4 ms·

This is crazy. Mozilla can remotely disable extensions on any domain that Mozilla chooses? https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 https://bugzilla

by lapcat 3y ago

This is crazy. Mozilla can remotely disable extensions on any domain that Mozilla chooses? https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 Apparently they're luring everyone into accepting this abomination by starting with an empty list, but what in the world is the motivation for this feature, and which domains do they intend to add??? "We don't know, we just thought it would be a good idea" is no explanation or justification. People are going to talk about "security" and "banking", but that's a load of crap. Just wait until your bank disables password autofill and paste on their site, and no extension can override it. I have no problem with letting the user control the domains that an extension can access, but giving Mozilla remote control? No way.

BaseballPhysics 3y ago
Given you can just go override Firefox and enable disabled extensions, I'm not sure I understand the outrage. Then again, Mozilla does seem to attract a remarkable level of vitriol despite being one of the true stewards of an open internet...
- dotancohen 3y ago
  > Given you can just go override Firefox and enable disabled extensions No, _you_ can just go override Firefox and enable disabled extensions. The average user can not do that. _I_ can bore out a V-8 0.030 over, choose a proper cam, match all my bearing clearances, assemble the thing balanced, and then tune 30% more power out of it than it came with from the factory. But not all automobile drivers can do that.
  - BaseballPhysics 3y ago
    I'm gonna wager by far the majority of people who will actually get affected or outraged by this have the technical wherewithal to click a little gear icon and re-enable an extension. Everyone else is running maybe uBlock and a privacy extension that their kid installed for them, and those will be whitelisted. This is a tempest in a teapot, just like every other "controversy" that Firefox finds themselves embroiled in.
    - lapcat 3y ago
      > I'm gonna wager by far the majority of people who will actually get affected We have no idea who will be affected, because Mozilla hasn't specified their plans for this "feature". > Everyone else is running maybe uBlock and a privacy extension that their kid installed for them, and those will be whitelisted. I'm an extension developer myself. I'm not ok with a world where a tiny number of lucky extensions get whitelisted, while my extension and everyone else's extensions get silently, remotely disabled by Firefox.
      - BaseballPhysics 3y ago
        They literally wrote a blog post about how they're going to use this feature. In what way have they not "specified their plans"? > I'm an extension developer myself. I'm not ok with a world where a tiny number of lucky extensions get whitelisted, while my extension and everyone else's extensions get silently, remotely disabled by Firefox Ah, now I see the real concern. Honestly, I'm not that sympathetic. Extensions have always been a potential security liability and anything that protects less savvy users when accessing online banking or other sensitive services is a good thing. Heavy extension use is the hallmark of a power user. Power users can configure Firefox to enable these extensions (Mozilla has specifically said they plan to deliver more user controls in 116), so I personally don't see the problem.
        lapcat 3y ago
        > They literally wrote a blog post about how they're going to use this feature. In what way have they not "specified their plans"? Which domains will be quarantined? And which extensions will be exempted? Everyone seems to be assuming "banking" with absolutely no evidence whatsoever. Mozilla hasn't said. There are countless banks in the world. Is Mozilla going to maintain a list of every banking web site? The fact is that nobody knows what the hell Mozilla is going to do with the quarantine list.
        BaseballPhysics 3y ago
        So you assume the worst because you apparently don't trust them. I assume the best because I believe they have an exceptional track record. I see what they say and assume the best intentions. You look at what they don't say and assume the worst. I guess at this point we'll just see how it shakes out.
  - thomasjb 3y ago
    What's your boring setup?
    - dotancohen 3y ago
      Sending it to Ricks )) But I would check it meticulously at the top, middle, and bottom on every cylinder, in two axis, before bolting it together. Trust, but verify.
  - nerdbert 3y ago
    The margin between users who can't figure out how to re-enable the extension, and users who would have imagined the existence of a password-paste-enabling-on-bank-site extension and then sought out and installed it in the first place, has to be vanishingly small. I bet we are talking about tens of people worldwide.
Barrin92 3y ago
> Just wait until your bank disables password autofill and paste on their site, and no extension can override it that would be a fantastic day because autofill based on html/js hackery by extensions is one of the biggest security risks there is. It's why Extensions like Bitwarden caution you to have autofill turned on. Tavis Ormandy (security researcher) demonstrated this last year in a blog post https://lock.cmpxchg8b.com/passmgrs.html https://lock.cmpxchg8b.com/passmgrs.html
- lapcat 3y ago
  > autofill based on html/js hackery by extensions is one of the biggest security risks there is I think you misunderstood. I was talking about sites disabling built-in browser features.
