Mozilla Bans Popular Firefox Add-On That Tampered With Security Settings (softpedia.com)

An anonymous reader writes: Mozilla has banned the popular (250,000+ installs) YouTube Unblock add-on that allowed users to view YouTube clips blocked in their country. The reason for this move is because the add-on was caught disabling a Firefox security setting (code signing) which the allowed it to silent-install another add-on, which Avast (antivirus software) was detecting as malware. Earlier in 2015, the same plugin was again caught cheating when it was using an self-contained update system that was bypassing Mozilla's add-on review process.

Comments

Good on Mozilla

[Anonymous Coward]

Please publish the names of the authors, so we know not to ever install anything written by them ever again.

Re:Good on Mozilla

[Tharkkun]

Please publish the names of the authors, so we know not to ever install anything written by them ever again.

Better yet. Stop trying to police addons we want to use in our browser.

Let THE USER Decide

[Anonymous Coward]

Who is in the right. This is JUST corporate overreach of the worst kind.

Re:Let THE USER Decide

[epyT-R]

Well, on the one hand, it's good to know that there was possible bad behavior, but on the other, the trend of vendors locking down their ecosystems is hurting those who do not wish to accept whatever they're willing to push through the needle.

Re:Let THE USER Decide

[Kremmy]

What, are you a malware author or something? Remove this backdoor garbage from official add-on repositories.

Re: Let THE USER Decide

[Anonymous Coward]

"The add-on remains available through its homepage."
The user still can decide. Mozilla only removed it from their add-on marketplace, which is IMO the correct action and certainly not any kind of overreach. That's like saying Google is wrong for banning Android apps from the Play Store which root your phone - it's not, they have policies and those apps knowingly violated them; if you still want those apps side loading is available.

Re:Let THE USER Decide

[Anonymous Coward]

Shame of Mozilla for such shitty design that allows this kind of crap. If this was IE you could but your last dollareuropound there would be 500+ posts by now.

Re: Let THE USER Decide

[Anonymous Coward]

When I saw the summary say that they "banned" it, I understood that they completely blocked it from being installed in the browser.

Re: Let THE USER Decide

[LoneBoco]

That's what will happen once mandatory addon signing is implemented.

Re:Let THE USER Decide

[William Baric]

I agree, remove this backdoor garbage from OFFICIAL add-on repositories, but still allow me to install whatever the fuck I want. I'm seriously tired of how arrogant Mozilla developers have become.

Re:Let THE USER Decide

[Anonymous Coward]

Who is in the right. This is JUST corporate overreach of the worst kind.

this is capitalization of the worst kind. you're emphasizing the word just, implying that mozilla is doing good.

Re: Let THE USER Decide

[DrXym]

They could do that too. They have blacklist functionality which I'm sure includes the ability to block apks. And who's to say they won't use it if the add-on is a malware vector.

Re:Let THE USER Decide

[paulatz]

The FA says you are still allowed to infect your pc with all the malware you want from the addon homepage. Did you try to RTFA but were stopped by ad popups?

Re:Let THE USER Decide

[Anonymous Coward]

Currently it might still be possible to install it, but they are planning to remove that feature in firefox 46.
Even now you have to change settings in about:config to do so.
From their own wiki:
> Firefox 46: Release and Beta versions of Firefox for Desktop will not allow unsigned extensions to be installed, with no override. Firefox for Android will enforce add-on signing, and will retain a preference to permit disabling of signing.

Re: Let THE USER Decide

[bickerdyke]

The user CAN NOT decide if the probably unwanted stuff is slipped to him secretly.

It would be different if the user was warned during plugin installation "Hey, we're going to mess with your browser security setting and will install stuff that would trigger your virus alert, but - just to avoid that confusion - we will disable your antivirus while we're at it. OK?"

THAT would be "let the user decide".

Re:Let THE USER Decide

[Anonymous Coward]

Haha, ok, well, that's the end of Firefox, then. I've just read the signing process and nope, nope, nope. I used to write and maintain extensions for a local site I was involved with and there is no way in hell I'm submitting shit to them and waiting for them to approve what already works and my users already trust me with.

Although I might just work out how to get everyone installing a developer certificate or recomend that they install one of the Firefox forks.

Re: Let THE USER Decide

[Anonymous Coward]

By apks u mean xpis?

Re:Let THE USER Decide

[Anonymous Coward]

You have a very awkward security system. 'Your users trust you' is not a system I would trust. I prefer some extra protocols instead of somewhere on the internet there are people who trust that other person on the internet, so I'm pretty sure I can trust it too. This is what causes all those exploits of which you think how stupid people could be to trust these installers. No system is water proof, but having an authority like Mozilla banning ad ons from untrustworthy programmers is a slightly better system than what you seem to be doing.

Re:Let THE USER Decide

[Anonymous Coward]

Fork you!

Sorry, that should have been, "Fork, you!"

As in, if you don't like it, feel free to take the source code, and fork it, or use one of the many forks that have already been made.

Enjoy!

Re:Let THE USER Decide

[Anonymous Coward]

Spoken like a true malware writer. Local site being a porn site? Hurrah?

Re:Let THE USER Decide

[Anonymous Coward]

A reputation built through a web of trust is the best possible system.

A single centralised decider of who counts as trustworthy - particularly one so incompetent and obviously lacking in decent direction as Mozilla - is the worst possible system.

So, you're the polar opposite of correct.

Re:Let THE USER Decide

[Anonymous Coward]

Ignorant and condescending. That's a great combination!

Re: Let THE USER Decide

[Anonymous Coward]

No, it won't. Users will always be able to install a Firefox without the requirement. Most of us just don't care to, because we're not idiots who think that having a malware magnet is the same thing as having the freedom to install any software we'd like.

