I manage a medium-sized browser extension at work. We also offer(ed) it on Firefox. But I have spent the past year struggling to get back into Mozilla store after a manual review. As far as I can tell, there are maybe two reviewers that are based in Europe (Romania?). The turn around time is long when I am in the US, and it has been rife with this same kind of "simple mistake" that takes 2 weeks to resolve. "You need a privacy policy"–we already have one. "You are using machine generated and minified code"–no you are looking at the built code, not the included source. "We cannot reproduce your source"-that's because you didn't follow instructions and are in the wrong directory. Very frustrating.
Also had these issues when working on my previous job's extension. The Firefox review process was a real nightmare to work with. Same heavy delays and misunderstandings your mentioned. Eventually the company just stopped updating the Firefox extension as often since usage was low and the review process was such a pain. Unfortunate for me, as the only engineer (maybe employee) at that company that used Firefox.
I had these issues too a few years ago. Now the review time is shorter than Chrome’s and hasn’t been flagged in a few years. However my extension has about 10k users, if that makes any difference.
That's not just mozilla. Google's review team all are in India and they cannot write clear English. It's a mess.
If I understand the timeline correctly here, it seems that gorhill overreacted, and I say that as someone who is usually harshly critical of everything Mozilla has done in the past 5+ years. It's hardly practical for Mozilla to manually review every add-on revision for safety in a timely manner, so they had the choice between automation and delays that would make add-on development a slog; automation though inevitably will cause false positives.
What's the alternative? No pre-release review at all? As a user I would hope that this will not be the case, especially now that we have confirmation that flashy supply chain attacks are being executed in the wild. In fact the review policy protects gorhill himself too, since it makes him a bit less attractive as a target for a rubberhose attack (no point in blackmailing him to put in spyware if the spyware would be caught before release).
I think it’s reasonable to expect that one of Firefox’s most popular extension publishers gets a higher tier of review service. Gorhill (and other top extension devs) are providing real value to Firefox, and have demonstrated good behavior for years.
This doesn’t mean they should get to publish whatever they want, but if a reviewer is about to reject a high profile plugin, they should get a second set of eyes on it. Which would have obviously caught the mistake here.
Feels like another “Firefox is underinvested in developer relations” story, which is surprising given how much they rely on them.
Edit: honestly the idea that gorhill doesn’t have a dedicated rep at Mozilla is baffling to me. According to their stats the extension has 8.4 million users. They should call him on the phone to let him know there’s a problem with his extension.
But this is not about a high profile plugin. The high profile plugin is "uBlock Origin", and this is about "uBlock Origin Lite", which is a big thing for Chrome, but not for Firefox. Why would anyone want to use uBOL, when they have the option to use uBO?
Perhaps Mozilla does have a higher tier of review, but it's for specific plugins, not for specific authors.
From what I remember, there are noticeable efficiency gains when using uBOL on mobile browsers.
But it's the same dev who's been active for over a decade and has a solid reputation. Users rely on these extensions. Removing a popular, well established extension without warning or apparently even making sure it was in violation of said policies to begin with is irresponsible.
And the specific extension in question being a popular ad/tracker blocker while Mozilla has been cozying up to the adtech industry lately and selling access to Firefox user data isn't a good look for Mozilla. Maybe Mozilla is just being grossly mismanaged but this is all getting noticeably suspicious.
> But this is not about a high profile plugin. The high profile plugin is "uBlock Origin", and this is about "uBlock Origin Lite", which is a big thing for Chrome, but not for Firefox. Why would anyone want to use uBOL, when they have the option to use uBO?
uBlock Origin requires giving the extension full read and write permissions on every site you visit, which is a huge liability, security-wise.
uBlock Origin Lite uses Manifest V3, which doesn't require providing those permissions to the extension.
Perhaps you trust gorhill with that power, but it's pretty understandable why others might not want to give that power to a third party.
This is exactly why Apple implemented the precursor to Chrome's v3 manifest in Safari (not to mention the performance implications).
It's a lot easier to just accuse Google of acting in bad faith, and Mozilla of being their lapdogs, and ignore any possible evidence to the contrary.
