15 ms·

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store aft

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need a privacy policy"–we already have one. "You are using machine generated and minified code"–no you are looking at the built code, not the included source. "We cannot reproduce your source"-that's because you didn't follow instructions and are in the wrong directory. Very frustrating.

sureIy 2y ago
I had these issues too a few years ago. Now the review time is shorter than Chrome’s and hasn’t been flagged in a few years. However my extension has about 10k users, if that makes any difference.
jjice 2y ago
Also had these issues when working on my previous job's extension. The Firefox review process was a real nightmare to work with. Same heavy delays and misunderstandings your mentioned. Eventually the company just stopped updating the Firefox extension as often since usage was low and the review process was such a pain. Unfortunate for me, as the only engineer (maybe employee) at that company that used Firefox.
- whstl 2y ago
  Same here. We even had a special "mini" Firefox version that didn't require any additional Javascript build step, to make the review easy. But there were so many issues with the review and so few users that we just decided to give up.
- rightbyte 2y ago
  The whole extension change Mozilla forced on Firefox seems like some sort of sabotage. Mozilla sneaking in more and more spyware and ad friendly functionality seems in line with the same conspirators. And given how high profile all these changes are, it runs to the top of the company.
  - Squeeeez 2y ago
    So, which browser are you using?
    - rightbyte 2y ago
      Firefox... I wont give up on them just yet :)
ilrwbwrkhv 2y ago
That's not just mozilla. Google's review team all are in India and they cannot write clear English. It's a mess.
- salesynerd 2y ago
  Why make such a generalized statement?
- politelemon 2y ago
  Also Apple and Meta. It's awful dealing with infallible gatekeepers.
- Rinzler89 2y ago
  >Google's review team all are in India and they cannot write clear English. Which is ironic considering the reason they went to India and not other countries with cheap labor is that English is an official language there.
  - lenerdenator 2y ago
    The problem is that the set of "Indians who can speak fluent English" and the set of "Indians who will work for the absolute lowest bid" are exclusive. And I don't blame them, really. These execs mistake "English is an official language" for "English is a widespread first language". Only 0.02% of Indians speak English as their first language, while total speakers (of first, second, or third language) are 10.6% of the population.[0] [0] https://en.wikipedia.org/wiki/Languages_of_India#Multilingualism https://en.wikipedia.org/wiki/Languages_of_India#Multilingua...
    - hedora 2y ago
      The last time I had realistic numbers, an outsourced engineer in India cost a bit more than a comparable one in the Midwestern US. I’d guess they’re more expensive now, despite the obvious timezone problems.
    - Izkata 2y ago
giancarlostoro 2y ago
> that's because you didn't follow instructions and are in the wrong directory. You just need to have a shell script in the root directory that assumes the person running it has 0 clue about your extension. Also some of this reminds me of Apple. They clear something up, then bring it up again the next time review is needed.
- adrian17 2y ago
  Even this we had issues with - we wrapped the entire build environment and script in a dockerfile, but depending on system configuration you may or may not have to run docker with sudo - it just so happened that reviewer's environment required it, while ours didn't, and the reviewer needed specific instructions on what to do in this case. Another time, they failed the review because the reviewer's VM _ran out of disk space_ (which we only learned after digging into the issue, as the first report just mentioned "build errors"; according to later inquiries the VM had ~9GB available) and we had to add some extra build logic to delete intermediate files, just for them. The build is quite large because it involves rust->wasm compilation, but I'd still expect the reviewer's machine to have a bit more space...
  - cxr 2y ago
    Everything described here sounds like your team, your extension, and your software development process are the problem. Demanding >9GB of disk space to build a browser extension is capital F, capital I Fucking Insane. Go yell at the Rust folks about their shitty toolchain and your engineering lead for buying into it instead of blaming people who have enough problems as it is just coming into contact with the quagmire you described.
    - adrian17 2y ago
      The 9GB limit was not just the Rust stuff, that was for the entire docker environment with compiler, JRE, node, wasm toolkit, typescript, webpack etc. Yes, we need all of these to make a "true" reproducible build from scratch. > to build a browser extension It shares 99% of code with a desktop application; you can compile it to wasm while preserving most features. The extension wraps the wasm. For reference, when making a single clean build, the `target/` dir reaches 700MB.
adrian17 2y ago
> We cannot reproduce your source This is the biggest issue we had, and we had to add a decent bit of complexity to our builds to support reproducible builds in the exact way they want. But the silly part is that our extension involves building a wasm file from Rust, and after some back and forth it turned out that they don't require it to be reproducible (despite being core of our extension and containing 99% of our logic), which honestly feels like it defeats the point - who cares if JS reproduces if you can hide any arbitrary possibly-malicious code in wasm. For a while we were seriously considering putting our prebuilt wasm in the source package or on npm, just to make the "reproducible build" on AMO side simpler, despite this making it even further from how it's actually built.
- Etherlord87 2y ago
  What kind of harmful code could you put in WASM? You could return a string that you eval on the javascript side, so the reviewers could possibly ask for the WASM source if they saw the eval, but other than that the purpose of WASM is to be a safe sandbox after all, right?
  - xelamonster 2y ago
    I'm not familiar with the security guarantees of WASM in the browser but I imagine they're more along the lines of preventing data exfiltration from the browser/OS, it would be difficult to prevent something like abusing your CPU resources to mine Bitcoin in the background for example.
