Comment by dessant | Hacker News Reader

Comment by dessant | Hacker News Reader

Here's the rejected Firefox blocklist request for Avast extensions: https://bugzilla.mozilla.org/show_bug.cgi?id=1600600

Blocklisting the extensions would disable existing installations and stop ancillary data collection, which is prohibited by Firefox Add-on Policies.

https://extensionworkshop.com/documentation/publish/add-on-p...

> Mozilla expects that the add-on limits data collection whenever possible, in keeping with Mozilla's Lean Data Practices and Mozilla's Data Privacy Principles, and uses the data only for the purpose for which it was originally collected.

There are a number of browser extensions maintained by antivirus companies that use security as a disguise to collect and monetize user data. It is time for Google and Mozilla to act on this issue and protect users from these predatory practices.

Benign extensions that are genuinely useful and don't have a company behind them do not get this treatment [1], they are blocked whitout preliminary contact with developers [2].

[1] https://www.jeremiahlee.com/posts/page-translator-is-dead/

[2] https://www.ghacks.net/2019/11/05/mozilla-bans-all-extension...

I want to second this sentiment and EXPLICITLY call out Mozilla.

I am the lead dev for a relatively small Firefox extension. We do not do ANY tracking.

We were rejected and removed for simply including the sdk for Microsoft outlook addins as a script in one of our html pages (we share the codebase for an outlook addon as well). This script is well documented and published by Microsoft.

I find the hypocrisy here staggering.

I know that Firefox gets a lot of love, particularly on HN because it feels like Mozilla is still a trustworthy company. I want to clearly express that I no longer believe this. They want addons in the store that they can use for marketing and sales. Period.

https://digdeeper.neocities.org/ghost/mozilla.html

This article, along with some other sites and my own digging made me leave Firefox for good. It's a good read if you value privacy and think Mozilla is the good guy in a field dominated by evil corporations. At first it might seem biased, but the author makes very good points and backs them up with tons of sources that can't be really argued - most of the article is reviewing privacy policies and terms of service agreements that are available publicly to check.

For now I stuck with Pale Moon, but I'm considering some other browsers like Ungoogled Chromium for my daily private and work use. Pale Moon feels kinda janky and old-school in a not good way. But it's fast and (with some minor tweaking: https://spyware.neocities.org/guides/palemoon.html) respects your privacy 100%.

I've read through the first bit of it, and the author comes off as a huge pedant.

They spend most of the introduction ranting about browser features being removed in updates - because their expectation seems to be that once Mozilla ships a feature, it must forevermore be a part of the latest version of the browser, from now, until the heat death of the universe...

Disclaimer: I don't actually use Firefox, I don't have a hobby horse in this race.

Funny how the design of that article borders on typical insane unreadable looks of conspiracy theory sites.

Thanks for posting this. I have had similarly odd experiences recently with the Firefox addon store, which my startup has been in since 2013. All of a sudden we got yanked, among other things because we modify third party libraries. Apparently we would have been fine if we did exactly the same thing but wrote the code ourselves, but since we used a library, and then modified it, we were in violation. To be clear, we provide all our source code in the review process, so it is 100% clear what we are doing. And we don't do anything that is remotely privacy- or security-compromising, which is very clear from the code.

We tried to understand this bizarre no-modifying-third-party-libraries policy and see how we could fix it, but they stopped responding and eventually even deleted our extension from the browsers where our users had previously installed it. (Even Apple doesn't do this when it yanks apps — only rarely if there is proven bad behavior will the pull an already-installed/paid-for app from a device.)

I happen to know a couple very high-up people at Mozilla, and one of them was able to flag our mistreatment, and the reviewers now seem to be walking back the previously-described global ban on modifying third-party libraries, but we're still not back in the addon store (it's been months).

The (alleged?) policy makes no sense to me, and I also don't understand why Mozilla is now blocking users from installing any addon that hasn't been blessed by Mozilla. I understand that they want to vet addons that are listed in their store, but they've assured me that users can't even install off our website unless Mozilla signs off. That seems very un-Mozilla-ish to me. What happened to the open web?