Re:Let THE USER Decide

[Anonymous Coward]

They don't allow it, really. They blocklist addons regularly, but it's rare for such a high-profile example to come around that proves that Mozilla's on the right track with their addons overhaul. People can no longer hide behind "muh freedom!" type of arguing when it comes to deriding Mozilla for wanting to improve their addon system, so making a stink about its current failings is important.

Re:Let THE USER Decide

[Anonymous Coward]

That would actually be a good point if you were right about Mozilla not having good direction. I truly think people have jerked their knees about Mozilla's direction for so long now that they're unwilling to accept the good ideas and directions they're heading in. Overhauling the addons system so they're less fragile, better-sandboxed, and can be reviewed by real humans more efficiently is a fantastic idea. In addition, letting the people who have been doing this for a long time, volunteers and otherwise, has proven far more effective than Google's Chrome extension vetting system. I honestly fail to see what you're complaining about here. They're relying largely on volunteers, so it's not just Mozilla's interests being reflected here. They have an open process, where people can complain and harm Mozilla's reputation for abusing the system. They're not even forcing anyone to use this system, users or addon makers, but rather only if they want to be on AMO and not need users to opt into unreviewed and potentially bad addons.

Re:Let THE USER Decide

[Tharkkun]

I agree, remove this backdoor garbage from OFFICIAL add-on repositories, but still allow me to install whatever the fuck I want. I'm seriously tired of how arrogant Mozilla developers have become.

I agree. They fuck with Java non-stop which I require for internal applications. Who cares if my Java is out of date when I use one specific browser on one applications. Stop disabling my shit Mozilla.

Re:Let THE USER Decide

[chefmonkey]

You need to read more carefully. For the kind of add-ons you mention -- that is, ones not hosted on Mozilla's servers -- the signing process is automatic. You can even use a commandline tool to automate submission of the file for signing, and generally get a signed version back within a few seconds.

Security design-flaw in Firefox

[Anonymous Coward]

It should not have been possible that an add-on can change security settings to begin with.

Re:Security design-flaw in Firefox

[Anonymous Coward]

Why not?

Re:Security design-flaw in Firefox

[Anonymous Coward]

250,000+ reasons.

Re:Security design-flaw in Firefox

[Anonymous Coward]

When an add-on can change anything about the browser, how can you prevent it?

captcha = fallacy

Re:Security design-flaw in Firefox

[Anonymous Coward]

Many of the security and privacy related improvements people want|need come from addons changing security related settings and behaviors.

Re:Security design-flaw in Firefox

[Anonymous Coward]

It doesn't have to be able to change literally anything about the browser. There's a balance. Changing security settings to silently install add-ons goes beyond that balance.

I'm not necessarily saying that whatever setting this was shouldn't be available, but you can make an API such that they aren't, so long as your plugin model isn't "execute arbitrary native code in the same process as the host".

Re:Security design-flaw in Firefox

[Anonymous Coward]

What if you WANTED that add-on to change the security settings?

If a addon cant change security settings then people will be complaining that firefox has things blocked off that can't be changed.

People are lazy and will use addons to change simple stuff. Look at the ones to disable webrtc. All it takes is typing in "about:config" and double clicking on a entry but all the people who use those addons show people like the convenience of addons to change the settings for them.

You shouldn't blame firefox for giving addons makers/users more control when the an addon maker abuses that control. Blame the maker of that addon!

Re:Security design-flaw in Firefox

[Anonymous Coward]

"@people want|need"

Isn't that the point? People neither wanted or needed this change, the plug in did it behind their back. Mozilla have no way to protect their browser from the plugins, so it cannot guarantee that a plugin won't do this behind its back.

No USER gave that plugin permission to change the USERs chosen browser security settings.

Re:Security design-flaw in Firefox

[softnewsit]

Code signing will not be a "turn off/on" settings in upcoming Firefox versions. It is under testing, so it still allowed users to disable it because it did not get to "test & sign" all existing addons

Re:Security design-flaw in Firefox

[Anonymous Coward]

@"People are lazy and will use addons to change simple stuff. "

They didn't download a youtube plugin to turn off their security and download malware. Firefox shouldn't allow the security parts of its browser to be altered. Rather it should make any necessary changes easy enough for lazy users to make themselves.

Re:Security design-flaw in Firefox

[Anonymous Coward]

So Firefox is going to do a code analysis on every Firefox plugin that gets uploaded on the internet to make sure other plugins aren't breaking the rules they don't actually enforce via code?

No, Firefox is the only problem here. I'm glad I stopped using it for being so slow and bloated, because apparently they don't know the first thing about security either.

Re:Security design-flaw in Firefox

[bloodhawk]

Then the user should be asked and CONSENT to changing the security setting. Allowing any addon to do this without the users knowledge is most definitely a design flaw.

Re: Security design-flaw in Firefox

[Anonymous Coward]

Security relevant settings should of course be changeable. But they should only be changed by the user, and only via native browser UI, or maybe by explicit opt-in permission from the user via native browser UI. I say maybe because is already dangerous to let users grant that kind of permission. Firefox is for the general population, people who have been trained to give anything they install sweeping permissions without even reading the boilerplate.

Re: Security design-flaw in Firefox

[Anonymous Coward]

Right and you probably tell your family and friends to stop using the internet cause it's lame too. STFU

Re:Security design-flaw in Firefox

[Anonymous Coward]

Users may not have wanted|needed the changes discussed here, but in other cases they do. So the route forward would be to improve the user's ability to see and control such changes. Rather than eliminate the possibility that such changes can be made.

