Not the answer

[tcaudilllg]

I am quite convinced at this point that the only real answer to this is to make a fork of Firefox that combines 19 and 14. This isn't as hard as it sounds... Firefox's code is pretty well documented and contrary to what Moz may imply, it doesn't change that often. The core is still held over from Netscape. The changes between the versions are so minor it would not be hard to restore the functionality of enablePrivilege. Mozilla as we know it is gone. The noble vision of Blake Ross.... corrupted beyond restoration. Like you said, this is a feudal fife governed by group-think. It's like Netscape all over again, and it will invariably suffer a similar fate. But in these times, people are afraid. Unless we wage the revolt... no one will. Only INTPs like us are so obsessed with abstracted responsibility that we'd go this far, am I right? ;)

I do think people inside Moz will help us if we ask. There are still a lot of rebels there, and even some arrogant enough to give us what we want if it'll shut us up. It might seem scary to not have Moz's security fixers at your back but these people really don't test their stuff to any meaningful extent. The security flaws are a result of their carelessness, and besides, it takes time to capitalize on them. There are other builds that aren't updated as often, and you don't hear complaints about them. It's not the end of the world.

But if we fight them here, it'll be a major coup for freedom. It'll change the whole web.

[brettz9]

As I am in China's timezone, it was night and I was exhausted, so I could not continue the conversation on the bug tracker, so my apologies for any frustrations you had in spending time to try to get it to work. I think my latest advice, to use the XPI from Github, will definitely solve your problem as that preferences issue was related to Firefox 19/20, which I fixed. If not, let me know.

I also agree with you as far as the fact that my addon could use a bit of a user-friendliness makeover, but my goal was to first implement a high and fine degree of control over security settings to overcome the objections of Mozilla toward getting the addon accepted at AMO, allowing the defaults to be strict so as to avoid too easy of social engineering by malicious hackers.

If AsYouWish can be hosted at AMO (and though I agree with you that their endorsement is not strictly necessary and I hope to persist regardless), we can thereby assuage some concerns users may have that the addon itself could be insecure or unsafe (as opposed to the potential for malicious sites to use AsYouWish to ask the user for permission to do bad things--which we unfortunately can't avoid here).

Once the granular level of control is completed (as mentioned, I still want to allow file and database access to be more specific if so requested), I think I may be able to focus on splitting up the dialog into a "Basic" and "Advanced" mode, so as not to deter people who just want to get going with the addon quickly (and I am open to suggestions or pull requests on how to better name or frame things).

My personal aim is to avoid personally taking too confrontational lines (though I admit I may have been a bit abrasive or at least intolerant and verbose in complaining to Mozilla from time to time, as I feel I think similar to you in the great importance of this issue), but I also support the goal of freedom, and think it can be best served by focusing our energy on working alternatives. That being said, if we can do it with Mozilla's blessing, even if their security review is not perfect, I think it should be a lot smoother for everybody, not only for their visible stamp of approval, but also for their own potential to keep in mind that this addon exists, is dependent upon their APIs, etc.

As far as forking Firefox to reapply enablePrivilege, I am afraid this is not within my competence, nor do I have time or energy to learn. Don't let me discourage you if you feel there is a need to do it, but I hope you will at least bear with me to get AsYouWish working, so you can make an informed decision (and perhaps enlighten me in turn as to deficits in my own approach).

I think my current approach in being a light wrapper for the SDK APIs has the following advantages:

1. Mozilla states that they intend these to be or become stable APIs, so they ought to be familiar to at least Firefox developers, and theoretically, become more well-thought out and friendly with practical experience of many consumers of the API over time, as well as being fairly well documented.
2. Assuming security policies do not interfere with our ability to wrap the SDK APIs and conditionally expose them to websites, my extension should need very little maintenance because Mozilla is already planning to maintain these APIs. I may only need to add explicit reference to newly created APIs from time to time (I can't (easily?) allow dynamic requiring of modules due to the static binding of require() statements in the SDK). The only known exception to this is that when the internal SDK code uses the instanceof operator to do checks, this does not work with the wrapped objects I supply to websites, so I have to modify the SDK code directly to avoid this. But that is not difficult either (just substitute their instanceof checks with duck-typing).
3. I think the avoidance of block-level permissions such as enablePrivilege in gaining privileges makes development easier. AsYouWish just works at the URL level. If the requesting URL is permitted, it can make requests anywhere in its code. On the other hand, that does require more care in avoiding XSS, etc.

[tcaudilllg]

I don't think users think Moz's approval matters (particularly not Firefox users). All they really want is indemnity... they think issues with Firefox will hurt the sales of their phones. They never should have gotten into the phone business... major tactical and moral error. Doubtless they're just being used by Google.

I've about isolated where the code is. The actual ability to work with files in Firefox is of course completely untouched... they've just removed the XPCOM wrapper. Trying to find where that wrapper is in FF14.... You know your add-on isn't gonna become anywhere near standard practice for users. They will eventually finish the file API (probably by 2015) and then we'll quite frankly use that. It would make more sense not to confront Moz, but the File API pointman in Moz by working to implement it ourselves. That will at least force him to get off his ass.

[brettz9]

"All they really want is indemnity". Who is the "they" here? I'm sorry, but I don't understand your argument. To me it is desirable to be able to have an open, JavaScript-hackable platform for use on mobile devices, consistent in approach with the desktop.

Thank you for your candor on AYW. It makes sense. I would indeed not expect any add-on to become standard practice. I do hope it provides something useful in the interim though (not only for file access, but for any privileged API access), including I hope more web developers leveraging it when packaging files for other developers that need to create files. Also, I'm not sure that the standardization process will ever be fully robust... Will one be able to create a cross-browser desktop browser with the finalized file API, for example? I am all in support of using standard means where present (I wish there wasn't any need for AsYouWish at all).

That is encouraging to hear of your apparent interest to help implement the file API. I really wish I could assist (my biggest interest is to see https://bugzilla.mozilla.org/show_bug.cgi?id=618354 implemented).

[brettz9]

Per your question on https://bugzilla.mozilla.org/show_bug.cgi?id=797443 . I've opened a GoToMeeting now as I am free to answer questions and I figure it should be less frustrating to have a chance to ask follow-up questions, etc. I'll hang around for a while so we can do a screen sharing audio session if you like. (If not, there are the docs or demos.)

1. Please join my meeting.
   https://www1.gotomeeting.com/join/412783505
2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.

Dial +1 (773) 897-3000
Access Code: 412-783-505
Audio PIN: Shown after joining the meeting

Meeting ID: 412-783-505

GoToMeeting®
Online Meetings Made Easy®

Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app.

[brettz9]

I closed the meeting, but let me know if you'd like to schedule a time. Or on Skype (brettz9).

[tcaudilllg]

Tomorrow same time would be fine. I'll make note.

[brettz9]

I guess you mean 9am China time +8 UTC when I sent the last invite? In case you're free now, I'll hang around a little while again at:

1. Please join my meeting.
   https://www1.gotomeeting.com/join/383380185
2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.

Dial +1 (773) 897-3015
Access Code: 383-380-185
Audio PIN: Shown after joining the meeting

Meeting ID: 383-380-185

GoToMeeting®
Online Meetings Made Easy®

Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app.

[brettz9]

I'll close the issue for now, but feel free to add further comments here.

[tcaudilllg]

Does this work on Firefox Mobile?

