Mozilla silently bans 2 anti-state-censorship add-ons in Russia
discourse.mozilla.orgI'm the author of "Runet Censorship Bypass". We help Russians to circumvent state censorship while with some tricks the extension may also be used to bypass private discrimination or sanctions-based censorship.
We received no notifications about this restriction. Waiting for the official statement or just any comment from Mozilla.
This is terrible. I really hope there's a good explanation and it's restored quickly.
I hope you live outside of russia.
https://wiki.mozilla.org/Add-ons/Extension_Signing
> Is this a way for Mozilla to censor add-ons they don't like, enforce copyright, government demands, etc.?
> No, the purpose of this is to protect users from malicious add-ons. We have a set of guidelines (https://developer.mozilla.org/en-US/Add-ons/AMO/Policy/Revie...) for when it is appropriate to blocklist an add-on and have refused multiple times to block for other reasons.
Is Mozilla refusing to sign the add-on? Or just refusing to host it on addons.mozilla.org? There's a big difference. If the extension can still be signed, it's easy to install on production Firefox builds. If it can't be signed, then it can only be installed on Nightly or Developer builds with xpinstall.signatures.required disabled in about:config.
Looks like the extensions are still available in the US: https://addons.mozilla.org/en-US/firefox/addon/censor-tracke... https://addons.mozilla.org/en-US/firefox/addon/%D0%BE%D0%B1%...
So it looks like they are still signed, but they are not available on amo in Russia. The extensions can still be installed on production Firefox builds if they are hosted elsewhere, such as:
Runet Censorship Bypass: https://files.catbox.moe/g7mww2.xpi
Censor Tracker: https://files.catbox.moe/37grym.xpi
Publishing a Mozilla-signed XPI outside of AMO is a breach of ToS, and can lead to being removed from the AMO.
Source? I’m not aware of that restriction.
Self-hosting xpi files is definitely allowed, and all xpi files are signed by Mozilla. https://extensionworkshop.com/documentation/publish/self-dis...
They threatened me here: https://github.com/orgs/ActivityWatch/discussions/818#discus...
See https://extensionworkshop.com/documentation/publish/signing-...
My previous statement was overly broad, but the restrictions do apply to rejected xpis.
So posting the contents of my ~/.mozilla/firefox/default/extensions/ on GitHub is going to remove all of them from the store? Goodness, I wonder why no one thought of that until now.
Yeah sorry I used imprecise language see: https://news.ycombinator.com/item?id=40766705
files.catbox.moe is blocked in russia. You should use litterbox.
Assuming the bans are at Russia's request, what's the worst Russia could do if Mozilla refused to comply?
Russia could block mozilla.org (in which case 1000s of clones would likely emerge). Mozilla is a not for profit. Why not simply ignore such requests..
> what's the worst Russia could do if Mozilla refused to comply?
The worst? Probably murder.
https://en.m.wikipedia.org/wiki/List_of_Russian_assassinatio...
https://en.m.wikipedia.org/wiki/Suspicious_deaths_of_Russian...
You're probably mixing that up with jumping out of the window.
More likely one shooting oneself in the back, assisted by a Russian agent.
Nah. Polonium BBs being injected into your calf. They’re so much more fun.
/s
You can’t prove murder. Mozilla employees simply enjoy swimming while duct taped to lawn chairs.
I absolutely hate what Putin and his goons are doing to Ukraine and Russia.
Having said that the list contains many names of people who would be hunted and killed by any government. Imagine Apache starting revolt, murdering civilians, keeping / trading slaves, cutting heads etc. etc. Whoever the author of the article is - they did a shitty job.
This list is a big disservice to true victims of Putin, like Navalny and the likes.
OK, I'm imagining people defending their homelands against invaders.The Apache tribes fought the invading Spanish and Mexican peoples for centuries. The first Apache raids on Sonora appear to have taken place during the late 17th century. In 19th-century confrontations during the American Indian Wars, the U.S. Army found the Apache to be fierce warriors and skillful strategists.I am talking about now. In the end Indians were conquered with all the consequences. If they wake up now and start the war for independence it will be exactly the same situation as with Chechnya with exactly the same results.
