This doesn’t change their enforcement in any way. These guidelines have been in effect since we announced them, and the modifications they’ve had since have been very minor. Also, the document is currently awaiting editorial review, which means they’ll go through some readability improvements in the future. Any major changes to the guidelines will be announced on this blog.

The document explains how to get in touch with us if you want to report a violation. Millions of add-on users will have their online experiences improved with your help.

We want to clarify that, from now on, there are only two acceptable ways of installing add-ons into Firefox:

1. Web install. Users are presented with a page that has an install button or link that they need to click on their own in order to initiate the add-on installation.
2. External install. The add-on is installed through the Windows Registry or a global install location, triggering the opt-in install screen. It is forbidden to tamper with this install screen, including overlaying images or text on top of it or anywhere near it.

There are two differences between this and previous policy. First, we used to allow a hybrid install method where an external installer opened Firefox and opened a new tab pointing directly to the XPI installer. After discussion with the SUMO team, we now realize that this isn’t clear enough for our users. Secondly, we’re making it clear that we’re not okay with installers placing information on top of the opt-in screen. This was becoming a trend in application installers and we hadn’t taken a clear position as to whether this was allowed or not.

However, we’re not ignoring the reasons for which many add-on developers do this. We understand that the opt-in screen needs improvement, and we’re committed to making it better. Feel free to comment below or get in touch with us through our other contact channels. Let us know your concerns and how you think we can improve the install flow.

I updated the Add-on Guidelines draft page to reflect this policy update.

On the Add-ons team, it’s our responsibility to find add-on problems and get them solved, regardless of where the add-on is distributed. The most effective way for us to do that is to ensure our expectations are clearly documented so that problems can be avoided before they even surface. This will empower the community to help us fix add-on problems, and it will give add-on developers an easy guide to follow.

This is why we’re putting forward the Add-on Guidelines, currently in draft form. They are mostly a formalization of what we have already been looking for. The idea behind this document is to make our guidelines clear to everyone, and to have a distinct guide that applies to all add-ons, even those not hosted on addons.mozilla.org. In addition to guidance for developers, these guidelines establish a formal process for users and community contributors to report violations to Mozilla to help us identify problems sooner.

These guidelines have already gone through two rounds of discussion, and now we’d like the community at large to give their input. Once we have reached a finalized version of the document, we will put it up in a more permanent location and make it official.

If you have feedback on the draft, please share it with us in the comments or in the latest newsgroup discussion.

Last year we introduced a new Firefox feature to ensure add-ons dropped into Firefox by third parties would only be enabled if the user agrees. This means that some users may be asked if they’d like to install an add-on by a software installer as well as by Firefox itself, but these extra clicks attempt to ensure the user understands the modifications being applied to Firefox.

Even if an add-on has its own installer, the Firefox add-on opt-in dialog is not optional and must be displayed every time a new add-on is installed from outside of Firefox. Mozilla will take appropriate measures to ensure this is happening, including remotely disabling violating add-ons. This policy applies to all add-ons except those distributed in an enterprise or controlled environment.

We encourage add-on developers who would like to see improvements or changes to these user protection controls to propose them in Bugzilla or a newsgroup.

The Add-ons Team generally will not block legitimate add-ons without consulting with their developers first and giving them a reasonable amount of time to analyze and fix whatever problem is discovered. We have found that developers of legitimate, widely-used add-ons are usually more than happy to work with us in finding resolutions to problems and ensuring a smooth experience for users. As expected in this case, the McAfee team kept close communications with us and provided a pre-release version for us to test in advance. The partially fixed version was released less than a week later.

Version 3.4.1.195 doesn’t fix all the memory leaks, but it does fix the most serious ones. The remaining leaks are being tracked on bug 729608. At this point it is unclear if the remaining memory leaks are caused by McAfee’s code or Firefox bugs. We will keep you up-to-date on any major developments.

Since the beginning of AMO, we’ve had a set of featured add-ons that are displayed prominently on the homepage and an ever-expanding list of other areas. Being featured guarantees downloads and notoriety, and many add-ons, especially start-ups, see it as crucial in order for their add-on to succeed.

