This is how the Avast blocklisting request should have been handled:
- Immediately blocklist [1] the extension because it harvests personal data without user consent, notify Avast
- Offer to reenable the extension for the existing user base when Avast reaches out and stops data collection in an extension update
Because the extension was not blocklisted, but temporarily removed from the store, personal data was siphoned off without the consent of existing users for weeks, with the knowledge and implicit approval of Mozilla, until Avast has released an update.
Users that have configured Firefox to update extensions manually may continue to use an extension version which steals personal data, despite Mozilla being capable of disabling those extension instances, and despite their recent commitment [2] to use blocklisting more proactively when an extension is circumventing user consent or control.
Mozilla did not respect its own policies and has put the interests of Avast before the privacy and safety of its users.
[1] https://blocked.cdn.mozilla.net
[2] https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and...
The initial update for one extension was also approved despite the extension not respecting a declined consent and resuming data collection after browser restart [1].
Ultimately we need to give the user more control over what software on their system is doing. None of these entities (mozilla, google, apple, microsoft, amazon, facebook) can be trusted to act in our best interest