Firefox 42 will not allow unsigned extensions • Hacker News Board

Re: Firefox 42 will not allow unsigned extensions

#181

Post by rockdoe » Tue, Aug 11, 2015, 1:49 PM UTC

debacle wrote: post #158

SkatAndRap wrote: post #120

Earlier quoted context omitted.

Firefox users see through this feel-good marketing nonsense from Mozilla. They've seen Firefox's UI change for the worse in so many ways, even in the face of wide opposition. They've seen unwanted bloat, like Hello and Pocket, forced upon them, again in the face of wide opposition. They've seen their requests for bug fixes and performance improvements go unheeded, sometimes for years. The easy use of extensions has b…

I don't understand why Mozilla is trying to control the ecosystem. It's an open source product. Why does it need to be locked down like this? Who do they think they are protecting, or even helping, with this?

Their users?

I'm not sure what you're asking. It's trivial to remove the block for open source contributors, and in fact Iceweasel etc likely won't have it.

But for people who download Windows binaries (or get automatically updated) it's a godsend.

Re: Firefox 42 will not allow unsigned extensions

#182

Post by Karunamon » Tue, Aug 11, 2015, 1:51 PM UTC

ikeboy wrote: post #133

TazeTSchnitzel wrote: post #121

Earlier quoted context omitted.

Mozilla hasn't fired anyone for their views. And caring about users' security is to be commended.

http://www.theatlantic.com/politics/archive/2014/04/mozillas...

The article characterizing his resignation as forced or him being fired does not make it true.

Re: Firefox 42 will not allow unsigned extensions

#183

Post by rockdoe » Tue, Aug 11, 2015, 1:53 PM UTC

userbinator wrote: post #108

kragen wrote: post #30

This is deeply disappointing. Two details: the extensions need to be signed by Mozilla , and only US English speakers will be allowed to disable this requirement. The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software etho…

I understand the issue of users being tricked into downloading and installing malicious extensions. If you let someone program, they will be able to paste malicious code. I just don’t think that taking away users’ ability to modify their own browsers is an acceptable solution to that. I think it's just another battle in The War on General Purpose Computing. I like to keep this quote in mind: "Freedom is not worth hav…

The problem is what consequences those mistakes have for other people.

Yay more botnets.

Re: Firefox 42 will not allow unsigned extensions

#184

Post by Karunamon » Tue, Aug 11, 2015, 1:55 PM UTC

alfapla wrote: post #47

It's little more than a year ago that Brendan Eich was ousted from Mozilla by an ugly orchestrated cabal. When I read Mitchell Baker's vapid blog post [1] on the decision, filled with polite backstabbing and politically correct buzzwordery I understood that Mozilla has been taken over by politicians and that its decline is just a matter of time. [1] https://blog.mozilla.org/blog/2014/04/03/brendan-eich-steps-...

He quit, he wasn't fired. If you have evidence to the contrary, please post it.

Re: Firefox 42 will not allow unsigned extensions

#185

Post by verusfossa » Tue, Aug 11, 2015, 1:57 PM UTC

This is disappointing. Everything is becoming centralized, even Firefox extensions. I wish there was an opt out like "unknown sources" in android, but they keep saying we're not smart enough to make or own decisions. They won't even put one in about:config. This change well undoubtedly upset developers and other techy folk, exactly the kind of people you want working with your software.

Fdroid is working on third party repositories, maybe that will catch on to decentralize the mobile world a bit. Something like that for browser extensions would be sweet. Take a look at Fennec Fdroid for a cleaner Firefox mobile experience at least.

Re: Firefox 42 will not allow unsigned extensions

#186

Post by SCHiM » Tue, Aug 11, 2015, 2:00 PM UTC

acdha wrote: post #111

SCHiM wrote: post #102

I like the fact that a security issue is being tackled. What I absolutely hate is the fact that there are no ways to turn this option off. Just like HSTS I can't turn this off and it leaves a bad taste in my mouth. Were originally I considered firebox to be a browser for power users, now I'm not too sure any more.

I'm mixed on the general issue – an option to turn it off is an option which is certain to be used to social engineer millions of people – but this is somewhat different from HSTS: HSTS allows a site owner to set a security policy for access their own servers. There's no downside to using it, it doesn't affect anyone else, and in any case if you choose to use a service you're subject to their security policies. The f…

I really, really disagree. If your data is on my computer I should have a say in what happens to it. If I want to tunnel your hsts connection through a proxy I should be able to do so.

You can't imagine how frustrated I was when I found out that I couldn't use my proxy any more, because some guy somewhere decided that it'd bee too hard to hard to add the following lines to firefox:

if (user_doesn't_want_hsts) { dont_do_hsts(); }

I can't even bend my head around how someone thought it was acceptable to totally take this option away from people. I understand that such an option should be hidden deep inside a config somewhere so as to prevent a normal user from compromising his/her own security. But please don't presume that you did everyone a service by taking this option away. I can't express how angry and frustrated I become when I even think about it.

As for your 'no downside', as I said, perhaps not for normal users. But I most definitively am not. And I probably need to jump though a lot of hoops to tear this "feature" out of my own firefox build.

Re: Firefox 42 will not allow unsigned extensions

#187

Post by bigbugbag » Tue, Aug 11, 2015, 2:03 PM UTC

glass- wrote: post #93

systemz wrote: post #68

Mozilla is doing everything to stop using their browser.

And instead people are going to use what?

not sure yet, but as soon as there's something I'm making the switch.

Too many extensions are required to try to make firefox into something usable, mainly reverting changes or fiwing broken or missing features: ad blocking, sidebar, download manager, bringing back the add on bar, putting back the ability to disable javascript, session manager, cookie manager ability to take screenshot, mouse gestures, tab manager, …

Re: Firefox 42 will not allow unsigned extensions

#188

Post by MiddleEndian » Tue, Aug 11, 2015, 2:03 PM UTC

mythealias wrote: post #114

AlwaysRock wrote: post #98

Isnt chrome already like this? I spent 45 minutes trying to find a way to install a non extension store extension this weekend and gave up after being blocked repeatedly.

I don't think what chrome does is relevant in this discussion at least not in the context of defining what is the the correct way for mozilla to go forward.

Unfortunately it's relevant in the discussion of what Mozilla can get away with.

Re: Firefox 42 will not allow unsigned extensions

#189

Post by ikeboy » Tue, Aug 11, 2015, 2:04 PM UTC

Karunamon wrote: post #182

ikeboy wrote: post #133

Earlier quoted context omitted.

http://www.theatlantic.com/politics/archive/2014/04/mozillas...

The article characterizing his resignation as forced or him being fired does not make it true.

There was a large outcry, then he resigned. His resignation can be directly traced to his views. Whether he was technically fired or "decided" to resign seems largely irrelevant.

Re: Firefox 42 will not allow unsigned extensions

#190

Post by dannysu » Tue, Aug 11, 2015, 2:07 PM UTC

It's been one month and the new version of an extension I wrote is still waiting to be reviewed. I've since stopped waiting and started using the new version myself rather than download from AMO. I was already very disappointed by the review process and now this.

Tweeted to Chris Beard: "Dear @cbeard, please give your users the choice and control they deserve in @firefox. Allow extension signing to be disabled in FF42."

You want to protect the user, then start making extensions more secure and require permissions to do things. E.g. If an extension can access contents of webpages, pop up a dialog and ask the first time. There are other ways to protect users without going authoritarian on us.