> it will be exactly the same situation as with Chechnya with exactly the same results
Chechnya was pacified with regular significant money transfers to the strongman at the head. Indians, hmm...
This would be just speculation, and I could be way off base. This would also be assuming that Mozilla is looking out for the best interest of users, which may or may not be the case.
We saw that when companies like McDonalds could no longer operate in Russia, Russia essentially took the McDonalds and created a knock-off. If Russia decided to ban Firefox, they may just fire up a knock off and sell it to the populace as Mozilla is an evil American corporation so they have created RuskieFox and all that national pride stuff. Would tech saavy people trust the Russian knock off? My guess is the tech saavy people won't and will find ways to get firefox from Mozilla. But the non-tech saavy? Probably not. From this, if we assume Mozilla is doing what it can to protect users (which may or may not be the case), it would be better to comply but Russians get official builds of Firefox than being banned and the Russian government replacing Firefox with their own build.
There's already a Yandex browser, there's no need for a Firefox knock-off.
> Would tech saavy people trust the Russian knock off?
No one with a single brain cell uses the Yandex web browser. It's akin to giving the Russian authorities full access to your entire web presence.
> But the non-tech saavy?
For those Firefox has never existed. Most people in Russia use: Yandex web browser, Opera or Google Chrome.
> From this, if we assume Mozilla is doing what it can to protect users (which may or may not be the case), it would be better to comply but Russians get official builds of Firefox than being banned and the Russian government replacing Firefox with their own build.
Mozilla loses nothing from not complying but gains reputation and trust of not sharing the bed with Putin.
> No one with a single brain cell uses the Yandex web browser. It's akin to giving the Russian authorities full access to your entire web presence.
In Russian Hacker News, someone is saying the exact same thing about Google Chrome.
> Why not simply ignore such requests.
Because no one is helped by that, least of all Russian people wanting to use Firefox. It seems fairly obvious that "all of Firefox is not available in Russia" is worse than "two extensions are not available in Russia".
It is not "all of Firefox is not available in Russia," as there will be unofficial mirrors, torrents, etc. But I hear you, it's indeed better to have two extensions available from unofficial sources only than the whole ecosystem.
Mozilla shared this yesterday in the ama
Here's the statement we're sharing with the press:
In alignment with our commitment to an open and accessible internet, Mozilla will reinstate previously restricted listings in Russia. Our initial decision to temporarily restrict these listings was made while we considered the regulatory environment in Russia and the potential risk to our community and staff.
As outlined in our Manifesto, Mozilla's core principles emphasize the importance of an internet that is a global public resource, open and accessible to all. Users should be free to customize and enhance their online experience through add-ons without undue restrictions.
By reinstating these add-ons, we reaffirm our dedication to:
Openness: Promoting a free and open internet where users can shape their online experience.
Accessibility: Ensuring that the internet remains a public resource accessible to everyone, regardless of geographical location.
Mozilla is starting to seriously have a long list of highly questionable if not directly user hostile behaviors. They are hiding behind the fact that they are the almost only viable alternative to the chrome ecosystem... But they may well loose that advantage. What should we think of their VPN they try to promote so much if they bow to Russian demands for blocking extensions...
Starting? Remember the time they silently installed an extension written for a TV network?
The project manager for it used to work in the advertising industry. When the ticket was filed in Bugzilla, she quickly set it to be private to try and hide it. Another mozilla employee put it back to public, and then the ticket was set such that not even employees could see it by Mozilla executive leadership.
How about them ramming Pocket down everyone's throats?
Or the 2022 "partnership" with Facebook over an advertising a "privacy preserving" advertising standard?
How about the CEO's astronomical pay increases while market share sank? How about the fact that they now have a billion dollars in assets, half of that in cash? And they slashed their software development budget a year or two ago? And paid someone ~350,000+ to write an "AI and racial justice" report?
https://lunduke.locals.com/post/4387539/firefox-money-invest...
