13 ms·

Firefox 115 can remotely disable any extension on any site

357 points by signa11 3y ago

threesevenths 3y ago
Put on a tinfoil hat, the Google search contract is up for renewal this year, and YouTube is getting serious about ad blockers. I could see YT domains sliding into this list over time after a new search agreement is reached.
readyzero 3y ago
I'm surprised no one mentioned vivaldi browser as alternative https://vivaldi.com/ https://vivaldi.com/ , I've been testing it for a few months now and I'm quite pleased with it, still need to adapt my habits to control navigation on it (heavy user of Firefox here..), but overall I think it's an interesting alternative.
causi 3y ago
As if we needed yet another reminder Firefox doesn't respect its users' extension choices, after their crippling of Firefox Mobile and the earlier expired certificate debacle.
- Vt71fcAqt7 3y ago
  why is this downvoted? They literaly don't care about their users at all, in any sense. Major features that chrome has for years are ignored in now decades long bug reports while they continue to add google telemetry and waste all the money google gives them on VPNs, pocket and now AI. Is there any other open source project that does this? They are a project, not a comapny. They don't need to pay millions of dollars to a CEO so they can catch the AI train they just need to be a web browser. I used to use violentmonkey to fix websites that I don't like for various reasons. After they rewrote firefox mobile they tried to and mostly succeeded in getting rid of extensions, which IIRC they claimed they didn't know people cared so much about. Now you need a firefox account and firefox nightly (with even more telemetry) to use perfectly working extensions which aren't included in their whitelist. In what way does this show respecting its users' extension choices?
  - BaseballPhysics 3y ago
    > why is this downvoted? They literaly don't care about their users at all, in any sense. Because comments like this add nothing to the discourse. They're angry opinions that serve only to attract controversy. I'd call it flamebait except I do think the comments are made in good faith, even if they aren't constructive or particularly interesting.
    - causi 3y ago
      Multiple Firefox developers have commented in posts about Firefox. They read HN. I remind them that their choices are still causing grief to their users, at least as long as Firefox has any users left.
  - throw16180339 3y ago
    I downvoted because it's snarky and doesn't mention the topic at all.
RMPR 3y ago
> My own extension StopTheMadness stops web sites from disabling your browser's built-in paste and autofill features, a kind of madness commonly implemented by sites that have a misguided, ignorant notion about what makes a login form "secure" Now, this is an extension I didn't know I needed. I'm baffled that there are some things without which the web is unusable for me. Looking at my extension list, on Firefox I have: - ClearURLs - Clickbait remover for YouTube - Cookie Autodelete - Firefox Multi-account container - I don't care about cookies (not updated since bought by Avast) - Privacy badger - Tampermonkey - Tridactyl - uBlock Origin I feel like I'm pretty conservative with the add-ons that I install, yet I can't comfortably browse the web if I'm missing one of them. When did everything go so wrong?
- kentrf 3y ago
  Try Consent-O-Matic instead of IDCAC. It is possible to reject consent instead of blindly accepting them with IDCAC... and also the Avast thing
  - deleted 3y ago
    [deleted]
  - ibejoeb 3y ago
    I think the point of these is that GDPR requires an affirmative action, i.e., there is no need to decline, so just get the shitty overlays out of the way. Consent-O-Matic submits those forms on your behalf. I don't want that. I'd rather not participate at all.
- mostlysimilar 3y ago
  Here's the non-enshittified version of "I don't care about cookies": https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies/ https://addons.mozilla.org/en-US/firefox/addon/istilldontcar... Yes, the web is hostile. It's frankly incredible we're still allowed the power to control our user agents like we do. If the web was built today it would be a locked down nightmare controlled 100% by corporate interests.
  - 3y ago
ilyt 3y ago
[flagged]
- BaseballPhysics 3y ago
  Its just more fear mongering, in this case from an extension developer that thinks this'll cut into their user numbers. The feature isn't even fully built yet (116 will include more iteration on this and meanwhile 115 ships with no domains in the quarantine list). But every little hint of a possible misstep by Mozilla turns into a drama vortex in this community these days.
  - logicprog 3y ago
    Mozilla does do a lot of underhanded or anti-user things, including the boatloads of telemetry some of which goes through Google Analytics. However, Mozilla is still a lot better than Google, and Firefox is leaps and bounds better than Chrome in terms of privacy, even given all of the problematic things Mozilla has done, even if the fact that there's a big controversy every time Firefox does something bad while everyone just expects Chrome to do bad things and so doesn't talk about it gives the impression that Firefox is worse. I think that's actually the reason why there's a big outcry every time Mozilla does something like this — Mozilla Firefox is kind of one of the last browsers to be relatively respecting of people's privacy and definitely one of the last ones outside of Google's Chromium dominion, so it means a lot more when they do bad things.
    - rightbyte 3y ago
      > Mozilla does do a lot of underhanded or anti-user things, including the boatloads of telemetry some of which goes through Google Analytics What? For real? How hard can it be to not be a Google shill ... They have to have really toxic people internally pushing all these anti-feutures down our throats. I refuse to believe the whole org. is rotten.
  - ilyt 3y ago
