6 ms·

"Certain Firefox users may come across a message in the extensions panel indicating that their add-ons are not allowed on the site currently open. We have intro

by _odey 3y ago

"Certain Firefox users may come across a message in the extensions panel indicating that their add-ons are not allowed on the site currently open. We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including security concerns." https://support.mozilla.org/en-US/kb/quarantined-domains https://support.mozilla.org/en-US/kb/quarantined-domains Tin foil hat on This will be used by Google to force Mozilla into disabling ad blockers on YouTube (dare I say: SponsorBlock as well). Tin foil hat off

sharps1 3y ago
The problem with this feature is the user does not make the choice. Firefox should be alerting the user why they disabled the extensions and give them a choice to enable them.
- Xylakant 3y ago
  From the linked page explaining the feature: How can I re-enable the add-ons that are not allowed on some websites? We understand that installing add-ons is a user choice and, as with your security, we also take this matter very seriously. If you are aware of the associated risk and still wish to allow the add-ons that have been disallowed on a website by Mozilla, you can do it from the configuration editor (about:config):
  - MikusR 3y ago
    "“But the plans were on display…” “On display? I eventually had to go down to the cellar to find them.” “That’s the display department.” “With a flashlight.” “Ah, well, the lights had probably gone.” “So had the stairs.” “But look, you found the notice, didn’t you?” “Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.” "
    - iudqnolq 3y ago
      Requiring users to have non-trivial general computer skills before disabling security features seems completely fine to me. If you see that an extension is blocked on a domain and don't think to Google "unblock extension domain Firefox", select an appropriate result, and follow straightforward instructions then you probably aren't capable of understanding the nuances of extension security risks.
      - Aleklart 3y ago
        These stupid users, can’t control their computers! Let it be us, corporation, who decide what you can run. It is safe and effective.
        shard972 3y ago
        [dead]
        paulryanrogers 3y ago
        Apple, is that you?
    - Xylakant 3y ago
      The blocking UI shown to n the documentation of the feature has a “learn more” link which presumably leads to to exact the same documentation that I quoted. I consider that absolutely discoverable and fine. The one thing that I would wish for as an improvement is that I can unblock specific extensions individually instead of a single switch for all.
  - Santosh83 3y ago
    This about:config toggle seems to be a "nuclear option" that disables the entire "quarantined domains" functionality. It would be better if Mozilla offered users a choice to toggle only certain blocked addons on certain domains, though the normal UI.
    - Xylakant 3y ago
      I agree, that would be better. But the current situation is strictly better than before, even if it’s not perfect - it protects you until you flip that switch and when you do, you’re exactly where you were before they added the feature. So nobody is worse off and many are better off.
m45t3r 3y ago
I don't think this is exactly new. For example the Add-ons website for Firefox already didn't allow any extensions to be run on it. It does seems this feature extends this list for new websites, but it doesn't mean Firefox will abuse (and even if they start abusing it, they have a explicit flag to opt-out).
- MikusR 3y ago
  They will abuse it. Then "apologize". And then abuse again.
- jwilk 3y ago
  https://github.com/gorhill/uBlock/wiki/Privileged-Pages https://github.com/gorhill/uBlock/wiki/Privileged-Pages
goatsi 3y ago
The screenshot they use for the example specifically has ublock origin as the vetted extension that is permitted to run.
deadbunny 3y ago
On the page you linked it explains how to disable this completely. No tin foil hat needed.
SushiHippie 3y ago
I searched a bit through the documentation and code and these were my findings. I thought I'd share them for others that are interested and for future reference. Currently, there are no domains blocked, they would appear on this API endpoint: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/addons-manager-settings/records https://firefox.settings.services.mozilla.com/v1/buckets/mai... This is the json schema for this API endpoint: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/addons-manager-settings https://firefox.settings.services.mozilla.com/v1/buckets/mai... More information on the remote settings in general: AMRemoteSettings Overview - quarantinedDomains: https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/AMRemoteSettings-overview.html#quarantineddomains https://firefox-source-docs.mozilla.org/toolkit/mozapps/exte... Remote Settings documentation: https://remote-settings.readthedocs.io/en/latest/index.html https://remote-settings.readthedocs.io/en/latest/index.html Remote Settings Devtools - where you can see all the remote settings, that get set: https://github.com/mozilla-extensions/remote-settings-devtools https://github.com/mozilla-extensions/remote-settings-devtoo...
- JohnFen 3y ago
  I truly miss the days when companies weren't able to remotely change any settings at all.
mschuster91 3y ago
Makes sense though, the amount of malware extensions is... unbelievable.
depereo 3y ago
This appears to have been implemented by the security team, with the bugzilla issue originally made private / Mozilla staff only a month ago. Mozilla has earned some trust here, I think. I'll be interested to see why this was done, can't imagine that'll be quiet forever.
- msla 3y ago
  > Mozilla has earned some trust here, I think. How? Was it the opt-out telemetry, putting ads in the browser, or the "experiments" that were also ads?
  - depereo 3y ago
    The 25 years of seeking better outcomes for netizens, using their small influence to help people to have a better experience with the internet. If you always compare things to your version of utopia you'll be very disappointed. I appreciate their efforts in saving me from the alternatives like Chrome and IE, which are produced and pushed by groups with a million times their resources.
    - Aleklart 3y ago
      I thought Chrome saved us from slow and tarded Mozilla Suite and IE 7 past gen browsers. God bless Apple WebKit I guess. It made web 2.0 possible.
      - wtallis 3y ago
        The old Mozilla suite was obsoleted by Firefox much earlier: Firefox 1.0 was in 2004, IE 7 in 2006, and Chrome didn't show up until 2008 when Firefox was on 3.0.
- SushiHippie 3y ago
  This is the Bugzilla issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 https://bugzilla.mozilla.org/show_bug.cgi?id=1832791
- 3y ago
marcosdumay 3y ago
In the past, Mozilla has quarantined several things outside of the reach of standard Firefox customizing tools. Every time it has been because compromising one of those things would result on the user not being able to manage the configurations or even seeing that something different is happening. IMO, the most likely usage is that they will use it to disallow extensions on the extension store.
thayne 3y ago
I can't imagine uBlock Origin not being on the list of "monitored extensions" that are allowed. That said, I am concerned that there doesn't seem to be any easily findable information about what domains (or even what kind of domains) will be quarantined, or what extensions will be "monitored".
mmis1000 3y ago
This thing is like there on the first day firefox have extension. If you look closely, you can't run extension on extension store page since day one. So basically nothing changed. The only difference is they now allow some extension to run on these forbidden domains. And show you clearly where the extension won't run.
iavael 3y ago
I think Google would rather preinstall SponsorBlock in Chrome by default if it could, because this move would encourage use of YouTube Ad tools instead of in-video ads (from which Google gets nothing).

