Firefox 42 will not allow unsigned extensions • Hacker News Board

Re: Firefox 42 will not allow unsigned extensions

#211

Post by alexhektor » Tue, Aug 11, 2015, 2:39 PM UTC

userbinator wrote: post #103

Mozilla's hypocrisy is astounding: https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." https://blog.mozilla.org/theden/2014/12/15/introducing-a-sma... "Firefox is dedicated to putting users in control of their online experience" More recently: https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in... "Firefox Puts You…

We're currently waiting for well over 2 months now for an add-on update to get released -.-

https://blog.mozilla.org/addons/2015/07/22/add-ons-update-68...

Re: Firefox 42 will not allow unsigned extensions

#212

Post by Sir_Cmpwn » Tue, Aug 11, 2015, 2:39 PM UTC

soapdog wrote: post #209

Sir_Cmpwn wrote: post #166

Earlier quoted context omitted.

I did read the blog post. It says I have to use a less stable (beta) or less customizable (dev edition) version of Firefox to avoid this burden.

Dev Edition is not less customizable... its just Firefox with a new theme and more bleeding edge dev tools which you should be using to develop addons anyway.

The theme is the problem I'm referring to.

Re: Firefox 42 will not allow unsigned extensions

#213

Post by soapdog » Tue, Aug 11, 2015, 2:40 PM UTC

sergimansilla wrote: post #57

I recently made an update my own Firefox extension, called Tab Grenade. It took them 4 months to review. 4 months. And that's for a (very) minor update. Because of that, I was definitely considering to start releasing it on my own, instead of through Mozilla's add-on website. It looks like I will be able to do that, but I'll have to use the signed extension process. I'll believe this system works when I see it. After…

The review is mostly done by volunteers. Sorry for the delay, I feel your pain. Will check here if we can try to get more people onboard to help review stuff.

Re: Firefox 42 will not allow unsigned extensions

#214

Post by soapdog » Tue, Aug 11, 2015, 2:44 PM UTC

ekianjo wrote: post #28

It should still possible to fork Firefox and remove this requirement, right ?

you don't need to fork. There are four versions without requirement: nightly, dev edition, unbranded stable and unbranded beta. What more do you want?

Re: Firefox 42 will not allow unsigned extensions

#215

Post by rndgermandude » Tue, Aug 11, 2015, 2:46 PM UTC

rockdoe wrote: post #172

coldpie wrote: post #142

Earlier quoted context omitted.

Firefox is open source. Disabling the signature check will probably be a one-line change. Yes, it's a much larger barrier to entry (building Firefox is not trivial), but it's not like IE or Chrome where you have no choice in the matter at all.

building Firefox is not trivial ./mach bootstrap ./mach build

Yeah? You at the very least forgot to obtain the source code first somehow. What about build-dependencies, because ./mach bootstrap does not fully handle that?

Now please tell me how to do a Windows release-build with all release features enabled (except for official branding), aka. a ton of configure switches, and also please do it for my language using the official de locale, because neither the source tar.bz2 nor the hg you'd normally clone contains that. I'm starting from scratch of course. And suddenly it is less easy and trivial..

Re: Firefox 42 will not allow unsigned extensions

#216

Post by MacsHeadroom » Tue, Aug 11, 2015, 2:48 PM UTC

hobarrera wrote: post #192

> [...] plugins don't need to be signed. So the worst kind of threat is still there. Great job, Mozilla!

That's because plugins are going to need to be white-listed (modifiable via about:config). The win64 (beta) edition of Firefox only allows the Flash Player Plugin, for example.

Re: Firefox 42 will not allow unsigned extensions

#217

Post by soapdog » Tue, Aug 11, 2015, 2:49 PM UTC

Folks,

There are FOUR VERSIONS OF FIREFOX WITH A SWITCH TO DISABLE THIS if you're so inclined. You can use: Nightly, Dev Edition, Unbranded Stable and Unbranded Beta. All of which have a switch that you can set to disable addons signing requirement.

