Firefox 42 will not allow unsigned extensions • Hacker News Board

Re: Firefox 42 will not allow unsigned extensions

#171

Post by atopal » Tue, Aug 11, 2015, 1:38 PM UTC

Sir_Cmpwn wrote: post #166

atopal wrote: post #164

Earlier quoted context omitted.

Did you not read the blog post? You can use the dev edition or the special release and beta version that don't have this limitation. Nobody is forcing you to live with this limitation. If this was done as an about:config flag it could easily be changed by an add-on too.

I did read the blog post. It says I have to use a less stable (beta) or less customizable (dev edition) version of Firefox to avoid this burden.

From https://wiki.mozilla.org/Addons/Extension_Signing

"What are my options if I want to install unsigned extensions in Firefox?

The Developer Edition and Nightly versions of Firefox will have a setting to disable signature checks. There will also be special unbranded versions of Release and Beta that will have this setting, so that add-on developers can work on their add-ons without having to sign every build."

Re: Firefox 42 will not allow unsigned extensions

#172

Post by rockdoe » Tue, Aug 11, 2015, 1:39 PM UTC

coldpie wrote: post #142

RexRollman wrote: post #73

And slowly, freedom everywhere was destroyed in the name of security.

Firefox is open source. Disabling the signature check will probably be a one-line change. Yes, it's a much larger barrier to entry (building Firefox is not trivial), but it's not like IE or Chrome where you have no choice in the matter at all.

building Firefox is not trivial

./mach bootstrap

./mach build

Re: Firefox 42 will not allow unsigned extensions

#173

Post by rockdoe » Tue, Aug 11, 2015, 1:42 PM UTC

kragen wrote: post #31

ekianjo wrote: post #28

It should still possible to fork Firefox and remove this requirement, right ?

In theory, but that will be very difficult.

It's trivial.

Re: Firefox 42 will not allow unsigned extensions

#174

Post by rockdoe » Tue, Aug 11, 2015, 1:44 PM UTC

rquirk wrote: post #123

Will this also affect Firefox for Android? Mozilla currently don't provide a dev build for Android, just regular and beta versions https://play.google.com/store/apps/developer?id=Mozilla The security problem that this "fixes" is not really an issue on Android due to Android's own app sandboxing, so maybe the Android build will allow unsigned extensions? It's not mentioned in the FAQ.

Mozilla provides Aurora and Nightly for Android. They're just not on the Play Store, but you can download them from their website.

https://nightly.mozilla.org/

not really an issue on Android due to Android's own app sandboxing

A malicious add-on could still steal all your passwords.

Re: Firefox 42 will not allow unsigned extensions

#175

Post by rockdoe » Tue, Aug 11, 2015, 1:45 PM UTC

sergimansilla wrote: post #57

I recently made an update my own Firefox extension, called Tab Grenade. It took them 4 months to review. 4 months. And that's for a (very) minor update. Because of that, I was definitely considering to start releasing it on my own, instead of through Mozilla's add-on website. It looks like I will be able to do that, but I'll have to use the signed extension process. I'll believe this system works when I see it. After…

Signing != Reviewing.

Re: Firefox 42 will not allow unsigned extensions

#176

Post by rockdoe » Tue, Aug 11, 2015, 1:47 PM UTC

doodpants wrote: post #150

TazeTSchnitzel wrote: post #113

Earlier quoted context omitted.

The PDF viewer is rather important if only for security.

How is having a built-in PDF viewer more secure than downloading the PDF and viewing it in Adobe Reader or Foxit? Is it just that those readers have vulnerabilities that Firefox doesn't?

Yes. The Firefox viewer sits on top of the JavaScript sandbox, which is the same sandbox that has to withstand attacks from pretty much everything on the internet and has been very hardened over the years (same for other browsers).

Ironically it had a vulnerability last week, but that's ONE and that's why it got so much attention. Adobe Reader and similar have had hundreds.

Re: Firefox 42 will not allow unsigned extensions

#177

Post by rockdoe » Tue, Aug 11, 2015, 1:48 PM UTC

userbinator wrote: post #103

Mozilla's hypocrisy is astounding: https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." https://blog.mozilla.org/theden/2014/12/15/introducing-a-sma... "Firefox is dedicated to putting users in control of their online experience" More recently: https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in... "Firefox Puts You…

Individuals aren't in control over their on-line experience if their browser settings (search etc) are taken over by malware.

I think the average HN reader should go out there once and look at the typical household PC. Bring eye bleach.

Re: Firefox 42 will not allow unsigned extensions

#178

Post by coldpie » Tue, Aug 11, 2015, 1:48 PM UTC

ikeboy wrote: post #167

coldpie wrote: post #136

Earlier quoted context omitted.

"Unapproved views"? Would you oppose firing someone for openly expressing white supremacy?

For expressing it while not on the job, no, they should not be fired.

Fair enough, I guess. I don't agree.

Re: Firefox 42 will not allow unsigned extensions

#179

Post by Sir_Cmpwn » Tue, Aug 11, 2015, 1:48 PM UTC

atopal wrote: post #171

Sir_Cmpwn wrote: post #166

Earlier quoted context omitted.

I did read the blog post. It says I have to use a less stable (beta) or less customizable (dev edition) version of Firefox to avoid this burden.

From https://wiki.mozilla.org/Addons/Extension_Signing "What are my options if I want to install unsigned extensions in Firefox? The Developer Edition and Nightly versions of Firefox will have a setting to disable signature checks. There will also be special unbranded versions of Release and Beta that will have this setting, so that add-on developers can work on their add-ons without having to sign every build."

Ah, nice. Even so, I still have issues with this:

- Special version of the software

- Can't run my own version of AMO

Re: Firefox 42 will not allow unsigned extensions

#180

Post by Cthulhu_ » Tue, Aug 11, 2015, 1:48 PM UTC

nathanb wrote: post #11

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…

Do you test your extension against pre-release versions of Firefox? That's kinda what they're for.