At this point I don't think I'll ever return to using firefox after the mountain of stupid shit mozilla has pulled in the last ~2 years.
Firefox 42 will not allow unsigned extensions
61–70 of 315 posts
Re: Firefox 42 will not allow unsigned extensions
#62Well, at least they're paying lip-service to enterprise users who may have internal extensions to deal with: What about private add-ons used in enterprise environments? We haven't announced our plan for this case yet. Stay tuned. In the interim, ESR will not support signing at least until version 45, which won't come out until 2016.
I have seen several suggestions along the following lines as far back as the original blog post which announced the intention to require extension signing
Allow an extension signing certificate to be place in a directory/store which requires elevated privileges to modify (ie /etc/ or similar).
Extensions in the user's profile signed by this certificate will load as if they were signed with the Mozilla certificate.
If the user has enough privileges to add an extension signing certificate then they also most likely have the ability to modify the Firefox itself, I think this addresses any concerns that this method could be used to load malicious extensions (if the user is willing to run unknown executables with elevated privileges then extensions with apparently valid signatures are the least of their worries).
This allows enterprises to sign and distribute their own extensions, with the additional step of creating and distributing the signing certificate, and could work also work for home users.
Re: Firefox 42 will not allow unsigned extensions
#63This is deeply disappointing. Two details: the extensions need to be signed by Mozilla , and only US English speakers will be allowed to disable this requirement. The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software etho…
In addition to the "en-US locale only" restriction, I wonder if unbranded builds will be made available for non-desktop platforms. I would like to run my own extension, or that of the company I work for, on multiple platforms and especially without having to share proprietary source code with Mozilla et al.
I think they removed alternate signature checks from the base code (may affect other browsers), and the preference to disable Mozilla signature checks is a global switch. So they've made things even harder than they have to be for those who don't want to comply with the new model.
According to Mozilla, they have to do this because a user who has control of their OS might install malware and might grant it root/admin privileges. Such malware could not only tamper with extensions, it could tamper with the permission and preference systems and other key components and files. IOW, if Mozilla continues to pursue this policy, we may be looking at the beginning of a more comprehensive lockdown of Mozilla applications.
It might be wise to try to hold the line somewhere. In general, we aren't going to be more secure if we allow ourselves to be locked into simplified configurations that suit the mass market.
Re: Firefox 42 will not allow unsigned extensions
#64At this point I don't think I'll ever return to using firefox after the mountain of stupid shit mozilla has pulled in the last ~2 years.
I share your sentiment, but Google Chrome is better only in terms of performance [1], it fares worse in both privacy and extensibility (no ad blockers/addons on mobile Chrome).
For people like me, who want:
* a free software browser
* android/desktop sync
* adblock and other addons
it is pretty much a binary choice between two evils.
[1]: Possibly, of course -- but that is a debate for another time.
Re: Firefox 42 will not allow unsigned extensions
#65Earlier quoted context omitted.
I can't think of many OSS projects that aren't being manipulated by a strong community of liberals.
Is that the US definition of 'liberal'? i.e. the one that would apply to most center-right parties in the rest of the world?
Probably. I've always considered both US parties to be so far right wrt the rest of the world, that anything even remotely moderate would be labeled "liberal" or "communist". Both terms used with extreme prejudice and disdain, of course.
Re: Firefox 42 will not allow unsigned extensions
#66Earlier quoted context omitted.
> only US English speakers will be allowed to disable this requirement Do they assume that non-English speakers are just drooling baboons who cannot decide this for themselves unlike English speakers?...
Perhaps they assume that to program enough to write an extension, you need to learn English. I’ve met people here in Argentina who say that. My view is that, even if that is the status quo ante (and I’m not sure it really is) it’s a status quo we must disrupt, not ossify.
Wise words, kragen. With the excuse "you need english because" a new form of imperialism is on the making. And what is worse, is that this attitude is often self-imposed.
Re: Firefox 42 will not allow unsigned extensions
#67Earlier quoted context omitted.
> only US English speakers will be allowed to disable this requirement Do they assume that non-English speakers are just drooling baboons who cannot decide this for themselves unlike English speakers?...
Perhaps they assume that to program enough to write an extension, you need to learn English. I’ve met people here in Argentina who say that. My view is that, even if that is the status quo ante (and I’m not sure it really is) it’s a status quo we must disrupt, not ossify.
China [1] and Brazil [2] feature strongly non-English developer communities. Regardless, keying such features to a language is just painfully ignorant. On a closer look though, it appears that beside the developer edition having the setting, the unbranded version will only be released for en-us.
ESR has some bits about "Learn English if you want to code" - but politics of it aside, this isn't even about coding. This is about using a plugin that someone has not signed (like, for instance, RES for Chrome which for the longest time did not have a Store entry iirc).
Re: Firefox 42 will not allow unsigned extensions
#68Mozilla is doing everything to stop using their browser.
Re: Firefox 42 will not allow unsigned extensions
#69It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…
Super noob question: Would it make sense for FF to realize a version which an extension is approved for? You create an extension capable for 1.0, they release 1.1, any client who has 1.1 has the extension automatically disabled? Assuming this is your business and you dont mind going through the approval process, then your users would have a better experience with this process no? Being notified they simply can't use it yet?