[tcaudilllg]

I was able to reuse the XPCOM API after obtaining chrome privileges. Thanks. :) Gamestar works now. 💃

I'd love to see Gamestar run in Firefox Mobile. I realize maybe you don't have a dog in that fight, but I'll perform the adaptation myself if necessary.

[brettz9]

As far as the XPCOM API, that is great--glad to hear it! If you haven't seen it already, there is a FAQ entry on XPCOM API usage: https://github.com/brettz9/asyouwish/wiki/Developer-FAQ

As far as Mobile, it appears that addons (as opposed to web apps) can currently only be made for Android and Maemo.

However, I suppose at least theoretically, AYW-like functionality could be added into the source code for the "Web browser" app of Firefox OS (if Mozilla isn't already planning some kind of addon system--from the current code, it doesn't appear so, though I've added a bug for it, along with requesting other related features, at https://bugzilla.mozilla.org/show_bug.cgi?id=848647 ), since everything is still built on top of Gecko (not sure if all XPCOM interfaces are available though). Source code of the browser is at https://github.com/mozilla-b2g/gaia/blob/master/apps/browser/js/browser.js (for the sake of interest (but not relevant to AsYouWish unless it was to allow APIs to overlay it), the source of the code showing the list of apps themselves is at https://github.com/mozilla-b2g/gaia/tree/master/apps/system ).

So I'm certainly interested to know what might be doable for mobile, yes, but it's not at the top of my current priority list--unless I might discover it will not be difficult/time-consuming to adapt.

If you decide to investigate, an overview of architecture is documented at https://developer.mozilla.org/en-US/docs/Mozilla/Firefox_OS/Platform/Architecture and there are some browser-specific docs at https://wiki.mozilla.org/Gaia/Browser and a proposed API for browsers at https://wiki.mozilla.org/WebAPI/BrowserAPI which Firefox OS' browser apparently already implements. Mention is made at https://developer.mozilla.org/en-US/docs/Apps/Manifest for "privileged" and "certified" type of apps which is what I believe the add-ons of "Web Browser" ought to run under (which perhaps they would automatically given that "Web Browser" is packaged as a "certified" app). Generic info on Firefox OS is at https://developer.mozilla.org/en-US/docs/Mozilla/Firefox_OS and the WebBrowser APIs are listed at https://wiki.mozilla.org/WebAPI/ .

Also, if in the unlikely event you happen to discover in the course of any investigation into the mobile browser, any way in which browser code might be applied to the desktop to allow independent browsing navigation controls on iframes (per my request at https://bugzilla.mozilla.org/show_bug.cgi?id=618354 ), I would be most grateful.

[brettz9]

If you like and it is ready for the public, you are welcome to send me a URL to Gamestar so I can add it to the list at https://github.com/brettz9/asyouwish/wiki/Published-apps-using-AsYouWish

[tcaudilllg]

It doesn't work on Firefox Mobile. I got an error: "This add-on is incompatible with Firefox 19". I got this error for both the current version and the one on AMO.

I'm honestly not sure why it doesn't work. Probably because it didn't have the mobile id in the install.manifest. May give that a try and see what happens.

As for Firefox OS, File API will probably be done by the time it ships..

[brettz9]

Which Firefox Mobile? There is no add-on capability in the new Firefox OS yet. Did you try in Firefox for Android? Also, are you using the add-on XPI from Github instead of AMO?

[tcaudilllg]

I downloaded FF for Android. That's what I got the error on. I tried both.

[brettz9]

Hmm, sorry, don't know about it.

[tcaudilllg]

Why not create an issue for Firefox for Android, and I'll ask someone from Moz to look at it? They may also know something about the Firefox OS plans.

[tcaudilllg]

Or if you have time, we can go over to Moz chat right now together and see if we can get attention.

[brettz9]

Sorry, busy these my day-times until Sunday.

[tcaudilllg]

I built AYW for mobile with the SDK ("cfx xpi --force -mobile"). It installed fine but even after setting things up on the options panel it didn't work. The permission dialog itself doesn't show and neither does the widget not the HTML panel.

[brettz9]

Although this was a year ago, I see per
https://blog.mozilla.org/addons/2012/02/06/mobile-add-on-development-using-the-add-on-sdk/
that only certain SDK modules were supported at the time. I would also
be hesitant to believe that all XPCOM APIs have been implemented (like
perhaps the notifications).

I'm afraid this is not high on my priority list at the moment, but
please feel free to send any questions if you start exploring the
Console errors to see why it's not working and need help understanding
the code.

Brett

On 3/9/2013 7:41 AM, tcaudilllg wrote:

I built AYW for mobile with the SDK ("cfx xpi --force -mobile"). It
installed fine but even after setting things up on the options panel
it didn't work. The permission dialog itself doesn't show and neither
does the widget not the HTML panel.

—
Reply to this email directly or view it on GitHub
#9 (comment).

[tcaudilllg]

I've been investigating all the alternatives, and it seems like the best
solution, as befits Mobile, is to just run Desktop Firefox with AsYouWish
on an emulated or co-booted Linux distro. Best mobile Firefox there is in
my opinion. :P

On Sun, Mar 10, 2013 at 8:18 AM, Brett Zamir [email protected]:

Although this was a year ago, I see per

https://blog.mozilla.org/addons/2012/02/06/mobile-add-on-development-using-the-add-on-sdk/
that only certain SDK modules were supported at the time. I would also
be hesitant to believe that all XPCOM APIs have been implemented (like
perhaps the notifications).

I'm afraid this is not high on my priority list at the moment, but
please feel free to send any questions if you start exploring the
Console errors to see why it's not working and need help understanding
the code.

Brett

On 3/9/2013 7:41 AM, tcaudilllg wrote:

I built AYW for mobile with the SDK ("cfx xpi --force -mobile"). It
installed fine but even after setting things up on the options panel
it didn't work. The permission dialog itself doesn't show and neither
does the widget not the HTML panel.

—
Reply to this email directly or view it on GitHub
#9 (comment).

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-14681207
.

[brettz9]

Nice to hear you found something that works. That does like a good solution, though I will try to keep my eyes open if chances permit on usage within Firefox for Android.

[tcaudilllg]

Having gotten fed up (and aware enough that I need authority from on high to get anywhere with official builds) I've done the standards people's work for them:

https://hacks.mozilla.org/2012/07/why-no-filesystem-api-in-firefox/comment-page-1/#comment-2041377

You support is suggested and would be appreciated.

[tcaudilllg]

So it seems Moz has left us on our own with respect to the addons issue.
I've looked over the Builder code ("Flight Deck") and got a sense for how
it works with the Add-on Builder Helper. The Helper does very little... it
does a few security checks and calls Jetpack if everything checks out. The
builder app is what creates the actual XPI. The builder is written in
Python, which is a problem for hosting. However, a replacement can probably
be made for PHP. It won't be as secure, but it won't matter because users
will be in charge of their own security. All that would be needed would be
to create a ZIP with Jetpack in it, the required directory structure, and
supporting files. The Builder could be modified to accept the created "XPI"
from the hosting website.

[brettz9]

Why not a fully client-side solution? Would be faster... If you don't want to have your users install AsYouWish, you could still build an add-on Builder in AsYouWish. :) Mozilla has the zip facilities to do this...

[tcaudilllg]

Well if it's got zip, that's all that's needed. I didn't think zip was
exposed to JS, though.

I have nothing against AsYouWish... simply an issue that most people trust
addons more. Seriously I have major issues getting users to install
AsYouWish. If it were any different I'd switch back to AYW in an instant.

