Hi, wonderful developers, I would like to address an issue that some of you have faced lately: long manual review times.
A lot of people are reporting long manual review times, and that’s true, but not because we are reviewing fewer add-ons. Our average time to review hasn’t changed much, nor has our capacity to review new versions.
What we have noticed so far:
- We’re experiencing up to 4x increase in the number of new add-ons and versions submitted!
- The size of the new versions has significantly increased = more files, more lines of code, and way more difficult for our reviewers to do a speedy review.
- People with little coding skills are writing more and more add-ons.
- It’s easier than ever for people to build bots and fake users.
- As a result, malicious attacks have become more regular than ever, with a recent example publicized a few weeks ago.
Our top priority is the safety of our users and developers; that’s why we are continuously working to address these emergent issues. Our manual review times currently vary, but it is worth noting that only a small percentage of the add-ons submitted daily are added to the manual review queue.
To address these emergent issues, we are continuously working on:
- Extending the capabilities and improving the effectiveness of our automated malware-detection tools.
- Decreasing the time to identify and take action against malicious actors and spam.
- Further streamlining our internal processes and evaluating new approaches to address the volume and review times for new add-on versions.
All of the above have already been contributing towards our manual review capabilities. We could also use your help in this ongoing situation.
What can you do:
- Double and triple-check your code and your add-on’s behavior against our policies. The most common violations we see are:
- About the Data Collection and Transmission Disclosure and Control: please use Firefox’s taxonomy in case you collect, process, or store any data.
- Remote Code Execution: Add-ons must be self-contained and not load remote code for execution.
- Attach source code during every submission if your add-on contains machine-generated code.
- Provide a single set of instructions, or better yet, a single-command build script that reviewers can execute.
- Manually verify that the build fully reproduces without differences using only the provided source code and build script (or instructions), ideally on a separate machine.
- Please refrain from contacting us directly to request a faster review.
We really appreciate your patience and support while we navigate this new era. Rest assured, we are doing our best to increase capacity, reduce the manual review times, and strengthen security.
On behalf of the Mozilla Add-ons Team,
-Christos