When Add-Ons Wage War
Conflicts in the Open Source world — as in the proprietary world — are hardly a surprising phenomenon. Indeed, our community can't even agree over what to call one of its most popular projects — a fight we have no interest in entering, particularly not here. What is perhaps more surprising is when these disputes escalate like a deleted scene from Fatal Attraction — escalate so far that the powers-that-be must intervene.
While NoScript surely has NoFriends among the attackers it helps to thwart, AdBlock Plus has a much less sinister group of opponents. Because it blocks advertisements, which site owners use to generate the funds that allow the site to continue operating, many site owners object to the extension's use, and some even make attempts to circumvent the extension. Giorgio Maone, the developer of NoScript, is one such site owner — his project is funded by donations, and by revenue from ads placed on the NoScript website. Frustrated with his ads being blocked by AdBlock Plus, and reportedly feeling that his project was at financial risk, Maone implemented measures to prevent AdBlock Plus from preventing his ads from displaying.
Palant, meanwhile, took exception to his extension being bypassed and instructed the individual who maintains AdBlock Plus' list of filters — the means by which the blocking is achieved — to add a new filter specifically designed to block ads on NoScript's domain. AdBlock filters are generally rather generic, blocking any images from URLs used by ad providers — users have the ability, though, to craft their own rules, and even to use the extension to block normal HTML elements on a page. Once Maone discovered that Palant was circumventing his circumvention, he introduced new methods to block the ads. The AdBlock Plus filter maintainer — known only as Ares2 — retaliated with more and more severe filters until eventually the NoScript website was inaccessible to users of AdBlock Plus.
Until this point, the dispute was fairly transparent — users are able to view, alter, and disable the filters enabled in their browser, and Maone's actions to circumvent the extension on his site would have been apparent to any AdBlock Plus user who visited the site. However, once Ares2 introduced filters that broke his site, Maone left transparency behind. He introduced new code into NoScript which disrupted the operation of AdBlock Plus — something made possible by the broad ability Firefox extensions have to alter not just the content of websites, but the browser itself, and any other add-ons that might be installed.
Generally, as is the case with most Open Source projects, extensions are scrutinized by hundreds, thousands, possibly more developers who ensure the extensions are safe for users to install — indeed, Mozilla maintains a formal process for approving extensions. To prevent the code from being discovered, Maone encoded it in a way that obscured it from other's inspection. No notice was given to NoScript's users, nor was there any option to prevent NoScript from affecting AdBlock Plus. What could not be obscured, however, was the user's experience, wherein it was obvious that something was disrupting AdBlock Plus' operations.
When users discovered the cause of AdBlock Plus' sudden malfunction, the reaction was swift and severe. They were outraged that one extension would deliberately be used to disable other add-ons with which the developer disagreed, were even more irate that it had been done with no notice or opt-out, and supremely enfrothed that the offending code was intentionally obscured — a cardinal offense if there is one in the Open Source world. Once brought to Palant's attention, he assailed the practice in an entry on the AdBlock Plus blog, an entry described as a "scathing" one "that excoriates NoScript." As one might expect, once the dispute was revealed to the greater public, an overwhelming amount of attention quickly followed.
As a result of the incident, the powers-that-be at Mozilla — or at least those responsible for keeping the peace among extensions — have proposed a new policy for add-ons to be accepted into the official addons.mozilla.org repository. Under the proposal, add-ons may only be approved if all changes to the user's home page and search preferences, as well as any changes to other extensions, can be justified as required by the core function of the extension. Once that test is met, the add-on must further disclose, in the add-on description, what changes will be made, and any changes must be opt-in rather than opt-out, requiring specific action by the user to enable them.
Finally, once the add-on is uninstalled, any settings that were altered must be returned to their original state — the proposal is not clear on whether this means the settings must be returned to a default state, that is, as the browser was shipped, or whether the extension will be required to keep a record of what settings it changed and their values, and restore them to their state before the extension was installed. The proposal is also quick to point out that the points set out are a minimum standard, and do not ensure that every extension that meets them will be approved. Community comment is requested, with indication that the Mozilla Development newsgroup is the preferred location.
As for the AdBlock Plus-NoScript feud, Maone issued an apology, acknowledging that using his extension to disrupt another was inappropriate, and asking that users "accept my most sincere apologies and believe in my shame and contrition." The offending code has been removed, with Maone writing that "I had this crazy idea of retaliating against EasyList 'from the inside', and in my blindness I did not grasp that I was really retaliating against my own users and the Mozilla community at large."
A cursory review of Palant's original entry shows three updates, the first noting the removal of the NoScript code and thanking users for helping to bring about the policy proposal at Mozilla. The second regards the closing of comments, and the third acknowledges and links to Maone's statement. Two additional entries to the blog, which appear to have drawn a great deal of comment, appear to propose a whitelisting system for AdBlock Plus, to give users more options of which ads to block. The relevant posts, which with their comments are quite lengthy, can be found on the AdBlock Plus blog.
For our part, we are deeply saddened by any schism, however quickly redressed, that affects our community. We would invite readers to share in the comments their thoughts, not only about the specific incident reported here, but also on the greater issue of how to maintain, if not community unity, then at a minimum a fair and civil environment for all Open Source projects.
Justin Ryan is a Contributing Editor for Linux Journal.
|Designing Electronics with Linux||May 22, 2013|
|Dynamic DNS—an Object Lesson in Problem Solving||May 21, 2013|
|Using Salt Stack and Vagrant for Drupal Development||May 20, 2013|
|Making Linux and Android Get Along (It's Not as Hard as It Sounds)||May 16, 2013|
|Drupal Is a Framework: Why Everyone Needs to Understand This||May 15, 2013|
|Home, My Backup Data Center||May 13, 2013|
- I once had a better way I
3 hours 3 min ago
- Not only you I too assumed
3 hours 20 min ago
- another very interesting
5 hours 13 min ago
- Reply to comment | Linux Journal
7 hours 7 min ago
- Reply to comment | Linux Journal
14 hours 1 min ago
- Reply to comment | Linux Journal
14 hours 17 min ago
- Favorite (and easily brute-forced) pw's
16 hours 8 min ago
- Have you tried Boxen? It's a
22 hours 26 sec ago
- seo services in india
1 day 2 hours ago
- For KDE install kio-mtp
1 day 2 hours ago
Enter to Win an Adafruit Pi Cobbler Breakout Kit for Raspberry Pi
It's Raspberry Pi month at Linux Journal. Each week in May, Adafruit will be giving away a Pi-related prize to a lucky, randomly drawn LJ reader. Winners will be announced weekly.
Fill out the fields below to enter to win this week's prize-- a Pi Cobbler Breakout Kit for Raspberry Pi.
Congratulations to our winners so far:
- 5-8-13, Pi Starter Pack: Jack Davis
- 5-15-13, Pi Model B 512MB RAM: Patrick Dunn
- 5-21-13, Prototyping Pi Plate Kit: Philip Kirby
- Next winner announced on 5-27-13!
Free Webinar: Hadoop
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers
Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.
Some of key questions to be discussed are:
- What is the “typical” Hadoop cluster and what should be installed on the different machine types?
- Why should you consider the typical workload patterns when making your hardware decisions?
- Are all microservers created equal for Hadoop deployments?
- How do I plan for expansion if I require more compute, memory, storage or networking?