329
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 24 Oct 2025
329 points (100.0% liked)
Firefox
21148 readers
21 users here now
/c/firefox
A place to discuss the news and latest developments on the open-source browser Firefox.
Rules
1. Adhere to the instance rules
2. Be kind to one another
3. Communicate in a civil manner
Reporting
If you would like to bring an issue to the moderators attention, please use the "Create Report" feature on the offending comment or post and it will be reviewed as time allows.
founded 5 years ago
MODERATORS

Well, I guess they could. But at least its in the rules and people can report. And if it indeed violates the setting, then the addon could be removed from the repository. So there is an incentive for addon developers not to break that "promise". At least this is the right direction.
Yes, but it's about the tiniest step they could possibly take. It just officially makes violating "trust me, bro" against the rules, but does absolutely nothing to prevent it, nor allow the user to directly prevent such abuse. Some extensions don't need Internet access at all, but there's no (easy) way to stop it from happening. Others only need occasional access for updates, but there's no user control for whether that's all they're doing.
Yes, it also narrows down the number of potential targets for analysis / report. If an extension is not marked "none" then no need to go out of your way to figure out if it does it.
For some extensions it might actually be relatively easy to figure out if they do communicate with an external server that they might not need to, specially considering that the extension format can easily be decompressed,
.crxfiles are justzipfiles with some javascript and other files inside.. they might want to obfuscate the logic, but it's not impossible to try and unravel things to some extent.