4 ms·

That sucks. I work for Mozilla, but nowhere near Addons so I don't know what pressures they're under or whatever. But if I ran the zoo... this is gorhill we're

by sfink 2y ago

That sucks. I work for Mozilla, but nowhere near Addons so I don't know what pressures they're under or whatever. But if I ran the zoo... this is gorhill we're talking about. We ought to just make him an add-on reviewer with full rights, and tell him it's ok if the only add-ons he reviews are his own. We do not need to vet either his competence or trustworthiness; we have vastly more historical data backing him up than on any contractor or employee. He's not a one-off either. We aren't nearly as volunteer-oriented as we used to be, sadly. But we still get many and major contributions from volunteers, and at least in my team (SpiderMonkey) there's no wall between external and paid contributors. (Except for the company-wide offsites, grr...) I don't see any reason why gorhill couldn't be made a full member of the review team, not that I'd expect him to be up for it right now given what's happened. That makes more sense to me than giving him a special pass that we could potentially give out to other people or organizations. He is a major contributor to Firefox's capability and success already, let him contribute reviews that are already a thing and provide value. (Again, only self-reviews would be just fine with me.) Now I need to figure out who to pester on Slack.

EasyMark 2y ago
I suspect he will simmer down a bit (I do not at all blame him for what he did, it has to be frustrating to dedicate thousands of hours into something just to have some clueless person pull it). I think it will be back inside of a week, it’s important and can save battery over regular ublock origin on Firefox.
- account42 2y ago
  > can save battery over regular ublock origin Comparing battery usage for tools with wildly different capabilites does not make sense.
- thoroughburro 2y ago
  > it’s important and can save battery over regular ublock origin on Firefox That sounds like a reason for Mozilla to simmer down and compromise, not gorhill.
  - cholantesh 2y ago
    They already did? In this specific context, acknowledging the mistake and reinstating the extension is materially all they can do. Maybe it is necessary to reform the extension review process, but getting UBOL back onto AMO would then just be a positive side effect of a much longer-term project.
omoikane 2y ago
This sounds like a proposal to make the review process giving more weight to reputation, unlike the current process which is supposed to be entirely technical[1]. This might be a good idea, but I can see how Mozilla would get a different set of complaints about reputation not being consistently evaluated. [1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing
- sfink 2y ago
  That's a fair complaint, and I definitely agree that using reputation as a factor in the decision for an individual addon is a very bad idea. But why is that? (1) Because reputation does not imply trustworthiness. Someone could build up a reputation with a set of very proper addons, and then use that reputation to sneak in problematic ones. (2) Because it's unfair special treatment. The chosen person's addons would be subject to different standards than others'. Again, this is gorhill. People are offering authors of popular addons some mind-bendingly large sums of money to sell out. (1) does not apply: gorhill is the author of the most popular addon, which implies that he has been offered if not the most money, at least a lot more than most. And the well-known history is that someone did make money off of his original version, that someone isn't him, and in response he rebirthed the addon that he didn't particularly want to maintain. Try to find someone with a more convincing backstory. (2) is trickier, and it's why the distinction between uBlock Origin getting a free pass and gorhill being a reviewer makes sense to me, even if it seems like I'm just obscuring influence. As a reviewer, gorhill would be expected to not just automatically approve his own addons, but to apply the agreed upon evaluation criteria. This would be a farce if his integrity were in question, but see (1). It's pretty clear to see that he is the person most qualified to make that evaluation (heck, he's already doing it before releasing; he's not new to the game), so it comes down to trust. Sure, I am not the best person to review my own code, no matter how honest I might be. But read the Technical Code Review portion of the link above[1], since it's the only part that matters here. There are some addons where those criteria might be difficult to evaluate, but we're not talking about those. If significant code changes cause those to be less clear cut, gorhill can always pass it by another reviewer. (Yes, this again requires trust. See (1).) Plus, you don't even have to depend on (1). People can be skeptical and double-check, and news would get out very very quickly. (Even shortcomings in areas like a reproducible build would get called out.) I don't see this being a wide open backdoor into the process. Not many people are going to come by with the #1 installed addon, together with the history of uBlock and uBlock Origin. Sure, factoring reputation into the process is fraught with problems, but I'm not suggesting that everyone above 1M installs gets grandfathered in. This slippery slope is bone dry and covered with cobblestones. [1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing
fph 2y ago
I disagree here. You don't want to allow people to review their own code. That defeats the purpose of a review. No matter if he's a superstar, have someone else look at his code so that he doesn't get sloppy with security practices. And if you allowed this, then more borderline superstars would want the same privilege. In scientific publishing, even if you're the editor in chief, your paper gets reviewed by someone else and the whole decision process happens away from your eyes; this is good for science.
thatguy288 2y ago
Probably a big ask, but could you find out why one is not allowed to add your own root cert to FF and sign an addon yourself, instead being forced to use an ESR/develop/nightly version and setting xpinstall.signatures.required to false, significantly reducing your security?
- anticensor 2y ago
  And, when a self-signed certificate is in use, the browser should show a prominent icon of self-configured security.
  - fwn 2y ago
    > And, when a self-signed certificate is in use, the browser should show a prominent icon of self-configured security. ..and there should of course be a way to disable that prominent icon of self-configured security. Because Firefox, unlike most software, is designed to be a user agent. While it may be natural for Google, for example, to constantly nag Chrome users for non-standard behaviour, Mozilla should not do the same with Firefox.

