uBOL version updates missing in Firefox add-ons store

[NoahDurham]

I am deploying uBOL to Firefox to parity deployment to Chrome and Edge. The Firefox add-ons store shows version 2023.8.25.959. Version history shows only this version in the store. Github shows a more up to date version. One of my test devices has a version 2024.8.21.996. Another test device that I just pushed my policy to has 2023.8.25.959 because it is the "latest" in the store currently.

[gorhill]

Right, I received two emails from Mozilla Add-ons:

Mozilla Add-ons: uBlock Origin Lite [ref:67f692f2-a395-4214-b945-3671893a17a8]

Hello,

Your Extension uBlock Origin Lite was manually reviewed by the Mozilla Add-ons team in an assessment performed on our own initiative of content that was submitted to Mozilla Add-ons.

Our review found that your content violates the following Mozilla policy or policies:

• Consent, specifically Nonexistent: For add-ons that collect or transmit user data, the user must be informed and provided with a clear and easy way to control this data collection. The control mechanism must be shown at first-run of the add-on. The control should contain a choice accompanied by the data collection summary. Depending on the type of data being collected, the choice to send cannot be enabled by default. If data collection starts or changes in an add-on update, or the consent and control is introduced in an update, it must be shown to all new and upgrading users. For the exact requirements, refer to https://extensionworkshop.com/documentation/publish/add-on-policies/#data-disclosure-collection-and-management . For an example of how to provide a consent and control dialog, see https://extensionworkshop.com/documentation/develop/best-practices-for-collecting-user-data-consents/ .
  Also, if your add-on is listed on addons.mozilla.org, the listing needs to include a privacy policy, and a summary of the data collection should be mentioned in the add-on description.
  -> web_accessible_resources/googlesyndication_adsbygoogle.js

• Sources, specifically Sources or instructions missing: Your add-on contains minified, concatenated or otherwise machine-generated code. You need to provide the original sources, together with instructions on how to generate the exact same code used in the add-on. Source code must be provided as an archive and uploaded using the source code upload field, which can be done during submission or on the version page in the developer hub. Instructions can be provided in a top-level README file inside the source code package or in the "Notes to Reviewers" field on the version page in the developer hub.
  -> web_accessible_resources/fingerprint2.js
  -> web_accessible_resources/google-analytics_analytics.js
  -> web_accessible_resources/google-analytics_ga.js
  -> web_accessible_resources/googletagservices_gpt.js.

Affected versions: 1.0.23.8128, 1.0.23.8155, 2023.9.10.1131, 2023.9.19.787, 2023.9.28.935, 2023.10.3.896, 2023.10.12.904, 2023.10.21.720, 2023.11.4.95, 2023.11.11.1035, 2023.11.19.977, 2023.11.28.36, 2023.12.4.1333, 2023.12.16.1327, 2024.1.2.1038, 2024.1.14.912, 2024.1.21.1302, 2024.1.29.1338, 2024.2.14.104, 2024.2.25.1407, 2024.2.26.112, 2024.3.4.107, 2024.3.11.1438, 2024.3.21.842, 2024.3.30.1062, 2024.4.8.931, 2024.5.13.839, 2024.5.17.961, 2024.5.27.852, 2024.6.2.1013, 2024.6.10.805, 2024.6.17.766, 2024.6.26.1308, 2024.7.3.674, 2024.7.17.853, 2024.7.28.888, 2024.8.5.925, 2024.8.12.902, 2024.8.19.905, 2024.8.21.996, 2024.9.1.1266

Based on that finding, those versions of your Extension have been disabled on https://addons.mozilla.org/addon/ublock-origin-lite/ and are no longer available for download from Mozilla Add-ons, anywhere in the world. Users who have previously installed those versions will be able to continue using them.

You may upload a new version which addresses the policy violation(s).

More information about Mozilla's add-on policies can be found at https://extensionworkshop.com/documentation/publish/add-on-policies/.

Thank you for your attention.

[ref:67f692f2-a395-4214-b945-3671893a17a8]

Mozilla Add-ons Team
https://addons.mozilla.org/

Mozilla Add-ons: uBlock Origin Lite [ref:8e5f092f-a51c-46ae-8a8d-f5831d35d173]

Hello,

Your Extension uBlock Origin Lite was manually reviewed by the Mozilla Add-ons team in an assessment performed on our own initiative of content that was submitted to Mozilla Add-ons.