ygjb 3y ago
It's actually ok for you to feel that way! It's also ok for Mozilla to do this, because Mozilla aims to use this to protect users! The internet is already a yard full of rakes for folks, I appreciate things that make it easier for users to protect themselves online. Yes, the feature can be abused, but frankly, at least Firefox is an open source project, and there are methods that can be used to disable this feature, up to and including using or creating a new Firefox fork.
- xcdzvyn 3y ago
  I'm happy to presume it wasn't your intent, but I thought I'd share that this reply comes across, to me at least, as pretty condescending and preachy.
  - ygjb 3y ago
    Nah, it was meant as preachy, but not necessarily condescending. It's absolutely important to challenge Mozilla and other open source projects, especially in this era of enshittification[1]; Mozilla and Firefox operate in a position of trust on behalf of their users. That said, the parent post positioned this as an abomination of a feature, but acknowledged it makes sense as a user feature. The ability to disable add-ons by domain is a great feature for user control, but it's functionally useless on it's own as a mechanism to protect users. In order for that feature to actually protect users, you need a mechanism to turn it on and off remotely so that if a new threat is identified (or there is a serious regression in Firefox that makes specific extensions higher risk), that users don't need to act to do the right thing. This isn't a meaningful loss of user control, and I already said elsewhere that Mozilla should have communicated more about this new feature, but ultimately it's the right kind of feature. [1] https://pluralistic.net/tag/enshittification/ https://pluralistic.net/tag/enshittification/
- xg15 3y ago
  > Yes, the feature can be abused, but frankly, at least Firefox is an open source project So open source that the first thing they did was marking the ticket as confidential.
ThePowerOfFuet 3y ago
>If one or more extensions installed in your web browser have been blocked by this new feature and you want to use those extensions, you can disable the new feature and re-enable those disabled extensions in Firefox.
neilv 3y ago
Quoting #1832791: > We need to have ability to set the list of quarantined domains remotely. [...] Filing as confidential for now, until we ship the system addon. A few questions: * Why would this be confidential? Was it compelled? Is it tied to a commercial deal? * If you ship a facility like this, does that lower the bar to being ordered to use it? (No excuse that it would be difficult/time-consuming/expensive to do, because it's already there, and the list can be updated easily?) * Can changes to this list be done quietly, or with less scrutiny than code changes? And by whom? * Can this be used in a way that targets individual people?
Gigachad 3y ago
Browser extensions have been an unmitigated security train wreck. Not a single person is actually auditing the source code of every extension they use before installation and before each update. And if you are, you should have no issues recompiling firefox without this change.
- lapcat 3y ago
  Browsers have been an unmitigated security train wreck. https://www.mozilla.org/en-US/security/advisories/mfsa2023-22/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-2...
  - Gigachad 3y ago
    Browsers have bugs, meanwhile most extensions are actively malware while also having bugs.
    - lapcat 3y ago
      > most extensions are actively malware Citation needed. This seems like scaremongering to me. Moreover, even if your claim were true, which it's not, then this new Firefox feature wouldn't actually do much, because it only disables extensions on a select list of sites, currently empty.
cycomanic 3y ago
If you actually read the linked bug report (https://bugzilla.mozilla.org/show_bug.cgi?id=1745823 https://bugzilla.mozilla.org/show_bug.cgi?id=1745823) they talk about making the list user configurable. I actually agree that having a per extension list for disabling on some websites would be nice (some websites break with extensions, e.g. I use tridactyl for Vim like Navigation, but if I work on e.g. Overleaf things get into the way of each other and so I turn it off via mode ignore)
- lapcat 3y ago
  > If you actually read the linked bug report (https://bugzilla.mozilla.org/show_bug.cgi?id=1745823 https://bugzilla.mozilla.org/show_bug.cgi?id=1745823) I did. > they talk about making the list user configurable. As I said, "I have no problem with letting the user control the domains that an extension can access". Indeed, Safari already has this feature. Funny how Mozilla implemented the remote kill switch before they implemented the user control, though. Also, AFAIK neither Safari nor Chrome has a remote domain list kill switch, so it's unclear what "security" problem it's supposed to solve.
  - TheCoelacanth 3y ago
    AFAIK, Safari and Chrome extensions are far less powerful than Firefox extensions, so it makes sense that they would be less worried about malicious ones.
    - lapcat 3y ago
      How are Chrome extensions less powerful than Firefox extensions? Also, Safari extensions are perfectly capable of reading and stealing your password on banking websites, which is what everyone seems to be concerned about. In fact, there's a warning about that in the Safari extensions user interface: "Can read sensitive information from webpages, including passwords, phone numbers, and credit cards."

