Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 42 will not allow unsigned extensions

wiki.mozilla.org

Post reply on HN
Print view View original

241–250 of 315 posts

Re: Firefox 42 will not allow unsigned extensions

#241

Post by _lce0 »

grincho wrote: post #229
nathanb wrote: post #11

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…

Hi, Mozilla developer here, speaking for only myself. I'm not sure why we don't make this clearer on the wiki page, but I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way. (Disclaimer: I didn't work on this feature and am going by recollection and my own logic.) We see many copies of Firefox infested with rogue add-ons the user didn't…

> We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of.

GoogleUpdate?

why Firefox could not remove these extension itself? I needed to remove some files from the harddisk --I doubt john.doe will be able to remove such evils

Please excuse the rant tone, these things make me feel my intimacy raped

Re: Firefox 42 will not allow unsigned extensions

#242

Post by nightpool »

SCHiM wrote: post #186
acdha wrote: post #111

Earlier quoted context omitted.

I'm mixed on the general issue – an option to turn it off is an option which is certain to be used to social engineer millions of people – but this is somewhat different from HSTS: HSTS allows a site owner to set a security policy for access their own servers. There's no downside to using it, it doesn't affect anyone else, and in any case if you choose to use a service you're subject to their security policies. The f…

I really, really disagree. If your data is on my computer I should have a say in what happens to it. If I want to tunnel your hsts connection through a proxy I should be able to do so. You can't imagine how frustrated I was when I found out that I couldn't use my proxy any more, because some guy somewhere decided that it'd bee too hard to hard to add the following lines to firefox: if (user_doesn't_want_hsts) { dont_…

You... really don't understand HSTS or how proxies work. Any actual secure proxy configuration would still work just fine with HSTS. Its only ones that specifically downgrade HTTPS connections to HTTP ones that break.

Re: Firefox 42 will not allow unsigned extensions

#243

Post by nightpool »

MacsHeadroom wrote: post #216
hobarrera wrote: post #192

> [...] plugins don't need to be signed. So the worst kind of threat is still there. Great job, Mozilla!

That's because plugins are going to need to be white-listed (modifiable via about:config). The win64 (beta) edition of Firefox only allows the Flash Player Plugin, for example.

isn't this still vulnerable to the attack reported up-thread where whatever malware just goes and changed about:config before installing their plugin? (and the reason that the addon opt-out is being removed from ff42)

Re: Firefox 42 will not allow unsigned extensions

#244

Post by Arcsech »

grincho wrote: post #229
nathanb wrote: post #11

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…

Hi, Mozilla developer here, speaking for only myself. I'm not sure why we don't make this clearer on the wiki page, but I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way. (Disclaimer: I didn't work on this feature and am going by recollection and my own logic.) We see many copies of Firefox infested with rogue add-ons the user didn't…

> We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of.

Like Pocket or Hello?

Re: Firefox 42 will not allow unsigned extensions

#245

Post by malnourish »

twelvechairs wrote: post #153
SkatAndRap wrote: post #120

Earlier quoted context omitted.

Firefox users see through this feel-good marketing nonsense from Mozilla. They've seen Firefox's UI change for the worse in so many ways, even in the face of wide opposition. They've seen unwanted bloat, like Hello and Pocket, forced upon them, again in the face of wide opposition. They've seen their requests for bug fixes and performance improvements go unheeded, sometimes for years. The easy use of extensions has b…

Im a firefox user on all devices and am fine with the ui and dont know what Hello or Pocket are. It has gone through periods of bad choices and bloat before but has been cleaned up over time. I fully expect this to happen again with more annoyances greater than this one. And i still prefer to use it because i support its aims and it supports mine.

See, therein lies the problem. I use Firefox because of our mutual views (and the extensions) and there is no competition in that field. Chromium is too pared-down (no sidebar is basically a killer) and I don't want to support a webkit-centered internet.

Re: Firefox 42 will not allow unsigned extensions

#246

Post by tenfingers »

wsha wrote: post #86
tenfingers wrote: post #78

So much for beta-testing your extension prior to release. It's already hard to get users involved, now they just can't. Or using any other channel to get your extension. !Thanks Mozilla, really.

