Gorhill pulls uBlock Origin Lite from Firefox store

https://www.neowin.net/news/ublock-origin-lite-maker-ends-firefox-store-support-slams-mozilla-for-hostile-reviews/

by croes • 2 years ago

481 417 2 years ago

neowin.net

petabit• 2 years ago

Apparently, as the article says, the lite version is the recommended one by the author to be used

ziml77• 2 years ago

Recommended for Chrome. I'm not sure why anyone would want this for Firefox.

trustno23• 2 years ago

It's lighter on resources and requires less permissions (so it's more private).

manifest v3 is not as bad idea as some people are saying

prmoustache• 2 years ago

The article is misleading. The lite version is recommended on chrome because very soon the non lite version will stop working.

It doesn't apply to firefox.

Freak_NL• 2 years ago

I really hope Raymond Hill won't do the same for uBlock Origin (the manifest v2 version). I'm not too comfortable recommending others to install a self-hosted extension.

It's a shame Mozilla and Raymond Hill can't/won't solve this together. I get that the review he got simply should not have happened for an extension like this (see the Github thread¹) and that he is simply done with bothering, but I worry about how that will affect uBlock Origin's long-term stability as a project. The whole situation sounds decidedly unhealthy.

1: https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco...

free_bip• 2 years ago

Latest update from the link you provided: The Mozilla review team acknowledged their error and rectified it. Hopefully that allows it to continue existing.

cholantesh3• 2 years ago

Hill seems intent on self-hosting, so I mean it will exist, but will be a lot harder to discover and as GP mentions, probably harder to convince people to install.

superkuh2• 2 years ago

uBlock Origin 1.60 is still held back for review by Mozilla. Despite it being out for about a week 1.59 is the latest available on the Firefox add-on site.

thoroughburro4• 2 years ago

I worry about how that will affect uBlock Origin's long-term stability as a project.

I wouldn’t be surprised if UBO has more users across all browsers than Firefox has users at all, and expect it’s at least within an order of magnitude.

To imply it’s in any danger at all because a minor platform is recalcitrant is ridiculous.

tandr• 2 years ago

Easy. I have 3 browsers installed. All of them have uBO as a first thing installed.

actinium226• 2 years ago

But... ublock is like the main reason I use FF

pbronez• 2 years ago

You can continue to use Ublock Origin, which uses the v2 manifest.

The delisted extension, Ublock Origin lite, is a v3 manifest plugin. Apparently it was created to address chrome blocking the v2 extension, but you can continue to use the v2 extension on Firefox

anonymous_sorry• 2 years ago

ublock origin is still available in the Firefox add-on store.

The developer has pulled the 'lite' version, which is developed mainly for Chrome because Google killed some APIs the full version was using.

VoxPelli2• 2 years ago

Because no one ever have taken over and compromised high profile extensions?

Chrome battles with it a lot, see eg. https://news.ycombinator.com/item?id=36146278

I find Mozilla's process to be quite reassuring, but would be good to have alternative "addon stores" that also have a review process

sdflhasjd• 2 years ago

Mozilla is definitely doing the right thing by reviewing the extensions, but the issue here is that were wrong, they found issues that didn't exist (such as claiming it contained obfuscated code and collected private data).

It appears the issues were found using simple heuristics (e.g they detected string pagead2.googlesyndication.com in a comment) and these detections weren't then manually reviewed as claimed, which is wasting everybody's time.

protoster• 2 years ago

Why does lying about manual review seem so commonplace?

For example, during basically any YouTube copyright or moderation controversy, there is always "manual review" of videos that have obviously been caught in automated systems that in case of actual manual review, would be cleared of problems by any reasonable human.

JohnBooty• 2 years ago

Absolutely. But: I don't think anybody is saying that high profile extensions should receive less scrutiny?

For high-profile extensions, the impact is higher for both false negatives and false positives. So they should receive more attention.

I do not know anything about Mozilla's internal procedures regarding add-on approvals. However, for a high profile extension like uBO/uBO Lite... it should either require multiple reviewers, or maybe just an escalation to a senior reviewer or something. You should never be a single human error away from a high impact mistake.

Maybe they do that already, I dunno. But it seems hard for me to believe that multiple people approved uBO Lite's yoinking.

Extensions are SUCH a crucial part of FF's appeal. And uBO/uBO is arguably the most important of them all.

finnthehuman6• 2 years ago

There is a difference between questioning if a review process should exist for the official addon index and questioning if the implementation is any good.

You address the former when it seems like the issue is the later.

mossTechnician3• 2 years ago

Mozilla has the capability to handle compromised addons; this whole mess happened because they wiped out every version of uBOL except for the earliest one.

They just haven't used that capability responsibly... Yet.

latexr13• 2 years ago

I find Mozilla's process to be quite reassuring

The fact that a review process exists might be reassuring, but the way they went about it surely isn’t.

https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco...

eviks3• 2 years ago

What's reassuring about the lack of basic competence? Why would you think such people/processes will help catch the types of issues mentioned in the Chrome link?

poincaredisk• 2 years ago

The last message from the developer in a now-closed GitHub issue shows an email from Mozilla admitting its fault and apologizing for the mistake. However, Raymond still pulled the extension from the Mozilla Add-ons Store, which means you can no longer find it on addons.mozilla.org.

This seems pretty harsh. Mozilla made a mistake, Mozilla apologized, Mozilla fixed the mistake (maybe even improved their processes), and the author still pulls their choose and criticizes Mozilla. On my opinion either author took this a bit up personally, or cares about improving the review process and wants to make a strong point (with some hurt done for their project visibility).

VoxPelli2• 2 years ago

Feels like they were just waiting for a reason to pull out – likely feels its a hassle to upload and have it review and just want everyone to trust them and keep it simple

And I guess some people would claim that since its an open source addon no one can feel entitled to anything else

latexr13• 2 years ago

Remember why uBlock Origin exists in the first place: Raymond Hill was fed up with the chore of all the administrative crap around uBlock¹. They wanted it to be a hobby and it started feeling like a job.

https://github.com/gorhill/uBlock/issues/38#issuecomment-918...

So it’s predictable they’d get fed up with that Mozilla review process and call it quits too.

¹ Which led them to hand the project to an unscrupulous rando that immediately tried to monetise it, leading Raymond to hate the outcome and having to decry his own previous project and ending up essentially where it all started but with a bunch of extra work in the middle.

finnthehuman6• 2 years ago

I can’t fault gorhill for not wanting to play the “give large rich organization infinite second chances” game. Sometimes enough is enough even if you think you’d act differently in his shoes.

Mozilla apologized

No they didn’t. Now I’m not here to play apology police or anything. But that’s just a perfunctory customer service voice statement which happened to include the word “apologize”. And that’s fine. Nobody expects more. We can acknowledge it for what it is tho.

latexr13• 2 years ago

What could the email have said that would have made you believe they had apologised? If the literal string “we apologize” isn’t it, what is?

marssaxman• 2 years ago

The author is a volunteer and the software is a labor of love: of course it's personal. Such projects thrive when the author feels like they are giving a valuable gift to a community which is receiving and appreciating it. Being required to submit your creation through an impersonal "review" process which rejects you in such a way that it's obvious nobody cared enough to even look is not just a buzzkill: it's an insult.

I would walk away, too.

freedomben3• 2 years ago

when the author feels like they are giving a valuable gift to a community which is receiving and appreciating it.

Who is the "community" in this case? Mozilla? Or is it us users? If the former then fine, but if the latter, then who is being hurt by this, and how does Mozilla being annoying reflect ingratitude in the community?

trustno23• 2 years ago

Judging from his replies, this is not the first time he had problems with the review system

akira25016• 2 years ago

author took this a bit up personally

Yea, those pesky unpaid developers, letting their emotions get mixed into their personal projects. Why can't they be cold and unfeeling, like the people who run the firefox "store?"

healsdata• 2 years ago

Mozilla sent a template email and you're acting like they did anything beyond that. They didn't even assure the author that their add-on wouldn't be removed without prior two-way communication ever again.

Mozilla has a press page -- they could issue a clear, open press release talking about what went wrong, how they're changing going forward, etc. They could even acknowledge that this extension is awesome and contribute capital to making it available to their users.

But, instead, they did the minimum amount possible to save face after one of their reviewers royally messed up. The things the reviewer cited in the first review are plainly wrong and a junior JS developer could tell you that.

Heck, an AI reviewer would have done better (ChatGPT 4o mini):

"No, this file does not appear to contain minified code. Minified code is typically compressed to remove all unnecessary characters such as whitespace, line breaks, and comments to reduce the file size, making it harder to read.

