Gorhill pulls uBlock Origin Lite from Firefox store

Firefox (despite being the smallest usage) is utterly insane with regards to process. They demand a reproducible build, but then can’t do things like install the right version of yarn (no – npm install -g yarn is not correct, our readme says it in bold like 5 times and provides the exact correct command to install the right version), or follow basic setup steps like “Use this version of node (complete with exact steps to install it and a script to automate that for them)”.

God fucking help you if you try to do something completely crazy as a private company like – checks notes – use a private NPM module. Despite providing them with access on a pre-configured account, or offering to give a review account access according to Mozilla “It’s too hard to use external accounts during review”.

Honestly – having to interact with the browser review team is a BIG reason I no longer recommend Firefox. They’re incompetent at best, and I’m fairly convinced they’re just milking the google search deal income for as a much as it’s worth – I don’t think they really want to provide an alternative and secure browser anymore.

I wouldn’t expect the reviewers to deal with every add-ons bespoke snowflake build. Even less so if it requires access to a private module. Mozilla should provide a baseline of how a build is intended to be done, then extensions just have to follow this template. Though yes, you would expect them to have some familiarity with basic stuff like yarn and that the baseline supports a few of the most popular builders.

yarn npm login

yarn –immutable

yarn build

Personally – I don’t really find it reasonable to place demands on build tooling for an external company.

I’m assuming you would also find it reasonable for Google to suddenly ship chromium with a requirement that you use “google-pack” for all js builds or they don’t run it?

To be entirely blunt, what exactly do you think is going to change when we’re already giving them bare JS? It’s not like we’re shipping a binary blob here, we’re literally handing them a zip file with perfectly fine & inspectable javascript inside it.

Further, do you realistically believe that a single low grade QA/Support engineer who can’t even install the correct tooling is going to catch malware?

Because I read their matrix chats and I can fucking promise they aren’t catching the malware all that fast….

I’m not sure I agree, plenty of OS distributions do this. If you want to distribute on Arch in the official AUR you’re going to need a PKGBUILD file. The difference though is they make it very easy to integrate custom distribution channels where you can build the package however you want, and I would really love to see browsers move more in that direction. Requiring centrally managed signatures from a corporation to install extensions in a purportedly open and community-driven product is just absurd to me.

This is fine. This is actually also roughly in line with what you need for an extension (a manifest.json file).

What the poster here is proposing is rather this: You cannot build that PKGBUILD file using any tooling other than the standard. Ex – you want to script how that PKGBUILD file get made? Fuck off, not allowed.

That’s a COMPLETELY different take. It’s not dictating limitations on the output (which I find reasonable as a required integration between products) it’s dictating limitations on how a company produces that output (I find this monopoly behavior, why should they get to tell me what tools or processes to use? My output is the SAME.).

That’s exactly what the ex-McKinsey C-suite are doing. Regular employee talent suffers because of it, as you’ve found.

Mozilla not so much.

We had a really frank internal discussion about just dropping support for Mozilla because their review process is also the most expensive out of every client we currently ship (And not “reasonable expensive”… Useless time sink expensive, back and forths with folks who I would frankly not hire as a junior because they can’t read a readme file and follow basic and clear instructions.)

They are acting like they have the position to demand these reviews… and they just don’t.

Good devs just leave because they’re a waste of time and money, and they’re STILL rampant with malware on their store (Mozilla is literally the only one of the major vendors that will make a listing live with no vetting, and then 4 months later yank it because of “problems”…).

It doesn’t make me feel secure, it makes me feel like they’re trying to market security. It makes me really dislike mozilla, and firefox was a formative part of the my tech career early.

I do have half an idea to deal with it that I plan to try, thought it might be helpful to suggest: implement a Fisher-Price build system that checks and automates every single step and cannot go wrong. Ideally if the reviewers can run Docker, do it all in a container. Wrap package.json scripts with functions to validate the build environment before proceeding and either fix it automatically or fail and print clear instructions to the console. A preinstall hook could verify they have proper NPM auth and prompt for it if needed.

Annoying to have to do that at all though. I’m starting to come to similar conclusions on Firefox, using it currently but I’ve been thinking about jumping ship for a while. What browser would you recommend now? I wanted to get away from Google but I’m considering just Chromium since any remotely comparable options I’ve found are poorly thought out wrappers of it.

Programming is a race between the programmers, trying to build better, idiot-proof software, and the Universe, trying to build better idiots. Do not underestimate the Universe.

This is the biggest issue we had, and we had to add a decent bit of complexity to our builds to support reproducible builds in the exact way they want.
But the silly part is that our extension involves building a wasm file from Rust, and after some back and forth it turned out that they don’t require it to be reproducible (despite being core of our extension and containing 99% of our logic), which honestly feels like it defeats the point – who cares if JS reproduces if you can hide any arbitrary possibly-malicious code in wasm.

For a while we were seriously considering putting our prebuilt wasm in the source package or on npm, just to make the “reproducible build” on AMO side simpler, despite this making it even further from how it’s actually built.

I want to write a chat program, but it has to work on phones, and the DevEx for native phone frameworks compared to desktop apps looks like hell, and PWAs seem to be barely supported.

It’s easier than ever to make a CLI or desktop app, but phones seem like the worst of all Microsoft dev history – Learn these arcane lifecycle vocab words that make no sense, like using Win32 directly, but also it changes every year or two like when MS invents a new GUI framework, but also if you can’t get into The Store, nobody but your power user friends will be able to run your app anyway. What is this shit?

Mozilla sneaking in more and more spyware and ad friendly functionality seems in line with the same conspirators.

And given how high profile all these changes are, it runs to the top of the company.

And that more interesting job will probably pay better as well.

You just need to have a shell script in the root directory that assumes the person running it has 0 clue about your extension.

Also some of this reminds me of Apple. They clear something up, then bring it up again the next time review is needed.

Another time, they failed the review because the reviewer’s VM _ran out of disk space_ (which we only learned after digging into the issue, as the first report just mentioned “build errors”; according to later inquiries the VM had ~9GB available) and we had to add some extra build logic to delete intermediate files, just for them. The build is quite large because it involves rust->wasm compilation, but I’d still expect the reviewer’s machine to have a bit more space…

It’s not a huge improvement, but it sounds like one thing we could do to improve the communications process around build errors is to include a link to this documentation in the notification email sent to developers. I’ll create a ticket for this now.

(1): https://extensionworkshop.com/documentation/publish/source-c…

> to build a browser extension

It shares 99% of code with a desktop application; you can compile it to wasm while preserving most features. The extension wraps the wasm.

For reference, when making a single clean build, the `target/` dir reaches 700MB.

None of this is surprising or exculpatory. Demanding >9GB of disk space to build a browser extension is insane.

