3 ms·

Would also be bad for all extensions Mozilla does not allow in their extension store. All software stores can be pressured to remove content. Keeping the abili

by fwn 6y ago

Would also be bad for all extensions Mozilla does not allow in their extension store. All software stores can be pressured to remove content. Keeping the ability to load non-store extensions fixes that specific deplatfoming problem.

realharo 6y ago
The basic assumption is that users are dumb when it comes to security, and if there is a way to install malware, they will be tricked into installing malware (even with no vulnerabilities in the host software itself). Especially since there is such a thing as warning screen fatigue, which makes people not pay attention and just click through due to the sheer amount of benign(ish) warning screens they regularly deal with (https://en.wikipedia.org/wiki/Alarm_fatigue https://en.wikipedia.org/wiki/Alarm_fatigue). Making them explicitly type out "YES I AM AWARE THIS EXTENSION COULD EASILY CONTAIN MALICIOUS CODE AND I TRUST THE SOURCE: " + the domain name, in all caps before proceeding could be enough to catch most cases (unless too much legit software gets forced behind such warnings, where it would lead to that fatigue problem again). Desktop Chrome doesn't let you have an outside extension without showing a warning on every single startup (even if it's an extension you are currently developing), but that could be because on a desktop OS, other applications could add such extension into Chrome without a user action. On mobile, where apps are isolated from one another, that problem doesn't exist, so maybe such strict restrictions shouldn't be necessary.
- fwn 6y ago
  I don't think any of this is necessary. I know we often say "the user is dumb, therefore software should patronize them", but that really only goes so far. On hindsight it looks like a balancing act where single features are evaluated for their danger, etc. Then, at some point, there's no software left that allows users to achieve their goals, because "you wouldn't want to do that", "stupid people could accidentally use it", "your use case is too fringe to justify catering to it anymore", etc. We're pretty much at this point now regarding browsers on Android, where there's only Chrome and it's skins (that let you do nothing) and Firefox. I can't believe the sensible thing to do would be to cut uncurated, non-store extensions from Firefox as well. It would be a huge loss for the whole ecosystem just to make a few Firefox installs (from an already small install base) a tiny bit less compromisable.
  - realharo 6y ago
    >I know we often say "the user is dumb, therefore software should patronize them", but that really only goes so far. It's not just a saying, it's supported by real-world situations that actually happened, and that you can be pretty sure will happen again. That's the context for the decisions that platform owners have to make. E.g. not too long ago, Dark Reader users received this notice https://darkreader.org/blog/attention/ https://darkreader.org/blog/attention/ about malware clones of the real extension that apparently thousands of people had installed (from the stores). It is events like this that influence these decisions. >Then, at some point, there's no software left that allows users to achieve their goals, because "you wouldn't want to do that", "stupid people could accidentally use it", "your use case is too fringe to justify catering to it anymore", etc. That's basically the Apple mindset. It's a well known fact (e.g. his biography) that Steve Jobs didn't even want any third party apps (other than super limited web-"apps") on iOS initially, and had to be convinced otherwise.
    - fwn 6y ago
      But I didn't argue that they shouldn't do it because we don't know whether people will compromise themselves. I argued they shouldn't do it despite knowing that people will have the ability to compromise themselves.
      - deleted 6y ago
        [deleted]
      - realharo 6y ago
        Well, their goals are clearly different. From the FAQ linked above, it is clear they want to have some control over "the experience", which is mentioned a lot. If too many users install a crappy, buggy extension that slows everything down, they know they will get a reputation for being a buggy and slow browser, regardless of whether it's their fault or not. It also creates incentives for extension authors to follow best practices where possible. For people who really care about choices for themselves, it's an open source project, it's not that hard to make an unrestricted fork under a different name that automatically tracks the upstream (as long as Android sideloading stays intact, plus it could also be published in Play Store as long as you don't use any of their trademarks). As far as I know there is nothing unique in the official branch that you would miss out on (when compared to e.g. missing out on Netflix or voiding warranty with custom ROMs - there are no such tradeoffs with simply using a fork of a browser). It only creates a much higher barrier to adoption for unapproved extensions (because you now have to convince users to install another browser), so many developers simply won't bother, but that's not an issue if I understand your argument correctly.