On Wed, Jan 15, 2014 at 12:22 AM, Brett Zamir [email protected]:

Why not a fully client-side solution? Would be faster... If you don't want
to have your users install AsYouWish, you could still build an add-on
Builder in AsYouWish. :) Mozilla has the zip facilities to do this...

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-32335726
.

[brettz9]

As far as zip and Mozilla, I mean within an addon (or within AsYouWish), you could get access to: https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIZipWriter . However, it seems there are facilities now even in vanilla JavaScript to do zipping: http://stackoverflow.com/questions/2095697/unzip-files-using-javascript and http://stuk.github.io/jszip/ , for example, though I haven't used them.

Yeah, well, first of all, maybe I should remove some (though not all) of the scary warnings at the AsYouWish repo page. Are the issues you faced getting users to install because they are deterred by the concept or because they have difficulty figuring out how to use it?

[tcaudilllg]

Both. Most people won't bother with something that implies risk in the
context of computers.

On Thu, Jan 16, 2014 at 8:24 AM, Brett Zamir [email protected]:

As far as zip and Mozilla, I mean within an addon (or within AsYouWish),
you could get access to:
https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIZipWriter. However, it seems there are facilities now even in vanilla JavaScript to
do zipping:
http://stackoverflow.com/questions/2095697/unzip-files-using-javascriptand
http://stuk.github.io/jszip/ , for example, though I haven't used them.

Yeah, well, first of all, maybe I should remove some (though not all) of
the scary warnings at the AsYouWish repo page. Are the issues you faced
getting users to install because they are deterred by the concept or
because they have difficulty figuring out how to use it?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-32467996
.

[tcaudilllg]

Would be enough to modify the helper, I'd think. Of course, if you think
AsYouWish is the answer, maybe Firefox should push that. I think the
primary issue with it is that people aren't accustomed to using Firefox as
a replacement for their Windows apps. I have little doubt though that AYW
is safer... and besides, it's not like using you card at a regular merchant
is any safer than using it in a browser.

As regards modifying the helper, it would be easy to port my file access
routines from Gamestar. They're pretty simple and easy to use.

On Thu, Jan 16, 2014 at 11:58 AM, Anthony Caudill [email protected]:

Both. Most people won't bother with something that implies risk in the
context of computers.

On Thu, Jan 16, 2014 at 8:24 AM, Brett Zamir [email protected]:

As far as zip and Mozilla, I mean within an addon (or within AsYouWish),
you could get access to:
https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIZipWriter. However, it seems there are facilities now even in vanilla JavaScript to
do zipping:
http://stackoverflow.com/questions/2095697/unzip-files-using-javascriptand
http://stuk.github.io/jszip/ , for example, though I haven't used them.

Yeah, well, first of all, maybe I should remove some (though not all) of
the scary warnings at the AsYouWish repo page. Are the issues you faced
getting users to install because they are deterred by the concept or
because they have difficulty figuring out how to use it?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-32467996
.

[brettz9]

Good point about the relative safety of cards. What are you referencing by "modify the helper"? The readme or the zip libraries I mentioned?

[tcaudilllg]

Have you joined INTP group on Facebook? I think you'd find it useful.

I mean the addon builder helper addon that flightdeck used.

On Thu, Jan 30, 2014 at 1:52 AM, Brett Zamir [email protected]:

Good point about the relative safety of cards. What are you referencing by
"modify the helper"? The readme or the zip libraries I mentioned?

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-33664325
.

[tcaudilllg]

well we'd access the zip libs from within the helper via chrome. We could
attach a web page to the helper that would serve as the interface.

On Thu, Jan 30, 2014 at 8:44 PM, Anthony Caudill [email protected]:

Have you joined INTP group on Facebook? I think you'd find it useful.

I mean the addon builder helper addon that flightdeck used.

On Thu, Jan 30, 2014 at 1:52 AM, Brett Zamir [email protected]:

Good point about the relative safety of cards. What are you referencing
by "modify the helper"? The readme or the zip libraries I mentioned?

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-33664325
.

[tcaudilllg]

Brett,

I investigated some of my suspicions about mozilla recently. Particularly
regarding AsYouWish.

16:14 *** tcaud2 joined #amo-editors
Add-on code review discussions | Don't ask to ask | Mention the
name and ID of your add-on | See #amo for addons.mozilla.org site, #addons
for general add-on support, #extdev for extension development |
https://wiki.mozilla.org/AMO:Editors | Queue status: http://mzl.la/AMOQueues
Topic set by John-Galt on Mon Oct 01 2012 16:43:17 GMT-0400
(Eastern Daylight Time)
16:15 tcaud2 Hi, I'd like to discuss the AsYouWish addon.
16:23 tcaud2 It has received preliminary review.
16:24 tcaud2 It's function is to restore enablePrivilege, which was
removed as of Firefox 17.
16:33 jorgev what would you like to discuss?
16:33 tcaud2 I would like to discuss its prospects for approval.
16:34 jorgev full approval? I don't think that'll happen
16:34 *** JesperHansen quit (Ping timeout)
16:34 tcaud2 Why not?
16:35 jorgev because it's a power tool and potential footgun
16:35 jorgev we generally give those preliminary approval only
16:36 tcaud2 So let me get this straight: you're not going to even
give it the mark of trust that the tool does not steal a person's credit
card information?
16:37 tcaud2 I mean it's coming from some guy nobody knows, they have
to trust him personally, as it is, before even trying to use it as a power
tool.
16:38 tcaud2 I know how your process works. You have two stages:
preliminary, where you don't hardly even look it over, and full, where you
pour over it and study every aspect.
16:39 jorgev you don't know it very well then
16:39 jorgev preliminary approval does go through code review and we
make sure the add-on is safe to use
16:40 tcaud2 Then why do you state on the add button on MDN that it
hasn't been reviewed?
16:40 tcaud2 That's all end users see.
16:40 jorgev if it says it hasn't been reviewed it's because it hasn't
16:40 tcaud2 you're mixing words.
16:41 jorgev AsYouWish has not been reviewed
16:41 jorgev it is awaiting preliminary review
16:41 tcaud2 What further review do you need beyond assessing whether
it is safe?
16:41 tcaud2 No it's not.
16:41 John-Galt It is.
16:42 rctgamer3 It is.
16:42 jorgev
https://addons.mozilla.org/en-US/developers/addon/as-you-wish/versions
16:42 jorgev it has been, for a very long time
16:42 jorgev I'm not sure what is blocking its review, but maybe
John-Galt can clarify that
16:43 John-Galt The last time I reviewed it, it took an entire day,
and I haven't had an entire day to devote to it since then.
16:44 tcaud2 However, even after preliminary review is completed, it
states "the addon has not been reviewed by mozilla".
16:44 tcaud2 just below the button.
16:45 tcaud2 here's another example.
16:45 rctgamer3 tcaud2: After it has been preliminary reviewed, that
line will change
16:45 jorgev tcaud2:
https://addons.mozilla.org/en-US/firefox/addon/tree-style-tab/
16:45 jorgev that's how a preliminarily approved add-on looks like
16:47 *** fixanoid_ quit (Ping timeout)
16:50 tcaud2 yeah nevermind on that.
16:50 tcaud2 well when is the review?
16:51 *** JesperHansen joined #amo-editors
16:51 tcaud2 can you schedule someone to look at it?
16:51 jorgev the active admin reviewers are John-Galt and TheOne
16:51 jorgev it's up to them to make time for it
16:52 tcaud2 So you're not going to honor the expectation that it
would be reviewed in three weeks.
16:52 tcaud2 as AMO states.
16:53 tcaud2 which of course you are already hideously overdue.
16:53 John-Galt The ideal is 3 days. It's not a guarantee, and for
add-ons like this which require a thororugh security review, things can
take considerably longer.
16:54 tcaud2 So there's no time frame.
16:54 jorgev there's an approximation
16:54 jorgev and most add-ons are reviewed within those times
16:54 jorgev some take longer, some take much longer
16:55 jorgev especially for the first review
16:55 tcaud2 that's not the first review.
16:55 tcaud2 It was updated.
16:56 tcaud2 it's not a huge task.
16:56 tcaud2 I think you could finish it in a couple hours.
16:56 jorgev by first review I mean it hasn't been approved before
16:56 tcaud2 but it has been approved previously.
16:56 tcaud2 hasn't it?
16:57 John-Galt It hasn't
16:57 tcaud2 well it's been 9 months.
16:57 tcaud2 or thereabouts.
17:00 John-Galt It's true, I'd have liked it to have been reviewed
months ago. But it's been a busy year, and the several hours it would take
to review that add-on could be used to review dozens of others.
17:01 John-Galt I'm also not especially happy about the idea of that
add-on existing or being hosted on AMO, so it's not an especially high
priority. But I will get to it soon, now that queue lengths are relatively
low.
17:02 tcaud2 soon as in, two weeks?
17:02 John-Galt I can't give you a timeframe.
17:02 tcaud2 I don't believe you.
17:03 tcaud2 Be honest.
17:03 John-Galt shrug
17:04 TheOne he was
17:06 tcaud2 He's not honest about his intent to not review it.
17:07 John-Galt I think this conversation is over.
17:09 tcaud2 It's clear that you don't want to do it, hence you won't
do it unless someone forces you to. But you're the boss and you've
expressed your reservations, while manipulating the author of the addon.
You'd might as well be president telling the government not to observe a
law you don't like.
17:10 jorgev as much as I like fascism analogies, this is getting
very derailed
17:10 jorgev I acknowledge that the waiting time for your add-on has
been absurd
17:10 jorgev and I do think it should be reviewed soon (say, within
the next month)
17:10 jorgev but we can't give you any promises
17:11 jorgev also, given that your add-on is targeted to a very
specific audience, I wonder why it is so dependent on AMO
17:11 jorgev it's been around for over a year and has about 40 users
17:12 jorgev so I don't think it's than unreasonable for it to be a
low priority given its complexity and potential for security problems
17:12 tcaud2 because people associate AMO reviews with
trustworthiness.
17:12 tcaud2 but I'm done. I got what I came for.
17:12 tcaud2 BTW, I'm not the author.
17:13 rctgamer3 jorgev: replied to your needinfo
17:13 jorgev that's good to know

