99 ms·

Firefox is also the only browser that vets uBlock's code on every update to make sure the developer hasn't inserted spyware or malware into the extension. They

Firefox is also the only browser that vets uBlock's code on every update to make sure the developer hasn't inserted spyware or malware into the extension. They don't do it for every extension, but they do so for a wide selection of popular options. > Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality and user experience. After receiving Recommended status, safety standards are maintained through automated checks, monitoring, and periodic technical reviews https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-...

big_toast 2mo ago
That's pretty cool. Thanks for pointing that out. I don't see where it says 'on every update' unless you're referring to the automated checks? I've always wished extensions had more granular permissions though (a la phones, but more so). I think automated ai security checks sound promising soon.
- elashri 2mo ago
  Automated checks are done for every extension on every update. But their recommend extensions they feature on the Extension store, they do other extensive checks for each update.
- socalgal2 2mo ago
  what permissions do you suggest?
  - yjftsjthsd-h 2mo ago
    I'd like a way to easily specify exactly what sites an extension can run on. There are extensions that I'd like to run on a subset - often just one or two sites - without giving them access do anything else. For that matter, a way to only activate an extension as a one-off when I click it and on no other tabs.
    - raffraffraff 2mo ago
      What about container specific permissions? If they implemented that it would be enough for me since I tend to split up my services by type (eg: shopping, banking, work, hack) so enabling an extensive on a specific set of containers would rock. Right now I think the only control we have is over private tabs/windows?
      - DANmode 2mo ago
        It took them over a decade to implement per-site isolation when other browsers had it, so don’t hold your breath. Firefox isn’t the security-first choice. They don’t pretend to be.
    - Paradigm2020 2mo ago
      I'm using an extension that does exactly that¹, actually every update of the extension is mostly about then supporting more websites and asking permission to access those. So maybe more developers could do a all sites and manually select sites option? ¹BPC extension
      - jstanley 2mo ago
        The extension can declare which websites it can access, but the other commenter was looking for the ability for the user to declare which websites it can access.
swed420 2mo ago
> Firefox is also the only browser that vets uBlock's code on every update to make sure the developer hasn't inserted spyware or malware into the extension. They could save themselves the trouble if Firefox simply baked in its own ad-blocking, but since Google basically owns them, we all know that will never happen. Ladybird browser is going to be awesome.
- deweywsu 2mo ago
  See, this is the kind of thing that makes Firefox cool. They have not only just as good of developer console tools as Chrome, they have forward thinking, truly user-oriented policies. They have had trouble in the recent past at securing funding, but something tells me their user philosophy might save them when all the others turn completely to corporate greed as their main operating mechanism (if they already haven't).
  - swed420 2mo ago
    Your reply makes no sense. To the original point, if they had user-oriented policies, they'd have ad-blocking baked in by now. But they don't, and likely never will.
    - ruckcbek 2mo ago
      You're absolutely right.
    - bigbadfeline 2mo ago
      > Your reply makes no sense. To the original point, if they had user-oriented policies, they'd have ad-blocking baked in by now. It's not black and white, and your inability to see the larger context is disturbing. You could, by the same logic, criticize Mozilla for not serving you coffee which is certainly a "user-oriented policy" "baked-in" or rather "brewed-in". But we must be realistic about how far UOPs can be stretched, Mozilla is better than the rest, which includes large corps with far more money than them. If you can do better than Mozilla, I'm all ears. Next, an ad-blocker needs continuous maintenance - someone started a good one long time ago and apparently loves to improve it and maintain the various lists it uses - why should Mozilla strain to compete with one of their best contributors? - that would be both rude and dumb, and they'd be wasting resources too. There's absolutely no upside to your proposition but you keep insisting.
einpoklum 2mo ago
[flagged]
- culi 2mo ago
  I don't like telemetry being defaulted to opt-in but relax. It's anonymized and it's far and away the least intrusive of the major browsers
  - einpoklum 2mo ago
    It's not anonymized, because your communication with Mozilla has plenty of identifying information. Also, Mozilla officially un-committed to not using sell this and any other data it collects from you: https://arstechnica.com/tech-policy/2025/02/firefox-deletes-promise-to-never-sell-personal-data-asks-users-not-to-panic/ https://arstechnica.com/tech-policy/2025/02/firefox-deletes-...
    - moebrowne 2mo ago
      That article is well over a year old. The current privacy FAQ right now explicitly states: > We never sell your personal data. Unlike other big tech companies that collect and profit off your personal information, we’re built with privacy as the default. We don’t know your age, gender, precise location, or other information Big Tech collects and profits from. https://www.mozilla.org/en-US/privacy/faq/ https://www.mozilla.org/en-US/privacy/faq/
