3 ms·

I normally take the good faith interpretation for things like this, but I'm confused by this one. What security problem would be addressed by this? Why would M

I normally take the good faith interpretation for things like this, but I'm confused by this one. What security problem would be addressed by this? Why would Mozilla need to disable "untrusted" extensions for only certain websites? Why would a website need to be quarentined from an extension, instead of the other way around? I would think that the remote kill switch for a specific extension addresses the actual security concerns, or Mozilla just not allow 'untrusted extensions' by default on any website. I don't think Mozilla is evil for doing this, but I do find the motivation for this confusing.

BaseballPhysics 3y ago
Think high sensitivity sites like banking. Personally, I'd love to be able to flag sites as only having a limited whitelisted set of extensions, as they are a serious potential security risk. And I'm fine with the browser shipping with sane defaults. I don't want to have to manually tune this for my family members. Come to think of it, even better would be to attach this feature to whole containers...
- jeroenhd 3y ago
  I understand this position, but I do see several trackers ("telemetry") get blocked by uBlock on my bank's website. This type of telemetry can go die in a fire for all I'm concerned, but these trackers are particularly devious with their constantly changing domains and URLs. Addons that allow for things like regex matching are the only solution that seems to work because the Pihole blacklist doesn't seem to block them sufficiently. Mozilla has already killed off malicious addons by enforcing their signature requirements. I'm not sure what this adds, I doubt Mozilla will hire someone to monitor the changes to banking URLs around the world (a necessity if this is indeed intended to make banking safer).
  - BaseballPhysics 3y ago
    > I understand this position, but I do see several trackers ("telemetry") get blocked by uBlock on my bank's website. Which is why I'd leave uBlock whitelisted. I never said I want to block all extensions! > I doubt Mozilla will hire someone to monitor the changes to banking URLs around the world uBlock effectively does this for advertising domains. Why is that any different?
    - jeroenhd 3y ago
      The tricky thing is what extensions should be whitelisted and what extensions shouldn't. uBlock is easy, but what about Consent-O-Matic? What about GreaseMonkey and friends? What about Stylus? Where do you draw the line? uBlock was just an example, of course. There are other addons that do more complex auto detection.
      - drdaeman 3y ago
        In my experience, banking websites are notoriously ass-backwards and need more hacks and patches than many other websites. I’ve specifically used Greasemonkey to fix bank breaking pasting into fields and blocking password managers by splitting login form into deliberately broken pieces.
  - fragmede 3y ago
    > Mozilla has already killed off malicious addons by enforcing their signature requirements. I don't think those signing requirements do what you think they do.
    - jeroenhd 3y ago
      They've nipped the crap inserted by adware in the bud. Sure, anyone who can pass a simple malware scan can get an addon published, but there's no doubt in my mind that getting rid of unsigned addons has helped a lot.
- impissedoff1 3y ago
  That's what incognito is for. And what you should use regardless
  - BaseballPhysics 3y ago
    What? No. I've never used incognito mode for that purpose. I still want my banking site to be able to, for example, drop persistent cookies (for example, to indicate I'm comfortable bypassing two factor on that device).
- depereo 3y ago
  When I went looking into this feature I saw they're developing a negative permissions list for addons, so you can create exceptions for i.e ublock or dark reader or whatever for specific websites, disallowing them to access your data on that page.
- ilyt 3y ago
  Okay? You have "malicious" extension. Why would you allow it to run everyhere ? What would just limiting the "fix" of blocking it to inevitably only some set of US banks (as I doubht they get the all URLs to every bank in the world) achieve?
  - BaseballPhysics 3y ago
    It's not about known malicious extensions, it's about known trusted extensions. Are you really not understanding this threat model?
    - JohnFen 3y ago
      Hmm, I thought I understood until your comment here. It being about known trusted extensions makes no sense to me -- so I guess I'm not understanding the threat model at all. If an extension is known and trusted, why does there need to be a Mozilla-controlled kill switch for it?
      - BaseballPhysics 3y ago
        It's the reverse. The purpose of the feature is to put known trusted extensions on a whitelist for sensitive sites while blacklisting everything else. In my case I'd put uBlock on my "yes I trust this extension" list and when I visit my banking website only that extension would be active. It's also not "Mozilla-controlled". It's a feature that will, in the future, come with sensible defaults, just as uBlock does with their default blocklists, but in 116 the user will be able to more fully configure the feature. Meanwhile, in 115 the feature isn't active by default because the extension whitelist and domain list are empty.
        horsawlarway 3y ago
        How do they know what sites I consider sensitive? How do they establish trust for an extension? How many dollars do you want to wager that they are building this feature with the intent to get sued so that they can be forced by the courts to turn it on for sites like youtube?
yjftsjthsd-h 3y ago
Actually iff it's user-controlled I'd love such a feature. As sibling comment notes, it'd be nice to have zero extensions (or maybe just uBo) running on sensitive sites like a bank, but I'd actually be more interested in running certain extensions only on select sites; ex. there are extensions to force videos to play at arbitrary speeds that I like for video sites, but I want to only let those extensions run on a very short list of sites (youtube, netflix, w/e) and nowhere else.
amenod 3y ago
Why "security problem"? The wording is telling: > ...for various reasons, including security concerns. Security is just a red herring. Who wins with this move? The cynic in me (who is usually annoyingly right) says Google. Mozilla loses even more trust from its users and Firefox now has a tool to disable ad blockers on websites of their biggest competitor^Wsponsor if they reach a suitable mutual agreement (read: G pays enough for it). Win-win for all the parties that have a say in this. Not users of course, but that's life.
- JohnFen 3y ago
  > ...for various reasons, including security concerns. Yes, this is what got my spidey-sense tingling, too.

