Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 42 will not allow unsigned extensions

wiki.mozilla.org

Post reply on HN
Print view View original

121–130 of 315 posts

Re: Firefox 42 will not allow unsigned extensions

#121

Post by TazeTSchnitzel »

phpmal wrote: post #106
kragen wrote: post #30

This is deeply disappointing. Two details: the extensions need to be signed by Mozilla , and only US English speakers will be allowed to disable this requirement. The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software etho…

Mozilla have been doing odd things in recent years, almost like they are transitioning into an authoritarian movement. Want to use unsanctioned extensions? No, go away. Want to use non-secure HTTP? Sure, but we will take away your features. Want to work for them but have unapproved views? Fired. All this is from viewing them as an outsider, so you never know, but something is different.

Mozilla hasn't fired anyone for their views.

And caring about users' security is to be commended.

Re: Firefox 42 will not allow unsigned extensions

#122

Post by TazeTSchnitzel »

WireWrap wrote: post #63
kragen wrote: post #30

This is deeply disappointing. Two details: the extensions need to be signed by Mozilla , and only US English speakers will be allowed to disable this requirement. The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software etho…

In addition to the "en-US locale only" restriction, I wonder if unbranded builds will be made available for non-desktop platforms. I would like to run my own extension, or that of the company I work for, on multiple platforms and especially without having to share proprietary source code with Mozilla et al. I think they removed alternate signature checks from the base code (may affect other browsers), and the prefere…

> might install malware

Might? This happens very frequently.

> might grant it root/admin privileges

They don't need to, if you have the browser you have all the good stuff.

Re: Firefox 42 will not allow unsigned extensions

#123

Post by rquirk »

Will this also affect Firefox for Android?

Mozilla currently don't provide a dev build for Android, just regular and beta versions https://play.google.com/store/apps/developer?id=Mozilla

The security problem that this "fixes" is not really an issue on Android due to Android's own app sandboxing, so maybe the Android build will allow unsigned extensions? It's not mentioned in the FAQ.

Re: Firefox 42 will not allow unsigned extensions

#124

Post by mikegerwitz »

kragen wrote: post #30

This is deeply disappointing. Two details: the extensions need to be signed by Mozilla , and only US English speakers will be allowed to disable this requirement. The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software etho…

> The old free software movement has died. We need a new free software movement.

There is nothing wrong with the free software movement just because someone does something disagreeable---that's like saying there's something wrong with your operating system because you have malware on it.

Re: Firefox 42 will not allow unsigned extensions

#125

Post by shdon »

SkatAndRap wrote: post #110
alfapla wrote: post #47

It's little more than a year ago that Brendan Eich was ousted from Mozilla by an ugly orchestrated cabal. When I read Mitchell Baker's vapid blog post [1] on the decision, filled with polite backstabbing and politically correct buzzwordery I understood that Mozilla has been taken over by politicians and that its decline is just a matter of time. [1] https://blog.mozilla.org/blog/2014/04/03/brendan-eich-steps-...

I have been looking at https://input.mozilla.org/ now and then for a long time, and I am still astounded at how it's typically around 90% unhappy, 10% happy. I know that some Mozilla supporters will justify that huge difference by saying, "but unhappy people will always complain and happy people won't say anything", but I don't think that's necessarily the case. Here we have Mozilla's own stats saying that a lot of t…

Take a look at the platform statistics there. Nearly half of the feedback (46%) comes from Android users. Reading the comments, they seem like the (very uninsightful) reviews you typically see in the Google Play Store where the "unhappy people will complain" seems to be quite true.

Firefox for Android is a fundamentally different beast from the browser on Windows/Linux/MacOS. I am quite happy with the desktop version, yet I find the mobile experience quite underwhelming.

If you limit the selection by platform, on Android it will even show "100% sad, 0% happy" -- Mozilla has some work to do there. On Windows 7 you get "81% sad, 19% happy". Still bad, I agree, but don't just dismiss the inherent bias of a feedback system. And compare them to the stats for competitors, too.