> we need all of these to make a “true” reproducible build from scratch

You need and them to reproduce your build. You definitely don’t need all of them to build what you’re building.

When you took your desktop app and built a browser extension version, did you really rewrite the entire app in vanilla JavaScript just got the Mozilla review team as you seem to be expecting GP to have done? How long did it take you? What sort of opportunity cost was there from investing your time on that instead of adding value to your product?

Demanding >9GB of disk space to build a browser extension is insane.

I would tend to assume that a person given responsibility for reviewing this software, supposedly to protect end users, would not be this clueless.

What value is the “Firefox Store” actually offering then?

That anyone dumber than such a reviewer cannot sneak malicious extensions in.

Which, sadly, is probably a non-trivial number of submissions.

Although people smarter than such a reviewer are free to? What kind of standard is that?

> Which, sadly, is probably a non-trivial number of submissions.

Then they’re not, as an organization, actually capable of doing what they’re promising here. There are more ways to get this wrong than to get it right, and borrowing the Google strategy of just not caring about your end users seems completely inappropriate for a non-profit like Mozilla.

That’s the standard of all currated stores.

We can argue about whether Mozilla’s reviewer skillset is too low, but there’s always going to be someone smarter than a reviewer, when reviewing is a cost center that companies want to spend the minimum amount of money on.

This seems to ignore how boutique stores and high end retail operates. This is the standard of rent seeking middlemen stores. You still haven’t answered why this model is appropriate for Firefox.

> We can argue about whether Mozilla’s reviewer skillset is too low

We’re not. I’m pointing out how simply taking the opposing view reveals that your reasoning could not possibly be correct.

> reviewing is a cost center that companies want to spend the minimum amount of money on.

Which is weird because I assumed the cost of re-creating the plugin yourself would be much higher than that. It’s almost like continual failure of these simplistic analyses reveal that a broader examination is required.

A minimal cost reviewer model isn’t appropriate to Firefox.

But, example counterargument as to why it might be: Firefox needs to ensure they don’t open themselves up liability but doesn’t want to fully fund/staff a review team.

would you do that job 8+ hours a day for little pay?

Ya’ll are putting the cart before the horse. I’m not being critical of the reviewer but of the large non profit organization that is responsible for creating this failure. Which apparently only exists to pantomime what the for profit players have built and is unsurprisingly equally wasteful of open source developers time and skill set.

Why does Firefox even need a curated “store?” They could have built anything better. I’m sure they were paid, er given “donations,” that ensured they would never try. And from what everyone has been saying here those donations got exactly what they were intended to get.

Even Hacker News seems to unquestioningly assume this is a rational way to manage an open source plugin ecosystem. That this is the fault of the plugin author somehow or the store reviewer somehow. It’s really disappointing to see.

Which is ironic considering the reason they went to India and not other countries with cheap labor is that English is an official language there.

These execs mistake “English is an official language” for “English is a widespread first language”. Only 0.02% of Indians speak English as their first language, while total speakers (of first, second, or third language) are 10.6% of the population.(0)

(0) https://en.wikipedia.org/wiki/Languages_of_India#Multilingua…

The focus on primary language makes it seem less used than it actually is.

I’d guess they’re more expensive now, despite the obvious timezone problems.

having the makers of a browser do this is bound to create both efficiency and political problems for extensions. im remembering dissenter now

But if I ran the zoo… this is gorhill we’re talking about. We ought to just make him an add-on reviewer with full rights, and tell him it’s ok if the only add-ons he reviews are his own. We do not need to vet either his competence or trustworthiness; we have vastly more historical data backing him up than on any contractor or employee.

He’s not a one-off either. We aren’t nearly as volunteer-oriented as we used to be, sadly. But we still get many and major contributions from volunteers, and at least in my team (SpiderMonkey) there’s no wall between external and paid contributors. (Except for the company-wide offsites, grr…) I don’t see any reason why gorhill couldn’t be made a full member of the review team, not that I’d expect him to be up for it right now given what’s happened.

That makes more sense to me than giving him a special pass that we could potentially give out to other people or organizations. He is a major contributor to Firefox’s capability and success already, let him contribute reviews that are already a thing and provide value. (Again, only self-reviews would be just fine with me.)

Now I need to figure out who to pester on Slack.

And if you allowed this, then more borderline superstars would want the same privilege.

In scientific publishing, even if you’re the editor in chief, your paper gets reviewed by someone else and the whole decision process happens away from your eyes; this is good for science.

Again, this is gorhill. People are offering authors of popular addons some mind-bendingly large sums of money to sell out. (1) does not apply: gorhill is the author of the most popular addon, which implies that he has been offered if not the most money, at least a lot more than most. And the well-known history is that someone did make money off of his original version, that someone isn’t him, and in response he rebirthed the addon that he didn’t particularly want to maintain. Try to find someone with a more convincing backstory.

(2) is trickier, and it’s why the distinction between uBlock Origin getting a free pass and gorhill being a reviewer makes sense to me, even if it seems like I’m just obscuring influence. As a reviewer, gorhill would be expected to not just automatically approve his own addons, but to apply the agreed upon evaluation criteria. This would be a farce if his integrity were in question, but see (1). It’s pretty clear to see that he is the person most qualified to make that evaluation (heck, he’s already doing it before releasing; he’s not new to the game), so it comes down to trust.

Sure, I am not the best person to review my own code, no matter how honest I might be. But read the Technical Code Review portion of the link above(1), since it’s the only part that matters here. There are some addons where those criteria might be difficult to evaluate, but we’re not talking about those. If significant code changes cause those to be less clear cut, gorhill can always pass it by another reviewer. (Yes, this again requires trust. See (1).)

Plus, you don’t even have to depend on (1). People can be skeptical and double-check, and news would get out very very quickly. (Even shortcomings in areas like a reproducible build would get called out.)

I don’t see this being a wide open backdoor into the process. Not many people are going to come by with the #1 installed addon, together with the history of uBlock and uBlock Origin. Sure, factoring reputation into the process is fraught with problems, but I’m not suggesting that everyone above 1M installs gets grandfathered in. This slippery slope is bone dry and covered with cobblestones.

(1) https://wiki.mozilla.org/Add-ons/Reviewers/Guide/Reviewing

What’s the alternative? No pre-release review at all? As a user I would hope that this will not be the case, especially now that we have confirmation that flashy supply chain attacks are being executed in the wild. In fact the review policy protects gorhill himself too, since it makes him a bit less attractive as a target for a rubberhose attack (no point in blackmailing him to put in spyware if the spyware would be caught before release).

This doesn’t mean they should get to publish whatever they want, but if a reviewer is about to reject a high profile plugin, they should get a second set of eyes on it. Which would have obviously caught the mistake here.