In contrast there are only two versions where this is a requirement, Stable and Beta. If you doubt the usefulness of this you haven't seen a browser being hijacked by malware overriding search results, inserting all types of toolbars and more. This will prevent malware from sideloading extensions. And this is good.

The signing process is not the same as the AMO review process. The process takes only seconds and the signed addon is returned to the developer. They can distribute as they see fit.

Now, lets face the fact: Simple signing process that takes only seconds and will help prevent lots of malware, not the most nasty ones but a huge lot of sideloaded crap. Four versions of the browser for those power users who want to disable this.

Now, can someone explain to me without hate why this is a bad thing?

Re: Firefox 42 will not allow unsigned extensions

#218

Post by e1ven » Tue, Aug 11, 2015, 2:51 PM UTC

soapdog wrote: post #204

Animats wrote: post #20

Earlier quoted context omitted.

That's for non-public add-ons. If you submit a public add-on, even a minor update, it has to go through the AMO bureaucracy. I currently have an update that was uploaded on July 10, 2015, and is at queue position of 64 of 137. There are no code changes; it's just being updated because Mozilla changed their build system. This seems to be part of Mozilla's effort to be more like the Apple and Google stores. Mozila AMO…

You can sign the addons and distribute it on other channels. If you want to have it on AMO then it takes a while to review. The process is done by volunteers

This is one of the things which is frustrating about Mozilla. I love that they stand for open protocols, free software and user privacy, but I don't love what they prioritize.

Reviewing extensions is critical to their user-experience. If this really doesn't have an team of paid staffers, that's unfortunate.

Re: Firefox 42 will not allow unsigned extensions

#219

Post by detaro » Tue, Aug 11, 2015, 2:52 PM UTC

rockdoe wrote: post #176

doodpants wrote: post #150

Earlier quoted context omitted.

How is having a built-in PDF viewer more secure than downloading the PDF and viewing it in Adobe Reader or Foxit? Is it just that those readers have vulnerabilities that Firefox doesn't?

Yes. The Firefox viewer sits on top of the JavaScript sandbox, which is the same sandbox that has to withstand attacks from pretty much everything on the internet and has been very hardened over the years (same for other browsers). Ironically it had a vulnerability last week, but that's ONE and that's why it got so much attention. Adobe Reader and similar have had hundreds.

Allowing people to implement viewers for file types that run in the sandbox as plugins seems like a good idea then. Not that I mind that a PDF-viewer is already built in, but firefox can't support all file types.

Re: Firefox 42 will not allow unsigned extensions

#220

Post by 4bpp » Tue, Aug 11, 2015, 2:52 PM UTC

soapdog wrote: post #200

userbinator wrote: post #103

Mozilla's hypocrisy is astounding: https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." https://blog.mozilla.org/theden/2014/12/15/introducing-a-sma... "Firefox is dedicated to putting users in control of their online experience" More recently: https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in... "Firefox Puts You…

WTF people. So much hate for Mozilla these days, this appear pitchfork group. Lets review what the article says: addons needed to be signed. The process is automated. It takes only seconds. It prevents some malware from spreading. You can still host your addon wherever you want. This is just an extra step that can actually improve security. It requires more effort by the part of the developer but it also helps preven…

What is the rationale behind removing the configuration switch, though? Is there supposed to be some contingent of users who are not sufficiently tech-savvy to be trusted with choosing their own add-ons, but sufficiently tech-savvy to go and edit something in about:config, which really needs to be protected from their own stupidity? This sort of "mother knows best" approach is something I would expect from Apple, not a company that claims to put you in control.

Nightly comes with obvious stability and security problems; I don't know about "dev edition", but wouldn't be surprised if it isn't kept up-to-date at the same rate or comes with some presets regarding UI layout or otherwise that are annoying to someone who is not intending to primarily use it as a testbed.