Hello! I am one of the many developers of extensions who are currently faced with the spectre of the message “This is not a Recommended Extension. Make sure you trust it before installing.” on my extension’s page - along with a warning triangle.
While I appreciate Mozilla’s desire to help protect users, I was wondering if this could perhaps be approached a bit differently. I tried placing myself in a potential user’s shoes tonight and here was my thought process:
- “Hmmm, not recommended. That’s not good. I’ll look for a different one.”
- “Hey, I’ve seen a similar message to this before! I’ve gotten warnings kind of like this for pages not using HTTPS! I bet this developer just isn’t into security. I should stick to someone who is more trustworthy.”
Importantly, here are some things that I did not think:
- “That Learn More link will have something I find useful as a non-technical person so I should click it.”
- “Recommended Extension - that must be some special program that Mozilla has to protect me as a user.”
While the linked page is quite explanatory, I think most folks will never even go there. I believe they will assume that as a developer I am not doing something I should be doing and have agency to do. I think a warning message of some sort is fine, but I think we don’t want to bury the lede regarding the scope of developer responsibility in the process.
How about something like this for addons with low numbers of users:
“This addon is not yet eligible for the Recommended Extension program because it does not have enough users. As such, it passes automated security scans but hasn’t gone through an extra expert-based security audit that happens when an addon is selected for curation. Keep that in mind and let the community know if there any concerns.” (with an appropriate link to the forums to report security concerns, etc.) And then of course, include the “Learn More” button.
Similarly in the case of addons with lots of users but that are not recommended yet:
"“This addon is not yet part of the Recommended Extension program. As such, it passes…” etc.
I know it’s a bit wordy, but I think something like that would help better explain the true state of affairs and help new addons from developers like me find pioneering users rather than scaring them away.
What do other members of the community think? Are my concerns unfounded? How has new user adoption fared in light of the messages as they currently are?