unauthorized, unverified and outdated uBlock Origin binary on Safari Extensions Gallery and "marketing" website #69
Description
The issue:
- @hartator published in the Safari Extensions Gallery a "uBlock Origin" extension binary as "Chris Aljoudi/Raymond Hill", linking to Ellis Tsung's GitHub account, without advanced notification, permission or authorization from Raymond Hill or Ellis Tsung. (It's an additional insult that Chris Aljoudi is even mentioned.)
- @hartator unilaterally created and maintains a "marketing site" (his own words): https://hartator.github.io/uBlock-Safari/, also without advanced notification, permission or authorization, linking to another "uBlock Origin" binary.
You can read the detailed history of this situation under Issue #34.
Even if @hartator had good intentions, this is very bad and should no longer go unaddressed.
Why is this bad?
- uBlock Origin is used by thousands if not millions of people. This fact amplifies everything I say below.
- @hartator did this without the creators/maintainer's knowledge. He admitted to it after-the-fact.
- @hartator had to impersonate or claim to be acting as an authorized representative of the names he supplied to Apple when he published to the Gallery using his Apple Developer account. As long as he keeps it up in the gallery, he is continuing to represent it as such.
- Here is a link to the Apple Developer Program License Agreement. IANAL, but I'm pretty sure by agreeing to this agreement and by signing the extension with his certificate, he made false representations to Apple, and violated multiple clauses of the agreement.
- Whether or not you care about Apple's policies, its users trust that software they install through Apple is software that follows its policies and rules.
- The marketing site (link to today's snapshot on InternetArchive) impersonates an official, authorized website for uBlock Origin.
- The marketing site links to yet another binary of the extension.
- This means there are two binaries out there not built or managed by the creators/maintainers of uBlock Origin, yet published under their names. This is a SERIOUS SECURITY ISSUE:
- The binaries are outdated (7 months and 3 versions old as of this writing). If a uBlock Origin security vulnerability is discovered, users who have installed this unauthorized build will not get notified or updated.
- The binaries are unverified. We are trusting @hartator built the source code untouched. He may be a good guy, but this is a very bad practice.
- The binaries are unauthorized: People should only be installing binaries published by the actual sources, not unknown and unauthorized third parties that decide to post their own build. @hartator, by publishing of under those names without their permission, is making a misrepresentation to the public.
- People are being mislead and confused.
- uBlock has already been victim to someone absconding with and damaging the brand. In that case, Raymond Hill himself called that website a "misrepresentation". Let's not be sloppy about such things again.
@hartator has had 6 months to rectify this deed, but nothing has changed.