Re:Security design-flaw in Firefox

[joboss]

What you're saying is why Firefox basically sucks. They go too far for security and forget about diminishing returns. You can't deal with a stupid user and the longer you over guard them from their stupidity the longer they stay stupid for. You can never say never. There are reasons an addon might need to override "security". Security is not a magic word for something unobtrusive. It means crippling and limiting everything that might be abused, if not simply removing it. You can't say there is no legitimate use for those things. Security comes at a price, it means making sacrifices and sometimes too many. It is a lost cause to try to make add on development super secure. However the API should be written in a way which makes auditing of add ons relatively simple. Focus on making the risk manageable, not impossible. Otherwise you're making nearly everything else impossible as well. I have the same problem using FireFox for non-standard roles and have had to role out my own modified version with patch security handling because otherwise FireFox is a lemon and we can't do what we need to do. It has some other problems as well such as many of the up and coming APIs, solutions, etc being immature, not widely used, lacking documentation or up to date documentation, unfriendly to developers outside of the FireFox sphere, etc. They don't have enough contributors and have a lot of large but incomplete or unpolished or mangled or poorly abstracted systems.

Re: Security design-flaw in Firefox

[Anonymous Coward]

Security relevant settings should of course be changeable. But they should only be changed by the user, and only via native browser UI, or maybe by explicit opt-in permission from the user via native browser UI. I say maybe because is already dangerous to let users grant that kind of permission. Firefox is for the general population, people who have been trained to give anything they install sweeping permissions without even reading the boilerplate.

Make up your mind!
First you say that security relevant setting should be changeable then you say it's dangerous to let users grant that kind of permission.
So, who gets to change the settings? The software author, via mandatory updates? Oh, nice privacy setttings you got there, let me change them for you because I know you want the internet to know all about you.
I'd say let the user decide AND take responsability for his/her actions if they fuck up.

Re: Security design-flaw in Firefox

[BronsCon]

let users grant that kind of permission

was, I think, referring to

maybe by explicit opt-in permission from the user

which would imply the user granting an add-on the ability to change the settings on their behalf. I think AC was pretty clearly agreeing with you that the user should be allowed to change the settings themselves when they said

Security relevant settings should of course be changeable.

and

But they should only be changed by the user, and only via native browser UI

You must have seen these remarks; you directly quoted each of them.

Re: Security design-flaw in Firefox

[sexconker]

Make up your mind!
First you say that security relevant setting should be changeable then you say it's dangerous to let users grant that kind of permission.

And?
Users should be able to do dangerous things if they so choose.

Re:Security design-flaw in Firefox

[Anonymous Coward]

Your perspective clearly demonstrates that you don't actually know what you're talking about. Firefox documentation is generally quite good, and the under-the-hood code and processes for addons are being improving away from the situation you describe already. I only hear this kind of vague hand-wringing from people who don't want any oversight of the software they want people to install. Mostly corporations who bitch and whine that Firefox doesn't tickle their gonads and make it easy to install a MITM cert, or who want to evade having their shitty code signed even with an NDA in place. Frankly, you're the dinosaurs. Mozilla is doing exactly what they should be doing, and you're calling foul because you want full control over things.

Re: Security design-flaw in Firefox

[Anonymous Coward]

This is why respecting your freedoms and using and writing Free Software is important, specially in this day and time.

Re:Security design-flaw in Firefox

[chefmonkey]

Well, sure. The issue is that add-ons have historically been loaded into the same security context as the rest of the browser code, which means they could literally do anything. The recent move towards having a better-defined API -- one that would prevent the kinds of things you think should be prevented -- is being done in large part to make this a far more tractable problem to deal with.

Of course, as soon as there's any noise about preventing add-ons from doing literally anything they want to your computer, Mozilla is painted as control-freak fascists out to destroy Firefox forever. So it's kind of a rock-and-hard-place situation.

Tor Browser + youtube-dl is a great work around

[Anonymous Coward]

and youtube-dl makes this simple so you don't use insecure flash or html5. youtube-dl supports a ton of sites with videos and always downloads the best quality version of the video.

don't download the older versions of youtube-dl in your Linux repository, instead, just download the newest version @ youtube-dl website:

http://rg3.github.io/youtube-d...

Re:Tor Browser + youtube-dl is a great work around

[Anonymous Coward]

yup and it's easier in Tails...

once you follow the chmod instructions @ youtube-dl site, just
use:

torsocks youtube-dl videoyouwanttodownloadurl

it works on some news sites, too, where you can just point youtube-dl to the news page and it sucks down the video from the article!

Here's a list of the Supported Sites:

https://rg3.github.io/youtube-...

No "plugin" can compare to youtube-dl when used in Tails properly.

Re:Tor Browser + youtube-dl is a great work around

[Anonymous Coward]

I previously used youtube-unblock before to bypass georestriction. using tor browser will let me access youtube *sitewide* block (block from national isp filter, company filter, etc...) but it will be a test of luck if you are trying to browse/download *georestricted* video (ex: many japanese youtube will restrict their access to japan users--japan ip-- only). As much as youtube-unblock is grayware/malware, I don't think it is not replaced by Tor browser (+ youtube-dl or so).

GJ

[ZeRu]

When I read the first sentence, I thought to myself that reasoning behind this was some corporate/copyright bullshit. But looks like Mozilla did a good job on this!

About add-ons

[lucm]

Maybe timothy needs an Mozilla add-on which the allow him to write not poor summary, the reason is because he is bad writer.

I need a nubile girl

[Anonymous Coward]

I'm sorry, but I don't know who else to turn to. I desperately need a nubile girl who will let me fuck her in the ass. Where can I find one?

Re: I need a nubile girl

[Anonymous Coward]

127.0.0.1

Re: I need a nubile girl

[Anonymous Coward]

I want to use you like a toilet.

Re: I need a nubile girl

[Anonymous Coward]

Pornhub.com

Re:I need a nubile girl

[Anonymous Coward]

http://gelbooru.com/index.php?page=post&s=list&tags=1girl+spread_anus

Re: I need a nubile girl

[Anonymous Coward]

When I think of dirty old men, I think of Ike Thomas and when I think about Ike I get a hard on that won’t quit.

Sixty years ago,I worked in what was once my Grandfather’s Greenhouses. Gramps had died a year earlier and Grandma, now in her seventies had been forced to sell to the competition. I got a job with the new owners and mostly worked the range by myself. That summer, they hired a man to help me get the benches ready for the fall planting.

