15 ms·

This isn’t just their extension, if I am reading this correctly it is any extension(that hasn’t been vetted by Mozilla) is capable of being blocked from running

This isn’t just their extension, if I am reading this correctly it is any extension(that hasn’t been vetted by Mozilla) is capable of being blocked from running due to this this new quarantined domain list that Firefox 115 has. However this feature can be disabled, or otherwise overridden at this time by the end user when following the documentation[0]. I can understand the concern here, but this change is being communicated, can be user managed, and the best faith interpretation I can come up with, is in fact for security purposes. It creates restrictions on (at least from Mozilla’s perspective) untrusted extensions. I mean how many extensions are there that do act maliciously? It probably isn’t trivial. I highly recommend you use a minimum amount of extensions anyway. The OP’s extension is a good one from what I can tell but I really only use uBlock Origin, Bitwarden, and tab containers at this point. I guess whenever I use Gnome I end up having to use their extension too which is frustrating but a different story. Will have to pay attention to this feature. Thanks for sharing the link. [0]: https://support.mozilla.org/en-US/kb/quarantined-domains https://support.mozilla.org/en-US/kb/quarantined-domains

TheRealPomax 3y ago
"We've taken away your power and hidden it behind a setting that we have no obligation to maintain" seems to have been the Firefox motto for the last ten years, and continues to go strong.
- kemotep 3y ago
  It is increasingly frustrating but in my opinion Firefox is the only usable browser. The ads and other nonsense, despite being pushed out often, are still user controllable and once configured, I have always had my settings honored. You cannot say the same about Edge and if app manifest v3 actually does what people say does, Chrome will essentially be undergoing the same cut off of extension capabilities that Firefox Quantum did years ago but even worst.
  - cglong 3y ago
    I'm wary of Manifest v3, but like you say, it isn't a mandate yet. Is there any reason today why Chrome isn't usable? There's also Brave, which I love on Android.
    - kemotep 3y ago
      It’s more or less ideological on my part. There being only 1 browser engine is something I would like to avoid. And unless Safari becomes available on Linux (or that Orion browser from the makers of Kagi), Firefox is the only other option. There is Librewolf and some other gecko based ones out there but other than the TOR browser, none of the others are large enough projects that I would trust with something as important as my Web Browser. I support plenty of end users on Chrome and Edge at work and will happily oblige my wife by installing and configuring Chrome on all her devices. Firefox is what works for me and what I am comfortable using at this time. Unusable was certainly a hyperbole on my part.
      - cglong 3y ago
        Got it, thank you for explaining! :) I've never used Linux full-time, but from my understanding, neither GNOME Web nor Konqueror are Blink-based. Are they missing critical power user features?
        kemotep 3y ago
        The lack or nonstandard support for extensions. But looking into it, I see that it looks like at least Gnome Web now can support extensions. Currently not using Gnome or KDE on my Linux install though.
        cglong 3y ago
        Not sure if this helps, but according to Wikipedia: > Despite being a component of GNOME, Web has no dependency on GNOME components, so it can be potentially installed on any system supporting GTK and WebKitGTK.
    - 3y ago
  - a_imho 3y ago
    once configured, I have always had my settings honored totally different experience, FF ESR decided to update itself just the other day and break a bunch of stuff out of the blue, because of course moz://a knows better what I need and when I need it. It is very sad people like me need to put up with this abusive behaviour because the alternatives are worse
    - kemotep 3y ago
      Do you have an example? I would like to double check my own browser to see if anything has been changed without my knowledge or permission.
      - a_imho 3y ago
        You mean besides the forced update? Unfortunately not much I can help with, in my case I was deliberately running ESR 78.14.0 which was force updated to ESR 102.11.0 on May 26 and later 102.12.0 on June 20 (setting is obviously 'Check for updates'). It was a pretty big change first, so I naturally tried to revert back as much as I could. However for example Google Image Search is broken again, clicking it simply crashes the tab (Gah. Your tab just crashed), which could be fixed by tweaking some options in the earlier version iirc. Unless moz://a managed to break it a different way this time
  - RobotToaster 3y ago
    >I have always had my settings honored They disabled the setting to enable XUL extensions. They disabled a bunch of extensions I had installed on firefox android.
    - TheRealPomax 3y ago
      They didn't disable the setting to enable XUL extensions, they rewrote the codebase to something that can't run XUL. And of all the changes in the past decade, that's actually one I'm 100% okay with, XUL was a hot mess that could do way more harm than any extension should have ever even in theory been able to do. As long as FF doesn't buy into Manifest v3. Which it will. Because it will.
      - JohnFen 3y ago
        > of all the changes in the past decade, that's actually one I'm 100% okay with I would have been OK with it if it didn't come with the loss of functionality.
        TheRealPomax 3y ago
        There's "loss of functionality" and then there's "I am enjoying functionality that's due to an extention potentially taking over my system". More of the former, less of the latter please.
        JohnFen 3y ago
        Fair enough! It means FF is the browser for you, and it's not the browser for me.
      - type0 3y ago
        It will when they update their Manifesto to v3 https://www.mozilla.org/en-US/about/manifesto/ https://www.mozilla.org/en-US/about/manifesto/
  - spiralpolitik 3y ago
    I remember when they rolled out DNS over HTTPs and set the default to "Fallback Mode" effectively highjacking DNS for most users. Good times figuring out why users couldn't access certain sites after ignoring the vague opt-out message, good times.
- ncann 3y ago
  While I understand the frustration, they're pretty good at keeping about:config settings around. I can't remember the last time they removed one. The same can't be said about Chrome.
