> But this is not about a high profile plugin. The high profile plugin is "uBlock Origin", and this is about "uBlock Origin Lite", which is a big thing for Chrome, but not for Firefox. Why would anyone want to use uBOL, when they have the option to use uBO?
uBlock Origin requires giving the extension full read and write permissions on every site you visit, which is a huge liability, security-wise.
uBlock Origin Lite uses Manifest V3, which doesn't require providing those permissions to the extension.
Perhaps you trust gorhill with that power, but it's pretty understandable why others might not want to give that power to a third party.
To have a reviewer under your employ that doesn’t know what UBO is or it’s dev, makes me feel pretty confident in siding with gorilla on this, but I hope that he does calm down a bit and put the extension back up.
> To have a reviewer under your employ that doesn’t know what UBO is or it’s dev, makes me feel pretty confident in siding with gorilla on this, but I hope that he does calm down a bit and put the extension back up.
FYI, it's UBlock Origin Lite that is affected here, not UBlock Origin. Same developer account, but a tiny fraction of the installation base. I think I still have an extension that has more users than UBlock Origin Lite did on Firefox (only 5000 installations at the time it was taken down).
To be honest, neither party looks good here. It reflects poorly on Mozilla that they don't have guardrails in place to prevent adverse action on the developer account that publishes their most popular extension. Gorhill's reaction (particularly his most recent comment from an hour ago) comes off as petty and vindictive. Yes, it's his prerogative to spend his unpaid time how he wants, but expressing that sort of aggression and directing it at your users doesn't win over many allies in the long run.
> Perhaps you trust gorhill with that power, but it's pretty understandable why others might not want to give that power to a third party.
I have been using the extension, now called ublock origin, for longer than I have been using the Firefox browser. Mozilla is the third party in this relationship.
In all those years, the extension project's principles were very strict, and the authors never disappointed. Mozilla, meanwhile, is just a constant stream of disappointments.
It's so many things, really. Magic opt-out tracking here and there, ads in new tab windows, nuking almost the entire extension ecosystem on Android for a couple of years just to grind down the user base, etc. It never ends.
You can also communicate with gorhill like a real person. Mozilla press communication is always a psychopathic mess of corporate speak. There is hardly anything in there.
I'm not even sure which project, ublock origin or Firefox, has more users by now.
My loyalties are pretty well sorted at this point.
> It's a lot easier to just accuse Google of acting in bad faith, and Mozilla of being their lapdogs, and ignore any possible evidence to the contrary.
There are two issues at play here.
Manifest V3 is, undeniably, a security improvement over Manifest V2. Providing full read/write access to all websites is a huge security risk, and the fact that we're willing to do it is really a testament to how bad the state of the web is without adblockers.
However, the final standardized version of Manifest V3 limited the size of content filters - essentially, limiting the number of ad sources that you could filter. This severely limits the utility of adblocking extensions.
Mozilla responded to this by promising not to implement the cap in their implemention of Manifest V3 - ie, ignoring that part of the spec and allowing extensions to filter an unlimited number of sources in Firefox. Chrome and other browsers are sticking to the spec, though, including the cap on sources.
I believe UBlock Origin Lite is a downgrade feature-wise from UBlock Origin, but that's because it's targeting both Firefox and non-Firefox browsers. In theory, a Manifest V3 version of UBlock Origin Lite designed for Firefox could provide the same functionality as the Manifest V2 UBlock Origin.
Honestly, I hope someone (whether gorhill or someone else) takes up the mantle and does that, because there's no reason that Firefox users should have to use an adblocker with a less secure design, just because other browsers don't support it.
> Providing full read/write access to all websites is a huge security risk, and the fact that we're willing to do it is really a testament to how bad the state of the web is without adblockers.
That seems to be completely ignoring that extensions aren't just independent self-contained programs. They're intended to extend and modify the capabilities of your user agent to better suit the needs of the user. Trusting the user agent with full read/write access to the data it's fetching is fundamental to the purpose of a user agent. Sure, it's nice when you can sandbox a helper, but it's irresponsible to suggest there's anything wrong or unusual about having the kind of powerful extensions that Google doesn't want you to have.
> Sure, it's nice when you can sandbox a helper, but it's irresponsible to suggest there's anything wrong or unusual about having the kind of powerful extensions that Google doesn't want you to have.
What's inaccurate? Do you really want to claim that Google isn't actively reducing the scope of what browser extensions can do on behalf of end users? Having security as a justification does nothing to erase the fact that they are locking down the browser platform and making some useful categories of extensions impossible.
It's not just the size of content filters. V2 had the ability to run code to block a web request before it was downloaded. V3 only gives you a (size-limited) set of declarative filters. If you want to block anything else, you'll have to do it after it has been downloaded already.
Last I checked google didn't remove the read-only access to network requests in v3, so an extension that wants to track everything can still do that. It just can't block anything with custom code.
uBlock Origin requires giving the extension full read and write permissions on every site you visit, which is a huge liability, security-wise.
uBlock Origin Lite uses Manifest V3, which doesn't require providing those permissions to the extension.
Perhaps you trust gorhill with that power, but it's pretty understandable why others might not want to give that power to a third party.