"DNS rebinding" bypasses ABE LOCAL & same origin protection

[Giorgio Maone]

I'm not sure whether a warning prompt (especially if modal) is actually a good idea, because it should be issued at the very beginning of the session, which is against the new "good first run experience" principle dictated by AMO.

This happens once per implemented feature, not even on every install, I don't get your objections.

If you're upgrading 2, 3 or more extensions at once (it happens quite frequently) and every each of them pops up a modal dialog asking for something, this is very annoying and you'll probably won't act correctly on any of them, just dismiss them as soon as possible.

Being upfront about these things and letting the user decide is a signal of honorable intentions.

This is not something which is not being made "upfront" enough: it will get the publicity it deserves, but being exclusively a security feature which cannot diminish neither your security nor your privacy, making it opt-out rather than opt-in is better for everyone. I mean, do you prefer getting a prompt which asks for permission and dismissing it today because you don't have the time to read it or the knowledge to understand it, and tomorrow getting your router hacked because you read somewhere that NoScript protects you from "router hacks" and got lulled in a false sense of security?

On a side note, has the "Safebrowsing" feature of Firefox, which sends data to Google (!) in a much less anonymous fashion than this WAN IP checker, been made opt-in?

Does it not annoy you when other software does this behind your back?

No it doesn't, if it's an all round honest security feature like this (it actually will cost me tons of bandwidth with no kind of compensation) and has no side effects.
Do you really think I could have any incentive beside making my user base safer, when being bombed with millions of hits on an invisible SSL web service this way (with no ads, no data collection nor any other traffic-related revenue whatsoever)?

Because of 1 & 2 combined, a middle ground may be issuing a confirmation prompt only to users who choose not to opt out of the release notes page (which are the vast majority): the other ones would be informed of the absolute anonymity and benefits of this feature by the release notes page itself and by the privacy policy posted on AMO.

Did you perhaps mean "who chose to opt out?"

Yes, obviously. But I'm seriously thinking about not doing this either, because the more I think about it, the more I'm convinced this is more "fixing a bug in a primary and widely publicized feature in ABE" than adding a feature which you would want to opt-out in advance.
Of course, as I said, this will get publicized with the due emphasis on the Privacy Policy, on the release notes and on the blog.

It's logged on the terminal, rather than on the Error Console -- even though doing the latter is probably better and the feature is quiet enough.

Console is better, console logging can be toggled, but a terminal requires a restart. Are you sending other things to the terminal only? Why?

Yes, basically modules which aim not to have dependencies on the main NoScript module (which has the console/terminal switch) and which potentially generate lots of debugging output.
Console is very slow in comparison to terminal, and synchronous VS asynchronous, so it's not good at all for fast updates.
A terminal doesn't require a restart if, like me, you attach it to every session through a shortcut.

However, as I said, this is a feature whose non-debugging output is gonna be switched to the Error Console.

[Giorgio Maone]

BTW, latest development build has WAN IP checker logging on Error Console.

[al_9x]

If you're upgrading 2, 3 or more extensions at once (it happens quite frequently) and every each of them pops up a modal dialog asking for something, this is very annoying and you'll probably won't act correctly on any of them, just dismiss them as soon as possible.

You can make it default to "yes" so that saying "no" would be more work (clicks), and simply dismissing the alert (or whatever it is) would preserve the "yes"

On a side note, has the "Safebrowsing" feature of Firefox, which sends data to Google (!) in a much less anonymous fashion than this WAN IP checker, been made opt-in?

It's on by default and you are not asked for permission. I would prefer it did ask.

Do you really think I could have any incentive beside making my user base safer, when being bombed with millions of hits on an invisible SSL web service this way (with no ads, no data collection nor any other traffic-related revenue whatsoever)?

My desire for an opportunity to evaluate on my own the advisability/utility of additional background internet traffic, is not an accusation against you.

Yes, obviously. But I'm seriously thinking about not doing this either, because the more I think about it, the more I'm convinced this is more "fixing a bug in a primary and widely publicized feature in ABE" than adding a feature which you would want to opt-out in advance.

Additional background network traffic has additional security and privacy implications, it's not simply "fixing a bug." The user deserves an opportunity to evaluate those for himself. If you implement something else in the future that requires background connections, I would want to be asked about it.