Sandboxed add-ons to be disabled next week

15

The new Developer Tools and review process were implemented on AMO and announced a little over a month ago. I also expanded the explanation about the new review process, so you should have a look if you haven’t already.

One of the key goals of the new review system was to make AMO a safer place for our users. In the previous system, an add-on could be created, never submitted for code review, and still be permanently visible and searchable within the site. These add-ons had a couple different qualifiers along the years like “In Sandbox” and “Experimental”, and showed warnings indicating that were not safe to install. However, warning messages are prone to be ignored, and the mere fact of being listed on the official Mozilla Add-ons site was enough for some people to trust the code they were downloading and installing regardless of the warnings. We needed something different.

The new system requires all add-ons listed on our site to pass at least a basic security review, which we’re calling Preliminary Review. Add-ons that pass this review will be visible on the site but get lower rankings, and they have the “Experimental” qualifier near their install button. They also have automatic updates enabled, which is an advantage in comparison to the old sandbox system. All updates also have to pass our review process, either preliminary or full depending on what the developer chooses. There’s more info in the overview post.

Moving to the new system, however, requires a massive migration of add-ons that were previously in the sandbox. Since we can’t make decisions for our developers, we provided you with a choice: nominate your add-on for full review or preliminary review in the following weeks, or your add-on will be disabled. We have already processed more than 1500 nominations from add-ons that were previously in the sandbox, but there are over 6000 add-ons that remain to show any activity, even after 2 rounds of email notifications indicating the imminent deactivation of the add-on listings.

So, if you’re an add-on author and still haven’t nominated your previously sandboxed add-on for review, you have until the end of this week. Starting next week, your listing will be disabled. If you submitted a new add-on in the past month, or if you nominated your add-on but haven’t heard back from us, don’t worry. Your add-on should be pending review and we won’t disable any of those. The waiting times for nominations is pretty large these days (at least a couple of weeks) because of the migration to the new system.

If you have doubts about the status of your add-on, you can check it out following these directions:

  1. Go to your Add-ons Page. It should show an overview of all your add-ons and their status.
  2. For details about a specific add-on of yours, click on the Edit Listing link.
  3. On the menu on the left-hand side, choose Manage Status & Versions.

If you’re still unsure, you can send a message to amo-editors AT mozilla DOT org, or visit the #addons IRC channel. We’ll be happy to help.

Tags: , , , ,

Categories: developers, general, policy

15 responses

  1. Danny Moules

    It’s far less stressful to get a patch into Fx than it is to get a half-way complex add-on reviewed. I gave up trying. Now you’re doing this… and you’ve killed third-party hosting through AMO. So now I just won’t bother writing extensions at all. I’ll write code for Fx instead with my time. I’d rather pray than it gets accepted by module owners.

    Unfortunately all the people who do use my perfectly safe and reasonable addons will just have to go without. For, y’know, their safety.

    1. Jorge Author

      I had a look at your add-ons, and I could only see one that has ever been reviewed (I could be wrong, deleted versions leave no trace). It looks like it was rejected for incorrect reasons, which could have been corrected by replying to the review message and getting in touch with us. You are free to debate any review you are given, and we will respond to you.
      You can disagree with most of our policies, not follow them, and still qualify for a preliminary review. Unless you’re doing something we consider clearly unsafe, it should be OK.
      You can send me an email or reply here if you wish to discuss it further.

  2. Danny Moules

    that*

  3. Ken Saunders

    “you have until the end of this week”
    “Starting next week, your listing will be disabled”

    A standard business week?

    My notice says,
    “Add-ons that have not selected a review process
    –>before<– February 18, 2011 will be disabled"

    So today is the 17th, will it be disabled at midnight tonight the 18th, Saturday the 19th, or Sunday the 20th?

    I'm working on it, but knowing the exact amount of time left would be helpful.

    1. Jorge Author

      I doubt somebody will run the disable script at midnight on a weekend. It’s more likely that it will happen sometime next Monday, but I can’t tell you for sure.
      What do you mean “I’m working on it”? All you need to do is nominate. You don’t need to upload a new version or support Firefox 4 or even 3.6. All you need to do is nominate to avoid getting your add-on disabled, and after that you’ll have all the time you need to work on it.