As I see it, there are two ways forward. Addons as we know them are
untenable... Jetpack is an irredeemable mess. I have identified several
individuals working at mozilla who cannot be trusted when it comes to user
rights.

In general, it seems like there are just a few dominant personalities
pulling all the strings at the point.

Mozilla is a paper tiger... they say they despise the NSA, but are no
better about user rights. Amidst my discussions with them and observations
of their conversations with other users, I've noticed a trend: the common
users ("fans") tend to object to many of the changes forced on them, while
the business users often express reservations but behave in a more
conciliatory and appeasing manner. Once they adapt to the change, they
withdraw their opposition and the absence of this opposition is pointed at
by the personalities behind the change in a bid to
guilt/persuade/goad/whatever their opposition into maintaining their
loyalty. But that string is running out fast, and Firefox is dying as a
consumer browser. People are migrating to Chrome, which will result in
pretty much the end of file access by websites as per Google's ambition. Of
course Mozilla will survive as a provider of "prototypes" for custom
business solutions (like yours), but when its US marketshare falls below
10% Google will pull their funding and Mozilla will regress to Safari/Opera
status as it had a decade ago.

In the US, anyway. In developing markets it aims to be a leader, and Google
might keep it around for that purpose. I'm not concerned about those
markets, though, but about the freedom of the US markets. The US is
devolving gradually into a police state.

On Thu, Jan 30, 2014 at 8:46 PM, Anthony Caudill [email protected]:

well we'd access the zip libs from within the helper via chrome. We could
attach a web page to the helper that would serve as the interface.

On Thu, Jan 30, 2014 at 8:44 PM, Anthony Caudill [email protected]:

Have you joined INTP group on Facebook? I think you'd find it useful.

I mean the addon builder helper addon that flightdeck used.

On Thu, Jan 30, 2014 at 1:52 AM, Brett Zamir [email protected]:

Good point about the relative safety of cards. What are you referencing
by "modify the helper"? The readme or the zip libraries I mentioned?

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-33664325
.

[tcaudilllg]

I'd like to stop the slide, but it's hard given the concerted undercover
efforts being made to impoverish enemies of the police state and keep them
from interacting with each other. There are many factors driving the
transition, to the point that many are unaware that they are participant in
it. It's a campaign of information suppression and opportunity constraint.
I realize the odds are high but I choose not to see them as they appear. I
will resist.

Regardless, I am firmly convinced that something must change in the browser
development sphere. Everything is riding on it.

On Fri, Jan 31, 2014 at 7:04 PM, Anthony Caudill [email protected]:

Brett,

I investigated some of my suspicions about mozilla recently. Particularly
regarding AsYouWish.

