6 ms·

These are strong words. Mozilla is miles ahead of chrome with recommended extensions [1]: > Recommended extensions undergo full code review by staff security

These are strong words. Mozilla is miles ahead of chrome with recommended extensions [1]: > Recommended extensions undergo full code review by staff security experts to provide a strong additional security check. It has a list of blocked addons [2]. And I believe that is Chrome who turned addons into Wild West, Mozilla had a long review process [3]. [1] https://blog.mozilla.org/firefox/firefox-recommended-extensions/ https://blog.mozilla.org/firefox/firefox-recommended-extensi... [2] https://blocked.cdn.mozilla.net/ https://blocked.cdn.mozilla.net/ [3] https://blog.mozilla.org/addons/2010/02/15/the-add-on-review-process-and-you/ https://blog.mozilla.org/addons/2010/02/15/the-add-on-review...

ThePhysicist 6y ago
It's still so easy in Firefox to install add-ons that spy on your entire browser session and send tons of telemetry data to a backend (Ghostery is a popular example) while the user has no clue that any kind of data transfer even happens. Such behavior shouldn't be something that can be turned on with two clicks.
- kekebo 6y ago
  Ghostery is even a recommended Addon on AMO [1]. What would really be practical were some kind of extension analyzer/profiler that runs newly installed addons in a sandbox and displays attempted connections and payloads. Or a mode where connections need to be whitelisted, to limit the impact of silent addon takeovers. Too many times I find myself having to download, unpack, and skim through an addon's source to make sure it's not doing anything malicious under the hood. [1] https://addons.mozilla.org/en-US/firefox/addon/ghostery/ https://addons.mozilla.org/en-US/firefox/addon/ghostery/
  - sergeykish 6y ago
    They state it in plain site. Sadly it is not advertised clearly. Yes, that would be good. I would love to hear that someone I trust checked latest version. If enough people joined we can make distribution. And, hey! It is MPL-2 [1], bad defaults can be patched. [1] https://github.com/ghostery/ghostery-extension https://github.com/ghostery/ghostery-extension
- sergeykish 6y ago
  Privacy Policy [1]: > Human Web > ... turned on by default > Data Collection: In order for Human Web to function we automatically collect non-private URLs, search queries along with search engine results pages, suspicious URLs that could potentially be phishing websites, information related to safe and unsafe trackers, and information related to the prevalence and performance of Trackers. So opt out data collection, I thought better of Recommend Extensions. They really should use leverage to make safe defaults and forbid dark patters. [1] https://addons.mozilla.org/en-US/firefox/addon/ghostery/privacy/ https://addons.mozilla.org/en-US/firefox/addon/ghostery/priv...
- godelski 6y ago
  >Ghostery is a popular example I'm a little confused. I used to use ghostery (don't anymore), but there was always an option to have them not collect data. This is even a recommended app! I went to their privacy policy to check > II. Basis to Collect and Use Personal Data There is no obligation on your part to provide your Personal Data. However, if you do, we have a legitimate interest to collect and use it, namely so we can provide products or services, or complete a transaction with you. > III. Notion of Personal Data Personal Data means any information concerning the personal or material circumstances of an identified or identifiable individual such as name and age. Non-personal data are all data that cannot be used to identify an individual, such as statistics about usage of a website.
criley2 6y ago
1. "Recommended" extensions are a subset of all extensions, so to narrow the comparison from "Extensions" to "A limited subset" feels dishonest. Not all Firefox extensions are Recommended. 2. Firefox took years and years to lock down extensions like Chrome, and people were legitimately upset that they turned extensions into basically privileged webpages in the name of security. They used to be more like software. It wasn't until what 2017 or 2018 that Firefox truly took security seriously and stopped letting extensions run application code. 3. Chrome didn't turn extensions into the 'wild west'! For the record, Firefox 3.0 had "Add-ons" in 2008 a few months before Google released Chrome 1.0!
- sergeykish 6y ago
  1. I just said it is good if at least subset can be trusted. It would be nice to have such feature in Chrome. 2. Sorry, could you please make your point clear (edit)? Firefox third party extensions used to access internal constructs. I think most of what is Firefox on top of Gecko is privileged extensions. 3. Yes, Firefox had addons with review process.
  - criley2 6y ago
    2. I'm talking about the switch to WebExtensions, https://wiki.mozilla.org/WebExtensions/FAQ https://wiki.mozilla.org/WebExtensions/FAQ, which every major browser followed Chrome in doing, which was largely done for security reasons 3. Firefox does not manually review every extension, they perform some cursory virus/malware scans, same as Google. I think you're really overplaying the idea that Firefox has some manual review process ensuring only quality and safe extensions are uploaded. The best way to demonstrate this is to point out that Firefox must frequently ban released extensions -- extensions which passed these so called reviews.
    - sergeykish 6y ago
      2. My understanding that nothing has changed much. Mozilla forbidden internals access to 3rd party developers, mostly driven to ease refactoring - completing the drop of non Firefox browsers started in 2008 [1]. Those who need (and were allowed) these API (like Developer tools) moved in tree. Others have to use new API which for compatibility reasons looks like Chrome. 3. Today looks like every browsers gallery dropped security. I was talking about days before Chrome and how things changed. I gave a link, there were just several blocked addons in 2008-2010. Something changed and I remember publishing process was different in Firefox and Chrome. Search gives me no complains about long review in 2010 for Chrome. I am not Mozilla funboy. I do not think that Mozilla actions is enough, Chrome had good things too - reviews without "I like it" and "Works for me". Everyone deploys automatic scan. Manual review is better than no manual review. How many extensions from Recommend list were blocked? We have to find a way to reduce pressure to buy/sell addon for use as spyware. Someone has to think twice before trying to buy Recommended addon. Or looking on a list of blocked addons. Or maybe someday "Collects data" badge. Today Mozilla is ahead, just copy and move on. [1] Mike Pinkerton on Mozilla and Camino https://www.youtube.com/watch?v=ttiZevbtvf0 https://www.youtube.com/watch?v=ttiZevbtvf0