Ike always looked like he was three days from a shave and his whiskers were dirty white under the brim of his battered felt fedora.

He did nott chew tobacco but the corners of his mouth turned down in a way that, at any moment, I expected a trickle of thin, brown juice to creep down his chin. His bushy, brown eyebrows shaded pale, gray eyes.

Old Ike, he extended his hand, lifted his leg like a dog about to mark a bush and let go the loudest fart I ever heard. The old man winked at me. “Ike Thomas is the name and playing pecker’s my game.

I thought he said, “Checkers.” I was nineteen, green as grass. I said, “I was never much good at that game.”

“Now me,” said Ike, “I just love jumping men. . .”

“I’ll bet you do.”

“. . . and grabbing on to their peckers,” said Ike.

“I though we were talking about. . .”

“You like jumping old men’s peckers?”

I shook my head.

“I reckon we’ll have to remedy that.” Ike lifted his right leg and let go another tremendous fart. “He said, “We best be getting to work.”

That summer of1941 was a more innocent time. I learned most of the sex I knew from those little eight pager cartoon booklets of comic-page characters going at it. Young men read them in the privacy of an outside john, played with themselves, by themselves and didn’t brag about it. Sometimes, we got off with a trusted friend and helped each other out.

Under the greenhouse glass, the temperature some times climbed over the hundred degree mark. I had worked stripped to the waist since April and was as browwn as a berry. On only his second day on the job and in the middle of August, Ike wore old fashioned overalls. Those and socks in his hightop work shoes was every stitch he wore. When he bent forward, the bib front billowed out and I could see the white curly hairs on his chest and belly.

“Me? I just love to eat pussy!”I ke licked his lips from corner to corner then stuck it out far enough that the tip could touch the tip of his nose. He said, A man’s not a man till he knows first hand, the flavor of a lady’s pussy.”

“People do that?”

He winked. “Of course the taste of a hard cock ain’t to be sneezed at neither. Now you answer me, yes or no. Does a man’s cock taste salty or not?”

“I never. . .”

“Well, old Ike’s willing to let you find out.”

“No way.”

“Just teasing,” said Ike. “But don’t give me no sass or I’ll show you my ass.” He winked. Might show it to you anyway, if you was to ask.”

“Why would I do that?”

“Curiousity, maybe. I’m guessing you never had a good piece of man ass.”

“I’m no queer.”

“Now don’t be getting judgemental. Enjoying what’s at hand ain’t beiing queer. It’s taking pleasure where you find it with anybody willing.” Ike slipped a handside the side slit of his overalls and I could tell he was fondling and straightening out his cock. Now I admit I got me a hole that satisfied a few guys.”

I swallowed, hard.

Ike winked. “Care to be asshole buddies?”

***

We worked steadily until noon. Ike drew a worn pocket watch from the bib pocket o

I didn't realise this add-on existed...

[91degrees]

Now I want it. Except without crippling my security.

Is there an alternative?

Re:I didn't realise this add-on existed...

[jrumney]

Is there an alternative?

Newsflash: people who write ad-ons that do not respect the rights of publishers most likely have no respect for your rights either. If you still want alternatives, tread carefully.

Re:I didn't realise this add-on existed...

[cdrudge]

people who write ad-ons that do not respect the rights of publishers most likely have no respect for your rights either.

So authors the various ad blockers, NoScript, Ghostery, etc aren't respecting your rights when they also don't respect the publisher's rights, blocking all the crap the publishers include? How am I suppose to live with myself and sleep at night violating the publisher's right to violate me?

Re:I didn't realise this add-on existed...

[Anonymous Coward]

"violate" you? come on, you aren't being raped or anything, dial back th froth a little.

Re:I didn't realise this add-on existed...

[cdrudge]

Yeah. Violate me. As in my right to privacy, right to be or not to be tracked, right to not be exposed to potential security issues, etc.

Re:I didn't realise this add-on existed...

[Tharkkun]

"violate" you? come on, you aren't being raped or anything, dial back th froth a little.

You sound like Bill Cosby.

Re:I didn't realise this add-on existed...

[chefmonkey]

Hrm. If there were only some way to search for that kind of thing...

https://addons.mozilla.org/en-...

Re:I didn't realise this add-on existed...

[KGIII]

There are many, many ways to use a VPN. This is even do-able in just the browser itself. If one's goal is to bypass geolocation restrictions, and isn't really all that security minded, then one need only look at the many services offered. Many of them are free. Some of the free ones have various restrictions, such as bandwidth restrictions. Needless to say, there are ways around those restrictions - such as multiple accounts. I guess, I'd rather call those "proxies" instead of "VPNs" as they're not really a VPN for the whole system. I think proxy is a more accurate term but nobody asked me.

I pay for a couple of them, actually. I use them for different things. I even have one at home that I run but that's for an entirely different reason and isn't actually used as often as it probably should be. There's a free one called Hola*** but I recall reading that they were selling their accumulated data, or something along those lines. If you're just using it for bypassing the restrictions then it might be an option for you to consider. There are many, many options. (My recollection of Hola was slightly off - I've included some more details at the bottom.)

The most applicable one that I pay for is SurfEasy. SurfEasy is run by the folks who own Opera. I use it to see what the web looks like for other people as well as to appear to be from other places. It's a bit of anonymity in some regards and it used to work with my cell phone but doesn't actually work with it anymore because I've changed phones. So, I just use the browser extensions. I get unlimited data and I've yet to have a problem with it. There are probably hundreds of choices. There are probably hundreds of free choices. There are many, many paid choices.

You can just use regular old proxies if you want. There are proxy lists all over the place. As you're not (I hope) planning on doing secure things through it then that's an option. If you're just browsing content that's restricted because your IP address indicates you're from the wrong area then, by all means, I'd certainly consider that a reasonable risk to take. Obviously, you don't do banking on it. I'd not even log-in with a regular Google account on YouTube for this though I am not sure how they'd go about compromising an encrypted stream and grabbing personal information from it. It's still better safe than sorry and I suppose they might be able to do something with just the associated cookies? I'm not really sure.

