View source for User:Fligtar/Blocklist Draft

Blocklisting is the ability to disable errant add-ons, plugins, and other third-party software for Firefox users. For graphics drivers, please see [https://wiki.mozilla.org/User:JoeDrew/GFXBlocklistDraft this policy].

= Blocklisting Policy =
No matter how secure, fast, or stable Firefox is, one encounter with bad third-party software can cause permanent damage to Firefox, your computer, or worse. That's why Mozilla considers it our responsibility to help users avoid those encounters. One tool we use to do that is blocking dangerous third-party add-ons, plugins, and DLLs from running in Firefox.

== A High Bar ==
Blocking third-party software is a sensitive issue that must be carefully considered in every case. We must be certain that the issue at hand is so great that it outweighs the user's choice to install the software, the utility it provides, and the vendor's freedom to distribute and control their software.

== Block Conditions ==
Acceptable reasons for blocking software include:
* Critical security vulnerabilities
* High crash volume
* Malicious in nature
* Severe performance impact (adds more than 75% to start-up time)
* Severe bugs that unintentionally affect core Firefox features

{{note|The above conditions assume users have chosen to install the add-on or software in question. If the software is installed without user consent, the bar is significantly lower to blocking for the above and other reasons.}}

The following are '''not''' reasons to block an add-on:
* Inclusion of advertisements or other "spyware" tactics, unless users did not choose to install the software or were not made aware of the offending functionality
* Intentional significant changes to or breakage of core Firefox features, unless users did not choose to install the software or were not made aware of the offending functionality
* At request of the vendor/developer, except in extreme circumstances

== Block Severity ==
There are two levels of blocking available to add-ons and plugins: soft and hard.

Soft-blocks disable the add-on by default, but allow the user to override and continue to use the add-on. This is the preferred option in almost all cases.

Hard-blocks disable the add-on and do not allow the user to enable it or override the block. This should only be used in cases where:
* an add-on is malicious
* a soft-block will not resolve the issue in question, such as a start-up crash

== Vendor Outreach and Block Ranges ==
Software should not be blocklisted without a reasonable attempt to contact the vendor/developer beforehand to alert them of the block and request a fixed version. If a fixed version will be provided in an adequate timeframe (0-3 calendar days), the block should be held so that users can update to the fixed version.

Block ranges should be as specific as possible to only target the offending versions in the affected application versions.

= How to request a block =
# Read the policy above and be sure your request meets the criteria
# File a bug using the appropriate request form and filling in all requested details:
#* [https://bugzilla.mozilla.org/enter_bug.cgi?comment=Extension%20name%3A%20%0D%0AExtension%20UUID%3A%20%0D%0AExtension%20versions%20to%20block%3A%20%0D%0AApplications%2C%20versions%2C%20and%20platforms%20affected%20affected%3A%20%0D%0ABlock%20severity%3A%20%28hard%2Fsoft%29%0D%0A%0D%0AHomepage%2C%20AMO%20listing%2C%20other%20references%20and%20contact%20info%3A%20%0D%0A%0D%0AReasons%3A&component=Blocklisting&op_sys=All&product=addons.mozilla.org&rep_platform=All&short_desc=Extension%20block%20request%3A%20%3CUUID%3E&status_whiteboard=%5Bextension%5D&version=unspecified Extension Block Request]
#* [https://bugzilla.mozilla.org/enter_bug.cgi?comment=Plugin%20name%3A%20%0D%0APlugin%20versions%20to%20block%3A%20%0D%0AApplications%2C%20versions%2C%20and%20platforms%20affected%3A%20%0D%0ABlock%20severity%3A%20%28hard%2Fsoft%29%0D%0A%0D%0AHow%20does%20this%20plugin%20appear%20in%20about%3Aplugins%3F%0D%0A%20%20%20%20File%3A%20%0D%0A%20%20%20%20Version%3A%20%0D%0A%20%20%20%20Description%3A%20%0D%0A%0D%0AHomepage%20and%20other%20references%20and%20contact%20info%3A%20%0D%0A%0D%0AReasons%3A&component=Blocklisting&op_sys=All&product=addons.mozilla.org&rep_platform=All&short_desc=Plugin%20block%20request%3A%20%3Cplugin%20name%3E&status_whiteboard=%5Bplugin%5D&version=unspecified Plugin Block Request]
#* [https://bugzilla.mozilla.org/enter_bug.cgi?comment=DLL%20name%3A%20%0D%0ADLL%20versions%20to%20block%3A%20%0D%0AApplications%2C%20versions%2C%20and%20platforms%20affected%3A%20%0D%0A%0D%0AHomepage%20and%20other%20references%20and%20contact%20info%3A%20%0D%0A%0D%0AReasons%3A&component=Blocklisting&op_sys=All&product=addons.mozilla.org&rep_platform=All&short_desc=DLL%20block%20request%3A%20%3CDLL%20name%3E&status_whiteboard=%5Bdll%5D&version=unspecified DLL Block Request]
# The request will follow the process outlined below until resolved.

If there is an existing bug to be morphed into a blocklist request, make sure the required information (indicated in the request template) is included in the bug before moving it to addons.mozilla.org :: Blocklisting. Please do not move bugs to Blocklisting until they are ready for blocklist consideration.

= Blocklisting Process =
# A request is filed with detailed information as described above
# The vendor or developer of the item in question will be contacted, directed to the bug, and encouraged to fix the issue.
# The request will be discussed in the bug among the Firefox and add-ons product drivers and other interested parties to agree upon validity of the request, block ranges, and severity
# The agreed-upon block range will be placed on the blocklist staging server for anyone to [[Blocklisting/Testing|help test]]
# A bug will be filed to update the [http://www.mozilla.com/blocklist blocklist information page]
# Once the information page is updated, the block will be pushed to production

= What users will see =
[[File:Addonblock.png|600px|thumb|center|Screenshots of add-on block flow|Add-on block flow from a user perspective]]

[[File:Pluginblock.png|600px|thumb|center|Screenshots of plugin block flow|Plugin block from a user perspective]]

= More Information =
* [[Extension_Blocklisting:Code_Design|XML definition]]
* [[Blocklisting/Testing|Testing a staged block]] or [[Extension_Blocklisting:Testing|other blocklist testing]]
* [https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&product=addons.mozilla.org&component=Blocklisting&resolution=--- Open blocklist requests]
* See here for additional [[Extension_Blocklisting|details & information about blocklisting]]