9 ms·

Mozilla restricts extensions on some domains on Firefox 115

97 points by muxator 3y ago

gpvos 3y ago
Mozilla must have introduced this feature for some reason, but the article doesn't talk about the possible negative consequences of disabling it.
- parker_mountain 3y ago
  It's probably for "managed firefox", which is when your IT department sets firefox as the default browser. It lets them, for example, disable adblock on the internal company portal
  - Mordisquitos 3y ago
    That would make perfect sense, but to be clear the primary motivation wouldn't be to specifically disable adblockers on the internal network. Rather, it would be to disable any extension on internal company domains, as an information security precaution.
- suprjami 3y ago
  See analysis here: https://news.ycombinator.com/item?id=36590507 https://news.ycombinator.com/item?id=36590507
  - xg15 3y ago
    Hang on, so the list of domains is pulled from an API endpoint? Meaning, it can change at any time, even without requiring an update to the browser? That would actually be far worse than a static list.
kevin_b_er 3y ago
What's the list of quarantined domains?
deely3 3y ago
I want to say something good, but it looks like Mozilla continue search for a way to take more control from the user.
- beebeepka 3y ago
  They aren't taking away control. Read their own post
  - rampant_ai 3y ago
    If I install a ceiling fan for someone with multiple speeds, forward/reverse, and a dimmable light but I take the remote with me and leave just a basic on/off switch that's still taking away control. Give me full control of all features or I go elsewhere.
    - nerdbert 3y ago
      If you install a fancy ceiling fan for someone and the remote is on backorder, and you're going to bring it to them next week, I don't think you've done them any major disservice. That's what's happening here. A feature for which the UX is still in development, and until then, interested users can manage it via the about:config page.
  - deely3 3y ago
    They started disabling extensions installed by user on some websites without clear explanation why and when it will happen and intentionally hided settings to disable this functionality. Should I read their own post again? Why not ask user first? "Do you want to disable add-on not monitored by Mozilla on this specific site?". Also, how many times users asks about this functionality? "I want Mozilla to monitor add-ons installed on my browser and disable it on some websites, when Mozilly want it" - surelly most of the users wants this.
    - woofcat 3y ago
      Please do read it again. They've not disabled any extension on any website. They've added a option for that to potentially do that.
zb3 3y ago
Is there a list of these domains?
- nammi 3y ago
  On 115.0b9 on macOS the list is empty (`extensions.quarantinedDomains.list`), guessing it's intended to be set by school/company IT for their managed devices
  - dTP90pN 3y ago
    ~~While school/company IT as a use case is being considered[1], that is not the primary intent for this feature.~~ edit: I misread that ticket. It's about allowing school/company IT to disable the feature, not to allow them to use it. https://bugzilla.mozilla.org/show_bug.cgi?id=1834985 https://bugzilla.mozilla.org/show_bug.cgi?id=1834985
- toyg 3y ago
  I believe the list will be configurable, it might be empty by default. Looking at the inter-bug linkage, this feature seems built for IT departments to blanket-ban extensions from domains that the company deems sensitive.
  - detuur 3y ago
    That purpose doesn't really make sense for me. Any IT department that wants to shut down unverified code on their intranet sites will just disable add-ons completely. I mean, it's a noble idea, to allow users to install their own preferred add-ons while still blocking them on intranet sites, but for IT it's much easier to just lock it down completely. I think the feature's simply not finished yet, and that in the future this list is going to come pre-loaded with government and banking domains.
    - deleted 3y ago
      [deleted]
    - toyg 3y ago
wasmitnetzen 3y ago
This feature stems from an attempt at disallowing extensions with have rights to all websites on certain websites[1]. Version 116 will have an UI for users to control this.[2] [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1745823 https://bugzilla.mozilla.org/show_bug.cgi?id=1745823 https://bugzilla.mozilla.org/show_bug.cgi?id=1834825 https://bugzilla.mozilla.org/show_bug.cgi?id=1834825 [2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1837670 https://bugzilla.mozilla.org/show_bug.cgi?id=1837670
RobotToaster 3y ago
I wonder if this mysteriously blocks adblockers running on certain sites like youtube?
- lyvxh 3y ago
  uBlock Origin is specifically one of the whitelisted extensions, and you can disable this feature by setting extensions.quarantinedDomains.enabled to false (in about:config)
  - baconfromhell 3y ago
    Yeah, the average user will figure that out. It's still defined as a win for advertisers because not every users will know to do this and also when this happens... They'll be able to post record profits on quarterly earnings.
jwilk 3y ago
Looks like blogspam for https://support.mozilla.org/en-US/kb/quarantined-domains https://support.mozilla.org/en-US/kb/quarantined-domains.