Feels like another “Firefox is underinvested in developer relations” story, which is surprising given how much they rely on them.

Edit: honestly the idea that gorhill doesn’t have a dedicated rep at Mozilla is baffling to me. According to their stats the extension has 8.4 million users. They should call him on the phone to let him know there’s a problem with his extension.

I live as if it were a couple decades ago, working on a desktop computer. I’ve bought several laptops and failed to modernize. My entire life depends on the Internet and all of that, I’d prefer more distance to be honest.

plain old uBlock is another add-on which may no longer exist. (uBlock was the original original, but the same developer, gorhill, mistakenly let it slip into the wrong hands and it became a pay-to-play leaky ad blocker)

Perhaps Mozilla does have a higher tier of review, but it’s for specific plugins, not for specific authors.

If Mozilla is providing tiered support by plugin rather than publisher, this latest kerfuffle is evidence that they should reconsider the approach. But if I were betting, I’d guess there’s no one at Mozilla whose job responsibilities include keeping their marquee plugin authors happy.

They’re the browser with 2% market share.

They’re lucky he didn’t also pull uBlock Origin because he felt insulted and let users figure it out. He doesn’t owe Mozilla their tent-pole of “We make it harder for third-parties to track you”, the tent-pole he set up for them for free.

What I don’t agree with, is that a system that is based on higher tiers for entire accounts, is necessarily better. If such a tier exists, then all the big players will apply pressure to be put in that tier. Suppose Amazon tries for that – surely they’ll get it. And then they’ll use it, not just for “the Amazon app”, but for every crappy outsourced app they make for any purpose. Placing a huge burden on Mozilla, who now will have to spend extra resources to hand-check a lot of crap that could have been auto-rejected, just in case, because effectively the burden of proof has been shifted.

I’d like you all to try to abstract from this case for a second, and think about the strategic choice: Which is the better rule, evaluating apps, or evaluating accounts. Sure, now you’re all thinking that you’ll make a super-duper amalgam system that looks at both in some combination. That’s the benefit of hindsight. But suppose you’re making version 1, and you’re keeping it simple. What would you start with?

For now, evaluating apps.

… but only because gorhill decided not to go nuclear (and good on ’em for doing so). The unequal power dynamic you’re painting of Amazon exists today, whether or not Amazon attempts to pressure Mozilla right now; they’re at their discretion to decide that they’ll only support a Firefox extension if Mozilla plays ball with a bunch of other crappy apps too (and then Mozilla can tell them to go pound sand, and then the users can’t get to the Amazon app easily, and then someone writes a workaround… The human system is far, far squishier and more complicated than the technical system).

> But suppose you’re making version 1, and you’re keeping it simple.

Sadly, Mozilla does not have that luxury because they exist in an ecosystem of other corporations with web-store presences and it’s incumbent upon them to be competitive if they want to survive in that configuration. If Google and Amazon can glad-hand high-value customers, Mozilla needs to learn how to do so also or risk those customers deciding the Mozilla ecosystem is more trouble than it’s worth to participate in (because what do you get? 2% market share?).

Almost every business looks after their biggest customer better than their smallest customer.

And the specific extension in question being a popular ad/tracker blocker while Mozilla has been cozying up to the adtech industry lately and selling access to Firefox user data isn’t a good look for Mozilla. Maybe Mozilla is just being grossly mismanaged but this is all getting noticeably suspicious.

uBlock Origin requires giving the extension full read and write permissions on every site you visit, which is a huge liability, security-wise.

uBlock Origin Lite uses Manifest V3, which doesn’t require providing those permissions to the extension.

Perhaps you trust gorhill with that power, but it’s pretty understandable why others might not want to give that power to a third party.

FYI, it’s UBlock Origin Lite that is affected here, not UBlock Origin. Same developer account, but a tiny fraction of the installation base. I think I still have an extension that has more users than UBlock Origin Lite did on Firefox (only 5000 installations at the time it was taken down).

To be honest, neither party looks good here. It reflects poorly on Mozilla that they don’t have guardrails in place to prevent adverse action on the developer account that publishes their most popular extension. Gorhill’s reaction (particularly his most recent comment from an hour ago) comes off as petty and vindictive. Yes, it’s his prerogative to spend his unpaid time how he wants, but expressing that sort of aggression and directing it at your users doesn’t win over many allies in the long run.

It’s a lot easier to just accuse Google of acting in bad faith, and Mozilla of being their lapdogs, and ignore any possible evidence to the contrary.

There are two issues at play here.

Manifest V3 is, undeniably, a security improvement over Manifest V2. Providing full read/write access to all websites is a huge security risk, and the fact that we’re willing to do it is really a testament to how bad the state of the web is without adblockers.

However, the final standardized version of Manifest V3 limited the size of content filters – essentially, limiting the number of ad sources that you could filter. This severely limits the utility of adblocking extensions.

Mozilla responded to this by promising not to implement the cap in their implemention of Manifest V3 – ie, ignoring that part of the spec and allowing extensions to filter an unlimited number of sources in Firefox. Chrome and other browsers are sticking to the spec, though, including the cap on sources.

I believe UBlock Origin Lite is a downgrade feature-wise from UBlock Origin, but that’s because it’s targeting both Firefox and non-Firefox browsers. In theory, a Manifest V3 version of UBlock Origin Lite designed for Firefox could provide the same functionality as the Manifest V2 UBlock Origin.

Honestly, I hope someone (whether gorhill or someone else) takes up the mantle and does that, because there’s no reason that Firefox users should have to use an adblocker with a less secure design, just because other browsers don’t support it.

That seems to be completely ignoring that extensions aren’t just independent self-contained programs. They’re intended to extend and modify the capabilities of your user agent to better suit the needs of the user. Trusting the user agent with full read/write access to the data it’s fetching is fundamental to the purpose of a user agent. Sure, it’s nice when you can sandbox a helper, but it’s irresponsible to suggest there’s anything wrong or unusual about having the kind of powerful extensions that Google doesn’t want you to have.

You’re arguing against a straw man here.

This developer one of the main reasons for many people to use Firefox, especially in this current chrome controversy manifestV2 vs V3

And ironically this uBOL success should be of very interest to Mozilla because if it had gained more success than the main one uBO then it would be one less reason for the company to invest resources into maintaining manifestV2

HOWEVER: the email clearly states:

> Your Extension uBlock Origin Lite was manually reviewed by the Mozilla Add-ons team in an assessment performed on our own initiative of content that was submitted to Mozilla Add-ons

Either that is a lie, or the manual reviewer that did the “review” doesn’t understand that the automated tool they ran is capable of false positives.