16:14 *** tcaud2 joined #amo-editors
Add-on code review discussions | Don't ask to ask | Mention the
name and ID of your add-on | See #amo for addons.mozilla.org site,
#addons for general add-on support, #extdev for extension development |
https://wiki.mozilla.org/AMO:Editors | Queue status:
http://mzl.la/AMOQueues
Topic set by John-Galt on Mon Oct 01 2012 16:43:17 GMT-0400
(Eastern Daylight Time)
16:15 tcaud2 Hi, I'd like to discuss the AsYouWish addon.
16:23 tcaud2 It has received preliminary review.
16:24 tcaud2 It's function is to restore enablePrivilege, which was
removed as of Firefox 17.
16:33 jorgev what would you like to discuss?
16:33 tcaud2 I would like to discuss its prospects for approval.
16:34 jorgev full approval? I don't think that'll happen
16:34 *** JesperHansen quit (Ping timeout)
16:34 tcaud2 Why not?
16:35 jorgev because it's a power tool and potential footgun
16:35 jorgev we generally give those preliminary approval only
16:36 tcaud2 So let me get this straight: you're not going to even
give it the mark of trust that the tool does not steal a person's credit
card information?
16:37 tcaud2 I mean it's coming from some guy nobody knows, they
have to trust him personally, as it is, before even trying to use it as a
power tool.
16:38 tcaud2 I know how your process works. You have two stages:
preliminary, where you don't hardly even look it over, and full, where you
pour over it and study every aspect.
16:39 jorgev you don't know it very well then
16:39 jorgev preliminary approval does go through code review and we
make sure the add-on is safe to use
16:40 tcaud2 Then why do you state on the add button on MDN that it
hasn't been reviewed?
16:40 tcaud2 That's all end users see.
16:40 jorgev if it says it hasn't been reviewed it's because it
hasn't
16:40 tcaud2 you're mixing words.
16:41 jorgev AsYouWish has not been reviewed
16:41 jorgev it is awaiting preliminary review
16:41 tcaud2 What further review do you need beyond assessing
whether it is safe?
16:41 tcaud2 No it's not.
16:41 John-Galt It is.
16:42 rctgamer3 It is.
16:42 jorgev
https://addons.mozilla.org/en-US/developers/addon/as-you-wish/versions
16:42 jorgev it has been, for a very long time
16:42 jorgev I'm not sure what is blocking its review, but maybe
John-Galt can clarify that
16:43 John-Galt The last time I reviewed it, it took an entire day,
and I haven't had an entire day to devote to it since then.
16:44 tcaud2 However, even after preliminary review is completed, it
states "the addon has not been reviewed by mozilla".
16:44 tcaud2 just below the button.
16:45 tcaud2 here's another example.
16:45 rctgamer3 tcaud2: After it has been preliminary reviewed, that
line will change
16:45 jorgev tcaud2:
https://addons.mozilla.org/en-US/firefox/addon/tree-style-tab/
16:45 jorgev that's how a preliminarily approved add-on looks like
16:47 *** fixanoid_ quit (Ping timeout)
16:50 tcaud2 yeah nevermind on that.
16:50 tcaud2 well when is the review?
16:51 *** JesperHansen joined #amo-editors
16:51 tcaud2 can you schedule someone to look at it?
16:51 jorgev the active admin reviewers are John-Galt and TheOne
16:51 jorgev it's up to them to make time for it
16:52 tcaud2 So you're not going to honor the expectation that it
would be reviewed in three weeks.
16:52 tcaud2 as AMO states.
16:53 tcaud2 which of course you are already hideously overdue.
16:53 John-Galt The ideal is 3 days. It's not a guarantee, and for
add-ons like this which require a thororugh security review, things can
take considerably longer.
16:54 tcaud2 So there's no time frame.
16:54 jorgev there's an approximation
16:54 jorgev and most add-ons are reviewed within those times
16:54 jorgev some take longer, some take much longer
16:55 jorgev especially for the first review
16:55 tcaud2 that's not the first review.
16:55 tcaud2 It was updated.
16:56 tcaud2 it's not a huge task.
16:56 tcaud2 I think you could finish it in a couple hours.
16:56 jorgev by first review I mean it hasn't been approved before
16:56 tcaud2 but it has been approved previously.
16:56 tcaud2 hasn't it?
16:57 John-Galt It hasn't
16:57 tcaud2 well it's been 9 months.
16:57 tcaud2 or thereabouts.
17:00 John-Galt It's true, I'd have liked it to have been reviewed
months ago. But it's been a busy year, and the several hours it would take
to review that add-on could be used to review dozens of others.
17:01 John-Galt I'm also not especially happy about the idea of that
add-on existing or being hosted on AMO, so it's not an especially high
priority. But I will get to it soon, now that queue lengths are relatively
low.
17:02 tcaud2 soon as in, two weeks?
17:02 John-Galt I can't give you a timeframe.
17:02 tcaud2 I don't believe you.
17:03 tcaud2 Be honest.
17:03 John-Galt shrug
17:04 TheOne he was
17:06 tcaud2 He's not honest about his intent to not review it.
17:07 John-Galt I think this conversation is over.
17:09 tcaud2 It's clear that you don't want to do it, hence you
won't do it unless someone forces you to. But you're the boss and you've
expressed your reservations, while manipulating the author of the addon.
You'd might as well be president telling the government not to observe a
law you don't like.
17:10 jorgev as much as I like fascism analogies, this is getting
very derailed
17:10 jorgev I acknowledge that the waiting time for your add-on has
been absurd
17:10 jorgev and I do think it should be reviewed soon (say, within
the next month)
17:10 jorgev but we can't give you any promises
17:11 jorgev also, given that your add-on is targeted to a very
specific audience, I wonder why it is so dependent on AMO
17:11 jorgev it's been around for over a year and has about 40 users
17:12 jorgev so I don't think it's than unreasonable for it to be a
low priority given its complexity and potential for security problems
17:12 tcaud2 because people associate AMO reviews with
trustworthiness.
17:12 tcaud2 but I'm done. I got what I came for.
17:12 tcaud2 BTW, I'm not the author.
17:13 rctgamer3 jorgev: replied to your needinfo
17:13 jorgev that's good to know

As I see it, there are two ways forward. Addons as we know them are
untenable... Jetpack is an irredeemable mess. I have identified several
individuals working at mozilla who cannot be trusted when it comes to user
rights.

In general, it seems like there are just a few dominant personalities
pulling all the strings at the point.

Mozilla is a paper tiger... they say they despise the NSA, but are no
better about user rights. Amidst my discussions with them and observations
of their conversations with other users, I've noticed a trend: the common
users ("fans") tend to object to many of the changes forced on them, while
the business users often express reservations but behave in a more
conciliatory and appeasing manner. Once they adapt to the change, they
withdraw their opposition and the absence of this opposition is pointed at
by the personalities behind the change in a bid to
guilt/persuade/goad/whatever their opposition into maintaining their
loyalty. But that string is running out fast, and Firefox is dying as a
consumer browser. People are migrating to Chrome, which will result in
pretty much the end of file access by websites as per Google's ambition. Of
course Mozilla will survive as a provider of "prototypes" for custom
business solutions (like yours), but when its US marketshare falls below
10% Google will pull their funding and Mozilla will regress to Safari/Opera
status as it had a decade ago.

In the US, anyway. In developing markets it aims to be a leader, and
Google might keep it around for that purpose. I'm not concerned about those
markets, though, but about the freedom of the US markets. The US is
devolving gradually into a police state.

On Thu, Jan 30, 2014 at 8:46 PM, Anthony Caudill [email protected]:

well we'd access the zip libs from within the helper via chrome. We could
attach a web page to the helper that would serve as the interface.

On Thu, Jan 30, 2014 at 8:44 PM, Anthony Caudill [email protected]:

Have you joined INTP group on Facebook? I think you'd find it useful.

I mean the addon builder helper addon that flightdeck used.

On Thu, Jan 30, 2014 at 1:52 AM, Brett Zamir [email protected]:

Good point about the relative safety of cards. What are you referencing
by "modify the helper"? The readme or the zip libraries I mentioned?

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-33664325
.

[tcaudilllg]

One that will happen if AYW gets approved: all the download sites will
crawl it and begin hosting it.

I'm really thinking that the thing to do would be to simply offer a version
of Firefox with AYW in it, and let users decide. Oh, and did you hear about
the plan to create a Flash-clone built-in to Firefox, complete with
official whitelists so the damn ads still show?

On Fri, Jan 31, 2014 at 7:11 PM, Anthony Caudill [email protected]:

I'd like to stop the slide, but it's hard given the concerted undercover
efforts being made to impoverish enemies of the police state and keep them
from interacting with each other. There are many factors driving the
transition, to the point that many are unaware that they are participant in
it. It's a campaign of information suppression and opportunity constraint.
I realize the odds are high but I choose not to see them as they appear. I
will resist.

Regardless, I am firmly convinced that something must change in the
browser development sphere. Everything is riding on it.

On Fri, Jan 31, 2014 at 7:04 PM, Anthony Caudill [email protected]:

Brett,

I investigated some of my suspicions about mozilla recently. Particularly
regarding AsYouWish.