End users see this list as a safe place to start with add-ons and trust Mozilla to feature great add-ons that work perfectly. However the selection process until now has been a pretty objective one, handled randomly by a small number of people, and the list has not been updated as frequently as we would have hoped.

We would therefore like to reach out to the Mozilla community to be part of an Advisory board to review new add-ons, and maintain a set of featured add-ons that are updated each month. We think this is a fair, and novel way to overcome some of the hurdles involved outlined above, and a chance to hand the responsibility over to the community that actually use and develop add-ons on a daily basis.

The Featured add-ons advisory board

Every 6 months, a call will go out via the Add-ons Blog for volunteers to participate in choosing featured add-ons. Volunteers must commit to trying the add-ons that apply to be featured and attending a monthly conference call to discuss suitability.

Each Board’s term is 6 months and will be comprised of 5 community members and 2-3 members of the Mozilla Add-ons team.

A note on member requirements:

Members must abstain from voting on add-ons that they have any business or personal affiliations with, as well as direct competitors of any such add-ons. Members must be picked from the add-ons community: power users, developers, and evangelists of add-ons

If you would like to be considered for a position on the add-ons advisory board, please email amo-featured@mozilla.org with your name and contact details, no later than May 19th 23:59 PDT.

You can find our more about the new featured add-on selection process on the wiki.

• These posts written every 2 weeks explain the current state of add-on reviews and other information relevant to add-on developers.
• Nominations at the moment are being processed slower than usual. The new review system required hundreds of add-on developers to renominate their add-ons, which has placed a large workload on the editor team. Nominations are currently taking a week or two to review.
• Most updates are being reviewed within 5 days.
• Most preliminary reviews are being reviewed within 5 days.

The Review Queues

• These stats are taken from the last queue report. Preliminary queue stats are still pending.
• 59 new nominations that week. 161 nominations in the queue awaiting review.
• 80 new updates that week. 50 updates in the queue awaiting review.
• 2620 reviews were performed by AMO Editors in February (updated March 1st).

Firefox 4 Compatibility

Firefox 4 will be released very soon! Beta 12 is the current stable release and the first Release Candidate (and hopefully the final 4.0 release) should follow soon. AMO already supports 4.0.* as a valid maxVersion, and there are no major changes expected that affect add-on developers. If your add-on is already compatible, you should update your maxVersion to cover all future 4.0 releases. Most of the necessary documentation to upgrade your add-on for Firefox 4 is readily available:

• Firefox 4 for developers at MDC.
• Making your add-on compatible with Firefox 4.
• Firefox 4 Compatibility discussion in the Add-ons Forum. This is the best place to post any feedback and bugs related to Firefox 4 and add-on development.
• Toolbar buttons and icons for Firefox 4.

Notes for Developers

• If your add-on was recently disabled, it could be related to the mass sandbox cleanup we performed recently. You can still get your listing enabled again if you contact us. Your add-on page should have instructions on how to contact us.
• Add-on Performance at XUL School. This article is highly recommended to all developers. It explains a few methods to improve add-on performance, including how to easily measure startup times.
• The AMO Editor Guide. This new page in the wiki is a comprehensive guide to the work performed by AMO Editors. It will serve as an introductory guide for new editors, and is a step forward in being as transparent as possible with our review process.
• Useful Information for Add-on Authors. How to improve review times for your add-on, information about the review process, etc.

Jorge Villalobos

Add-ons Developer Relations Lead, Mozilla

One of the key goals of the new review system was to make AMO a safer place for our users. In the previous system, an add-on could be created, never submitted for code review, and still be permanently visible and searchable within the site. These add-ons had a couple different qualifiers along the years like “In Sandbox” and “Experimental”, and showed warnings indicating that were not safe to install. However, warning messages are prone to be ignored, and the mere fact of being listed on the official Mozilla Add-ons site was enough for some people to trust the code they were downloading and installing regardless of the warnings. We needed something different.

The new system requires all add-ons listed on our site to pass at least a basic security review, which we’re calling Preliminary Review. Add-ons that pass this review will be visible on the site but get lower rankings, and they have the “Experimental” qualifier near their install button. They also have automatic updates enabled, which is an advantage in comparison to the old sandbox system. All updates also have to pass our review process, either preliminary or full depending on what the developer chooses. There’s more info in the overview post.