And then there's the partnership with an identity protection service (why the fuck is a browser company getting involved in that!?) whose CEO was running people-search network sites https://krebsonsecurity.com/2024/03/mozilla-drops-onerep-aft...
Any alternatives to Firefox worth exploring where users are the customers and you can pay for the product instead of being sold as one?
I have good expirience with Vivaldi. Yes, Chromium based, but very-very customizable, a bit slower than other browser, again because of customizations, but in general it looks like they believe that user know what he/she is doing.
An independent browser engine is top reason I use Firefox. Anything based on Webkit/Blink is just reinforcing the monoculture and further locking out alternatives.
I don't know honestly. I don't like what Mozilla is doing with Firefox, and I'm not sure that we should support it.
Clearly we have different priorities and I've failed to convince you. Which is fine.
Hopefully enough folks do prioritize browser engine diversity, so we aren't stuck with no significant alternative.
> Clearly we have different priorities and I've failed to convince you.
Im not sure that we should support one "not the best" company just because other company definitely worse.
If you feel that strongly, there are other non-Webkit/Blink options besides Firefox.
Kagi has their own browser called Orion, their whole business model (including search) is that you pay for it instead of you being sold.
Unfortunately, it's iOS only and based on WebKit.
There's definitely an opportunity here, maybe using Servo as the browser engine.
> it's iOS only
It's available on macOS as well: https://kagi.com/orion/#download_sec
Sorry, should've said Apple only.
LibreWolf, Mullvad Browser, Brave, Chromium
WaterFox
> Mozilla is starting to seriously have a long list of highly questionable if not directly user hostile behaviors.
Would you care to provide examples? I am a longtime user of Mozilla products unfamiliar with the topic and I am genuinely curious.
> What should we think of their VPN they try to promote so much
Mozilla does not have its own service but rather resells Mullvad, one of the most privacy focused services in existence. Is there more to this story that I am unaware of?
Allow me to add this to the other sibling comments: Pocket was an... interesting series of choices.
"""
Mozilla replaced a feature that was end to end encrypted with one that sent private data to a third party for data mining. They denied getting paid for the integration. That was technically true. They eventually admitted they got paid for referrals. They bought the company in 2017 and promised to release the source code. They still haven't. The Pocket website says "as a member of the Firefox family, privacy is paramount."[1] The first part is misleading and the second part is simply false.
"""
Open Sourcing something is never a easy task especially if it calls for a complete rewrite which i assume is why it still has not been open sourced yet
Really? I'm genuinely unaware, what would make it difficult? In what situations would it require a rewrite?
Buying a technology company, they buy a proven idea. If the bought tech has a diffrent stack than everything else Mozilla already had then rewriting it is going to be a good long term idea.
User hostile: restricting browser customization
Enlighten us. What's that long list of questionable behaviours?
The ones that angered me were the surveillance and the inclusion of closed source DRM. Enough to get me to switch to LibreWolf.
> inclusion of closed source DRM
Because what people really want is a browser that can't use Netflix or Spotify...
Firefox would no longer exist today if they hadn't included DRM. Ideological purity is fun and all, but it's perhaps a good idea to occasionally recognize reality.
I would also never pay for DRMed media, so LibreWolf is a good fit for my use case. I don’t decide any one else’s use case.
Don't forget the Mr. Robot malware.
> inclusion of closed source DRM Do you think if DRM is not included, will Firefox still retain 3% usage across the world?
https://gs.statcounter.com/browser-market-share
Let's put it bluntly, but libre principle does not live well with consumerism of the modern world.
So in exchange for their principles, they got to keep 3 whole percent of the market? That's a victory?
I think that's a poor argument. However, I think the stronger argument is that in this case it's actually relatively okay. Like, it'd be a better world if DRM didn't exist, but given that they lack the market power to do anything about that, EME actually seems like the least bad option:
* It's sandboxed.
