4 ms·

The article is right that we've not seen any communication about Mozilla as to how they intend to use this, so we can only speculate about why they might want t

by kemayo 3y ago

The article is right that we've not seen any communication about Mozilla as to how they intend to use this, so we can only speculate about why they might want the feature. My own speculation is that this is them warding against extension-takeovers, where people sell off their semi-successful extension to some company which then fills it up with spyware. If Mozilla fills up their quarantine list with domains that're easy targets for stealing valuable information (banks, etc), that'd reduce the incentive to do such takeovers.

londons_explore 3y ago
Mozilla already control the update process, so could easily stop extension authors pushing malicious updates after a takeover.
- ghayes 3y ago
  It’s quite possible that a malicious takeover is only diagnosed after the fact. Updates might appear innocuous at first but later be incredibly user-hostile.
- 16bitvoid 3y ago
  I'm not familiar with extension development or their capabilities, but perhaps the extension author can remotely activate the malicious parts after it passes the update process and perhaps Mozilla doesn't have the manpower to manually review the code of every extension update?
- kemayo 3y ago
  I think that's the difference between "monitored" and "unmonitored" extensions, as called out in the article. Monitored extensions are presumably ones where they actually verify the updates, and so they think it's fine to let them run on sensitive sites.
- Clamchop 3y ago
  Why do you say easily? Software is an endless parade of creative exploits both intentional and accidental, it's never seemed like an easy problem to solve.
logicprog 3y ago
Wouldn't a better way to deal with extension takeovers B to just turn off the extension instead of blocking the extension from certain websites? Especially since, as the author points out, any such quarantine list of domains is of necessity going to be incomplete?
- zargon 3y ago
  It blocks *all* (non-monitored) extensions from running on *some* websites. What it should do is block *specific* extensions from running on *all* sites. The security justification doesn't align with what they actually did.
  - kemayo 3y ago
    I think the idea would be that it's easier to list common targets than to play after-the-fact whack-a-mole with malicious extensions. The former makes it less lucrative to sneak your malicious code into an extension, because you don't get that window of being able to harvest data before it's noticed.
  - logicprog 3y ago
    Exactly what I was getting at yeah, well said
  - mook 3y ago
    They already have (separate) capability to force uninstall specific extensions, so there isn't much point to blocking specific extensions from all sites. My charitable guess for this one is block things like Honey (which essentially slurps your browsing history in return for affiliate discounts) from things like banking websites. But I'll disable it for now and see what the UI is later.
galangalalgol 3y ago
Power given to the well-intentioned will get used by their successors. I haven't tried servo since right after the transition to the Linux foundation. It seemed good for most of my browsing already, but with a bad ui. I looked for any good tickets for new contributors but all I found was something about xml parsing that I am unqualified for, plus I hate xml. If we could throw out weight behind it I think it could be an alternative for everything that shouldn't be a web app or native app.
- kemayo 3y ago
  I'm inclined to reserve judgement until we see the user-facing UI for this (which is apparently coming in 116, per other comments). It seems like a reasonable feature, so long as there's sufficiently accessible ways to override it.
denton-scratch 3y ago
> My own speculation is that this is them warding against extension-takeovers I don't buy that. If they learn that an extension has been taken over, then they can just block the extension. Also, why the domain list? If some extension has started cryptomining, why will Mozilla protect me only when I visit selected domains? And why the tight lips?
- unethical_ban 3y ago
  [flagged]
- kemayo 3y ago
  > If they learn that an extension has been taken over, then they can just block the extension. The goal would be to stop compromised extensions from being able to hit high value targets even before anyone has realized they're compromised. They won't get that valuable window in which the malicious update has gone out, but nobody has realized that it was malicious. > If some extension has started cryptomining, why will Mozilla protect me only when I visit selected domains? Because they're not protecting against cryptomining, they're protecting against data theft, which is naturally going to focus on certain high-value domains.
  - rst 3y ago
    But if they know there was a malicious update, being distributed through infrastructure they control, why not immediately block it altogether? (The notion that they have an explicit list of every, say, bank, stockbroker, crypto exchange, etc., so they could disable it for only those is... awfully suspect.)
    - kemayo 3y ago
      Because this would block it from hitting some high-value sites before they know there was a malicious update. I would imagine that once they know about it it'd also get added to the blocked-extensions list.
      - 3y ago
mcpackieh 3y ago
More likely this is preparation for them to comply with DMCA takedowns against uBlock Origin, by blacklisting it on those websites while placating users by not removing it entirely (as they did in this case: https://www.ghacks.net/2023/04/20/mozilla-removes-bypass-paywalls-clean-extension-from-its-add-repository/ https://www.ghacks.net/2023/04/20/mozilla-removes-bypass-pay... )
- berkes 3y ago
  Except in the article it's made clear that uBlock origin is ignored and therefore will run on quarantined domains.
  - mcpackieh 3y ago
    > uBlock origin is ignored That's just configuration, easy to change. And if they change that configuration in response to a lawsuit, Mozilla can play the victim and say their hand was forced. If they had to ban uBlock Origin outright that would probably kill Firefox's (already abysmal) install base. Neither Mozilla nor Google wants that; they want Firefox to remain as an obscure but technically viable competitor. What they're doing now is laying the groundwork for banning uBlock Origin on only some websites while allowing it to continue working on most. This let's Google have their cake and eat it too; Firefox surviving as nominal competition to Chrome but no longer blocking ads on Youtube.