> It's a lot easier to just accuse Google of acting in bad faith, and Mozilla of being their lapdogs, and ignore any possible evidence to the contrary.
There are two issues at play here.
Manifest V3 is, undeniably, a security improvement over Manifest V2. Providing full read/write access to all websites is a huge security risk, and the fact that we're willing to do it is really a testament to how bad the state of the web is without adblockers.
However, the final standardized version of Manifest V3 limited the size of content filters - essentially, limiting the number of ad sources that you could filter. This severely limits the utility of adblocking extensions.
Mozilla responded to this by promising not to implement the cap in their implemention of Manifest V3 - ie, ignoring that part of the spec and allowing extensions to filter an unlimited number of sources in Firefox. Chrome and other browsers are sticking to the spec, though, including the cap on sources.
I believe UBlock Origin Lite is a downgrade feature-wise from UBlock Origin, but that's because it's targeting both Firefox and non-Firefox browsers. In theory, a Manifest V3 version of UBlock Origin Lite designed for Firefox could provide the same functionality as the Manifest V2 UBlock Origin.
Honestly, I hope someone (whether gorhill or someone else) takes up the mantle and does that, because there's no reason that Firefox users should have to use an adblocker with a less secure design, just because other browsers don't support it.
Yeah they've repeatedly used his name in advertising Firefox Mobile.
I'm not even surprised the addon got flagged. The linked files in the Github issue all had file names insinuating a direct connection to known trackers (which, of course, uBOL is blocking). Whatever automated scanning tool Mozilla uses probably latched on to "oh this is Google Tag Manager" and issued the warning that is normally handed out to addons that do include sketchy scripts like these.
HOWEVER: the email clearly states:
> Your Extension uBlock Origin Lite was manually reviewed by the Mozilla Add-ons team in an assessment performed on our own initiative of content that was submitted to Mozilla Add-ons
Either that is a lie, or the manual reviewer that did the "review" doesn't understand that the automated tool they ran is capable of false positives.
Nothing wrong with automated abuse assessments on a platform like Mozilla's, but don't lie in your communications about it (or hire people who know what they're doing when it comes to blocking addons).
Maybe a less crappy review system at least?
"The burden is that even as a self-hosted extension, it fails to pass review at submission time, which leads to having to wait an arbitrary amount of time (time is an important factor when all the filtering rules are packaged into the extension), and once I finally receive a notification that the review cleared, I have to manually download the extension's file, rename it, then upload it to GitHub, then manually patch the update_url to point to the new version. It took 5 days after I submitted version 2024.9.12.1004 to finally be notified that the version was approved for self-hosting. As of writing, version 2024.9.22.986 has still not been approved."
Doesn't sound like something I'd enjoy as a hobby.
I agree with what you say about the tradeoffs of a review process, but strongly disagree that Raymond Hill overreacted. He's a solo dev working on uBlock as a hobby who doesn't even take donations; he doesn't owe us anything. He gets to decide if the review process frictionless enough for him to contribute his time and energy, and even though he decided it's not in this case, he made his extension open source, so anyone else is free to publish uBlock Origin Lite in his stead.
> manually review every add-on revision for safety in a timely manner
Sure, but uBlock Origin, lite or not, is one of the most important browser add-on, if not the single most important one. This may not justify to give it a pass without looking, but it should certainly be reason enough to jump it in front of the queue and review it manually every time.
Lite is meaningless to 99% of Firefox users. The real deal is available and they aren't force to use the inferior Chrome version.
I think that the alternative is some form of "per review", where the effort of performing reviews is spread out among a volunteer f with reasonable "reputation" management and in which a party can accelerate their own review by contributing to the reviews for others.
Don't remove stuff that are used for some time using only automatic tooling ...
And from the start the review was supposedly: "Your Extension uBlock Origin Lite was manually reviewed by the Mozilla Add-ons team".
Exactly. And this is why we need paid browsers. If the ad-supported/donation-supported browsers like Firefox need to apply low-quality automated solutions to approving/rejecting even their most popular addons, then clearly the business model isn't working.