by lapcat 3y ago

BaseballPhysics 3y ago

Given you can just go override Firefox and enable disabled extensions, I'm not sure I understand the outrage. Then again, Mozilla does seem to attract a remarkable level of vitriol despite being one of the true stewards of an open internet...

dotancohen 3y ago
> Given you can just go override Firefox and enable disabled extensions No, _you_ can just go override Firefox and enable disabled extensions. The average user can not do that. _I_ can bore out a V-8 0.030 over, choose a proper cam, match all my bearing clearances, assemble the thing balanced, and then tune 30% more power out of it than it came with from the factory. But not all automobile drivers can do that.
- BaseballPhysics 3y ago
  I'm gonna wager by far the majority of people who will actually get affected or outraged by this have the technical wherewithal to click a little gear icon and re-enable an extension. Everyone else is running maybe uBlock and a privacy extension that their kid installed for them, and those will be whitelisted. This is a tempest in a teapot, just like every other "controversy" that Firefox finds themselves embroiled in.
  - lapcat 3y ago
    > I'm gonna wager by far the majority of people who will actually get affected We have no idea who will be affected, because Mozilla hasn't specified their plans for this "feature". > Everyone else is running maybe uBlock and a privacy extension that their kid installed for them, and those will be whitelisted. I'm an extension developer myself. I'm not ok with a world where a tiny number of lucky extensions get whitelisted, while my extension and everyone else's extensions get silently, remotely disabled by Firefox.
    - BaseballPhysics 3y ago
      They literally wrote a blog post about how they're going to use this feature. In what way have they not "specified their plans"? > I'm an extension developer myself. I'm not ok with a world where a tiny number of lucky extensions get whitelisted, while my extension and everyone else's extensions get silently, remotely disabled by Firefox Ah, now I see the real concern. Honestly, I'm not that sympathetic. Extensions have always been a potential security liability and anything that protects less savvy users when accessing online banking or other sensitive services is a good thing. Heavy extension use is the hallmark of a power user. Power users can configure Firefox to enable these extensions (Mozilla has specifically said they plan to deliver more user controls in 116), so I personally don't see the problem.
      - lapcat 3y ago
        > They literally wrote a blog post about how they're going to use this feature. In what way have they not "specified their plans"? Which domains will be quarantined? And which extensions will be exempted? Everyone seems to be assuming "banking" with absolutely no evidence whatsoever. Mozilla hasn't said. There are countless banks in the world. Is Mozilla going to maintain a list of every banking web site? The fact is that nobody knows what the hell Mozilla is going to do with the quarantine list.
        BaseballPhysics 3y ago
        So you assume the worst because you apparently don't trust them. I assume the best because I believe they have an exceptional track record. I see what they say and assume the best intentions. You look at what they don't say and assume the worst. I guess at this point we'll just see how it shakes out.
- thomasjb 3y ago
  What's your boring setup?
  - dotancohen 3y ago
    Sending it to Ricks )) But I would check it meticulously at the top, middle, and bottom on every cylinder, in two axis, before bolting it together. Trust, but verify.
- nerdbert 3y ago
  The margin between users who can't figure out how to re-enable the extension, and users who would have imagined the existence of a password-paste-enabling-on-bank-site extension and then sought out and installed it in the first place, has to be vanishingly small. I bet we are talking about tens of people worldwide.

Barrin92 3y ago

> Just wait until your bank disables password autofill and paste on their site, and no extension can override it that would be a fantastic day because autofill based on html/js hackery by extensions is one of the biggest security risks there is. It's why Extensions like Bitwarden caution you to have autofill turned on. Tavis Ormandy (security researcher) demonstrated this last year in a blog post https://lock.cmpxchg8b.com/passmgrs.html https://lock.cmpxchg8b.com/passmgrs.html

lapcat 3y ago
> autofill based on html/js hackery by extensions is one of the biggest security risks there is I think you misunderstood. I was talking about sites disabling built-in browser features.