by fwn 6y ago

realharo 6y ago

The basic assumption is that users are dumb when it comes to security, and if there is a way to install malware, they will be tricked into installing malware (even with no vulnerabilities in the host software itself). Especially since there is such a thing as warning screen fatigue, which makes people not pay attention and just click through due to the sheer amount of benign(ish) warning screens they regularly deal with (https://en.wikipedia.org/wiki/Alarm_fatigue https://en.wikipedia.org/wiki/Alarm_fatigue). Making them explicitly type out "YES I AM AWARE THIS EXTENSION COULD EASILY CONTAIN MALICIOUS CODE AND I TRUST THE SOURCE: " + the domain name, in all caps before proceeding could be enough to catch most cases (unless too much legit software gets forced behind such warnings, where it would lead to that fatigue problem again). Desktop Chrome doesn't let you have an outside extension without showing a warning on every single startup (even if it's an extension you are currently developing), but that could be because on a desktop OS, other applications could add such extension into Chrome without a user action. On mobile, where apps are isolated from one another, that problem doesn't exist, so maybe such strict restrictions shouldn't be necessary.

fwn 6y ago
I don't think any of this is necessary. I know we often say "the user is dumb, therefore software should patronize them", but that really only goes so far. On hindsight it looks like a balancing act where single features are evaluated for their danger, etc. Then, at some point, there's no software left that allows users to achieve their goals, because "you wouldn't want to do that", "stupid people could accidentally use it", "your use case is too fringe to justify catering to it anymore", etc. We're pretty much at this point now regarding browsers on Android, where there's only Chrome and it's skins (that let you do nothing) and Firefox. I can't believe the sensible thing to do would be to cut uncurated, non-store extensions from Firefox as well. It would be a huge loss for the whole ecosystem just to make a few Firefox installs (from an already small install base) a tiny bit less compromisable.
- realharo 6y ago
  >I know we often say "the user is dumb, therefore software should patronize them", but that really only goes so far. It's not just a saying, it's supported by real-world situations that actually happened, and that you can be pretty sure will happen again. That's the context for the decisions that platform owners have to make. E.g. not too long ago, Dark Reader users received this notice https://darkreader.org/blog/attention/ https://darkreader.org/blog/attention/ about malware clones of the real extension that apparently thousands of people had installed (from the stores). It is events like this that influence these decisions. >Then, at some point, there's no software left that allows users to achieve their goals, because "you wouldn't want to do that", "stupid people could accidentally use it", "your use case is too fringe to justify catering to it anymore", etc. That's basically the Apple mindset. It's a well known fact (e.g. his biography) that Steve Jobs didn't even want any third party apps (other than super limited web-"apps") on iOS initially, and had to be convinced otherwise.
  - fwn 6y ago
    But I didn't argue that they shouldn't do it because we don't know whether people will compromise themselves. I argued they shouldn't do it despite knowing that people will have the ability to compromise themselves.
    - deleted 6y ago
      [deleted]
    - realharo 6y ago
      Well, their goals are clearly different. From the FAQ linked above, it is clear they want to have some control over "the experience", which is mentioned a lot. If too many users install a crappy, buggy extension that slows everything down, they know they will get a reputation for being a buggy and slow browser, regardless of whether it's their fault or not. It also creates incentives for extension authors to follow best practices where possible. For people who really care about choices for themselves, it's an open source project, it's not that hard to make an unrestricted fork under a different name that automatically tracks the upstream (as long as Android sideloading stays intact, plus it could also be published in Play Store as long as you don't use any of their trademarks). As far as I know there is nothing unique in the official branch that you would miss out on (when compared to e.g. missing out on Netflix or voiding warranty with custom ROMs - there are no such tradeoffs with simply using a fork of a browser). It only creates a much higher barrier to adoption for unapproved extensions (because you now have to convince users to install another browser), so many developers simply won't bother, but that's not an issue if I understand your argument correctly.