5 ms·

Here's the rejected Firefox blocklist request for Avast extensions: https://bugzilla.mozilla.org/show_bug.cgi?id=1600600 https://bugzilla.mozilla.org/show_bug.c

Here's the rejected Firefox blocklist request for Avast extensions: https://bugzilla.mozilla.org/show_bug.cgi?id=1600600 https://bugzilla.mozilla.org/show_bug.cgi?id=1600600 Blocklisting the extensions would disable existing installations and stop ancillary data collection, which is prohibited by Firefox Add-on Policies. https://extensionworkshop.com/documentation/publish/add-on-policies/ https://extensionworkshop.com/documentation/publish/add-on-p... > Mozilla expects that the add-on limits data collection whenever possible, in keeping with Mozilla's Lean Data Practices and Mozilla's Data Privacy Principles, and uses the data only for the purpose for which it was originally collected. There are a number of browser extensions maintained by antivirus companies that use security as a disguise to collect and monetize user data. It is time for Google and Mozilla to act on this issue and protect users from these predatory practices. Benign extensions that are genuinely useful and don't have a company behind them do not get this treatment [1], they are blocked whitout preliminary contact with developers [2]. [1] https://www.jeremiahlee.com/posts/page-translator-is-dead/ https://www.jeremiahlee.com/posts/page-translator-is-dead/ [2] https://www.ghacks.net/2019/11/05/mozilla-bans-all-extensions-that-execute-remote-code/ https://www.ghacks.net/2019/11/05/mozilla-bans-all-extension...

horsawlarway 7y ago
I want to second this sentiment and EXPLICITLY call out Mozilla. I am the lead dev for a relatively small Firefox extension. We do not do ANY tracking. We were rejected and removed for simply including the sdk for Microsoft outlook addins as a script in one of our html pages (we share the codebase for an outlook addon as well). This script is well documented and published by Microsoft. I find the hypocrisy here staggering. I know that Firefox gets a lot of love, particularly on HN because it feels like Mozilla is still a trustworthy company. I want to clearly express that I no longer believe this. They want addons in the store that they can use for marketing and sales. Period.
- minewastaken 7y ago
  https://digdeeper.neocities.org/ghost/mozilla.html https://digdeeper.neocities.org/ghost/mozilla.html This article, along with some other sites and my own digging made me leave Firefox for good. It's a good read if you value privacy and think Mozilla is the good guy in a field dominated by evil corporations. At first it might seem biased, but the author makes very good points and backs them up with tons of sources that can't be really argued - most of the article is reviewing privacy policies and terms of service agreements that are available publicly to check. For now I stuck with Pale Moon, but I'm considering some other browsers like Ungoogled Chromium for my daily private and work use. Pale Moon feels kinda janky and old-school in a not good way. But it's fast and (with some minor tweaking: https://spyware.neocities.org/guides/palemoon.html https://spyware.neocities.org/guides/palemoon.html) respects your privacy 100%.
  - vkou 7y ago
    I've read through the first bit of it, and the author comes off as a huge pedant. They spend most of the introduction ranting about browser features being removed in updates - because their expectation seems to be that once Mozilla ships a feature, it must forevermore be a part of the latest version of the browser, from now, until the heat death of the universe... Disclaimer: I don't actually use Firefox, I don't have a hobby horse in this race.
  - aasasd 7y ago
    Funny how the design of that article borders on typical insane unreadable looks of conspiracy theory sites.
- gnicholas 7y ago
  Thanks for posting this. I have had similarly odd experiences recently with the Firefox addon store, which my startup has been in since 2013. All of a sudden we got yanked, among other things because we modify third party libraries. Apparently we would have been fine if we did exactly the same thing but wrote the code ourselves, but since we used a library, and then modified it, we were in violation. To be clear, we provide all our source code in the review process, so it is 100% clear what we are doing. And we don't do anything that is remotely privacy- or security-compromising, which is very clear from the code. We tried to understand this bizarre no-modifying-third-party-libraries policy and see how we could fix it, but they stopped responding and eventually even deleted our extension from the browsers where our users had previously installed it. (Even Apple doesn't do this when it yanks apps — only rarely if there is proven bad behavior will the pull an already-installed/paid-for