Nothing wrong with automated abuse assessments on a platform like Mozilla’s, but don’t lie in your communications about it (or hire people who know what they’re doing when it comes to blocking addons).

“The burden is that even as a self-hosted extension, it fails to pass review at submission time, which leads to having to wait an arbitrary amount of time (time is an important factor when all the filtering rules are packaged into the extension), and once I finally receive a notification that the review cleared, I have to manually download the extension’s file, rename it, then upload it to GitHub, then manually patch the update_url to point to the new version. It took 5 days after I submitted version 2024.9.12.1004 to finally be notified that the version was approved for self-hosting. As of writing, version 2024.9.22.986 has still not been approved.”

Doesn’t sound like something I’d enjoy as a hobby.

https://github.com/uBlockOrigin/uBOL-home/issues/197

It was not an automated review, it was a manual review, poorly done.
The author then explains that they don’t want to deal with the stress (there are also some extra explanations of what’s involved in the AMO review process), and also that they left a somewhat harmful version of the plugin up.
Not wanting to deal with stress is a perfectly understandable reaction.

You can lose a volunteer army fast if you don’t provide them the warm fuzzies of the experience they don’t get working with a faceless corporation.

Sure, but uBlock Origin, lite or not, is one of the most important browser add-on, if not the single most important one. This may not justify to give it a pass without looking, but it should certainly be reason enough to jump it in front of the queue and review it manually every time.

In general quite many extensions are done for passion. And any chance of destroying that passion will make your product less desirable to work with and thus in long run less popular.

And from the start the review was supposedly: “Your Extension uBlock Origin Lite was manually reviewed by the Mozilla Add-ons team”.

Sure, but it’s published by the same developer and has existed for a while. It’s not a brand new extension under his account, or published on a different developer account.

I’ve built review systems before, and you typically have safeguards in place to prevent mistakes that impact your biggest users. No matter how you cut it, this isn’t a good look for Mozilla.

If you make maintaining one of them more stressful than the other, the maintainer dropping one to focus on the other is a predictable consequence.

When you blatantly violate the IP of a well-trusted dev, posing as a third-party and successfully tricking Apple, yeah, you are a pretty big data point. You can’t call CloudStrike an anecdote.

My bigger intention is to fight the idea that automated solutions are necessarily better than inept human-reliant ones. Firefox doesn’t even have remotely Apple’s scale or revenue to work with – who seriously expects Mozilla to do better than them?

Then Mozilla should do at least 1000 times better even if it is just a forgotten side project like Firefox?

uhhh what were we talking about again… ah right extension reviews.

Well, just let the developer pay for 50 different tiers of review with prices scaling with the size of the code base or upgrade. Display the level of scrutiny on the extension page, have a donate to the cause button so that funds contribute only to reviews.

If you’ve installed any extensions you should regularly be made aware of the security risk and have a nice overview of the level of hazard and fund raising efforts.

If you’ve reached a high level of security further upgrades will either be expensive or install should be discouraged.

In the same place the developer can explain how urgent or useful the upgrade is and users can donate to bring the patch up to the desired level.

Code changes can be displayed with public discussion. This will be useful for doing the different reviews as cheaply as possible. Let there be bidding wars.

In addition there should be an extremely granular permission system that triggers dialogs in an amount sensible for the review level. Developers should be allowed to buy reviews for tiny functions that accurately define permission requests.

For example: Rather than full access to all pages I want access to all links pointing at example.com and I want to fetch the title of the pages on example.com Or say: I don’t want access to the entire internet but only to things in valid RSS or Atom format.

Seems a sensible solution to me and I don’t even know anything.

Nah, XUL had to go. The other stuff wasn’t really related. It was a more “if we are going to break most extensions we may as well use this time to push everything else we want”. If anything XUL is a scapegoat.

I know because I maintained VimFx for a while after the XUL removal. It was difficult to keep up with internal APIs that are changing, but I can’t blame them, they need to develop their product. The thing that really made me give up on maintaining VimFx was the signing enforcement. They just keep tightening the screws so that I couldn’t even run “my own” code with any reasonable UX.

What I would have like to have seen:

1. Provide WebExtensions as the recommended way to do things with some compatibility and deprecation guarantees.

2. Stop caring about compatibility of other APIs.

3. Still allow outside “full access” extensions that use those internal APIs. You can give warnings in the store “this extensions uses unsupported APIs and may break at any time and steal all of your personal data” and make the install button bright red but still allow it.

4. Keep supporting self-distributed extensions with developer managed signing keys and update URLs.

Since there are no compatibility guarantees on these APIs it wouldn’t have been much extra work. Just a bit of UX work to add scary warnings and maintenance of the non-store update code.

Mozilla followed the big corps in the ‘store’ model, instead of keeping it open free-form. We might have a viable developer certification trust system by now, but with that too, only the corps have enforced signing systems (that are closed and fragmented.)

Don’t we already have that system, in the form of distributions? More specifically, I’m thinking of something like Ubuntu’s PPA system, where each developer publishes their packages with their own signing key.

You mean like how you need permission to distribute software on MacOS/iOS? More and more platforms are moving in this direction and I wouldn’t be surprised if Windows goes the same way in the future.

(0): https://support.apple.com/en-nz/guide/mac-help/mh40616/mac

I think MS has already tried this several times, such as with Windows RT and the Windows store. It never caught on, and they pissed off the independent software vendors who make the Windows ecosystem valuable in the first place. Maybe they just didn’t push it hard enough; maybe they could have just forced everyone to use it anyway, and maybe it would have worked because what are Windows users going to do, switch to Linux or Mac? But maybe the real danger was that users simply wouldn’t upgrade to the new locked-down Windows in the first place and just stick with older versions forever, which is something they’ve been doing all along (look how mad people were when they finally killed XP).

You can temporarily add unsigned extensions in about:debugging, but those are lost on restarts, which is pretty annoying. I used this for a while until I got fed up and tried to find a better way.

“Unbranded” Firefox builds allow adding unsigned extensions, but then I need to either 1) compile my own Firefox, or 2) Use “Firefox Developer Edition”, which is mostly just the same as regular Firefox but based on beta versions (I’d rather just use release versions). Neither really appeals to me.

So my solution now is to just create “unlisted” extensions and sign them with the web-ext CLI. It works and it’s not entirely horrible, but it’s a lot more hassle than I’d like.

And the requirement for extensions to be signed is fine; I have no problem with that. But it should allow adding my own signing key. Or something.

I kind of get why Mozilla is so restrictive about this; with banking and credit card stuff and whatnot all being browser-based, adding an extension is basically giving the keys to the castle. I can see some support scammer instructing someone to add some malicious signing key. But there does need to be some limit to how much we protect people from themselves, because at some point you just start making life hard for regular users.

