1478731 - Extension block request: {dd3d7613-0246-469d-bc65-2a3cc1668adc} and {bee8b1f2-823a-424c-959c-f8f76c8b2306}

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, enhancement)

Description

[Andreas Wagner [:TheOne] [use NI]]

Extension name: "Blocksite" and "Popup blocker for FireFox - Poper Blocker"
Extension UUID: {dd3d7613-0246-469d-bc65-2a3cc1668adc}  and  {bee8b1f2-823a-424c-959c-f8f76c8b2306}
Extension versions to block: *
Applications, versions, and platforms affected: *
Block severity: soft

Homepage, AMO listing, other references and contact info
https://reviewers.addons.mozilla.org/en-US/reviewers/review/poper-blocker-pop-up-blocker
https://reviewers.addons.mozilla.org/en-US/reviewers/review/blocksite

Reasons:
Violations of the data collection policies

Comment 1

[Andreas Wagner [:TheOne] [use NI]]

Correction:

Version ranges to block:

{bee8b1f2-823a-424c-959c-f8f76c8b2306} : <= 4.0.7.3
{dd3d7613-0246-469d-bc65-2a3cc1668adc} : <= 4.0.3

Comment 2

[Andreas Wagner [:TheOne] [use NI]]

The blocks have been staged. Jorge, can you please review and push?

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

Done.

Comment 4

[Mitar]

I am one of users of the "Blocksite" extension. I got today a message about this extension being blocked, but as an user of Firefox I must say I would prefer a bit more information about what is the problem with the extension, what was the extension doing, how much data was leaked, where is anything about the process how this was decided? I cannot see anymore extension's page to see any comments or discussions made there, and also in this issue there is nothing more than "Violations of the data collection policies". As an user of the extension I am now in fact not sure if I should block the extension. It is providing me an useful feature. So I would like to better understand the process here.

Comment 5

[paulo_3d]

why did this extension is blocked ? one of the bests and does the work very well, I still don't understand...is it tracking us ? pretty weird.

Comment 6

[raclapp]

I also agree, it has always worked fine for me.  Hands off on this one.  I intend to re-enable it.  There is nothing it is doing that is an issue for me.

Comment 7

[raclapp]

(In reply to Andreas Wagner [:TheOne] [use NI] from comment #0)
> Extension name: "Blocksite" and "Popup blocker for FireFox - Poper Blocker"
> Extension UUID: {dd3d7613-0246-469d-bc65-2a3cc1668adc}  and 
> {bee8b1f2-823a-424c-959c-f8f76c8b2306}
> Extension versions to block: *
> Applications, versions, and platforms affected: *
> Block severity: soft
> 
> Homepage, AMO listing, other references and contact info
> https://reviewers.addons.mozilla.org/en-US/reviewers/review/poper-blocker-
> pop-up-blocker
> https://reviewers.addons.mozilla.org/en-US/reviewers/review/blocksite
> 
> Reasons:
> Violations of the data collection policies

If we knowingly allow it on our system, how is it violating anything.  It must get some data, to do it's job properly.

Comment 8

[johnnys42]

You should probably read their Privacy Policy first before accusing them of something like that. I had this add-on for quite a while and have no problems with it. I just made a bugzilla account because I'm baffled with this nonsense!!

Comment 9

[jeff]

hay mozilla please unblock  poper blocker you're being punked by all the site's that are mad about how good the poper blocker is you don't have any other poper blocker that is anywhere near as good.  sites can't block it like they can with ublock or adblock where they can turn off there sites if they detect you using an add blocker so please fix the problem an give me back my poper blocker please. i have been using it for longtime with no problem. i have all my family and friends using it an they all love it to. so please unblock it. because now i have all kinds of **** redirecting me to all kinds of crazy web site i don't want to go to. its a mess i have to keep restarting  firefox to get out of all the sites i'm being forced to go to.                    please don't let them take away the only blocker that can rely block an they can't block. thanks  hope this can be sorted out so cause i all ready miss it. firefox just doesn't work right without it.

Comment 10

[jeff]

(In reply to johnnys42 from comment #8)
> You should probably read their Privacy Policy first before accusing them of
> something like that. I had this add-on for quite a while and have no
> problems with it. I just made a bugzilla account because I'm baffled with
> this nonsense!!

me to give us back poper blokcer please

Comment 11

[paulo_3d]

(In reply to johnnys42 from comment #8)
> You should probably read their Privacy Policy first before accusing them of
> something like that. I had this add-on for quite a while and have no
> problems with it. I just made a bugzilla account because I'm baffled with
> this nonsense!!

I made an account here especially for that too, I'm surprised , My 3 best extensions are now blocked, Downthemeall, Stylish and now Popup blocker (Stylish I know what they made and in this case, Mozilla did right blocking them) however Downthemeall , for years on top downloaded extensions disappears suddently , I've checked out what happened and I was shocked when I saw the developer dissatisfied with Mozilla and having to get something off his chest there. Very suspícious.

Comment 12

[larabe]

This does not explain why it was blocked. Please explain in detail why it was decided to block it.

Comment 15

[u621659]

Unless it can be proven by the person who reported Popup Blocker for Firefox that this addon supposedly violated the data collection policies (And not that any sites that no doubt dislike this addon are being pandered to) then i see no reason why said addon should have been blocked nor will i be disabling Popup Blocker for Firefox.