Our review found that your content violates the following Mozilla policy or policies:

• Consent, specifically Nonexistent: For add-ons that collect or transmit user data, the user must be informed and provided with a clear and easy way to control this data collection. The control mechanism must be shown at first-run of the add-on. The control should contain a choice accompanied by the data collection summary. Depending on the type of data being collected, the choice to send cannot be enabled by default. If data collection starts or changes in an add-on update, or the consent and control is introduced in an update, it must be shown to all new and upgrading users. For the exact requirements, refer to https://extensionworkshop.com/documentation/publish/add-on-policies/#data-disclosure-collection-and-management . For an example of how to provide a consent and control dialog, see https://extensionworkshop.com/documentation/develop/best-practices-for-collecting-user-data-consents/ .
  Also, if your add-on is listed on addons.mozilla.org, the listing needs to include a privacy policy, and a summary of the data collection should be mentioned in the add-on description.
  -> web_accessible_resources/googlesyndication_adsbygoogle.js

• Sources, specifically Sources or instructions missing: Your add-on contains minified, concatenated or otherwise machine-generated code. You need to provide the original sources, together with instructions on how to generate the exact same code used in the add-on. Source code must be provided as an archive and uploaded using the source code upload field, which can be done during submission or on the version page in the developer hub. Instructions can be provided in a top-level README file inside the source code package or in the "Notes to Reviewers" field on the version page in the developer hub.
  -> web_accessible_resources/fingerprint2.js
  -> web_accessible_resources/google-analytics_analytics.js
  -> web_accessible_resources/google-analytics_ga.js
  -> web_accessible_resources/googletagservices_gpt.js.

Affected versions: 2023.8.25.959

Based on that finding, those versions of your Extension will be disabled on https://addons.mozilla.org/addon/ublock-origin-lite/ in 14 day(s). Once disabled, these versions will no longer be available for download from Mozilla Add-ons, anywhere in the world, but any compliant versions will remain in place, and you may choose to upload a new version that addresses the policy violation. Users who have previously installed the disabled versions will be able to continue using them.

More information about Mozilla's add-on policies can be found at https://extensionworkshop.com/documentation/publish/add-on-policies/.

Thank you for your attention.

[ref:8e5f092f-a51c-46ae-8a8d-f5831d35d173]

Mozilla Add-ons Team
https://addons.mozilla.org/

---

Contrary to what these emails suggest, the source code files highlighted in the email:

• Have nothing to do with data collection, there is no such thing anywhere in uBOL
• There is no minified code in uBOL, and certainly none in the supposed faulty files
• There is a privacy policy link in uBOL's add-on page: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin-lite/privacy/

I don't have the time or motivation to spend time on this nonsense, so I will let AMO do whatever they want with uBOL. I will probably publish a self-hosted version which auto-updates (like how dev build of uBO is self-hosted) when I find the time to arrange all that.

[NoahDurham]

That's unfortunate that Mozilla flagged it incorrectly, but I understand. Thank you for the update and hope to hear about the self-hosted version in the near future.

[Rob--W]

@gorhill The review decision looks inaccurate to me. Could you reply to the email to let the original reviewers know that the assessment is inaccurate? What you wrote above in the comment is sufficient.

[gorhill]

Starting with uBOLite_2024.9.12.1004, the Firefox version of the extension will be self-hosted and can be installed from the release section. The extension will auto update when a newer version is available.

[ColinHRL]

Starting with uBOLite_2024.9.12.1004, the Firefox version of the extension will be self-hosted and can be installed from the release section. The extension will auto update when a newer version is available.

thank you for setting this up so quickly. i appreciate it

[gorhill]

The Firefox version of uBO Lite will cease to exist, I am dropping support because of the added burden of dealing with AMO nonsensical and hostile review process. However trivial this may look to an outsider, it's a burden I don't want to take on -- since the burden is on me, I make the decision whether I can take it on or not, it's not something up for discussion.

The burden is that even as a self-hosted extension, it fails to pass review at submission time, which leads to having to wait an arbitrary amount of time (time is an important factor when all the filtering rules are packaged into the extension), and once I finally receive a notification that the review cleared, I have to manually download the extension's file, rename it, then upload it to GitHub, then manually patch the update_url to point to the new version. It took 5 days after I submitted version 2024.9.12.1004 to finally be notified that the version was approved for self-hosting. As of writing, version 2024.9.22.986 has still not been approved.

However often keep looking into all this, every time I can only conclude the feedback from Mozilla Add-ons Team to have been nonsensical and hostile, and as a matter of principle I won't partake into this nonsensical and hostile review process.

It takes only a few seconds to see how this is nonsensical -- keep in mind that this "was manually reviewed by the Mozilla Add-ons team":

• "For add-ons that collect or transmit user data, the user must be informed and provided with a clear and easy way to control this data collection"
  Where is the "data collection" in this file?
  • https://github.com/uBlockOrigin/uBOL-home/blob/uBOLite_2024.9.1.1266/firefox/web_accessible_resources/googlesyndication_adsbygoogle.js
• "Your add-on contains minified, concatenated or otherwise machine-generated code"
  Where is the "minification" in these files?
  • https://github.com/uBlockOrigin/uBOL-home/blob/uBOLite_2024.9.1.1266/firefox/web_accessible_resources/fingerprint2.js
  • https://github.com/uBlockOrigin/uBOL-home/blob/uBOLite_2024.9.1.1266/firefox/web_accessible_resources/google-analytics_analytics.js
  • https://github.com/uBlockOrigin/uBOL-home/blob/uBOLite_2024.9.1.1266/firefox/web_accessible_resources/google-analytics_ga.js
  • https://github.com/uBlockOrigin/uBOL-home/blob/uBOLite_2024.9.1.1266/firefox/web_accessible_resources/googletagservices_gpt.js
• "Also, if your add-on is listed on addons.mozilla.org, the listing needs to include a privacy policy, and a summary of the data collection should be mentioned in the add-on description."
  Right, it's always been there since the first version published on AMO more than a year ago
  • https://github.com/user-attachments/assets/350bc17c-53e2-401a-91a0-2a321337c49e