* It's optional and doesn't run by default.
* Firefox prompts the user and asks if they want to run the DRM.
In fairness, I understand that there are different views on this; I stop one tiny half-step shy of the GNU/FSF position, in that I would argue that people should have complete control of their machines, but that that includes the right to run software that doesn't respect their right to control the machine.
The close sourced DRM is necessary for Netflix and a bunch of other apps, Also its provided for free to mozilla by google + cisco
Hello folks, latest update available here: https://discourse.mozilla.org/t/the-censorship-circumvention...
ublock origin is blocked in china, in same way.
otherwise the whole amo would be blocked.
that's not even relevant since couldn't you just run adblocking dns script as cronjob with list of ad domains like here? https://raw.githubusercontent.com/StevenBlack/hosts/master/h...
how china blocks that? ublock sucks anyway if you're using 127.0.0.1:53 with unbound/dnscrypt or something
ublock blocks html element in a browser, dns blacklists stop resolution. they’re clearly not the same.
With all the criticism of Mozilla here, it wouldn't be any help to keep these few extensions available, and get the whole website blocked. It's possible to get addons signed and distribute it on other websites. On the other hand, when Apple complies with demands, there's no way to install apps anymore.
Does Mozilla have any assets or workers located in Russia? If yes, this could be the reason, as the censors won't hesitate to go after them, and the law in Russia is whatever Kremlin says it is. If there aren't then it's just unbelievable cowardice which lacks any explanation.
> Does Mozilla have any assets or workers located in Russia?
Nothing.
You know where all of Mozilla's 1000+ employees are right now? Good for you.
Then I suspect it's just cowardice.
Mozilla does all sorts of problematic things all the time, but none of them have been as ethically terrible as this. I hope this is a temporary misunderstanding.
And you cannot install dev extension in mozilla like chrome without uploading in addons hub. Mozilla is becoming to bad these days.
Not true, you can simply use an xpi file, without signature even when a flag is set.
https://support.mozilla.org/en-US/kb/add-on-signing-in-firef... seems to say that the normal release of Firefox can't install unsigned XPIs
I think we're at the point where we need to ask, how the fsck supposedly "open browser" prohibits their own users from installing extensions they want to install? I mean, I get signing - if you want signing, you can use it. I even get the config option for enterprise setups, maybe - so if an org wants to standardize on Firefox and prohibit workers from installing unsigned extensions - fine. But when it comes to my own install, that's just bullshit.
It's a trade off between security for normies and power for technical users. I disagreed at the time (as an addon author) yet have come around to agreeing with the choice.
Normies don't know what the "addon" is and likely would have IT to install them anyway.
It's not IT. It's the "potentially unwanted software" installers they download. There's no way to distinguish a user installing an unsigned addon vs some malware doing so.
If you're already running an unverified third-party installer, your system is gone. There's nothing Firefox addon signing can do to save you at that moment. You are already at the "running arbitrary code" stage.
If you modify the AppConstants file (inside omni.ja) you can install unsigned extensions anyway:
https://gist.github.com/TheBrokenRail/c43bf0f07f4860adac2631...
That link appears to describe a process for patching the Firefox package. That does not strike me as a reasonable solution.
I didn't say it was reasonable, just that it's an option.
Sorry, dev and nightly, but that doesnt impact browser experience otherwise.
Using pre-release versions absolutely is different
Is there a way to side-load Mozilla extensions and circumvent their store? We see now that any central-authority store is a net negative for online freedoms and rights.
Firefox will happily install anything signed by Mozilla.
You just have to download it somewhere.
The browser extension which might be useful only in Russia suddenly stopped being accessible from Russia? Seems like a possible source of income for the corporation.
uBlock Origin is ban in china
Mozilla: we're all for freedom & users privacy, but Putins regime pays us too much money!
This is a new low for Mozilla.
MAANG and quasi-nonprofit husks of former megacorps aren't your friends. They tend to do the bidding of authoritarian regimes, enable genocides like Myanmar, and disclose metadata facilitating the targeting of civilians.
