Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 42 will not allow unsigned extensions

wiki.mozilla.org

Post reply on HN
Print view View original

251–260 of 315 posts

Re: Firefox 42 will not allow unsigned extensions

#251

Post by piyush_soni »

kpcyrd wrote: post #71
Animats wrote: post #20

Earlier quoted context omitted.

That's for non-public add-ons. If you submit a public add-on, even a minor update, it has to go through the AMO bureaucracy. I currently have an update that was uploaded on July 10, 2015, and is at queue position of 64 of 137. There are no code changes; it's just being updated because Mozilla changed their build system. This seems to be part of Mozilla's effort to be more like the Apple and Google stores. Mozila AMO…

Actually, it's their effort to prevent AMO from ending up as malware riddled as the Chrome Store. Addons are running in the chrome context and are thus pretty powerful. It's trival to compromise the whole computer if they aren't reviewed.

I wouldn't think Chrome Web store is full of Malware. Yes, it's not free of those, but the bad ones are quickly removed by both Chrome's policing, and users' flagging. That's how Mozilla should go forward. The problem with manual reviewing is, it depends on the 'volunteers' time availability, and a stupid Review system which is NOT FCFS. You are told you are 37th out of 150 in the queue, but you see that you either remain at that position while others are being approved, your queue position goes both up and down, and some times your add-on is instantly approved even when you are 100th in the queue. All this takes many days even if your users are waiting for a critical fix. This is the biggest turn off in uploading add-ons for Firefox.

Re: Firefox 42 will not allow unsigned extensions

#252

Post by piyush_soni »

Arcsech wrote: post #244
grincho wrote: post #229

Earlier quoted context omitted.

Hi, Mozilla developer here, speaking for only myself. I'm not sure why we don't make this clearer on the wiki page, but I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way. (Disclaimer: I didn't work on this feature and am going by recollection and my own logic.) We see many copies of Firefox infested with rogue add-ons the user didn't…

> We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of. Like Pocket or Hello?

Why is this downvoted? These inbuilt add-ons might not be 'rogue', but are definitely the ones which many users didn't ask for, or aren't even aware of.

Re: Firefox 42 will not allow unsigned extensions

#253

Post by Jordrok »

scintill76 wrote: post #24

Ah, feels like they're following Chrome's example, which decreed that it should be exceedingly difficult for Windows Chrome users to install extensions from somewhere other than https://chrome.google.com/webstore/ . This basically killed an internal app we had at work (a fork of a "REST client", with some added request-signing features specific to our internal APIs.) There was no strong reason to keep it secret, but…

This is the exact reason why I moved to Firefox from Chrome back when Google started tightening the noose around developer mode extensions. I had written a few extensions for my own personal use and had no interest in putting them up in the Chrome Web Store. This was fine and good until Google decided it was A Bad Thing and Chrome started popping up annoying warning windows on every startup and then eventually disabled my extensions entirely.

I switched to Firefox since it let me have more control over my own browsing experience (and gave me a good excuse to extract myself just a little bit from the Google hivemind). I'm extremely annoyed to see that Firefox is now going down this route too.

Re: Firefox 42 will not allow unsigned extensions

#254

Post by zeveb »

grincho wrote: post #229
nathanb wrote: post #11

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…

Hi, Mozilla developer here, speaking for only myself. I'm not sure why we don't make this clearer on the wiki page, but I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way. (Disclaimer: I didn't work on this feature and am going by recollection and my own logic.) We see many copies of Firefox infested with rogue add-ons the user didn't…

> I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way.

> We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of. Sometimes these add-ons even ship with big-name software, with no opt out or with the opt out squirreled away in some dark corner.

If malware is already executing on the user's computer, it's game over, full stop. That malware can do anything, to include using local-root vulnerabilities to patch Firefox to do anything.

Mozilla is _breaking_ Firefox for normal users, and making itself the arbiter of what users are and are not allowed to run on their own systems. That's both dangerous and foolish.

Re: Firefox 42 will not allow unsigned extensions

#255

Post by josteink »

soapdog wrote: post #217

Folks, There are FOUR VERSIONS OF FIREFOX WITH A SWITCH TO DISABLE THIS if you're so inclined. You can use: Nightly, Dev Edition, Unbranded Stable and Unbranded Beta. All of which have a switch that you can set to disable addons signing requirement. In contrast there are only two versions where this is a requirement, Stable and Beta. If you doubt the usefulness of this you haven't seen a browser being hijacked by mal…

> There are FOUR VERSIONS OF FIREFOX WITH A SWITCH TO DISABLE THIS

While that may be true, requiring that you run a non-standard version of Firefox to be able to use "random" extensions will probably have a chilling effect on the Firefox extension ecosystem.

