3 ms·

isn't this generally true of every extension/app/smart appliance? Everything wants to collect and sling your data on the side. Browser and phone vendors do try

isn't this generally true of every extension/app/smart appliance? Everything wants to collect and sling your data on the side. Browser and phone vendors do try to protect users with permissions controls in addition to the store curation that you point out is imperfectly executed. How do you propose they enact a perfect system of vetting for the long tail of benign extensions?

dessant 7y ago
Equally enforcing policies regardless of who's the publisher of an extension would be a good start. This is how the Avast blocklisting request should have been handled: - Immediately blocklist [1] the extension because it harvests personal data without user consent, notify Avast - Offer to reenable the extension for the existing user base when Avast reaches out and stops data collection in an extension update Because the extension was not blocklisted, but temporarily removed from the store, personal data was siphoned off without the consent of existing users for weeks, with the knowledge and implicit approval of Mozilla, until Avast has released an update. Users that have configured Firefox to update extensions manually may continue to use an extension version which steals personal data, despite Mozilla being capable of disabling those extension instances, and despite their recent commitment [2] to use blocklisting more proactively when an extension is circumventing user consent or control. Mozilla did not respect its own policies and has put the interests of Avast before the privacy and safety of its users. [1] https://blocked.cdn.mozilla.net https://blocked.cdn.mozilla.net [2] https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and-process-updates/ https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and...
- rentnorove 7y ago
  It seems they did originally block them before reverting that decision: https://www.ghacks.net/2019/12/03/mozilla-removes-all-avast-firefox-extensions/ https://www.ghacks.net/2019/12/03/mozilla-removes-all-avast-... Would be interested to hear their justification.
  - dessant 7y ago
    The extensions were temporarily removed from AMO, but blocklisting was not enacted, so around 1 million existing installations have remained operational while Mozilla was waiting for weeks for Avast to submit an update. The initial update for one extension was also approved despite the extension not respecting a declined consent and resuming data collection after browser restart [1]. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1600600 https://bugzilla.mozilla.org/show_bug.cgi?id=1600600
monadic2 7y ago
Well they could start by banning extensions that make the news for sending all of their visited urls to a third party. Ultimately we need to give the user more control over what software on their system is doing. None of these entities (mozilla, google, apple, microsoft, amazon, facebook) can be trusted to act in our best interest

dessant 7y ago

Equally enforcing policies regardless of who's the publisher of an extension would be a good start. This is how the Avast blocklisting request should have been handled: - Immediately blocklist [1] the extension because it harvests personal data without user consent, notify Avast - Offer to reenable the extension for the existing user base when Avast reaches out and stops data collection in an extension update Because the extension was not blocklisted, but temporarily removed from the store, personal data was siphoned off without the consent of existing users for weeks, with the knowledge and implicit approval of Mozilla, until Avast has released an update. Users that have configured Firefox to update extensions manually may continue to use an extension version which steals personal data, despite Mozilla being capable of disabling those extension instances, and despite their recent commitment [2] to use blocklisting more proactively when an extension is circumventing user consent or control. Mozilla did not respect its own policies and has put the interests of Avast before the privacy and safety of its users. [1] https://blocked.cdn.mozilla.net https://blocked.cdn.mozilla.net [2] https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and-process-updates/ https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and...

rentnorove 7y ago
It seems they did originally block them before reverting that decision: https://www.ghacks.net/2019/12/03/mozilla-removes-all-avast-firefox-extensions/ https://www.ghacks.net/2019/12/03/mozilla-removes-all-avast-... Would be interested to hear their justification.
- dessant 7y ago
  The extensions were temporarily removed from AMO, but blocklisting was not enacted, so around 1 million existing installations have remained operational while Mozilla was waiting for weeks for Avast to submit an update. The initial update for one extension was also approved despite the extension not respecting a declined consent and resuming data collection after browser restart [1]. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1600600 https://bugzilla.mozilla.org/show_bug.cgi?id=1600600

monadic2 7y ago

Well they could start by banning extensions that make the news for sending all of their visited urls to a third party. Ultimately we need to give the user more control over what software on their system is doing. None of these entities (mozilla, google, apple, microsoft, amazon, facebook) can be trusted to act in our best interest