Moving to the new system, however, requires a massive migration of add-ons that were previously in the sandbox. Since we can’t make decisions for our developers, we provided you with a choice: nominate your add-on for full review or preliminary review in the following weeks, or your add-on will be disabled. We have already processed more than 1500 nominations from add-ons that were previously in the sandbox, but there are over 6000 add-ons that remain to show any activity, even after 2 rounds of email notifications indicating the imminent deactivation of the add-on listings.

So, if you’re an add-on author and still haven’t nominated your previously sandboxed add-on for review, you have until the end of this week. Starting next week, your listing will be disabled. If you submitted a new add-on in the past month, or if you nominated your add-on but haven’t heard back from us, don’t worry. Your add-on should be pending review and we won’t disable any of those. The waiting times for nominations is pretty large these days (at least a couple of weeks) because of the migration to the new system.

If you have doubts about the status of your add-on, you can check it out following these directions:

1. Go to your Add-ons Page. It should show an overview of all your add-ons and their status.
2. For details about a specific add-on of yours, click on the Edit Listing link.
3. On the menu on the left-hand side, choose Manage Status & Versions.

If you’re still unsure, you can send a message to amo-editors AT mozilla DOT org, or visit the #addons IRC channel. We’ll be happy to help.

By the way, this post doesn’t cover Personas because they have a separate review process.

Submitting Your Add-on

Did you create an add-on you want to host on AMO (addons.mozilla.org)? Just visit the AMO Developer Hub to get started. You’ll need an AMO account and you should probably take some time to read our submission policies. We also have a detailed guide that explains what we look for when reviewing your submissions and deciding if and how it should be listed on the site.

When you submit a new add-on, you will have to choose between 2 review tracks: Full Review and Preliminary Review.

For the Full Review track, our reviewers will check that your add-on is safe to use, respects users’ privacy and choices, doesn’t conflict with other add-ons or break existing Firefox features, is easy to use, and is worth publishing to a general audience. While this appears to set a very high admission threshold, it really doesn’t; our goal is to publish as many add-ons as possible, while offering safe and useful choices to our users. Add-ons that receive Full Review approval will appear as Public, have the option to be Featured, can enable Contributions, and in general get much more public attention and downloads.

The Preliminary Review track only requires your add-on to be safe to use. Reviewers look for issues that could put the users’ system or data at risk. Add-ons with Preliminary Review approval appear on the site as Experimental, can’t be featured, and get lower search rankings. Like Public add-ons, they have automatic updates enabled.

So, why would anybody choose Preliminary Review? Many authors have expressed to us the need to host their add-ons on AMO in an intermediate state where they don’t get as much visibility and don’t have their add-ons as heavily scrutinized as they are for Full Review. Also, it serves as a replacement for the sandbox that we had in the previous review system. Now, if an add-on doesn’t pass Full Review, it can still qualify for Preliminary Review if it passes the basic security checks that we do. That will at least allow the add-on to be visible, installable and updatable.

Add-ons that don’t pass Preliminary Review are considered unsafe and are not published on AMO at all.

When your add-on is reviewed, you should receive and email message form us explaining if the review was approved or not, and what kind of approval you got. The message should include notes from the reviewer explaining what was discovered during the review and any issues that need to be addressed. Make sure that your registered email address on AMO is active and that you check on it frequently. On occasion we’ve been told that review email end up in the Spam or Junk folders, so you may want to check there if you think you should have heard from us by then.

Changing tracks

If your add-on has been approved in the Preliminary Review track, you can nominate it to the Full Review track after a 10 day waiting period. The 10 days begin from the time of your last Preliminary approval. After that you should see a Full Review nomination option in the Status & Versions page in the Developer Hub.

Updating your add-on

You can upload updates for your add-on from the Status & Versions page in Developer Hub. All updates are reviewed as well, and they will receive Full Review or Preliminary Review depending on the review track your add-on is in. If your first submission wasn’t reviewed before you uploaded the update, the new version will take its place in the review process.