The code you provided contains readable formatting, including comments, indentation, and well-structured functions, which are not characteristics of minified code."

latexr13• 2 years ago

For anyone confused by the real title:

uBlock Origin Lite maker ends Firefox store support, slams Mozilla for hostile reviews

“Review” here means the Mozilla review to allow the extension in the store, not user reviews of the extension.

einpoklum• 2 years ago

Mozilla decided at some point to kill extensions - whether following Google Chrome or of its own volition. It took an axe to its ecosystem by disablign the loading of anything external other than WebExtensions - and note that it's just an artificial disabling, as internally, Firefox is still basically some bundled "extensions" over a C++ core.

And now there's the "manifest v3" change, and making people jump through hoops to be on AMO.

This is very sad, almost as much as the internal governance over there.

kristjank• 2 years ago

Another Mozilla classic...

timeon• 2 years ago

From the article:

uBlock Origin Lite is a Manifest V3-compatible version of the content blocker. It is less powerful, but since Google is disabling Manifest V2 support in Chrome, it is what will remain from uBlock Origin for Chromium-based browsers.
Does it affect uBlock Origin? The core extension remains available for Firefox. Unlike Google Chrome, Firefox will continue to support Manifest V2 extensions. Mozilla has not flagged this extensions or disabled it

But somehow it is Mozilla who is the bad guy not Chromium-based browsers.

yjftsjthsd-h2• 2 years ago

But somehow it is Mozilla who is the bad guy

Sounds like it, yeah.

not Chromium-based browsers.

Nobody said that.

seszett• 2 years ago

This story is about Mozilla removing the Lite/Manifest v3 version from Firefox's extensions, this has nothing to with Chromium.

Now why does such a version even exist when the "normal" uBlock Origin is available on Firefox, I don't know. But there's no question it was a mistake by Mozilla. Mistakes do happen, I'm just explaining why it's only related to Mozilla's actions here.

JadeNB• 2 years ago

To be clear, the complaint is not about Manifest V2 vs. Manifest V3 (which is of course its own can of nonsense), but about Mozilla's review:

Mozilla says that it has reviewed the extension and found violations. The following claims were made:
The extension is not asking for consent for data collecting.
The extension contains "minified, concatenated or otherwise machine-generated code".
There is no privacy policy.

The article points out that all three points are false, and this, or—I'll go ahead and trust the author of an extension I rely on heavily—what the author says:

In a follow-up, Hill criticized the "nonsensical and hostile review process" that put added burden on developers. Mozilla disabled all versions of the extension except for the very first one. It still flagged the extension for the very same reasons, but nevertheless decided to keep the outdated version up.

is what makes Mozilla the bad guy here. (It also says Mozilla restored the extension a few days later, which is better than doubling down but, of course, worse than not making the ridiculous error in the first place.)

roblabla• 2 years ago

I mean, those are _completely_ separate issues? People can be mad at Google/Chrome about Manifest V3, whilst also being mad at Mozilla/Firefox for randomly flagging UBOL with bullshit reasons.

nicholasjarnold• 2 years ago

The article seemed to highlight the inconsistencies or errors in the plugin review process which puts undue burden on developers trying to add value to the ecosystem. It was not about the differences in Manifest v2/3 and the issues with Chrome, though this was mentioned and is the reason why the 'Lite' version of uBlock Origin exists in the first place.

tl;dr - continue using Firefox and installing uBlock Origin. If you develop Firefox plugins for distribution through their official channel beware the review process I guess.

1GZ02• 2 years ago

Mozilla just can't help themselves, can they? Seriously, once Google is broken up and their donations to Mozilla stop, I won't be sad when Mozilla is forced to shut down.

jordanb• 2 years ago

These "lapses in judgement" are driven by Mozilla's brass representing the desires of their real masters. A post-Google Mozilla may be smaller, but I bet Firefox would be better and more popular.

1GZ02• 2 years ago

I hope so, but I wouldn't count on it.

noworriesnate• 2 years ago

I wish they'd get smaller first, build up a fund so they could literally just invest in the stock market and run indefinitely off the returns, and only then go Google-free. That would be a more permanent solution.

seba_dos13• 2 years ago

It's a blog post about something that happened a month ago and boils down to "some (obvious) mistake happened during review". Not much to see here.

bluGill2• 2 years ago

That obvious mistakes can happen is itself a problem.

flyingpenguin• 2 years ago

Have you never been at work being forced to do something because you need money but you just are not feeling it that day? Obvious mistakes will ALWAYS happen, regardless of rules, regulations, human involvement, process, etc. It's thoughts like this

"How can we make sure this doesn't happen again"

"Its unacceptable than an obvious mistake happened"

that make corporations so full of random rules, because they think it's possible to prevent things like this. What matters is the frequency with which they happen, and how gracefully you handle yourself after it happened.

talldayo4• 2 years ago

Obvious mistakes are an issue with most software stores. Less a matter of attention being paid, and more a consequence of scale: https://www.pcmag.com/news/beware-theres-a-fake-lastpass-app...

SSLy5• 2 years ago

latest message from moz on the GH issue is from the day back

InsomniacL• 2 years ago

The organization issued an apology for the "mistake" and recommended to Hill to reach out whenever he has questions or concerns about a review.

Before taking drastic action like pulling addons from the store, Mozilla should reach out if they have questions or concerns about a review.

elAhmo• 2 years ago

It appears all of the companies that are gatekeepers to apps, extensions and similar user-generated stuff are really quick to overreact and unless you are a high-profile person, have a lot of followers or a really popular app or an extension, good luck resolving it in a timely manner.

CaptainFever• 2 years ago

On first glance, it really does seem to be the case, regardless if one is "big tech" (e.g. Apple) or a non-profit organization (e.g. Mozilla).

nar001• 2 years ago

Gorhill is a pretty high profile person considering uBlock Origin and yet still got it taken down and overreacted though. So the issues seem to run deeper than that.

suprjami4• 2 years ago

This is literally the most high profile person Mozilla has. He's carrying the entire browser.

AdmiralAsshat4• 2 years ago

Oof. I get gorhill is pissed about the whole thing, but, this feels like cutting off your nose to spite your face. It's going to be much trickier for people to get uBO Lite onto their Firefox for Android installations now, or even if they can, they might just not bother.

And, while I suppose gorhill could make the case that he's protesting this egregious process on behalf of the little guy, the fact is, he's not the little guy as far as Firefox add-ons go. uBO was one of the first (if not the first) 3rd-party addon to be offered as part of Firefox for Android after Mozilla's reorg started rolling out. He clearly has Mozilla's attention. I'm not sure what he gains from continued intransigence offers after Mozilla admits their mistake and apologizes.

Timshel3• 2 years ago

He gains by not having to interact with them for UBOL.

When you waste people's time sometimes an apology is not enough for them to want to continue to work with you ...

51Cards• 2 years ago

An outlook like that will really limit who you work with in the future. I don't know anyone, corp or otherwise, that doesn't mess up from time to time. What matters is the acknowledgement of the mistake and taking steps to rectify it.

IMO, as much as I highly respect his products, the dev pulled a hissy fit over a mistake.

yjftsjthsd-h2• 2 years ago

It's going to be much trickier for people to get uBO Lite onto their Firefox for Android installations now, or even if they can, they might just not bother.

Why would they bother? Firefox - Android or desktop - runs full/regular uBo just fine.

AdmiralAsshat4• 2 years ago

Why would they bother? Firefox - Android or desktop - runs full/regular uBo just fine.

gorhill himself stated[0]:

This is unfortunate because despite uBOL being more limited than uBO, there were people who preferred the Lite approach of uBOL, which was designed from the ground up to be an efficient suspendable extension, thus a good match for Firefox for Android.

[0] https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco...

carlosjobim2• 2 years ago

I'm not sure what he gains from continued intransigence offers after Mozilla admits their mistake and apologizes.

What would he gain from submission to Mozilla? Either way he gains $0 for all the work he's done to improve the Internet for millions of people.

AdmiralAsshat4• 2 years ago

He gains Mozilla's distribution model and audience, which allows users of Firefox to download add-ons from their browser's UI and updates automatically, rather than having to manually pull an extension file from a Github page for each new release and install it.

wolpoli• 2 years ago

The organization issued an apology for the "mistake" and recommended to Hill to reach out whenever he has questions or concerns about a review.