    That from company that force-installed addons for marketing purposes... and you wonder why people are careful around another "genius" idea from Mozilla.
deleted 3y ago
[deleted]
sanqui 3y ago
StopTheMadness appears to be a Firefox extension that's only available for Mac users?
- kemayo 3y ago
  I believe it's sold through the Mac App Store, because the Firefox extension is an outgrowth of the preexisting Safari extension. https://lapcatsoftware.com/articles/StopTheMadness-Firefox.html https://lapcatsoftware.com/articles/StopTheMadness-Firefox.h...
- drewg123 3y ago
  Ah, that explains why I could not find it!
arp242 3y ago
Discussed yesterday: https://news.ycombinator.com/item?id=36591247 https://news.ycombinator.com/item?id=36591247
beebeepka 3y ago
Didn't we cover this yesterday https://news.ycombinator.com/item?id=36591247 https://news.ycombinator.com/item?id=36591247
DistractionRect 3y ago
There's already been some good discussion on this, I find this comment the most enlightening: https://news.ycombinator.com/item?id=36591247#36591664 https://news.ycombinator.com/item?id=36591247#36591664 Basically it's intended to be a user defined middle ground between allowing permissions everywhere vs the developer hand curating a list of allowed sites.
- jchw 3y ago
  > user defined Hmmm... > We need to have ability to set the list of quarantined domains remotely. > Filing as confidential for now, > "Only some extensions monitored by Mozilla are allowed on this site to protect your data." I didn't know Mozilla was the user of my local Firefox instance :P (Well, doesn't matter much to me honestly. I only use LibreWolf.)
  - DistractionRect 3y ago
    As commented, 116 will have a UI to allow the user to better control this. As I understand it, this just a safetly precaution. They will likely default opt out unmonitored extensions from certain high value sites (banks, email, etc) and allow users to explicitly opt back in. This, to me, seems perfectly reasonable
    - jchw 3y ago
      Oh no, I love it when developers ship features that'll be perfectly reasonable in the next release, and people defend that as if it's some kind of catch 22 versus what they actually shipped. What I said describes accurately the actual thing they shipped. A remote kill switch that's nearly completely opaque to the user. That's what shipped today. If you want Mozilla to get a free pass, that's your business. To me, what they shipped matters and said about it matters too. It says a lot about Mozilla that they seemingly didn't see how this would look optically, or perhaps simply don't care. And no, "Chrome is worse" is not a good answer. I don't want good to be the enemy of great, but I'm not making excuses for enshittification either.
kemayo 3y ago
The article is right that we've not seen any communication about Mozilla as to how they intend to use this, so we can only speculate about why they might want the feature. My own speculation is that this is them warding against extension-takeovers, where people sell off their semi-successful extension to some company which then fills it up with spyware. If Mozilla fills up their quarantine list with domains that're easy targets for stealing valuable information (banks, etc), that'd reduce the incentive to do such takeovers.
- londons_explore 3y ago
  Mozilla already control the update process, so could easily stop extension authors pushing malicious updates after a takeover.
  - ghayes 3y ago
    It’s quite possible that a malicious takeover is only diagnosed after the fact. Updates might appear innocuous at first but later be incredibly user-hostile.
  - 16bitvoid 3y ago
    I'm not familiar with extension development or their capabilities, but perhaps the extension author can remotely activate the malicious parts after it passes the update process and perhaps Mozilla doesn't have the manpower to manually review the code of every extension update?
  - kemayo 3y ago
    I think that's the difference between "monitored" and "unmonitored" extensions, as called out in the article. Monitored extensions are presumably ones where they actually verify the updates, and so they think it's fine to let them run on sensitive sites.
  - Clamchop 3y ago
    Why do you say easily? Software is an endless parade of creative exploits both intentional and accidental, it's never seemed like an easy problem to solve.
deleted 3y ago
[deleted]
kemotep 3y ago
This isn’t just their extension, if I am reading this correctly it is any extension(that hasn’t been vetted by Mozilla) is capable of being blocked from running due to this this new quarantined domain list that Firefox 115 has. However this feature can be disabled, or otherwise overridden at this time by the end user when following the documentation[0]. I can understand the concern here, but this change is being communicated, can be user managed, and the best faith interpretation I can come up with, is in fact for security purposes. It creates restrictions on (at least from Mozilla’s perspective) untrusted extensions. I mean how many extensions are there that do act maliciously? It probably isn’t trivial. I highly recommend you use a minimum amount of extensions anyway. The OP’s extension is a good one from what I can tell but I really only use uBlock Origin, Bitwarden, and tab containers at this point. I guess whenever I use Gnome I end up having to use their extension too which is frustrating but a different story. Will have to pay attention to this feature. Thanks for sharing the link. [0]: https://support.mozilla.org/en-US/kb/quarantined-domains https://support.mozilla.org/en-US/kb/quarantined-domains
- TheRealPomax 3y ago
  "We've taken away your power and hidden it behind a setting that we have no obligation to maintain" seems to have been the Firefox motto for the last ten years, and continues to go strong.
  - kemotep 3y ago
    It is increasingly frustrating but in my opinion Firefox is the only usable browser. The ads and other nonsense, despite being pushed out often, are still user controllable and once configured, I have always had my settings honored. You cannot say the same about Edge and if app manifest v3 actually does what people say does, Chrome will essentially be undergoing the same cut off of extension capabilities that Firefox Quantum did years ago but even worst.