You jump immediately to money. But less crappy automation in this case is almost certainly a question of configuration and then thoughtfulness on the part of follow up reviewers, not just throwing money at the problem. It feels like you are shoehorning your own agenda in the conversation a bit.
> their most popular addons
It’s the lite version. It’s not popular at all.
...except there is no evidence that paid, manual review works. Closest thing we have is Apple's App Store, which infamously has manual review cycles worse than an automated malware checker: https://www.pcmag.com/news/beware-theres-a-fake-lastpass-app...
This is why you should be happy that you don't pay for a browser.
> No pre-release review at all?
certainly not leaving only the oldest version of the extension up.
Mozilla is not a single person in a basement with a 20 year old second hand computer. They spend hundreds of millions $ per year. uBlock origin has 8+ million installs. The second extension by install count has 4 (four) times less. If if anything to do with gorhill and their extensions is not priority one in their review system, then something is really wrong at Mozilla.
This was for uBlock lite, a much lesser used plugin
> This was for uBlock lite, a much lesser used plugin
Sure, but it's published by the same developer and has existed for a while. It's not a brand new extension under his account, or published on a different developer account.
I've built review systems before, and you typically have safeguards in place to prevent mistakes that impact your biggest users. No matter how you cut it, this isn't a good look for Mozilla.
...and the extension this article is about had about 5000 (five thousand) installs before being taken down. That doesn't really scream "priority" to me.
It may be true, but your point of view isn't the sole possible. Many people have to use more than one browser and for them, the Google decision (effectively forcing the creation of uBOL) was really painful so Hill's new product is of big value. Also, there are people who don't know anything about uBO since they never used Firefox but they probably will start to use uBOL as other blockers for Chromium-based browsers are incomparable to it. Thus 5k downloads of uBOL are no measure of its importance.
It's very annoying you have to submit your extension to gatekeepers to even distribute them to normal users. As gorhill said on GitHub it took days for a self-hosted version to be approved - that's unacceptable. Imagine you would need approval from Microsoft to distribute software. Not even Android is this closed. Enforcing signatures and removing XUL were the worst things Mozilla has ever done. And yes, Google does the same and it's even worse there but this it to be expected from them, but not from Mozilla.
> removing XUL
Nah, XUL had to go. The other stuff wasn't really related. It was a more "if we are going to break most extensions we may as well use this time to push everything else we want". If anything XUL is a scapegoat.
I know because I maintained VimFx for a while after the XUL removal. It was difficult to keep up with internal APIs that are changing, but I can't blame them, they need to develop their product. The thing that really made me give up on maintaining VimFx was the signing enforcement. They just keep tightening the screws so that I couldn't even run "my own" code with any reasonable UX.
What I would have like to have seen:
1. Provide WebExtensions as the recommended way to do things with some compatibility and deprecation guarantees.
2. Stop caring about compatibility of other APIs.
3. Still allow outside "full access" extensions that use those internal APIs. You can give warnings in the store "this extensions uses unsupported APIs and may break at any time and steal all of your personal data" and make the install button bright red but still allow it.
4. Keep supporting self-distributed extensions with developer managed signing keys and update URLs.
Since there are no compatibility guarantees on these APIs it wouldn't have been much extra work. Just a bit of UX work to add scary warnings and maintenance of the non-store update code.
On desktop Firefox, you can download an extension from anywhere and install it. All they're gatekeeping is their own repository, which I think most of us would like them to do.
I think mobile requires using a nightly build to install extensions from outside Mozilla's repository, and that suggests their thinking is becoming contaminated by the rest of the mobile ecosystem.
You can no longer package extensions yourself and if you try using "Load add on from file" you get that extension loaded but it's gone after a restart. All extensions have to be signed first to be permanent and Mozilla denied to fix that on their bug tracker.
Signing is such a low bar to pass I agree that not offering that as an option is reasonable. It takes seconds to do.
No, the normal version blocks (at least permanent) installs. You need the developer version to install unsigned extensions.
I see. The extension I installed to test that actually is signed, though it's not in AMO.
