9 ms·

A big thing for me is that Tampermonkey is not open source. And yes, Firefox on Android has an allowlist of "known working good" extensions, the reason given b

by jraph 4y ago

A big thing for me is that Tampermonkey is not open source. And yes, Firefox on Android has an allowlist of "known working good" extensions, the reason given being that Firefox for Android doesn't implement everything the Desktop version implements and IIUC, want to a avoid users blaming the browser when something breaks because of it.

saghm 4y ago
> A big thing for me is that Tampermonkey is not open source. How does that even work? I assumed that Firefox extensions were implemented in frontend web technologies (JavaScript, CSS, etc.)? Do they use WebAssembly or something, or is it just obfuscated to the point that trying to read it isn't worthwhile?
- charles_f 4y ago
  The latter afaik, but also since they have analytics there's a backend bit you can't see
- 2Gkashmiri 4y ago
  being in cleartext does not mean the code itself is "open source" or proprietary. the license defines that,
- pmontra 4y ago
  Check the EULA at https://www.tampermonkey.net/eula.php https://www.tampermonkey.net/eula.php Excerpt from point 4 > 4. NON-ALLOWABLE USES OF TAMPERMONKEY > You are strictly prohibited from, and agree that you will not, adapt, edit, change, modify, transform, publish, republish, distribute, or redistribute Tampermonkey or any elements, portions, or parts thereof, including without limitation, to any elements, portions, or parts of Tampermonkey software (in any form or media) without the Company’s prior written consent. [...]
  - 2Gkashmiri 4y ago
    https://github.com/Tampermonkey/tampermonkey/blob/master/COPYING https://github.com/Tampermonkey/tampermonkey/blob/master/COP... this says GPL so unless they update their license file here, this stays
    - L3viathan 4y ago
      > This repository contains the source of the Tampermonkey extension up to version 2.9. All newer versions are distributed under a proprietary license. You can of course do whatever GPL allows you to the code in the repository (so up to version 2.9).
      - crashmat 4y ago
        so the newer version isn't even at all based on the one before 2.9? seems unlikely
        tsbinz 4y ago
        If you own the rights to software, you previously releasing something under the GPL does not mean you have to make derived versions of the thing you released under the GPL available under the GPL too. If you take someone else's code under the terms of the GPL you have to do that, but that does not seem to have happened here.
        dTal 4y ago
        That assumes that nobody contributed to the software while it was GPL, unless there was an explicit contractual copyright transfer.
        account42 4y ago
        It only assumes that there were no copyrightable contributions that weren't replaced as before the license change. Not all code changes meet the criteria for copyright.
- can_center_divs 4y ago
  Website's source code is not open source, even though you can inspect it. If you have a public repository with your code on GitHub, everyone can see the code. But they do not have the right to use the same code in a commercial manner, without you specifying a license for your code, that says they can.
  - tech2 4y ago
    CoPilot sticks its fingers in its ears, scrunches its eyes closed, and shouts "Not Listening!" repeatedly...
LightHugger 4y ago
Ah yes, an addon whitelist. How very community friendly of Mozilla... And they wonder why their market share plummets the way it does, making such extremely user hostile decisions like that.
- Synaesthesia 4y ago
  Playing devil's advocate here, don't they need to protect their users from nefarious add ons that could steal data?
  - Jach 4y ago
    Going down the path to eventually having no users is an interesting way to accomplish that. But really, no, they don't. Put up enough disclaimers (this is the secret to compromising with security teams on usability) and let me do what I want at my own risk.
  - peoplefromibiza 4y ago
    my data is on my computer which has also access to my phone because they are connected
  - krono 4y ago
    Doesn't seem very high up their list of priorities, seeing as how their desktop extensions - including the "Recommended" ones - are allowed to break all the rules. A surprising amount of them comes with unlisted and uncontrollable connections to snooping services like Google Analytics or Sentry, I've seen unexpected redirects / tab hijacks - mostly to advertise the developer's new other extension, even fetching and executing external scripts and other resources from various CDNs is not uncommon... essentially everything their extension policies disallow. All these violations are hardcoded into the extensions' source and rather easily scanned for automatically mind you, it almost takes more effort to not notice them. I've stopped reporting the ones I encountered, they were never taken down, never lost their recommended badge, and all the violations remained in every next version that I checked.
    - 4y ago
deleted 4y ago
[deleted]
xPaw 4y ago
It really is bizzare, old Firefox used to support all addons, then they shipped a new version and only allowed like 10 addons, and to this day they don't allow any more. It's already been years. I know my addon works fine on mobile, but they provide no means of specifying that*. I tried to email them for it to become "recommended" but never heard back. The fact that they allow tampermonkey which allows any kind of script just adds insult to the injury. * when uploading a new version, it does ask to specify which Firefox desktop/android versions are supported, but this existed before the new Firefox and doesn't do anything.
- MasterYoda 4y ago
  As far as I know you can install any addons you want, you just have to create your own collection. Those default addons you see are only Mozillas standard collection. Even do I would like there were more addons to choose from as default I can understand Mozillas choice here. And that is that most addons are not design for android and they would not work or give a very bad UX. So for many non tech savvy standard users, that just would be frustrated and blame Firefox, this decision can make sense to select god and popular addons they know works well. But it would be great if more addons could be added ofcourse, and that Mozilla could have some design guidelines for new addons that they should work for both desktop and mobile (where it make sense). And mark in the addon store which addons that are design for both. Or maybe have a simple setting in Firefox for android that is for advanced users, there they could add any addon, but first they have to check a box that they understand that the addon may not work correctly on a smartphone.
  - ashwagary 4y ago
    >As far as I know you can install any addons you want, you just have to create your own collection. I'm also very interested in bypassing the mobile limitation. Does creating a custom collection require an account? Ive never seen the option and have tried everything to back to 2019-2020 Firefox plugin capabilities. Update: For anyone in the same position, I just saw this solution in another comment. Its unfortunate that such basic functionality requires a whole user account. >For reference, to work around mozilla's artificial restrictions, you have to use nightly. Once you activate the debug menu (about firefox > tap logo 5 times) there's the option to set a "custom add-on collection". You can make a custom collection on addons.mozilla.org using a firefox account. The two fields are the last two parts of the URL on your custom collection.
ecef9-8c0f-4374 4y ago
I know for sure I could enforce the use of my desktop addons by installing them manually. They were missing dialogs boxen and touch problems, but for the most part they worked and I was OK with the problems. Of course we can't have nice things and not even bad things. Personal freedom is overrated after all. At some point Mozilla invested time and money to take my freedom. This reminds me of the time of XPI and XUL, when I used to hack my own Addons together. Then they enforced addon-signing. Until this point you could disable it and switch to "developer mode". I hate Mozilla and guess they hate me.