At any rate, there are lots of options out there. As you're just trying to view content, you can probably accept a few more risks concerning data interception. If you're using the free services then I'd make sure to use the more reputable companies if you're planning on doing anything that you want to keep truly private. Seeing as it probably doesn't matter that you wanted to bypass the restrictions for the BBC iPlayer, you're probably good to go with most any VPN out there that has an end-point in the UK.

I'm a bit low on time or I'd go dig out a few links for you. Just search for "free VPN" or "VPN" or "proxy" at your favorite search engine AND check those same search terms at your browser's extension/add-on site. You'll find a whole bunch of services that offer this at low and no cost. Depending on how much you want to pay and what you want for security, there are a bunch of choices. Tor, for example, is not the appropriate tool for this job but VPN Gate is probably just fine for your needs.

Here, I'll get you a link to the VPN Gate site. They're run by a university in Japan, free, and have lots of options - including many (most?) that work with Linux or any OS that is supported by OpenVPN. Depending on your OS, you may not even need any additional software at all. Anyhow, the link to this one:
http://vpngate.net/

Actually, a friend sent me a few links the other day...
http://www.vpnbook.com/
https://www.vpnme.me/

And SurfEasy:

Re:I didn't realise this add-on existed...

[KGIII]

About that Ghostery...

https://www.google.com/search?...

I've long-since moved away and use uMatrix. It's completely open and, unless I'm missing something in the code (I've checked the source - I'm pretty sure), there's nothing amiss there. It's got a bit of a learning curve but it's slight and easily doable. If I can learn it, I'm sure you can. You can then get rid of anything and everything on a site. It's pure whitelist-based.

I like to describe it as being akin to an old-school software firewall except limited to just your browser. However, as you can import and export both rules and settings, it makes it very portable. It's really nice and means you don't need to use NoScript and all the rest. Basically, unless you intentionally change it then anything not explicitly allowed is blocked. Once configured, it makes a handy tool. I've given my settings and custom rules sets to people before to get them started. I have the backup/import process sort of automated and mirror copies to a couple of private places online.

It's the same guy that makes uBlock origin, I've emailed 'em a couple of times. They won't even accept donations, put it that way. You can see his GitHub page here:
https://github.com/gorhill/uMa...

You can actually do a lot of what you can do with uMatrix by just using uBlock. On top of that, he also makes another extension called HTTP Switchboard. For the most part, all three are very similar but have slightly different goals and slightly different interfaces. At this point, I've been quite happy with his work. Just to be on the safe side, I sometimes remember to grab copies of the source that way, if things go south, I've got a way to fork from before things went south or the option to keep using the older versions.

All-in-all, there are tools out there that you can place a degree of trust in. It may take some research. I've no idea why you'd take my word for it but, if you want, my word is given that I both trust the uMatrix and uBlock code and author, for the time being, and am happy with the results. The best thing is that you can not rely on my word and just check the source yourself.

I think it's important to note that I'm actually a bit skeptical. I can, and do, set up Wireshark or push things through a hardware firewall and check the logs for suspicious activity. I can say, with a reasonable degree of certainty, that I've never seen any unexpected or suspicious traffic which can be traced to either of those two applications. I have not examined or made much use of the third program, HTTP Switchboard, so I will not opine on it except to say that, at this point, I've no reason to distrust it because of having used his other applications and finding them performing as advertised and only as advertised.

Here's a link to the source for all of his projects:
https://github.com/gorhill

Again, I only offer much of an opinion on the two and, as always, I encourage others to research and find their own solutions. In the case of Ghostery, specifically, you'd probably be better served seeking an alternative. For that, and to replace NoScript as there's no reason to run both, I recommend uMatrix. It even does HTTP referrers and whatnot. You can utilize blocking via HOSTS file inclusions and import them from multiple sources. I find them both quite handy, reliable, and trustworthy.

Re:I didn't realise this add-on existed...

[91degrees]

Yes... The first one wants "anonymised click stream data", and I'd rather not give permission without knowing what it it. Others seem to want me to sign up for something that all else being equal I'd rather not do.

But it's possible that a slashdotter somewhere knows about a good alternative or can offer advice on which one to use.

It turns out though, that you're right and I'm wrong. They don't. I just get a response from some sarcastic jerk.

Re:I didn't realise this add-on existed...

[jrumney]

As I said, tread carefully. Adblockers to counter malware and obtrusive advertising are one thing, but not all ad blocker authors have your best interests at heart ("Acceptable Ads" anyone?).

COB: Corporate Overreach Blocker has detected....

[TapeCutter]

As the smartest guy on the internet you probably already have my patented corporate overreach blocker installed. As you probably know it has been banned from freedom hating corporate repositories, meaning my elite followers are forced to download it from my exclusive website. What you may not know is that I just finished uploading the new version. The new version of the banned plugin can now shrink corporate overreach from the most powerful multi-nationals in the world down to the size of Donald Trump's fingers. It's really important that you and all your loved ones download the latest version NOW!!!! - My corporate spy team are telling me that the censors at google are about to delist my website, not sure when that will happen, it could be hours or days, but when it does happen I will be forced to move operations onto the dark web.

other browsers with Firefox-like add-ons

[Anonymous Coward]

On my android pda, i use noscript, Videodownloadhelper, Save mht, and a few other firefox add-ons for authoring and editting javascript inline webpages etc.

Are there any other webrowsers that can use Firefox add-ons or have same functionality as what i described above? I have tried Opera, Dolphin, Arachne, Dillo, w3c webbrowser, and a few others but non can do what Firefox does. When someone make a crossover mechanism? NO I WILL NOT TRY CHROME. Opera is nice for offline reading

Re:other browsers with Firefox-like add-ons

[johanw]

Try a Firefox clone like Palemoon http://www.palemoon.org/ . The flexibility of Firefox but without the would-be Chrome UI crap.

