They should make it a requestable permission.

They have the Recommended Extensions program, where they do that for a subset of the available extensions.

https://support.mozilla.org/en-US/kb/recommended-extensions-program

Agreed, it should be this way. But I guess it would break most applications that rely on data collection (and I am saying that with a voice of sarcasm).

Calm down guys you’re asking for an actual feature, now… this is gonna need like five years of extensive study and testing.

Well, I guess they could. But at least its in the rules and people can report. And if it indeed violates the setting, then the addon could be removed from the repository. So there is an incentive for addon developers not to break that "promise". At least this is the right direction.

It has been a thing for longer that extensions are not allowed to make connections to the internet, unless it's actually required for the functionality they advertise. And I believe, they have some rudimentary code scans in place to check for that. Besides that, there's also their Recommended Extensions program, where they do thorough code reviews for a subset of available extensions.

addons.mozilla.com isn't a large enough source of extension downloads for a lot of extension developpers to be willing to comply with that, they'd just drop the platform, and firefox would have an even harder time getting people to use it.

how is knowing what data extensions collect a crappy idea?

Since some extensions are "mozilla-approved", I guess they test it regularly, it wouldn't be hard to verify if one is really sending anything despite their disclosure.

@This2ShallPass @themachinestops As an extension developper on Mozilla's store, yes it's definitely possible. There's some automatic review process but what you state in your implicit data consent disclosure (that's how they call it) is up to the developer.However, the extension can't access all websites unless you specifically allow it while installing. There's an "All websites" permission, so if it's that or if it includes some kind of sketchy site then it's a bad sign.Finally, just like any web page, you can always inspect an extension and check the network requests to see if it's doing malicious stuff. If so, then you can report it.But since mozilla accounts are free and only require a verified email, they could just create another one. It's an endless game of whack-a-mole!

Yup, sounds great to me. I could see a world in which it becomes a bad thing because they try to enforce it by pulling a Google and blocking users from installing extensions that aren't through their official add-on store, but as it is, it's hard to see any reasonable criticism.

You've got a downvote, so it seems not long. 😄

insert rant about Mozilla CEO

It's not clear whether it's a useless disclosure or enforced by the API.

So, sandbox the extensions, a practical, sensible step on the path to browser as OS (contentious, but doesn't that seem where things are going, and if we lose firefox...). I get it, it's mr right now harm minimization, as opposed to mr right (linux or flatpak) general purpose computers in service of their users with usable security control.

Already has it