      - inigyou 2mo ago
        They pulled back on the websife change after backlash, but trust takes a long time to rebuild. Also, don't go by the FAQ. Go by the actual terms and conditions. Remember part of their original response to the controversy was to say "we don't sell your data, we just give it out in exchange for money" so I'm inclined to ignore anything from them that says "we don't sell" as they clearly don't know what it means.
        2mo ago
gurjeet 2mo ago
Complete, authoritative list of Firefox extensions officially recommended by Mozilla. https://addons.mozilla.org/en-US/firefox/search/?promoted=recommended&type=extension https://addons.mozilla.org/en-US/firefox/search/?promoted=re... Some quite informative discussion on Firefox subreddit when I discovered and posted the above list there a few months ago. https://www.reddit.com/r/firefox/comments/1pyvx2v/complete_authoritative_list_of_firefox_extensions/ https://www.reddit.com/r/firefox/comments/1pyvx2v/complete_a... The Recommended Extensions program description: https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-...
- benatkin 2mo ago
  I seem to remember TamperMonkey being on there but not ViolentMonkey, which I didn't agree with. However, I see neither of them on there. Both are available but not recommended. I wonder what is going on with that.
  - culi 2mo ago
    Probably just resources. Mozilla has to vet each update to give them the "recommended" badge and so they probably focus on the most popular extensions
    - benatkin 2mo ago
      They should have vetted ViolentMonkey instead of TamperMonkey the last time around.
      - embedding-shape 2mo ago
        > Tampermonkey - Rating 4.7 (5,306 reviews) - 760,294 Users > Violentmonkey - Rating 4.7 (793 reviews) - 164,622 Users On Google Web Store, it's 11,000,000 users VS 900,000 users. Their popularity seems different by a magnitude, hardly surprising Firefox/Mozilla would chose to focus on one above the other.
Beijinger 2mo ago
Also for youtube download plug-ins. yt-dpl does not work for youtube anymore.
- culi 2mo ago
  Still works for me. The occasional 403 has always been an issue
  - fhn 2mo ago
    download everything now because this is going to be a larger problem
Beijinger 2mo ago
I recommend two more: 1. pass paywalls clean. 2. Social Fixer
- culi 2mo ago
  You mean Bypass Paywalls Clean? It's illegal and it's not even on the Firefox extension store. You have to download it from some Russian Github alternative and manually install it. I will say however, it works remarkably well. I haven't seen a paywall in years!
  - Beijinger 2mo ago
    Why should it be illegal?
    - _ZeD_ 2mo ago
      It's not. Op is wrong
      - culi 2mo ago
        It's been taken down by DMCA copyright strikes on every western platform that could distribute it. That's why you can't find it on the Firefox extension store anymore
        gilrain 2mo ago
        None of that means it’s “illegal”. You apparently think something being removed to reduce legal risk means it’s illegal, but that doesn’t follow.
        culi 2mo ago
        It's illegal to distribute. Unambiguously. That's how DMCA works. If Mozilla were to add it back to the store, they would be acting illegally.
    - 2mo ago
ololobus 2mo ago
I’m a huge fan of Mozilla and Firefox specifically, but I don’t think that the way classical adblock extensions are made is the right way. Instead, it should be done as Apple/Safari do it [1]: the browser provides an API to hook/set a block list of identifiers that should be blocked, it could be resource hostnames, html signatures, need to think how to improve the API, but this way it’s completely safe, extension has zero access to the actual page content. Apple does the same for caller id apps. Afaik, Android has this API too, but the last time I checked, all relevant extensions were just “give me your whole phone control or web page access”, so Google clearly doesn’t enforce it Yes, it kinda gives more control to the platform, but so far, iOS extensions that use this API worked surprisingly well for me Please, correct me if I am wrong and uBclock can already work in this restricted mode And the last thing, if people really want to give someone a full page content access, they surely should be able to do that, so kudos to Mozilla [1] https://developer.apple.com/documentation/safariservices/creating-a-content-blocker https://developer.apple.com/documentation/safariservices/cre...
- arendtio 2mo ago
  I think that would limit its capabilities so much that it would be much easier for ad platforms to find ways to circumvent it.
- jchw 2mo ago
  You can only get a very limited uBlock Origin facsimile, not the real thing. A lot of browsers have a uBlock Lite. It's missing a lot of useful features IMO.
- commoner 2mo ago
  Absolutely not. This is exactly why people have a problem with Chromium, which now has some of the same restrictions on extensions as Safari (Manifest V3). - uBlock Origin works best on Firefox: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b... - uBlock Origin Lite FAQ: https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-asked-questions-(FAQ) https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...
- 2mo ago
poilcn 2mo ago
I kept Firefox on one system for testing and had some non-popular extensions installed there. I rarely opened it and when I did it would spew me with a message that one of the extensions got malicious code installed
mrbluecoat 2mo ago
Good for them! Glad they have the resources to do so. The free Brave Origin on Linux also has good native ad-blocking in my experience.