ygjb 3y ago

It's actually ok for you to feel that way! It's also ok for Mozilla to do this, because Mozilla aims to use this to protect users! The internet is already a yard full of rakes for folks, I appreciate things that make it easier for users to protect themselves online. Yes, the feature can be abused, but frankly, at least Firefox is an open source project, and there are methods that can be used to disable this feature, up to and including using or creating a new Firefox fork.

xcdzvyn 3y ago
I'm happy to presume it wasn't your intent, but I thought I'd share that this reply comes across, to me at least, as pretty condescending and preachy.
- ygjb 3y ago
  Nah, it was meant as preachy, but not necessarily condescending. It's absolutely important to challenge Mozilla and other open source projects, especially in this era of enshittification[1]; Mozilla and Firefox operate in a position of trust on behalf of their users. That said, the parent post positioned this as an abomination of a feature, but acknowledged it makes sense as a user feature. The ability to disable add-ons by domain is a great feature for user control, but it's functionally useless on it's own as a mechanism to protect users. In order for that feature to actually protect users, you need a mechanism to turn it on and off remotely so that if a new threat is identified (or there is a serious regression in Firefox that makes specific extensions higher risk), that users don't need to act to do the right thing. This isn't a meaningful loss of user control, and I already said elsewhere that Mozilla should have communicated more about this new feature, but ultimately it's the right kind of feature. [1] https://pluralistic.net/tag/enshittification/ https://pluralistic.net/tag/enshittification/
xg15 3y ago
> Yes, the feature can be abused, but frankly, at least Firefox is an open source project So open source that the first thing they did was marking the ticket as confidential.

ThePowerOfFuet 3y ago

>If one or more extensions installed in your web browser have been blocked by this new feature and you want to use those extensions, you can disable the new feature and re-enable those disabled extensions in Firefox.

neilv 3y ago

Quoting #1832791: > We need to have ability to set the list of quarantined domains remotely. [...] Filing as confidential for now, until we ship the system addon. A few questions: * Why would this be confidential? Was it compelled? Is it tied to a commercial deal? * If you ship a facility like this, does that lower the bar to being ordered to use it? (No excuse that it would be difficult/time-consuming/expensive to do, because it's already there, and the list can be updated easily?) * Can changes to this list be done quietly, or with less scrutiny than code changes? And by whom? * Can this be used in a way that targets individual people?

Gigachad 3y ago

Browser extensions have been an unmitigated security train wreck. Not a single person is actually auditing the source code of every extension they use before installation and before each update. And if you are, you should have no issues recompiling firefox without this change.

lapcat 3y ago
Browsers have been an unmitigated security train wreck. https://www.mozilla.org/en-US/security/advisories/mfsa2023-22/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-2...
- Gigachad 3y ago
  Browsers have bugs, meanwhile most extensions are actively malware while also having bugs.
  - lapcat 3y ago
    > most extensions are actively malware Citation needed. This seems like scaremongering to me. Moreover, even if your claim were true, which it's not, then this new Firefox feature wouldn't actually do much, because it only disables extensions on a select list of sites, currently empty.

cycomanic 3y ago

If you actually read the linked bug report (https://bugzilla.mozilla.org/show_bug.cgi?id=1745823 https://bugzilla.mozilla.org/show_bug.cgi?id=1745823) they talk about making the list user configurable. I actually agree that having a per extension list for disabling on some websites would be nice (some websites break with extensions, e.g. I use tridactyl for Vim like Navigation, but if I work on e.g. Overleaf things get into the way of each other and so I turn it off via mode ignore)

lapcat 3y ago
> If you actually read the linked bug report (https://bugzilla.mozilla.org/show_bug.cgi?id=1745823 https://bugzilla.mozilla.org/show_bug.cgi?id=1745823) I did. > they talk about making the list user configurable. As I said, "I have no problem with letting the user control the domains that an extension can access". Indeed, Safari already has this feature. Funny how Mozilla implemented the remote kill switch before they implemented the user control, though. Also, AFAIK neither Safari nor Chrome has a remote domain list kill switch, so it's unclear what "security" problem it's supposed to solve.
- TheCoelacanth 3y ago
  AFAIK, Safari and Chrome extensions are far less powerful than Firefox extensions, so it makes sense that they would be less worried about malicious ones.
  - lapcat 3y ago
    How are Chrome extensions less powerful than Firefox extensions? Also, Safari extensions are perfectly capable of reading and stealing your password on banking websites, which is what everyone seems to be concerned about. In fact, there's a warning about that in the Safari extensions user interface: "Can read sensitive information from webpages, including passwords, phone numbers, and credit cards."