this post was submitted on 04 Jul 2023
351 points (98.3% liked)

Firefox

17953 readers
160 users here now

A place to discuss the news and latest developments on the open-source browser Firefox

founded 4 years ago
MODERATORS
351
Firefox 115 released (www.mozilla.org)
submitted 1 year ago* (last edited 1 year ago) by hal_5700X to c/[email protected]
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 81 points 1 year ago (7 children)

Certain Firefox users may come across a message in the extensions panel indicating that their add-ons are not allowed on the site currently open. We have introduced a new back-end feature to only allow some extensions monitored by Mozilla to run on specific websites for various reasons, including security concerns.

What is this bullshit? Feel like this will lead to adblocks being blocked for certain websites under the guise of "security", aka: we don't have to justify shit to you.

[–] [email protected] 38 points 1 year ago

It's not going to inconvenience you that much, and the proof for that is that this has always been the case: extensions would never run on e.g. addons.mozilla.org. This makes sense; you don't want extensions to trick you into installing other extensions, for example, or to hijack your sync password.

It looks like the main change is that this actually loosens this restriction: it looks like some trusted extensions from now on will be allowed.

[–] [email protected] 31 points 1 year ago (2 children)
[–] PaulDevonUK 1 points 1 year ago (1 children)

1st thing to do on every release from now on.

This is a step too far for me. My device, my choice of browser and I am adult enough to make my own decisions.

[–] [email protected] 34 points 1 year ago (1 children)

Oh come on, it's still a free and open source browser. As seen in the other comments, it's a badly worded security feature for firefox internal pages and mozilla pages.

It's not going to kill adblock, it won't send your data everywhere and it can be disabled through an option as well as by simply building firefox yourself.

Everybody should stop being so negative towards open source developers.

[–] [email protected] 3 points 1 year ago

Did everyone in this thread drink the conspiracy theory kool-aid or something? The accusations here are wild.

[–] [email protected] 17 points 1 year ago* (last edited 1 year ago) (1 children)

Is there even some way to see which addons this applies to on which websites? I can't find anything. Or am I just going to find out randomly while browsing?

[–] [email protected] 44 points 1 year ago* (last edited 1 year ago) (2 children)

I was curious as well so I looked at the git tree. I'm not familiar with Firefox code, but I'm assuming I found the list:

pref("extensions.webextensions.restrictedDomains", 
"accounts-static.cdn.mozilla.net,accounts.firefox.com,
addons.cdn.mozilla.net,addons.mozilla.org,
api.accounts.firefox.com,content.cdn.mozilla.net,
discovery.addons.mozilla.org,install.mozilla.org,
oauth.accounts.firefox.com,profile.accounts.firefox.com,
support.mozilla.org,sync.services.mozilla.com");

From here

So it looks like it's mostly to do with the account system of Firefox. I'm not sure why their websites would need special protection, but whatever. It's not malicious, for now

[–] [email protected] 38 points 1 year ago

Makes sense. You don't want Addons to navigate to the addons page and install other addons. You also don't want to give them access to the firefox sync data through your account to do the same from that end.

[–] [email protected] 38 points 1 year ago

Thanks! Nicer list:

  • accounts-static.cdn.mozilla.net
  • accounts.firefox.com
  • addons.cdn.mozilla.net
  • addons.mozilla.org
  • api.accounts.firefox.com
  • content.cdn.mozilla.net
  • discovery.addons.mozilla.org
  • install.mozilla.org
  • oauth.accounts.firefox.com
  • profile.accounts.firefox.com
  • support.mozilla.org
  • sync.services.mozilla.com
[–] [email protected] 3 points 1 year ago

at least it can be disabled in the prefs for now

[–] dojan 2 points 1 year ago (2 children)

“Security concerns” is such a bullshit reason. If an add on is such a security concern, why host it in the first place?

I’m disappointed Mozilla is going down this path, but not surprised.

[–] [email protected] 11 points 1 year ago (1 children)

So allowing any random, possibly compromised, possibly installed by malware, add-on to run during the Firefox account login pages (see the list of URLs in this thread) isn't a security concern to you?

[–] [email protected] 2 points 1 year ago

The alternative would be to give addons so little permission that the damage wouldn't matter. Effectively break the whole system, i'm fine with the ignore list.

[–] [email protected] 0 points 1 year ago

To me it sounds more like they plan on blocking all addons (other than some whitelist of "trusted" addons) on important pages (like the Google login page maybe?).

[–] [email protected] 1 points 1 year ago

I just hope that Librewolf will remove this.

[–] [email protected] 1 points 1 year ago (1 children)

You can always download the xpi and install it manually

[–] [email protected] 3 points 1 year ago

this doesn't block you from installing extensions. It blocks them from running on certain protected pages, whatever they may be