    - Etherlord87 2y ago
      One way to protect yourself from bitcoin mining is to not give a WASM program both an access to get incoming data and send data both into a 3rd party server. Another possibility is to threshold computation power on the WASM interpreter so that there's a limit of opcodes processed.
jeffchien 2y ago
The reproducible build requirement seems to be a major blocker for many addons, including one I use for Twitch: https://github.com/FrankerFaceZ/FrankerFaceZ/issues/1495#issuecomment-2168139762 https://github.com/FrankerFaceZ/FrankerFaceZ/issues/1495#iss...
stainablesteel 2y ago
this seems like the kind of place where user-based reviews would be more efficient, better, and more open having the makers of a browser do this is bound to create both efficiency and political problems for extensions. im remembering dissenter now
saulrh 2y ago
Every time I hear about the review processes for browser extensions I'm shocked that the it involves humans having to read your README and manually plumb together the build process. Sometimes I hear that reviewers are even reusing VMs when doing reviews, or even not using VMs at all. I'd have expected the review form to have a textbox where you paste your git link and a well-documented automated pipeline that stands up a specified VM with a specified amount of RAM and disk, clones the git, descends into it, and executes `docker build -t ./docker/review/Dockerfile`. I'm surprised that the reviewers themselves haven't outright demanded such tooling from their larger organization, just as a matter of job satisfaction - I can't imagine all the abuse they get from angry app owners.
- 01HNNWZ0MV43FF 2y ago
  Browser extensions really seem like they're slowly failing and just not supported. Kinda like PWAs. I want to write a chat program, but it has to work on phones, and the DevEx for native phone frameworks compared to desktop apps looks like hell, and PWAs seem to be barely supported. It's easier than ever to make a CLI or desktop app, but phones seem like the worst of all Microsoft dev history - Learn these arcane lifecycle vocab words that make no sense, like using Win32 directly, but also it changes every year or two like when MS invents a new GUI framework, but also if you can't get into The Store, nobody but your power user friends will be able to run your app anyway. What is this shit?
  - heraldgeezer 2y ago
    >Browser extensions really seem like they're slowly failing and just not supported. Kinda like PWAs. Ya, totally! lmao ublock origin has 8mil users on Firefox alone.
    - manquer 2y ago
      I don't think OP means for the lack of need or popularity, more so because vendors and platforms do not want them to be.
joshdavham 2y ago
That's interesting to hear. Do you also offer your extension on the chrome store? How did the review process differ? I ask because I've only published on the chrome store in the past.
arp242 2y ago
The problem with these types of things is that the people who are qualified to do good reviews are also the sort of people who can typically get a far more interesting job building stuff, rather than just reviewing code. It's work that does require a certain level of skill, but at the same time is also quite boring. And that more interesting job will probably pay better as well.
- ozim 2y ago
  I think that is one way that “tragedy of commons”.
- boopdewoop 2y ago
  Id rather hire a senior dev as a reviewer and a mid dev as the coder at a company. pay the reviewer more since they will be dealing with shit practices and having to train the dev.
- I_AM_A_SMURF 2y ago
  Not only that, but properly reviewing code would take forever. Heck I don't know how many senior engineers at my fancy tech company could do it and reliably spot problems.
horsawlarway 2y ago
Similar boat. I release an extension with about 1 million installs across Chrome/Firefox/Edge for work. Firefox (despite being the smallest usage) is utterly insane with regards to process. They demand a reproducible build, but then can't do things like install the right version of yarn (no - npm install -g yarn is not correct, our readme says it in bold like 5 times and provides the exact correct command to install the right version), or follow basic setup steps like "Use this version of node (complete with exact steps to install it and a script to automate that for them)". God fucking help you if you try to do something completely crazy as a private company like - checks notes - use a private NPM module. Despite providing them with access on a pre-configured account, or offering to give a review account access according to Mozilla "It's too hard to use external accounts during review". Honestly - having to interact with the browser review team is a BIG reason I no longer recommend Firefox. They're incompetent at best, and I'm fairly convinced they're just milking the google search deal income for as a much as it's worth - I don't think they really want to provide an alternative and secure browser anymore.
- ranger_danger 2y ago
  This is exactly what the review process for the Play Store is like, even worse for Google TV apps. Often times just re-submitting multiple times without changing anything at all will get it pushed through.
  - Yeul 2y ago
    Yeah but despite how much HN hates Google everyone here will do whatever it takes to get on their app store. Google has the power to make the entire industry their bitch. Mozilla not so much.
    - horsawlarway 2y ago
      So much this. Mozilla barely breaks 10k installs out of our total 1million installed base. We had a really frank internal discussion about just dropping support for Mozilla because their review process is also the most expensive out of every client we currently ship (And not "reasonable expensive"... Useless time sink expensive, back and forths with folks who I would frankly not hire as a junior because they can't read a readme file and follow basic and clear instructions.) They are acting like they have the position to demand these reviews... and they just don't. Good devs just leave because they're a waste of time and money, and they're STILL rampant with malware on their store (Mozilla is literally the only one of the major vendors that will make a listing live with no vetting, and then 4 months later yank it because of "problems"...). It doesn't make me feel secure, it makes me feel like they're trying to market security. It makes me really dislike mozilla, and firefox was a formative part of the my tech career early.
fcking_n1gg3rs 2y ago
[flagged]
- LegitShady 2y ago
  [dead]

