Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 42 will not allow unsigned extensions

wiki.mozilla.org

Post reply on HN
Print view View original

21–30 of 315 posts

Re: Firefox 42 will not allow unsigned extensions

#21

Post by Dylan16807 »

mveety wrote: post #12
brighteyes wrote: post #8

Earlier quoted context omitted.

Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.

Why don't we teach people the don't understand so they can make informed choices instead of preventing it entirely?

The choice isn't prevented. There is just a small barrier put in place of the choice. Installing a different version of firefox is not difficult, but it makes sure the user is absolutely sure, and helps get an idea across of the ramifications.

Re: Firefox 42 will not allow unsigned extensions

#23

Post by cortesoft »

mveety wrote: post #12
brighteyes wrote: post #8

Earlier quoted context omitted.

Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.

Why don't we teach people the don't understand so they can make informed choices instead of preventing it entirely?

There are way too many decisions we need to make in this world to really be informed on every one. Of course, in our world, understanding software and safety is in our scope of knowledge, so we believe everyone should have it. However, not everyone is in our world. I am sure tech people make all sorts of uninformed decisions in other realms that people in those fields would be appalled at. It is OUR job to help protect regular people who don't have the time to learn our world be safe, just as it is the job of those other fields to help keep us safe.

Re: Firefox 42 will not allow unsigned extensions

#24

Post by scintill76 »

Ah, feels like they're following Chrome's example, which decreed that it should be exceedingly difficult for Windows Chrome users to install extensions from somewhere other than https://chrome.google.com/webstore/ . This basically killed an internal app we had at work (a fork of a "REST client", with some added request-signing features specific to our internal APIs.) There was no strong reason to keep it secret, but there had previously been no need to put it in the store either, and there was a $5 charge to publish in the Web Store, which I didn't feel like dealing with.

Anyway, they are both measures taken to stop malware, by taking an option away from the user, that most users won't even notice, but many "power users" will be inconvenienced to varying degrees. I'm guessing Firefox's won't be as bad, since the "developer version" that will let you keep doing the old way probably won't differ from the normal version as much as Chrome's does.

Re: Firefox 42 will not allow unsigned extensions

#25

Post by Buge »

mukundmr wrote: post #22

What happens to all of those extensions that are on they gray area of DMCA? Who is this move benefiting? The users or the sponsors?

>>Is this a way for Mozilla to censor add-ons they don't like, enforce copyright, government demands, etc.?

>No, the purpose of this is to protect users from malicious add-ons. We have clear guidelines[1] for when it is appropriate to blocklist an add-on and have refused multiple times to block for other reasons.

[1] https://developer.mozilla.org/en-US/Add-ons/Add-on_guideline...

Copyright, DMCA, and legal concerns are not listed. So I take that to mean nothing will be rejected from signing for those reasons. Hosting on AMO has stricter rules, so they could sign the extension for you to host, but refuse to host it themselves.

Re: Firefox 42 will not allow unsigned extensions

#26

Post by mindcrime »

Well, at least they're paying lip-service to enterprise users who may have internal extensions to deal with:

  What about private add-ons used in enterprise environments?

  We haven't announced our plan for this case yet. Stay tuned. 
  In the interim, ESR will not support signing at least until 
  version 45, which won't come out until 2016.

Re: Firefox 42 will not allow unsigned extensions

#27

Post by gnaritas »

mveety wrote: post #12
brighteyes wrote: post #8

Earlier quoted context omitted.

Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.

Why don't we teach people the don't understand so they can make informed choices instead of preventing it entirely?

They can't be taught, nor do they care to be. Education is not the solution to the problem of users who don't want to know.

Re: Firefox 42 will not allow unsigned extensions

#29

Post by ekianjo »

brighteyes wrote: post #8
mveety wrote: post #6

What is the point of this? Shouldn't users be allowed to make their own decisions no matter how stupid or dangerous?

Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.

> It does make sense to keep the defaults where it prevents most users from harm.

Wait, did we have an extension-caused apocalypse recently leading to this requirement ? Erm, I guess not. So why do we exactly need it ?

Re: Firefox 42 will not allow unsigned extensions

#30

Post by kragen »

This is deeply disappointing.

Two details: the extensions need to be signed by Mozilla, and only US English speakers will be allowed to disable this requirement.

The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software ethos that made Firefox possible in the first place.

I understand the issue of users being tricked into downloading and installing malicious extensions. If you let someone program, they will be able to paste malicious code. I just don’t think that taking away users’ ability to modify their own browsers is an acceptable solution to that.

If this disturbing move sticks, Mozilla will become an increasingly tempting target for whatever group wants to control what software you can install on your own computer — whether that’s Sony Pictures, the NSA, or Amazon.

The old free software movement has died. We need a new free software movement.

Post reply on HN