I think this is bad for the general population. Chrome is already planning to disable uBlock origin and many folks I know were ready to move browsers to Firefox to keep uBlock functionality. Now if uBlock is removed from Firefox extension store as well, there is no clear path to execute it from Github on managed machines. Sure if you are a developer and have admin rights, you can get it to work on Firefox, but a lot of people don't.
Per the article, uBlock Origin is still in the Firefox store at https://addons.mozilla.org/en-US/firefox/addon/ublock-origin... ; it's the lighter MV3-based uBlock Origin Lite that was removed. So the general population can continue to use the full Origin.
And because the original non-lite uBlock Origin supports much more complicated rulesets, it should be effective even without code updates... but it still is concerning that the same Mozilla errors that caused Origin Lite to be flagged might extend to time-sensitive updates to the original Origin as well.
>The last message from the developer in a now-closed GitHub issue shows an email from Mozilla admitting its fault and apologizing for the mistake. However, Raymond still pulled the extension from the Mozilla Add-ons Store, which means you can no longer find it on addons.mozilla.org.
This seems pretty harsh. Mozilla made a mistake, Mozilla apologized, Mozilla fixed the mistake (maybe even improved their processes), and the author still pulls their choose and criticizes Mozilla. On my opinion either author took this a bit up personally, or cares about improving the review process and wants to make a strong point (with some hurt done for their project visibility).
Remember why uBlock Origin exists in the first place: Raymond Hill was fed up with the chore of all the administrative crap around uBlock¹. They wanted it to be a hobby and it started feeling like a job.
So it’s predictable they’d get fed up with that Mozilla review process and call it quits too.
¹ Which led them to hand the project to an unscrupulous rando that immediately tried to monetise it, leading Raymond to hate the outcome and having to decry his own previous project and ending up essentially where it all started but with a bunch of extra work in the middle.
The author is a volunteer and the software is a labor of love: of course it's personal. Such projects thrive when the author feels like they are giving a valuable gift to a community which is receiving and appreciating it. Being required to submit your creation through an impersonal "review" process which rejects you in such a way that it's obvious nobody cared enough to even look is not just a buzzkill: it's an insult.
> when the author feels like they are giving a valuable gift to a community which is receiving and appreciating it.
Who is the "community" in this case? Mozilla? Or is it us users? If the former then fine, but if the latter, then who is being hurt by this, and how does Mozilla being annoying reflect ingratitude in the community?
Who is being hurt is Raymond Hill (their sanity / mental stability / desire to work on this popular extension); Firefox users who preferred the Lite version; Firefox users on Android; Everyone who would’ve been recommended this extension and now won’t (see other comments in this thread); Mozilla (taking yet another hit to their reputation) and by extension the open web as more reasons to abandon Firefox lead to less browser diversity.
Feels like they were just waiting for a reason to pull out – likely feels its a hassle to upload and have it review and just want everyone to trust them and keep it simple
And I guess some people would claim that since its an open source addon no one can feel entitled to anything else
I can’t fault gorhill for not wanting to play the “give large rich organization infinite second chances” game. Sometimes enough is enough even if you think you’d act differently in his shoes.
> Mozilla apologized
No they didn’t. Now I’m not here to play apology police or anything. But that’s just a perfunctory customer service voice statement which happened to include the word “apologize”. And that’s fine. Nobody expects more. We can acknowledge it for what it is tho.
"Statistically your extensions are one of the most used on Firefox. We will handle all related matters with higher priority and care in the future, and are deeply sorry about this."
Gorhill's full uBlock Origin might be the only remaining selling point for Firefox.
With the outrageous sum of money that the Mozilla top executive was recently taking for themself, they could've instead staffed an entire team of first-rate people, with the sole mission of doing whatever Mr. Gorhill needed.
I really hope Raymond Hill won't do the same for uBlock Origin (the manifest v2 version). I'm not too comfortable recommending others to install a self-hosted extension.