Re:other browsers with Firefox-like add-ons

[Anonymous Coward]

On my android pda, i use noscript, Videodownloadhelper, Save mht, and a few other firefox add-ons for authoring and editting javascript inline webpages etc.

Are there any other webrowsers that can use Firefox add-ons or have same functionality as what i described above? I have tried Opera, Dolphin, Arachne, Dillo, w3c webbrowser, and a few others but non can do what Firefox does. When someone make a crossover mechanism? NO I WILL NOT TRY CHROME. Opera is nice for offline reading

Classic opera can't use Firefox addons, but the 12.xx versions comes with so much included functionality (including opera dragonfly) that you really need only 2 extra addons : ghostery and adblock. Now chromeified Opera is as shit as Firefox so you've got no option if you want the lastest shinniest piece of shit browser.

Re:other browsers with Firefox-like add-ons

[Anonymous Coward]

Or you could just install Classic Theme Restorer, since palemoon isn't 100% compatible with firefox addons and made by amateurs.
Plus there's Firefox ESR which doesn't have the stupid 6 week realease cycle.

Re:other browsers with Firefox-like add-ons

[fbobraga]

DownThemAll is a must have add-on to me, and it's not available for Chrome (since long time, now): it was the primary cause that made me stick with Firefox over Chrome :P

Re:other browsers with Firefox-like add-ons

[fbobraga]

Opera is nice for offline reading

I recommend Opera Mini over "normal Opera": it has a much minor size and memory footprint (by been very light, it works very well on old phones and tablets)

Re:other browsers with Firefox-like add-ons

[arth1]

Or you could just install Classic Theme Restorer, since palemoon isn't 100% compatible with firefox addons and made by amateurs.

From a security point of view, Palemoon failed even at step one, installation. Its Linux installer *requires* that the system is set up for gratuitous sudo. Anything that asks for a system password during installation is something I will not install. And a system password that for an account that is set up to have root access for any command when the account password is given? No, just no.

(And never mind that they can't be bothered to list the prerequisites either.)

Re:other browsers with Firefox-like add-ons

[arth1]

I think downthemall.com is an unfortunate name. I thought it was for 14 year olds who wanted to hang out down the mall.

Re:other browsers with Firefox-like add-ons

[Anonymous Coward]

I read it, at first, as "DamnThemAll" which is more appropriate it think. :-)

Re:other browsers with Firefox-like add-ons

[ArchieBunker]

Why not Chrome? I know everyone claims it spies but nobody has provided any kind of Wireshark logs or further information to prove it.

Re:other browsers with Firefox-like add-ons

[fbobraga]

I think this naming problem is is a consequence of o major problem, that relates to all open-source community: poor "marketing" decisions (it's not natural?)

Re:other browsers with Firefox-like add-ons

[jez9999]

Its Linux installer *requires* that the system is set up for gratuitous sudo.

Heh, I guess you're not a Windows user or you'd be pretty used to elevating to Administrator during installs!

Re:other browsers with Firefox-like add-ons

[thegarbz]

Heh, I guess you're not a Windows user or you'd be pretty used to elevating to Administrator during installs!

That is predominantly to allow writing to the registry and a few locked folders during installation. These days the number of applications which actually require to be *run* as administrator are near enough to zero that it's not an issue.

However Linux never had this peculiarity in the first place. If you download a program that is standalone and doesn't have some deep hooks into the OS there's no reason you need elevated privileges on Linux, which makes me even MORE cautious when a Linux program asks for it.

Re:other browsers with Firefox-like add-ons

[Alumoi]

Hmm, could it be that because it logs you automatically on all google sites (search, youtube, ad network and so on)?
With Firefox/Opera I can choose when I want to be logged in and when not.

Re:other browsers with Firefox-like add-ons

[hairyfeet]

They offer the source so you should DIY...isn't that the Linux way? The Palemoon team has ZERO to do with the Linux branch, its made by a volunteer using the source. if you don't like the way he does it? You are free to take the source and come up with your own installer.

Re:other browsers with Firefox-like add-ons

[Anonymous Coward]

on my android I cannot seem to find any of the add-ons you describe, care to identify better them?

Re:other browsers with Firefox-like add-ons

[Anonymous Coward]

Oh that's cute, you still think you have anonymity online. Unless you're using a text only browser you've got invisible trackers tracking you, and if you are using a text only browser, trust me we know it's you. We also know your screen size, the last time you visited, how many devices you have used on the site, and more likely how many you have overall, plus your phone carrier...the internet knows everything about you. Stop being pretending to be naive and thinking they don't. Your browser doesn't matter and you know it. You also don't need to be logging into Chrome. It's a choice, same as Firefox.

Re:other browsers with Firefox-like add-ons

[Anonymous Coward]

It really is too bad that Windows doesn't really have a concept of an /opt directory or installing to user folders.

Re:other browsers with Firefox-like add-ons

[malditaenvidia]

You're also free to use seamonkey, waterfox, iceweasel or any of the other forks that aren't 10 versions out of date.

Re:other browsers with Firefox-like add-ons

[arth1]

Waterfox is available for Linux now? That's news.

Re:other browsers with Firefox-like add-ons

[sexconker]

It really is too bad that Windows doesn't really have a concept of an /opt directory or installing to user folders.

It does.

Programs that aren't written by morons should ask you if you want to install it for the current user only (no UAC required) or for the whole system (UAC required).

For the user, HKEY_CURRENT_USER\Software in the registry is like the opt directory.
But so is %USERPROFILE%\AppData\. And in AppData you have Local, LocalLow, and Roaming.

The %APPDATA% variable points to Roaming by default, while the Local directory is for shit specific to the PC (shouldn't roam), or is too big to roam. LocalLow is a "low integrity" directory. Allegedly things like plugins and add-ons should store their shit there and not be able to write to the Local directory.