Re: Firefox 42 will not allow unsigned extensions

#126

Post by TazeTSchnitzel »

SkatAndRap wrote: post #120
userbinator wrote: post #103

Mozilla's hypocrisy is astounding: https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." https://blog.mozilla.org/theden/2014/12/15/introducing-a-sma... "Firefox is dedicated to putting users in control of their online experience" More recently: https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in... "Firefox Puts You…

Firefox users see through this feel-good marketing nonsense from Mozilla. They've seen Firefox's UI change for the worse in so many ways, even in the face of wide opposition. They've seen unwanted bloat, like Hello and Pocket, forced upon them, again in the face of wide opposition. They've seen their requests for bug fixes and performance improvements go unheeded, sometimes for years. The easy use of extensions has b…

Some people hate the UI changes. A lot of people are just fine with them.

Hello and Pocket are just two buttons in a toolbar which you can remove.

Re: Firefox 42 will not allow unsigned extensions

#127

Post by userbinator »

TazeTSchnitzel wrote: post #119
userbinator wrote: post #103

Mozilla's hypocrisy is astounding: https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." https://blog.mozilla.org/theden/2014/12/15/introducing-a-sma... "Firefox is dedicated to putting users in control of their online experience" More recently: https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in... "Firefox Puts You…

Users still have control. You can remove plugins you don't like, and if you really want to, use a version of a plugin which allows unsigned extensions. Arguably this change might give users more control: Trojan horses can no longer secretly side load malware.

Users still have control. You can remove plugins you don't like, and if you really want to, use a version of a plugin which allows unsigned extensions.

You could argue that as long as users can still download a disk editor and change any byte of the disk on their machine they still have control (in fact patching out this signature check could probably be done with a single-byte change to the binary...); the problem is when this control is made more and more difficult.

Re: Firefox 42 will not allow unsigned extensions

#128

Post by atopal »

SkatAndRap wrote: post #110
alfapla wrote: post #47

It's little more than a year ago that Brendan Eich was ousted from Mozilla by an ugly orchestrated cabal. When I read Mitchell Baker's vapid blog post [1] on the decision, filled with polite backstabbing and politically correct buzzwordery I understood that Mozilla has been taken over by politicians and that its decline is just a matter of time. [1] https://blog.mozilla.org/blog/2014/04/03/brendan-eich-steps-...

I have been looking at https://input.mozilla.org/ now and then for a long time, and I am still astounded at how it's typically around 90% unhappy, 10% happy. I know that some Mozilla supporters will justify that huge difference by saying, "but unhappy people will always complain and happy people won't say anything", but I don't think that's necessarily the case. Here we have Mozilla's own stats saying that a lot of t…

Those approval ratings you speak of are usually reported as a part of representative studies. What do you think is the approval rating of Obama, if you only ask people who support Jeb Bush's campaign?

Input is anything but representative, it's not meant to be. It's there to catch things as early as possible.

Re: Firefox 42 will not allow unsigned extensions

#129

Post by TazeTSchnitzel »

Communitivity wrote: post #100

Epic fail. Mozilla should be making the browser subsystems more secure, not saying 'Trust us, we'll ensure your add-ons are secure'. Will the add-ons source code be reviewed by a CISSP skilled in the languages used within the add-on? Will the add-on be tested with the top 1000 add-on combinations out there? If the add-on provides an API, will it be tested using fuzzing? The list of these questions, and the others to…

The law allows people to make mistakes. You clearly have no idea what you are talking about.

Re: Firefox 42 will not allow unsigned extensions

#130

Post by shdon »

ck2 wrote: post #83

Between that and e10s being on by default, FF42 is going to go over like a lead balloon. I hope 41 is an ESR update, nope: only 38 and 45 are ESR https://mozorg.cdn.mozilla.net/media/img/firefox/organizatio...

What would be the problem with e10s? Sure, it's a big change, but it seems quite desirable imho.
Post reply on HN