  - SilasX 3y ago
    Right. They keep the config settings around. They just start ignoring the value, like in the case of allowing unsigned extensions. Or anything related to telemetry and user experiments.
    - hpd 3y ago
      While I've not noticed any settings being ignored, I suggest to use policies(either GPO or "policies.json" when it comes to telemetry. As for experiments I've been running ESR for so long that I don't even know what these are supposed to be or do.
      - SilasX 3y ago
        Wow, you didn’t notice the one I just listed even after I listed it? That level of ignorance takes effort! As for telemetry, I’m talking about this particular incident, where the “user studies” feature was used to force an unrelated update: https://news.ycombinator.com/item?id=19826827 https://news.ycombinator.com/item?id=19826827
  - TheRealPomax 3y ago
    You mean those settings that you don't get to see anymore when you type about:config unless you now, every fucking time, click "show me all settings"? The one they also removed entirely from the android release? That about:config? Because they've been doing the exact same thing to that, packing it away more and more, slowly killing off the parts that made it a great power user and developer browser by just making them a little bit harder to use or get to every time.
- anjel 3y ago
  This new "feature" is nothing to rejoice about but balancing against the parent observation not all unique firefox settings dissipate. eg. defeating video autoplay migrated from about:config to a prominent settings toggle listed under permissions.
  - TheRealPomax 3y ago
    ... what are you smoking? Because I might need some, but also what the hell are you trying to even say?
A4ET8a8uTh0 3y ago
That.. is upsetting. Mozilla seems to be determined to ensure that the user base it does have left leave it. I am glad it can be toggled off, but why exactly is there to begin with is the real question.
- deleted 3y ago
  [deleted]
- simlevesque 3y ago
  > why exactly is there to begin with is the real question And "it's confidential" is the worst possible answer but it's still the one they gave us.
- itzworm 3y ago
  The commentor you've replied to says: > The best faith interpretation I can come up with, is in fact for security purposes. It creates restrictions on (at least from Mozilla’s perspective) untrusted extensions. I mean how many extensions are there that do act maliciously? It probably isn’t trivial. My best interpretation of that is it allows organizations to more easily allow some extensions while disallowing others.
  - kemotep 3y ago
    Firefox is lagging behind on enterprise configuration options. Adding in additional features that allow sysadmins to deploy policies that can further control Firefox like Chrome and Edge could be potentially behind why this is happening. This is of course, complete speculation and if it was for enterprise management reasons, Mozilla should have clearly communicated it.
- indymike 3y ago
  The ability to prevent an extension from accessing specific sites is an improvement as long as the user can control it and it is not used for centralized access control. The reason this feature is there is that many extensions play poorly with or should not have access at all to specific sites. For example, Grammarly has no business accessing a corporate billing system and IT might want to disable access. In other cases an extension slows a site massively and a user might want to say, "not that site" to an extension. This could be the start of a big end-user improvement, especially if it can be managed by users and installers.
nani8ot 3y ago
Extension Manager [0] allows for installing Gnome extensions through an libadwaita app. This replaces the Gnome Extensions app and the browser extension. [0]: https://github.com/mjakeman/extension-manager https://github.com/mjakeman/extension-manager
- kemotep 3y ago
  Thanks for sharing this. It seems absurd that you needed a browser extension to manage your desktop environment and window manager theme. If only Xfce supported wayland.
BSEdlMMldESB 3y ago
my worry is that by firefox 225 that option will be gone, or will require modifying some text file in your profile. I say this because I already have had to modify a text file in my profile to get firefox to do what I want (tree style tabs without dupe tab-bar on top). also, by "firefox 225" I wonder how easy it will be to arbitrarily modify a 'protected' app/system text file (this is already difficult on smartphones)
madeofpalk 3y ago
I normally take the good faith interpretation for things like this, but I'm confused by this one. What security problem would be addressed by this? Why would Mozilla need to disable "untrusted" extensions for only certain websites? Why would a website need to be quarentined from an extension, instead of the other way around? I would think that the remote kill switch for a specific extension addresses the actual security concerns, or Mozilla just not allow 'untrusted extensions' by default on any website. I don't think Mozilla is evil for doing this, but I do find the motivation for this confusing.
- BaseballPhysics 3y ago
  Think high sensitivity sites like banking. Personally, I'd love to be able to flag sites as only having a limited whitelisted set of extensions, as they are a serious potential security risk. And I'm fine with the browser shipping with sane defaults. I don't want to have to manually tune this for my family members. Come to think of it, even better would be to attach this feature to whole containers...
  - jeroenhd 3y ago
    I understand this position, but I do see several trackers ("telemetry") get blocked by uBlock on my bank's website. This type of telemetry can go die in a fire for all I'm concerned, but these trackers are particularly devious with their constantly changing domains and URLs. Addons that allow for things like regex matching are the only solution that seems to work because the Pihole blacklist doesn't seem to block them sufficiently. Mozilla has already killed off malicious addons by enforcing their signature requirements. I'm not sure what this adds, I doubt Mozilla will hire someone to monitor the changes to banking URLs around the world (a necessity if this is indeed intended to make banking safer).
    - BaseballPhysics 3y ago
      > I understand this position, but I do see several trackers ("telemetry") get blocked by uBlock on my bank's website. Which is why I'd leave uBlock whitelisted. I never said I want to block all extensions! > I doubt Mozilla will hire someone to monitor the changes to banking URLs around the world uBlock effectively does this for advertising domains. Why is that any different?