sureIy 2y ago

I had these issues too a few years ago. Now the review time is shorter than Chrome’s and hasn’t been flagged in a few years. However my extension has about 10k users, if that makes any difference.

jjice 2y ago

Also had these issues when working on my previous job's extension. The Firefox review process was a real nightmare to work with. Same heavy delays and misunderstandings your mentioned. Eventually the company just stopped updating the Firefox extension as often since usage was low and the review process was such a pain. Unfortunate for me, as the only engineer (maybe employee) at that company that used Firefox.

whstl 2y ago
Same here. We even had a special "mini" Firefox version that didn't require any additional Javascript build step, to make the review easy. But there were so many issues with the review and so few users that we just decided to give up.
rightbyte 2y ago
The whole extension change Mozilla forced on Firefox seems like some sort of sabotage. Mozilla sneaking in more and more spyware and ad friendly functionality seems in line with the same conspirators. And given how high profile all these changes are, it runs to the top of the company.
- Squeeeez 2y ago
  So, which browser are you using?
  - rightbyte 2y ago
    Firefox... I wont give up on them just yet :)

ilrwbwrkhv 2y ago

That's not just mozilla. Google's review team all are in India and they cannot write clear English. It's a mess.

salesynerd 2y ago
Why make such a generalized statement?
politelemon 2y ago
Also Apple and Meta. It's awful dealing with infallible gatekeepers.
Rinzler89 2y ago
>Google's review team all are in India and they cannot write clear English. Which is ironic considering the reason they went to India and not other countries with cheap labor is that English is an official language there.
- lenerdenator 2y ago
  The problem is that the set of "Indians who can speak fluent English" and the set of "Indians who will work for the absolute lowest bid" are exclusive. And I don't blame them, really. These execs mistake "English is an official language" for "English is a widespread first language". Only 0.02% of Indians speak English as their first language, while total speakers (of first, second, or third language) are 10.6% of the population.[0] [0] https://en.wikipedia.org/wiki/Languages_of_India#Multilingualism https://en.wikipedia.org/wiki/Languages_of_India#Multilingua...
  - hedora 2y ago
    The last time I had realistic numbers, an outsourced engineer in India cost a bit more than a comparable one in the Midwestern US. I’d guess they’re more expensive now, despite the obvious timezone problems.
  - Izkata 2y ago

giancarlostoro 2y ago

> that's because you didn't follow instructions and are in the wrong directory. You just need to have a shell script in the root directory that assumes the person running it has 0 clue about your extension. Also some of this reminds me of Apple. They clear something up, then bring it up again the next time review is needed.