    - cglong 3y ago
      I'm wary of Manifest v3, but like you say, it isn't a mandate yet. Is there any reason today why Chrome isn't usable? There's also Brave, which I love on Android.
xanathar 3y ago
Fun stuff, I would have bet that this was to stop adblockers on YouTube, and yet an adblocker on YouTube is the only extension that works.
logicprog 3y ago
It really makes me sad every time Mozilla pulls stuff like this in Firefox. Firefox is basically the last usable mainstream browser outside of Google's indirect dominion via Chromium, and one of the few somewhat privacy respecting ones as well. I'm glad I project like LibreWolf exists to undo and rip out all of the stuff like this so that I can have a truly private and secure browser that isn't based on chromium instead of having to switch to Brave or something, because as much as I value my privacy and security I also value not giving in to Google's browser monopoly.
- stalfosknight 3y ago
  Safari is quite usable and very mainstream.
  - logicprog 3y ago
    Is it FLOSS? Also, I don't really like Apple's software (or hardware), and I'd prefer a browser that was outside of all those large ecosystems/walled gardens. Safari probably is a cut above most though, AppleApple's relationship to privacy is... complicated.
    - stalfosknight 3y ago
      There's an entire universe of useful and well-designed software that isn't FLOSS. Being free or open source isn't the be-all and end-all for most people.
  - simlevesque 3y ago
    > Safari is quite usable The majority of device with web browsers cannot use Safari. I can't use it at all.
    - logicprog 3y ago
      Yeah like I don't own any apple devices so it is useless to me
Thissitesucks00 3y ago
I don't think this is new, is it? For at least the last couple of years (maybe longer, that's just how long I've used Firefox on Windows) some sites are hardcoded not to allow extensions to run on them. As an example, add-ons don't run on addons.mozilla.org for security purposes. Is there any reason to think this is a conspiracy about ad blockers? I haven't seen anything that indicates this isn't the same as the addons.mozilla.org situation.
- lapcat 3y ago
  > I don't think this is new, is it? How can you say it's not new when it's literally in the release notes for yesterday's Firefox update? > For at least the last couple of years (maybe longer, that's just how long I've used Firefox on Windows) some sites are hardcoded not to allow extensions to run on them. Yes, the setting extensions.webextensions.restrictedDomains is old, and it applies to every extension, including uBlock Origin. The domains are all Mozilla. Here's the complete list: accounts-static.cdn.mozilla.net,accounts.firefox.com,addons.cdn.mozilla.net,addons.mozilla.org,api.accounts.firefox.com,content.cdn.mozilla.net,discovery.addons.mozilla.org,install.mozilla.org,oauth.accounts.firefox.com,profile.accounts.firefox.com,support.mozilla.org,sync.services.mozilla.com
  - deleted 3y ago
    [deleted]
hexage1814 3y ago
Only requiring developers to sign their extensions so that they can run on firefox wasn't enough – as mozilla had already done back in 2015 or so. No, no, no, in the name of safety we need to make sure your extension doesn't run on forbidden sites. https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/ https://blog.mozilla.org/addons/2015/02/10/extension-signing...
Santosh83 3y ago
We've almost come full circle with browser extensions, from being rare or non-existent to the zenith of popularity and power in the pre-Quantum Firefox days to now back to being increasingly whitelisted and sandboxed into unpopularity.
12345hn6789 3y ago
It's impressive how well Firefox does at making it hard to justify using Firefox. Can't wait until 116 release to see what other feature they removed or anti pattern they decided should be opted into by default for "confidential reasons"
Cyder 3y ago
my first thought: they'll collect money from sites to disable adblockers and other ext. I gave up on Mozilla 5 or so years ago because they ARE sneaky about being corporate sellouts and anti privacy. At least the browsers i use now don't PRETEND to be privacy focused.
qwertyuiop_ 3y ago
Ministry of truth
aweirljslfj 3y ago
relevant links all the bugzilla items: https://bugzilla.mozilla.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=RESOLVED&bug_status=VERIFIED&bug_status=CLOSED&f1=classification&short_desc_type=anywordssubstr&query_format=advanced&j2=OR&f2=OP&short_desc=quarantined%20domains&o1=notequals&f3=CP&v1=Graveyard https://bugzilla.mozilla.org/buglist.cgi?bug_status=UNCONFIR... if you have access to their project tracking, it's under WEBEXT-1351 (would love if someone can post the entire reasoning for the feature here, as their conversations are now behind login which i didn't bother to secure) The code for what the user can see/allow per-domain https://hg.mozilla.org/mozilla-central/rev/4399291987d9 https://hg.mozilla.org/mozilla-central/rev/4399291987d9 (not released as far as i can tell) you can see the file locally via `resource://gre/modules/ExtensionPermissions.sys.mjs` in your address bar. and lastly, the dev doc on how to push those values to live user browsers https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/AMRemoteSettings-overview.html https://firefox-source-docs.mozilla.org/toolkit/mozapps/exte... this is already how it works on Firefox for android, with NO USER WHITELIST OPTION... the only workaround on android is to add another hidden setting that points to a user-defined collection in addons.mozilla.org, which will be the allowed extension list instead of mozilla's. edit; HOLY SHIT!!! just updated firefox for android, and they removed access to about:config there in the last version! (ps: they had already removed since 2020 for "regular lowly users" who do not install experimental version, their words. Now it is also removed from f-droid stable build since last version. I didn't see it mentioned on the release notes, so they either strong armed the maintainer or slipped changes past them)
