I wrote back to Mozilla: "This is an old add-on. I just want to get rid of the warning label. How much will that cost me?"
I feel like I'm asking the extortionist goon how much it's going to cost me to not be beaten up.
The open-source projects with no income are the ones getting hurt.
I can guess why you say they're terrible for privacy, but they both mention what data they share on the addon page. So it seems not so much that they are violating users privacy, but that you think people should be more concerned with the amount of privacy they give up.
For the record, I am pro-privacy, and would never want to use addons like these that send my browsing and other data to a third-party. And I know the vast majority of people don't read privacy statements and might not fully realize the amount of privacy they're giving up. But that's a much bigger problem than Mozilla giving these addons that openly collect this data a Verified tag. Also, the tag will ostensibly indicate some level of verification that the addon isn't doing anything sneaky (on the client side), so it's not "just" promotion, according to the announcement. If you don't believe Mozilla is going to do that verification well/honestly, that's a different discussion.
Regarding open-source projects, I share your concern, but would be interested to see some evidence that they will be hurt by this.
[1] https://addons.mozilla.org/en-US/firefox/addon/grammarly-1/
It is now. All add-ons must be signed by Mozilla. There's a development mode, but test add-ons disappear when the browser exits.
> Additionally, we collect payment information if you choose to use our Premium services, and we automatically collect technical information, including log data and usage information, for legitimate business interests, such as improving our product and providing customer support.
You can bet that means they're building a credit profile of people and likely selling the information.
> We may share any of the information that we collect through the add-on with our third-party service providers in order to provide you with services, as required by law, to protect our rights or the rights of others, with your consent, or as otherwise legally permitted.
I'd really like to call out the "or as otherwise legally permitted at the end" which means essentially says that the previous list of things is a bullshit hand-picked subset of the set "legally permitted to perform." When I change it to:
> We may share any of the information that we collect through the add-on with our third-party service providers as legally permitted.
It all feels a bit different; which is to say, unless the law says its explicitly illegal for us to share information we collect, we can and will share it. For something that literally monitors everything you write/think, your payment information (probably invoices/site/etc), and then shares it with anyone the fucking please... I'm gonna say that's a big "terrible for security" from me, dawg.
Where I live it's illegal to walk around with a beer/booze in public. But whenever I want to drink a beer in public, I just walk around with it like any other drink. My behavior looks so normal, people just assume it's not a beer, helping me out even more is the fact is "it's illegal" so people's good intentions/will further push the idea out of mind "I don't want to think they're breaking the law, they don't look like they would."
I would say after reading what's literally on the page and thinking about it: the Grammarly extension authors are pretty proudly walking around with a beer right now...
Mozilla being like the friend who invites someone to your home to help tighten up some loose wobblywomps on the porch; but that person then drinks your beer, drinks their beer, goes through your fridge eats what they want, starts making their own batch of beer at your house, and then finally partially adjusts your wobblywomps. Departing, the drunken fat stranger looks to you and says "it was great doing business with you and I be back everyday this week to tighten your wobblywomps."
Huh? That seems like a bit of a leap
"Developers will have all new versions of their add-on reviewed for security and policy compliance. If the add-on passes, it will receive a Verified badge"
I mean you could try to do a web of trust kinda thing but you would still end up paying someone.
I get where you’re coming from that they could just not have the scary warning but the fact that it’s hosted on Mozilla’s site without a warning already lends a lot of legitimacy to what should be seen as “some random person’s add on.”
It's like putting a sign in front of a retail store that says "make sure you trust the proprietor before patronizing this store" -- it's not saying anything that isn't true, but it's also going to be a direct cause of fewer people patronizing the store, even if the proprietor is trustworthy.
If the sign then only comes down by paying money to the party who put up the sign, well, now it's a racket.