Wait. web-ext allows the signing of arbitrary extensions without review? Wouldn’t that defeat the purpose Mozilla is sacrificing technical users for?

While I didn’t come across web-ext, I also tried my hand at working around firefox’s limitations for my own extensions, but eventually decided it would be easier to give up and switch to a chrome-based browser instead. To this day, I still don’t understand the “significant” threat that Mozilla sees (and other browser vendors apparently don’t) that warrants such heavy-handed Apple-esque control over their users’ ability to control their browser. Whatever it is, I no longer care.

It takes about ten minutes to sign, and only seems like it uses automatic checks. I do get an email that “any extension may be reviewed by a human at any time”.

I don’t know if it matters that it’s unlisted, or that they’re all very simple extensions with very limited permissions. I’m not an expert on any of this and I’ve never published a public extension; I just have a few for my own use. But it does seem that they apply some heuristic to determine what is worth reviewing and what isn’t.

> To this day, I still don’t understand the “significant” threat that Mozilla sees (and other browser vendors apparently don’t) that warrants such heavy-handed Apple-esque control over their users’ ability to control their browser.

There are support scammers and such that will phone you with “hi, we are from Microsoft support to help you. You need to go to h4xx0r.ru to install an extension to protect your computer”.

There are other ways of doing this of course, but an extension is a simple abd easy way.

I don’t really know how to best solve this. I agree with your dislike of the current heavy-handed approach without escape hatch. But I also think the concerns are real, and you’re being a bit too dismissive about that.

Franky, I don’t think this move is motivated by security concerns at all. (Not that it matters anymore)

I don’t like this. I know there have been issues with malicious extensions, so it makes sense to me that installing unsigned extensions is turned off by default, but requiring developer builds is a step too far.

Before taking drastic action like pulling addons from the store, Mozilla should reach out if they have questions or concerns about a review.

With the outrageous sum of money that the Mozilla top executive was recently taking for themself, they could’ve instead staffed an entire team of first-rate people, with the sole mission of doing whatever Mr. Gorhill needed.

I don’t pay for news. Intelligent employees of news organizations would learn from that but no…

Instead we get advertising apologists trying to gaslight me into thinking tracking is ok.

They did learn from it, that’s why many “news” sites are now content-free entertainment, and why intelligent non-employees of news organizations complain that they’re not providing news.

In light of the alternatives (like paying for everything with discrete purchase or subscriptions), I’d prefer that advertising survive. Ideally with less invasive ways of detecting my interests.

My intention is certainly not to gaslight anyone. Not sure how you came to that conclusion.

Full disclosure, I work for a paywall SAAS.

This seems pretty harsh. Mozilla made a mistake, Mozilla apologized, Mozilla fixed the mistake (maybe even improved their processes), and the author still pulls their choose and criticizes Mozilla. On my opinion either author took this a bit up personally, or cares about improving the review process and wants to make a strong point (with some hurt done for their project visibility).

https://github.com/gorhill/uBlock/issues/38#issuecomment-918…

So it’s predictable they’d get fed up with that Mozilla review process and call it quits too.

¹ Which led them to hand the project to an unscrupulous rando that immediately tried to monetise it, leading Raymond to hate the outcome and having to decry his own previous project and ending up essentially where it all started but with a bunch of extra work in the middle.

I would walk away, too.

See Raymond’s comment five days ago:

https://github.com/uBlockOrigin/uBOL-home/issues/197

Who is being hurt is Raymond Hill (their sanity / mental stability / desire to work on this popular extension); Firefox users who preferred the Lite version; Firefox users on Android; Everyone who would’ve been recommended this extension and now won’t (see other comments in this thread); Mozilla (taking yet another hit to their reputation) and by extension the open web as more reasons to abandon Firefox lead to less browser diversity.

Mozilla has a press page — they could issue a clear, open press release talking about what went wrong, how they’re changing going forward, etc. They could even acknowledge that this extension is awesome and contribute capital to making it available to their users.

But, instead, they did the minimum amount possible to save face after one of their reviewers royally messed up. The things the reviewer cited in the first review are plainly wrong and a junior JS developer could tell you that.

Heck, an AI reviewer would have done better (ChatGPT 4o mini):

“No, this file does not appear to contain minified code. Minified code is typically compressed to remove all unnecessary characters such as whitespace, line breaks, and comments to reduce the file size, making it harder to read.

The code you provided contains readable formatting, including comments, indentation, and well-structured functions, which are not characteristics of minified code.”

Yea, those pesky unpaid developers, letting their emotions get mixed into their personal projects. Why can’t they be cold and unfeeling, like the people who run the firefox “store?”

> Mozilla apologized

No they didn’t. Now I’m not here to play apology police or anything. But that’s just a perfunctory customer service voice statement which happened to include the word “apologize”. And that’s fine. Nobody expects more. We can acknowledge it for what it is tho.

“We admit we used automated scanning here and tried to pass it off as human review. We got caught. Badly. All our future scans will have to pass our own internal reviews before we make demands of extension authors.”

these sorts of things

Hill made their initial emails public and the discussion of AMO’s incompetence had already happened. Mozilla have been able to see this and formulate a response. Their response was not a full PR face-saving, it was a single further email from the AMO review system. That speaks volumes.

Dear Mr Hill

sorry we are such idiots. Now please reply to us so you comply with the mandatory review process governed by idiots. Our policies require that we do not unilaterally fix any mistakes we unilaterally made. We must first waste more of your time to acertain that you agree our direction is the right one.

Yours Sincerely

The Idiots

https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco…

But I’m trying to have a productive conversation on what would be a realistic response that Mozilla could have plausibly sent that would show true remorse and constitute a proper apology.

Insulting them and giving absurd examples that would never happen does not advance the discussion. I’m not interested in unabashed mocking. There are people on the other side too, it doesn’t cost anything to have a little empathy. Yes, Mozilla is in the wrong here, no one disagrees. How about we discuss what they could’ve done right?

Edit: and if they want to continue thinking they’re a “platform”, they need to invest in more and better staff for doing these reviews they insist on. They need to accept that false positives are just as bad, if not worse, than false negatives.

But you did it in a way that ridicules Mozilla. It was an unrealistic example of something they would never have sent. For what? There’s no point to that. Surely you can come up with something that is apologetic, honest, real, and that a manager at a company could approve. I was looking for something sensical, not a caricature.

> Mozilla should stop thinking (…)

That, and most of your post, gets to the heart of it. You’re displeased with Mozilla and want them to look bad. Look, I get it, I don’t like Mozilla’s direction either, I am plenty critical of them. But you can be critical and constructive. Your comments that made them look like absolute bozos are the kind of rhetoric any Mozilla employee would skip over as not being serious. I would like Mozilla to be better, not just burn them to the ground.