16:14 *** tcaud2 joined #amo-editors
Add-on code review discussions | Don't ask to ask | Mention the
name and ID of your add-on | See #amo for addons.mozilla.org site,
#addons for general add-on support, #extdev for extension development |
https://wiki.mozilla.org/AMO:Editors | Queue status:
http://mzl.la/AMOQueues
Topic set by John-Galt on Mon Oct 01 2012 16:43:17 GMT-0400
(Eastern Daylight Time)
16:15 tcaud2 Hi, I'd like to discuss the AsYouWish addon.
16:23 tcaud2 It has received preliminary review.
16:24 tcaud2 It's function is to restore enablePrivilege, which was
removed as of Firefox 17.
16:33 jorgev what would you like to discuss?
16:33 tcaud2 I would like to discuss its prospects for approval.
16:34 jorgev full approval? I don't think that'll happen
16:34 *** JesperHansen quit (Ping timeout)
16:34 tcaud2 Why not?
16:35 jorgev because it's a power tool and potential footgun
16:35 jorgev we generally give those preliminary approval only
16:36 tcaud2 So let me get this straight: you're not going to even
give it the mark of trust that the tool does not steal a person's credit
card information?
16:37 tcaud2 I mean it's coming from some guy nobody knows, they
have to trust him personally, as it is, before even trying to use it as a
power tool.
16:38 tcaud2 I know how your process works. You have two stages:
preliminary, where you don't hardly even look it over, and full, where you
pour over it and study every aspect.
16:39 jorgev you don't know it very well then
16:39 jorgev preliminary approval does go through code review and
we make sure the add-on is safe to use
16:40 tcaud2 Then why do you state on the add button on MDN that it
hasn't been reviewed?
16:40 tcaud2 That's all end users see.
16:40 jorgev if it says it hasn't been reviewed it's because it
hasn't
16:40 tcaud2 you're mixing words.
16:41 jorgev AsYouWish has not been reviewed
16:41 jorgev it is awaiting preliminary review
16:41 tcaud2 What further review do you need beyond assessing
whether it is safe?
16:41 tcaud2 No it's not.
16:41 John-Galt It is.
16:42 rctgamer3 It is.
16:42 jorgev
https://addons.mozilla.org/en-US/developers/addon/as-you-wish/versions
16:42 jorgev it has been, for a very long time
16:42 jorgev I'm not sure what is blocking its review, but maybe
John-Galt can clarify that
16:43 John-Galt The last time I reviewed it, it took an entire day,
and I haven't had an entire day to devote to it since then.
16:44 tcaud2 However, even after preliminary review is completed,
it states "the addon has not been reviewed by mozilla".
16:44 tcaud2 just below the button.
16:45 tcaud2 here's another example.
16:45 rctgamer3 tcaud2: After it has been preliminary reviewed,
that line will change
16:45 jorgev tcaud2:
https://addons.mozilla.org/en-US/firefox/addon/tree-style-tab/
16:45 jorgev that's how a preliminarily approved add-on looks like
16:47 *** fixanoid_ quit (Ping timeout)
16:50 tcaud2 yeah nevermind on that.
16:50 tcaud2 well when is the review?
16:51 *** JesperHansen joined #amo-editors
16:51 tcaud2 can you schedule someone to look at it?
16:51 jorgev the active admin reviewers are John-Galt and TheOne
16:51 jorgev it's up to them to make time for it
16:52 tcaud2 So you're not going to honor the expectation that it
would be reviewed in three weeks.
16:52 tcaud2 as AMO states.
16:53 tcaud2 which of course you are already hideously overdue.
16:53 John-Galt The ideal is 3 days. It's not a guarantee, and for
add-ons like this which require a thororugh security review, things can
take considerably longer.
16:54 tcaud2 So there's no time frame.
16:54 jorgev there's an approximation
16:54 jorgev and most add-ons are reviewed within those times
16:54 jorgev some take longer, some take much longer
16:55 jorgev especially for the first review
16:55 tcaud2 that's not the first review.
16:55 tcaud2 It was updated.
16:56 tcaud2 it's not a huge task.
16:56 tcaud2 I think you could finish it in a couple hours.
16:56 jorgev by first review I mean it hasn't been approved before
16:56 tcaud2 but it has been approved previously.
16:56 tcaud2 hasn't it?
16:57 John-Galt It hasn't
16:57 tcaud2 well it's been 9 months.
16:57 tcaud2 or thereabouts.
17:00 John-Galt It's true, I'd have liked it to have been reviewed
months ago. But it's been a busy year, and the several hours it would take
to review that add-on could be used to review dozens of others.
17:01 John-Galt I'm also not especially happy about the idea of
that add-on existing or being hosted on AMO, so it's not an especially high
priority. But I will get to it soon, now that queue lengths are relatively
low.
17:02 tcaud2 soon as in, two weeks?
17:02 John-Galt I can't give you a timeframe.
17:02 tcaud2 I don't believe you.
17:03 tcaud2 Be honest.
17:03 John-Galt shrug
17:04 TheOne he was
17:06 tcaud2 He's not honest about his intent to not review it.
17:07 John-Galt I think this conversation is over.
17:09 tcaud2 It's clear that you don't want to do it, hence you
won't do it unless someone forces you to. But you're the boss and you've
expressed your reservations, while manipulating the author of the addon.
You'd might as well be president telling the government not to observe a
law you don't like.
17:10 jorgev as much as I like fascism analogies, this is getting
very derailed
17:10 jorgev I acknowledge that the waiting time for your add-on
has been absurd
17:10 jorgev and I do think it should be reviewed soon (say, within
the next month)
17:10 jorgev but we can't give you any promises
17:11 jorgev also, given that your add-on is targeted to a very
specific audience, I wonder why it is so dependent on AMO
17:11 jorgev it's been around for over a year and has about 40 users
17:12 jorgev so I don't think it's than unreasonable for it to be a
low priority given its complexity and potential for security problems
17:12 tcaud2 because people associate AMO reviews with
trustworthiness.
17:12 tcaud2 but I'm done. I got what I came for.
17:12 tcaud2 BTW, I'm not the author.
17:13 rctgamer3 jorgev: replied to your needinfo
17:13 jorgev that's good to know

As I see it, there are two ways forward. Addons as we know them are
untenable... Jetpack is an irredeemable mess. I have identified several
individuals working at mozilla who cannot be trusted when it comes to user
rights.

In general, it seems like there are just a few dominant personalities
pulling all the strings at the point.

Mozilla is a paper tiger... they say they despise the NSA, but are no
better about user rights. Amidst my discussions with them and observations
of their conversations with other users, I've noticed a trend: the common
users ("fans") tend to object to many of the changes forced on them, while
the business users often express reservations but behave in a more
conciliatory and appeasing manner. Once they adapt to the change, they
withdraw their opposition and the absence of this opposition is pointed at
by the personalities behind the change in a bid to
guilt/persuade/goad/whatever their opposition into maintaining their
loyalty. But that string is running out fast, and Firefox is dying as a
consumer browser. People are migrating to Chrome, which will result in
pretty much the end of file access by websites as per Google's ambition. Of
course Mozilla will survive as a provider of "prototypes" for custom
business solutions (like yours), but when its US marketshare falls below
10% Google will pull their funding and Mozilla will regress to Safari/Opera
status as it had a decade ago.

In the US, anyway. In developing markets it aims to be a leader, and
Google might keep it around for that purpose. I'm not concerned about those
markets, though, but about the freedom of the US markets. The US is
devolving gradually into a police state.