concinds 3y ago
> is being communicated In the release notes which 95% of users don't read, and in a text label hidden in a toolbar menu. No informed consent or prompt to opt-in. And Mozilla hasn't disclosed their criteria for inclusion of websites, and what they plan to use it for.
- kemotep 3y ago
  The average user isn’t using Firefox to begin with. In fact 5% market share for Mozilla is probably pretty generous. I agree with you that Mozilla has certainly dropped the ball regarding this change. Much like pocket, the Mr Robot ARG, the Quantum update, DoH with Cloudflare as the default provider, and so on. But again all but the Quantum update have been user configurable, and in my experience, have not been reverted unlike my browser preferences on Windows, where Edge hijacks anything and everything with very little recourse.
  - NooneAtAll3 3y ago
    > The average user isn’t using Firefox to begin with. that's... not a valid argument for this discussion? market share and user conservatism has no connection to concerns about basic safety affecting everyone judgement should be applied equally, every user and every product
    - mrtranscendence 3y ago
      > that's... not a valid argument for this discussion? I believe the intention was to argue against the notion that 95% of users don't read release notes. The contention seems to be that, because Firefox users are more technical (or enthusiast, perhaps), more than 5% of Firefox users would read be aware of this change.
    - kemotep 3y ago
      The grandparent comment was regarding that the average user doesn’t read release notes and I was remarking that Firefox users are not average. Now I agree that this change is not being communicated properly but to claim that the Firefox user is similar to the average computer user is not something I would agree with.
jorvi 3y ago
> I highly recommend you use a minimum amount of extensions anyway. This why Brave has far surpassed Firefox at this point. - Good privacy defaults - Adblocking - The iOS browser actually has ad-blocking (this alone is why I shy every layman away from Firefox, fuck Mozilla for specifically locking those users out in the cold) - Choose your own blocklists - Anti-fingerprinting - Soon cookie auto-delete - Soon port scan blocking - WebRTC protection - HTTPS upgrading (less relevant these days but hey) - IPFS - Tor They also have a viable business model beyond “pay me off, Google”. And that is not to mention how Mozilla has chosen to soak their entire culture in ultra-progressive nonsense instead of rooting it in tech. Yes, Brave appending affiliate links was scummy (although not particularly harmful to their users). But that is quite some time ago now. I was a Mozilla / Firefox stan for a very very very long time. I still love Thunderbird, especially the progress they’re making now. But Firefox (and to a lesser point Mozilla) has completely lost its way.
- bloopernova 3y ago
  I haven't looked much at Brave, does it have nested vertical tabs and bookmark tags? Those are my killer features that I really don't want to give up.
  - jorvi 3y ago
    Verticals tabs do have nesting via tan groups. They just introduced vertical tabs, so expect pretty quick improvements and iterating for the next few months. Two things coming in the (near?) future: - vertical tabs get a number or background color when collapsed, helping visual differentiation and memorization - tab ‘+’ button moved to more convenient location Bookmarks don’t have tags, and I haven’t heard much noise about planned improvement (or users needing improvement) there.
- impissedoff1 3y ago
  Let's not forget mozilla prioritized renaming master password to primary password before adding back in print to Firefox mobile, and it's still missing..5 years later...
LegitShady 3y ago
>However this feature can be disabled, or otherwise overridden at this time by the end use Key words "at this time". In a few versions maybe they take that away and you can't block ads ok YouTube because Google threatened them. Building the capability and hiding the options in the about config is opening the door to a lot of bad decisions later on.
- hexage1814 3y ago
  It's also worth notice that Mozilla, for instance, removed Bypass Paywalls Clean https://www.ghacks.net/2023/04/20/mozilla-removes-bypass-paywalls-clean-extension-from-its-add-repository/ https://www.ghacks.net/2023/04/20/mozilla-removes-bypass-pay...
  - LegitShady 3y ago
    I'm less concerned about that. Mozilla doesn't have to host it. The author can offer it elsewhere.
    - hexage1814 3y ago
      >Mozilla doesn't have to host it But they still have to sign it, even if you're offering your extension somewhere else. https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/ https://blog.mozilla.org/addons/2015/02/10/extension-signing...
      - LegitShady 3y ago
        I had no idea this was implemented. Yikes.
- mcpackieh 3y ago
  > In a few versions maybe they take that away and you can't block ads ok YouTube because Google threatened them. And since they already built the requisite system needed to fulfill Google's demand, they won't be able to claim it would be too much work to implement. They're setting themselves up to readily comply with the demand when it comes.
GeekyBear 3y ago
> I highly recommend you use a minimum amount of extensions anyway. Given the number of extensions silently purchased by people seeking to spy and push malware, I've minimized the use of extensions that aren't vetted in advance by Mozilla/Firefox. > Recommended extensions undergo full code review by staff security experts to provide a strong additional security check. https://blog.mozilla.org/en/products/firefox/firefox-recommended-extensions/ https://blog.mozilla.org/en/products/firefox/firefox-recomme...
floomk 3y ago
If an extension has been installed on my machine it is by definition trusted. Firefox is not my antivirus solution and it should not try to be. Keep your lane.
- Groxx 3y ago
  Adware and spyware have a long history of silently installing browser extensions to collect more info. Is it really trusted? Though this kind of thing will generally be removed by the extension block list, not merely blocked from working on some domains.
  - floomk 3y ago
