Bugzilla

The end user is not seeing the permission string "messagesMove", but he sees the description "Move, copy, or delete your email messages". So the user has agreed to give those rights to the extensions (the argument that users do not read that is invalid, they should). If an extension is indeed ill-intended, users can report them and they get banned. This has proven to work for FF and reduced the review time of add-ons dramatically.

So from the permission point of few this is not a bug.

I do see a potential need for a more fine tuned delete permission. But there is a pitfall: The user can configure TB to delete messages directly instead of moving them to trash. In this case `skiptrash` is not needed to permanently delete messages. So a newly introduced permission which controls the usage of `skiptrash` can still not protect the user from permanent deletions. Even if we introduce `messagesDelete` (controls usage of `messages.delete()`) and `messagesDelete.permanent` (controls usage of `skiptrash`), the user is not safe from permanent deletion by *not* using add-ons who request `messagesDelete.permanent`.

Introducing a new permission which grants usage of `messages.delete()` is also problematic, as the developer can just use `messages.move()` to move messages to the trash folder (and auto delete will remove them later, also maybe unnoticed by the user).

I only see one way to improve the situation: Change the description of messagesMove to "Move, copy, or (permanently) delete your email messages". But I have to check if that is possible, because IIRC we cannot change the meaning of locale strings (just fix spelling errors), because a changed meaning needs to trigger updates of all languages, but only new locales get send to translators, not updates. I have to check.

The end user is not seeing the permission string `messagesMove`, but the description "Move, copy, or delete your email messages". So the user has agreed to give those rights to the extensions (the argument that users do not read that is invalid, they should). If an extension is indeed ill-intended, users can report them and they get banned. This has proven to work for FF and reduced the review time of add-ons dramatically.

So from the permission point of few this is not a bug.

I do see a potential need for a more fine tuned delete permission. But there is a pitfall: The user can configure TB to delete messages directly instead of moving them to trash. In this case `skiptrash` is not needed to permanently delete messages. So a newly introduced permission which controls the usage of `skiptrash` can still not protect the user from permanent deletions. Even if we introduce `messagesDelete` (controls usage of `messages.delete()`) and `messagesDelete.permanent` (controls usage of `skiptrash`), the user is not safe from permanent deletion by *not* using add-ons who request `messagesDelete.permanent`.

Introducing a new permission which grants usage of `messages.delete()` is also problematic, as the developer can just use `messages.move()` to move messages to the trash folder (and auto delete will remove them later, also maybe unnoticed by the user).

I only see one way to improve the situation: Change the description of messagesMove to "Move, copy, or (permanently) delete your email messages". But I have to check if that is possible, because IIRC we cannot change the meaning of locale strings (just fix spelling errors), because a changed meaning needs to trigger updates of all languages, but only new locales get send to translators, not updates. I have to check.

The end user is not seeing the permission string `messagesMove`, but the description "Move, copy, or delete your email messages". So the user has agreed to give those rights to the extensions (the argument that users do not read that is invalid, they should). If an extension is indeed ill-intended, users can report them and they get banned. This has proven to work for FF and reduced the review time of add-ons dramatically.

So from the permission point of few this is not a bug.

I do see a potential need for a more fine tuned delete permission. But there is a pitfall: The user can configure TB to delete messages directly instead of moving them to trash. In this case `skiptrash` is not needed to permanently delete messages. So a newly introduced permission which controls the usage of `skiptrash` can still not protect the user from permanent deletions. Even if we introduce `messagesDelete` (controls usage of `messages.delete()`) and `messagesDelete.permanent` (controls usage of `skiptrash`), the user is not safe from permanent deletion by *not* using add-ons who request `messagesDelete.permanent`.

Introducing a new permission which grants usage of `messages.delete()` is also problematic, as the developer can just use `messages.move()` to move messages to the trash folder (and auto delete will remove them later, also maybe unnoticed by the user).

I only see one way to improve the situation: Change the description of `messagesMove` to "Move, copy, or (permanently) delete your email messages". But I have to check if that is possible, because IIRC we cannot change the meaning of locale strings (just fix spelling errors), because a changed meaning needs to trigger updates of all languages, but only new locales get send to translators, not updates. I have to check.