If your extension has been fully reviewed by AMO, you can upload beta versions that only have to pass the automated signing review to be posted to AMO.

Please don't assume all extensions have a reason to be on AMO. There are plenty of extensions which are developed in-house for in-house use only.

Also, as a developer, I never cared to run the "nighties": I don't want an unstable browser, and I don't want fancy new features. I always ran the stock version, also to ensure compatibility with the user base, and never needed anything else.

Maybe Mozilla should also remove the developer tools from the stock version, because clearly it's too dangerous in the hand of people that could cut&paste code with full privileges into it, and it's only a keystroke away!

This is a giant slap in the face, frankly.

I don't see a difference between a walled garden such as google play and this.

Re: Firefox 42 will not allow unsigned extensions

#247

Post by callahad »

piyush_soni wrote: post #239
grincho wrote: post #229

Earlier quoted context omitted.

Hi, Mozilla developer here, speaking for only myself. I'm not sure why we don't make this clearer on the wiki page, but I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way. (Disclaimer: I didn't work on this feature and am going by recollection and my own logic.) We see many copies of Firefox infested with rogue add-ons the user didn't…

It's been a few months already, and Mozilla is still 'undecided' on what will happen to Enterprise add-ons. The only two options you are giving us are: 1) Either remain on 'ESR' branch, which is always outdated, OR, 2) Reveal private Enterprise source code to you to get it signed (it might even be illegal for employees to do that). Both of them could be unacceptable to many organizations.

There will also be automated, unbranded builds of Firefox Stable that allow you to disable the signing requirement, but are otherwise bit identical.

Re: Firefox 42 will not allow unsigned extensions

#248

Post by tenfingers »

wsha wrote: post #91
tenfingers wrote: post #84

Earlier quoted context omitted.

But it doesn't ! As long as downloading anything is allowed, signing requirements on extensions will not prevent anything. And by experience supporting users, this is not how bad extensions get installed on the system: they're pulled in by malware which gets installed by other means. This is only going to irate legitimate extension developers, which already have to wait weeks for AMO to review even the most basic cha…

But ths change will prevent bad extensions pulled in by malware installed by other means.... On systems that require application signing, that should do some good (otherwise I'd expect malware to just switch from sideloading extensions to sideloading a modified version of Firefox).

How many systems do you think require application signing?

Re: Firefox 42 will not allow unsigned extensions

#249

Post by tired_man »

tenfingers wrote: post #246
wsha wrote: post #86

Earlier quoted context omitted.

If your extension has been fully reviewed by AMO, you can upload beta versions that only have to pass the automated signing review to be posted to AMO.

Please don't assume all extensions have a reason to be on AMO. There are plenty of extensions which are developed in-house for in-house use only. Also, as a developer, I never cared to run the "nighties": I don't want an unstable browser, and I don't want fancy new features. I always ran the stock version, also to ensure compatibility with the user base, and never needed anything else. Maybe Mozilla should also remov…

I gave Mozilla money back in the day when they asked for donations in the beginning to be on that full-page NY Times ad.

I wonder if I can have a refund? I'm very disappointed in how Firefox has aged.

Re: Firefox 42 will not allow unsigned extensions

#250

Post by callahad »

bobajeff wrote: post #235
SkatAndRap wrote: post #120

Earlier quoted context omitted.

Firefox users see through this feel-good marketing nonsense from Mozilla. They've seen Firefox's UI change for the worse in so many ways, even in the face of wide opposition. They've seen unwanted bloat, like Hello and Pocket, forced upon them, again in the face of wide opposition. They've seen their requests for bug fixes and performance improvements go unheeded, sometimes for years. The easy use of extensions has b…

I don't remember Firefox being well over 30%. The highest I've seen them had been 27%. That said I can see how users don't like Mozilla's attitude. I've actually noticed it as far back as Firefox 3.5. I know users didn't like the changes post Firefox 2.0. It's too bad Firefox wasn't componentized enough to separate UI from the layout engine and JavaScript engine. I myself like Australis but I'm also someone who's lov…

> tracker blocking

Try opening a private browsing window in Nightly and see what you get... ;-)

Edit: Here's a screenshot for folks without Nightly handy. http://imgur.com/5khKObb. This is still a work in progress, but we're getting there.

Post reply on HN