- mutant 3y ago
  I noticed this on Android a while ago, and bailed on FF. Their trajectory feels so anti-user, I was like "welp, figure out how to live in a chromium world where I know I'm under constant attack"
Animats 3y ago
Is there a list of all the things for which Firefox now "phones home"? "Sync", "Pocket", Firefox updates, extension updates, the bad site blocklist, and this. What else?
- lapcat 3y ago
  https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... https://support.mozilla.org/en-US/kb/domains-allow-firefox https://support.mozilla.org/en-US/kb/domains-allow-firefox
__fst__ 3y ago
I can see the need to deactivate some extensions on certain websites. For me that's mostly a "make the site work" workaround than a security feature but anyway. I can recommend using different browser profiles for specific setups (e.g. banking). Linux Mint has the Web Apps feature (https://www.makeuseof.com/how-to-create-a-web-app-in-linux-mint/ https://www.makeuseof.com/how-to-create-a-web-app-in-linux-m...) that lets you configure different browser profiles and as a bonus it turns the web site into a desktop app. The downside of it is that each browser profile needs its own config, i.e. you have a lot of repeated overhead and you need to reinstall extensions into every profile. But on the flipside I can control which extensions I want to have in there.
m4lvin 3y ago
Once more I an happy to use the ESR version of Firefox where stuff like this tends to only land much later. Add on top of that the Debian patches and default settings and it's a fine user-agent again :-) Edit: oops, looks like 115 is the next ESR version, does that mean it gets this "feature" but for a long time will not get proper UI go control it? :-(
munro 3y ago
what the heck is this person crying about. the amount of attention & level of seriousness raised is totally not justified..... after reading the changes, they're fine. ok you're /indie/ extension is safe (or so you claim), but so many out there are extremely dangerous. let mozilla cook
- xigoi 3y ago
  If I don't consider an extension safe, I won't install it. I don't want some company to make choices for me.
Zren 3y ago
Tampermonkey (Userscripts) has a similar default blocklist. It blocks by default: example.org, paypal.tld, stripe.com, deutsche-bank-24.tld, bankofamerica.tld, apis.google.com, www.facebook.com/plugins/, platform.twitter.com/widgets
rvz 3y ago
Not your browser. Seems like there is no benefit to using Firefox. Just use Brave.
- deleted 3y ago
  [deleted]
dang 3y ago
Recent and related: Mozilla restricts extensions on some domains on Firefox 115 - https://news.ycombinator.com/item?id=36591247 https://news.ycombinator.com/item?id=36591247 - July 2023 (91 comments)
ibejoeb 3y ago
What I really want is extension integration with container tabs, so that I can partition the extensions myself. For example, I probably want my banking container to have no extensions, but my news container to have all of the ad-blockers, link cleaners, etc.
- haxiel 3y ago
  Not a perfect solution to this scenario, but I have used multiple Firefox profiles in the past this way. The profiles are isolated at the file-system level, so extensions remain separate. So you could have a 'hardened' profile will all the blocking/cleaning extensions, and a 'trusted' profile with no extensions. Profile isolation also covers configuration, so you could even tweak those independently.
  - ibejoeb 3y ago
    I've experimented with that from time to time, but it hasn't stuck. The problem is when I click through. Container tabs handles that, but I would have to be extremely vigilant to prevent sites from loading outside of the hardened profile.
giantbanana 3y ago
[flagged]
deleted 3y ago
[deleted]
Sunspark 3y ago
The article isn't clearly stated on this point, but at the current time to block this new behaviour, in about:config create a new boolean named "extensions.quarantinedDomains.enabled" and set the value to false. It's a shame, because I can see where this will lead to beyond the obvious of just extensions today. The domains list will be tied to country codes. So it will become a situation where "if country X then block politically objectionable domain Y!" where Y can be a site that criticizes the ruling party or the usual crew of copyright carpetbaggers wanting various sites blocked from the browser end, etc. And it will actually cover a lot of scope, you already see some of this beginning where they have started blocking some US states from viewing pornography, but with this method, you can block an entire country from all porn domains at once just by making the browser refer to a master blacklist. On the bright side, Firefox may be able to soon access the lucrative North Korean market since all domains will be blocked.
- hexage1814 3y ago
  Interestingly the France government, as well as Porn Hub, both asked for such a a sythem you are describing. Even more interesting is that Mozilla, a few days ago, made a post criticizing this, but it seems that behind the scenes they are pretty much putting all the infrastructure needed for this to be implement pretty soon if they need. https://blog.mozilla.org/netpolicy/2023/06/26/france-browser-website-blocking/ https://blog.mozilla.org/netpolicy/2023/06/26/france-browser... https://www.dailymail.co.uk/news/article-12234299/We-want-porn-boring-Pornhub-owners-say-governments-stop-crackdown-adult-websites.html#:~:text=The%20only%20solution%20that%20accomplishes%20both%20of%20these%20goals%20is%20device%20or%20browser-based%20verification https://www.dailymail.co.uk/news/article-12234299/We-want-po...
- a2128 3y ago
  This is about blocking unverified extensions on specific websites, not blocking access to specific websites
tomkarho 3y ago
Well looks like the browser market is due for some fresh blood and disruption. Good thing Ladybird got huge donations recently.