    As far as the browser should be concerned, yes it is trusted. It's up to another layer of security to help the user not install extensions (or any other software) that they do not want on their machine. This security is a farce anyway. Firefox is installed in the user profile so any sufficiently advanced malware can just patch the firefox binary and embed itself in there or disable this nonsense. The extension shenanigans is just done to take away user control, with the excuse being to protect users from malware.
    - deleted 3y ago
      [deleted]
  - ilyt 3y ago
    Okay ? If FF knows signature of known bad extension why would it block it only on some sites?! That makes zero sense from security perspective. It would be like asking antivirus to only let virus access D:\ drive...
    - Groxx 3y ago
      Yeah, the site-specific blocking seems... mostly dubious, possibly decent as a "this is a banking website - extensions are disabled by default, but you can click to enable them" thing. Right now it looks much more dubious than anything though. But even in the very best case, it's yet another custom "premium support" feature either way, like the Public Suffix List. They should push for standards instead, these kinds of things are always leaky and sometimes dangerous. Anyway. I just meant that extensions are not trustworthy just because they're installed. Malicious vectors exist, and protecting people from themselves / them understandably not being an up-to-date expert in all things tech by the millions-to-billions is largely a good thing.
RobotToaster 3y ago
>However this feature can be disabled For now. You used to be able to install any extension in firefox mobile, but they blocked that without any option to override it.
- amenod 3y ago
  Actually you can override it, but they made the process so convoluted and privacy breaking that I would guess not many people use it. So yes, effectively they blocked it.
NooneAtAll3 3y ago
what does Tab Container extention do that isn't in the default container tabs?
- slondr 3y ago
  “Default” container tabs have no user-facing UI. Tab Containers gives them a ui.
  - NooneAtAll3 3y ago
    are you sure? I don't have extension installed and I have "Open Link in New Container Tab" button
rvz 3y ago
That is even worse than thought. > However this feature can be disabled, or otherwise overridden at this time by the end user when following the documentation[0]. Nefarious features 'enabled by default' is the standard of Firefox. What else have they switched on behind the user's back then? > I highly recommend you use a minimum amount of extensions anyway. The OP’s extension is a good one from what I can tell but I really only use uBlock Origin, Bitwarden, and tab containers at this point. I guess whenever I use Gnome I end up having to use their extension too which is frustrating but a different story. You might as well use Brave Browser at this point.
Rebelgecko 3y ago
At this point I'm up to maybe 15-20 about:config + user.js changes to make FF work properly for me. Unfortunately I use FF on multiple computers, is there a good way to keep everything in sync? Not sure how well something like a git repo would work.
- naavis 3y ago
  Could you give some examples? I use Firefox daily and have not had to change anything in about:config nor user.js.
  - tarxvf 3y ago
    Edit to clarify, not my GP but maybe similar experience. All the fixups, for five: browser.fixup.alternate.* (multiple) browser.fixup.dns_first_for_single_words browser.fixup.fallback-to-https (If I type something in the url bar I damn well mean it! It'd be fine if it tried others, but it tries them and then stays on them, meaning I have to retype urls to get it to load the actual thing I want.) There's a few others that I don't _need_ but do use that I'm not including here. System-provided custom CAs, for another, and removing the CAs I don't trust and am not likely to be impacted by removing. I don't need or want trust in a Turkish CA, for example. Cert stuff in particular gets worse every year, and here's another specific example of that: security.certerrors.permanentOverride. Enough said, I hope. At least they give me the option to make it temporary again. There's no GPSD support in any easily available Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1250922#c24 https://bugzilla.mozilla.org/show_bug.cgi?id=1250922#c24 and they're going to remove it (again) because they didn't maintain it: https://bugzilla.mozilla.org/show_bug.cgi?id=1803234 https://bugzilla.mozilla.org/show_bug.cgi?id=1803234. Now I need dbus and geoclue, I guess. Where are the docs on how? I think it's clear enough that Firefox is not being made for the _users_ with this topic. There are more, but I hope this is enough to show that they exist. These are the most egregious, for me - if they were removed I would stop using the web entirely the same way I've stopped using my cell phone for everything except work.
  - Rebelgecko 3y ago
    Part of the problem is that I'm on my non-primary machine so I don't know which ones I'm missing findbar.highlightall is essential for me extensions.pocket.enabled hide "are you sure" dialog when opening about:config browser.urlbar.clickselectsall (now defunct) extensions.checkCompatibility & friends (not sure if still necessary since I can't recall why I'm using it in the first place) browser.backspace_action (might be platform dependent?) browser.tabs.tabMinWidth browser.compactmode.show user.js customization because when I use tree style tabs there's redundant UI elements
FreshStart 3y ago
They will sell no-addblock days. For security reasons. The last big gulp to take from the little audience they have left.
- kemotep 3y ago
  This is conspiratorial in nature. Firefox has run ads against all users before but why would they specifically do what you suggest when uBlock Origin is shown in the linked article to be a trusted application that this domain quarantine list would not apply to?
tivert 3y ago
> This isn’t just their extension, if I am reading this correctly it is any extension(that hasn’t been vetted by Mozilla) is capable of being blocked from running due to this this new quarantined domain list that Firefox 115 has. What domains are in this "new quarantined domain list"?
ilyt 3y ago
"it's fine because power users can disable it deep into about:config options that are not even in config panel" is a terrible excuse
- grokgrok 3y ago
  Sometimes you just don't want the Find-a-Coupon extension accessing Grandma's Zelle.
gaws 3y ago
> I highly recommend you use a minimum amount of extensions anyway. > I really only use uBlock Origin, Bitwarden, and tab containers at this point. Stylus, Privacy, Bypass Paywalls, and OneTab are up there in "essential" extensions.