ThePhysicist 6y ago

It's still so easy in Firefox to install add-ons that spy on your entire browser session and send tons of telemetry data to a backend (Ghostery is a popular example) while the user has no clue that any kind of data transfer even happens. Such behavior shouldn't be something that can be turned on with two clicks.

kekebo 6y ago
Ghostery is even a recommended Addon on AMO [1]. What would really be practical were some kind of extension analyzer/profiler that runs newly installed addons in a sandbox and displays attempted connections and payloads. Or a mode where connections need to be whitelisted, to limit the impact of silent addon takeovers. Too many times I find myself having to download, unpack, and skim through an addon's source to make sure it's not doing anything malicious under the hood. [1] https://addons.mozilla.org/en-US/firefox/addon/ghostery/ https://addons.mozilla.org/en-US/firefox/addon/ghostery/
- sergeykish 6y ago
  They state it in plain site. Sadly it is not advertised clearly. Yes, that would be good. I would love to hear that someone I trust checked latest version. If enough people joined we can make distribution. And, hey! It is MPL-2 [1], bad defaults can be patched. [1] https://github.com/ghostery/ghostery-extension https://github.com/ghostery/ghostery-extension
sergeykish 6y ago
Privacy Policy [1]: > Human Web > ... turned on by default > Data Collection: In order for Human Web to function we automatically collect non-private URLs, search queries along with search engine results pages, suspicious URLs that could potentially be phishing websites, information related to safe and unsafe trackers, and information related to the prevalence and performance of Trackers. So opt out data collection, I thought better of Recommend Extensions. They really should use leverage to make safe defaults and forbid dark patters. [1] https://addons.mozilla.org/en-US/firefox/addon/ghostery/privacy/ https://addons.mozilla.org/en-US/firefox/addon/ghostery/priv...
godelski 6y ago
>Ghostery is a popular example I'm a little confused. I used to use ghostery (don't anymore), but there was always an option to have them not collect data. This is even a recommended app! I went to their privacy policy to check > II. Basis to Collect and Use Personal Data There is no obligation on your part to provide your Personal Data. However, if you do, we have a legitimate interest to collect and use it, namely so we can provide products or services, or complete a transaction with you. > III. Notion of Personal Data Personal Data means any information concerning the personal or material circumstances of an identified or identifiable individual such as name and age. Non-personal data are all data that cannot be used to identify an individual, such as statistics about usage of a website.

criley2 6y ago

1. "Recommended" extensions are a subset of all extensions, so to narrow the comparison from "Extensions" to "A limited subset" feels dishonest. Not all Firefox extensions are Recommended. 2. Firefox took years and years to lock down extensions like Chrome, and people were legitimately upset that they turned extensions into basically privileged webpages in the name of security. They used to be more like software. It wasn't until what 2017 or 2018 that Firefox truly took security seriously and stopped letting extensions run application code. 3. Chrome didn't turn extensions into the 'wild west'! For the record, Firefox 3.0 had "Add-ons" in 2008 a few months before Google released Chrome 1.0!

sergeykish 6y ago
1. I just said it is good if at least subset can be trusted. It would be nice to have such feature in Chrome. 2. Sorry, could you please make your point clear (edit)? Firefox third party extensions used to access internal constructs. I think most of what is Firefox on top of Gecko is privileged extensions. 3. Yes, Firefox had addons with review process.
- criley2 6y ago
  2. I'm talking about the switch to WebExtensions, https://wiki.mozilla.org/WebExtensions/FAQ https://wiki.mozilla.org/WebExtensions/FAQ, which every major browser followed Chrome in doing, which was largely done for security reasons 3. Firefox does not manually review every extension, they perform some cursory virus/malware scans, same as Google. I think you're really overplaying the idea that Firefox has some manual review process ensuring only quality and safe extensions are uploaded. The best way to demonstrate this is to point out that Firefox must frequently ban released extensions -- extensions which passed these so called reviews.
  - sergeykish 6y ago
    2. My understanding that nothing has changed much. Mozilla forbidden internals access to 3rd party developers, mostly driven to ease refactoring - completing the drop of non Firefox browsers started in 2008 [1]. Those who need (and were allowed) these API (like Developer tools) moved in tree. Others have to use new API which for compatibility reasons looks like Chrome. 3. Today looks like every browsers gallery dropped security. I was talking about days before Chrome and how things changed. I gave a link, there were just several blocked addons in 2008-2010. Something changed and I remember publishing process was different in Firefox and Chrome. Search gives me no complains about long review in 2010 for Chrome. I am not Mozilla funboy. I do not think that Mozilla actions is enough, Chrome had good things too - reviews without "I like it" and "Works for me". Everyone deploys automatic scan. Manual review is better than no manual review. How many extensions from Recommend list were blocked? We have to find a way to reduce pressure to buy/sell addon for use as spyware. Someone has to think twice before trying to buy Recommended addon. Or looking on a list of blocked addons. Or maybe someday "Collects data" badge. Today Mozilla is ahead, just copy and move on. [1] Mike Pinkerton on Mozilla and Camino https://www.youtube.com/watch?v=ttiZevbtvf0 https://www.youtube.com/watch?v=ttiZevbtvf0