It's unclear why the author of the article decided that the word 'mistake' deserved the scary quote treatment.

greentxt• 2 years ago

Because there was a privacy policy it's hard to understand how that could be a mistake. The insinuation is the reviewer was not acting in hood faith.

pdpi• 2 years ago

Which brings us to: It's unclear why the author of the article decided that the reviewer was not acting in good faith.

breakingcups• 2 years ago

Lot of people in this thread not familiar with Hanlon's razor..

Obviously this could all just be incompetence. It's just a convenient excuse to do some more Mozilla-bashing, (lack of) facts be damned.

Not that any of this excuses the experience Gorhill had, of course.

eviks3• 2 years ago

Pretty clear: because it's a quote form the Mozilla's response

"We apologize for the mistake and encourage"

SuperNinKenDo3• 2 years ago

Fair play. uBO is THE killer extension, and apparently it never occured to Mozilla that if they were going to insist on using some hideous, Google style, machine led review process for extensions, perhaps they should at least make a carve out for one of the single most important extensions that exists.

I can totally understand gorhill becoming completely insensed by the whole thing and refusing to play ball when Mozilla "realises their mistake". Their mistake was assuming he would simply put up with being subjected to the drudgery that so many extension and open-source developers allow themselves to be subjected to in return for little thanks and ever increasing demands.

The outcome is far from ideal, but the fault, sadly, lies squarely with Mozilla. Real shame.

abhinavk2• 2 years ago

This is about uBOL. I haven't seen much delays for the main extension. It is always more up to date on Firefox compared to Chrome/Edge.

SuperNinKenDo3• 2 years ago

OK? So you support Mozilla's actions or something? What is the purpose of your comment?

ravenstine• 2 years ago

uBlock Origin is likely the primary reason Firefox has any amount of meaningful browser market share today. If Firefox didn't support it then I would be using another browser. Seeing as Mozilla has been struggling to get anything right, they should be kissing gorhill's behind.

maest• 2 years ago

uBO is THE killer extension

Now that you say that, I wonder if that's Google's end game: keep Mozilla on the payroll, disincentivise them from innovating on their product and wait for Firefox to slowly bleed users until nobody is using them and solidify Chrome's position. And that's how they take care of adblockers. They already have wide control over Chromium so that would only leave Safari as the last viable browser alternative (a much harder product to attack).

Now, Google can't stop Firefox from allowing ad blocker extensions, but they can encourage Mozilla to run Firefox in all but abandonware mode, until it dies out.

It's embarrassing how hard the Mozilla Foundation has fumbled their position and I'm having a hard time attributing their actions simply to incompetence.

ForHackernews4• 2 years ago

So Mozilla goofed, apologised of their own accord and corrected the mistake? And in response this dev is throwing his toys out of the pram? Do I read this right?

jampekka3• 2 years ago

I can see how having to jump pointless bureaucratic hoops in a volunteer project can cause throwing out toys.

ForHackernews4• 2 years ago

What pointless hoops? The extension was restored.

catapart• 2 years ago

Yeah, it's kind of wild to see the general reaction to this being "the developer is being unreasonable".

It's like... I, too, find it burdensome for a review that claims to be "manual" to suddenly flag a file my code has been utilizing for years, and puts the onus on me to refute it's findings. Not only is it trying to prove a negative, it's ridiculous that an unchanged file needs re-review for things like "is it minified?".

As far as I can see, there are errors here and they are ALL on Mozilla's side. Better training, maybe, but probably just stop lying that a manual review has happened when it hasn't. And then, when you have whatever semi-automated review is being done flag a thing, then actually have a human review it. And, since that would be a firehose, implement simple standards to filter out spam and publish those standards - and what effect each infraction will have on the review process, including steps for remedy. Make them able to be completed as automatically as possible for the developers, so that you don't have to manually review, again. If it's a minification issue, require the devs to re-upload non-minified versions, check it automatically, and then allow the publish.

I'm being simplistic and flip, but a reasonable generalization is just that bureaucracy should be imposed on the implementers of the bureaucracy, not the people who are trying to engage with it.

x0x02• 2 years ago

When Mozilla is being gifted enormous amounts of free labor, they should be more careful with the donor.

aaronmdjones2• 2 years ago

You do not read this right. Mozilla goofed, then goofed again, then again, then again, then again, then the developer got fed up of having every single version reviewed incorrectly and pulled it, then Mozilla apologised.

I'd do exactly the same thing.

lol7682• 2 years ago

Why does this extension even exist on AMO? The article says it's the "Lite/Manifest v3 version" - why would you ever install the inferior edition meant for legacy browsers, instead of the one that blocks ads properly that's meant for Firefox?

SSLy5• 2 years ago

Because it's lighter on power usage, and that matters for firefox on android.

panarky• 2 years ago

And because it can block ads without infinite permission to read and change every site you visit.

mmwelt2• 2 years ago

But now it's not even possible to use the add-on in Firefox for Android, as only add-ons from AMO can be installed.

lol7682• 2 years ago

You know what else uses power? Ads! Particularly the flashy animated ones that fingerprint the browser and hoover up data to prove you're a real human ad impression. I'd wager it doesn't take too many of those slipping through the net to completely undo your "power saving" of a slightly more efficient way of blocking resources.

Has anyone actually done some quantitative research here? I've been using Firefox with uBO for years on Android and of all the apps on my phone, Firefox is not the one that's chewing through battery.

Timshel3• 2 years ago

It can run with way less permission as opposed to UBO.

sureIy3• 2 years ago

I don’t think people care about giving permissions to one of the most popular extensions ever. The advantages of giving that extension full access are quite clear and the dangers minimal.

jeroenhd3• 2 years ago

For the few good reasons Google had for restricting addon manifests: performance and security. Declarative domain lists are easier to cache and lead to fewer (unnecessary) addon activations. Fewer permissions means the impact of a malware-infected version hitting the addon store in the future is a lot lower. uBlock's rule engine is incredibly powerful, to the point where a custom ruleset can inject code into any website. That applies to custom rulesets, but also to the built-in ones that may or may not get their accounts/hosting hacked, or bought out in the future.

Not that I would use the lite version myself, or that I agree with Google's choice, of course; they killed ad blocker APIs without providing an alternative API, after all. With the code already out there anyway, for the people stuck in their ways still using Google Chrome, they may as well make this version available for Firefox.

wvenable• 2 years ago

The other good reason that Google has is that it puts them entirely in control of the lists. If they don't want Chrome to block ads on Google properties they can opt them out of the block lists.

trustno23• 2 years ago

manifest v3 is actually not a bad idea at all. it's more efficient, more private.

EasyMark10• 2 years ago

It’s bad though in that it reduces your power over your browsing experience. We should get a choice on that. uBO is a good actor and I trust them. Also good crippled storage for lists in v3 while Firefox did not. Clearly it’s to limit size of Adblock lists on google’s part to make the adblockers more irrelevant and in their interest to put as many ads in your face as possible.

EasyMark10• 2 years ago

It’s faster and has less security implications. I accept that UBO is more powerful even if it has a slightly less secure footprint, but that’s a decision, others may choose for more security per V3

akira25016• 2 years ago

why would you ever install the inferior edition

It's my computer. I paid for it and I maintain it. I'll do whatever I please with it.

instead of the one that blocks ads properly that's meant for Firefox?

I have a better question. Why even use Firefox if it refuses to do what I want?

4bpp• 2 years ago

If I understand the timeline correctly here, it seems that gorhill overreacted, and I say that as someone who is usually harshly critical of everything Mozilla has done in the past 5+ years. It's hardly practical for Mozilla to manually review every add-on revision for safety in a timely manner, so they had the choice between automation and delays that would make add-on development a slog; automation though inevitably will cause false positives.

What's the alternative? No pre-release review at all? As a user I would hope that this will not be the case, especially now that we have confirmation that flashy supply chain attacks are being executed in the wild. In fact the review policy protects gorhill himself too, since it makes him a bit less attractive as a target for a rubberhose attack (no point in blackmailing him to put in spyware if the spyware would be caught before release).

SSLy5• 2 years ago

No pre-release review at all?

certainly not leaving only the oldest version of the extension up.

jeroenhd3• 2 years ago

I'm not even surprised the addon got flagged. The linked files in the Github issue all had file names insinuating a direct connection to known trackers (which, of course, uBOL is blocking). Whatever automated scanning tool Mozilla uses probably latched on to "oh this is Google Tag Manager" and issued the warning that is normally handed out to addons that do include sketchy scripts like these.

