Openness and security: a balancing act for the add-ons ecosystem