It's a shame Mozilla and Raymond Hill can't/won't solve this together. I get that the review he got simply should not have happened for an extension like this (see the Github thread¹) and that he is simply done with bothering, but I worry about how that will affect uBlock Origin's long-term stability as a project. The whole situation sounds decidedly unhealthy.
Latest update from the link you provided: The Mozilla review team acknowledged their error and rectified it. Hopefully that allows it to continue existing.
Hill seems intent on self-hosting, so I mean it will exist, but will be a lot harder to discover and as GP mentions, probably harder to convince people to install.
Absolutely. But: I don't think anybody is saying that high profile extensions should receive less scrutiny?
For high-profile extensions, the impact is higher for both false negatives and false positives. So they should receive more attention.
I do not know anything about Mozilla's internal procedures regarding add-on approvals. However, for a high profile extension like uBO/uBO Lite... it should either require multiple reviewers, or maybe just an escalation to a senior reviewer or something. You should never be a single human error away from a high impact mistake.
Maybe they do that already, I dunno. But it seems hard for me to believe that multiple people approved uBO Lite's yoinking.
Extensions are SUCH a crucial part of FF's appeal. And uBO/uBO is arguably the most important of them all.
Mozilla is definitely doing the right thing by reviewing the extensions, but the issue here is that were wrong, they found issues that didn't exist (such as claiming it contained obfuscated code and collected private data).
It appears the issues were found using simple heuristics (e.g they detected string pagead2.googlesyndication.com in a comment) and these detections weren't then manually reviewed as claimed, which is wasting everybody's time.
Why does lying about manual review seem so commonplace?
For example, during basically any YouTube copyright or moderation controversy, there is always "manual review" of videos that have obviously been caught in automated systems that in case of actual manual review, would be cleared of problems by any reasonable human.
There is a difference between questioning if a review process should exist for the official addon index and questioning if the implementation is any good.
You address the former when it seems like the issue is the later.
Mozilla has the capability to handle compromised addons; this whole mess happened because they wiped out every version of uBOL except for the earliest one.
They just haven't used that capability responsibly... Yet.
It seems to me that any platform with a review gateway should treat failing a review erroneously as a critical failure.
In fact it does literally constitute denial-of-service.
When a failure like this occurs, it needs more than an apology, it should have an incident report to show that the failure was understood and steps were taken to prevent future failures.
You can continue to use Ublock Origin, which uses the v2 manifest.
The delisted extension, Ublock Origin lite, is a v3 manifest plugin. Apparently it was created to address chrome blocking the v2 extension, but you can continue to use the v2 extension on Firefox
If you would group those woes, by type of addon, i guess there is "irrelevant " and "a world of pain for those threatening google add revenues " .. the hand that feeds.
It‘s not only that, Firefox also forces you to use the Developer edition (which updates about daily, FORCING you to restart it) if you want to install extensions that aren’t signed by Mozilla (e.g. your own).
This behavior reminds of Apple. They say it‘s for security (where have I heard that before), yet Chrome doesn’t seem to need such a restriction.
To me it seems like another step in many of Mozilla‘s enshittification.
I am pretty sure Chrome has also added the forced restart for a bit now. It might not show up right after the update, but it doesn't take long. I don't remember if it was straighforward, or just crashed new tabs.
Mozilla decided at some point to kill extensions - whether following Google Chrome or of its own volition. It took an axe to its ecosystem by disablign the loading of anything external other than WebExtensions - and note that it's just an artificial disabling, as internally, Firefox is still basically some bundled "extensions" over a C++ core.
And now there's the "manifest v3" change, and making people jump through hoops to be on AMO.
This is very sad, almost as much as the internal governance over there.
But that does not mean that random errors can be always attributed to malice or financial interests.
You think that's how Mozilla would kiss up to Google? "Hey, we disabled an ad-blocking extension (although not its more popular and powerful big brother) for half a day! And then we put it back up!"
If I'm Google, that is not really thrilling me or making an impact.
Also, the Google/Mozilla relationship goes both ways. Mozilla is dependent on Google for cash, which I absolutely dislike.