357 points by signa11 3y ago

Put on a tinfoil hat, the Google search contract is up for renewal this year, and YouTube is getting serious about ad blockers. I could see YT domains sliding into this list over time after a new search agreement is reached.

readyzero 3y ago

I'm surprised no one mentioned vivaldi browser as alternative https://vivaldi.com/ https://vivaldi.com/ , I've been testing it for a few months now and I'm quite pleased with it, still need to adapt my habits to control navigation on it (heavy user of Firefox here..), but overall I think it's an interesting alternative.

causi 3y ago

As if we needed yet another reminder Firefox doesn't respect its users' extension choices, after their crippling of Firefox Mobile and the earlier expired certificate debacle.

Vt71fcAqt7 3y ago
why is this downvoted? They literaly don't care about their users at all, in any sense. Major features that chrome has for years are ignored in now decades long bug reports while they continue to add google telemetry and waste all the money google gives them on VPNs, pocket and now AI. Is there any other open source project that does this? They are a project, not a comapny. They don't need to pay millions of dollars to a CEO so they can catch the AI train they just need to be a web browser. I used to use violentmonkey to fix websites that I don't like for various reasons. After they rewrote firefox mobile they tried to and mostly succeeded in getting rid of extensions, which IIRC they claimed they didn't know people cared so much about. Now you need a firefox account and firefox nightly (with even more telemetry) to use perfectly working extensions which aren't included in their whitelist. In what way does this show respecting its users' extension choices?
- BaseballPhysics 3y ago
  > why is this downvoted? They literaly don't care about their users at all, in any sense. Because comments like this add nothing to the discourse. They're angry opinions that serve only to attract controversy. I'd call it flamebait except I do think the comments are made in good faith, even if they aren't constructive or particularly interesting.
  - causi 3y ago
    Multiple Firefox developers have commented in posts about Firefox. They read HN. I remind them that their choices are still causing grief to their users, at least as long as Firefox has any users left.
- throw16180339 3y ago
  I downvoted because it's snarky and doesn't mention the topic at all.

RMPR 3y ago

> My own extension StopTheMadness stops web sites from disabling your browser's built-in paste and autofill features, a kind of madness commonly implemented by sites that have a misguided, ignorant notion about what makes a login form "secure" Now, this is an extension I didn't know I needed. I'm baffled that there are some things without which the web is unusable for me. Looking at my extension list, on Firefox I have: - ClearURLs - Clickbait remover for YouTube - Cookie Autodelete - Firefox Multi-account container - I don't care about cookies (not updated since bought by Avast) - Privacy badger - Tampermonkey - Tridactyl - uBlock Origin I feel like I'm pretty conservative with the add-ons that I install, yet I can't comfortably browse the web if I'm missing one of them. When did everything go so wrong?

kentrf 3y ago
Try Consent-O-Matic instead of IDCAC. It is possible to reject consent instead of blindly accepting them with IDCAC... and also the Avast thing
- deleted 3y ago
  [deleted]
- ibejoeb 3y ago
  I think the point of these is that GDPR requires an affirmative action, i.e., there is no need to decline, so just get the shitty overlays out of the way. Consent-O-Matic submits those forms on your behalf. I don't want that. I'd rather not participate at all.
mostlysimilar 3y ago
Here's the non-enshittified version of "I don't care about cookies": https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies/ https://addons.mozilla.org/en-US/firefox/addon/istilldontcar... Yes, the web is hostile. It's frankly incredible we're still allowed the power to control our user agents like we do. If the web was built today it would be a locked down nightmare controlled 100% by corporate interests.
- 3y ago

ilyt 3y ago

[flagged]

BaseballPhysics 3y ago
Its just more fear mongering, in this case from an extension developer that thinks this'll cut into their user numbers. The feature isn't even fully built yet (116 will include more iteration on this and meanwhile 115 ships with no domains in the quarantine list). But every little hint of a possible misstep by Mozilla turns into a drama vortex in this community these days.
- logicprog 3y ago
  Mozilla does do a lot of underhanded or anti-user things, including the boatloads of telemetry some of which goes through Google Analytics. However, Mozilla is still a lot better than Google, and Firefox is leaps and bounds better than Chrome in terms of privacy, even given all of the problematic things Mozilla has done, even if the fact that there's a big controversy every time Firefox does something bad while everyone just expects Chrome to do bad things and so doesn't talk about it gives the impression that Firefox is worse. I think that's actually the reason why there's a big outcry every time Mozilla does something like this — Mozilla Firefox is kind of one of the last browsers to be relatively respecting of people's privacy and definitely one of the last ones outside of Google's Chromium dominion, so it means a lot more when they do bad things.
  - rightbyte 3y ago
    > Mozilla does do a lot of underhanded or anti-user things, including the boatloads of telemetry some of which goes through Google Analytics What? For real? How hard can it be to not be a Google shill ... They have to have really toxic people internally pushing all these anti-feutures down our throats. I refuse to believe the whole org. is rotten.
- ilyt 3y ago
  That from company that force-installed addons for marketing purposes... and you wonder why people are careful around another "genius" idea from Mozilla.

deleted 3y ago

[deleted]

sanqui 3y ago

StopTheMadness appears to be a Firefox extension that's only available for Mac users?