by _odey 3y ago

sharps1 3y ago

The problem with this feature is the user does not make the choice. Firefox should be alerting the user why they disabled the extensions and give them a choice to enable them.

Xylakant 3y ago
From the linked page explaining the feature: How can I re-enable the add-ons that are not allowed on some websites? We understand that installing add-ons is a user choice and, as with your security, we also take this matter very seriously. If you are aware of the associated risk and still wish to allow the add-ons that have been disallowed on a website by Mozilla, you can do it from the configuration editor (about:config):
- MikusR 3y ago
  "“But the plans were on display…” “On display? I eventually had to go down to the cellar to find them.” “That’s the display department.” “With a flashlight.” “Ah, well, the lights had probably gone.” “So had the stairs.” “But look, you found the notice, didn’t you?” “Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.” "
  - iudqnolq 3y ago
    Requiring users to have non-trivial general computer skills before disabling security features seems completely fine to me. If you see that an extension is blocked on a domain and don't think to Google "unblock extension domain Firefox", select an appropriate result, and follow straightforward instructions then you probably aren't capable of understanding the nuances of extension security risks.
    - Aleklart 3y ago
      These stupid users, can’t control their computers! Let it be us, corporation, who decide what you can run. It is safe and effective.
      - shard972 3y ago
        [dead]
      - paulryanrogers 3y ago
        Apple, is that you?
  - Xylakant 3y ago
    The blocking UI shown to n the documentation of the feature has a “learn more” link which presumably leads to to exact the same documentation that I quoted. I consider that absolutely discoverable and fine. The one thing that I would wish for as an improvement is that I can unblock specific extensions individually instead of a single switch for all.
- Santosh83 3y ago
  This about:config toggle seems to be a "nuclear option" that disables the entire "quarantined domains" functionality. It would be better if Mozilla offered users a choice to toggle only certain blocked addons on certain domains, though the normal UI.
  - Xylakant 3y ago
    I agree, that would be better. But the current situation is strictly better than before, even if it’s not perfect - it protects you until you flip that switch and when you do, you’re exactly where you were before they added the feature. So nobody is worse off and many are better off.

m45t3r 3y ago

I don't think this is exactly new. For example the Add-ons website for Firefox already didn't allow any extensions to be run on it. It does seems this feature extends this list for new websites, but it doesn't mean Firefox will abuse (and even if they start abusing it, they have a explicit flag to opt-out).