app from a device.) I happen to know a couple very high-up people at Mozilla, and one of them was able to flag our mistreatment, and the reviewers now seem to be walking back the previously-described global ban on modifying third-party libraries, but we're still not back in the addon store (it's been months). The (alleged?) policy makes no sense to me, and I also don't understand why Mozilla is now blocking users from installing any addon that hasn't been blessed by Mozilla. I understand that they want to vet addons that are listed in their store, but they've assured me that users can't even install off our website unless Mozilla signs off. That seems very un-Mozilla-ish to me. What happened to the open web? For the record, I used to love Mozilla/Firefox, and have used their browsers for decades. I now use Brave, both because of experiences like this one, and because it's much faster on my Mac.
  - the8472 7y ago
    > The (alleged?) policy makes no sense to me The most charitable explanation I can come up with is that they want to avoid confusion attacks on their reviewers. But then again they already have a list of hashes for trusted libs, so clearly they could just diff the modified library against the canonical version when a hash doesn't match. > but they've assured me that users can't even install off our website unless Mozilla signs off. That seems very un-Mozilla-ish to me. What happened to the open web? I have clashed with their addons staff over similar issues. Their argument is basically security absolutism, motivated by (some) users easily being tricked. Any inch of rope you give the user they will use to hang themselves. So any security-related decisions they make are based on this dumbest possible user. Additionally they consider it a reputational issue, if an extension screws up firefox then firefox is blamed, or so they say. Firefox stable basically means nannying. If you want more control you're supposed to use developer edition or (on linux) the distribution builds. They don't say it quite that directly, but that's what their answers boil down to.
bagacrap 7y ago
isn't this generally true of every extension/app/smart appliance? Everything wants to collect and sling your data on the side. Browser and phone vendors do try to protect users with permissions controls in addition to the store curation that you point out is imperfectly executed. How do you propose they enact a perfect system of vetting for the long tail of benign extensions?
- dessant 7y ago
  Equally enforcing policies regardless of who's the publisher of an extension would be a good start. This is how the Avast blocklisting request should have been handled: - Immediately blocklist [1] the extension because it harvests personal data without user consent, notify Avast - Offer to reenable the extension for the existing user base when Avast reaches out and stops data collection in an extension update Because the extension was not blocklisted, but temporarily removed from the store, personal data was siphoned off without the consent of existing users for weeks, with the knowledge and implicit approval of Mozilla, until Avast has released an update. Users that have configured Firefox to update extensions manually may continue to use an extension version which steals personal data, despite Mozilla being capable of disabling those extension instances, and despite their recent commitment [2] to use blocklisting more proactively when an extension is circumventing user consent or control. Mozilla did not respect its own policies and has put the interests of Avast before the privacy and safety of its users. [1] https://blocked.cdn.mozilla.net https://blocked.cdn.mozilla.net [2] https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and-process-updates/ https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and...
  - rentnorove 7y ago
    It seems they did originally block them before reverting that decision: https://www.ghacks.net/2019/12/03/mozilla-removes-all-avast-firefox-extensions/ https://www.ghacks.net/2019/12/03/mozilla-removes-all-avast-... Would be interested to hear their justification.
    - dessant 7y ago
MrGilbert 7y ago
Same. We have a desktop application with ca. 14.000 installs, which requires a companion extension either for Firefox or Chrome. It has been taken down occasionally, mostly months after the last version got released. What annoys me most is that this happens out of the blue. There is no „pre-warning“. The last times this happened, we told our customers to use Chrome instead. Never had a problem with them.
- gnud 7y ago
  Now, this really scares me. Not because it's a false positive. Those are bound to happen. But if the takedown really happens months after the last update, then that would mean malicious add-ons are left on AMO for months?

