unauthorized, unverified and outdated uBlock Origin binary on Safari Extensions Gallery and "marketing" website

[vassudanagunta]

The issue:

1. @hartator published in the Safari Extensions Gallery a "uBlock Origin" extension binary as "Chris Aljoudi/Raymond Hill", linking to Ellis Tsung's GitHub account, without advanced notification, permission or authorization from Raymond Hill or Ellis Tsung. (It's an additional insult that Chris Aljoudi is even mentioned.)
2. @hartator unilaterally created and maintains a "marketing site" (his own words): https://hartator.github.io/uBlock-Safari/, also without advanced notification, permission or authorization, linking to another "uBlock Origin" binary.

You can read the detailed history of this situation under Issue #34.

Even if @hartator had good intentions, this is very bad and should no longer go unaddressed.

Why is this bad?

• uBlock Origin is used by thousands if not millions of people. This fact amplifies everything I say below.
• @hartator did this without the creators/maintainer's knowledge. He admitted to it after-the-fact.
• @hartator had to impersonate or claim to be acting as an authorized representative of the names he supplied to Apple when he published to the Gallery using his Apple Developer account. As long as he keeps it up in the gallery, he is continuing to represent it as such.
  • Here is a link to the Apple Developer Program License Agreement. IANAL, but I'm pretty sure by agreeing to this agreement and by signing the extension with his certificate, he made false representations to Apple, and violated multiple clauses of the agreement.
  • Whether or not you care about Apple's policies, its users trust that software they install through Apple is software that follows its policies and rules.
• The marketing site (link to today's snapshot on InternetArchive) impersonates an official, authorized website for uBlock Origin.
• The marketing site links to yet another binary of the extension.
• This means there are two binaries out there not built or managed by the creators/maintainers of uBlock Origin, yet published under their names. This is a SERIOUS SECURITY ISSUE:
  • The binaries are outdated (7 months and 3 versions old as of this writing). If a uBlock Origin security vulnerability is discovered, users who have installed this unauthorized build will not get notified or updated.
  • The binaries are unverified. We are trusting @hartator built the source code untouched. He may be a good guy, but this is a very bad practice.
  • The binaries are unauthorized: People should only be installing binaries published by the actual sources, not unknown and unauthorized third parties that decide to post their own build. @hartator, by publishing of under those names without their permission, is making a misrepresentation to the public.
• People are being mislead and confused.
• uBlock has already been victim to someone absconding with and damaging the brand. In that case, Raymond Hill himself called that website a "misrepresentation". Let's not be sloppy about such things again.

@hartator has had 6 months to rectify this deed, but nothing has changed.

[gorhill]

I don't have any browser which allows me to see the extension in Apple store, that is what I get with your link:

So at this point I cannot even get 1st-hand knowledge about this. If there is something I could do, like report it to Apple store as a fraudulent version (assuming that is possible), I need at least to get 1st-hand knowledge about what is there.

[BugDave]

It will show for me using vivaldi.

…

On Oct 11, 2017, at 8:06 AM, Raymond Hill ***@***.***> wrote: I don't have any browser which allows me to see the extension in Apple store: So at this point I cannot even get 1st-hand knowledge about this. If there is something I could do, like report it to Apple store as a fraudulent version (assuming that is possible), I need at least to get 1st-hand knowledge about what is there.

[vassudanagunta]

@gorhill Here is a screenshot for that link in Safari. Here is the Install now ↓ link if you want to examine what it points to: https://safari-extensions.apple.com/extensions/com.el1t.uBlock-8782JU4WM4/uBlock.safariextz.

[vassudanagunta]

@gorhill Here is how it appears in Safari once installed.

[vassudanagunta]

@gorhill @el1t

Here is the source for @hartator's "marketing site": hartator/uBlock-Safari.

I created an issue under it requesting that he remove the site and the distributions: hartator/uBlock-Safari#1

[gorhill]

Is there a way for you to download the package as served by Apple store? I would like to do a diff with the one here.

[vassudanagunta]

Sure. GitHub required me to to zip it first: uBlock.safariextz.zip

But here again is the download link on apple.com so that you can get it from "the source": https://safari-extensions.apple.com/extensions/com.el1t.uBlock-8782JU4WM4/uBlock.safariextz

[vassudanagunta]

@gorhill You can use xar to extract the contents of a safariextz file. Let me know if I have to do that on macOS for you.

[gorhill]

I don't have xar, doesn't look like it's readily available on linux.