I don't like this. I know there have been issues with malicious extensions, so it makes sense to me that installing unsigned extensions is turned off by default, but requiring developer builds is a step too far.
Are you certain extensions can be downloaded and installed from anywhere? Firefox's documentation[1] states "Extensions and themes need to be signed by Mozilla before they can be installed in release and beta versions of Firefox." If UBlock Lite was rejected through Mozilla's signing API, they'd have no ability to create an XPI that can be installed by release/beta version of Firefox.
[1]: https://extensionworkshop.com/documentation/publish/signing-...
> The organization issued an apology for the "mistake" and recommended to Hill to reach out whenever he has questions or concerns about a review.
Before taking drastic action like pulling addons from the store, Mozilla should reach out if they have questions or concerns about a review.
It appears all of the companies that are gatekeepers to apps, extensions and similar user-generated stuff are really quick to overreact and unless you are a high-profile person, have a lot of followers or a really popular app or an extension, good luck resolving it in a timely manner.
Why does this extension even exist on AMO? The article says it's the "Lite/Manifest v3 version" - why would you ever install the inferior edition meant for legacy browsers, instead of the one that blocks ads properly that's meant for Firefox?
For the few good reasons Google had for restricting addon manifests: performance and security. Declarative domain lists are easier to cache and lead to fewer (unnecessary) addon activations. Fewer permissions means the impact of a malware-infected version hitting the addon store in the future is a lot lower. uBlock's rule engine is incredibly powerful, to the point where a custom ruleset can inject code into any website. That applies to custom rulesets, but also to the built-in ones that may or may not get their accounts/hosting hacked, or bought out in the future.
Not that I would use the lite version myself, or that I agree with Google's choice, of course; they killed ad blocker APIs without providing an alternative API, after all. With the code already out there anyway, for the people stuck in their ways still using Google Chrome, they may as well make this version available for Firefox.
The other good reason that Google has is that it puts them entirely in control of the lists. If they don't want Chrome to block ads on Google properties they can opt them out of the block lists.
manifest v3 is actually not a bad idea at all. it's more efficient, more private.
Because it's lighter on power usage, and that matters for firefox on android.
And because it can block ads without infinite permission to read and change every site you visit.
But now it's not even possible to use the add-on in Firefox for Android, as only add-ons from AMO can be installed.
I was curious if trying to load it via file:///storage/emulated/0/Download/... would work (as my recollection is that .xpi installation is content-type: sensitive) but insult-to-injury is that FF Nightly for Android searches for the string "file:///storage...", so they seemingly have nuked even the file: protocol handler for Android. Good times over there at Mozilla
Pretty sure file:// is very broken in different ways on every android browser.
For example, on kiwi browser typing in a file URL causes it to be searched, but using the "go to URL in clipboard" button (with the file url in your clipboard) works. Except when you randomly run into some weird android file permission issue and the browser just can't see certain files...
It can run with way less permission as opposed to UBO.
I don’t think people care about giving permissions to one of the most popular extensions ever. The advantages of giving that extension full access are quite clear and the dangers minimal.
> I don’t think people care about giving permissions to one of the most popular extensions ever.
I'm going to fail to go out on a limb and say that those people shouldn't use this version in order to avoid that, then. I suspect this extension been made available for others, like those you're replying to here.
There's nothing more frustrating than being gatekept by incompetent, lying idiots. Sad day for users but the right choice by Hill.
Mozilla wanted in on the $CURRENT_THING of being a "platform" where devs bow and scrape and they claim to be the great custodian of stuff, protector of users. Don't do this if you can't be competent at it. Devs _can_ leave, and they will if you fuck up often enough.
Automated process have so far managed to destroy the experience of the world wide web as a whole for developers and users both. And AI based tools seem like gas to this fire. Seems very soon web will die out of it's quality and only bots will remain.
The sooner people realize Mozilla is not your friend, the better. They’ve been compromised by the Google money. Want an alternative to Chromium? Go support Servo or Ladybird, Firefox can’t be saved.
Blink is to Servo what Chromium is to Firefox.
