Stumbleupon Uses About:Config for profile settings. Valid?

[harrystottle]

I went into about:config on other business (to turn off Geo location nagging) and discovered, to my horror that Stumbleupon has added about 100 lines to it. A number of questions arise:

1) how is that even possible? In my naivete, I had assumed that only Mozilla and myself could alter about:config

2) is it "legal"? or at least permitted?

3) what other 3rd party apps use about:config in a similar way? (I could see no other obviously 3rd party lines in mine but that proves nothing)

4) given the "dragons" warning we get as users, even if it IS permitted, how is it possible that a 3rd party app can make such alterations without us even being aware of it?

5) what are the risks of allowing 3rd party apps to make such un-notified amendments?

6) what are the potential benefits? Presumably there must be some, even if it is only a benefit to the App's authors rather than the user, or else Stumble wouldn't bother. Why, in other words do they use about:config, rather than their own settings file?

7) how, if it is generally agreed that this is an unacceptable practice by Stumbleupon, would I
a) remove all such entries
b) continue using stumbleupon in the absence of those entries and
c) how would I prevent either Stumbleupon or any other 3rd party app making future amendments to about:config without my explicit permission.

[malliz]

If you install something then you should at least have some idea what it is going to do. In theory if you uninstall stumbleupon it should clear those about:config settings many older extensions tend to leave some settings in place however. So cleaning up by right clicking the setting and chose re-set needs to be done in many cases.
The whole point here is many third party extensions change or add about:config settings in order to work.

From the Mozilla Addons page for StumleUpon

Permissions


Some add-ons ask for permission to perform certain functions. Since you’re in control of your Firefox, the choice to grant or deny these requests is yours.

Please note this add-on uses legacy technology, which gives it access to all browser functions and data without requesting your permission.

My guess is you failed to read that

[therube]

I would think that most every extension stores its settings in prefs.js, not just Stumbleupon.

[harrystottle]

>>The whole point here is many third party extensions change or add about:config settings in order to work.

this is the bit that was news to me.

>> Some add-ons ask for permission to perform certain functions. Since you’re in control of your Firefox, the choice to grant or deny these requests is yours.

>> Please note this add-on uses legacy technology, which gives it access to all browser functions and data without requesting your permission.
>>My guess is you failed to read that

I'm well aware of that standard behaviour and take great care in what permissions I grant.

The whole point of my post is that this is done by SU not just without notification at the time (and I've just uninstalled/reinstalled it to confirm the behaviour) but that there is no mention anywhere in its blurb that it does or will use about:config for this purpose.

However, if such use of of the file is as common as you suggest, then it may be a non-issue. My reaction to it was conditioned by the years of dragon warnings on entry which - obviously falsely - gave me the impression that this was a particularly sensitive protected file and not just a routine config file; so thanks for clarifying that. As a result I've just scrolled through looking for evidence of other 3rd party settings and now I'm seeing things like the Keefox, Adblock Plus or Tails settings, which I have noticed before, but had assumed they were Firefox's own record of what those apps were doing, rather than settings inserted by the apps themselves. (also without explicit notification)

Cheers

Harry