kevin_b_er 3y ago
Ok I went through the implementation code. The "quarantined domains" are the contents of extensions.quarantinedDomains.list, which defaults to empty. So, this has to be some sort of enterprise feature.
- dTP90pN 3y ago
  Mozilla can remotely set that pref: https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 There is consideration to allow enterprises to disable this feature though: https://bugzilla.mozilla.org/show_bug.cgi?id=1834985 https://bugzilla.mozilla.org/show_bug.cgi?id=1834985 edit: fixed 2nd link description.
AshamedCaptain 3y ago
Yet another mechanism for a 3-letter-agency to remotely change your browser settings.
- unethical_ban 3y ago
  Not at all.
- nerdbert 3y ago
  Yes because the CIA, which is very interested in your browser settings, is going to do it via this transparent and easily audited mechanism.
  - AshamedCaptain 3y ago
    "plausible deniability"
crote 3y ago
Which extensions and which domains, though? I think we can all agree that restricting uBlock from working on YouTube probably isn't going to happen, and you might want some restrictions on addons accessing all data on a banking website. But where did they draw the line? Is someone still allowed to publish an addon which fixes the interface of an absolutely broken banking website, or which allows you to liberate your own data? Will that only be allowed through vetting? What about things like Dark Mode addons which have access to all websites? Is it possible to explicitly request to be included in the allowlist? I am not against it on principle, but we're missing a loooot of information right now to decide whether this is actually a good thing.
- cjsawyer 3y ago
  I’d be 100% on-board if they changed this from a list of URL’s they define to a list I define. Web extensions sound great until you realize how much power you’re handing to arbitrary code once you allow it reading and writing to the DOM. They can forward anything to anywhere, sandboxing goes out the window
  - cycomanic 3y ago
    But if you read the related bug reports it is a list that you define, it just can get some defaults from Mozilla.
    - hu3 3y ago
      Defaults matter. I'd be okay if they had suggestions, but I'm not okay with them blocking extensions on certain websites of their choice by default.
- icodestuff 3y ago
  Looks like there will be a UI to control this 116, and the block list is empty in 115. I’m pretty stoked for this. Every time I install an extension I wonder what’s going to happen to my banking info if an update ever gets hijacked. This is a much better solution than turning all my extensions off and on when I visit financial websites.
indymike 3y ago
This would be a nice feature if the user can manage the restriction list. This is the kind of feature that will make the web a better place.
ghusto 3y ago
The reverse of this would be even more useful to me, i.e. a list where the extension _is_ allowed. So many developers hit the "ALL THE THINGS" button out of laziness.
- susanthenerd 3y ago
  Last time I checked firefox lists the website an extension has permissions on
  - ghusto 3y ago
    It does, and lists it again when you install the extension :) What I was getting at was that there are so many developers that just put in "*" out of laziness, when their extension might need access to only a handful of domains, or even just one.
    - charrondev 3y ago
      Safari actually handles this pretty well. By default you will be prompted per-site which domain you want the extension to run on, or you can set your allow or deny all except your whitelist.
    - yamalight 3y ago
      I really like Edge's "site access: on click" for extensions. Hoping for FF to add it at some point
lapcat 3y ago
This is crazy. Mozilla can remotely disable extensions on any domain that Mozilla chooses? https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 Apparently they're luring everyone into accepting this abomination by starting with an empty list, but what in the world is the motivation for this feature, and which domains do they intend to add??? "We don't know, we just thought it would be a good idea" is no explanation or justification. People are going to talk about "security" and "banking", but that's a load of crap. Just wait until your bank disables password autofill and paste on their site, and no extension can override it. I have no problem with letting the user control the domains that an extension can access, but giving Mozilla remote control? No way.
- BaseballPhysics 3y ago
  Given you can just go override Firefox and enable disabled extensions, I'm not sure I understand the outrage. Then again, Mozilla does seem to attract a remarkable level of vitriol despite being one of the true stewards of an open internet...
  - dotancohen 3y ago
    > Given you can just go override Firefox and enable disabled extensions No, _you_ can just go override Firefox and enable disabled extensions. The average user can not do that. _I_ can bore out a V-8 0.030 over, choose a proper cam, match all my bearing clearances, assemble the thing balanced, and then tune 30% more power out of it than it came with from the factory. But not all automobile drivers can do that.
    - BaseballPhysics 3y ago