TheRealPomax 3y ago

"We've taken away your power and hidden it behind a setting that we have no obligation to maintain" seems to have been the Firefox motto for the last ten years, and continues to go strong.

kemotep 3y ago
It is increasingly frustrating but in my opinion Firefox is the only usable browser. The ads and other nonsense, despite being pushed out often, are still user controllable and once configured, I have always had my settings honored. You cannot say the same about Edge and if app manifest v3 actually does what people say does, Chrome will essentially be undergoing the same cut off of extension capabilities that Firefox Quantum did years ago but even worst.
- cglong 3y ago
  I'm wary of Manifest v3, but like you say, it isn't a mandate yet. Is there any reason today why Chrome isn't usable? There's also Brave, which I love on Android.
  - kemotep 3y ago
    It’s more or less ideological on my part. There being only 1 browser engine is something I would like to avoid. And unless Safari becomes available on Linux (or that Orion browser from the makers of Kagi), Firefox is the only other option. There is Librewolf and some other gecko based ones out there but other than the TOR browser, none of the others are large enough projects that I would trust with something as important as my Web Browser. I support plenty of end users on Chrome and Edge at work and will happily oblige my wife by installing and configuring Chrome on all her devices. Firefox is what works for me and what I am comfortable using at this time. Unusable was certainly a hyperbole on my part.
    - cglong 3y ago
      Got it, thank you for explaining! :) I've never used Linux full-time, but from my understanding, neither GNOME Web nor Konqueror are Blink-based. Are they missing critical power user features?
      - kemotep 3y ago
        The lack or nonstandard support for extensions. But looking into it, I see that it looks like at least Gnome Web now can support extensions. Currently not using Gnome or KDE on my Linux install though.
        cglong 3y ago
        Not sure if this helps, but according to Wikipedia: > Despite being a component of GNOME, Web has no dependency on GNOME components, so it can be potentially installed on any system supporting GTK and WebKitGTK.
  - 3y ago
- a_imho 3y ago
  once configured, I have always had my settings honored totally different experience, FF ESR decided to update itself just the other day and break a bunch of stuff out of the blue, because of course moz://a knows better what I need and when I need it. It is very sad people like me need to put up with this abusive behaviour because the alternatives are worse
  - kemotep 3y ago
    Do you have an example? I would like to double check my own browser to see if anything has been changed without my knowledge or permission.
    - a_imho 3y ago
      You mean besides the forced update? Unfortunately not much I can help with, in my case I was deliberately running ESR 78.14.0 which was force updated to ESR 102.11.0 on May 26 and later 102.12.0 on June 20 (setting is obviously 'Check for updates'). It was a pretty big change first, so I naturally tried to revert back as much as I could. However for example Google Image Search is broken again, clicking it simply crashes the tab (Gah. Your tab just crashed), which could be fixed by tweaking some options in the earlier version iirc. Unless moz://a managed to break it a different way this time
- RobotToaster 3y ago
  >I have always had my settings honored They disabled the setting to enable XUL extensions. They disabled a bunch of extensions I had installed on firefox android.
  - TheRealPomax 3y ago
    They didn't disable the setting to enable XUL extensions, they rewrote the codebase to something that can't run XUL. And of all the changes in the past decade, that's actually one I'm 100% okay with, XUL was a hot mess that could do way more harm than any extension should have ever even in theory been able to do. As long as FF doesn't buy into Manifest v3. Which it will. Because it will.
    - JohnFen 3y ago
      > of all the changes in the past decade, that's actually one I'm 100% okay with I would have been OK with it if it didn't come with the loss of functionality.
      - TheRealPomax 3y ago
        There's "loss of functionality" and then there's "I am enjoying functionality that's due to an extention potentially taking over my system". More of the former, less of the latter please.
        JohnFen 3y ago
        Fair enough! It means FF is the browser for you, and it's not the browser for me.
    - type0 3y ago
      It will when they update their Manifesto to v3 https://www.mozilla.org/en-US/about/manifesto/ https://www.mozilla.org/en-US/about/manifesto/
- spiralpolitik 3y ago
  I remember when they rolled out DNS over HTTPs and set the default to "Fallback Mode" effectively highjacking DNS for most users. Good times figuring out why users couldn't access certain sites after ignoring the vague opt-out message, good times.
ncann 3y ago
While I understand the frustration, they're pretty good at keeping about:config settings around. I can't remember the last time they removed one. The same can't be said about Chrome.
- SilasX 3y ago
  Right. They keep the config settings around. They just start ignoring the value, like in the case of allowing unsigned extensions. Or anything related to telemetry and user experiments.
  - hpd 3y ago
    While I've not noticed any settings being ignored, I suggest to use policies(either GPO or "policies.json" when it comes to telemetry. As for experiments I've been running ESR for so long that I don't even know what these are supposed to be or do.
    - SilasX 3y ago
      Wow, you didn’t notice the one I just listed even after I listed it? That level of ignorance takes effort! As for telemetry, I’m talking about this particular incident, where the “user studies” feature was used to force an unrelated update: https://news.ycombinator.com/item?id=19826827 https://news.ycombinator.com/item?id=19826827
- TheRealPomax 3y ago
  You mean those settings that you don't get to see anymore when you type about:config unless you now, every fucking time, click "show me all settings"? The one they also removed entirely from the android release? That about:config? Because they've been doing the exact same thing to that, packing it away more and more, slowly killing off the parts that made it a great power user and developer browser by just making them a little bit harder to use or get to every time.
anjel 3y ago
This new "feature" is nothing to rejoice about but balancing against the parent observation not all unique firefox settings dissipate. eg. defeating video autoplay migrated from about:config to a prominent settings toggle listed under permissions.
- TheRealPomax 3y ago
  ... what are you smoking? Because I might need some, but also what the hell are you trying to even say?