Pecunia non olet
This sort of thing is exactly why browser extensions never should have required Mozilla's "approval" in the first place; forcing people onto beta or developer builds to have proper control over their own software is an appalling failure to live up to their stated ideology. If they wanted to "protect" average users, they could have defaulted to only allowing approved extensions and made it clear how to opt out for users who wish to do so.
This sort of condescending, controlling, anti-user behavior was one of the reasons I left Mozilla, and the politically/culturally difficult situations it puts them in are a bed they have, unfortunately, made for themselves.
Deep breath... the extensions are still signed.
If Mozilla refuses to sign the extensions, then we can pick up the pitchforks again.
What other browser might you recommend other than Firefox?
The depressing truth is I can't recommend anything. Firefox soft-forks can easily allow unrestricted use of web extensions, but I haven't kept up with which ones are popular and actively maintained so I can't recommend anything specific. If Mozilla ends up standing behind this decision I guess it'll be time to do some research.
Mozilla has been problematic for a while now, both with personnel having some... strong political ideas, their governance, executive pay, product direction....
Ugh, I don't want to go back to a chromium based browser but I don't know how what other options I have at this point, short of dropping down to links/lynx/elinks ..
I was told recently that their executives attempted to start an AI initiative without involving anyone from their data engineering team.
firefox could have some of the wackiest politics in the world but that fact remains that Google/Chrome is one of the key linchpins for the global corporate surveillance capitalism panopticon that we have today.
I still feel like it's an easy recommendation compared to the rest of the browser market.
what's wrong with strong political ideas, as long as they're the right ones?
> as long as they're the right ones?
Which ones are the right ones? Yours? Mine?
I honestly can't tell it the was meant sarcastically.
Who defines what the "right" political idea is? And do you really want to live in a society limited only to ideas that are deemed as the "right" ones by whoever has that power?
That's kind of how society works and why we have democracy.
What do you mean? Who defines the "right" political ideas in a democracy?
My understanding is that a democracy would exist to allow the majority of a society to define what they want, and that in the US we have a democratic republic because our founders still didn't trust the public enough to leave decisions entirely to a majority vote of the public.
Ladybird browser.
Not yet usable for any real work.
You can do the same with Firefox. Simply use Beta, Dev Edition or Nightly. The first two are very stable. You just need to flip `xpinstall.signatures.required` to `false` in about:config.
I plainly stated that in my original post:
> ... forcing people onto beta or developer builds to have proper control over their own software ...
1. It was for squingz 2. No one is forcing you to use Firefox. You don't even pay for it. You should have read the Open Source license buddy.
I'm stating my opinion, not asking for a refund.
As far as I know, installing unsigned extensions is also possible in ESR builds, in Firefox from Linux distributions, in Unbranded Builds from Mozilla (but I'm not sure if they keep older versions). In forks and in your own Firefox builds (from source).
The answer people don't want to hear is that the answer is to abandon the web. The standards are too complicated and evolve too fast. It costs too much. The bills have to be paid and that means everyone has to sell the users out "just a little bit, but at least we are better than the other guy".
Ungoogled-Chromium. Literally the only way to install extensions on it is to sideload them. But of course, it won't survive the Manifest-V3 onslaught.
I wish some talented bunch of people forked Brave to allow sideloading extensions and strip it of the crypto stuff.
Thorium, Mercury, or LibreWolf.
Fennec
> browser extensions never should have required Mozilla's "approval" in the first place;
You don't need Mozilla's approval; anyone can publish an add-on anywhere and anyone can install it in Firefox. I've distributed some bespoke non-public addons like this.
It's just the Mozilla add-on website/listing that's curated, which seems reasonable; it's their website and they can have their rules.[1] You can make your own "clipsy add-on listing" website if you want.
