3 ms·

> that volunteers review the addons I don't think that makes it better. In fact, it's worse. Why is Mozilla Corporation, a company with gross revenue of $56

> that volunteers review the addons I don't think that makes it better. In fact, it's worse. Why is Mozilla Corporation, a company with gross revenue of $562 million, delegating an important security role to unpaid and apparently unaccountable volunteers?

soapdog 8y ago
Thats not how it works. To become an addon reviewer there is a process and it is not like all the reviewers are the same. Again please, don't treat volunteers who are donating their time and effort as unaccountable or as if they don't know security, they are accountable and there is also a staff team working on there. There are a ton of volunteers who are very good with security. Whatever happened between this addon author and the review this is kinda private to them. I really dislike when people assume that because you're a volunteer that you're unaccountable or less capable technically or security wise than an employee. That is simply not true. There are volunteers in all places at Mozilla and personally, I think this is great. Also treating Mozilla as a company is not really the ideal mindset. Mozilla is at best a NGO, a foundation, who owns a company for legal reasons, who is also a community, who builds a ton of stuff. It is quite a complex entity to be summarized as "a company should handle this different".
- shkkmo 8y ago
  I don't understand what point you are trying to make. First you agree with the OP that the reviews being done by volunteers who can makes mistakes somehow makes Mozilla less culpable, then you jump in to say that these volunteers are just as accountable, technically capable and security wise as an employee would be. You only seem interested in letting Mozilla off the hook rather than acknowledging the systemic issues that gave rise to this situation. > Also treating Mozilla as a company is not really the ideal mindset. Mozilla is at best a NGO, a foundation, who owns a company for legal reasons, who is also a community, who builds a ton of stuff. Except the Mozilla Corporation is the entity that develops Firefox and is a company. That company may be wholey owned by a non-profit, but it is still a company.
Sylos 8y ago
Why is Google, a company with gross revenue of much more than that, not doing it at all? Obviously, the Mozilla Corporation's only stake holder is the non-profit Mozilla Foundation, so they can't pay out much of their revenue to anyone other than their employees (and to those in wages that are comparable with the rest of the industry; they have to publish their finances for that), so they certainly can afford to spend more money on things like that, but they're still trying to avoid spending huge amounts of money on something that can be done just as well in 99% of cases at a fifth of the cost. As far as I know, they have a system where at least two independent volunteers have to approve an extension and some employees will occasionally check up on things, too, and can revoke volunteers that make mistakes too often or are plain malicious. So, most of the time, this system will fail on the side of things being disapproved that should have been approved. It will much less often be the case that for example malware will get approved (especially since they also have automated malware scans, which is something that Google has, too).

soapdog 8y ago

Thats not how it works. To become an addon reviewer there is a process and it is not like all the reviewers are the same. Again please, don't treat volunteers who are donating their time and effort as unaccountable or as if they don't know security, they are accountable and there is also a staff team working on there. There are a ton of volunteers who are very good with security. Whatever happened between this addon author and the review this is kinda private to them. I really dislike when people assume that because you're a volunteer that you're unaccountable or less capable technically or security wise than an employee. That is simply not true. There are volunteers in all places at Mozilla and personally, I think this is great. Also treating Mozilla as a company is not really the ideal mindset. Mozilla is at best a NGO, a foundation, who owns a company for legal reasons, who is also a community, who builds a ton of stuff. It is quite a complex entity to be summarized as "a company should handle this different".

shkkmo 8y ago
I don't understand what point you are trying to make. First you agree with the OP that the reviews being done by volunteers who can makes mistakes somehow makes Mozilla less culpable, then you jump in to say that these volunteers are just as accountable, technically capable and security wise as an employee would be. You only seem interested in letting Mozilla off the hook rather than acknowledging the systemic issues that gave rise to this situation. > Also treating Mozilla as a company is not really the ideal mindset. Mozilla is at best a NGO, a foundation, who owns a company for legal reasons, who is also a community, who builds a ton of stuff. Except the Mozilla Corporation is the entity that develops Firefox and is a company. That company may be wholey owned by a non-profit, but it is still a company.

Sylos 8y ago

Why is Google, a company with gross revenue of much more than that, not doing it at all? Obviously, the Mozilla Corporation's only stake holder is the non-profit Mozilla Foundation, so they can't pay out much of their revenue to anyone other than their employees (and to those in wages that are comparable with the rest of the industry; they have to publish their finances for that), so they certainly can afford to spend more money on things like that, but they're still trying to avoid spending huge amounts of money on something that can be done just as well in 99% of cases at a fifth of the cost. As far as I know, they have a system where at least two independent volunteers have to approve an extension and some employees will occasionally check up on things, too, and can revoke volunteers that make mistakes too often or are plain malicious. So, most of the time, this system will fail on the side of things being disapproved that should have been approved. It will much less often be the case that for example malware will get approved (especially since they also have automated malware scans, which is something that Google has, too).