A4ET8a8uTh0 3y ago

That.. is upsetting. Mozilla seems to be determined to ensure that the user base it does have left leave it. I am glad it can be toggled off, but why exactly is there to begin with is the real question.

deleted 3y ago
[deleted]
simlevesque 3y ago
> why exactly is there to begin with is the real question And "it's confidential" is the worst possible answer but it's still the one they gave us.
itzworm 3y ago
The commentor you've replied to says: > The best faith interpretation I can come up with, is in fact for security purposes. It creates restrictions on (at least from Mozilla’s perspective) untrusted extensions. I mean how many extensions are there that do act maliciously? It probably isn’t trivial. My best interpretation of that is it allows organizations to more easily allow some extensions while disallowing others.
- kemotep 3y ago
  Firefox is lagging behind on enterprise configuration options. Adding in additional features that allow sysadmins to deploy policies that can further control Firefox like Chrome and Edge could be potentially behind why this is happening. This is of course, complete speculation and if it was for enterprise management reasons, Mozilla should have clearly communicated it.
indymike 3y ago
The ability to prevent an extension from accessing specific sites is an improvement as long as the user can control it and it is not used for centralized access control. The reason this feature is there is that many extensions play poorly with or should not have access at all to specific sites. For example, Grammarly has no business accessing a corporate billing system and IT might want to disable access. In other cases an extension slows a site massively and a user might want to say, "not that site" to an extension. This could be the start of a big end-user improvement, especially if it can be managed by users and installers.

nani8ot 3y ago

Extension Manager [0] allows for installing Gnome extensions through an libadwaita app. This replaces the Gnome Extensions app and the browser extension. [0]: https://github.com/mjakeman/extension-manager https://github.com/mjakeman/extension-manager

kemotep 3y ago
Thanks for sharing this. It seems absurd that you needed a browser extension to manage your desktop environment and window manager theme. If only Xfce supported wayland.

BSEdlMMldESB 3y ago

my worry is that by firefox 225 that option will be gone, or will require modifying some text file in your profile. I say this because I already have had to modify a text file in my profile to get firefox to do what I want (tree style tabs without dupe tab-bar on top). also, by "firefox 225" I wonder how easy it will be to arbitrarily modify a 'protected' app/system text file (this is already difficult on smartphones)

madeofpalk 3y ago

I normally take the good faith interpretation for things like this, but I'm confused by this one. What security problem would be addressed by this? Why would Mozilla need to disable "untrusted" extensions for only certain websites? Why would a website need to be quarentined from an extension, instead of the other way around? I would think that the remote kill switch for a specific extension addresses the actual security concerns, or Mozilla just not allow 'untrusted extensions' by default on any website. I don't think Mozilla is evil for doing this, but I do find the motivation for this confusing.

BaseballPhysics 3y ago
Think high sensitivity sites like banking. Personally, I'd love to be able to flag sites as only having a limited whitelisted set of extensions, as they are a serious potential security risk. And I'm fine with the browser shipping with sane defaults. I don't want to have to manually tune this for my family members. Come to think of it, even better would be to attach this feature to whole containers...
- jeroenhd 3y ago
  I understand this position, but I do see several trackers ("telemetry") get blocked by uBlock on my bank's website. This type of telemetry can go die in a fire for all I'm concerned, but these trackers are particularly devious with their constantly changing domains and URLs. Addons that allow for things like regex matching are the only solution that seems to work because the Pihole blacklist doesn't seem to block them sufficiently. Mozilla has already killed off malicious addons by enforcing their signature requirements. I'm not sure what this adds, I doubt Mozilla will hire someone to monitor the changes to banking URLs around the world (a necessity if this is indeed intended to make banking safer).
  - BaseballPhysics 3y ago
    > I understand this position, but I do see several trackers ("telemetry") get blocked by uBlock on my bank's website. Which is why I'd leave uBlock whitelisted. I never said I want to block all extensions! > I doubt Mozilla will hire someone to monitor the changes to banking URLs around the world uBlock effectively does this for advertising domains. Why is that any different?

concinds 3y ago

> is being communicated In the release notes which 95% of users don't read, and in a text label hidden in a toolbar menu. No informed consent or prompt to opt-in. And Mozilla hasn't disclosed their criteria for inclusion of websites, and what they plan to use it for.