On Thu, Jan 30, 2014 at 8:46 PM, Anthony Caudill [email protected]:

well we'd access the zip libs from within the helper via chrome. We
could attach a web page to the helper that would serve as the interface.

On Thu, Jan 30, 2014 at 8:44 PM, Anthony Caudill [email protected]:

Have you joined INTP group on Facebook? I think you'd find it useful.

I mean the addon builder helper addon that flightdeck used.

On Thu, Jan 30, 2014 at 1:52 AM, Brett Zamir [email protected]:

Good point about the relative safety of cards. What are you
referencing by "modify the helper"? The readme or the zip libraries I
mentioned?

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-33664325
.

[tcaudilllg]

The problem, as I see it, isn't Firefox. The problem is that people are
using Firefox instead of something better. Need to get people talking about
something better, then it will materialize. Stopping that talk is what Moz
is most focused on right now, unfortunately.

On Fri, Jan 31, 2014 at 8:10 PM, Anthony Caudill [email protected]:

One that will happen if AYW gets approved: all the download sites will
crawl it and begin hosting it.

I'm really thinking that the thing to do would be to simply offer a
version of Firefox with AYW in it, and let users decide. Oh, and did you
hear about the plan to create a Flash-clone built-in to Firefox, complete
with official whitelists so the damn ads still show?

On Fri, Jan 31, 2014 at 7:11 PM, Anthony Caudill [email protected]:

I'd like to stop the slide, but it's hard given the concerted undercover
efforts being made to impoverish enemies of the police state and keep them
from interacting with each other. There are many factors driving the
transition, to the point that many are unaware that they are participant in
it. It's a campaign of information suppression and opportunity constraint.
I realize the odds are high but I choose not to see them as they appear. I
will resist.

Regardless, I am firmly convinced that something must change in the
browser development sphere. Everything is riding on it.

On Fri, Jan 31, 2014 at 7:04 PM, Anthony Caudill [email protected]:

Brett,

I investigated some of my suspicions about mozilla recently.
Particularly regarding AsYouWish.

16:14 *** tcaud2 joined #amo-editors
Add-on code review discussions | Don't ask to ask | Mention the
name and ID of your add-on | See #amo for addons.mozilla.org site,
#addons for general add-on support, #extdev for extension development |
https://wiki.mozilla.org/AMO:Editors | Queue status:
http://mzl.la/AMOQueues
Topic set by John-Galt on Mon Oct 01 2012 16:43:17 GMT-0400
(Eastern Daylight Time)
16:15 tcaud2 Hi, I'd like to discuss the AsYouWish addon.
16:23 tcaud2 It has received preliminary review.
16:24 tcaud2 It's function is to restore enablePrivilege, which
was removed as of Firefox 17.
16:33 jorgev what would you like to discuss?
16:33 tcaud2 I would like to discuss its prospects for approval.
16:34 jorgev full approval? I don't think that'll happen
16:34 *** JesperHansen quit (Ping timeout)
16:34 tcaud2 Why not?
16:35 jorgev because it's a power tool and potential footgun
16:35 jorgev we generally give those preliminary approval only
16:36 tcaud2 So let me get this straight: you're not going to even
give it the mark of trust that the tool does not steal a person's credit
card information?
16:37 tcaud2 I mean it's coming from some guy nobody knows, they
have to trust him personally, as it is, before even trying to use it as a
power tool.
16:38 tcaud2 I know how your process works. You have two stages:
preliminary, where you don't hardly even look it over, and full, where you
pour over it and study every aspect.
16:39 jorgev you don't know it very well then
16:39 jorgev preliminary approval does go through code review and
we make sure the add-on is safe to use
16:40 tcaud2 Then why do you state on the add button on MDN that
it hasn't been reviewed?
16:40 tcaud2 That's all end users see.
16:40 jorgev if it says it hasn't been reviewed it's because it
hasn't
16:40 tcaud2 you're mixing words.
16:41 jorgev AsYouWish has not been reviewed
16:41 jorgev it is awaiting preliminary review
16:41 tcaud2 What further review do you need beyond assessing
whether it is safe?
16:41 tcaud2 No it's not.
16:41 John-Galt It is.
16:42 rctgamer3 It is.
16:42 jorgev
https://addons.mozilla.org/en-US/developers/addon/as-you-wish/versions
16:42 jorgev it has been, for a very long time
16:42 jorgev I'm not sure what is blocking its review, but maybe
John-Galt can clarify that
16:43 John-Galt The last time I reviewed it, it took an entire
day, and I haven't had an entire day to devote to it since then.
16:44 tcaud2 However, even after preliminary review is completed,
it states "the addon has not been reviewed by mozilla".
16:44 tcaud2 just below the button.
16:45 tcaud2 here's another example.
16:45 rctgamer3 tcaud2: After it has been preliminary reviewed,
that line will change
16:45 jorgev tcaud2:
https://addons.mozilla.org/en-US/firefox/addon/tree-style-tab/
16:45 jorgev that's how a preliminarily approved add-on looks like
16:47 *** fixanoid_ quit (Ping timeout)
16:50 tcaud2 yeah nevermind on that.
16:50 tcaud2 well when is the review?
16:51 *** JesperHansen joined #amo-editors
16:51 tcaud2 can you schedule someone to look at it?
16:51 jorgev the active admin reviewers are John-Galt and TheOne
16:51 jorgev it's up to them to make time for it
16:52 tcaud2 So you're not going to honor the expectation that it
would be reviewed in three weeks.
16:52 tcaud2 as AMO states.
16:53 tcaud2 which of course you are already hideously overdue.
16:53 John-Galt The ideal is 3 days. It's not a guarantee, and for
add-ons like this which require a thororugh security review, things can
take considerably longer.
16:54 tcaud2 So there's no time frame.
16:54 jorgev there's an approximation
16:54 jorgev and most add-ons are reviewed within those times
16:54 jorgev some take longer, some take much longer
16:55 jorgev especially for the first review
16:55 tcaud2 that's not the first review.
16:55 tcaud2 It was updated.
16:56 tcaud2 it's not a huge task.
16:56 tcaud2 I think you could finish it in a couple hours.
16:56 jorgev by first review I mean it hasn't been approved before
16:56 tcaud2 but it has been approved previously.
16:56 tcaud2 hasn't it?
16:57 John-Galt It hasn't
16:57 tcaud2 well it's been 9 months.
16:57 tcaud2 or thereabouts.
17:00 John-Galt It's true, I'd have liked it to have been reviewed
months ago. But it's been a busy year, and the several hours it would take
to review that add-on could be used to review dozens of others.
17:01 John-Galt I'm also not especially happy about the idea of
that add-on existing or being hosted on AMO, so it's not an especially high
priority. But I will get to it soon, now that queue lengths are relatively
low.
17:02 tcaud2 soon as in, two weeks?
17:02 John-Galt I can't give you a timeframe.
17:02 tcaud2 I don't believe you.
17:03 tcaud2 Be honest.
17:03 John-Galt shrug
17:04 TheOne he was
17:06 tcaud2 He's not honest about his intent to not review it.
17:07 John-Galt I think this conversation is over.
17:09 tcaud2 It's clear that you don't want to do it, hence you
won't do it unless someone forces you to. But you're the boss and you've
expressed your reservations, while manipulating the author of the addon.
You'd might as well be president telling the government not to observe a
law you don't like.
17:10 jorgev as much as I like fascism analogies, this is getting
very derailed
17:10 jorgev I acknowledge that the waiting time for your add-on
has been absurd
17:10 jorgev and I do think it should be reviewed soon (say,
within the next month)
17:10 jorgev but we can't give you any promises
17:11 jorgev also, given that your add-on is targeted to a very
specific audience, I wonder why it is so dependent on AMO
17:11 jorgev it's been around for over a year and has about 40
users
17:12 jorgev so I don't think it's than unreasonable for it to be
a low priority given its complexity and potential for security problems
17:12 tcaud2 because people associate AMO reviews with
trustworthiness.
17:12 tcaud2 but I'm done. I got what I came for.
17:12 tcaud2 BTW, I'm not the author.
17:13 rctgamer3 jorgev: replied to your needinfo
17:13 jorgev that's good to know

As I see it, there are two ways forward. Addons as we know them are
untenable... Jetpack is an irredeemable mess. I have identified several
individuals working at mozilla who cannot be trusted when it comes to user
rights.