      I'm gonna wager by far the majority of people who will actually get affected or outraged by this have the technical wherewithal to click a little gear icon and re-enable an extension. Everyone else is running maybe uBlock and a privacy extension that their kid installed for them, and those will be whitelisted. This is a tempest in a teapot, just like every other "controversy" that Firefox finds themselves embroiled in.
Centigonal 3y ago
This is a community comms failure. Preventing the random extension I installed from hijacking my bank login page is good! Giving Mozilla the ability to disable my adblocker or NoScript on an arbitrary domain list that they can update remotely is scary! A blog post with Mozilla's plans for the feature, what they're implementing to limit abuse on Mozilla's side, and how users can opt out would make this a non-issue. It's nuts that the mozilla bug tracker is the best source for laypeople to get info on this.
- ygjb 3y ago
  > Preventing the random extension I installed from hijacking my bank login page is good! Giving Mozilla the ability to disable my adblocker or NoScript on an arbitrary domain list that they can update remotely is scary! So the ability for the web browser to arbitrarily add and remove features from the browser is scary? Just asking because there is a massive security trade-off and the intersection of a number of threat models in this comment. Do you trust the platform you use to download and execute arbitrary code (that is, web content) to automatically update itself? If not, how do you balance the lack of automated updates against the need to keep software up to date to prevent exploit of known vulnerabilities? If so, how do you distinguish the ability to download and execute new code that could remove or suppress the features you choose from the ability to enable and disable add-ons/extensions? There could have been better communication on this, but describing the feature as scary tells me you don't really understand the threat model around your use of a web browser, and may not be asking the right questions or considering the actual threats.
Lariscus 3y ago
This is great. I would like to block extensions on certain websites. For example, I probably should not run any extensions on the website of my bank.
SushiHippie 3y ago
Reposting my comment about this from the other discussion (https://news.ycombinator.com/item?id=36590507 https://news.ycombinator.com/item?id=36590507): I searched a bit through the documentation and code, and these were my findings. I thought I'd share them for others that are interested and for future reference. Currently, there are no domains blocked, they would appear on this API endpoint: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/addons-manager-settings/records https://firefox.settings.services.mozilla.com/v1/buckets/mai... This is the JSON schema for this API endpoint: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/addons-manager-settings https://firefox.settings.services.mozilla.com/v1/buckets/mai... More information on the remote settings in general: AMRemoteSettings Overview - quarantinedDomains: https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/AMRemoteSettings-overview.html#quarantineddomains https://firefox-source-docs.mozilla.org/toolkit/mozapps/exte... Remote Settings documentation: https://remote-settings.readthedocs.io/en/latest/index.html https://remote-settings.readthedocs.io/en/latest/index.html Remote Settings DevTools - where you can see all the remote settings, that get set: https://github.com/mozilla-extensions/remote-settings-devtools https://github.com/mozilla-extensions/remote-settings-devtoo... EDIT: Seems like there are many settings that already get automatically set via AMRemoteSettings (including search-engine configs, cert revocations, dns over https providers, password rules for specific domains, top-sites, URL tracking parameters to clean, etc.). We will see how this new setting will be used, it can be easily disabled (https://support.mozilla.org/en-US/kb/quarantined-domains https://support.mozilla.org/en-US/kb/quarantined-domains) and you will get a warning if an Add-On is blocked from accessing the site. Also seems like there will be a UI for this in v116 (https://bugzilla.mozilla.org/show_bug.cgi?id=1837670 https://bugzilla.mozilla.org/show_bug.cgi?id=1837670), where you can configure this better than just disabling this feature completely.
MagicMoonlight 3y ago
So how much do I have to pay the foundation in order to make sure my ad-funded website can't be adblocked? Google has deep pockets.
Ycdr4thfdd 3y ago
> mozilla-employee-confidential With the exception of addressing critical security issues, why does an organization who positions themselves as a leader of open source software make so many user-unfriendly decisions behind closed doors?
nathants 3y ago
it’s not ideal, but using little snitch to prevent firefox from talking to mozilla should help.
baconfromhell 3y ago
What mozilla wants to censor the hecking internet. How could i have been so foolish. Brah cmon guys we knew thats what they are upto all along.
anonymousiam 3y ago
Disabling the restriction is pretty easy. https://www.askvg.com/fix-some-extensions-are-not-allowed-in-firefox-115-and-later/ https://www.askvg.com/fix-some-extensions-are-not-allowed-in...