adrian17 2y ago
Even this we had issues with - we wrapped the entire build environment and script in a dockerfile, but depending on system configuration you may or may not have to run docker with sudo - it just so happened that reviewer's environment required it, while ours didn't, and the reviewer needed specific instructions on what to do in this case. Another time, they failed the review because the reviewer's VM _ran out of disk space_ (which we only learned after digging into the issue, as the first report just mentioned "build errors"; according to later inquiries the VM had ~9GB available) and we had to add some extra build logic to delete intermediate files, just for them. The build is quite large because it involves rust->wasm compilation, but I'd still expect the reviewer's machine to have a bit more space...
- cxr 2y ago
  Everything described here sounds like your team, your extension, and your software development process are the problem. Demanding >9GB of disk space to build a browser extension is capital F, capital I Fucking Insane. Go yell at the Rust folks about their shitty toolchain and your engineering lead for buying into it instead of blaming people who have enough problems as it is just coming into contact with the quagmire you described.
  - adrian17 2y ago
    The 9GB limit was not just the Rust stuff, that was for the entire docker environment with compiler, JRE, node, wasm toolkit, typescript, webpack etc. Yes, we need all of these to make a "true" reproducible build from scratch. > to build a browser extension It shares 99% of code with a desktop application; you can compile it to wasm while preserving most features. The extension wraps the wasm. For reference, when making a single clean build, the `target/` dir reaches 700MB.

adrian17 2y ago

> We cannot reproduce your source This is the biggest issue we had, and we had to add a decent bit of complexity to our builds to support reproducible builds in the exact way they want. But the silly part is that our extension involves building a wasm file from Rust, and after some back and forth it turned out that they don't require it to be reproducible (despite being core of our extension and containing 99% of our logic), which honestly feels like it defeats the point - who cares if JS reproduces if you can hide any arbitrary possibly-malicious code in wasm. For a while we were seriously considering putting our prebuilt wasm in the source package or on npm, just to make the "reproducible build" on AMO side simpler, despite this making it even further from how it's actually built.

Etherlord87 2y ago
What kind of harmful code could you put in WASM? You could return a string that you eval on the javascript side, so the reviewers could possibly ask for the WASM source if they saw the eval, but other than that the purpose of WASM is to be a safe sandbox after all, right?
- xelamonster 2y ago
  I'm not familiar with the security guarantees of WASM in the browser but I imagine they're more along the lines of preventing data exfiltration from the browser/OS, it would be difficult to prevent something like abusing your CPU resources to mine Bitcoin in the background for example.
  - Etherlord87 2y ago
    One way to protect yourself from bitcoin mining is to not give a WASM program both an access to get incoming data and send data both into a 3rd party server. Another possibility is to threshold computation power on the WASM interpreter so that there's a limit of opcodes processed.

jeffchien 2y ago

The reproducible build requirement seems to be a major blocker for many addons, including one I use for Twitch: https://github.com/FrankerFaceZ/FrankerFaceZ/issues/1495#issuecomment-2168139762 https://github.com/FrankerFaceZ/FrankerFaceZ/issues/1495#iss...

stainablesteel 2y ago

this seems like the kind of place where user-based reviews would be more efficient, better, and more open having the makers of a browser do this is bound to create both efficiency and political problems for extensions. im remembering dissenter now

saulrh 2y ago

Every time I hear about the review processes for browser extensions I'm shocked that the it involves humans having to read your README and manually plumb together the build process. Sometimes I hear that reviewers are even reusing VMs when doing reviews, or even not using VMs at all. I'd have expected the review form to have a textbox where you paste your git link and a well-documented automated pipeline that stands up a specified VM with a specified amount of RAM and disk, clones the git, descends into it, and executes `docker build -t ./docker/review/Dockerfile`. I'm surprised that the reviewers themselves haven't outright demanded such tooling from their larger organization, just as a matter of job satisfaction - I can't imagine all the abuse they get from angry app owners.

