Hacker News Reader

Comment by _odey | Hacker News Reader

"Certain Firefox users may come across a message in the extensions panel indicating that their add-ons are not allowed on the site currently open. We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including security concerns."

https://support.mozilla.org/en-US/kb/quarantined-domains

Tin foil hat on

This will be used by Google to force Mozilla into disabling ad blockers on YouTube (dare I say: SponsorBlock as well).

Tin foil hat off

View on HN

I searched a bit through the documentation and code and these were my findings. I thought I'd share them for others that are interested and for future reference.

Currently, there are no domains blocked, they would appear on this API endpoint: https://firefox.settings.services.mozilla.com/v1/buckets/mai...

This is the json schema for this API endpoint: https://firefox.settings.services.mozilla.com/v1/buckets/mai...

More information on the remote settings in general: AMRemoteSettings Overview - quarantinedDomains: https://firefox-source-docs.mozilla.org/toolkit/mozapps/exte...

Remote Settings documentation: https://remote-settings.readthedocs.io/en/latest/index.html

Remote Settings Devtools - where you can see all the remote settings, that get set: https://github.com/mozilla-extensions/remote-settings-devtoo...

I truly miss the days when companies weren't able to remotely change any settings at all.

The problem with this feature is the user does not make the choice. Firefox should be alerting the user why they disabled the extensions and give them a choice to enable them.

From the linked page explaining the feature:

How can I re-enable the add-ons that are not allowed on some websites?

We understand that installing add-ons is a user choice and, as with your security, we also take this matter very seriously. If you are aware of the associated risk and still wish to allow the add-ons that have been disallowed on a website by Mozilla, you can do it from the configuration editor (about:config):

"“But the plans were on display…”

“On display? I eventually had to go down to the cellar to find them.”

“That’s the display department.”

“With a flashlight.”

“Ah, well, the lights had probably gone.”

“So had the stairs.”

“But look, you found the notice, didn’t you?”

“Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.” "

Requiring users to have non-trivial general computer skills before disabling security features seems completely fine to me.

If you see that an extension is blocked on a domain and don't think to Google "unblock extension domain Firefox", select an appropriate result, and follow straightforward instructions then you probably aren't capable of understanding the nuances of extension security risks.

These stupid users, can’t control their computers! Let it be us, corporation, who decide what you can run. It is safe and effective.

Apple, is that you?

The blocking UI shown to n the documentation of the feature has a “learn more” link which presumably leads to to exact the same documentation that I quoted. I consider that absolutely discoverable and fine. The one thing that I would wish for as an improvement is that I can unblock specific extensions individually instead of a single switch for all.

This about:config toggle seems to be a "nuclear option" that disables the entire "quarantined domains" functionality. It would be better if Mozilla offered users a choice to toggle only certain blocked addons on certain domains, though the normal UI.

I agree, that would be better. But the current situation is strictly better than before, even if it’s not perfect - it protects you until you flip that switch and when you do, you’re exactly where you were before they added the feature. So nobody is worse off and many are better off.

This appears to have been implemented by the security team, with the bugzilla issue originally made private / Mozilla staff only a month ago.

Mozilla has earned some trust here, I think. I'll be interested to see why this was done, can't imagine that'll be quiet forever.

> Mozilla has earned some trust here, I think.

How? Was it the opt-out telemetry, putting ads in the browser, or the "experiments" that were also ads?

The 25 years of seeking better outcomes for netizens, using their small influence to help people to have a better experience with the internet.

If you always compare things to your version of utopia you'll be very disappointed. I appreciate their efforts in saving me from the alternatives like Chrome and IE, which are produced and pushed by groups with a million times their resources.

I thought Chrome saved us from slow and tarded Mozilla Suite and IE 7 past gen browsers. God bless Apple WebKit I guess. It made web 2.0 possible.

The old Mozilla suite was obsoleted by Firefox much earlier: Firefox 1.0 was in 2004, IE 7 in 2006, and Chrome didn't show up until 2008 when Firefox was on 3.0.

This is the Bugzilla issue:

https://bugzilla.mozilla.org/show_bug.cgi?id=1832791

> Mozilla has earned some trust here, I think.

Mozilla has already burned through a fair amount of the trust they earned, though. The trust that is left is why adverse reactions to this are mostly in the form of suspicion rather than knee-jerk condemnation.

I don't think this is exactly new. For example the Add-ons website for Firefox already didn't allow any extensions to be run on it. It does seems this feature extends this list for new websites, but it doesn't mean Firefox will abuse (and even if they start abusing it, they have a explicit flag to opt-out).

They will abuse it. Then "apologize". And then abuse again.

https://github.com/gorhill/uBlock/wiki/Privileged-Pages

The screenshot they use for the example specifically has ublock origin as the vetted extension that is permitted to run.

In the past, Mozilla has quarantined several things outside of the reach of standard Firefox customizing tools. Every time it has been because compromising one of those things would result on the user not being able to manage the configurations or even seeing that something different is happening.

IMO, the most likely usage is that they will use it to disallow extensions on the extension store.

Makes sense though, the amount of malware extensions is... unbelievable.

I can't imagine uBlock Origin not being on the list of "monitored extensions" that are allowed.

That said, I am concerned that there doesn't seem to be any easily findable information about what domains (or even what kind of domains) will be quarantined, or what extensions will be "monitored".

On the page you linked it explains how to disable this completely. No tin foil hat needed.

This thing is like there on the first day firefox have extension. If you look closely, you can't run extension on extension store page since day one. So basically nothing changed. The only difference is they now allow some extension to run on these forbidden domains. And show you clearly where the extension won't run.

I think Google would rather preinstall SponsorBlock in Chrome by default if it could, because this move would encourage use of YouTube Ad tools instead of in-video ads (from which Google gets nothing).

Reply on news.ycombinator.com