However, Google also needs Mozilla as a hedge against antitrust claims. From an antitrust standpoint the ideal situation for Google is that Google continues to fund Mozilla, and Mozilla continues to allow ad-blocking (looks good to regulators) while continuing to have a tiny market share (so that FF's uBlock users don't actually have much of an impact on Google's advertising biz)
> They had no idea that uBlock Lite was the most popular ad blocker for Firefox.
Did I miss anything? Unless you really care about resource usage (on mobile, perhaps), there's hardly any reason to use uBlock Origin Lite on Firefox. It exists because of Chrome.
I think this is bad for the general population. Chrome is already planning to disable uBlock origin and many folks I know were ready to move browsers to Firefox to keep uBlock functionality. Now if uBlock is removed from Firefox extension store as well, there is no clear path to execute it from Github on managed machines. Sure if you are a developer and have admin rights, you can get it to work on Firefox, but a lot of people don't.
Per the article, uBlock Origin is still in the Firefox store at https://addons.mozilla.org/en-US/firefox/addon/ublock-origin... ; it's the lighter MV3-based uBlock Origin Lite that was removed. So the general population can continue to use the full Origin.
And because the original non-lite uBlock Origin supports much more complicated rulesets, it should be effective even without code updates... but it still is concerning that the same Mozilla errors that caused Origin Lite to be flagged might extend to time-sensitive updates to the original Origin as well.
>The last message from the developer in a now-closed GitHub issue shows an email from Mozilla admitting its fault and apologizing for the mistake. However, Raymond still pulled the extension from the Mozilla Add-ons Store, which means you can no longer find it on addons.mozilla.org.
This seems pretty harsh. Mozilla made a mistake, Mozilla apologized, Mozilla fixed the mistake (maybe even improved their processes), and the author still pulls their choose and criticizes Mozilla. On my opinion either author took this a bit up personally, or cares about improving the review process and wants to make a strong point (with some hurt done for their project visibility).
Remember why uBlock Origin exists in the first place: Raymond Hill was fed up with the chore of all the administrative crap around uBlock¹. They wanted it to be a hobby and it started feeling like a job.
https://github.com/gorhill/uBlock/issues/38#issuecomment-918...
So it’s predictable they’d get fed up with that Mozilla review process and call it quits too.
¹ Which led them to hand the project to an unscrupulous rando that immediately tried to monetise it, leading Raymond to hate the outcome and having to decry his own previous project and ending up essentially where it all started but with a bunch of extra work in the middle.
The author is a volunteer and the software is a labor of love: of course it's personal. Such projects thrive when the author feels like they are giving a valuable gift to a community which is receiving and appreciating it. Being required to submit your creation through an impersonal "review" process which rejects you in such a way that it's obvious nobody cared enough to even look is not just a buzzkill: it's an insult.
I would walk away, too.
> when the author feels like they are giving a valuable gift to a community which is receiving and appreciating it.
Who is the "community" in this case? Mozilla? Or is it us users? If the former then fine, but if the latter, then who is being hurt by this, and how does Mozilla being annoying reflect ingratitude in the community?
> who is being hurt by this
See Raymond’s comment five days ago:
https://github.com/uBlockOrigin/uBOL-home/issues/197
Who is being hurt is Raymond Hill (their sanity / mental stability / desire to work on this popular extension); Firefox users who preferred the Lite version; Firefox users on Android; Everyone who would’ve been recommended this extension and now won’t (see other comments in this thread); Mozilla (taking yet another hit to their reputation) and by extension the open web as more reasons to abandon Firefox lead to less browser diversity.
Judging from his replies, this is not the first time he had problems with the review system
Feels like they were just waiting for a reason to pull out – likely feels its a hassle to upload and have it review and just want everyone to trust them and keep it simple
And I guess some people would claim that since its an open source addon no one can feel entitled to anything else
I can’t fault gorhill for not wanting to play the “give large rich organization infinite second chances” game. Sometimes enough is enough even if you think you’d act differently in his shoes.