kemayo 3y ago
I believe it's sold through the Mac App Store, because the Firefox extension is an outgrowth of the preexisting Safari extension. https://lapcatsoftware.com/articles/StopTheMadness-Firefox.html https://lapcatsoftware.com/articles/StopTheMadness-Firefox.h...
drewg123 3y ago
Ah, that explains why I could not find it!

arp242 3y ago

Discussed yesterday: https://news.ycombinator.com/item?id=36591247 https://news.ycombinator.com/item?id=36591247

beebeepka 3y ago

Didn't we cover this yesterday https://news.ycombinator.com/item?id=36591247 https://news.ycombinator.com/item?id=36591247

DistractionRect 3y ago

There's already been some good discussion on this, I find this comment the most enlightening: https://news.ycombinator.com/item?id=36591247#36591664 https://news.ycombinator.com/item?id=36591247#36591664 Basically it's intended to be a user defined middle ground between allowing permissions everywhere vs the developer hand curating a list of allowed sites.

jchw 3y ago
> user defined Hmmm... > We need to have ability to set the list of quarantined domains remotely. > Filing as confidential for now, > "Only some extensions monitored by Mozilla are allowed on this site to protect your data." I didn't know Mozilla was the user of my local Firefox instance :P (Well, doesn't matter much to me honestly. I only use LibreWolf.)
- DistractionRect 3y ago
  As commented, 116 will have a UI to allow the user to better control this. As I understand it, this just a safetly precaution. They will likely default opt out unmonitored extensions from certain high value sites (banks, email, etc) and allow users to explicitly opt back in. This, to me, seems perfectly reasonable
  - jchw 3y ago
    Oh no, I love it when developers ship features that'll be perfectly reasonable in the next release, and people defend that as if it's some kind of catch 22 versus what they actually shipped. What I said describes accurately the actual thing they shipped. A remote kill switch that's nearly completely opaque to the user. That's what shipped today. If you want Mozilla to get a free pass, that's your business. To me, what they shipped matters and said about it matters too. It says a lot about Mozilla that they seemingly didn't see how this would look optically, or perhaps simply don't care. And no, "Chrome is worse" is not a good answer. I don't want good to be the enemy of great, but I'm not making excuses for enshittification either.

kemayo 3y ago

The article is right that we've not seen any communication about Mozilla as to how they intend to use this, so we can only speculate about why they might want the feature. My own speculation is that this is them warding against extension-takeovers, where people sell off their semi-successful extension to some company which then fills it up with spyware. If Mozilla fills up their quarantine list with domains that're easy targets for stealing valuable information (banks, etc), that'd reduce the incentive to do such takeovers.

londons_explore 3y ago
Mozilla already control the update process, so could easily stop extension authors pushing malicious updates after a takeover.
- ghayes 3y ago
  It’s quite possible that a malicious takeover is only diagnosed after the fact. Updates might appear innocuous at first but later be incredibly user-hostile.
- 16bitvoid 3y ago
  I'm not familiar with extension development or their capabilities, but perhaps the extension author can remotely activate the malicious parts after it passes the update process and perhaps Mozilla doesn't have the manpower to manually review the code of every extension update?
- kemayo 3y ago
  I think that's the difference between "monitored" and "unmonitored" extensions, as called out in the article. Monitored extensions are presumably ones where they actually verify the updates, and so they think it's fine to let them run on sensitive sites.
- Clamchop 3y ago
  Why do you say easily? Software is an endless parade of creative exploits both intentional and accidental, it's never seemed like an easy problem to solve.

deleted 3y ago

[deleted]

kemotep 3y ago

This isn’t just their extension, if I am reading this correctly it is any extension(that hasn’t been vetted by Mozilla) is capable of being blocked from running due to this this new quarantined domain list that Firefox 115 has. However this feature can be disabled, or otherwise overridden at this time by the end user when following the documentation[0]. I can understand the concern here, but this change is being communicated, can be user managed, and the best faith interpretation I can come up with, is in fact for security purposes. It creates restrictions on (at least from Mozilla’s perspective) untrusted extensions. I mean how many extensions are there that do act maliciously? It probably isn’t trivial. I highly recommend you use a minimum amount of extensions anyway. The OP’s extension is a good one from what I can tell but I really only use uBlock Origin, Bitwarden, and tab containers at this point. I guess whenever I use Gnome I end up having to use their extension too which is frustrating but a different story. Will have to pay attention to this feature. Thanks for sharing the link. [0]: https://support.mozilla.org/en-US/kb/quarantined-domains https://support.mozilla.org/en-US/kb/quarantined-domains

TheRealPomax 3y ago
"We've taken away your power and hidden it behind a setting that we have no obligation to maintain" seems to have been the Firefox motto for the last ten years, and continues to go strong.
- kemotep 3y ago
  It is increasingly frustrating but in my opinion Firefox is the only usable browser. The ads and other nonsense, despite being pushed out often, are still user controllable and once configured, I have always had my settings honored. You cannot say the same about Edge and if app manifest v3 actually does what people say does, Chrome will essentially be undergoing the same cut off of extension capabilities that Firefox Quantum did years ago but even worst.
  - cglong 3y ago
    I'm wary of Manifest v3, but like you say, it isn't a mandate yet. Is there any reason today why Chrome isn't usable? There's also Brave, which I love on Android.