Supporting Servo on its own doesn't really move the needle a whole lot if it's missing all of the rest of the bits that make a comprehensive browser.
Firefox is already using Servo (at least in the form of Quantum) under the hood and is still the best option available to prevent more of a complete Blink monoculture than already exists with every other major browser being Blink-based or some reskin/fork of Chromium
Neither of those work with ublock. I'd sooner disconnect from the net than not use ublock. (Same reason i don't use qutebrowser.)
I like SeaMonkey, it works with a legacy version of ublock. It's like using firefox back when it didnt suck.
Seems a bit extremist. I get being mad at microsoft for trying to charge for their software (gasp). I also get being mad at Chrome for trying to monetize their software (gasp) with ads. But now if you somehow get upset at Mozilla, it's more likely that you are the problem.
> The organization issued an apology for the "mistake" and recommended to Hill to reach out whenever he has questions or concerns about a review.
It's unclear why the author of the article decided that the word 'mistake' deserved the scary quote treatment.
Because there was a privacy policy it's hard to understand how that could be a mistake. The insinuation is the reviewer was not acting in hood faith.
Which brings us to: It's unclear why the author of the article decided that the reviewer was not acting in good faith.
The reviewer asserts that the addon transmits data. It does not.
That may not be malice, of course. It could just be incompetence (someone running an automated scanner and not verifying that the results are correct), someone trusted with a job they're not capable of doing, or maybe it's just Mozilla pretending someone reviewed the addon while using shitty AI like ChatGPT to do all the work.
The email even directly links to resources that are supposedly "minified, concatenated or otherwise machine-generated". That's simply not true.
Maybe it's the fact that 80+% of Mozilla's revenue comes directly from payment by Google who are extremely hostile to ad blockers (and UBO in particular) at the moment.
That should be obvious, honestly. The extension is a threat to the reviewer's paycheck...
UBO isn't even the extension that was scrutinized, and besides how do you even know that the reviewer (if they are a human which seems open to question) is a Mozilla employee rather than a volunteer, and that they were not acting out of sheer incompetence?
Pretty clear: because it's a quote form the Mozilla's response
"We apologize for the mistake and encourage"
This again shows the problem of automatic reviews. There should be a person name in every review that was responsible for it, currently it's blamed on our automated system. If the law would require someones name on it then I'm pretty sure the review process would be much better and the explanation would include more than an apology.
Doesn't this behavior from Mozilla staff indicate that using Firefox extensions at all is a security issue?
This shows that the reviewers may not be competent enough to catch actual malware uploaded to their add-ons site.
[dupe] More discussion here: https://news.ycombinator.com/item?id=41707418
It's a blog post about something that happened a month ago and boils down to "some (obvious) mistake happened during review". Not much to see here.
That obvious mistakes can happen is itself a problem.
Have you never been at work being forced to do something because you need money but you just are not feeling it that day? Obvious mistakes will ALWAYS happen, regardless of rules, regulations, human involvement, process, etc. It's thoughts like this
"How can we make sure this doesn't happen again"
"Its unacceptable than an obvious mistake happened"
that make corporations so full of random rules, because they think it's possible to prevent things like this. What matters is the frequency with which they happen, and how gracefully you handle yourself after it happened.
"But the bias-variance tradeoff doesn't really apply to us" - every bureaucracy ever.
Obvious mistakes are an issue with most software stores. Less a matter of attention being paid, and more a consequence of scale: https://www.pcmag.com/news/beware-theres-a-fake-lastpass-app...
latest message from moz on the GH issue is from the day back
If Raymond Hill endorsed a Firefox fork, I would switch to it immediately.
Yes, uBlock should incorporate Firefox, rather than Firefox incorporating adblocking.
Tangentially has anyone else noticed chrome extensions management page now saying unlock origin will soon be disables and to please find a replacement?
Yep. Fuck Google, I won’t use a desktop browser without it.
Those don’t seem like unreasonable asks on Moz side
Curious why Firefox doesn’t just start incorporating uBlock into the browser? Make it a standard feature that comes pre-installed… but maybe not automatically enabled? Thoughts?