HOWEVER: the email clearly states:

Your Extension uBlock Origin Lite was manually reviewed by the Mozilla Add-ons team in an assessment performed on our own initiative of content that was submitted to Mozilla Add-ons

Either that is a lie, or the manual reviewer that did the "review" doesn't understand that the automated tool they ran is capable of false positives.

Nothing wrong with automated abuse assessments on a platform like Mozilla's, but don't lie in your communications about it (or hire people who know what they're doing when it comes to blocking addons).

GrantMoyer• 2 years ago

I agree with what you say about the tradeoffs of a review process, but strongly disagree that Raymond Hill overreacted. He's a solo dev working on uBlock as a hobby who doesn't even take donations; he doesn't owe us anything. He gets to decide if the review process frictionless enough for him to contribute his time and energy, and even though he decided it's not in this case, he made his extension open source, so anyone else is free to publish uBlock Origin Lite in his stead.

Timshel3• 2 years ago

Don't remove stuff that are used for some time using only automatic tooling ...

And from the start the review was supposedly: "Your Extension uBlock Origin Lite was manually reviewed by the Mozilla Add-ons team".

yojo2• 2 years ago

I think it’s reasonable to expect that one of Firefox’s most popular extension publishers gets a higher tier of review service. Gorhill (and other top extension devs) are providing real value to Firefox, and have demonstrated good behavior for years.

This doesn’t mean they should get to publish whatever they want, but if a reviewer is about to reject a high profile plugin, they should get a second set of eyes on it. Which would have obviously caught the mistake here.

Feels like another “Firefox is underinvested in developer relations” story, which is surprising given how much they rely on them.

Edit: honestly the idea that gorhill doesn’t have a dedicated rep at Mozilla is baffling to me. According to their stats the extension has 8.4 million users. They should call him on the phone to let him know there’s a problem with his extension.

causi• 2 years ago

Yeah they've repeatedly used his name in advertising Firefox Mobile.

munch1174• 2 years ago

But this is not about a high profile plugin. The high profile plugin is "uBlock Origin", and this is about "uBlock Origin Lite", which is a big thing for Chrome, but not for Firefox. Why would anyone want to use uBOL, when they have the option to use uBO?

Perhaps Mozilla does have a higher tier of review, but it's for specific plugins, not for specific authors.

guilhas• 2 years ago

Good point, they should be on the phone "Mr G how can our developers help you getting this extension approved"

This developer one of the main reasons for many people to use Firefox, especially in this current chrome controversy manifestV2 vs V3

And ironically this uBOL success should be of very interest to Mozilla because if it had gained more success than the main one uBO then it would be one less reason for the company to invest resources into maintaining manifestV2

xnx2• 2 years ago

Firefox is a thick wrapper around the core functionality of uBlock on Android. Without uBlock, the case for using Firefox is very weak.

SergeAx• 2 years ago

uBlock Origin is THE reason I am using Firefox Mobile. The moment it gone - there's no sense in keeping the browser.

bambax• 2 years ago

manually review every add-on revision for safety in a timely manner

Sure, but uBlock Origin, lite or not, is one of the most important browser add-on, if not the single most important one. This may not justify to give it a pass without looking, but it should certainly be reason enough to jump it in front of the queue and review it manually every time.

asadotzler• 2 years ago

Lite is meaningless to 99% of Firefox users. The real deal is available and they aren't force to use the inferior Chrome version.

jampekka3• 2 years ago

Maybe a less crappy review system at least?

"The burden is that even as a self-hosted extension, it fails to pass review at submission time, which leads to having to wait an arbitrary amount of time (time is an important factor when all the filtering rules are packaged into the extension), and once I finally receive a notification that the review cleared, I have to manually download the extension's file, rename it, then upload it to GitHub, then manually patch the update_url to point to the new version. It took 5 days after I submitted version 2024.9.12.1004 to finally be notified that the version was approved for self-hosting. As of writing, version 2024.9.22.986 has still not been approved."

Doesn't sound like something I'd enjoy as a hobby.

https://github.com/uBlockOrigin/uBOL-home/issues/197

TiredOfLife• 2 years ago

Mozilla is not a single person in a basement with a 20 year old second hand computer. They spend hundreds of millions $ per year. uBlock origin has 8+ million installs. The second extension by install count has 4 (four) times less. If if anything to do with gorhill and their extensions is not priority one in their review system, then something is really wrong at Mozilla.

seba_dos13• 2 years ago

...and the extension this article is about had about 5000 (five thousand) installs before being taken down. That doesn't really scream "priority" to me.

bitfilped• 2 years ago

This was for uBlock lite, a much lesser used plugin

squarefoot2• 2 years ago

They spend hundreds of millions $ per year

Most of which coming from Google, whose web enshittification created the need for Ublock Origin and later Ublock Origin Lite. If Mozilla, which takes boatloads of money from Google, does something absurd that would please nobody else but Google, how could one not assume something fishy is going on?

https://archive.ph/jQPTt

( https://www.bloomberg.com/news/newsletters/2023-05-05/why-go... )

phendrenad22• 2 years ago

Exactly. And this is why we need paid browsers. If the ad-supported/donation-supported browsers like Firefox need to apply low-quality automated solutions to approving/rejecting even their most popular addons, then clearly the business model isn't working.

Semaphor3• 2 years ago

their most popular addons

It’s the lite version. It’s not popular at all.

talldayo4• 2 years ago

...except there is no evidence that paid, manual review works. Closest thing we have is Apple's App Store, which infamously has manual review cycles worse than an automated malware checker: https://www.pcmag.com/news/beware-theres-a-fake-lastpass-app...

This is why you should be happy that you don't pay for a browser.

sgc• 2 years ago

You jump immediately to money. But less crappy automation in this case is almost certainly a question of configuration and then thoughtfulness on the part of follow up reviewers, not just throwing money at the problem. It feels like you are shoehorning your own agenda in the conversation a bit.

EasyMark10• 2 years ago

I think not everyone thinks that money solves all things. Look at the $8 blue check “verified” accounts on Twitter that are easily identified as CCP/Russian spam bots. We’ve had free browsers for nearly 30 years, so I’d say we don’t need paid browsers just yet. There are of course some out there for those who like the idea, but overall it’s not a solution. n=1 failure doesn’t mean flushing the whole enterprise down the toilet. There is an easy policy change for this. Fire one high level executive and get 10 more quality reviewers so that the more experienced reviewers can get high traffic items like those from gorhill

phendrenad22• 2 years ago

Wow, stirred up a latent hornet's nest with this one. I should have known, people love "free" stuff (even if it's obvious to everyone, even themselves, that it is not at all "free"). Anyway, I think a paid browser would help solve this problem. If you don't agree, please, keep using Firefox or Chrome or whatever "free" browser you prefer.

mcherm• 2 years ago

I think that the alternative is some form of "per review", where the effort of performing reviews is spread out among a volunteer f with reasonable "reputation" management and in which a party can accelerate their own review by contributing to the reviews for others.

mort962• 2 years ago

Meh, it's perfectly reasonable to decide that you don't want to deal with this kind of bullshit and pull the extension from problematic stores. There's probably a miniscule amount of people using uBO Lite on Firefox anyway.

politelemon2• 2 years ago

I don't think the author has overreacted, but your first paragraph doesn't seem to match the timeline, so maybe the article didn't portray it correctly. For a better understanding have a look at the Github issue: https://github.com/uBlockOrigin/uBOL-home/issues/197

It was not an automated review, it was a manual review, poorly done. The author then explains that they don't want to deal with the stress (there are also some extra explanations of what's involved in the AMO review process), and also that they left a somewhat harmful version of the plugin up. Not wanting to deal with stress is a perfectly understandable reaction.

shadowgovt6• 2 years ago

Sometimes, people apparently forget how much of this ecosystem is built on volunteers: their time and their talent.

You can lose a volunteer army fast if you don't provide them the warm fuzzies of the experience they don't get working with a faceless corporation.

Ekaros• 2 years ago

No he did not. Mozilla is in situation where they should bend backwards with very popular extensions, which I believe both uBlock Origin versions must be. Ensure anything you do with them is absolutely correct.

