6 ms·

As I recall, because people were already programmatically generating endless numbers of malware extension IDs to avoid blacklisting. Blacklisting depends on a

by sfink 8y ago

As I recall, because people were already programmatically generating endless numbers of malware extension IDs to avoid blacklisting. Blacklisting depends on a limited supply of whatever you're trying to control. UUIDs are not limited. More generally, if you come up with an obviously superior solution to a problem that someone else has claimed is important and difficult, and has spent considerable resources addressing, perhaps it would be more constructive to investigate or ask questions to test your understanding of the situation before assuming and asserting that the other people are doing it all wrong? I'm not saying mozilla has the best possible solution here. I don't know what that would be. I do know (I work for mozilla though not in this area) that the step was taken to address real, and very active, threats to security, privacy, and stability.

AnthonyMouse 8y ago
> As I recall, because people were already programmatically generating endless numbers of malware extension IDs to avoid blacklisting. Which is a good reason not to use the extension ID as the sole method to enforce the blacklist, and is why anti-malware software generally uses a signature-based approach. > More generally, if you come up with an obviously superior solution to a problem that someone else has claimed is important and difficult, and has spent considerable resources addressing, perhaps it would be more constructive to investigate or ask questions to test your understanding of the situation before assuming and asserting that the other people are doing it all wrong? You're implying this is a novel problem that hasn't been widely studied by everyone and that they're not actually doing it all wrong. > I do know (I work for mozilla though not in this area) that the step was taken to address real, and very active, threats to security, privacy, and stability. There are many ways to solve a problem by trading it for a set of different problems. Centralized authoritarian control is exactly that. And those things can be popular in the same way anything that externalizes costs and internalizes benefits can be -- because that type of thing seems attractive to the people not directly paying the cost of it. Until the victims (in this case the developers and users whose apps you prohibit) devise a way to protect themselves. Then you end up in an antagonistic relationship with your users and addon developers. What's the cost of that? Meanwhile there are other solutions that don't do that.

by sfink 8y ago

AnthonyMouse 8y ago

> As I recall, because people were already programmatically generating endless numbers of malware extension IDs to avoid blacklisting. Which is a good reason not to use the extension ID as the sole method to enforce the blacklist, and is why anti-malware software generally uses a signature-based approach. > More generally, if you come up with an obviously superior solution to a problem that someone else has claimed is important and difficult, and has spent considerable resources addressing, perhaps it would be more constructive to investigate or ask questions to test your understanding of the situation before assuming and asserting that the other people are doing it all wrong? You're implying this is a novel problem that hasn't been widely studied by everyone and that they're not actually doing it all wrong. > I do know (I work for mozilla though not in this area) that the step was taken to address real, and very active, threats to security, privacy, and stability. There are many ways to solve a problem by trading it for a set of different problems. Centralized authoritarian control is exactly that. And those things can be popular in the same way anything that externalizes costs and internalizes benefits can be -- because that type of thing seems attractive to the people not directly paying the cost of it. Until the victims (in this case the developers and users whose apps you prohibit) devise a way to protect themselves. Then you end up in an antagonistic relationship with your users and addon developers. What's the cost of that? Meanwhile there are other solutions that don't do that.