Hacker News Reader

Comment by kemayo | Hacker News Reader

The article is right that we've not seen any communication about Mozilla as to how they intend to use this, so we can only speculate about why they might want the feature.

My own speculation is that this is them warding against extension-takeovers, where people sell off their semi-successful extension to some company which then fills it up with spyware. If Mozilla fills up their quarantine list with domains that're easy targets for stealing valuable information (banks, etc), that'd reduce the incentive to do such takeovers.

View on HN

> My own speculation is that this is them warding against extension-takeovers

I don't buy that. If they learn that an extension has been taken over, then they can just block the extension.

Also, why the domain list? If some extension has started cryptomining, why will Mozilla protect me only when I visit selected domains? And why the tight lips?

> If they learn that an extension has been taken over, then they can just block the extension.

The goal would be to stop compromised extensions from being able to hit high value targets even before anyone has realized they're compromised. They won't get that valuable window in which the malicious update has gone out, but nobody has realized that it was malicious.

> If some extension has started cryptomining, why will Mozilla protect me only when I visit selected domains?

Because they're not protecting against cryptomining, they're protecting against data theft, which is naturally going to focus on certain high-value domains.

But if they know there was a malicious update, being distributed through infrastructure they control, why not immediately block it altogether? (The notion that they have an explicit list of every, say, bank, stockbroker, crypto exchange, etc., so they could disable it for only those is... awfully suspect.)

Because this would block it from hitting some high-value sites before they know there was a malicious update. I would imagine that once they know about it it'd also get added to the blocked-extensions list.

The only way this approach could work is if they prevent any extensions from being in force on such websites from day 1.

I can't imagine that's their plan unless they really are trying to chase away the few FF users left.

Per the article, quarantined sites will only allow "monitored" extensions to run.

I presume that this means extensions for which they actually do verify that updates are non-malicious, which probably includes most of the popular extensions. Hard to say exactly which -- uBlock was called out as being one in the article, but there's nothing on its addon page[1] specifically flagging it as being on that list.

[1]: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...

Alternative headline: "Mozilla enables a global extension enablement policy for greater security"

Your solution is reactive. If I install a useful extension but want to ensure it can't access internal or sensitive websites (least privilege, basic cybersecurity) why would I want to wait until Mozilla disables the extension, after it is discovered to be malicious?

This seems to provide a user-controllable override of an extension's settings to enhance security, and I'm here for it.

Power given to the well-intentioned will get used by their successors.

I haven't tried servo since right after the transition to the Linux foundation. It seemed good for most of my browsing already, but with a bad ui. I looked for any good tickets for new contributors but all I found was something about xml parsing that I am unqualified for, plus I hate xml. If we could throw out weight behind it I think it could be an alternative for everything that shouldn't be a web app or native app.

I'm inclined to reserve judgement until we see the user-facing UI for this (which is apparently coming in 116, per other comments). It seems like a reasonable feature, so long as there's sufficiently accessible ways to override it.

Wouldn't a better way to deal with extension takeovers B to just turn off the extension instead of blocking the extension from certain websites? Especially since, as the author points out, any such quarantine list of domains is of necessity going to be incomplete?

It blocks *all* (non-monitored) extensions from running on *some* websites. What it should do is block *specific* extensions from running on *all* sites. The security justification doesn't align with what they actually did.

I think the idea would be that it's easier to list common targets than to play after-the-fact whack-a-mole with malicious extensions. The former makes it less lucrative to sneak your malicious code into an extension, because you don't get that window of being able to harvest data before it's noticed.

Exactly what I was getting at yeah, well said

They already have (separate) capability to force uninstall specific extensions, so there isn't much point to blocking specific extensions from all sites.

My charitable guess for this one is block things like Honey (which essentially slurps your browsing history in return for affiliate discounts) from things like banking websites. But I'll disable it for now and see what the UI is later.

Mozilla already control the update process, so could easily stop extension authors pushing malicious updates after a takeover.

It’s quite possible that a malicious takeover is only diagnosed after the fact. Updates might appear innocuous at first but later be incredibly user-hostile.

I'm not familiar with extension development or their capabilities, but perhaps the extension author can remotely activate the malicious parts after it passes the update process and perhaps Mozilla doesn't have the manpower to manually review the code of every extension update?

I think that's the difference between "monitored" and "unmonitored" extensions, as called out in the article. Monitored extensions are presumably ones where they actually verify the updates, and so they think it's fine to let them run on sensitive sites.

Why do you say easily? Software is an endless parade of creative exploits both intentional and accidental, it's never seemed like an easy problem to solve.

More likely this is preparation for them to comply with DMCA takedowns against uBlock Origin, by blacklisting it on those websites while placating users by not removing it entirely (as they did in this case: https://www.ghacks.net/2023/04/20/mozilla-removes-bypass-pay... )

Except in the article it's made clear that uBlock origin is ignored and therefore will run on quarantined domains.

> uBlock origin is ignored

That's just configuration, easy to change. And if they change that configuration in response to a lawsuit, Mozilla can play the victim and say their hand was forced.

If they had to ban uBlock Origin outright that would probably kill Firefox's (already abysmal) install base. Neither Mozilla nor Google wants that; they want Firefox to remain as an obscure but technically viable competitor. What they're doing now is laying the groundwork for banning uBlock Origin on only some websites while allowing it to continue working on most. This let's Google have their cake and eat it too; Firefox surviving as nominal competition to Chrome but no longer blocking ads on Youtube.

Reply on news.ycombinator.com