In general quite many extensions are done for passion. And any chance of destroying that passion will make your product less desirable to work with and thus in long run less popular.

fragmede• 2 years ago

Can we build a better sandbox? exfiltrating data is the issue, but if the extensions just weren't able to reach out arbtrarily but could only download a specified url, then that would eliminate the problem for plugins that could adapt to only using a specific permission and then not need manual review.

deepsun• 2 years ago

I'd pay for speedy reviews. I don't think it would resolve to paywall, but the reviewers are not free.

account424• 2 years ago

So? Mozilla inserted themselves as middlemen into addon delivery. Even for the so-called selfhosted addons. They can just not do that if doing it properly and without undue delays means more work than they can handle.

seneca• 2 years ago

Mozilla is an absolute joke of an organization, and it's tragic that they are still the primary alternative to Google having a total monopoly on browsers. I suppose you shouldn't expect much from a company that is just there to maintain a facade to fend off regulators.

busterarm4• 2 years ago

We're at a really dangerous point with browsers at the moment where there's really no consumer-friendly option available.

I'm scared to say that Safari comes closest but you're just in Apple's walled garden then instead of someone elses'.

Our only hope seems to lie with Ladybird, if that even ends up being good and it seems extensions aren't on the agenda at least for a while.

slig• 2 years ago

I'd say we're past that point. Less than 5% of global users (and going down) and NO mobile presence at all. The newer generation of devs and power users won't even care.

JimDabell• 2 years ago

The issue is bigger than that. The web standards process relies on two independent implementations for something to become a web standard. This just about works when there are three big players, but if Mozilla drops out, then it’s just Google and Apple arguing. It’s bad enough that two out of the three rendering engines that participate in the web standards process are funded by Google. We really need another independent rendering engine to step up. Hopefully Ladybird will get some traction.

somerandom24074• 2 years ago

Have you heard of Brave? It's a great browser with a built-in ad blocker founded by Brendan Eich, one of the co-founders of Mozilla and the creator of Javascript. I'm not a shill, I swear - I just think it's a great initiative that should be more well known than it is.

sunaookami2• 2 years ago

It's very annoying you have to submit your extension to gatekeepers to even distribute them to normal users. As gorhill said on GitHub it took days for a self-hosted version to be approved - that's unacceptable. Imagine you would need approval from Microsoft to distribute software. Not even Android is this closed. Enforcing signatures and removing XUL were the worst things Mozilla has ever done. And yes, Google does the same and it's even worse there but this it to be expected from them, but not from Mozilla.

Zak3• 2 years ago

On desktop Firefox, you can download an extension from anywhere and install it. All they're gatekeeping is their own repository, which I think most of us would like them to do.

I think mobile requires using a nightly build to install extensions from outside Mozilla's repository, and that suggests their thinking is becoming contaminated by the rest of the mobile ecosystem.

Semaphor3• 2 years ago

No, the normal version blocks (at least permanent) installs. You need the developer version to install unsigned extensions.

adduc• 2 years ago

Are you certain extensions can be downloaded and installed from anywhere? Firefox's documentation[1] states "Extensions and themes need to be signed by Mozilla before they can be installed in release and beta versions of Firefox." If UBlock Lite was rejected through Mozilla's signing API, they'd have no ability to create an XPI that can be installed by release/beta version of Firefox.

[1] https://extensionworkshop.com/documentation/publish/signing-...

bytebolt• 2 years ago

You can no longer package extensions yourself and if you try using "Load add on from file" you get that extension loaded but it's gone after a restart. All extensions have to be signed first to be permanent and Mozilla denied to fix that on their bug tracker.

Arnavion• 2 years ago

To add on to the other replies, you *can* load unsigned extensions with desktop Firefox if the build you're using disabled the signing requirement at build time. A bunch of distros' FF packages do that, for example, and is why I use a bunch of extensions I wrote myself (and thus trust) for myself without having to deal with Mozilla. (Zip up the files, change the file extension to `.xpi`, drop it in `$libdir/firefox/browser/extensions/`)

kevincox• 2 years ago

removing XUL

Nah, XUL had to go. The other stuff wasn't really related. It was a more "if we are going to break most extensions we may as well use this time to push everything else we want". If anything XUL is a scapegoat.

I know because I maintained VimFx for a while after the XUL removal. It was difficult to keep up with internal APIs that are changing, but I can't blame them, they need to develop their product. The thing that really made me give up on maintaining VimFx was the signing enforcement. They just keep tightening the screws so that I couldn't even run "my own" code with any reasonable UX.

What I would have like to have seen:

1. Provide WebExtensions as the recommended way to do things with some compatibility and deprecation guarantees.

2. Stop caring about compatibility of other APIs.

3. Still allow outside "full access" extensions that use those internal APIs. You can give warnings in the store "this extensions uses unsupported APIs and may break at any time and steal all of your personal data" and make the install button bright red but still allow it.

4. Keep supporting self-distributed extensions with developer managed signing keys and update URLs.

Since there are no compatibility guarantees on these APIs it wouldn't have been much extra work. Just a bit of UX work to add scary warnings and maintenance of the non-store update code.

irq-1• 2 years ago

4. Keep supporting self-distributed extensions with developer managed signing keys and update URLs.

Mozilla followed the big corps in the 'store' model, instead of keeping it open free-form. We might have a viable developer certification trust system by now, but with that too, only the corps have enforced signing systems (that are closed and fragmented.)

EasyMark10• 2 years ago

What?You can install extensions in Firefox easily without going through the Firefox extension store. XUL had to go.

mort962• 2 years ago

No, you can't. Extensions must be signed by Mozilla for Firefox to let you install them.

fastest963• 2 years ago

Imagine you would need approval from Microsoft to distribute software.

You mean like how you need permission to distribute software on MacOS/iOS? More and more platforms are moving in this direction and I wouldn't be surprised if Windows goes the same way in the future.

Aaron2222• 2 years ago

You don't need permission from Apple to distribute macOS software. Your users will just see a warning dialog when they try and run it for the first time and have to go to System Settings to allow it to run[0]. If you want to avoid this, you have to pay the $99 USD per year to join the Apple Developer Program, codesign your software with the certificate they give you, and submit it for notarization (which for macOS is a fully-automated security and malware review, unlike iOS notarization which is basically App Store review). It's not ideal (many open-source projects don't want to spend $99 USD per year, and it does tie the software to your real name), but it's not like iOS.

[0] https://support.apple.com/en-nz/guide/mac-help/mh40616/mac

shiroiushi• 2 years ago

More and more platforms are moving in this direction and I wouldn't be surprised if Windows goes the same way in the future.

I think MS has already tried this several times, such as with Windows RT and the Windows store. It never caught on, and they pissed off the independent software vendors who make the Windows ecosystem valuable in the first place. Maybe they just didn't push it hard enough; maybe they could have just forced everyone to use it anyway, and maybe it would have worked because what are Windows users going to do, switch to Linux or Mac? But maybe the real danger was that users simply wouldn't upgrade to the new locked-down Windows in the first place and just stick with older versions forever, which is something they've been doing all along (look how mad people were when they finally killed XP).

solarkraft• 2 years ago

It‘s not only that, Firefox also forces you to use the Developer edition (which updates about daily, FORCING you to restart it) if you want to install extensions that aren’t signed by Mozilla (e.g. your own).

This behavior reminds of Apple. They say it‘s for security (where have I heard that before), yet Chrome doesn’t seem to need such a restriction.

To me it seems like another step in many of Mozilla‘s enshittification.

rgreekguy• 2 years ago

I am pretty sure Chrome has also added the forced restart for a bit now. It might not show up right after the update, but it doesn't take long. I don't remember if it was straighforward, or just crashed new tabs.

aaronmdjones2• 2 years ago

You don't have to use the developer edition to run unsigned addons; you can use the ESR version or nightly as well.

Dkuku• 2 years ago

This again shows the problem of automatic reviews. There should be a person name in every review that was responsible for it, currently it's blamed on our automated system. If the law would require someones name on it then I'm pretty sure the review process would be much better and the explanation would include more than an apology.

system7rocks• 2 years ago

Curious why Firefox doesn’t just start incorporating uBlock into the browser? Make it a standard feature that comes pre-installed… but maybe not automatically enabled? Thoughts?

bogwog• 2 years ago

Mozilla has been trying to become an ad company for a while now. A built-in ad blocker would mess that up for them.

jjice2• 2 years ago

Have they? I haven't seen this. They have a lot of tracking protection built in, but no ad blocker. I'm not doubting you, I just haven't seen any action or posts on their part about this.

joemi• 2 years ago

So many people in this comment thread commenting stuff like this, that it should be included, it's the only reason to use Firefox, etc. Meanwhile I use Firefox every day at work without uBlock Origin or any other ad blockers, and it's perfectly fine. Why do you think they should it?

open-paren• 2 years ago

I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need a privacy policy"–we already have one. "You are using machine generated and minified code"–no you are looking at the built code, not the included source. "We cannot reproduce your source"-that's because you didn't follow instructions and are in the wrong directory. Very frustrating.

sureIy3• 2 years ago

I had these issues too a few years ago. Now the review time is shorter than Chrome’s and hasn’t been flagged in a few years. However my extension has about 10k users, if that makes any difference.

jjice2• 2 years ago

Also had these issues when working on my previous job's extension. The Firefox review process was a real nightmare to work with. Same heavy delays and misunderstandings your mentioned. Eventually the company just stopped updating the Firefox extension as often since usage was low and the review process was such a pain. Unfortunate for me, as the only engineer (maybe employee) at that company that used Firefox.

whstl• 2 years ago

Same here. We even had a special "mini" Firefox version that didn't require any additional Javascript build step, to make the review easy. But there were so many issues with the review and so few users that we just decided to give up.

rightbyte3• 2 years ago

The whole extension change Mozilla forced on Firefox seems like some sort of sabotage.