In general, it seems like there are just a few dominant personalities
pulling all the strings at the point.

Mozilla is a paper tiger... they say they despise the NSA, but are no
better about user rights. Amidst my discussions with them and observations
of their conversations with other users, I've noticed a trend: the common
users ("fans") tend to object to many of the changes forced on them, while
the business users often express reservations but behave in a more
conciliatory and appeasing manner. Once they adapt to the change, they
withdraw their opposition and the absence of this opposition is pointed at
by the personalities behind the change in a bid to
guilt/persuade/goad/whatever their opposition into maintaining their
loyalty. But that string is running out fast, and Firefox is dying as a
consumer browser. People are migrating to Chrome, which will result in
pretty much the end of file access by websites as per Google's ambition. Of
course Mozilla will survive as a provider of "prototypes" for custom
business solutions (like yours), but when its US marketshare falls below
10% Google will pull their funding and Mozilla will regress to Safari/Opera
status as it had a decade ago.

In the US, anyway. In developing markets it aims to be a leader, and
Google might keep it around for that purpose. I'm not concerned about those
markets, though, but about the freedom of the US markets. The US is
devolving gradually into a police state.

On Thu, Jan 30, 2014 at 8:46 PM, Anthony Caudill [email protected]:

well we'd access the zip libs from within the helper via chrome. We
could attach a web page to the helper that would serve as the interface.

On Thu, Jan 30, 2014 at 8:44 PM, Anthony Caudill [email protected]:

Have you joined INTP group on Facebook? I think you'd find it useful.

I mean the addon builder helper addon that flightdeck used.

On Thu, Jan 30, 2014 at 1:52 AM, Brett Zamir <[email protected]

wrote:

Good point about the relative safety of cards. What are you
referencing by "modify the helper"? The readme or the zip libraries I
mentioned?

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-33664325
.

[brettz9]

Busy at the moment, but plan to get back to you with more on this soon... That was some helpful information to have about the review status, as I hadn't been fully clear on that myself...

[tcaudilllg]

There may be an alternative. I had a discussion with DougT, the former
maintainer of Minimo, in which he explained the structure of the security
system. DougT is one of the best people at Mozilla... Knowledgeable,
fair... it's a shame he doesn't take a stronger role.

Anyway, he explained that there are two instances of Javascript running at
any given time: the scripts on the pages, and one running inside the
browser. This instance is the security principal which monitors the other
scripts, and is a part of the XPCOM wrapper system that enables pages to
invoke functions of the browser (coded in C++).
These scripts are all in the onmi.ja file, which is a Java jar archive.
One of them is the comptroller for chrome access privileges.

On Sat, Feb 1, 2014 at 8:45 PM, Brett Zamir [email protected]:

Busy at the moment, but plan to get back to you with more on this soon...
That was some helpful information to have about the review status, as I
hadn't been fully clear on that myself...

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-33889420
.

[tcaudilllg]

Nevermind. Tried fooling with those and Firefox crashed. Had to reinstall
even after reversing the changes.

A new tool is available which does you XPI building for you!
https://addons.mozilla.org/en-US/firefox/addon/xpicompiler/ . Glad we don't
have to do it ourselves. :P

On Sun, Feb 2, 2014 at 12:53 AM, Anthony Caudill [email protected]:

There may be an alternative. I had a discussion with DougT, the former
maintainer of Minimo, in which he explained the structure of the security
system. DougT is one of the best people at Mozilla... Knowledgeable,
fair... it's a shame he doesn't take a stronger role.

Anyway, he explained that there are two instances of Javascript running at
any given time: the scripts on the pages, and one running inside the
browser. This instance is the security principal which monitors the other
scripts, and is a part of the XPCOM wrapper system that enables pages to
invoke functions of the browser (coded in C++).
These scripts are all in the onmi.ja file, which is a Java jar archive.
One of them is the comptroller for chrome access privileges.

On Sat, Feb 1, 2014 at 8:45 PM, Brett Zamir [email protected]:

Busy at the moment, but plan to get back to you with more on this soon...
That was some helpful information to have about the review status, as I
hadn't been fully clear on that myself...

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-33889420
.

[brettz9]

Regarding full approval vs. preliminary approval, again thank you very much for getting this clarification. Mozilla documents this, but I hadn't been clear because my impression was that they weren't going to accept it which I had interpreted as meaning they wouldn't give even preliminary approval. I thought they had disapproved it but had just neglected to take it off AMO, but it appears the reason is just because they are still supposed to do a preliminary approval check which would be great (for reasons such as you aptly stated of people wanting to know that the add-on would not by itself steal their credit card info).

Why do you say "Addons as we know them are untenable..." and "Jetpack is an irredeemable mess"?

As far as security principal, FYI, in #4 , I am hopeful that we may have a way now to allow the DOM to become privileged as well (if approved by the user of course).

For WebAppFind as well as AsYouWish, I'd be interested in seeing the security principal be used, if it is possible, to optionally cause networking to be prevented or maybe preventing everything except a whitelist of sites where networking was allowed (I need to take a closer look at the suggestion at http://stackoverflow.com/questions/18369052/firefox-add-on-to-load-webpage-without-network-access ). Users would thus be able to get the benefits people with Mozilla have cited as existing for installed apps which would not exist otherwise for AsYouWish web apps: namely, that one could review the source code of just one version of a web app source code and trust that it wasn't going to be able to change into something insecure (or not need to review it at all if they were ok knowing there was no networking and the AYW privilege they had granted for the web app was not a risk). Such a feature is also described at http://en.wikipedia.org/wiki/Site-specific_browser , and it states that Chrome already has this capability via application shortcuts (but without having looked at this, my guess would be that this wouldn't allow integration with other browser add-ons, not to mention not being privileged).

As far as Facebook, thank you for the suggestion, but with my fatigue, I really have to prioritize the groups I join.

All the best,
Brett

[brettz9]

? Somebody take over your account?

[tcaudilllg]

When?

On Tue, Jun 24, 2014 at 2:03 AM, Brett Zamir [email protected]
wrote:

? Somebody take over your account?

—
Reply to this email directly or view it on GitHub
#9 (comment).

[brettz9]

Come to the Github site and look at the advertisement above...

[tcaudilllg]

sigh maybe so. I use an easy password... I'll change it.

On Tue, Jun 24, 2014 at 2:58 AM, Brett Zamir [email protected]
wrote:

Come to the Github site and look at the advertisement above...

—
Reply to this email directly or view it on GitHub
#9 (comment).

[brettz9]

You might also check whether you have any third party services associated with your account--I doubt they'd be causing trouble, but in case you wish to be certain...