For the system, you have HKEY_LOCAL_MACHINE and %ProgramData%.

The problems are:

1 - Morons write programs and demand full access to the whole system regardless of whether or not they need it.

2 - Morons write programs and store a whole mess of bizarre, indecipherable shit in the registry, in both HKLM and HKCU. Even when it's documented, it's fucking wrong (I'm looking at you, Adobe).

3 - Morons write programs and store a whole mess of bizarre, indecipherable shit in the the various %USERPROFILE%\AppData\ folders and the %ProgramData% folder .

4 - Morons write programs and store even more configs in the program's installation folder or other random places (like the Documents library).

Any one of these things alone is annoying, but programs often do all 4. This makes figuring out configs even harder - does the registry override settings.ini in the program folder? Or perhaps the profile in %AppData% wins out. What about the settings in %ProgramData%? Which registry settings are in HKLM vs HKCU? Why isn't anything in %AppData% or %ProgramData% or even the fucking registry cleared out when I uninstall?

It's a mess because developers are morons and Windows lets morons make a mess of things in several ways.

Re:other browsers with Firefox-like add-ons

[sexconker]

The mere fact that the address bar and search bar are the same qualifies.
You can't type in an address without it being sent off to Google to deliver suggestions when they're the same bar.

Re:other browsers with Firefox-like add-ons

[HiThere]

Even MSWind95 did that. When I installed Squeak and Python on MSWind95 there were no files installed outside the application directory, which I located in a custom place segregated from all system files.

The problem isn't that MSWind doesn't allow that, the problem is that it doesn't (didn't?) require that.

FWIW, I generally prefer /usr/local to /opt, but in either case the files should be those that you trust, and the locations should require root permission to allow installation. Files with any doubt as to their provenance should be installed in a place like /home/apps/ with write permission only to the apps user (not a real user) and execute permission as desired. If you can't control where it installs itself, don't trust it.

Re:other browsers with Firefox-like add-ons

[Anonymous Coward]

I like your rant and don't want to interrupt your bashing of Windows and developers, but honest question. Where are you saying the executable should be installed? For user-not-system installed software *everything* should go in %APPDATA% (or wherever, pick a place, one place, the exact location is of no concern to my question), executable and all? I'm trying to think if I've ever seen this done.

The benefit of executables going into C:\Program Files is that modifying those files does get the user hit with a UAC pop-up. So yes, on installs and updates the user sees a UAC but that way other programs aren't sneakily modifying the executables or dlls. There wouldn't be a UAC prompt when just running the program, though.

Re:other browsers with Firefox-like add-ons

[HiThere]

The last time I tried to use Seamonkey it wouldn't run. I didn't devote a whole lot of effort into trying to figure out why, but it did compile without errors (that I remember). I was trying to install it to use its html editor, but I found another one that looked like a fork and worked without problem. (Can't remember its name.)

Re:other browsers with Firefox-like add-ons

[lgw]

I've been frustrated with the fact I can't use anti-container (a wonderful extension to downthemall) on Pale Moon. It's the only reason I keep a copy of FF around. Chrome is right out.

Re:other browsers with Firefox-like add-ons

[allo]

And it will die in a few firefox releases. Mozilla deprecates (and removes) XUL and XPCom and addons as powerful as DTA will not be possible, the DTA author wrote he will probably need to discontinue it.

Re: other browsers with Firefox-like add-ons

[fbobraga]

A sad news to me :/

Re:other browsers with Firefox-like add-ons

[beastofburdon]

If you are installing into the standard directories then you must use root privileges. That is the way Linux is designed. If you want to install it in your home directory I guarantee that it will not require it.

Re:other browsers with Firefox-like add-ons

[arth1]

If you are installing into the standard directories then you must use root privileges.

Using root privileges to do something specific is not the same as granting a program gratuitous privilege escalation to root, or giving an installer a password.

That is the way Linux is designed.

No, it isn't. If the documentation states what it needs write permissions to, or the installation script reports problems and then rolls back, you can temporarily give the required access.
Either through group permissions or ACLs.

If it installs under, say, /opt/palemoon, it is FAR better to create that directory as root, and give the installing user temporary write access, and change the ownership/access of the directory afterwards. Similar for other directories it may want access to.

sudo isn't needed for this. Or for much else that sudo is abused for.

Re:other browsers with Firefox-like add-ons

[beastofburdon]

Let me get this straight. Are you saying that the install script is somehow giving the program root permissions that it can use after it has been installed? Otherwise in order to write to the /bin, /usr/bin, or any other directory that is not in your home directory you must have root permissions. You can temporarily give a user write permissions for a folder, but that also involves using root to give that permission.

250,000 reasons

[Anonymous Coward]

>lamefag: Tell him, Dont uninstall Firefox and Im not going to install malware.
>devel: Dont uninstall Firefox. I'll get rid of the malware.
>newsroid: malware in Firefuzz security, help is onthe way.
Mic Dundee (Anonymous Coward): tell them, why botnet?
>newsroid: i dunno, why bypass my security settings?
>devel: i dunno. Why did you install unsigned code?
>lamefag: i love you!
>devel: i love you.exe
>newsroid: ilovdyou.tif.com.bin.dmg.exe.apk
Mic Dundee (Anonymous Coward): *click

Keep it simple for a better browser

[Anonymous Coward]

I totally avoid extensions as much as possible. Much of what helped the demise of Firefox was bad extensions that either were poorly done, or like in this situation were causing more harm than good. If it has to cripple security to work, you don't need it.

Code signing is the final nail in Firefox's coffin

[Anonymous Coward]

It's no secret that Firefox is seriously losing market share. Firefox is likely under 8% of the browser market now, across all desktop and mobile platforms! To put that number into perspective, note that desktop Chrome 48 alone has over 3 times the number of users that Firefox has in total, and Chrome for Android 47 has over 2 times that number. IE 11, iOS Safari 9.2, and UC Browser for Android each have about the same number of users as Firefox does. Firefox nearly has fewer users than even Opera Mini has! And Firefox has essentially no mobile presence at all. Firefox for Android is only at 0.04%!