Incidentally, all the files reported as having issues are exactly the same files being used in uBO for years, and have been used in uBOL as well for over a year with no modification. Given this, it's worrisome what could happen to uBO in the future given it uses the same exact files.

The steps taken by Mozilla Add-ons Team as a result of the (nonsensical) "issues" was to disable all versions of uBOL except for the oldest version, first published on AMO on August 2023. That oldest version is also reported as having the same "issues" and was set to be disabled by Mozilla Add-ons Team unless the "issues" were addressed ("Based on that finding, those versions of your Extension will be disabled on https://addons.mozilla.org/addon/ublock-origin-lite/ in 14 day(s)."). I disabled this version myself to prevent new users from ending up with a severely outdated version of the extension to avoid a subpar first experience of uBOL.

So essentially, it was deemed that all versions of uBOL were having "issues", but instead of disabling all of them except the most recent one, they disabled all of them except the oldest one. This is hostile considering that whoever installed uBOL at that point would be installing a version of uBOL with severely outdated filter lists, along with an outdated codebase (many issues were fixed in the codebase since August 2023).

I am unable to attribute good faith to both the nonsensical review feedback and the steps taken as a result of this nonsensical review feedback, and I am unable to take on the added burden of having to deal with nonsense.

This is unfortunate because despite uBOL being more limited than uBO, there were people who preferred the Lite approach of uBOL, which was designed from the ground up to be an efficient suspendable extension, thus a good match for Firefox for Android.

From this point on, there will no longer be a package published in the release section for Firefox, except for the latest one, uBOLite_2024.9.22.986, if and when it's approved.

[Rob--W]

@gorhill

It saddens me to see the disappearance of a useful add-on due to a mistaken review. I can sympathize, especially as someone who has also experienced nonsensical rejections (not from AMO). I'd like to offer some perspective, and hope that you'd consider continuing uBOL for Firefox.

Manual review is done by humans, and it is unfortunately human to make errors. In #197 (comment) I encouraged replying to the review rejection e-mail, because that notifies reviewers and enables them to correct mistakes. Without such reply, reviewers are unaware of their mistake and they cannot take the corrective action to review and approve the update.

Although I am not part of the review team I used to be a volunteer reviewer, and am currently an engineer that developers the extension APIs that you use in Firefox (including the majority of the declarativeNetRequest API that is critical to your extension). With this background I am able to tell what your extension does and that it should not have been rejected for the given reasons.

[gorhill]

@Rob--W I appreciate you trying to build a bridge, but as much as I have tried over and over, I am unable to see this as a mistake, it takes only a few seconds for anyone who has even basic understanding of JavaScript to see the raised issues make no sense, and that the steps taken (disable all but the oldest version instead of all but the most recent) were the worse for both the extension and new users interested in it.

For those who still want to build and test a Firefox version of the extension, see https://github.com/gorhill/uBlock/tree/master/platform/mv3.

[gorhill]

For the record on September 27th, I received this message:

Mozilla Add-ons: uBlock Origin Lite 2024.9.1.1266

Hello,

A reviewer at addons.mozilla.org is contacting you regarding version 2024.9.1.1266 of the add-on uBlock Origin Lite. You are receiving this email because you are listed as an author of this add-on.

An add-on reviewer wrote:

After re-reviewing your extension, we have determined that the previous decision was incorrect and based on that determination, we have restored your add-on.

We apologize for the mistake and encourage you to reach out to us in the future whenever you have questions or concerns about a review so that we can correct mistakes and resolve any issues quickly.

To respond, please reply to this email or visit https://addons.mozilla.org/en-US/developers/addon/ublock-origin-lite/versions.

Thank you for your attention.

--
Mozilla Add-ons
https://addons.mozilla.org/

Exactly as said I would do above, I downloaded signed uBOLite_2024.9.22.986 for self-hosting purpose and removed the extension from AMO.

[gorhill]

Looks like the sentence "however trivial this may look to an outsider, it's a burden I don't want to take on" is lost on many who want to have an opinion about all this.

I dropped support for uMatrix years ago because it had become a burden I couldn't take on. This is such a case here, the unwarranted de-listing of uBOL and the requirement of having to deal with this caused the support to maintain a Firefox version to cross the line into the "burden I can't take on" territory. Amount of burden to take on is a personal decision, not something to be decided by others.