> Mozilla apologized
No they didn’t. Now I’m not here to play apology police or anything. But that’s just a perfunctory customer service voice statement which happened to include the word “apologize”. And that’s fine. Nobody expects more. We can acknowledge it for what it is tho.
What could the email have said that would have made you believe they had apologised? If the literal string “we apologize” isn’t it, what is?
"Statistically your extensions are one of the most used on Firefox. We will handle all related matters with higher priority and care in the future, and are deeply sorry about this."
Ego.
Gorhill's full uBlock Origin might be the only remaining selling point for Firefox.
With the outrageous sum of money that the Mozilla top executive was recently taking for themself, they could've instead staffed an entire team of first-rate people, with the sole mission of doing whatever Mr. Gorhill needed.
I really hope Raymond Hill won't do the same for uBlock Origin (the manifest v2 version). I'm not too comfortable recommending others to install a self-hosted extension.
It's a shame Mozilla and Raymond Hill can't/won't solve this together. I get that the review he got simply should not have happened for an extension like this (see the Github thread¹) and that he is simply done with bothering, but I worry about how that will affect uBlock Origin's long-term stability as a project. The whole situation sounds decidedly unhealthy.
1: https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco...
Latest update from the link you provided: The Mozilla review team acknowledged their error and rectified it. Hopefully that allows it to continue existing.
Hill seems intent on self-hosting, so I mean it will exist, but will be a lot harder to discover and as GP mentions, probably harder to convince people to install.
Is it even possible to connect to the public Internet in a way that isn’t completely compromised by a corporation or state?
TOR is busted at this point
DNS have been MITMed
Almost all hosts are under the control of a few players who are compelled by their respective states for ubiquitous and server monitoring
Any advertised IP has to have tons of routing info and local pointers so local hosting is just as risky if not more
What are the remaining options for a free (as in speech) internet?
Because no one ever have taken over and compromised high profile extensions?
Chrome battles with it a lot, see eg. https://news.ycombinator.com/item?id=36146278
I find Mozilla's process to be quite reassuring, but would be good to have alternative "addon stores" that also have a review process
Absolutely. But: I don't think anybody is saying that high profile extensions should receive less scrutiny?
For high-profile extensions, the impact is higher for both false negatives and false positives. So they should receive more attention.
I do not know anything about Mozilla's internal procedures regarding add-on approvals. However, for a high profile extension like uBO/uBO Lite... it should either require multiple reviewers, or maybe just an escalation to a senior reviewer or something. You should never be a single human error away from a high impact mistake.
Maybe they do that already, I dunno. But it seems hard for me to believe that multiple people approved uBO Lite's yoinking.
Extensions are SUCH a crucial part of FF's appeal. And uBO/uBO is arguably the most important of them all.
Mozilla is definitely doing the right thing by reviewing the extensions, but the issue here is that were wrong, they found issues that didn't exist (such as claiming it contained obfuscated code and collected private data).
It appears the issues were found using simple heuristics (e.g they detected string pagead2.googlesyndication.com in a comment) and these detections weren't then manually reviewed as claimed, which is wasting everybody's time.
Why does lying about manual review seem so commonplace?
For example, during basically any YouTube copyright or moderation controversy, there is always "manual review" of videos that have obviously been caught in automated systems that in case of actual manual review, would be cleared of problems by any reasonable human.
Maybe "manual review" here is that someone "manually" runs the automation tool for that specific entity.
> I find Mozilla's process to be quite reassuring
The fact that a review process exists might be reassuring, but the way they went about it surely isn’t.
https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco...
There is a difference between questioning if a review process should exist for the official addon index and questioning if the implementation is any good.
You address the former when it seems like the issue is the later.
Mozilla has the capability to handle compromised addons; this whole mess happened because they wiped out every version of uBOL except for the earliest one.
They just haven't used that capability responsibly... Yet.
It seems to me that any platform with a review gateway should treat failing a review erroneously as a critical failure.
In fact it does literally constitute denial-of-service.