For the record, I used to love Mozilla/Firefox, and have used their browsers for decades. I now use Brave, both because of experiences like this one, and because it's much faster on my Mac.

> The (alleged?) policy makes no sense to me

The most charitable explanation I can come up with is that they want to avoid confusion attacks on their reviewers. But then again they already have a list of hashes for trusted libs, so clearly they could just diff the modified library against the canonical version when a hash doesn't match.

> but they've assured me that users can't even install off our website unless Mozilla signs off. That seems very un-Mozilla-ish to me. What happened to the open web?

I have clashed with their addons staff over similar issues. Their argument is basically security absolutism, motivated by (some) users easily being tricked. Any inch of rope you give the user they will use to hang themselves. So any security-related decisions they make are based on this dumbest possible user. Additionally they consider it a reputational issue, if an extension screws up firefox then firefox is blamed, or so they say.

Firefox stable basically means nannying. If you want more control you're supposed to use developer edition or (on linux) the distribution builds. They don't say it quite that directly, but that's what their answers boil down to.

> Their argument is basically security absolutism, motivated by (some) users easily being tricked.

Honestly, most of the people I know who use FF these days are pretty tech-savvy. This wasn't always the case — my mom used to use Firefox. But Chrome/Safari/Edge are the default browsers these days, and they're pretty good. The only people installing other browsers are either pretty savvy, or being helped out by people who are savvy.

I realize that Mozilla perhaps yearns of the days when they had much larger market share (and therefore many more easily-tricked users). But those days seem to have passed.

Likewise, they may be trying to position themselves to become the go-to browser for the unwise masses. And perhaps someday they will retake that crown. But in the meantime, these nanny-state restrictions piss of their developer-heavy base.

And yet another example why "OS" owners (since it pretty much boils down to this) should NOT be allowed to own an "app store" !

Same. We have a desktop application with ca. 14.000 installs, which requires a companion extension either for Firefox or Chrome.

It has been taken down occasionally, mostly months after the last version got released.

What annoys me most is that this happens out of the blue. There is no „pre-warning“.

The last times this happened, we told our customers to use Chrome instead. Never had a problem with them.

Now, this really scares me. Not because it's a false positive. Those are bound to happen.

But if the takedown really happens months after the last update, then that would mean malicious add-ons are left on AMO for months?

isn't this generally true of every extension/app/smart appliance? Everything wants to collect and sling your data on the side. Browser and phone vendors do try to protect users with permissions controls in addition to the store curation that you point out is imperfectly executed. How do you propose they enact a perfect system of vetting for the long tail of benign extensions?

Equally enforcing policies regardless of who's the publisher of an extension would be a good start.

This is how the Avast blocklisting request should have been handled:

- Immediately blocklist [1] the extension because it harvests personal data without user consent, notify Avast

- Offer to reenable the extension for the existing user base when Avast reaches out and stops data collection in an extension update

Because the extension was not blocklisted, but temporarily removed from the store, personal data was siphoned off without the consent of existing users for weeks, with the knowledge and implicit approval of Mozilla, until Avast has released an update.

Users that have configured Firefox to update extensions manually may continue to use an extension version which steals personal data, despite Mozilla being capable of disabling those extension instances, and despite their recent commitment [2] to use blocklisting more proactively when an extension is circumventing user consent or control.

Mozilla did not respect its own policies and has put the interests of Avast before the privacy and safety of its users.

[1] https://blocked.cdn.mozilla.net

[2] https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and...

It seems they did originally block them before reverting that decision: https://www.ghacks.net/2019/12/03/mozilla-removes-all-avast-... Would be interested to hear their justification.

The extensions were temporarily removed from AMO, but blocklisting was not enacted, so around 1 million existing installations have remained operational while Mozilla was waiting for weeks for Avast to submit an update.

The initial update for one extension was also approved despite the extension not respecting a declined consent and resuming data collection after browser restart [1].

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1600600

Well they could start by banning extensions that make the news for sending all of their visited urls to a third party.

Ultimately we need to give the user more control over what software on their system is doing. None of these entities (mozilla, google, apple, microsoft, amazon, facebook) can be trusted to act in our best interest

Reply on news.ycombinator.com