[1]: in this case, it's not even "banned", just not displayed in Russia. It was probably a "ban these extensions or we'll ban all of Firefox" type scenario. Saying "njet" to Putin is tempting, but how does all of Firefox being banned in Russia help Russian people? It doesn't. You may not like the situation, but simplistic takes which simply ignore the reality of the situation are not serious.
The extension needs to be signed by mozilla for the normal production builds of firefox to let you load it on startup. If it isn't signed, you need to manually load it in using about:debugging each time you restart firefox.
Mozilla is not preventing from signing anything here (and the "security checks" on who can sign are so weak it might as well not exist in the first place).
Same applies to Chrome as well by that logic; it allows you to sideload unverified extensions too at the cost of annoyingly making you set it up at every startup.
I guess we're all better off using Chrome then?
Okay, but you've moved the goalposts from
> You don't need Mozilla's approval
to pointing out that Mozilla has approved (signed) this extension.
That's you're pedantically language-lawyering my post while not engaging with the far greater falsehood that the previous poster was perpetuating is not a good look.
And the reality is Mozilla can always block any extension they want. They can just change the Firefox source code. It doesn't matter what functionality does or doesn't exist now or what the policy they do or don't have – everything can always be changed. That's true for almost anything.
So what they "could do" is a complete distraction in the first place because the "could do" anything. What they ARE doing matters.
No, pointing out that your claims are conceptually false is a fine look.
It's not about things Mozilla could theoretically do to block you, it's that they require you to proactively get their permission to run an extension (in a prod version of the browser on an ongoing basis, which I think is reasonable table stakes). Here's their official docs for self-distribution, i.e. not using the AMO at all: https://extensionworkshop.com/documentation/publish/submitti... Notice that step 1 starts with giving Mozilla your extension to approve of, step 4 goes so far as to say that if your extension doesn't pass their checks then
> The message informs you of what failed. You cannot continue. Address these issues and return to step 1.
then step 7 is make sure Mozilla reviewers can read your source code, step 9 is wait for them to get back to you, and step 13 is download the XPI that Mozilla has approved to be allowed to run in their browser.
So yes, you absolutely need Mozilla's approval to publish an extension, even if you self-publish the XPI after they've blessed it. If they do not perform the action of signing it, they don't need to change any source code, it won't install. It may be true that in this case they have given that approval, but that doesn't invalidate the general point, and this is a fundamental restriction, not "language-lawyering".
I have to disagree that I'm perpetuating any falsehood here. Mozilla literally needs to approve an addon for it to behave normally. That you are satisfied with the process they have for approving doesn't change that.
To me it seems absurd for a company that claims to be so pro-privacy to not allow any genuinely private extensions to exist. Anyone who wants to make a 'real' addon has to share their code with mozilla.
I actually mostly had the top poster in mind, not you, sorry for the confusion.
What you're saying is technically true, but also not relevant, as explained. They can have the best system in place today, and just change Firefox tomorrow. So it doesn't really matter how the system works now. This is true for anything from Mozilla to XFree86 to Redis to left-pad.
De-facto reality is that right now anyone can create an account and just create a signing key and distribute their extensions $anywhere. Approval is little more than rubber stamp. Mozilla not going around granting "approval" or anything like that.
And they certainly didn't revoke the very weak "approval" here; people can distribute and install it. It's just not listed on the Russian add-on store. So that makes it doubly irrelevant.
> You don't need Mozilla's approval; anyone can publish an add-on anywhere and anyone can install it in Firefox.
Nope. Not on Android.
Yep, but you can use Fennec from FDroid.
how do i install xpi on fennec? i'm getting file not found when trying to open xpi with fennec app
Settings > About Fennec. Tap the logo five times to unlock the debug menu, then there will be an option to install addons from a file.
This addon cannot be installed because it has not been verified
thanks, didn't know about that. with all that censorship i been backing up a lot of programs and source tarballs locally. perhaps one day i'll go completely offline and off the grid and move to the mountains or some shit like Tuva where i will have goats and cows livestock. it's all getting so tiresome, i want out of this technological hell.
Yes, seems to be exact way out