Updates for add-ons in the Full Review track that don’t pass Full Review can still get Preliminary Review approval if any issues are found in the submission. In this case, the update will not be pushed to users, but it will still be visible and installable in the All Versions page of the add-on. The add-on remains in the Full Review track, and a fixed version needs to be submitted before updates can be pushed to users.

Update reviews are normally very fast (under 5 days), but we understand sometimes an update needs to be pushed as quickly as possible. Security fixes and broken external dependencies are the most common reasons for requesting this. In those cases you should contact the AMO Editors directly via email or IRC, and state your case. We can normally respond within a few hours.

The Review Queues

We have 3 lines where all review submissions are queued: one for Full Review nominations, one for Full Review updates, and one for Preliminary Reviews (both nominations and updates).

The waiting times for these queues can often vary, but our goal is to process all updates and preliminary reviews within a couple of days, and Full Review nominations within 10 days. I post queue state updates every week in the Add-ons Forum if you’re interested.

At this moment we’re doing very well on all queues except for Full Review nominations. We have a very large amount of reviews to process caused by the transition from the old review system to the new one, since thousands of old add-ons that never passed our reviewed process now require to do so in order to live on AMO. We expect to bring that queue back to normal within a few weeks, though.

AMO Editors

The Mozilla add-on review team is called AMO Editors. It’s composed mostly of volunteers; experienced add-on developers who take time from their busy lives to ensure the add-ons we list are good to use. Reviewing add-ons is a meticulous and often monotonous task, and many of them spend several hours a week working on this for free.

Reviewing add-ons for AMO is no small feat. Just last month the editor team performed over 2400 reviews. While these are exceptional times because of the release of Firefox 4 and the launch of the new review process, the average monthly review count usually hovers around 1000 reviews. With hundreds of submissions pouring in every week, there’s always work to do. So, if you run into an AMO Editor, give him a hug, or buy him a beer .

Questions and comments welcome, as always.

• These bi-weekly posts explain the current state of add-on reviews and other information relevant to add-on developers. There’s a lengthy overview of the Add-on Review Process posted in this blog that should be read as a general guide about the review process.
• Most nominations are being reviewed within 5 days.
• All updates are being reviewed within 5 days.

The Review Queues

• The stats are taken from the latest report at the forum (the 5th of November).
• 69 nominations in the queue awaiting review.
• 78 updates in the queue awaiting review.
• 177 reviews performed by AMO Editors this month. There were 14 editors performing reviews last week.

See the Add-on Review Process and You for information on how to check your  add-on status.

Firefox 4 Compatibility

Firefox 4 is coming later this year, and beta 6 is currently available for download. This will be the most difficult upgrade path for add-on developers yet, so everybody should keep an eye on beta updates and all the documentation that is being published. At the moment these are the most useful documentation resources:

• Firefox 4 for developers at MDC.
• Firefox 4 Compatibility blog post (Beta 4 edition!).
• Firefox 4 Compatibility discussion in the Add-ons Forum. This is the best place to post any feedback, bugs or insight surrounding Firefox 4 and add-on development.

Beta 7 is the first release after the codebase has gone through feature freeze. This means that after this release, no major changes are going to be performed, and add-ons that work correctly on beta 7 are very likely to work in the same way until the final release. After beta 7 is out (probably later this week),  I will be posting a very extensive view of Firefox 4 compatibility issues, including all that I’ve mentioned in previous posts. We will also be contacting all developers that have add-ons compatible with 3.6 and Firefox 4 betas, letting everybody know that they should be updating their code and Firefox 4 final is around the corner.

Notes for Developers

• Add-on Performance at XUL School. This article is highly recommended to all developers. It explains a few methods to improve add-on performance, including how to easily measure startup times.
• The AMO Editor Guide. This new page in the wiki is a comprehensive guide to the work performed by AMO Editors. It will serve as an introductory guide for new editors, and is a step forward in being as transparent as possible with our review process.
• Useful Information for Add-on Authors. How to improve review times for your add-on, information about the review process, etc.

Jorge Villalobos

Add-ons Developer Relations Lead, Mozilla