horsawlarway 7y ago

I want to second this sentiment and EXPLICITLY call out Mozilla. I am the lead dev for a relatively small Firefox extension. We do not do ANY tracking. We were rejected and removed for simply including the sdk for Microsoft outlook addins as a script in one of our html pages (we share the codebase for an outlook addon as well). This script is well documented and published by Microsoft. I find the hypocrisy here staggering. I know that Firefox gets a lot of love, particularly on HN because it feels like Mozilla is still a trustworthy company. I want to clearly express that I no longer believe this. They want addons in the store that they can use for marketing and sales. Period.

minewastaken 7y ago
https://digdeeper.neocities.org/ghost/mozilla.html https://digdeeper.neocities.org/ghost/mozilla.html This article, along with some other sites and my own digging made me leave Firefox for good. It's a good read if you value privacy and think Mozilla is the good guy in a field dominated by evil corporations. At first it might seem biased, but the author makes very good points and backs them up with tons of sources that can't be really argued - most of the article is reviewing privacy policies and terms of service agreements that are available publicly to check. For now I stuck with Pale Moon, but I'm considering some other browsers like Ungoogled Chromium for my daily private and work use. Pale Moon feels kinda janky and old-school in a not good way. But it's fast and (with some minor tweaking: https://spyware.neocities.org/guides/palemoon.html https://spyware.neocities.org/guides/palemoon.html) respects your privacy 100%.
- vkou 7y ago
  I've read through the first bit of it, and the author comes off as a huge pedant. They spend most of the introduction ranting about browser features being removed in updates - because their expectation seems to be that once Mozilla ships a feature, it must forevermore be a part of the latest version of the browser, from now, until the heat death of the universe... Disclaimer: I don't actually use Firefox, I don't have a hobby horse in this race.
- aasasd 7y ago
  Funny how the design of that article borders on typical insane unreadable looks of conspiracy theory sites.
gnicholas 7y ago
Thanks for posting this. I have had similarly odd experiences recently with the Firefox addon store, which my startup has been in since 2013. All of a sudden we got yanked, among other things because we modify third party libraries. Apparently we would have been fine if we did exactly the same thing but wrote the code ourselves, but since we used a library, and then modified it, we were in violation. To be clear, we provide all our source code in the review process, so it is 100% clear what we are doing. And we don't do anything that is remotely privacy- or security-compromising, which is very clear from the code. We tried to understand this bizarre no-modifying-third-party-libraries policy and see how we could fix it, but they stopped responding and eventually even deleted our extension from the browsers where our users had previously installed it. (Even Apple doesn't do this when it yanks apps — only rarely if there is proven bad behavior will the pull an already-installed/paid-for app from a device.) I happen to know a couple very high-up people at Mozilla, and one of them was able to flag our mistreatment, and the reviewers now seem to be walking back the previously-described global ban on modifying third-party libraries, but we're still not back in the addon store (it's been months). The (alleged?) policy makes no sense to me, and I also don't understand why Mozilla is now blocking users from installing any addon that hasn't been blessed by Mozilla. I understand that they want to vet addons that are listed in their store, but they've assured me that users can't even install off our website unless Mozilla signs off. That seems very un-Mozilla-ish to me. What happened to the open web? For the record, I used to love Mozilla/Firefox, and have used their browsers for decades. I now use Brave, both because of experiences like this one, and because it's much faster on my Mac.
- the8472 7y ago
  > The (alleged?) policy makes no sense to me The most charitable explanation I can come up with is that they want to avoid confusion attacks on their reviewers. But then again they already have a list of hashes for trusted libs, so clearly they could just diff the modified library against the canonical version when a hash doesn't match. > but they've assured me that users can't even install off our website unless Mozilla signs off. That seems very un-Mozilla-ish to me. What happened to the open web? I have clashed with their addons staff over similar issues. Their argument is basically security absolutism, motivated by (some) users easily being tricked. Any inch of rope you give the user they will use to hang themselves. So any security-related decisions they make are based on this dumbest possible user. Additionally they consider it a reputational issue, if an extension screws up firefox then firefox is blamed, or so they say. Firefox stable basically means nannying. If you want more control you're supposed to use developer edition or (on linux) the distribution builds. They don't say it quite that directly, but that's what their answers boil down to.

bagacrap 7y ago

isn't this generally true of every extension/app/smart appliance? Everything wants to collect and sling your data on the side. Browser and phone vendors do try to protect users with permissions controls in addition to the store curation that you point out is imperfectly executed. How do you propose they enact a perfect system of vetting for the long tail of benign extensions?

dessant 7y ago
Equally enforcing policies regardless of who's the publisher of an extension would be a good start. This is how the Avast blocklisting request should have been handled: - Immediately blocklist [1] the extension because it harvests personal data without user consent, notify Avast - Offer to reenable the extension for the existing user base when Avast reaches out and stops data collection in an extension update Because the extension was not blocklisted, but temporarily removed from the store, personal data was siphoned off without the consent of existing users for weeks, with the knowledge and implicit approval of Mozilla, until Avast has released an update. Users that have configured Firefox to update extensions manually may continue to use an extension version which steals personal data, despite Mozilla being capable of disabling those extension instances, and despite their recent commitment [2] to use blocklisting more proactively when an extension is circumventing user consent or control. Mozilla did not respect its own policies and has put the interests of Avast before the privacy and safety of its users. [1] https://blocked.cdn.mozilla.net https://blocked.cdn.mozilla.net [2] https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and-process-updates/ https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and...
- rentnorove 7y ago
  It seems they did originally block them before reverting that decision: https://www.ghacks.net/2019/12/03/mozilla-removes-all-avast-firefox-extensions/ https://www.ghacks.net/2019/12/03/mozilla-removes-all-avast-... Would be interested to hear their justification.
  - dessant 7y ago

MrGilbert 7y ago

Same. We have a desktop application with ca. 14.000 installs, which requires a companion extension either for Firefox or Chrome. It has been taken down occasionally, mostly months after the last version got released. What annoys me most is that this happens out of the blue. There is no „pre-warning“. The last times this happened, we told our customers to use Chrome instead. Never had a problem with them.

gnud 7y ago
Now, this really scares me. Not because it's a false positive. Those are bound to happen. But if the takedown really happens months after the last update, then that would mean malicious add-ons are left on AMO for months?