big_toast 2mo ago

That's pretty cool. Thanks for pointing that out. I don't see where it says 'on every update' unless you're referring to the automated checks? I've always wished extensions had more granular permissions though (a la phones, but more so). I think automated ai security checks sound promising soon.

elashri 2mo ago
Automated checks are done for every extension on every update. But their recommend extensions they feature on the Extension store, they do other extensive checks for each update.
socalgal2 2mo ago
what permissions do you suggest?
- yjftsjthsd-h 2mo ago
  I'd like a way to easily specify exactly what sites an extension can run on. There are extensions that I'd like to run on a subset - often just one or two sites - without giving them access do anything else. For that matter, a way to only activate an extension as a one-off when I click it and on no other tabs.
  - raffraffraff 2mo ago
    What about container specific permissions? If they implemented that it would be enough for me since I tend to split up my services by type (eg: shopping, banking, work, hack) so enabling an extensive on a specific set of containers would rock. Right now I think the only control we have is over private tabs/windows?
    - DANmode 2mo ago
      It took them over a decade to implement per-site isolation when other browsers had it, so don’t hold your breath. Firefox isn’t the security-first choice. They don’t pretend to be.
  - Paradigm2020 2mo ago
    I'm using an extension that does exactly that¹, actually every update of the extension is mostly about then supporting more websites and asking permission to access those. So maybe more developers could do a all sites and manually select sites option? ¹BPC extension
    - jstanley 2mo ago
      The extension can declare which websites it can access, but the other commenter was looking for the ability for the user to declare which websites it can access.

swed420 2mo ago

> Firefox is also the only browser that vets uBlock's code on every update to make sure the developer hasn't inserted spyware or malware into the extension. They could save themselves the trouble if Firefox simply baked in its own ad-blocking, but since Google basically owns them, we all know that will never happen. Ladybird browser is going to be awesome.

deweywsu 2mo ago
See, this is the kind of thing that makes Firefox cool. They have not only just as good of developer console tools as Chrome, they have forward thinking, truly user-oriented policies. They have had trouble in the recent past at securing funding, but something tells me their user philosophy might save them when all the others turn completely to corporate greed as their main operating mechanism (if they already haven't).
- swed420 2mo ago
  Your reply makes no sense. To the original point, if they had user-oriented policies, they'd have ad-blocking baked in by now. But they don't, and likely never will.
  - ruckcbek 2mo ago
    You're absolutely right.
  - bigbadfeline 2mo ago
    > Your reply makes no sense. To the original point, if they had user-oriented policies, they'd have ad-blocking baked in by now. It's not black and white, and your inability to see the larger context is disturbing. You could, by the same logic, criticize Mozilla for not serving you coffee which is certainly a "user-oriented policy" "baked-in" or rather "brewed-in". But we must be realistic about how far UOPs can be stretched, Mozilla is better than the rest, which includes large corps with far more money than them. If you can do better than Mozilla, I'm all ears. Next, an ad-blocker needs continuous maintenance - someone started a good one long time ago and apparently loves to improve it and maintain the various lists it uses - why should Mozilla strain to compete with one of their best contributors? - that would be both rude and dumb, and they'd be wasting resources too. There's absolutely no upside to your proposition but you keep insisting.

einpoklum 2mo ago

[flagged]

culi 2mo ago
I don't like telemetry being defaulted to opt-in but relax. It's anonymized and it's far and away the least intrusive of the major browsers
- einpoklum 2mo ago
  It's not anonymized, because your communication with Mozilla has plenty of identifying information. Also, Mozilla officially un-committed to not using sell this and any other data it collects from you: https://arstechnica.com/tech-policy/2025/02/firefox-deletes-promise-to-never-sell-personal-data-asks-users-not-to-panic/ https://arstechnica.com/tech-policy/2025/02/firefox-deletes-...
  - moebrowne 2mo ago
    That article is well over a year old. The current privacy FAQ right now explicitly states: > We never sell your personal data. Unlike other big tech companies that collect and profit off your personal information, we’re built with privacy as the default. We don’t know your age, gender, precise location, or other information Big Tech collects and profits from. https://www.mozilla.org/en-US/privacy/faq/ https://www.mozilla.org/en-US/privacy/faq/
    - inigyou 2mo ago
      They pulled back on the websife change after backlash, but trust takes a long time to rebuild. Also, don't go by the FAQ. Go by the actual terms and conditions. Remember part of their original response to the controversy was to say "we don't sell your data, we just give it out in exchange for money" so I'm inclined to ignore anything from them that says "we don't sell" as they clearly don't know what it means.
      - 2mo ago