xanathar 3y ago

Fun stuff, I would have bet that this was to stop adblockers on YouTube, and yet an adblocker on YouTube is the only extension that works.

logicprog 3y ago

It really makes me sad every time Mozilla pulls stuff like this in Firefox. Firefox is basically the last usable mainstream browser outside of Google's indirect dominion via Chromium, and one of the few somewhat privacy respecting ones as well. I'm glad I project like LibreWolf exists to undo and rip out all of the stuff like this so that I can have a truly private and secure browser that isn't based on chromium instead of having to switch to Brave or something, because as much as I value my privacy and security I also value not giving in to Google's browser monopoly.

stalfosknight 3y ago
Safari is quite usable and very mainstream.
- logicprog 3y ago
  Is it FLOSS? Also, I don't really like Apple's software (or hardware), and I'd prefer a browser that was outside of all those large ecosystems/walled gardens. Safari probably is a cut above most though, AppleApple's relationship to privacy is... complicated.
  - stalfosknight 3y ago
    There's an entire universe of useful and well-designed software that isn't FLOSS. Being free or open source isn't the be-all and end-all for most people.
- simlevesque 3y ago
  > Safari is quite usable The majority of device with web browsers cannot use Safari. I can't use it at all.
  - logicprog 3y ago
    Yeah like I don't own any apple devices so it is useless to me

Thissitesucks00 3y ago

I don't think this is new, is it? For at least the last couple of years (maybe longer, that's just how long I've used Firefox on Windows) some sites are hardcoded not to allow extensions to run on them. As an example, add-ons don't run on addons.mozilla.org for security purposes. Is there any reason to think this is a conspiracy about ad blockers? I haven't seen anything that indicates this isn't the same as the addons.mozilla.org situation.

lapcat 3y ago
> I don't think this is new, is it? How can you say it's not new when it's literally in the release notes for yesterday's Firefox update? > For at least the last couple of years (maybe longer, that's just how long I've used Firefox on Windows) some sites are hardcoded not to allow extensions to run on them. Yes, the setting extensions.webextensions.restrictedDomains is old, and it applies to every extension, including uBlock Origin. The domains are all Mozilla. Here's the complete list: accounts-static.cdn.mozilla.net,accounts.firefox.com,addons.cdn.mozilla.net,addons.mozilla.org,api.accounts.firefox.com,content.cdn.mozilla.net,discovery.addons.mozilla.org,install.mozilla.org,oauth.accounts.firefox.com,profile.accounts.firefox.com,support.mozilla.org,sync.services.mozilla.com
- deleted 3y ago
  [deleted]

hexage1814 3y ago

Only requiring developers to sign their extensions so that they can run on firefox wasn't enough – as mozilla had already done back in 2015 or so. No, no, no, in the name of safety we need to make sure your extension doesn't run on forbidden sites. https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/ https://blog.mozilla.org/addons/2015/02/10/extension-signing...

Santosh83 3y ago

We've almost come full circle with browser extensions, from being rare or non-existent to the zenith of popularity and power in the pre-Quantum Firefox days to now back to being increasingly whitelisted and sandboxed into unpopularity.

12345hn6789 3y ago

It's impressive how well Firefox does at making it hard to justify using Firefox. Can't wait until 116 release to see what other feature they removed or anti pattern they decided should be opted into by default for "confidential reasons"

Cyder 3y ago

my first thought: they'll collect money from sites to disable adblockers and other ext. I gave up on Mozilla 5 or so years ago because they ARE sneaky about being corporate sellouts and anti privacy. At least the browsers i use now don't PRETEND to be privacy focused.

qwertyuiop_ 3y ago

Ministry of truth

aweirljslfj 3y ago

relevant links all the bugzilla items: https://bugzilla.mozilla.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=RESOLVED&bug_status=VERIFIED&bug_status=CLOSED&f1=classification&short_desc_type=anywordssubstr&query_format=advanced&j2=OR&f2=OP&short_desc=quarantined%20domains&o1=notequals&f3=CP&v1=Graveyard https://bugzilla.mozilla.org/buglist.cgi?bug_status=UNCONFIR... if you have access to their project tracking, it's under WEBEXT-1351 (would love if someone can post the entire reasoning for the feature here, as their conversations are now behind login which i didn't bother to secure) The code for what the user can see/allow per-domain https://hg.mozilla.org/mozilla-central/rev/4399291987d9 https://hg.mozilla.org/mozilla-central/rev/4399291987d9 (not released as far as i can tell) you can see the file locally via `resource://gre/modules/ExtensionPermissions.sys.mjs` in your address bar. and lastly, the dev doc on how to push those values to live user browsers https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/AMRemoteSettings-overview.html https://firefox-source-docs.mozilla.org/toolkit/mozapps/exte... this is already how it works on Firefox for android, with NO USER WHITELIST OPTION... the only workaround on android is to add another hidden setting that points to a user-defined collection in addons.mozilla.org, which will be the allowed extension list instead of mozilla's. edit; HOLY SHIT!!! just updated firefox for android, and they removed access to about:config there in the last version! (ps: they had already removed since 2020 for "regular lowly users" who do not install experimental version, their words. Now it is also removed from f-droid stable build since last version. I didn't see it mentioned on the release notes, so they either strong armed the maintainer or slipped changes past them)

mutant 3y ago
I noticed this on Android a while ago, and bailed on FF. Their trajectory feels so anti-user, I was like "welp, figure out how to live in a chromium world where I know I'm under constant attack"