BaseballPhysics 3y ago

Think high sensitivity sites like banking. Personally, I'd love to be able to flag sites as only having a limited whitelisted set of extensions, as they are a serious potential security risk. And I'm fine with the browser shipping with sane defaults. I don't want to have to manually tune this for my family members. Come to think of it, even better would be to attach this feature to whole containers...

jeroenhd 3y ago
I understand this position, but I do see several trackers ("telemetry") get blocked by uBlock on my bank's website. This type of telemetry can go die in a fire for all I'm concerned, but these trackers are particularly devious with their constantly changing domains and URLs. Addons that allow for things like regex matching are the only solution that seems to work because the Pihole blacklist doesn't seem to block them sufficiently. Mozilla has already killed off malicious addons by enforcing their signature requirements. I'm not sure what this adds, I doubt Mozilla will hire someone to monitor the changes to banking URLs around the world (a necessity if this is indeed intended to make banking safer).
- BaseballPhysics 3y ago
  > I understand this position, but I do see several trackers ("telemetry") get blocked by uBlock on my bank's website. Which is why I'd leave uBlock whitelisted. I never said I want to block all extensions! > I doubt Mozilla will hire someone to monitor the changes to banking URLs around the world uBlock effectively does this for advertising domains. Why is that any different?
  - jeroenhd 3y ago
    The tricky thing is what extensions should be whitelisted and what extensions shouldn't. uBlock is easy, but what about Consent-O-Matic? What about GreaseMonkey and friends? What about Stylus? Where do you draw the line? uBlock was just an example, of course. There are other addons that do more complex auto detection.
    - drdaeman 3y ago
      In my experience, banking websites are notoriously ass-backwards and need more hacks and patches than many other websites. I’ve specifically used Greasemonkey to fix bank breaking pasting into fields and blocking password managers by splitting login form into deliberately broken pieces.
- fragmede 3y ago
  > Mozilla has already killed off malicious addons by enforcing their signature requirements. I don't think those signing requirements do what you think they do.
  - jeroenhd 3y ago
    They've nipped the crap inserted by adware in the bud. Sure, anyone who can pass a simple malware scan can get an addon published, but there's no doubt in my mind that getting rid of unsigned addons has helped a lot.
impissedoff1 3y ago
That's what incognito is for. And what you should use regardless
- BaseballPhysics 3y ago
  What? No. I've never used incognito mode for that purpose. I still want my banking site to be able to, for example, drop persistent cookies (for example, to indicate I'm comfortable bypassing two factor on that device).
depereo 3y ago
When I went looking into this feature I saw they're developing a negative permissions list for addons, so you can create exceptions for i.e ublock or dark reader or whatever for specific websites, disallowing them to access your data on that page.
ilyt 3y ago
Okay? You have "malicious" extension. Why would you allow it to run everyhere ? What would just limiting the "fix" of blocking it to inevitably only some set of US banks (as I doubht they get the all URLs to every bank in the world) achieve?
- BaseballPhysics 3y ago
  It's not about known malicious extensions, it's about known trusted extensions. Are you really not understanding this threat model?
  - JohnFen 3y ago
    Hmm, I thought I understood until your comment here. It being about known trusted extensions makes no sense to me -- so I guess I'm not understanding the threat model at all. If an extension is known and trusted, why does there need to be a Mozilla-controlled kill switch for it?
    - BaseballPhysics 3y ago
      It's the reverse. The purpose of the feature is to put known trusted extensions on a whitelist for sensitive sites while blacklisting everything else. In my case I'd put uBlock on my "yes I trust this extension" list and when I visit my banking website only that extension would be active. It's also not "Mozilla-controlled". It's a feature that will, in the future, come with sensible defaults, just as uBlock does with their default blocklists, but in 116 the user will be able to more fully configure the feature. Meanwhile, in 115 the feature isn't active by default because the extension whitelist and domain list are empty.
      - horsawlarway 3y ago
        How do they know what sites I consider sensitive? How do they establish trust for an extension? How many dollars do you want to wager that they are building this feature with the intent to get sued so that they can be forced by the courts to turn it on for sites like youtube?

yjftsjthsd-h 3y ago

Actually iff it's user-controlled I'd love such a feature. As sibling comment notes, it'd be nice to have zero extensions (or maybe just uBo) running on sensitive sites like a bank, but I'd actually be more interested in running certain extensions only on select sites; ex. there are extensions to force videos to play at arbitrary speeds that I like for video sites, but I want to only let those extensions run on a very short list of sites (youtube, netflix, w/e) and nowhere else.

amenod 3y ago

Why "security problem"? The wording is telling: > ...for various reasons, including security concerns. Security is just a red herring. Who wins with this move? The cynic in me (who is usually annoyingly right) says Google. Mozilla loses even more trust from its users and Firefox now has a tool to disable ad blockers on websites of their biggest competitor^Wsponsor if they reach a suitable mutual agreement (read: G pays enough for it). Win-win for all the parties that have a say in this. Not users of course, but that's life.

JohnFen 3y ago
> ...for various reasons, including security concerns. Yes, this is what got my spidey-sense tingling, too.