Mozilla has been trying to become an ad company for a while now. A built-in ad blocker would mess that up for them.
Have they? I haven't seen this. They have a lot of tracking protection built in, but no ad blocker. I'm not doubting you, I just haven't seen any action or posts on their part about this.
honestly we arent missing much by a manifest v3 ublock origin lite extension going away on firefox because firefox is still compatible with v2 so realistically we wouldnt have any use for it.
nevertheless it still is a sucky situation
Nkl Jhhhhuivh
True, I never thought about it that way.
Mozilla is an absolute joke of an organization, and it's tragic that they are still the primary alternative to Google having a total monopoly on browsers. I suppose you shouldn't expect much from a company that is just there to maintain a facade to fend off regulators.
We're at a really dangerous point with browsers at the moment where there's really no consumer-friendly option available.
I'm scared to say that Safari comes closest but you're just in Apple's walled garden then instead of someone elses'.
Our only hope seems to lie with Ladybird, if that even ends up being good and it seems extensions aren't on the agenda at least for a while.
The issue is bigger than that. The web standards process relies on two independent implementations for something to become a web standard. This just about works when there are three big players, but if Mozilla drops out, then it’s just Google and Apple arguing. It’s bad enough that two out of the three rendering engines that participate in the web standards process are funded by Google. We really need another independent rendering engine to step up. Hopefully Ladybird will get some traction.
I'd say we're past that point. Less than 5% of global users (and going down) and NO mobile presence at all. The newer generation of devs and power users won't even care.
You're absolutely right, but I'm trying to retain a shred of optimism, especially with a high amount of focus and interest on this area lately with projects like Ladybird and even new Gopher and Gemini clients.
If the vast majority of endusers want to live in the moat, I can't stop them, but at least I'd like an alternative to explore interesting content even if my bank, etc will never support it.
At least banks are regulated enough that I don't expect their websites to be running full-page video ads anytime soon.
It's past time to give up on Mozilla.
I told our dev teams to not even bother testing because, on our b2b site, Firefox usage was under 0.01%. That is not a typo. I can't spend dev time on that.
They're doing the same, and now playing VC, an industry at which they have no apparent expertise.
So Mozilla goofed, apologised of their own accord and corrected the mistake? And in response this dev is throwing his toys out of the pram? Do I read this right?
I can see how having to jump pointless bureaucratic hoops in a volunteer project can cause throwing out toys.
Yeah, it's kind of wild to see the general reaction to this being "the developer is being unreasonable".
It's like... I, too, find it burdensome for a review that claims to be "manual" to suddenly flag a file my code has been utilizing for years, and puts the onus on me to refute it's findings. Not only is it trying to prove a negative, it's ridiculous that an unchanged file needs re-review for things like "is it minified?".
As far as I can see, there are errors here and they are ALL on Mozilla's side. Better training, maybe, but probably just stop lying that a manual review has happened when it hasn't. And then, when you have whatever semi-automated review is being done flag a thing, then actually have a human review it. And, since that would be a firehose, implement simple standards to filter out spam and publish those standards - and what effect each infraction will have on the review process, including steps for remedy. Make them able to be completed as automatically as possible for the developers, so that you don't have to manually review, again. If it's a minification issue, require the devs to re-upload non-minified versions, check it automatically, and then allow the publish.
I'm being simplistic and flip, but a reasonable generalization is just that bureaucracy should be imposed on the implementers of the bureaucracy, not the people who are trying to engage with it.
What pointless hoops? The extension was restored.
After pointless hoops. And the process seems to involve pointless hoops even when the review is not rejected.
Again, what pointless hoops?
> After re-reviewing your extension, we have determined that the previous decision was incorrect and based on that determination, we have restored your add-on.
When Mozilla is being gifted enormous amounts of free labor, they should be more careful with the donor.
Fair play. uBO is THE killer extension, and apparently it never occured to Mozilla that if they were going to insist on using some hideous, Google style, machine led review process for extensions, perhaps they should at least make a carve out for one of the single most important extensions that exists.
