Firefox 42 will not allow unsigned extensions • Hacker News Board

Re: Firefox 42 will not allow unsigned extensions

#141

Post by rc4algorithm » Tue, Aug 11, 2015, 1:00 PM UTC

SkatAndRap wrote: post #120

userbinator wrote: post #103

Mozilla's hypocrisy is astounding: https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." https://blog.mozilla.org/theden/2014/12/15/introducing-a-sma... "Firefox is dedicated to putting users in control of their online experience" More recently: https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in... "Firefox Puts You…

Firefox users see through this feel-good marketing nonsense from Mozilla. They've seen Firefox's UI change for the worse in so many ways, even in the face of wide opposition. They've seen unwanted bloat, like Hello and Pocket, forced upon them, again in the face of wide opposition. They've seen their requests for bug fixes and performance improvements go unheeded, sometimes for years. The easy use of extensions has b…

You're being pretty grim. Hello is fucking awesome, and while I don't use Pocket it isn't the end of the world. Firefox isn't Lynx, but even as a Unix guy I enjoy and appreciate it. I also appreciate that they're trying to be more attractive to the masses, which is societally beneficial.

Re: Firefox 42 will not allow unsigned extensions

#142

Post by coldpie » Tue, Aug 11, 2015, 1:00 PM UTC

RexRollman wrote: post #73

And slowly, freedom everywhere was destroyed in the name of security.

Firefox is open source. Disabling the signature check will probably be a one-line change. Yes, it's a much larger barrier to entry (building Firefox is not trivial), but it's not like IE or Chrome where you have no choice in the matter at all.

Re: Firefox 42 will not allow unsigned extensions

#143

Post by wtbob » Tue, Aug 11, 2015, 1:03 PM UTC

You know, there was something beautiful about users being able to pick up a tutorial and extend their browsers, if they wanted. There was something very empowering about being able to write extensions even in a corporate environment.

I've written Firefox extensions for personal and business use, and Mozilla are preventing that from every happening again. Why? Cui bono?

I'll mention, again, that they completely broke the security of Firefox Sync: it's no longer a trustworthy place to store passwords. Why? Cui bono?

Re: Firefox 42 will not allow unsigned extensions

#144

Post by Kronopath » Tue, Aug 11, 2015, 1:05 PM UTC

mbrownnyc wrote: post #138

nathanb wrote: post #11

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…

To note, there is a client-side workaround that allows whitelisting of ALL unsigned extensions (they might consider creating a whitelist of UUIDs or something "humans" can handle like the name of an extension). I was able to change the following and uBlock and Ghostery immediately started working in the "Aurora" build: go to about:config ; set xpinstall.signatures.required = false

You didn't read the linked article. They say that the option will be available in Firefox 41, but Firefox 42 will have no such override.

Re: Firefox 42 will not allow unsigned extensions

#145

Post by shdon » Tue, Aug 11, 2015, 1:05 PM UTC

TheLoneWolfling wrote: post #139

shdon wrote: post #130

Earlier quoted context omitted.

What would be the problem with e10s? Sure, it's a big change, but it seems quite desirable imho.

2-3x the memory use and lower performance due to the additional overhead of talking between processes. There are advantages, but it is not without its disadvantages.

https://wiki.mozilla.org/Electrolysis/Firefox

"Goals

There are number of things we believe the e10s project will give us:

...

2. Improved performance, especially on multi-core machines.

3. Better memory core stats."

That seems to directly contradict your concerns. However, these are stated goals and may not align with practical reality. I'd be surprised if, when these are numbers 2 and 3 on their list of priorities, the reality would be so very different.

Re: Firefox 42 will not allow unsigned extensions

#146

Post by schrodinger » Tue, Aug 11, 2015, 1:06 PM UTC

gerv wrote: post #97

cpeterso wrote: post #50

Earlier quoted context omitted.