Despite being one of the most popular browsers several years ago, I think that Mozilla has gone out of their way to alienate Firefox users as often as they can. They've trashed Firefox's UI, turning it into an awful clone of Chrome. They've injected unwanted shit like Pocket and Hello into Firefox by default. They even put ads into the browser itself, although rumor has it they finally realized how fucking idiotic this was and are removing them. They've removed useful options from the preferences window. And despite making all of these changes that users don't want, they never seem to get around to fixing the longstanding memory and performance issues that have plagued Firefox for years.

The mandatory extension signing bullshit they've got in the works, along with changing to Chrome's extension model at some point, will utterly destroy Firefox's usability I think. The inconvenience these changes will bring to Firefox's few remaining users and extension developers will likely be enough to push them away completely. Firefox's 8% of the browser market will likely drop to the low single digits far quicker than anyone will have imagined.

To make matters worse, Mozilla has wasted a huge amount of time and effort on the Rust programming language and the Servo browser engine. In my view, Rust is a totally failed attempt to replace C++ with a "safer" language. I think that all they've managed to create is a language with an ugly syntax (even by C++'s standards!), an impractical ownership system, a single slow implementation (which itself is quite buggy despite being written in Rust, a language that's supposed to avoid this!), a rather awful standard library, and a questionable community that's highly focused on codes of conduct and censorship in the name of "tolerance" and "diversity".

Servo, which is written in Rust, is abysmal in my experience. I tried it last week, and I think I'd get better results using IE 3 today. Hell, Servo wouldn't even render any page for me for more than a minute before it crashed! Despite all of the hype around it, it fails to deliver even a 1990s browser experience.

In my opinion, things are looking extraordinarily bleak for Mozilla. They've ruined Firefox for so many users already. The replacement is going absolutely nowhere. And now it appears that they're going to make the Firefox experience even worse for the few users who remain! It's unbelievably sad what's happening to Firefox and Mozilla.

"the allowed it", "an self-contained"

[Anonymous Coward]

Stupid Americans...

Re:"the allowed it", "an self-contained"

[Anonymous Coward]

I know, google translate sucks.

Re:COB: Corporate Overreach Blocker has detected..

[BronsCon]

the censors at google are about to delist my website

Your corporate overreach blocker can't block that? Garbage.

Re:Code signing is the final nail in Firefox's cof

[Anonymous Coward]

Ignoring how inaccurate browser market share surveys are, 8% = hundreds of millions of users. People are free to flock to whatever crap they want, be it Chrome or Justin Bieber. It's funny you think people abandoned Firefox because of the UI changes--yeah, people left for Chrome because they didn't like Firefox's new Chrome-like UI. Or because of ads in the home screen they went running to an ad agency's browser out of protest.

By and large people are unsophisticated and just use default software and default settings. With Google's aggressive pushing of Chrome from many of its services (search engine, GMail) and bundling it in many software installers to automatically install unless you unchecked the box (just like sneaky malware or annoyances like Ask Toolbar used to do), it's not very surprising Chrome has a lot of users. It turns out all browser are pretty usable these days and most people will use whatever is in front of them. So what if only a few hundred million use Firefox? Who cares if in a few years it's only a million people that give a shit about their privacy or the open web and use Firefox? Sure it would be a shame because it's a good browser and others are missing out and Firefox's market share used to be huge, but continuing to serve millions is still an important job.

I don't want to seem an apologist for Mozilla--I have my criticisms. I just find your whining and doom-and-gloom annoying. Are you aging and can't deal with change? Australis was a shock at first but comparing it to Seamonkey's, the new UI is way the hell better. Pale Moon's is good too, it's frozen in time between the two. I also have Firefox Developer (46.0a2) installed and the UI is great with and without Tree Style Tabs. Their efforts to make the UI more responsive are paying off. If you want a traditional file menu for the rare time you need it, tap the 'alt' key.

The ads in the home screen were annoying, but easily toggled off. It's also annoying they have Yahoo as the default search provider when providers like DuckDuckGo exist which return vastly superior results and share similar missions as Mozilla. Pocket also seems unnecessarily bundled and a privacy concern. Hello (Telefonica) I have no real issue with other than the dumb name--a lot of people want videochatting and Hello bundled makes it very easy. I prefer it over Skype. The crux of all these issues is money--how to pay developers to continue improving the browser. I don't have a good solution. So I understand that they want to try out different things, I just think they need to listen to user feedback and be transparent about it (e.g. if Pocket paid them, just admit it). If Pocket didn't pay, and even if they did, it should probably be an installed-by-default add-on so it can be easily disabled, rather than integrated like it is.

It's strange you're so critical of Rust and Servo. Do you understand what research is? I think it's awesome that a company is willing to support essentially basic computer science research for many years without need for an immediate product. Part of it is they have a small team on each project so it's slow but steady work. I think the ideas behind Rust are very important and worth investigating. Look at it like research (which it is). It really doesn't matter if that lab specifically cures cancer or makes your dick longer or whatever, the goals are worth looking into and others are going to learn from the experiment and build off it. And Mozilla's end product might just be great. Swift has already borrowed some concepts from Rust and it's really easy to embed Rust into other languages. Concurrency sucks hard in most languages--I don't have a final verdict on Rust yet but it's worth checking out. There are also research groups trying to prove (or disprove) Rust's claims to safeness. This is cool shit, or do you think how the world was when you were growing up was the perfect world? We had perfect browsers and our understanding of math and computation then is all that's needed so let's not think about anything new or try to

Danke, GEMA

[Knuckles]

n/t

Re:COB: Corporate Overreach Blocker has detected..

[lgw]

But can your corporate overreach blocker do everything that hosts files can?