Mozilla sneaking in more and more spyware and ad friendly functionality seems in line with the same conspirators.

And given how high profile all these changes are, it runs to the top of the company.

ilrwbwrkhv• 2 years ago

That's not just mozilla. Google's review team all are in India and they cannot write clear English. It's a mess.

politelemon2• 2 years ago

Also Apple and Meta. It's awful dealing with infallible gatekeepers.

Rinzler892• 2 years ago

Google's review team all are in India and they cannot write clear English.

Which is ironic considering the reason they went to India and not other countries with cheap labor is that English is an official language there.

salesynerd• 2 years ago

Why make such a generalized statement?

giancarlostoro• 2 years ago

that's because you didn't follow instructions and are in the wrong directory.

You just need to have a shell script in the root directory that assumes the person running it has 0 clue about your extension.

Also some of this reminds me of Apple. They clear something up, then bring it up again the next time review is needed.

adrian173• 2 years ago

Even this we had issues with - we wrapped the entire build environment and script in a dockerfile, but depending on system configuration you may or may not have to run docker with sudo - it just so happened that reviewer's environment required it, while ours didn't, and the reviewer needed specific instructions on what to do in this case.

Another time, they failed the review because the reviewer's VM _ran out of disk space_ (which we only learned after digging into the issue, as the first report just mentioned "build errors"; according to later inquiries the VM had ~9GB available) and we had to add some extra build logic to delete intermediate files, just for them. The build is quite large because it involves rust->wasm compilation, but I'd still expect the reviewer's machine to have a bit more space...

akira25016• 2 years ago

that assumes the person running it has 0 clue about your extension.

I would tend to assume that a person given responsibility for reviewing this software, supposedly to protect end users, would not be this clueless.

What value is the "Firefox Store" actually offering then?

adrian173• 2 years ago

We cannot reproduce your source

This is the biggest issue we had, and we had to add a decent bit of complexity to our builds to support reproducible builds in the exact way they want. But the silly part is that our extension involves building a wasm file from Rust, and after some back and forth it turned out that they don't require it to be reproducible (despite being core of our extension and containing 99% of our logic), which honestly feels like it defeats the point - who cares if JS reproduces if you can hide any arbitrary possibly-malicious code in wasm.

For a while we were seriously considering putting our prebuilt wasm in the source package or on npm, just to make the "reproducible build" on AMO side simpler, despite this making it even further from how it's actually built.

Etherlord872• 2 years ago

What kind of harmful code could you put in WASM? You could return a string that you eval on the javascript side, so the reviewers could possibly ask for the WASM source if they saw the eval, but other than that the purpose of WASM is to be a safe sandbox after all, right?

jeffchien• 2 years ago

The reproducible build requirement seems to be a major blocker for many addons, including one I use for Twitch: https://github.com/FrankerFaceZ/FrankerFaceZ/issues/1495#iss...

stainablesteel• 2 years ago

this seems like the kind of place where user-based reviews would be more efficient, better, and more open

having the makers of a browser do this is bound to create both efficiency and political problems for extensions. im remembering dissenter now

saulrh• 2 years ago

Every time I hear about the review processes for browser extensions I'm shocked that the it involves humans having to read your README and manually plumb together the build process. Sometimes I hear that reviewers are even reusing VMs when doing reviews, or even not using VMs at all. I'd have expected the review form to have a textbox where you paste your git link and a well-documented automated pipeline that stands up a specified VM with a specified amount of RAM and disk, clones the git, descends into it, and executes `docker build -t ./docker/review/Dockerfile`. I'm surprised that the reviewers themselves haven't outright demanded such tooling from their larger organization, just as a matter of job satisfaction - I can't imagine all the abuse they get from angry app owners.

01HNNWZ0MV43FF• 2 years ago

Browser extensions really seem like they're slowly failing and just not supported. Kinda like PWAs.

I want to write a chat program, but it has to work on phones, and the DevEx for native phone frameworks compared to desktop apps looks like hell, and PWAs seem to be barely supported.

It's easier than ever to make a CLI or desktop app, but phones seem like the worst of all Microsoft dev history - Learn these arcane lifecycle vocab words that make no sense, like using Win32 directly, but also it changes every year or two like when MS invents a new GUI framework, but also if you can't get into The Store, nobody but your power user friends will be able to run your app anyway. What is this shit?

joshdavham• 2 years ago

That's interesting to hear. Do you also offer your extension on the chrome store? How did the review process differ? I ask because I've only published on the chrome store in the past.

arp2423• 2 years ago

The problem with these types of things is that the people who are qualified to do good reviews are also the sort of people who can typically get a far more interesting job building stuff, rather than just reviewing code. It's work that does require a certain level of skill, but at the same time is also quite boring.

And that more interesting job will probably pay better as well.

ozim• 2 years ago

I think that is one way that “tragedy of commons”.

boopdewoop• 2 years ago

Id rather hire a senior dev as a reviewer and a mid dev as the coder at a company. pay the reviewer more since they will be dealing with shit practices and having to train the dev.

I_AM_A_SMURF• 2 years ago

Not only that, but properly reviewing code would take forever. Heck I don't know how many senior engineers at my fancy tech company could do it and reliably spot problems.

horsawlarway5• 2 years ago

Similar boat. I release an extension with about 1 million installs across Chrome/Firefox/Edge for work.

Firefox (despite being the smallest usage) is utterly insane with regards to process. They demand a reproducible build, but then can't do things like install the right version of yarn (no - npm install -g yarn is not correct, our readme says it in bold like 5 times and provides the exact correct command to install the right version), or follow basic setup steps like "Use this version of node (complete with exact steps to install it and a script to automate that for them)".

God fucking help you if you try to do something completely crazy as a private company like - checks notes - use a private NPM module. Despite providing them with access on a pre-configured account, or offering to give a review account access according to Mozilla "It's too hard to use external accounts during review".

Honestly - having to interact with the browser review team is a BIG reason I no longer recommend Firefox. They're incompetent at best, and I'm fairly convinced they're just milking the google search deal income for as a much as it's worth - I don't think they really want to provide an alternative and secure browser anymore.

ranger_danger• 2 years ago

This is exactly what the review process for the Play Store is like, even worse for Google TV apps. Often times just re-submitting multiple times without changing anything at all will get it pushed through.

creatonez• 2 years ago

On the flip side, having to interact with addon review has raised by confidence in the browser. The steps they take to review, while not perfect, seem like they could weed out a lot of potential garbage and malware. I was expecting a much more minimal review process, which would have raised my fear about the extensions I use and set to auto-update.

Too• 2 years ago

Reproducible builds and open source sounds like a good thing.

I wouldn’t expect the reviewers to deal with every add-ons bespoke snowflake build. Even less so if it requires access to a private module. Mozilla should provide a baseline of how a build is intended to be done, then extensions just have to follow this template. Though yes, you would expect them to have some familiarity with basic stuff like yarn and that the baseline supports a few of the most popular builders.

oxym0ron• 2 years ago

Honestly I have to side with Mozilla team here. Kudos to them for trying to actually care about security and privacy. I can imagine the nightmare that people are submitting and trying to recheck everything and build those random extensions with private npm repos and whatnot.

throwaway48476• 2 years ago

They should switch to an fdroid like model that does public builds on cloud infra.

suprjami4• 2 years ago

I'm fairly convinced they're just milking the google search deal income for as a much as it's worth

That's exactly what the ex-McKinsey C-suite are doing. Regular employee talent suffers because of it, as you've found.

phatfish• 2 years ago

It sounds like they are doing their job attempting to review random code from strangers to be honest.

xelamonster3• 2 years ago

This sounds super frustrating, as someone who has an idea or two for browser extensions I'm not looking forward to all the bureaucracy. I actually love the idea of requiring and validating reproducible builds but they really should invest in reviewers competent enough to manage that.