> If I want to be able to continue this process, I will need to sign the extension myself This seems like a good approach to me. Instead of Mozilla itself signing developers' extensions, why can't Mozilla issue certificates so developers can sign their own extensions locally? If a developer turns rogue, Mozilla can revoke their certificate.

Because bad guys can just keep getting new certs when their old ones are revoked, unless you do identity validation (which costs money as it requires actual humans, so the certs can't be cheap or free).

Reviewing plugins costs somewhere around the same amount of human time/money, no?

Re: Firefox 42 will not allow unsigned extensions

#147

Post by Sir_Cmpwn » Tue, Aug 11, 2015, 1:06 PM UTC

atopal wrote: post #132

Sir_Cmpwn wrote: post #101

I use several small add-ons I wrote myself. Why should I have to get Mozilla's approval before I can install my own damn add-ons? One of them executes processes and I'm 99% sure it'll fail the automated review. EDIT: It passed the automated review, but my point stands. If I wrote the code, then you can be damn sure I trust it.

> I use several small add-ons I wrote myself. Why should I have to get Mozilla's approval before I can install my own damn add-ons? Mozilla has to balance the needs of several hundred million users, who are being attacked by malware every day, with the needs of people who write their own add-ons. Is it really that difficult to see it from that perspective? And it's not like you have no options now. You can either use…

They've always catered to the hacker perspective, too. Why take out the about:config flag? How about letting me trust my own certificate, instead of just AMO's? What about running AMO alternatives?

Re: Firefox 42 will not allow unsigned extensions

#148

Post by norea-armozel » Tue, Aug 11, 2015, 1:10 PM UTC

Does anyone know if the maintainers of Pale Moon or Waterfox intend to keep the extension signing requirement on their builds?

Re: Firefox 42 will not allow unsigned extensions

#149

Post by gajjanag » Tue, Aug 11, 2015, 1:10 PM UTC

TazeTSchnitzel wrote: post #126

SkatAndRap wrote: post #120

Earlier quoted context omitted.

Firefox users see through this feel-good marketing nonsense from Mozilla. They've seen Firefox's UI change for the worse in so many ways, even in the face of wide opposition. They've seen unwanted bloat, like Hello and Pocket, forced upon them, again in the face of wide opposition. They've seen their requests for bug fixes and performance improvements go unheeded, sometimes for years. The easy use of extensions has b…

Some people hate the UI changes. A lot of people are just fine with them. Hello and Pocket are just two buttons in a toolbar which you can remove.

True. However what I have found in general is that I have been spending more and more time tweaking and fiddling Firefox to make it work the way I want it to, i.e similar to the way it was in the past with no Pocket for instance.

It is really annoying to have to watch the Firefox news and other channels to get this kind of information, reason about it, and then make my choice regarding what to do.

Browsers for me are a tool to get my work done, and I don't want to spend my time shaping my browser every time some people in Mozilla decide to change something.

There are two solutions I see: 1. The cynical/pessimistic one: the web is broken, all browsers fail to various extents, and one needs to pick one's poison - Firefox is the least of evils, hence I will continue using it with increasing dissatisfaction.

2. The optimistic one: Firefox and Mozilla will eventually get back on track, and revisit their old values - I find this harder to believe as time passes by.

Re: Firefox 42 will not allow unsigned extensions

#150

Post by doodpants » Tue, Aug 11, 2015, 1:11 PM UTC

TazeTSchnitzel wrote: post #113

chriswarbo wrote: post #96

Earlier quoted context omitted.

> I don't use many extensions but I'm finding I have to use more as Mozilla remove features from Firefox. To me, that's the way Firefox should work: a fast, lightweight browser, with a powerful extension system. I get disappointed when Mozilla add "features" to Firefox, like PDF viewers, Pocket, etc.

The PDF viewer is rather important if only for security.

How is having a built-in PDF viewer more secure than downloading the PDF and viewing it in Adobe Reader or Foxit? Is it just that those readers have vulnerabilities that Firefox doesn't?