Animats 3y ago

Is there a list of all the things for which Firefox now "phones home"? "Sync", "Pocket", Firefox updates, extension updates, the bad site blocklist, and this. What else?

lapcat 3y ago
https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... https://support.mozilla.org/en-US/kb/domains-allow-firefox https://support.mozilla.org/en-US/kb/domains-allow-firefox

__fst__ 3y ago

I can see the need to deactivate some extensions on certain websites. For me that's mostly a "make the site work" workaround than a security feature but anyway. I can recommend using different browser profiles for specific setups (e.g. banking). Linux Mint has the Web Apps feature (https://www.makeuseof.com/how-to-create-a-web-app-in-linux-mint/ https://www.makeuseof.com/how-to-create-a-web-app-in-linux-m...) that lets you configure different browser profiles and as a bonus it turns the web site into a desktop app. The downside of it is that each browser profile needs its own config, i.e. you have a lot of repeated overhead and you need to reinstall extensions into every profile. But on the flipside I can control which extensions I want to have in there.

m4lvin 3y ago

Once more I an happy to use the ESR version of Firefox where stuff like this tends to only land much later. Add on top of that the Debian patches and default settings and it's a fine user-agent again :-) Edit: oops, looks like 115 is the next ESR version, does that mean it gets this "feature" but for a long time will not get proper UI go control it? :-(

munro 3y ago

what the heck is this person crying about. the amount of attention & level of seriousness raised is totally not justified..... after reading the changes, they're fine. ok you're /indie/ extension is safe (or so you claim), but so many out there are extremely dangerous. let mozilla cook

xigoi 3y ago
If I don't consider an extension safe, I won't install it. I don't want some company to make choices for me.

Zren 3y ago

Tampermonkey (Userscripts) has a similar default blocklist. It blocks by default: example.org, paypal.tld, stripe.com, deutsche-bank-24.tld, bankofamerica.tld, apis.google.com, www.facebook.com/plugins/, platform.twitter.com/widgets

rvz 3y ago

Not your browser. Seems like there is no benefit to using Firefox. Just use Brave.

deleted 3y ago
[deleted]

dang 3y ago

Recent and related: Mozilla restricts extensions on some domains on Firefox 115 - https://news.ycombinator.com/item?id=36591247 https://news.ycombinator.com/item?id=36591247 - July 2023 (91 comments)

ibejoeb 3y ago

What I really want is extension integration with container tabs, so that I can partition the extensions myself. For example, I probably want my banking container to have no extensions, but my news container to have all of the ad-blockers, link cleaners, etc.

haxiel 3y ago
Not a perfect solution to this scenario, but I have used multiple Firefox profiles in the past this way. The profiles are isolated at the file-system level, so extensions remain separate. So you could have a 'hardened' profile will all the blocking/cleaning extensions, and a 'trusted' profile with no extensions. Profile isolation also covers configuration, so you could even tweak those independently.
- ibejoeb 3y ago
  I've experimented with that from time to time, but it hasn't stuck. The problem is when I click through. Container tabs handles that, but I would have to be extremely vigilant to prevent sites from loading outside of the hardened profile.

giantbanana 3y ago

[flagged]

deleted 3y ago

[deleted]

Sunspark 3y ago

The article isn't clearly stated on this point, but at the current time to block this new behaviour, in about:config create a new boolean named "extensions.quarantinedDomains.enabled" and set the value to false. It's a shame, because I can see where this will lead to beyond the obvious of just extensions today. The domains list will be tied to country codes. So it will become a situation where "if country X then block politically objectionable domain Y!" where Y can be a site that criticizes the ruling party or the usual crew of copyright carpetbaggers wanting various sites blocked from the browser end, etc. And it will actually cover a lot of scope, you already see some of this beginning where they have started blocking some US states from viewing pornography, but with this method, you can block an entire country from all porn domains at once just by making the browser refer to a master blacklist. On the bright side, Firefox may be able to soon access the lucrative North Korean market since all domains will be blocked.

hexage1814 3y ago
Interestingly the France government, as well as Porn Hub, both asked for such a a sythem you are describing. Even more interesting is that Mozilla, a few days ago, made a post criticizing this, but it seems that behind the scenes they are pretty much putting all the infrastructure needed for this to be implement pretty soon if they need. https://blog.mozilla.org/netpolicy/2023/06/26/france-browser-website-blocking/ https://blog.mozilla.org/netpolicy/2023/06/26/france-browser... https://www.dailymail.co.uk/news/article-12234299/We-want-porn-boring-Pornhub-owners-say-governments-stop-crackdown-adult-websites.html#:~:text=The%20only%20solution%20that%20accomplishes%20both%20of%20these%20goals%20is%20device%20or%20browser-based%20verification https://www.dailymail.co.uk/news/article-12234299/We-want-po...
a2128 3y ago
This is about blocking unverified extensions on specific websites, not blocking access to specific websites

tomkarho 3y ago

Well looks like the browser market is due for some fresh blood and disruption. Good thing Ladybird got huge donations recently.