Firefox 42 will not allow unsigned extensions • Hacker News Board

Re: Firefox 42 will not allow unsigned extensions

#11

Post by nathanb » Tue, Aug 11, 2015, 4:41 AM UTC

It's the "no override" part that concerns me.

I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example).

Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never catches the breakage. But that's a side rant....

There can be a decent turnaround lag (sometimes on the order of a few days) to get a new version of an extension reviewed by addons.mozilla.org. In the meantime, I have made a habit of building a new version of the extension and giving it to anyone who asks. Some people rely on it to use the web and can't wait for Mozilla to do their thing (another side rant: I once stupidly forgot to check in a key resource. I've since changed my development process to keep this from happening again. But the non-functional extension that I pushed passed Mozilla's review just fine. Makes me wonder how much value the review process is really adding.)

If I want to be able to continue this process, I will need to sign the extension myself (and who knows what histrionics Firefox will throw if a user tries to replace an extension with one that has the same UUID but a different signature!)

Re: Firefox 42 will not allow unsigned extensions

#12

Post by mveety » Tue, Aug 11, 2015, 4:41 AM UTC

brighteyes wrote: post #8

mveety wrote: post #6

What is the point of this? Shouldn't users be allowed to make their own decisions no matter how stupid or dangerous?

Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.

Why don't we teach people the don't understand so they can make informed choices instead of preventing it entirely?

Re: Firefox 42 will not allow unsigned extensions

#13

Post by brighteyes » Tue, Aug 11, 2015, 4:43 AM UTC

nathanb wrote: post #11

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…

> There can be a decent turnaround lag (sometimes on the order of a few days)

Actually, the link says

> Files submitted for signing will go through an automated review process. If they pass this review, they are automatically signed and sent back to the developer. This process should normally take seconds

You may be thinking of a different type of review process, the signing one sounds almost instantaneous.

Re: Firefox 42 will not allow unsigned extensions

#14

Post by brighteyes » Tue, Aug 11, 2015, 4:44 AM UTC

mveety wrote: post #12

brighteyes wrote: post #8

Earlier quoted context omitted.

Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.

Why don't we teach people the don't understand so they can make informed choices instead of preventing it entirely?

We should teach people, yes! At the same time, educating hundreds of millions of people takes time.

Re: Firefox 42 will not allow unsigned extensions

#15

Post by smtddr » Tue, Aug 11, 2015, 4:46 AM UTC

mveety wrote: post #12

brighteyes wrote: post #8

Earlier quoted context omitted.

Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.

Why don't we teach people the don't understand so they can make informed choices instead of preventing it entirely?

There are a lot of things I wish the general public would try to get educated about so they can make informed choices.

  1) Nutrition
  2) Politics(especially taxes & wars)
  3) Computers
  4) Finances

If you can figure out how get people properly educated on even 2 of those things, the world would be a very different place.

Re: Firefox 42 will not allow unsigned extensions

#16

Post by tomjen3 » Tue, Aug 11, 2015, 4:47 AM UTC

brighteyes wrote: post #13

nathanb wrote: post #11

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…

> There can be a decent turnaround lag (sometimes on the order of a few days) Actually, the link says > Files submitted for signing will go through an automated review process. If they pass this review, they are automatically signed and sent back to the developer. This process should normally take seconds You may be thinking of a different type of review process, the signing one sounds almost instantaneous.

If it passes.

Nobody knows what it checks for or how it works.

Re: Firefox 42 will not allow unsigned extensions

#17

Post by ubernostrum » Tue, Aug 11, 2015, 4:48 AM UTC

GeorgeOrr wrote: post #2

It's important to note that the Developers Editions (and the Nightlys) will have a setting for disabling the requirement. The assumption being that developers need to test as they develop. And are a more informed user.

I had to flip that setting this morning when dev edition updated and disabled the 1Password extension. It's "xpinstall.signatures.required", for reference.

Re: Firefox 42 will not allow unsigned extensions

#18

Post by x0x0 » Tue, Aug 11, 2015, 4:48 AM UTC

mveety wrote: post #12

brighteyes wrote: post #8

Earlier quoted context omitted.

Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.

Why don't we teach people the don't understand so they can make informed choices instead of preventing it entirely?

Because that's been such an unqualified success for the last 30 years we've tried it.

Re: Firefox 42 will not allow unsigned extensions

#19

Post by tomjen3 » Tue, Aug 11, 2015, 4:50 AM UTC

mveety wrote: post #6

What is the point of this? Shouldn't users be allowed to make their own decisions no matter how stupid or dangerous?

Can't have censorship if users have the option of overriding it, can we?

Firefoxs plugin development is already a pain in the ass. They should focus on making it simpler, not giving more reasons to fork it.

Re: Firefox 42 will not allow unsigned extensions

#20

Post by Animats » Tue, Aug 11, 2015, 5:16 AM UTC

brighteyes wrote: post #13

nathanb wrote: post #11

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…

> There can be a decent turnaround lag (sometimes on the order of a few days) Actually, the link says > Files submitted for signing will go through an automated review process. If they pass this review, they are automatically signed and sent back to the developer. This process should normally take seconds You may be thinking of a different type of review process, the signing one sounds almost instantaneous.

That's for non-public add-ons. If you submit a public add-on, even a minor update, it has to go through the AMO bureaucracy. I currently have an update that was uploaded on July 10, 2015, and is at queue position of 64 of 137. There are no code changes; it's just being updated because Mozilla changed their build system.

This seems to be part of Mozilla's effort to be more like the Apple and Google stores.

Mozila AMO - Learn to embrace the pain.