kemotep 3y ago
The average user isn’t using Firefox to begin with. In fact 5% market share for Mozilla is probably pretty generous. I agree with you that Mozilla has certainly dropped the ball regarding this change. Much like pocket, the Mr Robot ARG, the Quantum update, DoH with Cloudflare as the default provider, and so on. But again all but the Quantum update have been user configurable, and in my experience, have not been reverted unlike my browser preferences on Windows, where Edge hijacks anything and everything with very little recourse.
- NooneAtAll3 3y ago
  > The average user isn’t using Firefox to begin with. that's... not a valid argument for this discussion? market share and user conservatism has no connection to concerns about basic safety affecting everyone judgement should be applied equally, every user and every product
  - mrtranscendence 3y ago
    > that's... not a valid argument for this discussion? I believe the intention was to argue against the notion that 95% of users don't read release notes. The contention seems to be that, because Firefox users are more technical (or enthusiast, perhaps), more than 5% of Firefox users would read be aware of this change.
  - kemotep 3y ago
    The grandparent comment was regarding that the average user doesn’t read release notes and I was remarking that Firefox users are not average. Now I agree that this change is not being communicated properly but to claim that the Firefox user is similar to the average computer user is not something I would agree with.

jorvi 3y ago

> I highly recommend you use a minimum amount of extensions anyway. This why Brave has far surpassed Firefox at this point. - Good privacy defaults - Adblocking - The iOS browser actually has ad-blocking (this alone is why I shy every layman away from Firefox, fuck Mozilla for specifically locking those users out in the cold) - Choose your own blocklists - Anti-fingerprinting - Soon cookie auto-delete - Soon port scan blocking - WebRTC protection - HTTPS upgrading (less relevant these days but hey) - IPFS - Tor They also have a viable business model beyond “pay me off, Google”. And that is not to mention how Mozilla has chosen to soak their entire culture in ultra-progressive nonsense instead of rooting it in tech. Yes, Brave appending affiliate links was scummy (although not particularly harmful to their users). But that is quite some time ago now. I was a Mozilla / Firefox stan for a very very very long time. I still love Thunderbird, especially the progress they’re making now. But Firefox (and to a lesser point Mozilla) has completely lost its way.

bloopernova 3y ago
I haven't looked much at Brave, does it have nested vertical tabs and bookmark tags? Those are my killer features that I really don't want to give up.
- jorvi 3y ago
  Verticals tabs do have nesting via tan groups. They just introduced vertical tabs, so expect pretty quick improvements and iterating for the next few months. Two things coming in the (near?) future: - vertical tabs get a number or background color when collapsed, helping visual differentiation and memorization - tab ‘+’ button moved to more convenient location Bookmarks don’t have tags, and I haven’t heard much noise about planned improvement (or users needing improvement) there.
impissedoff1 3y ago
Let's not forget mozilla prioritized renaming master password to primary password before adding back in print to Firefox mobile, and it's still missing..5 years later...

LegitShady 3y ago

>However this feature can be disabled, or otherwise overridden at this time by the end use Key words "at this time". In a few versions maybe they take that away and you can't block ads ok YouTube because Google threatened them. Building the capability and hiding the options in the about config is opening the door to a lot of bad decisions later on.

hexage1814 3y ago
It's also worth notice that Mozilla, for instance, removed Bypass Paywalls Clean https://www.ghacks.net/2023/04/20/mozilla-removes-bypass-paywalls-clean-extension-from-its-add-repository/ https://www.ghacks.net/2023/04/20/mozilla-removes-bypass-pay...
- LegitShady 3y ago
  I'm less concerned about that. Mozilla doesn't have to host it. The author can offer it elsewhere.
  - hexage1814 3y ago
    >Mozilla doesn't have to host it But they still have to sign it, even if you're offering your extension somewhere else. https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/ https://blog.mozilla.org/addons/2015/02/10/extension-signing...
    - LegitShady 3y ago
      I had no idea this was implemented. Yikes.
mcpackieh 3y ago
> In a few versions maybe they take that away and you can't block ads ok YouTube because Google threatened them. And since they already built the requisite system needed to fulfill Google's demand, they won't be able to claim it would be too much work to implement. They're setting themselves up to readily comply with the demand when it comes.

GeekyBear 3y ago

> I highly recommend you use a minimum amount of extensions anyway. Given the number of extensions silently purchased by people seeking to spy and push malware, I've minimized the use of extensions that aren't vetted in advance by Mozilla/Firefox. > Recommended extensions undergo full code review by staff security experts to provide a strong additional security check. https://blog.mozilla.org/en/products/firefox/firefox-recommended-extensions/ https://blog.mozilla.org/en/products/firefox/firefox-recomme...

floomk 3y ago

If an extension has been installed on my machine it is by definition trusted. Firefox is not my antivirus solution and it should not try to be. Keep your lane.