97 points by muxator 3y ago

Mozilla must have introduced this feature for some reason, but the article doesn't talk about the possible negative consequences of disabling it.

parker_mountain 3y ago
It's probably for "managed firefox", which is when your IT department sets firefox as the default browser. It lets them, for example, disable adblock on the internal company portal
- Mordisquitos 3y ago
  That would make perfect sense, but to be clear the primary motivation wouldn't be to specifically disable adblockers on the internal network. Rather, it would be to disable any extension on internal company domains, as an information security precaution.
suprjami 3y ago
See analysis here: https://news.ycombinator.com/item?id=36590507 https://news.ycombinator.com/item?id=36590507
- xg15 3y ago
  Hang on, so the list of domains is pulled from an API endpoint? Meaning, it can change at any time, even without requiring an update to the browser? That would actually be far worse than a static list.

kevin_b_er 3y ago

What's the list of quarantined domains?

deely3 3y ago

I want to say something good, but it looks like Mozilla continue search for a way to take more control from the user.

beebeepka 3y ago
They aren't taking away control. Read their own post
- rampant_ai 3y ago
  If I install a ceiling fan for someone with multiple speeds, forward/reverse, and a dimmable light but I take the remote with me and leave just a basic on/off switch that's still taking away control. Give me full control of all features or I go elsewhere.
  - nerdbert 3y ago
    If you install a fancy ceiling fan for someone and the remote is on backorder, and you're going to bring it to them next week, I don't think you've done them any major disservice. That's what's happening here. A feature for which the UX is still in development, and until then, interested users can manage it via the about:config page.
- deely3 3y ago
  They started disabling extensions installed by user on some websites without clear explanation why and when it will happen and intentionally hided settings to disable this functionality. Should I read their own post again? Why not ask user first? "Do you want to disable add-on not monitored by Mozilla on this specific site?". Also, how many times users asks about this functionality? "I want Mozilla to monitor add-ons installed on my browser and disable it on some websites, when Mozilly want it" - surelly most of the users wants this.
  - woofcat 3y ago
    Please do read it again. They've not disabled any extension on any website. They've added a option for that to potentially do that.

zb3 3y ago

Is there a list of these domains?

nammi 3y ago
On 115.0b9 on macOS the list is empty (`extensions.quarantinedDomains.list`), guessing it's intended to be set by school/company IT for their managed devices
- dTP90pN 3y ago
  ~~While school/company IT as a use case is being considered[1], that is not the primary intent for this feature.~~ edit: I misread that ticket. It's about allowing school/company IT to disable the feature, not to allow them to use it. https://bugzilla.mozilla.org/show_bug.cgi?id=1834985 https://bugzilla.mozilla.org/show_bug.cgi?id=1834985
toyg 3y ago
I believe the list will be configurable, it might be empty by default. Looking at the inter-bug linkage, this feature seems built for IT departments to blanket-ban extensions from domains that the company deems sensitive.
- detuur 3y ago
  That purpose doesn't really make sense for me. Any IT department that wants to shut down unverified code on their intranet sites will just disable add-ons completely. I mean, it's a noble idea, to allow users to install their own preferred add-ons while still blocking them on intranet sites, but for IT it's much easier to just lock it down completely. I think the feature's simply not finished yet, and that in the future this list is going to come pre-loaded with government and banking domains.
  - deleted 3y ago
    [deleted]
  - toyg 3y ago

wasmitnetzen 3y ago

This feature stems from an attempt at disallowing extensions with have rights to all websites on certain websites[1]. Version 116 will have an UI for users to control this.[2] [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1745823 https://bugzilla.mozilla.org/show_bug.cgi?id=1745823 https://bugzilla.mozilla.org/show_bug.cgi?id=1834825 https://bugzilla.mozilla.org/show_bug.cgi?id=1834825 [2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1837670 https://bugzilla.mozilla.org/show_bug.cgi?id=1837670

RobotToaster 3y ago

I wonder if this mysteriously blocks adblockers running on certain sites like youtube?

lyvxh 3y ago
uBlock Origin is specifically one of the whitelisted extensions, and you can disable this feature by setting extensions.quarantinedDomains.enabled to false (in about:config)
- baconfromhell 3y ago
  Yeah, the average user will figure that out. It's still defined as a win for advertisers because not every users will know to do this and also when this happens... They'll be able to post record profits on quarterly earnings.