by jraph 4y ago

saghm 4y ago

> A big thing for me is that Tampermonkey is not open source. How does that even work? I assumed that Firefox extensions were implemented in frontend web technologies (JavaScript, CSS, etc.)? Do they use WebAssembly or something, or is it just obfuscated to the point that trying to read it isn't worthwhile?

charles_f 4y ago
The latter afaik, but also since they have analytics there's a backend bit you can't see
2Gkashmiri 4y ago
being in cleartext does not mean the code itself is "open source" or proprietary. the license defines that,
pmontra 4y ago
Check the EULA at https://www.tampermonkey.net/eula.php https://www.tampermonkey.net/eula.php Excerpt from point 4 > 4. NON-ALLOWABLE USES OF TAMPERMONKEY > You are strictly prohibited from, and agree that you will not, adapt, edit, change, modify, transform, publish, republish, distribute, or redistribute Tampermonkey or any elements, portions, or parts thereof, including without limitation, to any elements, portions, or parts of Tampermonkey software (in any form or media) without the Company’s prior written consent. [...]
- 2Gkashmiri 4y ago
  https://github.com/Tampermonkey/tampermonkey/blob/master/COPYING https://github.com/Tampermonkey/tampermonkey/blob/master/COP... this says GPL so unless they update their license file here, this stays
  - L3viathan 4y ago
    > This repository contains the source of the Tampermonkey extension up to version 2.9. All newer versions are distributed under a proprietary license. You can of course do whatever GPL allows you to the code in the repository (so up to version 2.9).
    - crashmat 4y ago
      so the newer version isn't even at all based on the one before 2.9? seems unlikely
      - tsbinz 4y ago
        If you own the rights to software, you previously releasing something under the GPL does not mean you have to make derived versions of the thing you released under the GPL available under the GPL too. If you take someone else's code under the terms of the GPL you have to do that, but that does not seem to have happened here.
        dTal 4y ago
        That assumes that nobody contributed to the software while it was GPL, unless there was an explicit contractual copyright transfer.
        account42 4y ago
        It only assumes that there were no copyrightable contributions that weren't replaced as before the license change. Not all code changes meet the criteria for copyright.
can_center_divs 4y ago
Website's source code is not open source, even though you can inspect it. If you have a public repository with your code on GitHub, everyone can see the code. But they do not have the right to use the same code in a commercial manner, without you specifying a license for your code, that says they can.
- tech2 4y ago
  CoPilot sticks its fingers in its ears, scrunches its eyes closed, and shouts "Not Listening!" repeatedly...