TL;DR You have some explaining to do.

Comment 16

[ainahp07]

Adding my support to the add-on and the other comments here

Comment 17

[LMuffatti43]

I need more information about your attached pages

https://reviewers.addons.mozilla.org/en-US/reviewers/review/poper-blocker-pop-up-blocker
https://reviewers.addons.mozilla.org/en-US/reviewers/review/blocksite

because those info are not available anymore.

Regards

Comment 18

[Lawren]

I use this as well and was puzzled by the ban.

Compare the above block request to Stylish (https://bugzilla.mozilla.org/show_bug.cgi?id=1472948). There is a lot more information provided by the person requesting the block. This block request was not reported as "malicious". However, Stylish wasn't blocked immediately by Firefox/community, and only after a 3rd party software dev noticed the privacy issue.

I am not familiar with Firefox's API but I decided to look into the extensions' code via moz-extension://(some_id) (No idea what the id references but it is not the extension uid; I got the id from the clicking on the three dots on the add-on icon and selecting options. This loaded something like moz-extension://(some_id)/options.htm and then I removed the options.htm to see the add-on de-obfuscated code/directory.)

Anyways, the add-on code can be found in multiple javascript files. I can post the code to pastebin if anyone wants. These are the relevant files:
action.index.js
background.index.js
content.index.js

From what I can tell, there are 2 occurrences where anonymous data is sent to the author:
1. Google Analytics for button presses. This is common for all software/add-ons and helps the author determine how users use their software. The data sent is anonymous and has no identifying information.
2. Keen Analytics (https://keen.io/) for "manual remove overlay" actions. This is defined in the options as a checkbox that says something like "collect anonymous data for manual overlay removal". The code basically sends data about the website url + the overlay code that was blocked, but I don't see any identifying information (beyond the url). This action only occurs when the user manually removes an overlay and not when the add-on removes the overlay for you. My best guess is they use this to find new overlays to block and update the add-on to block these overlays elsewhere.

I searched the code for http requests and other functions that are used to send/request data. I did not see anything that would identify a person (ie. no unique id; browser agent information isn't sent).

Furthermore, the code is commented and this helps identify areas of the code. However comments can be misleading, but I didn't see any comments that attempt to mislead/distract. There is also a GDPR privacy function in the code that looks to ensure that data being sent/requested isn't breached the GDPR. And addition to this, the author's / addon's website also has an updated privacy policy for GDPR.

TL;DR: I did not see any data that could be used to identify a person. The only thing that could possibly lead to identification is how manual overlay removal is handled, but that can be disabled in the options.

Comment 19

[kcdtv78]

google-analytics? Why? That is probably a problem. And i guess it explains why firefox did removed the extension that i used too. It is ok to use google analytic in a web site that you own. And me as a visitor I can block google analytic. It is definitely not common for an add-on to send datas to goole analytic... well i hope not, not in firefox :D 
google analytic is not anonymous, it grabs your IP, grabs your refer etc... It is a serious problem to have it activated permanently in the background. And blocksites enters in conflict with all the privacy plug-in that helps you to block google analytic (privacy badger, u-matrix, no-script, duck duck go privacy essential etc.. etc.. ). 
And keen Analytics: I did not this one and went on their site. That smells very very fishy...  
The author definitely needs to do something about this. That is a shame because the extension did work well and was handy and funny. Saying so, you can edit your dns configuration file to block the domain that you want and it will have the same effect (without the funny pictures when site is blocked). In debian or ubuntu you just have to open /etc/hosts in a text editor (with administrator privileges)  and add a line like that: 0.0.0.0 www.rubishwebsite.com
maybe you need to flush DNS cache (you can reboot if you do not know how to do)
 Saying so it would be nice to have more detailed information when a plug-in is censured. Not that i don't trust firefox team but you know: when we are for full disclosure and freedom it works in "all directions". It is always sad to censure something and it is always good to explain why we got to this sad situation. Cheers

Comment 20

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

Everyone, 

This bug is not the place to discuss our policy on blocking add-ons. 

We have a mailing list for add-ons, [e-mail], which you can join by going to https://mail.mozilla.org/listinfo/dev-addons.

Please remember that Bugzilla, mailing lists, Discourse, and other online venues are subject to our Community Participation Guidelines.

https://www.mozilla.org/en-US/about/governance/policies/participation/

I'm closing comments on this bug until Monday AM Pacific time.

Comment 21

[Andreas Wagner [:TheOne] [use NI]]

Our data  collection policy is part of the Review Policy, which you can read at https://developer.mozilla.org/en-US/Add-ons/AMO/Policy/Reviews and every developer explicitly agrees to in order to become a developer.
For critical violations, we may block add-ons according to our Blocklisting Policy (https://wiki.mozilla.org/Blocklisting) in order to protect Firefox users.

Generally, no block is being approved without verification by a Mozilla admin reviewer.

Comment 22

[Tom S. (please needinfo tschuster)]

Seems like this was probably related to this https://adguard.com/en/blog/big-star-labs-spyware/ malicious activity (via mailing-list).

Comment 23

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

Quick update, the add-ons team have requested the bug be kept closed to comments so the conversation can continue on the add-ons mailing list.