jwilk 3y ago

Looks like blogspam for https://support.mozilla.org/en-US/kb/quarantined-domains https://support.mozilla.org/en-US/kb/quarantined-domains.

kevin_b_er 3y ago

Ok I went through the implementation code. The "quarantined domains" are the contents of extensions.quarantinedDomains.list, which defaults to empty. So, this has to be some sort of enterprise feature.

dTP90pN 3y ago
Mozilla can remotely set that pref: https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 There is consideration to allow enterprises to disable this feature though: https://bugzilla.mozilla.org/show_bug.cgi?id=1834985 https://bugzilla.mozilla.org/show_bug.cgi?id=1834985 edit: fixed 2nd link description.

AshamedCaptain 3y ago

Yet another mechanism for a 3-letter-agency to remotely change your browser settings.

unethical_ban 3y ago
Not at all.
nerdbert 3y ago
Yes because the CIA, which is very interested in your browser settings, is going to do it via this transparent and easily audited mechanism.
- AshamedCaptain 3y ago
  "plausible deniability"

crote 3y ago

Which extensions and which domains, though? I think we can all agree that restricting uBlock from working on YouTube probably isn't going to happen, and you might want some restrictions on addons accessing all data on a banking website. But where did they draw the line? Is someone still allowed to publish an addon which fixes the interface of an absolutely broken banking website, or which allows you to liberate your own data? Will that only be allowed through vetting? What about things like Dark Mode addons which have access to all websites? Is it possible to explicitly request to be included in the allowlist? I am not against it on principle, but we're missing a loooot of information right now to decide whether this is actually a good thing.

cjsawyer 3y ago
I’d be 100% on-board if they changed this from a list of URL’s they define to a list I define. Web extensions sound great until you realize how much power you’re handing to arbitrary code once you allow it reading and writing to the DOM. They can forward anything to anywhere, sandboxing goes out the window
- cycomanic 3y ago
  But if you read the related bug reports it is a list that you define, it just can get some defaults from Mozilla.
  - hu3 3y ago
    Defaults matter. I'd be okay if they had suggestions, but I'm not okay with them blocking extensions on certain websites of their choice by default.
icodestuff 3y ago
Looks like there will be a UI to control this 116, and the block list is empty in 115. I’m pretty stoked for this. Every time I install an extension I wonder what’s going to happen to my banking info if an update ever gets hijacked. This is a much better solution than turning all my extensions off and on when I visit financial websites.

indymike 3y ago

This would be a nice feature if the user can manage the restriction list. This is the kind of feature that will make the web a better place.

ghusto 3y ago

The reverse of this would be even more useful to me, i.e. a list where the extension _is_ allowed. So many developers hit the "ALL THE THINGS" button out of laziness.

susanthenerd 3y ago
Last time I checked firefox lists the website an extension has permissions on
- ghusto 3y ago
  It does, and lists it again when you install the extension :) What I was getting at was that there are so many developers that just put in "*" out of laziness, when their extension might need access to only a handful of domains, or even just one.
  - charrondev 3y ago
    Safari actually handles this pretty well. By default you will be prompted per-site which domain you want the extension to run on, or you can set your allow or deny all except your whitelist.
  - yamalight 3y ago
    I really like Edge's "site access: on click" for extensions. Hoping for FF to add it at some point

lapcat 3y ago

This is crazy. Mozilla can remotely disable extensions on any domain that Mozilla chooses? https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 Apparently they're luring everyone into accepting this abomination by starting with an empty list, but what in the world is the motivation for this feature, and which domains do they intend to add??? "We don't know, we just thought it would be a good idea" is no explanation or justification. People are going to talk about "security" and "banking", but that's a load of crap. Just wait until your bank disables password autofill and paste on their site, and no extension can override it. I have no problem with letting the user control the domains that an extension can access, but giving Mozilla remote control? No way.

BaseballPhysics 3y ago
Given you can just go override Firefox and enable disabled extensions, I'm not sure I understand the outrage. Then again, Mozilla does seem to attract a remarkable level of vitriol despite being one of the true stewards of an open internet...
- dotancohen 3y ago
  > Given you can just go override Firefox and enable disabled extensions No, _you_ can just go override Firefox and enable disabled extensions. The average user can not do that. _I_ can bore out a V-8 0.030 over, choose a proper cam, match all my bearing clearances, assemble the thing balanced, and then tune 30% more power out of it than it came with from the factory. But not all automobile drivers can do that.
  - BaseballPhysics 3y ago
    I'm gonna wager by far the majority of people who will actually get affected or outraged by this have the technical wherewithal to click a little gear icon and re-enable an extension. Everyone else is running maybe uBlock and a privacy extension that their kid installed for them, and those will be whitelisted. This is a tempest in a teapot, just like every other "controversy" that Firefox finds themselves embroiled in.