  4. Mook

    In my case, at least, the addons didn’t even have to be compatible with Firefox 4. They were uploaded four years ago, and not marked as compatible with anything recent, but still passed preliminary review with absolutely no issues.

    1. Jim

      “not marked as compatible with anything”

      That was not my experience at all. I had an addon disabled for this very reason (even though it was enabled). Seems kindof arbitrary.

      1. Jorge Author

        Which add-on is yours?

  5. Kohei Yoshino

    Japanese translation is here:
    https://dev.mozilla.jp/2011/02/sandboxed-add-ons-disabled-next-week/

  6. Ken Saunders

    @Jorge

    Not sure what I was thinking. I do actually read the posts here and elsewhere pertaining to add-ons.
    Perhaps I was thinking back to when this was being planned, and thought that sandboxed add-ons wouldn’t be accessible to AMO visitors without a full review and there would be time limits on how long that they’d sit on AMO, etc, etc.

    Thanks again for your help.

  7. New AMO User

    You said: “In the previous system, an add-on could be created, never submitted for code review, and still be permanently visible and searchable within the site.”

    …I would like to see a little bit of this come back, the “never submitted for code review” part.

    When I create an Addon, I’d like to be able to Submit it for “Full Review”, “Prelim Review” or “No Review”. The difference with the “old system”, would be that I want the “No Review” path to *only let me see it* (only let the Addon Author see it). It would be searchable & visible TO ME, when logged in, but would not be to anyone else. This way, I can upload an Addon & test the AMO interface, without taking up time on the Review Queue. Another question: if I submit an Addon for Full or Prelim Review, can I cancel that request?…or delete the Addon?

    I previously mentioned this here…

    An Overview of the AMO Review Process | Mozilla Add-ons Blog
    http://blog.mozilla.org/addons/2011/02/04/overview-amo-review-process/comment-page-1/#comment-153111

    …& fligtar said I could use addons.allizom.org for testing, but he never followed up on the other questions. Do I use the same login?…or register again over there?

    So, do you think a built-in way to select “No Review” (or “Just Testing”) would be a good thing to add to AMO? (it would not have the security concerns of the way the “previous system” handled it)

    Also, on the Firefox Addons Forum, does anyone at Mozilla look at the “Forum Concerns” or “Jetpack” sub-forums? I posted 2 topics there & neither one of them has gotten any response, from anyone.

    (again, No Preview!)

    1. Jorge Villalobos Author

      * After you submit your add-on for review, you have the possibility of cancelling the request by either deleting the version you were submitting, or deleting the add-on entirely.
      * On addons.allizom.org you can use the same account information as on the regular site. It’s kind of a clone of the real site, but with somewhat old data and the code currently in development for the next version of the site.
      * I don’t think a Just Testing setting is worthwhile. Our system is extremely complex as it is, and there’s no big need for this.
      * I check the Forums weekly and respond to everything I can respond to. You can try posting again and rewording your questions. Maybe they were to vague to reply to.

      1. New AMO User

        It’s failing to post my reply, with a blank white screen & no msg as to why. I’m gonna keep trying.

      2. New AMO User

        I don’t think they were too vague…

        This Forum loses caps in Usernames / phpBB Search is Useless
        https://forums.mozilla.org/addons/viewtopic.php?f=26&t=3148

        Status of Jetpack – What can it do NOW?
        https://forums.mozilla.org/addons/viewtopic.php?f=27&t=3152

        Just as a suggestion, I recommend you & other Firefox Devs periodically look at “View unanswered posts”…

        View unanswered posts
        https://forums.mozilla.org/addons/search.php?search_id=unanswered

        …there are many posts that were never replied to. (some are your own Announcements tho)

  8. rob

    you guys must have a 95-95-95 rule for addons to version 2.5
    95% of the addons are incompatible with foxfire & sea monkey 2.5 of those that are compatible 95% of them are useless for 95% of the users