I can totally understand gorhill becoming completely insensed by the whole thing and refusing to play ball when Mozilla "realises their mistake". Their mistake was assuming he would simply put up with being subjected to the drudgery that so many extension and open-source developers allow themselves to be subjected to in return for little thanks and ever increasing demands.
The outcome is far from ideal, but the fault, sadly, lies squarely with Mozilla. Real shame.
uBlock Origin is likely the primary reason Firefox has any amount of meaningful browser market share today. If Firefox didn't support it then I would be using another browser. Seeing as Mozilla has been struggling to get anything right, they should be kissing gorhill's behind.
This is about uBOL. I haven't seen much delays for the main extension. It is always more up to date on Firefox compared to Chrome/Edge.
OK? So you support Mozilla's actions or something? What is the purpose of your comment?
The purpose of their comment is to correct your statement that:
> perhaps they should at least make a carve out for one of the single most important extensions that exists.
uBOL is not an important extension on Firefox.
>uBOL is not an important extension on Firefox.
Perhaps you should read some earlier comments then you wouldn't say such things?
Hints: Firefox mobile; range of privileges required.
I did, it does not change what I said. uBO works perfectly fine on Firefox Mobile and doesn't use much battery. People can prefer uBOL, but that doesn't make it important to the ecosystem.
Oof. I get gorhill is pissed about the whole thing, but, this feels like cutting off your nose to spite your face. It's going to be much trickier for people to get uBO Lite onto their Firefox for Android installations now, or even if they can, they might just not bother.
And, while I suppose gorhill could make the case that he's protesting this egregious process on behalf of the little guy, the fact is, he's not the little guy as far as Firefox add-ons go. uBO was one of the first (if not the first) 3rd-party addon to be offered as part of Firefox for Android after Mozilla's reorg started rolling out. He clearly has Mozilla's attention. I'm not sure what he gains from continued intransigence offers after Mozilla admits their mistake and apologizes.
> It's going to be much trickier for people to get uBO Lite onto their Firefox for Android installations now, or even if they can, they might just not bother.
Why would they bother? Firefox - Android or desktop - runs full/regular uBo just fine.
> Why would they bother? Firefox - Android or desktop - runs full/regular uBo just fine.
gorhill himself stated[0]:
> This is unfortunate because despite uBOL being more limited than uBO, there were people who preferred the Lite approach of uBOL, which was designed from the ground up to be an efficient suspendable extension, thus a good match for Firefox for Android.
[0] https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco...
He gains by not having to interact with them for UBOL.
When you waste people's time sometimes an apology is not enough for them to want to continue to work with you ...
An outlook like that will really limit who you work with in the future. I don't know anyone, corp or otherwise, that doesn't mess up from time to time. What matters is the acknowledgement of the mistake and taking steps to rectify it.
IMO, as much as I highly respect his products, the dev pulled a hissy fit over a mistake.
So, half of what you say matters seems to be missing.
They restored his extension (until he removed it again), what more do the Mozilla-haters want?
An apology, a post mortem, and lessons learned and implemented so it doesn’t happen again.
> I'm not sure what he gains from continued intransigence offers after Mozilla admits their mistake and apologizes.
What would he gain from submission to Mozilla? Either way he gains $0 for all the work he's done to improve the Internet for millions of people.
He gains Mozilla's distribution model and audience, which allows users of Firefox to download add-ons from their browser's UI and updates automatically, rather than having to manually pull an extension file from a Github page for each new release and install it.
That's a long-winded way to say $0
You gain $0 for uploading your Linux package to yum/apt/dnf as well, but you recognize that there's value in being able to install such packages easily through a well-curated repository, no?
Time and effort are usually considered to be worth some amount of money.
I agree with one exception:
> [...] and audience [...]
If you take into account small market share of Firefox and even smaller percentage of Firefox user needing uBOL then "audience" isn't anything important in this case. Perhaps this whole story will increase popularity of uBOL more...
> allows users of Firefox to download add-ons from their browser's UI and updates automatically, rather than having to manually pull an extension file from a Github page for each new release and install it.
only because mozilla is gatekeeping that away otherwise.