I do have half an idea to deal with it that I plan to try, thought it might be helpful to suggest: implement a Fisher-Price build system that checks and automates every single step and cannot go wrong. Ideally if the reviewers can run Docker, do it all in a container. Wrap package.json scripts with functions to validate the build environment before proceeding and either fix it automatically or fail and print clear instructions to the console. A preinstall hook could verify they have proper NPM auth and prompt for it if needed.

Annoying to have to do that at all though. I'm starting to come to similar conclusions on Firefox, using it currently but I've been thinking about jumping ship for a while. What browser would you recommend now? I wanted to get away from Google but I'm considering just Chromium since any remotely comparable options I've found are poorly thought out wrappers of it.

arresin2• 2 years ago

It’s funny to think of Mozilla like landed gentry where they have captured serfs (their users) and get a payout from the king (Google) for their loyalty and support.

amiga3865• 2 years ago

There's nothing more frustrating than being gatekept by incompetent, lying idiots. Sad day for users but the right choice by Hill.

Mozilla wanted in on the $CURRENT_THING of being a "platform" where devs bow and scrape and they claim to be the great custodian of stuff, protector of users. Don't do this if you can't be competent at it. Devs _can_ leave, and they will if you fuck up often enough.

internet2000• 2 years ago

The sooner people realize Mozilla is not your friend, the better. They’ve been compromised by the Google money. Want an alternative to Chromium? Go support Servo or Ladybird, Firefox can’t be saved.

TZubiri3• 2 years ago

Seems a bit extremist. I get being mad at microsoft for trying to charge for their software (gasp). I also get being mad at Chrome for trying to monetize their software (gasp) with ads. But now if you somehow get upset at Mozilla, it's more likely that you are the problem.

lez2• 2 years ago

According to your argument, if Gorhill gets upset at Mozilla, then Gorhill is the problem? Who is the extremist here?

nosioptar• 2 years ago

Neither of those work with ublock. I'd sooner disconnect from the net than not use ublock. (Same reason i don't use qutebrowser.)

I like SeaMonkey, it works with a legacy version of ublock. It's like using firefox back when it didnt suck.

conor-• 2 years ago

Blink is to Servo what Chromium is to Firefox.

Supporting Servo on its own doesn't really move the needle a whole lot if it's missing all of the rest of the bits that make a comprehensive browser.

Firefox is already using Servo (at least in the form of Quantum) under the hood and is still the best option available to prevent more of a complete Blink monoculture than already exists with every other major browser being Blink-based or some reskin/fork of Chromium

thoroughburro4• 2 years ago

This used to be true. The Servo project is actually building a full browser, now.

https://servo.org/blog/2024/09/11/building-browser/

nix0n• 2 years ago

If Raymond Hill endorsed a Firefox fork, I would switch to it immediately.

pessimizer3• 2 years ago

Yes, uBlock should incorporate Firefox, rather than Firefox incorporating adblocking.

g-b-r• 2 years ago

A first effect of Mozilla's new "focus on AI"...

TZubiri3• 2 years ago

First came NetScape and all was good. Then came Internet Explorer, but apparently bundling a web browser with an operating system was bad, ok. Then came Google's Chrome trying to profit from a web browser with ads, and that was deemed 'bad' again. Then it was not sufficient for the browser manufacturers to push no ads, but the consumer demands that the browser block ads from websites. Now the browser developer and the third party ad blocker have some fight over who gets to serve clients that not only don't pay, but don't want advertisers to foot the bill either.

I have no sympathy for users that don't want to pay for software, or for developers that cater to that demographic. Enjoy fighting for crumbs.

Sent from Microsoft Edge.

pessimizer3• 2 years ago

Nobody is forcing you to put your website on the open internet, you're doing it because you're making a value judgement about how much money you can make by not closing or paywalling your system. Nobody cares what your business model is (that's your business and your decision barring illegality), and if it's not working for you, you should change it or shut down. Why should anyone have any sympathy for you?

totetsu• 2 years ago

Tangentially has anyone else noticed chrome extensions management page now saying unlock origin will soon be disables and to please find a replacement?

grahamj2• 2 years ago

Yep. Fuck Google, I won’t use a desktop browser without it.

silverliver3• 2 years ago

I wouldn't use a mobile browser without it either.

eYrKEC2• 2 years ago

The replacement is Brave browser https://brave.com/. Skip the crypto. Enjoy the integrated ad blocking.

yapyap• 2 years ago

honestly we arent missing much by a manifest v3 ublock origin lite extension going away on firefox because firefox is still compatible with v2 so realistically we wouldnt have any use for it.

nevertheless it still is a sucky situation

Havoc• 2 years ago

Those don’t seem like unreasonable asks on Moz side

Sephr• 2 years ago

Doesn't this behavior from Mozilla staff indicate that using Firefox extensions at all is a security issue?

This shows that the reviewers may not be competent enough to catch actual malware uploaded to their add-ons site.

Aachen• 2 years ago

Yes. I never took the review process seriously, I assumed people could publish pretty much whatever. Today I learned it's meant to be tight as well as that you can't run your own code anymore; that it needs to go through review or you get to reinstall every time you start your browser.

I've held out for a long time with Mozilla, trusting they thought it's a useful thing to do when they partner with Facebook to make privacy preserving adtech. This is a big ask of me though. I don't use it myself but I'm constantly running into limitations on Android and, at work, iOS because you can't simply do what you want on the devices without all sorts of hoops and fearmongering surrounding having actual access to your own device—the stuff I use my phone for simply doesn't run without root and one can't even make a full system backup without. It's not your device. Learning this about Firefox makes me feel it's not my browser...

vednig• 2 years ago

Automated process have so far managed to destroy the experience of the world wide web as a whole for developers and users both. And AI based tools seem like gas to this fire. Seems very soon web will die out of it's quality and only bots will remain.

NelsonMinar• 2 years ago

I'd hoped Google sabotaging uBlock Origin would be an opportunity for Mozilla to pick up some new users for Firefox. Lol.

neilv• 2 years ago

Gorhill's full uBlock Origin might be the only remaining selling point for Firefox.

With the outrageous sum of money that the Mozilla top executive was recently taking for themself, they could've instead staffed an entire team of first-rate people, with the sole mission of doing whatever Mr. Gorhill needed.

move-on-by• 2 years ago

They are too busy working for the advertising companies Mr. Gorhill is blocking. Most recently adding ‘privacy preserving attribution’ - a feature that no user has asked for.

paulryanrogers2• 2 years ago

People don't want 3P cookies tracking them around the web. They also don't want to pay to visit sites. Mozilla is trying to provide a middle path, I salute the effort.

qwertox• 2 years ago

I wish we could add PPAs to browsers just like we can in Debian/Ubuntu.

Maybe the EU should look into this, and also allow the users to "weaken" their security in order to continue using Manifest Version 2.

Log_out_• 2 years ago

If you would group those woes, by type of addon, i guess there is "irrelevant " and "a world of pain for those threatening google add revenues " .. the hand that feeds.

Lerc• 2 years ago

It seems to me that any platform with a review gateway should treat failing a review erroneously as a critical failure.

In fact it does literally constitute denial-of-service.

When a failure like this occurs, it needs more than an apology, it should have an incident report to show that the failure was understood and steps were taken to prevent future failures.

tatersolid• 2 years ago

From a security standpoint the opposite is true: false negatives are to be avoided at all costs, even when that posture increases false positives. There’s always a trade-off.

eviks3• 2 years ago

Or there isn't and such level of competence just increases the chances of both types of negatives: there is no good reason to think that people who can't see the obvious in cases like this one will catch hidden vulnerabilities

andrewmcwatters• 2 years ago

We need an industry movement of just saying no to app stores.

throwaway984393• 2 years ago

This is why app stores / extension stores are simply an antipattern. The intent is to make usability easier, but it's actually useful functionality.

Get rid of the app and extension stores and let users just install software they find on the internet. Safe and secure software is found on websites dedicated to reviewing them, like the Freshmeat of old, Tucows, etc.

AndrewKemendo3• 2 years ago

Is it even possible to connect to the public Internet in a way that isn’t completely compromised by a corporation or state?

TOR is busted at this point

DNS have been MITMed

Almost all hosts are under the control of a few players who are compelled by their respective states for ubiquitous and server monitoring

Any advertised IP has to have tons of routing info and local pointers so local hosting is just as risky if not more

What are the remaining options for a free (as in speech) internet?

lez2• 2 years ago

Nostr.

