3 ms·

...working with Mozilla to make AMO more secure for everyone by default seems like a pretty straightforward and desirable option for EFF. it's unclear why that

...working with Mozilla to make AMO more secure for everyone by default seems like a pretty straightforward and desirable option for EFF. it's unclear why that hasn't happened here. The bug report [1] was closed as WONTFIX. Essentially, AMO is more worried about malicious updates by extension authors than hijacking of legitimate extensions: The "hijacking" we worry about is from the addon authors themselves: we review and OK a benign add-on and then it self-updates into malware or adware. This is not a hypothetical worry. The EFF isn't going to do that, obviously, but the number of entities we trust to that extent who cannot simply host on AMO is so small that we can't spare the coding resources to create an exception mechanism. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=999014 https://bugzilla.mozilla.org/show_bug.cgi?id=999014

justcommenting 12y ago
to me, WONTFIX is just a signal that personal conversations with Mozilla devs as humans--or at least a more subtle understanding of why Mozilla's not budging--are that much more important as next steps. and i don't necessarily disagree with the technical merits of EFF's position, either. but what does it say about EFF if they don't feel the same way about PrivacyBadger being available through AMO? seems inconsistent, if we're to take the given rationale at face value. and more broadly, it seems clear that if EFF's goal is to maximize the number of people using HTTPSEverywhere, the status quo for providing access to their code is not optimal. i hope Mozilla/EFF will be able to work out a solution that increases the availability of HTTPSEverywhere's functionality.