When a failure like this occurs, it needs more than an apology, it should have an incident report to show that the failure was understood and steps were taken to prevent future failures.
I wish we could add PPAs to browsers just like we can in Debian/Ubuntu.
Maybe the EU should look into this, and also allow the users to "weaken" their security in order to continue using Manifest Version 2.
For anyone confused by the real title:
> uBlock Origin Lite maker ends Firefox store support, slams Mozilla for hostile reviews
“Review” here means the Mozilla review to allow the extension in the store, not user reviews of the extension.
I'd hoped Google sabotaging uBlock Origin would be an opportunity for Mozilla to pick up some new users for Firefox. Lol.
Apparently, as the article says, the lite version is the recommended one by the author to be used
The article is misleading. The lite version is recommended on chrome because very soon the non lite version will stop working.
It doesn't apply to firefox.
Recommended for Chrome. I'm not sure why anyone would want this for Firefox.
It's lighter on resources and requires less permissions (so it's more private).
manifest v3 is not as bad idea as some people are saying
But... ublock is like the main reason I use FF
ublock origin is still available in the Firefox add-on store.
The developer has pulled the 'lite' version, which is developed mainly for Chrome because Google killed some APIs the full version was using.
You can continue to use Ublock Origin, which uses the v2 manifest.
The delisted extension, Ublock Origin lite, is a v3 manifest plugin. Apparently it was created to address chrome blocking the v2 extension, but you can continue to use the v2 extension on Firefox
A first effect of Mozilla's new "focus on AI"...
If you would group those woes, by type of addon, i guess there is "irrelevant " and "a world of pain for those threatening google add revenues " .. the hand that feeds.
It‘s not only that, Firefox also forces you to use the Developer edition (which updates about daily, FORCING you to restart it) if you want to install extensions that aren’t signed by Mozilla (e.g. your own).
This behavior reminds of Apple. They say it‘s for security (where have I heard that before), yet Chrome doesn’t seem to need such a restriction.
To me it seems like another step in many of Mozilla‘s enshittification.
I am pretty sure Chrome has also added the forced restart for a bit now. It might not show up right after the update, but it doesn't take long. I don't remember if it was straighforward, or just crashed new tabs.
We need an industry movement of just saying no to app stores.
Mozilla decided at some point to kill extensions - whether following Google Chrome or of its own volition. It took an axe to its ecosystem by disablign the loading of anything external other than WebExtensions - and note that it's just an artificial disabling, as internally, Firefox is still basically some bundled "extensions" over a C++ core.
And now there's the "manifest v3" change, and making people jump through hoops to be on AMO.
This is very sad, almost as much as the internal governance over there.
Just follow the money.
For all practical purposes, Mozilla is a Google subsidiary.
Generally, yes: follow the money.
But that does not mean that random errors can be always attributed to malice or financial interests.
You think that's how Mozilla would kiss up to Google? "Hey, we disabled an ad-blocking extension (although not its more popular and powerful big brother) for half a day! And then we put it back up!"
If I'm Google, that is not really thrilling me or making an impact.
Also, the Google/Mozilla relationship goes both ways. Mozilla is dependent on Google for cash, which I absolutely dislike.
However, Google also needs Mozilla as a hedge against antitrust claims. From an antitrust standpoint the ideal situation for Google is that Google continues to fund Mozilla, and Mozilla continues to allow ad-blocking (looks good to regulators) while continuing to have a tiny market share (so that FF's uBlock users don't actually have much of an impact on Google's advertising biz)
Yeah, you're probably right.
This was just a completely innocent mistake. They had no idea that uBlock Lite was the most popular ad blocker for Firefox.
I'm sure the result made sugar daddy cry.
> They had no idea that uBlock Lite was the most popular ad blocker for Firefox.
Did I miss anything? Unless you really care about resource usage (on mobile, perhaps), there's hardly any reason to use uBlock Origin Lite on Firefox. It exists because of Chrome.
How is that at all relevant here? Google doesn't have this same review process for Chrome?
If it does, that only strengthens the point.