Groxx 3y ago
Adware and spyware have a long history of silently installing browser extensions to collect more info. Is it really trusted? Though this kind of thing will generally be removed by the extension block list, not merely blocked from working on some domains.
- floomk 3y ago
  As far as the browser should be concerned, yes it is trusted. It's up to another layer of security to help the user not install extensions (or any other software) that they do not want on their machine. This security is a farce anyway. Firefox is installed in the user profile so any sufficiently advanced malware can just patch the firefox binary and embed itself in there or disable this nonsense. The extension shenanigans is just done to take away user control, with the excuse being to protect users from malware.
  - deleted 3y ago
    [deleted]
- ilyt 3y ago
  Okay ? If FF knows signature of known bad extension why would it block it only on some sites?! That makes zero sense from security perspective. It would be like asking antivirus to only let virus access D:\ drive...
  - Groxx 3y ago
    Yeah, the site-specific blocking seems... mostly dubious, possibly decent as a "this is a banking website - extensions are disabled by default, but you can click to enable them" thing. Right now it looks much more dubious than anything though. But even in the very best case, it's yet another custom "premium support" feature either way, like the Public Suffix List. They should push for standards instead, these kinds of things are always leaky and sometimes dangerous. Anyway. I just meant that extensions are not trustworthy just because they're installed. Malicious vectors exist, and protecting people from themselves / them understandably not being an up-to-date expert in all things tech by the millions-to-billions is largely a good thing.

RobotToaster 3y ago

>However this feature can be disabled For now. You used to be able to install any extension in firefox mobile, but they blocked that without any option to override it.

amenod 3y ago
Actually you can override it, but they made the process so convoluted and privacy breaking that I would guess not many people use it. So yes, effectively they blocked it.

NooneAtAll3 3y ago

what does Tab Container extention do that isn't in the default container tabs?

slondr 3y ago
“Default” container tabs have no user-facing UI. Tab Containers gives them a ui.
- NooneAtAll3 3y ago
  are you sure? I don't have extension installed and I have "Open Link in New Container Tab" button

rvz 3y ago

That is even worse than thought. > However this feature can be disabled, or otherwise overridden at this time by the end user when following the documentation[0]. Nefarious features 'enabled by default' is the standard of Firefox. What else have they switched on behind the user's back then? > I highly recommend you use a minimum amount of extensions anyway. The OP’s extension is a good one from what I can tell but I really only use uBlock Origin, Bitwarden, and tab containers at this point. I guess whenever I use Gnome I end up having to use their extension too which is frustrating but a different story. You might as well use Brave Browser at this point.

Rebelgecko 3y ago

At this point I'm up to maybe 15-20 about:config + user.js changes to make FF work properly for me. Unfortunately I use FF on multiple computers, is there a good way to keep everything in sync? Not sure how well something like a git repo would work.

naavis 3y ago
Could you give some examples? I use Firefox daily and have not had to change anything in about:config nor user.js.
- tarxvf 3y ago
  Edit to clarify, not my GP but maybe similar experience. All the fixups, for five: browser.fixup.alternate.* (multiple) browser.fixup.dns_first_for_single_words browser.fixup.fallback-to-https (If I type something in the url bar I damn well mean it! It'd be fine if it tried others, but it tries them and then stays on them, meaning I have to retype urls to get it to load the actual thing I want.) There's a few others that I don't _need_ but do use that I'm not including here. System-provided custom CAs, for another, and removing the CAs I don't trust and am not likely to be impacted by removing. I don't need or want trust in a Turkish CA, for example. Cert stuff in particular gets worse every year, and here's another specific example of that: security.certerrors.permanentOverride. Enough said, I hope. At least they give me the option to make it temporary again. There's no GPSD support in any easily available Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1250922#c24 https://bugzilla.mozilla.org/show_bug.cgi?id=1250922#c24 and they're going to remove it (again) because they didn't maintain it: https://bugzilla.mozilla.org/show_bug.cgi?id=1803234 https://bugzilla.mozilla.org/show_bug.cgi?id=1803234. Now I need dbus and geoclue, I guess. Where are the docs on how? I think it's clear enough that Firefox is not being made for the _users_ with this topic. There are more, but I hope this is enough to show that they exist. These are the most egregious, for me - if they were removed I would stop using the web entirely the same way I've stopped using my cell phone for everything except work.
- Rebelgecko 3y ago
  Part of the problem is that I'm on my non-primary machine so I don't know which ones I'm missing findbar.highlightall is essential for me extensions.pocket.enabled hide "are you sure" dialog when opening about:config browser.urlbar.clickselectsall (now defunct) extensions.checkCompatibility & friends (not sure if still necessary since I can't recall why I'm using it in the first place) browser.backspace_action (might be platform dependent?) browser.tabs.tabMinWidth browser.compactmode.show user.js customization because when I use tree style tabs there's redundant UI elements

FreshStart 3y ago

They will sell no-addblock days. For security reasons. The last big gulp to take from the little audience they have left.

kemotep 3y ago
This is conspiratorial in nature. Firefox has run ads against all users before but why would they specifically do what you suggest when uBlock Origin is shown in the linked article to be a trusted application that this domain quarantine list would not apply to?

tivert 3y ago

> This isn’t just their extension, if I am reading this correctly it is any extension(that hasn’t been vetted by Mozilla) is capable of being blocked from running due to this this new quarantined domain list that Firefox 115 has. What domains are in this "new quarantined domain list"?

ilyt 3y ago

"it's fine because power users can disable it deep into about:config options that are not even in config panel" is a terrible excuse

grokgrok 3y ago
Sometimes you just don't want the Find-a-Coupon extension accessing Grandma's Zelle.

gaws 3y ago

> I highly recommend you use a minimum amount of extensions anyway. > I really only use uBlock Origin, Bitwarden, and tab containers at this point. Stylus, Privacy, Bypass Paywalls, and OneTab are up there in "essential" extensions.