Hacker News Reader

Comment by zb3 | Hacker News Reader

Is there a list of these domains?

On 115.0b9 on macOS the list is empty (`extensions.quarantinedDomains.list`), guessing it's intended to be set by school/company IT for their managed devices

~~While school/company IT as a use case is being considered[1], that is not the primary intent for this feature.~~

edit: I misread that ticket. It's about allowing school/company IT to disable the feature, not to allow them to use it.

https://bugzilla.mozilla.org/show_bug.cgi?id=1834985

I believe the list will be configurable, it might be empty by default. Looking at the inter-bug linkage, this feature seems built for IT departments to blanket-ban extensions from domains that the company deems sensitive.

That purpose doesn't really make sense for me. Any IT department that wants to shut down unverified code on their intranet sites will just disable add-ons completely. I mean, it's a noble idea, to allow users to install their own preferred add-ons while still blocking them on intranet sites, but for IT it's much easier to just lock it down completely.

I think the feature's simply not finished yet, and that in the future this list is going to come pre-loaded with government and banking domains.

I understand the paranoia but that scenario would make no sense, as long as about:config is accessible - which it will always be, for any FF user except managed-IT ones.

Oh, I'm not saying that it's some sort of plot to force us to disable our extensions or anything. I'm saying it's going to be a feature aimed at out-of-the-box security, which advanced users are free to tinker with as they wish. The reality is unfortunately that many less-advanced users are much more likely to install random unvetted add-ons, and sane defaults for that list (pre-loading it with gov and bank domains) will prevent hostile add-ons from doing serious damage.

Reply on news.ycombinator.com