by kemayo 3y ago

londons_explore 3y ago

Mozilla already control the update process, so could easily stop extension authors pushing malicious updates after a takeover.

ghayes 3y ago
It’s quite possible that a malicious takeover is only diagnosed after the fact. Updates might appear innocuous at first but later be incredibly user-hostile.
16bitvoid 3y ago
I'm not familiar with extension development or their capabilities, but perhaps the extension author can remotely activate the malicious parts after it passes the update process and perhaps Mozilla doesn't have the manpower to manually review the code of every extension update?
kemayo 3y ago
I think that's the difference between "monitored" and "unmonitored" extensions, as called out in the article. Monitored extensions are presumably ones where they actually verify the updates, and so they think it's fine to let them run on sensitive sites.
Clamchop 3y ago
Why do you say easily? Software is an endless parade of creative exploits both intentional and accidental, it's never seemed like an easy problem to solve.

logicprog 3y ago

Wouldn't a better way to deal with extension takeovers B to just turn off the extension instead of blocking the extension from certain websites? Especially since, as the author points out, any such quarantine list of domains is of necessity going to be incomplete?

zargon 3y ago
It blocks *all* (non-monitored) extensions from running on *some* websites. What it should do is block *specific* extensions from running on *all* sites. The security justification doesn't align with what they actually did.
- kemayo 3y ago
  I think the idea would be that it's easier to list common targets than to play after-the-fact whack-a-mole with malicious extensions. The former makes it less lucrative to sneak your malicious code into an extension, because you don't get that window of being able to harvest data before it's noticed.
- logicprog 3y ago
  Exactly what I was getting at yeah, well said
- mook 3y ago
  They already have (separate) capability to force uninstall specific extensions, so there isn't much point to blocking specific extensions from all sites. My charitable guess for this one is block things like Honey (which essentially slurps your browsing history in return for affiliate discounts) from things like banking websites. But I'll disable it for now and see what the UI is later.

galangalalgol 3y ago

Power given to the well-intentioned will get used by their successors. I haven't tried servo since right after the transition to the Linux foundation. It seemed good for most of my browsing already, but with a bad ui. I looked for any good tickets for new contributors but all I found was something about xml parsing that I am unqualified for, plus I hate xml. If we could throw out weight behind it I think it could be an alternative for everything that shouldn't be a web app or native app.

kemayo 3y ago
I'm inclined to reserve judgement until we see the user-facing UI for this (which is apparently coming in 116, per other comments). It seems like a reasonable feature, so long as there's sufficiently accessible ways to override it.

denton-scratch 3y ago

> My own speculation is that this is them warding against extension-takeovers I don't buy that. If they learn that an extension has been taken over, then they can just block the extension. Also, why the domain list? If some extension has started cryptomining, why will Mozilla protect me only when I visit selected domains? And why the tight lips?

unethical_ban 3y ago
[flagged]
kemayo 3y ago
> If they learn that an extension has been taken over, then they can just block the extension. The goal would be to stop compromised extensions from being able to hit high value targets even before anyone has realized they're compromised. They won't get that valuable window in which the malicious update has gone out, but nobody has realized that it was malicious. > If some extension has started cryptomining, why will Mozilla protect me only when I visit selected domains? Because they're not protecting against cryptomining, they're protecting against data theft, which is naturally going to focus on certain high-value domains.
- rst 3y ago
  But if they know there was a malicious update, being distributed through infrastructure they control, why not immediately block it altogether? (The notion that they have an explicit list of every, say, bank, stockbroker, crypto exchange, etc., so they could disable it for only those is... awfully suspect.)
  - kemayo 3y ago
    Because this would block it from hitting some high-value sites before they know there was a malicious update. I would imagine that once they know about it it'd also get added to the blocked-extensions list.
    - 3y ago

mcpackieh 3y ago

More likely this is preparation for them to comply with DMCA takedowns against uBlock Origin, by blacklisting it on those websites while placating users by not removing it entirely (as they did in this case: https://www.ghacks.net/2023/04/20/mozilla-removes-bypass-paywalls-clean-extension-from-its-add-repository/ https://www.ghacks.net/2023/04/20/mozilla-removes-bypass-pay... )

berkes 3y ago
Except in the article it's made clear that uBlock origin is ignored and therefore will run on quarantined domains.
- mcpackieh 3y ago
  > uBlock origin is ignored That's just configuration, easy to change. And if they change that configuration in response to a lawsuit, Mozilla can play the victim and say their hand was forced. If they had to ban uBlock Origin outright that would probably kill Firefox's (already abysmal) install base. Neither Mozilla nor Google wants that; they want Firefox to remain as an obscure but technically viable competitor. What they're doing now is laying the groundwork for banning uBlock Origin on only some websites while allowing it to continue working on most. This let's Google have their cake and eat it too; Firefox surviving as nominal competition to Chrome but no longer blocking ads on Youtube.