For a though experiment lets take those suggestions earlier in the thread that you already dismissed. Make them 10% less blunt. Have they become realistic? No? OK, another 10% less blunt. Keep going until it seems realistic. Does it still show true remorse? No? Quelle surprise! I don’t think there is any overlap to be found in this Venn Diagram.

The closest thing we might ever see is the mozilla dev elsewhere in this thread. They’re opining that mozilla should probably just give Hill reviewer creds so he can rubber stamp his own addons and explaining why.

I’m not saying that if Mozilla were to give him those permissions that it would constitute an apology. I’m saying that the case this Mozilla dev is making, that alone is already more remorse from Mozilla about how broken their internal process and priorities are, more than any “realistic” official communication from Mozilla will show.

That’s… Not how communication works.

> Have they become realistic? No? OK, another 10% less blunt. Keep going until it seems realistic. Does it still show true remorse? No? Quelle surprise!

What a bizarre straw man. You invent an argument unrelated to what the other person said, then argue with yourself pretending to know what the other person would respond ultimately making the imaginary opponent agree with you. That’s quite something.

Your post is so far removed from the point of the thread I have no idea how to respond to it. Nor would I want to, I believe this has gone so far off the rails there’s no salvaging it.

Again, I’m not defending Mozilla. Anyone who cared to find my other comments on the thread can easily verify I defended Raymond Hill from the start. The one thing I was interested in with the original question were serious arguments of what Mozilla could have done better. Straw man arguments lacking in empathy that makes everyone on the other side look like clowns are unproductive.

FWIW, the comment you were replying to had a bit of hyperbole in it, and I guess you seem to be expecting it to be an exact quote? I think that same sentiment can be done in a way that is more neutral in tone, which is what seems to be irking you? Which is awkward, I guess, as, frankly, the one you prefer comes off much more to me as “groveling”: the issue at hand is procedural and technical and maybe a bit political, but that reply is intensely personal and is directly “bending the knee” to Gorhill while not admitting any actual mistake.

But like, maybe, sometimes, an apology inherently requires some humility, and if Mozilla isn’t willing to actually state that they did wrong — not that Gorhill deserves respect, not that this situation went badly, certainly not merely that Gorhill felt bad about it — then what, pray tell, even is an apology?

I didn’t say the one I linked was perfect, I said it was more plausible. I don’t understand why everyone seems to have such a hard time understanding what that word means.

> and I guess you seem to be expecting it to be an exact quote?

That is exactly what I asked for. I asked what the email could have said. Words have meanings. Why oh why does that seem to be a novel concept?

> But like, maybe, sometimes, an apology inherently requires some humility

Yes, yes it does. I agree.

> then what, pray tell, even is an apology?

For crying out loud. HN, the community that is ridiculed everywhere else for being too literal, was today incapable of understanding a literal question.

> What could the email have said

If the goal is finding the right magic incantation for apology, then answer to your question is “nothing”. If it’s not, then the answer is “almost anything”.

So yes, apologies matters. It is baffling, and honestly worrying, that this has to be explained.

It is important to realise the people steering the apology are not the same ones that caused the offence. The organisation is the same, but you can’t control what every single individual does.

Hey man, you’re the one that seems to be of the impression that the person sending form letter extension review responses is in a position in Mozilla to be able to do any of the shit you just said apologizes represent.

I asked what’s it matter if they tick the apology box because they can’t actually apologize.

I just don’t get why, in my previous post, I was supposed to pretend like the person who wrote that “we apologize” statement even intended to apologize.

—-

And in the odd chance the person who sent that email is in that position (or it’s a personal apology limited to their own reviewing failures) they need to use their words and distinguish themselves from a prefunctory customer service script. Rote apologies are not apologies, they’re simply someone saying what they believe are the right polite words for a situation.

Yeah, that’s fair.

> Rote apologies are not apologies, they’re simply someone saying what they believe are the right polite words for a situation.

I agree. And rereading the email I also agree that their apology was lacklustre to say the least. Initially that seemed to be to have come from a position of authority, but I see I was wrong.

My only disagreement is that I do think there is some apology that would be valid. Something like a personalised email (not from a form) from someone with a modicum of power (e.g. the manager of the add-ons division).

Note, however, I’m not saying a valid apology must be accepted.

Okay… but I still get the feeling you’re talking about a non-apology here. No matter how hard they work to craft the right words, unless that manager does something differently they’re just being manipulative in addition to the original wrong they’re pretending to apologize for.

I know I’m not being maximally charitable here, but look how far you’ve strayed from “If the literal string ‘we apologize’ isn’t it, what is?”

Wasn’t it clear that I changed my mind through the conversation? That’s the point for me, my goal isn’t to pick a position and claim I’m right to the end, but to learn and improve my views. Like I said:

> I agree. And rereading the email I also agree that their apology was lacklustre to say the least. Initially that seemed to be to have come from a position of authority, but I see I was wrong.

If the literal strings “I agree” and “I was wrong” don’t convey that I agree with your points and I think I was wrong, what does?

To be absolutely clear, I’m being tongue-in-cheek. I have no desire to continue this.

And to be even clearer, what I offered as a suggestion was a response to you saying there was “nothing” they could do. That’s the one part I disagree with by the end.

There was an if clause separating different circumstances into “nothing” and “almost anything”.

And I stand by that. If an apology is actually meant it becomes trivial to come up with the words to apologize.

Laboring over the process of apologizing is a good sign you’re trying to avoid actually apologizing.

And I guess some people would claim that since its an open source addon no one can feel entitled to anything else

I can totally understand gorhill becoming completely insensed by the whole thing and refusing to play ball when Mozilla “realises their mistake”. Their mistake was assuming he would simply put up with being subjected to the drudgery that so many extension and open-source developers allow themselves to be subjected to in return for little thanks and ever increasing demands.

The outcome is far from ideal, but the fault, sadly, lies squarely with Mozilla. Real shame.

Perhaps you should read some earlier comments then you wouldn’t say such things?

Hints: Firefox mobile; range of privileges required.

Now that you say that, I wonder if that’s Google’s end game: keep Mozilla on the payroll, disincentivise them from innovating on their product and wait for Firefox to slowly bleed users until nobody is using them and solidify Chrome’s position. And that’s how they take care of adblockers. They already have wide control over Chromium so that would only leave Safari as the last viable browser alternative (a much harder product to attack).

Now, Google can’t stop Firefox from allowing ad blocker extensions, but they can encourage Mozilla to run Firefox in all but abandonware mode, until it dies out.

It’s embarrassing how hard the Mozilla Foundation has fumbled their position and I’m having a hard time attributing their actions simply to incompetence.