For extensions which have full access to all websites, I appreciate that. That is one of the main reasons for ManifestV3 because not all extensions can be reviewed.
Another Mozilla classic...
From the article:
> uBlock Origin Lite is a Manifest V3-compatible version of the content blocker. It is less powerful, but since Google is disabling Manifest V2 support in Chrome, it is what will remain from uBlock Origin for Chromium-based browsers.
> Does it affect uBlock Origin? The core extension remains available for Firefox. Unlike Google Chrome, Firefox will continue to support Manifest V2 extensions. Mozilla has not flagged this extensions or disabled it
But somehow it is Mozilla who is the bad guy not Chromium-based browsers.
This story is about Mozilla removing the Lite/Manifest v3 version from Firefox's extensions, this has nothing to with Chromium.
Now why does such a version even exist when the "normal" uBlock Origin is available on Firefox, I don't know. But there's no question it was a mistake by Mozilla. Mistakes do happen, I'm just explaining why it's only related to Mozilla's actions here.
The article seemed to highlight the inconsistencies or errors in the plugin review process which puts undue burden on developers trying to add value to the ecosystem. It was not about the differences in Manifest v2/3 and the issues with Chrome, though this was mentioned and is the reason why the 'Lite' version of uBlock Origin exists in the first place.
tl;dr - continue using Firefox and installing uBlock Origin. If you develop Firefox plugins for distribution through their official channel beware the review process I guess.
I mean, those are _completely_ separate issues? People can be mad at Google/Chrome about Manifest V3, whilst also being mad at Mozilla/Firefox for randomly flagging UBOL with bullshit reasons.
> But somehow it is Mozilla who is the bad guy
Sounds like it, yeah.
> not Chromium-based browsers.
Nobody said that.
To be clear, the complaint is not about Manifest V2 vs. Manifest V3 (which is of course its own can of nonsense), but about Mozilla's review:
> Mozilla says that it has reviewed the extension and found violations. The following claims were made:
> The extension is not asking for consent for data collecting.
> The extension contains "minified, concatenated or otherwise machine-generated code".
> There is no privacy policy.
The article points out that all three points are false, and this, or—I'll go ahead and trust the author of an extension I rely on heavily—what the author says:
> In a follow-up, Hill criticized the "nonsensical and hostile review process" that put added burden on developers. Mozilla disabled all versions of the extension except for the very first one. It still flagged the extension for the very same reasons, but nevertheless decided to keep the outdated version up.
is what makes Mozilla the bad guy here. (It also says Mozilla restored the extension a few days later, which is better than doubling down but, of course, worse than not making the ridiculous error in the first place.)
Mozilla just can't help themselves, can they? Seriously, once Google is broken up and their donations to Mozilla stop, I won't be sad when Mozilla is forced to shut down.
These "lapses in judgement" are driven by Mozilla's brass representing the desires of their real masters. A post-Google Mozilla may be smaller, but I bet Firefox would be better and more popular.
I wish they'd get smaller first, build up a fund so they could literally just invest in the stock market and run indefinitely off the returns, and only then go Google-free. That would be a more permanent solution.
That sounds like it'd make less money for the CEO, why would they be interested in that?
Mozilla no longer does what is good for Firefox.
I hope so, but I wouldn't count on it.
First came NetScape and all was good. Then came Internet Explorer, but apparently bundling a web browser with an operating system was bad, ok. Then came Google's Chrome trying to profit from a web browser with ads, and that was deemed 'bad' again. Then it was not sufficient for the browser manufacturers to push no ads, but the consumer demands that the browser block ads from websites. Now the browser developer and the third party ad blocker have some fight over who gets to serve clients that not only don't pay, but don't want advertisers to foot the bill either.
I have no sympathy for users that don't want to pay for software, or for developers that cater to that demographic. Enjoy fighting for crumbs.
Sent from Microsoft Edge.
Nobody is forcing you to put your website on the open internet, you're doing it because you're making a value judgement about how much money you can make by not closing or paywalling your system. Nobody cares what your business model is (that's your business and your decision barring illegality), and if it's not working for you, you should change it or shut down. Why should anyone have any sympathy for you?