01HNNWZ0MV43FF 2y ago
Browser extensions really seem like they're slowly failing and just not supported. Kinda like PWAs. I want to write a chat program, but it has to work on phones, and the DevEx for native phone frameworks compared to desktop apps looks like hell, and PWAs seem to be barely supported. It's easier than ever to make a CLI or desktop app, but phones seem like the worst of all Microsoft dev history - Learn these arcane lifecycle vocab words that make no sense, like using Win32 directly, but also it changes every year or two like when MS invents a new GUI framework, but also if you can't get into The Store, nobody but your power user friends will be able to run your app anyway. What is this shit?
- heraldgeezer 2y ago
  >Browser extensions really seem like they're slowly failing and just not supported. Kinda like PWAs. Ya, totally! lmao ublock origin has 8mil users on Firefox alone.
  - manquer 2y ago
    I don't think OP means for the lack of need or popularity, more so because vendors and platforms do not want them to be.

joshdavham 2y ago

That's interesting to hear. Do you also offer your extension on the chrome store? How did the review process differ? I ask because I've only published on the chrome store in the past.

arp242 2y ago

The problem with these types of things is that the people who are qualified to do good reviews are also the sort of people who can typically get a far more interesting job building stuff, rather than just reviewing code. It's work that does require a certain level of skill, but at the same time is also quite boring. And that more interesting job will probably pay better as well.

ozim 2y ago
I think that is one way that “tragedy of commons”.
boopdewoop 2y ago
Id rather hire a senior dev as a reviewer and a mid dev as the coder at a company. pay the reviewer more since they will be dealing with shit practices and having to train the dev.
I_AM_A_SMURF 2y ago
Not only that, but properly reviewing code would take forever. Heck I don't know how many senior engineers at my fancy tech company could do it and reliably spot problems.

horsawlarway 2y ago

Similar boat. I release an extension with about 1 million installs across Chrome/Firefox/Edge for work. Firefox (despite being the smallest usage) is utterly insane with regards to process. They demand a reproducible build, but then can't do things like install the right version of yarn (no - npm install -g yarn is not correct, our readme says it in bold like 5 times and provides the exact correct command to install the right version), or follow basic setup steps like "Use this version of node (complete with exact steps to install it and a script to automate that for them)". God fucking help you if you try to do something completely crazy as a private company like - checks notes - use a private NPM module. Despite providing them with access on a pre-configured account, or offering to give a review account access according to Mozilla "It's too hard to use external accounts during review". Honestly - having to interact with the browser review team is a BIG reason I no longer recommend Firefox. They're incompetent at best, and I'm fairly convinced they're just milking the google search deal income for as a much as it's worth - I don't think they really want to provide an alternative and secure browser anymore.

ranger_danger 2y ago
This is exactly what the review process for the Play Store is like, even worse for Google TV apps. Often times just re-submitting multiple times without changing anything at all will get it pushed through.
- Yeul 2y ago
  Yeah but despite how much HN hates Google everyone here will do whatever it takes to get on their app store. Google has the power to make the entire industry their bitch. Mozilla not so much.
  - horsawlarway 2y ago
    So much this. Mozilla barely breaks 10k installs out of our total 1million installed base. We had a really frank internal discussion about just dropping support for Mozilla because their review process is also the most expensive out of every client we currently ship (And not "reasonable expensive"... Useless time sink expensive, back and forths with folks who I would frankly not hire as a junior because they can't read a readme file and follow basic and clear instructions.) They are acting like they have the position to demand these reviews... and they just don't. Good devs just leave because they're a waste of time and money, and they're STILL rampant with malware on their store (Mozilla is literally the only one of the major vendors that will make a listing live with no vetting, and then 4 months later yank it because of "problems"...). It doesn't make me feel secure, it makes me feel like they're trying to market security. It makes me really dislike mozilla, and firefox was a formative part of the my tech career early.

fcking_n1gg3rs 2y ago

[flagged]

LegitShady 2y ago
[dead]