Not that I would use the lite version myself, or that I agree with Google’s choice, of course; they killed ad blocker APIs without providing an alternative API, after all. With the code already out there anyway, for the people stuck in their ways still using Google Chrome, they may as well make this version available for Firefox.

Has anyone actually done some quantitative research here? I’ve been using Firefox with uBO for years on Android and of all the apps on my phone, Firefox is not the one that’s chewing through battery.

For example, on kiwi browser typing in a file URL causes it to be searched, but using the “go to URL in clipboard” button (with the file url in your clipboard) works. Except when you randomly run into some weird android file permission issue and the browser just can’t see certain files…

You need to go Settings -> About Firefox -> Click the logo a bunch of times on this page specifically -> Press the back button

You will now see the Install extension from file option.

Of course all of us have our own assessment of trust and danger.

I’m going to fail to go out on a limb and say that those people shouldn’t use this version in order to avoid that, then. I suspect this extension been made available for others, like those you’re replying to here.

It’s my computer. I paid for it and I maintain it. I’ll do whatever I please with it.

> instead of the one that blocks ads properly that’s meant for Firefox?

I have a better question. Why even use Firefox if it refuses to do what I want?

this is it exactly. They should not remove manifest v2, they should make it more explicit that an addon is v2 or v3, and let the end user choose (with the default being v3, and deny v2 addons).

When an untrustworthy addon asks to be a v2 addon, the user can be made more suspicious, but allow addons like ublock to remain working at full power.

Of course, the whole reason google did it is to remove effective adblocking.

It’s a shame Mozilla and Raymond Hill can’t/won’t solve this together. I get that the review he got simply should not have happened for an extension like this (see the Github thread¹) and that he is simply done with bothering, but I worry about how that will affect uBlock Origin’s long-term stability as a project. The whole situation sounds decidedly unhealthy.

1: https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco…

I wouldn’t be surprised if UBO has more users across all browsers than Firefox has users at all, and expect it’s at least within an order of magnitude.

To imply it’s in any danger at all because a minor platform is recalcitrant is ridiculous.

Mozilla wanted in on the $CURRENT_THING of being a “platform” where devs bow and scrape and they claim to be the great custodian of stuff, protector of users. Don’t do this if you can’t be competent at it. Devs _can_ leave, and they will if you fuck up often enough.

This shows that the reviewers may not be competent enough to catch actual malware uploaded to their add-ons site.

I’ve held out for a long time with Mozilla, trusting they thought it’s a useful thing to do when they partner with Facebook to make privacy preserving adtech. This is a big ask of me though. I don’t use it myself but I’m constantly running into limitations on Android and, at work, iOS because you can’t simply do what you want on the devices without all sorts of hoops and fearmongering surrounding having actual access to your own device—the stuff I use my phone for simply doesn’t run without root and one can’t even make a full system backup without. It’s not your device. Learning this about Firefox makes me feel it’s not my browser…

It’s unclear why the author of the article decided that the word ‘mistake’ deserved the scary quote treatment.

That may not be malice, of course. It could just be incompetence (someone running an automated scanner and not verifying that the results are correct), someone trusted with a job they’re not capable of doing, or maybe it’s just Mozilla pretending someone reviewed the addon while using shitty AI like ChatGPT to do all the work.

The email even directly links to resources that are supposedly “minified, concatenated or otherwise machine-generated”. That’s simply not true.

That should be obvious, honestly. The extension is a threat to the reviewer’s paycheck…

Obviously this could all just be incompetence. It’s just a convenient excuse to do some more Mozilla-bashing, (lack of) facts be damned.

Not that any of this excuses the experience Gorhill had, of course.

Maybe if more developers refuse to put up with such bullshit in the name of gatekeeping the extensions store, browser vendors will start acting properly.

> uBlock Origin Lite maker ends Firefox store support, slams Mozilla for hostile reviews

“Review” here means the Mozilla review to allow the extension in the store, not user reviews of the extension.

“How can we make sure this doesn’t happen again”

“Its unacceptable than an obvious mistake happened”

that make corporations so full of random rules, because they think it’s possible to prevent things like this. What matters is the frequency with which they happen, and how gracefully you handle yourself after it happened.

Sure, the individual doing the check might be incompetent, but that doesn’t mean that Raymond needed to be bothered by Mozilla about it – they could have handled it internally instead.

Kinda why it’s a mistake to charge money for a process that is demonstrably incorrect.

In fact it does literally constitute denial-of-service.

When a failure like this occurs, it needs more than an apology, it should have an incident report to show that the failure was understood and steps were taken to prevent future failures.

It appears the issues were found using simple heuristics (e.g they detected string pagead2.googlesyndication.com in a comment) and these detections weren’t then manually reviewed as claimed, which is wasting everybody’s time.

For example, during basically any YouTube copyright or moderation controversy, there is always “manual review” of videos that have obviously been caught in automated systems that in case of actual manual review, would be cleared of problems by any reasonable human.

For high-profile extensions, the impact is higher for both false negatives and false positives. So they should receive more attention.

I do not know anything about Mozilla’s internal procedures regarding add-on approvals. However, for a high profile extension like uBO/uBO Lite… it should either require multiple reviewers, or maybe just an escalation to a senior reviewer or something. You should never be a single human error away from a high impact mistake.

Maybe they do that already, I dunno. But it seems hard for me to believe that multiple people approved uBO Lite’s yoinking.

Extensions are SUCH a crucial part of FF’s appeal. And uBO/uBO is arguably the most important of them all.

They just haven’t used that capability responsibly… Yet.

You address the former when it seems like the issue is the later.

Luckily there are other good options on the iOS front but I wish uBO was one of them.

With uBlock, pop up blocker extensions and Mac Minis connected to my TVs (wireless mouse as remote) I have totally ad free Internet experience; every site there is & from my couch or in my rooms.

The developer has pulled the ‘lite’ version, which is developed mainly for Chrome because Google killed some APIs the full version was using.

The delisted extension, Ublock Origin lite, is a v3 manifest plugin. Apparently it was created to address chrome blocking the v2 extension, but you can continue to use the v2 extension on Firefox

TOR is busted at this point

DNS have been MITMed

Almost all hosts are under the control of a few players who are compelled by their respective states for ubiquitous and server monitoring

Any advertised IP has to have tons of routing info and local pointers so local hosting is just as risky if not more

What are the remaining options for a free (as in speech) internet?

I’m scared to say that Safari comes closest but you’re just in Apple’s walled garden then instead of someone elses’.

Our only hope seems to lie with Ladybird, if that even ends up being good and it seems extensions aren’t on the agenda at least for a while.

If the vast majority of endusers want to live in the moat, I can’t stop them, but at least I’d like an alternative to explore interesting content even if my bank, etc will never support it.

