JAJare·Oct 26, 2016
And now one of the researcher has commented https://github.com/mozilla/addons-linter/issues/1000#issueco...
In Angular 1.x Banned from Firefox Addonsmozilla
addons-linter
JavaScript2016–2023
mozilla / addons-linter
addons-linter
🔍 Firefox Add-ons linter, written in JavaScript. 👁
8Distinct people
10Mentions
0Explicit recommenders
366GitHub stars
What to know before exploring
What it is
🔍 Firefox Add-ons linter, written in JavaScript. 👁
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 1:03:20 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year10 dated mentions
Observed mentions: 2016-10-20 17:17:34 UTC to 2023-03-14 19:13:43 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 8 | 1 | 7 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 1 | 1 |
What Hacker News says
8 sourcesAngular and Firefox teams are working to resolve the issue. The issue is not related to sandbox ... see https://github.com/mozilla/addons-linter/issues/1000#issueco...
In Angular 1.x Banned from Firefox AddonsNote that the Angular team is working with Mozilla and the researcher on this (see https://github.com/mozilla/addons-linter/issues/1000#issueco...) and that NDAs are a real, if insane, thing still to this day, and there is literally no way to legally compel any party to admit to being under NDA except in a court of law.
Should the researcher have told the Angular team? Yes. Should they have told the entire world? Probably no. Should Mozilla tell the world? Probably even less no. As long as the parties are talking (which they are), this is an unfinished security review on lock-down to prevent exploitation in the interrim.
In Angular 1.x Banned from Firefox AddonsWell, there's https://github.com/mozilla/addons-linter/issues/1000#issueco... ...
In Angular 1.x Banned from Firefox AddonsSo, there's so many problems with this i don't know where to begin. Since folks have already noted the "not notifying google" issue, let me point out another:
Prior to banning, i can find literally no discussion or details about this being about to happen (IE no notice), pretty much ever.
You can see it was initially noted here:
https://github.com/mozilla/addons-linter/commit/86f4dfb44355...
I can find no discussion around it (maybe it's there but i'm missing it? I looked in a lot of places).
You can see it fixed an issue to "warn third party developers of things we banned/don't advise", but there's nothing about initially banning anything there, and it was added with an initial ban list containing angular. I would have expected a page added, then a ban discussed, then a ban added. or something.
In fact, the details of the ban changed
Read the rest
(https://github.com/mozilla/addons-linter/commit/2dcc2226e2ec...) repeatedly without notice either.
This seems really bad. I would have expected, at the very least, a heads up to extension developers or something or even a more public notice when it happened so that some discussion could be had about it.
Instead, it looks like the only way you would have found out about it is by trying to lint an extension and see it banned
(IE after you developed it), or somehow random browsing of doc pages mozilla has.
I can't help but think that he's right though. Not explicitly but implicitly. By keeping the vulnerability from the dev team they're allowing it to stay out in the wild. No?
Edit: It may be that this is only an issue inside of Firefox extensions (addons). In which case, maybe the point is moot. See: https://github.com/mozilla/addons-linter/blob/master/docs/th...
In Angular 1.x Banned from Firefox AddonsI think encoderer was referring to https://github.com/mozilla/addons-linter/issues/1000#issueco..., where the engineer asks, "Is there any possible way for us to get around this ban?"
In Angular 1.x Banned from Firefox AddonsAngular 1.x Banned from Firefox Addons
384 points · Open discussion