[vassudanagunta]

No problem, I unpacked it for you: uBlock.safariextension.zip

[aggarwalankush]

when I installed the ublock using instructions from here - https://github.com/el1t/uBlock-Safari/tree/safari/dist#install, safari showed me a new version 1.14.14 is available to update the extension. Maybe @el1t fixed the issue as I can see this new repository - https://github.com/el1t/uBlock-Safari-releases has 1.14.14

[gorhill]

Ok, that version in Apple store is pretty much exactly 1.11.3b1 + two fixes in the platform-specific code: 1.11.3b1...19e8fe8. In short, nothing bad in the Apple store version.

However, it is a dated one, and from what I understand, the most pressing issue is that it's getting in the way of the official one from being updated.

Aside this, there is the fact that the extension in the store fail to disclose that it is not published by the official maintainer of the extension -- @el1t.

So @hartator, can you help resolve this as soon as possible?

[vassudanagunta]

There's also the "marketing" website. Either it should be blessed as official or shut down, in my opinion.

If it is blessed as official, it needs to point to the latest build in @el1t 's repo, and state that at present it is not a stable version. I'd recommend transferring the hartator/uBlock-Safari repo to @el1t as well.

[hartator]

I am so sorry for all the troubles caused.

For what is worth, I didn't meant any harms. I also haven't done any modifications to either modify how the extensions behave or claim ownership. I was sad at the time that uBlock Origin wasn't available for Safari and decided package it properly and to make an Apple submission. I fully understand it was a bad call.

I've already contacted Apple and they didn't got back to me. I don't have special access to the extension via my iTunes connect account and it appears they manage the extension pages manually unlike the regular App Store apps.

I've given write access to el1t and gorhill of my repository. Feel free to remove it, modify it, or redirect to another website whatever you feel is best.

What else can I do?

[hartator]

To be clear, the only way I have to communicate or update the extension is still: https://developer.apple.com/safari/extensions/submission/

There is no extension page on my account or anything looking like that.

[vassudanagunta]

@hartator Honestly, I believe you have to look/try harder. Only paying developers can even submit to the Extension Gallery, so it's hard to believe there is no way for you to take down an extension.

There are many developer support points of contact on this page for you to try: https://developer.apple.com/contact/

[Coriou]

@vassudanagunta I think @hartator is right though, the Extension Gallery is a mess and I also believe it's managed manually, or at the very least semi-manually.

Contacting Apple to remove it, might be in fact (as awful and outdated as it sounds) the only real option here.

[ya-d]

// Please ignore, I just found out that this conversation is already being had at #34. Sorry.

I appreciate any efforts to set things straight. But in general, wouldn't it be very desirable to have the official uBlock Origin available in Apples gallery? It might be a mess on its own but it provides automatic updates to users if properly maintained. So the user experience would be to "add once and forget".

[sinarquia]

Hi!

Sorry to bother you, but, is it ok to update to 1.14.14?

Thanks for your work. Much appreciated!!

[el1t]

So yeah, the practical side of the issue is that updating is more a hassle with the resign and upload delay. I'd recommend submitting some sort of feedback/bug report on the Apple contact site, but I'm not sure if they are reviewing them...
The releases repo that @aggarwalankush mentioned kind of works; it shows up like so

Easier than downloading and installing from github, but it doesn't auto-update—seems like Apple restricted that to gallery apps only. I'll mention that in the github release.

[vassudanagunta]

Why is @chrisaljoudi's name associated with this extension, and why is his name placed ahead of @gorhill's? Chris does not deserve to be rewarded after the stunts he's pulled and continues to pull. I'd say the extension should have Raymond Hill/Ellis Tsung as the named responsibles.

[alexchandel]

Why not just publish this plugin to the Safari Extensions Gallery yourself? All of these impersonation problems would be solved in that case. The extension may not be 1000% stable, but at least it's there, and it's far more accessible to the technologically disinclined. For example, directing a parent to the Extensions Gallery is far (far) easier than instructing them to download a Github release & to remember to keep it up to date.

[vassudanagunta]

@alexchandel, agreed, but apparently the @hartator publish to the gallery is blocking anyone else from publishing. Please read the history:

You can read the detailed history of this situation under Issue #34.

[vassudanagunta]

Another three weeks have passed. I just submitted a report to https://www.apple.com/feedback/safari.html.

@el1t, maybe you should fill out the App Store Content Dispute form: https://www.apple.com/legal/internet-services/itunes/appstorenotices/#/contacts?lang=en

Again, I think this is the responsible thing to do because many uBlock Origin users (thousands? millions?) trust the Extension Gallery and have no idea they are running an outdated and non-updating extension.

[maciejtarmas]

Another three weeks have passed. I just submitted a report to

Another report submitted.

[Baccount]

Try sending a report through Apple's bug reporter. https://bugreport.apple.com

[ghost]

Looks like the old version is not present in the Safari Extensions Gallery anymore, would it be the right time to add the correct auto-update enabled one ?