At least banks are regulated enough that I don’t expect their websites to be running full-page video ads anytime soon.

I told our dev teams to not even bother testing because, on our b2b site, Firefox usage was under 0.01%. That is not a typo. I can’t spend dev time on that.

They’re doing the same, and now playing VC, an industry at which they have no apparent expertise.

Every browser alternatives you can reasonably choose today is going to be either Blink (Chromium-based) or Gecko (Firefox-based). And then you have WebKit (Safari).

Ladybird, Flow and Dillo are really the only true alternative browsers in active development other than a few others running on niche operating systems (to which I’m throwing in all of the DOS browsers…).

I like SeaMonkey, it works with a legacy version of ublock. It’s like using firefox back when it didnt suck.

Supporting Servo on its own doesn’t really move the needle a whole lot if it’s missing all of the rest of the bits that make a comprehensive browser.

Firefox is already using Servo (at least in the form of Quantum) under the hood and is still the best option available to prevent more of a complete Blink monoculture than already exists with every other major browser being Blink-based or some reskin/fork of Chromium

Gorhill threw in the towel on uBOL after dealing with repeated bullshit from Mozilla, from the sounds of it. Multiple reviews, multiple people not understanding what the most famous FF extension in the world does, multiple appeals.

Personally, in just the past month, USPS has dropped active email conversations twice; a vendor I use often at work has disabled important web pages and there’s utter silence from their support email; Verizon is deprecating their messaging app in a month and I learned this through reddit; and my bank returned a canned response to an issue I raised two months ago.

I remember a comment on this site from several months ago from someone who worked in customer service who shared a list of things that deprioritize you in a company’s eyes, but it sounded like if you express the least bit of frustration at a bad experience, it goes on your permanent record. Companies, however, are allowed to shaft you however they please.

It doesn’t apply to firefox.

This behavior reminds of Apple. They say it‘s for security (where have I heard that before), yet Chrome doesn’t seem to need such a restriction.

To me it seems like another step in many of Mozilla‘s enshittification.

nevertheless it still is a sucky situation

Get rid of the app and extension stores and let users just install software they find on the internet. Safe and secure software is found on websites dedicated to reviewing them, like the Freshmeat of old, Tucows, etc.

And, while I suppose gorhill could make the case that he’s protesting this egregious process on behalf of the little guy, the fact is, he’s not the little guy as far as Firefox add-ons go. uBO was one of the first (if not the first) 3rd-party addon to be offered as part of Firefox for Android after Mozilla’s reorg started rolling out. He clearly has Mozilla’s attention. I’m not sure what he gains from continued intransigence offers after Mozilla admits their mistake and apologizes.

Why would they bother? Firefox – Android or desktop – runs full/regular uBo just fine.

When you waste people’s time sometimes an apology is not enough for them to want to continue to work with you …

What would he gain from submission to Mozilla? Either way he gains $0 for all the work he’s done to improve the Internet for millions of people.

only because mozilla is gatekeeping that away otherwise.

> (…) and audience (…)

If you take into account small market share of Firefox and even smaller percentage of Firefox user needing uBOL then “audience” isn’t anything important in this case. Perhaps this whole story will increase popularity of uBOL more…

But that does not mean that random errors can be always attributed to malice or financial interests.

You think that’s how Mozilla would kiss up to Google? “Hey, we disabled an ad-blocking extension (although not its more popular and powerful big brother) for half a day! And then we put it back up!”

If I’m Google, that is not really thrilling me or making an impact.

Also, the Google/Mozilla relationship goes both ways. Mozilla is dependent on Google for cash, which I absolutely dislike.

However, Google also needs Mozilla as a hedge against antitrust claims. From an antitrust standpoint the ideal situation for Google is that Google continues to fund Mozilla, and Mozilla continues to allow ad-blocking (looks good to regulators) while continuing to have a tiny market share (so that FF’s uBlock users don’t actually have much of an impact on Google’s advertising biz)

Did I miss anything? Unless you really care about resource usage (on mobile, perhaps), there’s hardly any reason to use uBlock Origin Lite on Firefox. It exists because of Chrome.

Now why does such a version even exist when the “normal” uBlock Origin is available on Firefox, I don’t know. But there’s no question it was a mistake by Mozilla. Mistakes do happen, I’m just explaining why it’s only related to Mozilla’s actions here.

> Mozilla says that it has reviewed the extension and found violations. The following claims were made:

> The extension is not asking for consent for data collecting.

> The extension contains “minified, concatenated or otherwise machine-generated code”.

> There is no privacy policy.

The article points out that all three points are false, and this, or—I’ll go ahead and trust the author of an extension I rely on heavily—what the author says:

> In a follow-up, Hill criticized the “nonsensical and hostile review process” that put added burden on developers. Mozilla disabled all versions of the extension except for the very first one. It still flagged the extension for the very same reasons, but nevertheless decided to keep the outdated version up.

is what makes Mozilla the bad guy here. (It also says Mozilla restored the extension a few days later, which is better than doubling down but, of course, worse than not making the ridiculous error in the first place.)

tl;dr – continue using Firefox and installing uBlock Origin. If you develop Firefox plugins for distribution through their official channel beware the review process I guess.

Maybe the EU should look into this, and also allow the users to “weaken” their security in order to continue using Manifest Version 2.

And because the original non-lite uBlock Origin supports much more complicated rulesets, it should be effective even without code updates… but it still is concerning that the same Mozilla errors that caused Origin Lite to be flagged might extend to time-sensitive updates to the original Origin as well.

I’d do exactly the same thing.

It’s like… I, too, find it burdensome for a review that claims to be “manual” to suddenly flag a file my code has been utilizing for years, and puts the onus on me to refute it’s findings. Not only is it trying to prove a negative, it’s ridiculous that an unchanged file needs re-review for things like “is it minified?”.

As far as I can see, there are errors here and they are ALL on Mozilla’s side. Better training, maybe, but probably just stop lying that a manual review has happened when it hasn’t. And then, when you have whatever semi-automated review is being done flag a thing, then actually have a human review it. And, since that would be a firehose, implement simple standards to filter out spam and publish those standards – and what effect each infraction will have on the review process, including steps for remedy. Make them able to be completed as automatically as possible for the developers, so that you don’t have to manually review, again. If it’s a minification issue, require the devs to re-upload non-minified versions, check it automatically, and then allow the publish.

I’m being simplistic and flip, but a reasonable generalization is just that bureaucracy should be imposed on the implementers of the bureaucracy, not the people who are trying to engage with it.

> After re-reviewing your extension, we have determined that the previous decision was incorrect and based on that determination, we have restored your add-on.

And now there’s the “manifest v3” change, and making people jump through hoops to be on AMO.

This is very sad, almost as much as the internal governance over there.