In order to even advertise a pay for add-on the developer must have uploaded a real add-on. If this add-on is just junk, i.e. doesn’t really do anything and is just a means for getting a page onto AMO, then it should be removed. I have seen add-ons like that (that weren’t advertising anything) getting removed as a matter of course anyway so I think this is already working.

The next question is whether the add-on is a basic version of the premium add-on. If so then I think it is totally fair that the developer can include text in the page to note that a pay for version is available elsewhere. I’m less enamoured with the idea of including screenshots of the pay-for version on AMO. I think regardless of how well labelled they are there is a strong risk of confusing the user there.

Trial versions of add-ons pose a question. Should AMO be allowing add-ons on the site that will intentionally stop working after a period of time, or that list features in menus that only pop up a message about needing to pay to activate? I don’t think so. I believe a user should be safe to download add-ons from AMO that are whole products and they can count on to continue to work.

If an add-on on AMO is unrelated to a premium version by the same author then more care has to be taken with advertising different add-ons on the same page. I don’t see a problem with a short note at the bottom mentioning that other add-ons from the author are also available elsewhere, but I don’t think mentioning what the other add-ons are or what they do is a good idea.

Overall I think short notes are the way forward, anything where the add-on is more of an advert than an add-on in its own right is something that needs to be carefully looked at.

Update: A couple of commenters have raised the question of whether AMO should just include pay for add-ons in its listing, something that I completely failed to consider. I’m not sure which side I am on on that yet. I think if handled correctly it could work, but maybe I’ll think on it and do a follow up post on the subject.

I’ve also taken this opportunity to move all my extensions to addons.mozilla.org. Most are currently still in the sandbox, hopefully they will come public soon. I’m also using the nice new AMO API service to populate details on the add-on homepages, means there is only one place I need to make most changes to.

What this means is that we are now enforcing a security restriction on all add-ons. To be specific, if an add-on does not provide a secure method of auto-updating then by default Firefox will refuse to install the add-on. If you have add-ons already installed that are insecure in this way then they will be automatically disabled.

The good news is that addons.mozilla.org already uses SSL for it’s updates, so any add-ons you have installed from there will be unaffected by this change. Equally any add-on authors who use SSL on their site, their add-ons will be unaffected. Personally I found 2 of my add-ons were disabled by it, that’s 2 out of nearly 20, so hopefully you won’t see a major impact.

For add-on authors there is an alternate way to provide secure updates without investing in an SSL key involving digital signatures, unfortunately we’ve had to hold off on providing the software to make that possible until the backend changes were complete and reviewed. I hope to have something usable available not too long after M8 is released. Keep an eye on this blog for an update on that.

If you want to see more of the specifics the best place to look is probably at the wiki page. This is all based around the discussions I started on various forums and newsgroups. Hopefully it’s not too much of a surprise to the add-on authors out there, if it is then I apologise, I tried to get the word out as best I could.