by sfink 2y ago

EasyMark 2y ago

I suspect he will simmer down a bit (I do not at all blame him for what he did, it has to be frustrating to dedicate thousands of hours into something just to have some clueless person pull it). I think it will be back inside of a week, it’s important and can save battery over regular ublock origin on Firefox.

account42 2y ago
> can save battery over regular ublock origin Comparing battery usage for tools with wildly different capabilites does not make sense.
thoroughburro 2y ago
> it’s important and can save battery over regular ublock origin on Firefox That sounds like a reason for Mozilla to simmer down and compromise, not gorhill.
- cholantesh 2y ago
  They already did? In this specific context, acknowledging the mistake and reinstating the extension is materially all they can do. Maybe it is necessary to reform the extension review process, but getting UBOL back onto AMO would then just be a positive side effect of a much longer-term project.

omoikane 2y ago

This sounds like a proposal to make the review process giving more weight to reputation, unlike the current process which is supposed to be entirely technical[1]. This might be a good idea, but I can see how Mozilla would get a different set of complaints about reputation not being consistently evaluated. [1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing

sfink 2y ago
That's a fair complaint, and I definitely agree that using reputation as a factor in the decision for an individual addon is a very bad idea. But why is that? (1) Because reputation does not imply trustworthiness. Someone could build up a reputation with a set of very proper addons, and then use that reputation to sneak in problematic ones. (2) Because it's unfair special treatment. The chosen person's addons would be subject to different standards than others'. Again, this is gorhill. People are offering authors of popular addons some mind-bendingly large sums of money to sell out. (1) does not apply: gorhill is the author of the most popular addon, which implies that he has been offered if not the most money, at least a lot more than most. And the well-known history is that someone did make money off of his original version, that someone isn't him, and in response he rebirthed the addon that he didn't particularly want to maintain. Try to find someone with a more convincing backstory. (2) is trickier, and it's why the distinction between uBlock Origin getting a free pass and gorhill being a reviewer makes sense to me, even if it seems like I'm just obscuring influence. As a reviewer, gorhill would be expected to not just automatically approve his own addons, but to apply the agreed upon evaluation criteria. This would be a farce if his integrity were in question, but see (1). It's pretty clear to see that he is the person most qualified to make that evaluation (heck, he's already doing it before releasing; he's not new to the game), so it comes down to trust. Sure, I am not the best person to review my own code, no matter how honest I might be. But read the Technical Code Review portion of the link above[1], since it's the only part that matters here. There are some addons where those criteria might be difficult to evaluate, but we're not talking about those. If significant code changes cause those to be less clear cut, gorhill can always pass it by another reviewer. (Yes, this again requires trust. See (1).) Plus, you don't even have to depend on (1). People can be skeptical and double-check, and news would get out very very quickly. (Even shortcomings in areas like a reproducible build would get called out.) I don't see this being a wide open backdoor into the process. Not many people are going to come by with the #1 installed addon, together with the history of uBlock and uBlock Origin. Sure, factoring reputation into the process is fraught with problems, but I'm not suggesting that everyone above 1M installs gets grandfathered in. This slippery slope is bone dry and covered with cobblestones. [1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing

fph 2y ago

I disagree here. You don't want to allow people to review their own code. That defeats the purpose of a review. No matter if he's a superstar, have someone else look at his code so that he doesn't get sloppy with security practices. And if you allowed this, then more borderline superstars would want the same privilege. In scientific publishing, even if you're the editor in chief, your paper gets reviewed by someone else and the whole decision process happens away from your eyes; this is good for science.

thatguy288 2y ago

Probably a big ask, but could you find out why one is not allowed to add your own root cert to FF and sign an addon yourself, instead being forced to use an ESR/develop/nightly version and setting xpinstall.signatures.required to false, significantly reducing your security?

anticensor 2y ago
And, when a self-signed certificate is in use, the browser should show a prominent icon of self-configured security.
- fwn 2y ago
  > And, when a self-signed certificate is in use, the browser should show a prominent icon of self-configured security. ..and there should of course be a way to disable that prominent icon of self-configured security. Because Firefox, unlike most software, is designed to be a user agent. While it may be natural for Google, for example, to constantly nag Chrome users for non-standard behaviour, Mozilla should not do the same with Firefox.