Centigonal 3y ago

This is a community comms failure. Preventing the random extension I installed from hijacking my bank login page is good! Giving Mozilla the ability to disable my adblocker or NoScript on an arbitrary domain list that they can update remotely is scary! A blog post with Mozilla's plans for the feature, what they're implementing to limit abuse on Mozilla's side, and how users can opt out would make this a non-issue. It's nuts that the mozilla bug tracker is the best source for laypeople to get info on this.

ygjb 3y ago
> Preventing the random extension I installed from hijacking my bank login page is good! Giving Mozilla the ability to disable my adblocker or NoScript on an arbitrary domain list that they can update remotely is scary! So the ability for the web browser to arbitrarily add and remove features from the browser is scary? Just asking because there is a massive security trade-off and the intersection of a number of threat models in this comment. Do you trust the platform you use to download and execute arbitrary code (that is, web content) to automatically update itself? If not, how do you balance the lack of automated updates against the need to keep software up to date to prevent exploit of known vulnerabilities? If so, how do you distinguish the ability to download and execute new code that could remove or suppress the features you choose from the ability to enable and disable add-ons/extensions? There could have been better communication on this, but describing the feature as scary tells me you don't really understand the threat model around your use of a web browser, and may not be asking the right questions or considering the actual threats.

Lariscus 3y ago

This is great. I would like to block extensions on certain websites. For example, I probably should not run any extensions on the website of my bank.

SushiHippie 3y ago

Reposting my comment about this from the other discussion (https://news.ycombinator.com/item?id=36590507 https://news.ycombinator.com/item?id=36590507): I searched a bit through the documentation and code, and these were my findings. I thought I'd share them for others that are interested and for future reference. Currently, there are no domains blocked, they would appear on this API endpoint: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/addons-manager-settings/records https://firefox.settings.services.mozilla.com/v1/buckets/mai... This is the JSON schema for this API endpoint: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/addons-manager-settings https://firefox.settings.services.mozilla.com/v1/buckets/mai... More information on the remote settings in general: AMRemoteSettings Overview - quarantinedDomains: https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/AMRemoteSettings-overview.html#quarantineddomains https://firefox-source-docs.mozilla.org/toolkit/mozapps/exte... Remote Settings documentation: https://remote-settings.readthedocs.io/en/latest/index.html https://remote-settings.readthedocs.io/en/latest/index.html Remote Settings DevTools - where you can see all the remote settings, that get set: https://github.com/mozilla-extensions/remote-settings-devtools https://github.com/mozilla-extensions/remote-settings-devtoo... EDIT: Seems like there are many settings that already get automatically set via AMRemoteSettings (including search-engine configs, cert revocations, dns over https providers, password rules for specific domains, top-sites, URL tracking parameters to clean, etc.). We will see how this new setting will be used, it can be easily disabled (https://support.mozilla.org/en-US/kb/quarantined-domains https://support.mozilla.org/en-US/kb/quarantined-domains) and you will get a warning if an Add-On is blocked from accessing the site. Also seems like there will be a UI for this in v116 (https://bugzilla.mozilla.org/show_bug.cgi?id=1837670 https://bugzilla.mozilla.org/show_bug.cgi?id=1837670), where you can configure this better than just disabling this feature completely.

MagicMoonlight 3y ago

So how much do I have to pay the foundation in order to make sure my ad-funded website can't be adblocked? Google has deep pockets.

Ycdr4thfdd 3y ago

> mozilla-employee-confidential With the exception of addressing critical security issues, why does an organization who positions themselves as a leader of open source software make so many user-unfriendly decisions behind closed doors?

nathants 3y ago

it’s not ideal, but using little snitch to prevent firefox from talking to mozilla should help.

baconfromhell 3y ago

What mozilla wants to censor the hecking internet. How could i have been so foolish. Brah cmon guys we knew thats what they are upto all along.

anonymousiam 3y ago

Disabling the restriction is pretty easy. https://www.askvg.com/fix-some-extensions-are-not-allowed-in-firefox-115-and-later/ https://www.askvg.com/fix-some-extensions-are-not-allowed-in...