MikusR 3y ago
They will abuse it. Then "apologize". And then abuse again.
jwilk 3y ago
https://github.com/gorhill/uBlock/wiki/Privileged-Pages https://github.com/gorhill/uBlock/wiki/Privileged-Pages

goatsi 3y ago

The screenshot they use for the example specifically has ublock origin as the vetted extension that is permitted to run.

deadbunny 3y ago

On the page you linked it explains how to disable this completely. No tin foil hat needed.

SushiHippie 3y ago

I searched a bit through the documentation and code and these were my findings. I thought I'd share them for others that are interested and for future reference. Currently, there are no domains blocked, they would appear on this API endpoint: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/addons-manager-settings/records https://firefox.settings.services.mozilla.com/v1/buckets/mai... This is the json schema for this API endpoint: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/addons-manager-settings https://firefox.settings.services.mozilla.com/v1/buckets/mai... More information on the remote settings in general: AMRemoteSettings Overview - quarantinedDomains: https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/AMRemoteSettings-overview.html#quarantineddomains https://firefox-source-docs.mozilla.org/toolkit/mozapps/exte... Remote Settings documentation: https://remote-settings.readthedocs.io/en/latest/index.html https://remote-settings.readthedocs.io/en/latest/index.html Remote Settings Devtools - where you can see all the remote settings, that get set: https://github.com/mozilla-extensions/remote-settings-devtools https://github.com/mozilla-extensions/remote-settings-devtoo...

JohnFen 3y ago
I truly miss the days when companies weren't able to remotely change any settings at all.

mschuster91 3y ago

Makes sense though, the amount of malware extensions is... unbelievable.

depereo 3y ago

This appears to have been implemented by the security team, with the bugzilla issue originally made private / Mozilla staff only a month ago. Mozilla has earned some trust here, I think. I'll be interested to see why this was done, can't imagine that'll be quiet forever.

msla 3y ago
> Mozilla has earned some trust here, I think. How? Was it the opt-out telemetry, putting ads in the browser, or the "experiments" that were also ads?
- depereo 3y ago
  The 25 years of seeking better outcomes for netizens, using their small influence to help people to have a better experience with the internet. If you always compare things to your version of utopia you'll be very disappointed. I appreciate their efforts in saving me from the alternatives like Chrome and IE, which are produced and pushed by groups with a million times their resources.
  - Aleklart 3y ago
    I thought Chrome saved us from slow and tarded Mozilla Suite and IE 7 past gen browsers. God bless Apple WebKit I guess. It made web 2.0 possible.
    - wtallis 3y ago
      The old Mozilla suite was obsoleted by Firefox much earlier: Firefox 1.0 was in 2004, IE 7 in 2006, and Chrome didn't show up until 2008 when Firefox was on 3.0.
SushiHippie 3y ago
This is the Bugzilla issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 https://bugzilla.mozilla.org/show_bug.cgi?id=1832791
3y ago

marcosdumay 3y ago

In the past, Mozilla has quarantined several things outside of the reach of standard Firefox customizing tools. Every time it has been because compromising one of those things would result on the user not being able to manage the configurations or even seeing that something different is happening. IMO, the most likely usage is that they will use it to disallow extensions on the extension store.

thayne 3y ago

I can't imagine uBlock Origin not being on the list of "monitored extensions" that are allowed. That said, I am concerned that there doesn't seem to be any easily findable information about what domains (or even what kind of domains) will be quarantined, or what extensions will be "monitored".

mmis1000 3y ago

This thing is like there on the first day firefox have extension. If you look closely, you can't run extension on extension store page since day one. So basically nothing changed. The only difference is they now allow some extension to run on these forbidden domains. And show you clearly where the extension won't run.

iavael 3y ago

I think Google would rather preinstall SponsorBlock in Chrome by default if it could, because this move would encourage use of YouTube Ad tools instead of in-video ads (from which Google gets nothing).