3 ms·

Which extensions and which domains, though? I think we can all agree that restricting uBlock from working on YouTube probably isn't going to happen, and you mi

by crote 3y ago

Which extensions and which domains, though? I think we can all agree that restricting uBlock from working on YouTube probably isn't going to happen, and you might want some restrictions on addons accessing all data on a banking website. But where did they draw the line? Is someone still allowed to publish an addon which fixes the interface of an absolutely broken banking website, or which allows you to liberate your own data? Will that only be allowed through vetting? What about things like Dark Mode addons which have access to all websites? Is it possible to explicitly request to be included in the allowlist? I am not against it on principle, but we're missing a loooot of information right now to decide whether this is actually a good thing.

cjsawyer 3y ago
I’d be 100% on-board if they changed this from a list of URL’s they define to a list I define. Web extensions sound great until you realize how much power you’re handing to arbitrary code once you allow it reading and writing to the DOM. They can forward anything to anywhere, sandboxing goes out the window
- cycomanic 3y ago
  But if you read the related bug reports it is a list that you define, it just can get some defaults from Mozilla.
  - hu3 3y ago
    Defaults matter. I'd be okay if they had suggestions, but I'm not okay with them blocking extensions on certain websites of their choice by default.
icodestuff 3y ago
Looks like there will be a UI to control this 116, and the block list is empty in 115. I’m pretty stoked for this. Every time I install an extension I wonder what’s going to happen to my banking info if an update ever gets hijacked. This is a much better solution than turning all my extensions off and on when I visit financial websites.
- pieter_mj 3y ago
  A separate 'financial' firefox profile would be more convenient and more secure.
- ddtaylor 3y ago
  > Every time I install an extension I wonder what’s going to happen to my banking info if an update ever gets hijacked. This is a much better solution than turning all my extensions off and on when I visit financial websites. Extensions already contain a whitelist of what domains they are allowed to interact with. It's shown when you first install the extension and at any time you can see it later by looking at the extension in the settings.
  - square_usual 3y ago
    And a better version of this feature would involve a UI where you can select which extensions can access which pages, like Safari (and Orion, which is based on WebKit) does.
  - icodestuff 3y ago
    Ad blockers and password managers are primarily what I’m installing, and they interact with all sites.
zymhan 3y ago
> If you are aware of the associated risk and still wish to allow the add-ons that have been disallowed on a website by Mozilla, you can do it from the configuration editor (about:config)
mcpackieh 3y ago
> I think we can all agree that restricting uBlock from working on YouTube probably isn't going to happen, Mozilla gets paid by Google, and Google is experimenting with blocking adblockers on youtube so... no. I don't agree with you.
- djur 3y ago
  Everybody will know if this happens, though. Why not save the vitriol for when and if it actually happens?
  - mcpackieh 3y ago
    Because by then it will be too late, letting the enemy take ground before mounting a defense is completely foolish. Maybe you're lacking some context so I'll clue you in: Mozilla already burned all their trust. This incident isn't occurring in a vacuum. And why did they mark this matter as employee confidential, if they're not plotting something shady?
    - djur 3y ago
      Mozilla could at any time release a new version that does the nefarious things you're concerned about, and they could do it in a much more secretive way. The way they've approached this is consistent with their stated goals for this feature. I don't consider Mozilla to be the "enemy" and I have no idea what you mean by them burning their trust, but if you distrust them, I'd advise not using their software.
lucb1e 3y ago
> you might want some restrictions on addons accessing all data on a banking website I might want to be control of that myself rather than having Mozilla trying to index all banking websites in the world and not being able to use accessibility tools on those they found
- Lariscus 3y ago
  Good news, there is a UI in v116. See: https://bugzilla.mozilla.org/show_bug.cgi?id=1837670 https://bugzilla.mozilla.org/show_bug.cgi?id=1837670
throwawaymobule 3y ago
If an extension that fixed an online banking website (non malicious and bug-free) got popular enough for them to notice, I'd expect some hamfisted effort on the bank's part to stop you using it. Probably taking out many other extensions/browsers with it.

by crote 3y ago

cjsawyer 3y ago

I’d be 100% on-board if they changed this from a list of URL’s they define to a list I define. Web extensions sound great until you realize how much power you’re handing to arbitrary code once you allow it reading and writing to the DOM. They can forward anything to anywhere, sandboxing goes out the window

cycomanic 3y ago
But if you read the related bug reports it is a list that you define, it just can get some defaults from Mozilla.
- hu3 3y ago
  Defaults matter. I'd be okay if they had suggestions, but I'm not okay with them blocking extensions on certain websites of their choice by default.

icodestuff 3y ago

Looks like there will be a UI to control this 116, and the block list is empty in 115. I’m pretty stoked for this. Every time I install an extension I wonder what’s going to happen to my banking info if an update ever gets hijacked. This is a much better solution than turning all my extensions off and on when I visit financial websites.

pieter_mj 3y ago
A separate 'financial' firefox profile would be more convenient and more secure.
ddtaylor 3y ago
> Every time I install an extension I wonder what’s going to happen to my banking info if an update ever gets hijacked. This is a much better solution than turning all my extensions off and on when I visit financial websites. Extensions already contain a whitelist of what domains they are allowed to interact with. It's shown when you first install the extension and at any time you can see it later by looking at the extension in the settings.
- square_usual 3y ago
  And a better version of this feature would involve a UI where you can select which extensions can access which pages, like Safari (and Orion, which is based on WebKit) does.
- icodestuff 3y ago
  Ad blockers and password managers are primarily what I’m installing, and they interact with all sites.

zymhan 3y ago

> If you are aware of the associated risk and still wish to allow the add-ons that have been disallowed on a website by Mozilla, you can do it from the configuration editor (about:config)

mcpackieh 3y ago

> I think we can all agree that restricting uBlock from working on YouTube probably isn't going to happen, Mozilla gets paid by Google, and Google is experimenting with blocking adblockers on youtube so... no. I don't agree with you.

djur 3y ago
Everybody will know if this happens, though. Why not save the vitriol for when and if it actually happens?
- mcpackieh 3y ago
  Because by then it will be too late, letting the enemy take ground before mounting a defense is completely foolish. Maybe you're lacking some context so I'll clue you in: Mozilla already burned all their trust. This incident isn't occurring in a vacuum. And why did they mark this matter as employee confidential, if they're not plotting something shady?
  - djur 3y ago
    Mozilla could at any time release a new version that does the nefarious things you're concerned about, and they could do it in a much more secretive way. The way they've approached this is consistent with their stated goals for this feature. I don't consider Mozilla to be the "enemy" and I have no idea what you mean by them burning their trust, but if you distrust them, I'd advise not using their software.

lucb1e 3y ago

> you might want some restrictions on addons accessing all data on a banking website I might want to be control of that myself rather than having Mozilla trying to index all banking websites in the world and not being able to use accessibility tools on those they found

Lariscus 3y ago
Good news, there is a UI in v116. See: https://bugzilla.mozilla.org/show_bug.cgi?id=1837670 https://bugzilla.mozilla.org/show_bug.cgi?id=1837670

throwawaymobule 3y ago

If an extension that fixed an online banking website (non malicious and bug-free) got popular enough for them to notice, I'd expect some hamfisted effort on the bank's part to stop you using it. Probably taking out many other extensions/browsers with it.