3 ms·

The current API is a security hole. But that's fine. "It's incumbent on end-users to know what they're installing" is a fine position for Mozilla to take.

dylan604 4y ago
I can't tell if you're being sincere or sarcastic. Allowing users to install whatever they want at their own risk is exactly what people complaining about walled gardens not allowing them to do. Attempting to protect people that don't know what they are doing from known security holes is what one of the things walled gardens claim as a feature. Which direction are taking it?
- Retric 4y ago
  That’s hardly the only option. Walled guardians that only protect against counterfeits or viruses is a perfectly useful feature even if they allow anyone on the platform.
  - DelightOne 4y ago
    Except that not being able to block all ads potentially containing viruses makes THAT walled garden unsafe by design.
    - Retric 4y ago
      In what way would the walled garden I described not be able to block adds?
      - DelightOne 4y ago
        When that walled garden relies on 3rd-party tools and does not give them enough power to do their job well.
        Retric 4y ago
        You are clearly assuming things that have nothing to do with what I described. The owner of a walled garden doesn’t need to depend on 3rd parties for anything they can build whatever tools they want in house.
        DelightOne 4y ago
        Right, I am talking about Chrome. You seem to be talking about something else.
        Retric 4y ago
        If you’re going to ignore what people say there’s little point in hitting that reply button.
- hgsgm 4y ago
  It's quite clear from the comment that 'shadowgovt supports Mozilla being a non-walled garden, which is the reason Firefox exists. No one needs a Chrome clone.
Miraste 4y ago
Being forced to see and potentially click on ads is a security hole. I trust uBlock and gorhill more than I trust Google.
- macNchz 4y ago
  This is what prompted me to start blocking ads many years ago…there’s simply too much malicious advertising out there and the corporations involved have the wrong incentives to deal with it properly. As long as ad networks allow arbitrary code to run, and content designed to trick users, I prefer to centralize on a single source of potential risk (the extension developer) rather than the moving target of malicious ads from myriad sources. A recent example readily avoided by not allowing the ad to run in the first place: https://www.securityweek.com/webkit-zero-day-vulnerability-exploited-malvertising-operation/ https://www.securityweek.com/webkit-zero-day-vulnerability-e...
- hgsgm 4y ago
  *"uBlock Origin" . "uBlock" stole the new from gorhill.
kuschku 4y ago
All chrome did was prevent extensions from blocking requests. They can still see all requests and do with them what they want, just read-only. How does that solve the security issue you mentioned?
- charcircuit 4y ago
  [flagged]
  - blibble 4y ago
    indeed, with Google being a well known champion of privacy
    - taneq 4y ago
      Google takes your privacy very seriously. Where ‘privacy’ is defined as ‘giving you control over who Google shared your data with’, of course.
      - charcircuit 4y ago
        [flagged]
        hgsgm 4y ago
        Except that Google exempts itself from those privacy controls, if you use a Google product. Users "understand" that Google records most everything they do on the web, for advertising purposes.
        charcircuit 4y ago
        >Except that Google exempts itself from those privacy controls, if you use a Google product. No it doesn't. Google takes privacy issues very seriously just like security issues. You can disable Google storing your web activity in your account's privacy settings here. https://myactivity.google.com/myactivity https://myactivity.google.com/myactivity
sebzim4500 4y ago
Am I missing something? It's my understanding that chromium based browsers also allow listening to requests same as before, they merely aren't allowed to block them anymore.
- shadowgovt 4y ago
  The set of responses to a request is also constrained to a non-Turing-complete declarative language.
  - hgsgm 4y ago
    Turing-complete and declarative are not the important parts. Ability to read content and perform side effects matter.

dylan604 4y ago

I can't tell if you're being sincere or sarcastic. Allowing users to install whatever they want at their own risk is exactly what people complaining about walled gardens not allowing them to do. Attempting to protect people that don't know what they are doing from known security holes is what one of the things walled gardens claim as a feature. Which direction are taking it?

Retric 4y ago
That’s hardly the only option. Walled guardians that only protect against counterfeits or viruses is a perfectly useful feature even if they allow anyone on the platform.
- DelightOne 4y ago
  Except that not being able to block all ads potentially containing viruses makes THAT walled garden unsafe by design.
  - Retric 4y ago
    In what way would the walled garden I described not be able to block adds?
    - DelightOne 4y ago
      When that walled garden relies on 3rd-party tools and does not give them enough power to do their job well.
      - Retric 4y ago
        You are clearly assuming things that have nothing to do with what I described. The owner of a walled garden doesn’t need to depend on 3rd parties for anything they can build whatever tools they want in house.
        DelightOne 4y ago
        Right, I am talking about Chrome. You seem to be talking about something else.
        Retric 4y ago
        If you’re going to ignore what people say there’s little point in hitting that reply button.
hgsgm 4y ago
It's quite clear from the comment that 'shadowgovt supports Mozilla being a non-walled garden, which is the reason Firefox exists. No one needs a Chrome clone.

Miraste 4y ago

Being forced to see and potentially click on ads is a security hole. I trust uBlock and gorhill more than I trust Google.

macNchz 4y ago
This is what prompted me to start blocking ads many years ago…there’s simply too much malicious advertising out there and the corporations involved have the wrong incentives to deal with it properly. As long as ad networks allow arbitrary code to run, and content designed to trick users, I prefer to centralize on a single source of potential risk (the extension developer) rather than the moving target of malicious ads from myriad sources. A recent example readily avoided by not allowing the ad to run in the first place: https://www.securityweek.com/webkit-zero-day-vulnerability-exploited-malvertising-operation/ https://www.securityweek.com/webkit-zero-day-vulnerability-e...
hgsgm 4y ago
*"uBlock Origin" . "uBlock" stole the new from gorhill.

kuschku 4y ago

All chrome did was prevent extensions from blocking requests. They can still see all requests and do with them what they want, just read-only. How does that solve the security issue you mentioned?

charcircuit 4y ago
[flagged]
- blibble 4y ago
  indeed, with Google being a well known champion of privacy
  - taneq 4y ago
    Google takes your privacy very seriously. Where ‘privacy’ is defined as ‘giving you control over who Google shared your data with’, of course.
    - charcircuit 4y ago
      [flagged]
      - hgsgm 4y ago
        Except that Google exempts itself from those privacy controls, if you use a Google product. Users "understand" that Google records most everything they do on the web, for advertising purposes.
        charcircuit 4y ago
        >Except that Google exempts itself from those privacy controls, if you use a Google product. No it doesn't. Google takes privacy issues very seriously just like security issues. You can disable Google storing your web activity in your account's privacy settings here. https://myactivity.google.com/myactivity https://myactivity.google.com/myactivity

sebzim4500 4y ago

Am I missing something? It's my understanding that chromium based browsers also allow listening to requests same as before, they merely aren't allowed to block them anymore.

shadowgovt 4y ago
The set of responses to a request is also constrained to a non-Turing-complete declarative language.
- hgsgm 4y ago
  Turing-complete and declarative are not the important parts. Ability to read content and perform side effects matter.