gurjeet 2mo ago

Complete, authoritative list of Firefox extensions officially recommended by Mozilla. https://addons.mozilla.org/en-US/firefox/search/?promoted=recommended&type=extension https://addons.mozilla.org/en-US/firefox/search/?promoted=re... Some quite informative discussion on Firefox subreddit when I discovered and posted the above list there a few months ago. https://www.reddit.com/r/firefox/comments/1pyvx2v/complete_authoritative_list_of_firefox_extensions/ https://www.reddit.com/r/firefox/comments/1pyvx2v/complete_a... The Recommended Extensions program description: https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-...

benatkin 2mo ago
I seem to remember TamperMonkey being on there but not ViolentMonkey, which I didn't agree with. However, I see neither of them on there. Both are available but not recommended. I wonder what is going on with that.
- culi 2mo ago
  Probably just resources. Mozilla has to vet each update to give them the "recommended" badge and so they probably focus on the most popular extensions
  - benatkin 2mo ago
    They should have vetted ViolentMonkey instead of TamperMonkey the last time around.
    - embedding-shape 2mo ago
      > Tampermonkey - Rating 4.7 (5,306 reviews) - 760,294 Users > Violentmonkey - Rating 4.7 (793 reviews) - 164,622 Users On Google Web Store, it's 11,000,000 users VS 900,000 users. Their popularity seems different by a magnitude, hardly surprising Firefox/Mozilla would chose to focus on one above the other.

Beijinger 2mo ago

Also for youtube download plug-ins. yt-dpl does not work for youtube anymore.

culi 2mo ago
Still works for me. The occasional 403 has always been an issue
- fhn 2mo ago
  download everything now because this is going to be a larger problem

Beijinger 2mo ago

I recommend two more: 1. pass paywalls clean. 2. Social Fixer

culi 2mo ago
You mean Bypass Paywalls Clean? It's illegal and it's not even on the Firefox extension store. You have to download it from some Russian Github alternative and manually install it. I will say however, it works remarkably well. I haven't seen a paywall in years!
- Beijinger 2mo ago
  Why should it be illegal?
  - _ZeD_ 2mo ago
    It's not. Op is wrong
    - culi 2mo ago
      It's been taken down by DMCA copyright strikes on every western platform that could distribute it. That's why you can't find it on the Firefox extension store anymore
      - gilrain 2mo ago
        None of that means it’s “illegal”. You apparently think something being removed to reduce legal risk means it’s illegal, but that doesn’t follow.
        culi 2mo ago
        It's illegal to distribute. Unambiguously. That's how DMCA works. If Mozilla were to add it back to the store, they would be acting illegally.
  - 2mo ago

ololobus 2mo ago

I’m a huge fan of Mozilla and Firefox specifically, but I don’t think that the way classical adblock extensions are made is the right way. Instead, it should be done as Apple/Safari do it [1]: the browser provides an API to hook/set a block list of identifiers that should be blocked, it could be resource hostnames, html signatures, need to think how to improve the API, but this way it’s completely safe, extension has zero access to the actual page content. Apple does the same for caller id apps. Afaik, Android has this API too, but the last time I checked, all relevant extensions were just “give me your whole phone control or web page access”, so Google clearly doesn’t enforce it Yes, it kinda gives more control to the platform, but so far, iOS extensions that use this API worked surprisingly well for me Please, correct me if I am wrong and uBclock can already work in this restricted mode And the last thing, if people really want to give someone a full page content access, they surely should be able to do that, so kudos to Mozilla [1] https://developer.apple.com/documentation/safariservices/creating-a-content-blocker https://developer.apple.com/documentation/safariservices/cre...

arendtio 2mo ago
I think that would limit its capabilities so much that it would be much easier for ad platforms to find ways to circumvent it.
jchw 2mo ago
You can only get a very limited uBlock Origin facsimile, not the real thing. A lot of browsers have a uBlock Lite. It's missing a lot of useful features IMO.
commoner 2mo ago
Absolutely not. This is exactly why people have a problem with Chromium, which now has some of the same restrictions on extensions as Safari (Manifest V3). - uBlock Origin works best on Firefox: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b... - uBlock Origin Lite FAQ: https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-asked-questions-(FAQ) https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...
2mo ago

poilcn 2mo ago

I kept Firefox on one system for testing and had some non-popular extensions installed there. I rarely opened it and when I did it would spew me with a message that one of the extensions got malicious code installed

mrbluecoat 2mo ago

Good for them! Glad they have the resources to do so. The free Brave Origin on Linux also has good native ad-blocking in my experience.