome, but sadly each time I tried that on firefox, it didn't fly (IIRC, you _can_ load extension from your local FS, but they only lives for the time of the session). By the way, if someone from firefox team is reading this : I would _really_ love to be able to just load directories from my FS as extensions rather than having to trust someone on the internet that it does what it says it does. I love building extensions myself, but I just don't install extensions from the web anymore because I don't know what's in there (note that referring to a github repos is not enough : I have no guarantee the content of the extension is the same).

cmroanirgo 8y ago

...Or, you can use "Firefox Multi-Account containers" by Mozilla. [0] This is what I use. I have everything that I log into google for in one container, social media in a second, and everything else is nicely sand-boxed away from those horrors. [0] https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account...

amelius 8y ago
Does it support mobile yet?
tjoff 8y ago
It bothers me that they for some reason doesn't support containers in private windows. I guess a substitute could be to wipe the firefox profile on start or something but haven't attempted that route yet.
- Aissen 8y ago
  You don't need to, Firefox has had an option to clear history (and cookies, etc.) on close, since… forever.
  - tjoff 8y ago
    I guess I just haven't trusted that that feature really does what I want it to. But I should check it out, thanks!
- speedplane 8y ago
  Is anyone else bothered by Google Chrome's new attempt to suggest long and complicated passwords when you create an account anywhere? Sure this is a nice bonus for security, but it also means that you can't log into websites anymore unless you're using chrome signed into your Google account.
  - oarsinsync 8y ago

INTPenis 8y ago

Considering that a lot of people still use Chrome I think just using Firefox is a great start. But yeah there is always nitpicking to do when it comes to security. No one is ever truly secure.

vorticalbox 8y ago
I use the brave browser which is based on chromium, blocks ads, trackers, has tor private tabs and soon will pay you for seeing ads which you can then use pay BAT to the websites you want to support. All this without breaking user privacy.
- h1d 8y ago
  How do you track that each update hasn't turned evil?
  - chazhaz 8y ago
    I mean, you don't. You have to trust the maintainers of the software you use, to a certain degree, or spend a majority of your time auditing the software you use. That being said, Brave is pretty upfront about the security of their software. They've paid $25k in bug/security bounties so far and their browser is open source. So if an update turns evil, it stands to reason that someone is going to notice.
- auslander 8y ago
  > I use the brave browser which is based on chromium ... Two points against it: 1. You stand out from the crowd with this User-Agent, easy to fingerprint you. 2. Chromium is Google (Ad company) software, like Android. Un-googling it may not be complete or full. Safest way is not using any Google software.

andyjohnson0 8y ago

I agree. I have no idea who the author is and, while they may well have the best of motives, that's not a basis for trust. FF extensions just have too much power and too little end-user control. At a minimum I'd like to be able to selectively disable them in private browsing mode, as Chrome allows.

opencl 8y ago

Feel free to read the source code (the entire thing is 400 lines) and disable extension auto updates. Or sideload the addon from the github repo so there's no way for it to auto update in the first place.

mtgx 8y ago

There's a Facebook container by Mozilla. I wonder why they didn't make one for Google themselves: https://addons.mozilla.org/en-US/firefox/addon/facebook-container/ https://addons.mozilla.org/en-US/firefox/addon/facebook-cont...