AndrewKemendo3• 2 years ago

Thanks I’ve heard of this but hadn’t looked too hard

squarefoot2• 2 years ago

Technically intriguing, but the people involved don't inspire the slightest trust.

https://archive.ph/TLwch

( https://www.businessinsider.com/jack-dorsey-fiatjaf-nostr-do... )

ab_testing• 2 years ago

I think this is bad for the general population. Chrome is already planning to disable uBlock origin and many folks I know were ready to move browsers to Firefox to keep uBlock functionality. Now if uBlock is removed from Firefox extension store as well, there is no clear path to execute it from Github on managed machines. Sure if you are a developer and have admin rights, you can get it to work on Firefox, but a lot of people don't.

btown• 2 years ago

Per the article, uBlock Origin is still in the Firefox store at https://addons.mozilla.org/en-US/firefox/addon/ublock-origin... ; it's the lighter MV3-based uBlock Origin Lite that was removed. So the general population can continue to use the full Origin.

And because the original non-lite uBlock Origin supports much more complicated rulesets, it should be effective even without code updates... but it still is concerning that the same Mozilla errors that caused Origin Lite to be flagged might extend to time-sensitive updates to the original Origin as well.

dowakin• 2 years ago

Without Gorhill's uBlock Origin, the internet would be a really awful place. Thank you, Raymond!

paul7986• 2 years ago

One of Firefox's value is uBlock origin for it's users yet not for Mozilla's money train Google and others.

With uBlock, pop up blocker extensions and Mac Minis connected to my TVs (wireless mouse as remote) I have totally ad free Internet experience; every site there is & from my couch or in my rooms.

sfink3• 2 years ago

That sucks. I work for Mozilla, but nowhere near Addons so I don't know what pressures they're under or whatever.

But if I ran the zoo... this is gorhill we're talking about. We ought to just make him an add-on reviewer with full rights, and tell him it's ok if the only add-ons he reviews are his own. We do not need to vet either his competence or trustworthiness; we have vastly more historical data backing him up than on any contractor or employee.

He's not a one-off either. We aren't nearly as volunteer-oriented as we used to be, sadly. But we still get many and major contributions from volunteers, and at least in my team (SpiderMonkey) there's no wall between external and paid contributors. (Except for the company-wide offsites, grr...) I don't see any reason why gorhill couldn't be made a full member of the review team, not that I'd expect him to be up for it right now given what's happened.

That makes more sense to me than giving him a special pass that we could potentially give out to other people or organizations. He is a major contributor to Firefox's capability and success already, let him contribute reviews that are already a thing and provide value. (Again, only self-reviews would be just fine with me.)

Now I need to figure out who to pester on Slack.

EasyMark10• 2 years ago

I suspect he will simmer down a bit (I do not at all blame him for what he did, it has to be frustrating to dedicate thousands of hours into something just to have some clueless person pull it). I think it will be back inside of a week, it’s important and can save battery over regular ublock origin on Firefox.

thoroughburro4• 2 years ago

it’s important and can save battery over regular ublock origin on Firefox

That sounds like a reason for Mozilla to simmer down and compromise, not gorhill.

account424• 2 years ago

can save battery over regular ublock origin

Comparing battery usage for tools with wildly different capabilites does not make sense.

omoikane• 2 years ago

This sounds like a proposal to make the review process giving more weight to reputation, unlike the current process which is supposed to be entirely technical[1]. This might be a good idea, but I can see how Mozilla would get a different set of complaints about reputation not being consistently evaluated.

[1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing

sfink3• 2 years ago

That's a fair complaint, and I definitely agree that using reputation as a factor in the decision for an individual addon is a very bad idea. But why is that? (1) Because reputation does not imply trustworthiness. Someone could build up a reputation with a set of very proper addons, and then use that reputation to sneak in problematic ones. (2) Because it's unfair special treatment. The chosen person's addons would be subject to different standards than others'.

Again, this is gorhill. People are offering authors of popular addons some mind-bendingly large sums of money to sell out. (1) does not apply: gorhill is the author of the most popular addon, which implies that he has been offered if not the most money, at least a lot more than most. And the well-known history is that someone did make money off of his original version, that someone isn't him, and in response he rebirthed the addon that he didn't particularly want to maintain. Try to find someone with a more convincing backstory.

(2) is trickier, and it's why the distinction between uBlock Origin getting a free pass and gorhill being a reviewer makes sense to me, even if it seems like I'm just obscuring influence. As a reviewer, gorhill would be expected to not just automatically approve his own addons, but to apply the agreed upon evaluation criteria. This would be a farce if his integrity were in question, but see (1). It's pretty clear to see that he is the person most qualified to make that evaluation (heck, he's already doing it before releasing; he's not new to the game), so it comes down to trust.

Sure, I am not the best person to review my own code, no matter how honest I might be. But read the Technical Code Review portion of the link above[1], since it's the only part that matters here. There are some addons where those criteria might be difficult to evaluate, but we're not talking about those. If significant code changes cause those to be less clear cut, gorhill can always pass it by another reviewer. (Yes, this again requires trust. See (1).)

Plus, you don't even have to depend on (1). People can be skeptical and double-check, and news would get out very very quickly. (Even shortcomings in areas like a reproducible build would get called out.)

I don't see this being a wide open backdoor into the process. Not many people are going to come by with the #1 installed addon, together with the history of uBlock and uBlock Origin. Sure, factoring reputation into the process is fraught with problems, but I'm not suggesting that everyone above 1M installs gets grandfathered in. This slippery slope is bone dry and covered with cobblestones.

[1] https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing

fph• 2 years ago

I disagree here. You don't want to allow people to review their own code. That defeats the purpose of a review. No matter if he's a superstar, have someone else look at his code so that he doesn't get sloppy with security practices.

And if you allowed this, then more borderline superstars would want the same privilege.

In scientific publishing, even if you're the editor in chief, your paper gets reviewed by someone else and the whole decision process happens away from your eyes; this is good for science.

thatguy288• 2 years ago

Probably a big ask, but could you find out why one is not allowed to add your own root cert to FF and sign an addon yourself, instead being forced to use an ESR/develop/nightly version and setting xpinstall.signatures.required to false, significantly reducing your security?

anticensor• 2 years ago

And, when a self-signed certificate is in use, the browser should show a prominent icon of self-configured security.

Timber-6539• 2 years ago

I fully agree with Gorhill's decision to pull the addon. Any downgrade of user experience on Firefox is solely due to their addons review team.

Maybe if more developers refuse to put up with such bullshit in the name of gatekeeping the extensions store, browser vendors will start acting properly.

superkuh2• 2 years ago

uBlock Origin 1.60 for desktop (not lite) has also been stuck in Mozilla review for a week now. On the firefox add-on site it is still 1.59 which doesn't really work for common things like youtube.

EasyMark10• 2 years ago

I'm glad he put it back up, I for one use it knowing that it's saving me battery on my phone and it works quite well.

adam-p• 2 years ago

If you want another example of difficulty with the AMO review process: https://github.com/adam-p/markdown-here/issues/21

And that's just one of the examples; another resulted in me having to add a preprocessor that removes code at build-time, which was annoying. I like Firefox, but it wasn't always easy to justify the effort.

CatWChainsaw• 2 years ago

It seems like customer service/PR/UX has really taken a nosedive since the start of COVID or maybe 2022. The pendulum seems to be swinging from "the customer is always right" to "give me your money, shut the fuck up, and go away until I want your money again."

Gorhill threw in the towel on uBOL after dealing with repeated bullshit from Mozilla, from the sounds of it. Multiple reviews, multiple people not understanding what the most famous FF extension in the world does, multiple appeals.

Personally, in just the past month, USPS has dropped active email conversations twice; a vendor I use often at work has disabled important web pages and there's utter silence from their support email; Verizon is deprecating their messaging app in a month and I learned this through reddit; and my bank returned a canned response to an issue I raised two months ago.

I remember a comment on this site from several months ago from someone who worked in customer service who shared a list of things that deprioritize you in a company's eyes, but it sounded like if you express the least bit of frustration at a bad experience, it goes on your permanent record. Companies, however, are allowed to shaft you however they please.

aprilnya• 2 years ago

FWIW, I've seen Firefox being unreasonable to other extensions as well — OldTwitter has been gone for a while and BlueBlocker has been trying to push an update to change the domain from Twitter to X for a while with no success...

Gorhill pulls uBlock Origin Lite from Firefox store

Related Stories