4 ms·
> As long as the user in question is informed and alerted to the potential security risks shouldn't it be within the user's purview to decide what to allow and
by jolux 5y ago
> As long as the user in question is informed and alerted to the potential security risks shouldn't it be within the user's purview to decide what to allow and what not?
In a purely ethical sense, absolutely yes. But we're coming up on 30 years of people using the internet, and it's been clear for a while now that you simply cannot teach people what is safe and what is not in an absolute sense. Even highly technical, experienced users still make mistakes and install malware sometimes. Informing users is not effective, to a first approximation. System designers have a responsibility to protect the users of their systems.
> If a user decides to downright download malware we let them (Given, Chrome would block it but you can override that manually) why wouldn't the user be allowed to override these risks (i.e. you can enable it only in development mode etc. with a requirement that such extensions provide sufficient warnings etc.)
These overrides should exist, but making them too easy will just lead to malware tricking people into triggering them. And some doors are so frequently abused or fundamentally vulnerable that they probably should be closed entirely — most people don't think we should still be embedding Java and Flash in webpages these days.
- ROARosen 5y agoThe problem with closing the API is that for even the most advanced users, it will now be impossible to get the (very useful) functionality these extensions provide.
- deleted 5y ago[deleted]
- jolux 5y agoI believe it was tptacek who once commented half-jokingly that the ideal thing to do would be to leave the API open to uBlock Origin exclusively and kill it for everything else. The privileges required by that extension and others like it are indeed very powerful and often abused. This is not a problem with an easy solution, your suggestions are essentially the status quo and the industry is beginning to move on from it.
- pmontra 5y agoMozilla went that way on Android when they broke all extensions about one year ago except a few blessed ones.
- shock 5y agoThere is now a way to enable any extension in Firefox Nightly.
- deleted 5y ago[deleted]
- skybrian 5y agoHmmm. I’m not implying anything here, but I’m wondering how we know we can trust uBlock Origin. How is its security vetted?
- ROARosen 5y agoHmmm. You're invited to vet it yourself here: https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
- skybrian 5y agoThis doesn't help if it gets sold to someone else, as many extensions have.
- jolux 5y agoIt’s open-source, and the author has a long history of supporting his product for free as an ethical good, even while some of his collaborators have went commercial and cashed out, once even taking the project name.
- the8472 5y agoThe issue with that approach is that the next addon developer who comes up with something as useful as uBlock will not be able to develop that. Legacy carveouts protect past innovations but not future ones.