[JonoHaysom]

yup.. stuck and wont install. hopefully the dev can help soon

[gingerbeardman]

I can reach of to a Safari contact at Apple if required

[vassudanagunta]

@el1t @gorhill. So Chris Aljoudi is up to something with uBlock. 11 days ago he created a GitHub org named uBlockAdmin (it looks like someone else is squatting on github/uBlock). He's apparently registered "uBlock, LLC" (listed on the org page). I'd bet money that he'll soon put "his" uBlock in the App Store.

I care about this because I care about Internet users as you two obviously do, and they are currently being deceived and misled by his actions, presentation and words. They are also being misled by the GitHub stars his repo retains, and the ublock.org website he created. He continues to collect money under false pretenses ("Please donate to help keep uBlock alive!" at the top of his website), and despite not having updated the extension in 3 years. He has not responded to a single one of the growing list of open Issues, but he has taken the time to reply to, rename, delete and close complaints about his dishonesty.

If "his" uBlock gets into the App Store first

If "his" uBlock gets into the App Store first it will build up an install base and then in turn come up first in search results, even if uBlock Origin is also there. Also, once people have it installed, they'll stay with it because they won't know better, since it will auto-update.

So I think it i very important to get uBlock Origin into the App Store, along with text or link to text warning people, maybe this.

I think we should also urge @hartator to transfer or shutdown his website. It's just a GitHub Pages site. See hartator/uBlock-Safari#1. The page still links to an outdated extension binary.

In other words there are unsuspecting users who are installing either Chris Aljoudi's three year old and dishonest one, or an outdated and non-updating version of the official one.

Perhaps I can petition GitHub to release github/uBlock if it makes sense to create an Org which @gorhill would own and control.

@gorhill I'm including you because I know you care about this too, even if you're leaving Safari to Ellis.

I know you two are busy. Let me know if I can help.

Thoughts?

[yuusharo]

Hoping to get some final clarification on this issue.

It appears a 'Ublock Origin' extension has once again been added back to the Safari Extensions Gallery. Installing extensions from this repo prompts Safari with an option to install from the gallery.

Is the new version on the gallery maintained and updated by the admins and developers of this repo, or is this yet another port/ripoff by yet another cloner?

Thanks in advance! It's been extremely confusing and, at times, frustrating to figure out which Ublock Origin Safari extension is the official sanctioned version.

[gingerbeardman]

The ID of the extension contained el1t so I assumed it was legit.

[bryandmlee]

Going with what @gingerbeardman has said, assuming this copy was uploaded by Ellis, the developer name is still listed as "Chris Aljoudi/Raymond Hill" in the search result and extension page though (it does correctly link to this repository).

@el1t Can you confirm you were the one who uploaded to the Safari Extensions Gallery? And do get the developer name changed to the same "Raymond Hill/Ellis Tsung" credit on the SEG listing yeah? (Hopefully it won't be a pain to do so, like taking down the previous version of the extension was…)

[vassudanagunta]

I think everyone can relax. The extensions gallery has @el1t's latest release. If you click on the "commits to safari since this release" link on that page, you'll see that the developer name has been updated and will be reflected in the next release to the extensions gallery.

My comment above is about getting uBlock Origin into the App Store, which is what Safari's Safari Extensions... menu and the More Extensions... button now points to (so most Safari users will not find uBLock Origin, and will find Chris Aljoudi's if he, as I predict, publishes to the store). But App Store Safari Extensions are different, and it may put an extra development burden on Ellis, and the Dev Program costs $99 (It can be waved if you are a non-profit with legal status, which is what Chris Aljoudi might be doing with his LLC). I'd be happy to donate. This pisses me off that Apple is doing it this way, but ignoring it might not be great for users either.

Also @hartator still hosting and delivering an outdated build on his webpage, posing as the official source. I just checked and that build has a distinct ID and installs next to Ellis's build if you try to install it.

[gingerbeardman]

Extensions in the Mac App Store is a really piss poor way to migrate away from the extensions website (which was poor anyway). Embarrassing. And I used to work for Apple!

[clement-escolano]

🎉 Today, my computer updated the extension with the latest version and the correctly set authors. It shows Raymond Hill/Ellis Tsung as the authors both on the extensions website and on the extension tab in Safari. I guess this part of the problem can be marked as resolved ! 🍾

[JBallin]

Shouldn't the README touch on the fact that the extension can be downloaded directly from Safari extensions?

[vassudanagunta]

closing as this project looks dead.

[gingerbeardman]

closing as this project looks dead.

@vassudanagunta it's not dead, just slow

[maciejtarmas]

it's not dead

It's just pining for the fjords 🤪

[translit]

You stunned the project, just as it was waking up! uBlocks stun easily. :-D