Hacker News Reader

Comment by crote | Hacker News Reader

Which extensions and which domains, though?

I think we can all agree that restricting uBlock from working on YouTube probably isn't going to happen, and you might want some restrictions on addons accessing all data on a banking website.

But where did they draw the line? Is someone still allowed to publish an addon which fixes the interface of an absolutely broken banking website, or which allows you to liberate your own data? Will that only be allowed through vetting? What about things like Dark Mode addons which have access to all websites? Is it possible to explicitly request to be included in the allowlist?

I am not against it on principle, but we're missing a loooot of information right now to decide whether this is actually a good thing.

View on HN

Looks like there will be a UI to control this 116, and the block list is empty in 115.

I’m pretty stoked for this. Every time I install an extension I wonder what’s going to happen to my banking info if an update ever gets hijacked. This is a much better solution than turning all my extensions off and on when I visit financial websites.

> Every time I install an extension I wonder what’s going to happen to my banking info if an update ever gets hijacked. This is a much better solution than turning all my extensions off and on when I visit financial websites.

Extensions already contain a whitelist of what domains they are allowed to interact with. It's shown when you first install the extension and at any time you can see it later by looking at the extension in the settings.

Ad blockers and password managers are primarily what I’m installing, and they interact with all sites.

And a better version of this feature would involve a UI where you can select which extensions can access which pages, like Safari (and Orion, which is based on WebKit) does.

A separate 'financial' firefox profile would be more convenient and more secure.

> I think we can all agree that restricting uBlock from working on YouTube probably isn't going to happen,

Mozilla gets paid by Google, and Google is experimenting with blocking adblockers on youtube so... no. I don't agree with you.

Everybody will know if this happens, though. Why not save the vitriol for when and if it actually happens?

Because by then it will be too late, letting the enemy take ground before mounting a defense is completely foolish. Maybe you're lacking some context so I'll clue you in: Mozilla already burned all their trust. This incident isn't occurring in a vacuum.

And why did they mark this matter as employee confidential, if they're not plotting something shady?

Mozilla could at any time release a new version that does the nefarious things you're concerned about, and they could do it in a much more secretive way. The way they've approached this is consistent with their stated goals for this feature. I don't consider Mozilla to be the "enemy" and I have no idea what you mean by them burning their trust, but if you distrust them, I'd advise not using their software.

I’d be 100% on-board if they changed this from a list of URL’s they define to a list I define. Web extensions sound great until you realize how much power you’re handing to arbitrary code once you allow it reading and writing to the DOM. They can forward anything to anywhere, sandboxing goes out the window

But if you read the related bug reports it is a list that you define, it just can get some defaults from Mozilla.

Defaults matter.

I'd be okay if they had suggestions, but I'm not okay with them blocking extensions on certain websites of their choice by default.

> you might want some restrictions on addons accessing all data on a banking website

I might want to be control of that myself rather than having Mozilla trying to index all banking websites in the world and not being able to use accessibility tools on those they found

Good news, there is a UI in v116.

See: https://bugzilla.mozilla.org/show_bug.cgi?id=1837670

If an extension that fixed an online banking website (non malicious and bug-free) got popular enough for them to notice, I'd expect some hamfisted effort on the bank's part to stop you using it. Probably taking out many other extensions/browsers with it.

> If you are aware of the associated risk and still wish to allow the add-ons that have been disallowed on a website by Mozilla, you can do it from the configuration editor (about:config)

Reply on news.ycombinator.com