That, and it reeks of Chromeism.

Re: Firefox 42 will not allow unsigned extensions

#256

Post by callahad »

hobarrera wrote: post #194
TazeTSchnitzel wrote: post #126

Earlier quoted context omitted.

Some people hate the UI changes. A lot of people are just fine with them. Hello and Pocket are just two buttons in a toolbar which you can remove.

> Hello and Pocket are just two buttons in a toolbar which you can remove. I would have preferred to see bugs fixed, rather than features that undeniably belong in extensions. Even if it'd been issues that don't even affect me.

> features that undeniably belong in extensions

At least in the case of Pocket, the current browser marketplace seems to disagree: Chrome is the only major browser without a built-in reading list. When it came time to add similar functionality to Firefox, we could either build and maintain our own service and integrations, or we could partner with an established player with sane privacy and data access policies.

We chose the latter. Pocket is already integrated into literally hundreds of applications, and it started life as a Firefox add-on. Embracing that is a reasonable choice in terms of utility and sustainability, as Pocket themselves are already maintaining SDKs and applications on all major platforms.

(Why this is built into the code and not shipped as an add-on was, iirc, an architectural quirk that will hopefully be rectified.)

Re: Firefox 42 will not allow unsigned extensions

#257

Post by azakai »

rndgermandude wrote: post #215
rockdoe wrote: post #172

Earlier quoted context omitted.

building Firefox is not trivial ./mach bootstrap ./mach build

Yeah? You at the very least forgot to obtain the source code first somehow. What about build-dependencies, because ./mach bootstrap does not fully handle that? Now please tell me how to do a Windows release-build with all release features enabled (except for official branding), aka. a ton of configure switches, and also please do it for my language using the official de locale, because neither the source tar.bz2 nor…

As the link mentions, you don't need to build from source. Binary builds are provided that do not have this restriction, for those that want that.

Re: Firefox 42 will not allow unsigned extensions

#258

Post by zeveb »

rockdoe wrote: post #174
rquirk wrote: post #123

Will this also affect Firefox for Android? Mozilla currently don't provide a dev build for Android, just regular and beta versions https://play.google.com/store/apps/developer?id=Mozilla The security problem that this "fixes" is not really an issue on Android due to Android's own app sandboxing, so maybe the Android build will allow unsigned extensions? It's not mentioned in the FAQ.

Mozilla provides Aurora and Nightly for Android. They're just not on the Play Store, but you can download them from their website. https://nightly.mozilla.org/ not really an issue on Android due to Android's own app sandboxing A malicious add-on could still steal all your passwords.

> A malicious add-on could still steal all your passwords.

Of course, so can Mozilla, because Firefox Accounts are no longer secure (the login page downloads JavaScript assets from Mozilla, and could be used to snarf a particular user's password in a targeted attack, leaving no traces observable by other users).

Re: Firefox 42 will not allow unsigned extensions

#259

Post by drdaeman »

rc4algorithm wrote: post #135
jsingleton wrote: post #74

Earlier quoted context omitted.

I don't use many extensions but I'm finding I have to use more as Mozilla remove features from Firefox. For example you can no longer set the User Agent string on a per site basis natively in Firefox preferences [0]. This would be very handy to force HTML5 video on BBC News when you don't want to install flash [1]. I only discovered this setting was deprecated by finding that bug report whilst researching the blog po…

> For example you can no longer set the User Agent string on a per site basis natively in Firefox preferences [0]. This seems like a uselessly fine-grained control. I was surprised to hear that they ever supported it.

uMatrix is relatively popular on AMO and it's about even more fine-grained control. ;)

Re: Firefox 42 will not allow unsigned extensions

#260

Post by callahad »

kragen wrote: post #30

This is deeply disappointing. Two details: the extensions need to be signed by Mozilla , and only US English speakers will be allowed to disable this requirement. The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software etho…

> The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties.

You've been on HN for over six and a half years. Surely you can't be this jaded or obtuse?

That freedom is absolutely, unequivocally preserved: The entire source to Firefox is available under OSI-approved libre licenses.

APIs change, but the freedom of the software isn't determined by its exposed APIs, but by your ability to exercise the Four Freedoms enumerated by the FSF at http://www.gnu.org/philosophy/free-sw.html. Debian exercises these freedoms with every build of the IceWeasel browser from Firefox's source.

Post reply on HN