LightHugger 4y ago

Ah yes, an addon whitelist. How very community friendly of Mozilla... And they wonder why their market share plummets the way it does, making such extremely user hostile decisions like that.

Synaesthesia 4y ago
Playing devil's advocate here, don't they need to protect their users from nefarious add ons that could steal data?
- Jach 4y ago
  Going down the path to eventually having no users is an interesting way to accomplish that. But really, no, they don't. Put up enough disclaimers (this is the secret to compromising with security teams on usability) and let me do what I want at my own risk.
- peoplefromibiza 4y ago
  my data is on my computer which has also access to my phone because they are connected
- krono 4y ago
  Doesn't seem very high up their list of priorities, seeing as how their desktop extensions - including the "Recommended" ones - are allowed to break all the rules. A surprising amount of them comes with unlisted and uncontrollable connections to snooping services like Google Analytics or Sentry, I've seen unexpected redirects / tab hijacks - mostly to advertise the developer's new other extension, even fetching and executing external scripts and other resources from various CDNs is not uncommon... essentially everything their extension policies disallow. All these violations are hardcoded into the extensions' source and rather easily scanned for automatically mind you, it almost takes more effort to not notice them. I've stopped reporting the ones I encountered, they were never taken down, never lost their recommended badge, and all the violations remained in every next version that I checked.
  - 4y ago

deleted 4y ago

[deleted]

xPaw 4y ago

It really is bizzare, old Firefox used to support all addons, then they shipped a new version and only allowed like 10 addons, and to this day they don't allow any more. It's already been years. I know my addon works fine on mobile, but they provide no means of specifying that*. I tried to email them for it to become "recommended" but never heard back. The fact that they allow tampermonkey which allows any kind of script just adds insult to the injury. * when uploading a new version, it does ask to specify which Firefox desktop/android versions are supported, but this existed before the new Firefox and doesn't do anything.

MasterYoda 4y ago
As far as I know you can install any addons you want, you just have to create your own collection. Those default addons you see are only Mozillas standard collection. Even do I would like there were more addons to choose from as default I can understand Mozillas choice here. And that is that most addons are not design for android and they would not work or give a very bad UX. So for many non tech savvy standard users, that just would be frustrated and blame Firefox, this decision can make sense to select god and popular addons they know works well. But it would be great if more addons could be added ofcourse, and that Mozilla could have some design guidelines for new addons that they should work for both desktop and mobile (where it make sense). And mark in the addon store which addons that are design for both. Or maybe have a simple setting in Firefox for android that is for advanced users, there they could add any addon, but first they have to check a box that they understand that the addon may not work correctly on a smartphone.
- ashwagary 4y ago
  >As far as I know you can install any addons you want, you just have to create your own collection. I'm also very interested in bypassing the mobile limitation. Does creating a custom collection require an account? Ive never seen the option and have tried everything to back to 2019-2020 Firefox plugin capabilities. Update: For anyone in the same position, I just saw this solution in another comment. Its unfortunate that such basic functionality requires a whole user account. >For reference, to work around mozilla's artificial restrictions, you have to use nightly. Once you activate the debug menu (about firefox > tap logo 5 times) there's the option to set a "custom add-on collection". You can make a custom collection on addons.mozilla.org using a firefox account. The two fields are the last two parts of the URL on your custom collection.

ecef9-8c0f-4374 4y ago

I know for sure I could enforce the use of my desktop addons by installing them manually. They were missing dialogs boxen and touch problems, but for the most part they worked and I was OK with the problems. Of course we can't have nice things and not even bad things. Personal freedom is overrated after all. At some point Mozilla invested time and money to take my freedom. This reminds me of the time of XPI and XUL, when I used to hack my own Addons together. Then they enforced addon-signing. Until this point you could disable it and switch to "developer mode". I hate Mozilla and guess they hate me.