EltonChou / TwitterMediaHarvest

Download twitter media with only one-click.
https://chrome.google.com/webstore/detail/media-harvest-twitter-med/hpcgabhdlnapolkkjpejieegfpehfdok
MIT License
382 stars 33 forks source link

[BUG] firefox add-ons page show 404 #112

Closed Seele0oO closed 8 months ago

Seele0oO commented 9 months ago

Describe the bug

firefox add-ons page show 404.

Is there something wrong?

I tried creating and signing it with Firefox and it passed all the checks.

if you need to automate the submission to Firefox's ci, I'd give it a try.

To Reproduce

firefox addons

Expected behavior

Screenshots image

Desktop (please complete the following information):

Additional context

EltonChou commented 9 months ago

I discarded the support of firefox addon because it can't pass the review. But you can still download it from release page.

Only a few of the users can provide useful feedbacks, so I relied on issue tracker to track issue if there is any potential bug. I have disclosed what kind of data the extension might collect from user in privacy policy. (Most of them were collected by the issue tracker.) The reviewer request me make a control mechanism, but the mechanism is basically a fancy way to display the privacy policy. image

I think this is ridiculous. If users really care about privacy they should read the privacy policy first and decide to install or not. This extension is open-source and released under MIT license.

And one thing really pissed me off. They give me two weeks to response but their response time was 5 days avg.

Below is reviewer's response.

For add-ons that collect or transmit user data, the user must be informed and provided with a clear and easy way to control this data collection. The control mechanism must be shown at first-run of the add-on. The control should contain a choice accompanied by the data collection summary. Depending on the type of data being collected, the choice to send cannot be enabled by default. For the exact requirements, refer to https://extensionworkshop.com/documentation/publish/add-on-policies/#data-disclosure-collection-and-management . For an example of how to provide a consent and control dialog, see https://extensionworkshop.com/documentation/develop/best-practices-for-collecting-user-data-consents/ . Also, if your add-on is listed on addons.mozilla.org, the listing needs to include a privacy policy, and a summary of the data collection should be mentioned in the add-on description.

offsetcyan commented 8 months ago

Seems like a GDPR violation to collect without explicit consent :+1:

Laurens256 commented 8 months ago

Would you be willing to allow users to opt out of data collection? Or alternatively force users to choose between data collection or remove the extension? I think this would allow the extension to be used in Firefox again

EltonChou commented 8 months ago

Would you be willing to allow users to opt out of data collection? Or alternatively force users to choose between data collection or remove the extension? I think this would allow the extension to be used in Firefox again

This work is still in progress and I'm unsure whether it will be published or not.

It would be a dilemma if I were to force users to allow data collection or remove the extension. Most of the users are unaware that this restriction was imposed by Mozilla and there is no api for removing the extension. From the users' perspective, it can feel like an infinite loop. How do they think? I don't know. They might think the developer is trolling and leave a low rating. Although I explain this situation in the description page, many people don't pay attention to it. As I mentioned earlier, if users genuinely care about privacy, they will take the time to read the privacy policy and make an decision about whether to install the extension.

Another possible solution is to allow users to opt out data collection, but this extension is not a standalone application, it relied on Twitter. Everything could happen when inject the script into the page. It hard for a normal user to provide the detailed information about their interactions. While an issue tracker like Sentry may not be necessary, it can be incredibly helpful for reproducing specific situations.

EltonChou commented 8 months ago

Add signed xpi file in release page.

Seele0oO commented 8 months ago

At least we have a convenient option. Really appreciate the quick response and solution you provided!