Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 42 will not allow unsigned extensions

wiki.mozilla.org

Post reply on HN
Print view View original

291–300 of 315 posts

Re: Firefox 42 will not allow unsigned extensions

#291

Post by callahad »

Zirro wrote: post #284
callahad wrote: post #280

Earlier quoted context omitted.

I apologize for the disparagement; I was miffed at your statement that "only US English speakers will be allowed to disable this requirement," which completely misrepresents the situation, followed by doubt about Firefox's status as F/OSS. Instead of ascribing that to malice, I should have assumed good intent and that the communications from our end were unclear. As to the English issue, we have absolutely no intent…

"Much like with our Nightly builds, the unbranded copies of Firefox will only be pre-compiled with en-US strings." I have been using localized builds from https://ftp.mozilla.org/pub/firefox/nightly/latest-mozilla-c... for several years - are they not part of the Nightly builds?

Oh, hey, yep. Tripping over my own ignorance there.

I didn't realize that latest-mozilla-central-l10n/ subdirectory existed; I've always gone straight for latest-trunk/, which it turns out is a symlink to latest-mozilla-central/, which only contains the en-US builds. Thanks for pointing that out. I'll file a bug to get https://nightly.mozilla.org/ updated to point to the localized builds.

Re: Firefox 42 will not allow unsigned extensions

#292

Post by soapdog »

josteink wrote: post #278
soapdog wrote: post #265

Earlier quoted context omitted.

you will be able to run "random" extension if the developer care enough about it and about the new security procedures to sign it. After all, it takes only couple seconds for the signing to work. The versions I quoted are not non-standard. They are all versions of Firefox being worked on and with all the relevant teams. All those versions eventually become Firefox Stable and after that becomes outdated and a new rele…

They are non-standard in the sense that 99% of Firefox users are not using them.

Do you understand that the Unbranded Stable version and Firefox Stable version have the same codebase? You can use that version for testing or if your users don't want signing they can move to that version. They lose the cute icon and branding but the code is the same.

Re: Firefox 42 will not allow unsigned extensions

#293

Post by soapdog »

rndgermandude wrote: post #225
soapdog wrote: post #200

Earlier quoted context omitted.

WTF people. So much hate for Mozilla these days, this appear pitchfork group. Lets review what the article says: addons needed to be signed. The process is automated. It takes only seconds. It prevents some malware from spreading. You can still host your addon wherever you want. This is just an extra step that can actually improve security. It requires more effort by the part of the developer but it also helps preven…

Mozilla will certainly continue to sign my piracy-enabling add-on that is perfectly legal in many jurisdictions worldwide, even after an US court ordered them not to sign it explicitly? I also heard mozilla got an NSL for my "Ed Snowden for president, Find out more on wikileaks" add-on, or rather, I didn't because NSL. Then again, I hear a brought coalition of human rights, LGBT and feminist groups lobbying mozilla n…

You understand that the addon signing process is automated right? Addon signing is not the same as AMO review. You can sign your addons and distribute them on other channels if they don't match AMO review criterias.

Re: Firefox 42 will not allow unsigned extensions

#294

Post by soapdog »

4bpp wrote: post #220
soapdog wrote: post #200

Earlier quoted context omitted.

WTF people. So much hate for Mozilla these days, this appear pitchfork group. Lets review what the article says: addons needed to be signed. The process is automated. It takes only seconds. It prevents some malware from spreading. You can still host your addon wherever you want. This is just an extra step that can actually improve security. It requires more effort by the part of the developer but it also helps preven…

What is the rationale behind removing the configuration switch, though? Is there supposed to be some contingent of users who are not sufficiently tech-savvy to be trusted with choosing their own add-ons, but sufficiently tech-savvy to go and edit something in about:config, which really needs to be protected from their own stupidity? This sort of "mother knows best" approach is something I would expect from Apple, not…

> I don't know about "dev edition", but wouldn't be surprised if it isn't kept up-to-date

Dev Edition is kept up to date. If you check Firefox Versioning workflow, you will see that Firefox DevEdition replaced aurora which was the version between nightly and beta. Its kept very up to date, there are daily updates on the Dev Edition channel. Also the Firefox UI is fully customizable, just click the menu icon in the toolbar, choose customize and start replacing things you don't like.

Re: Firefox 42 will not allow unsigned extensions

#295

Post by soapdog »

SkatAndRap wrote: post #268
soapdog wrote: post #200

Earlier quoted context omitted.

WTF people. So much hate for Mozilla these days, this appear pitchfork group. Lets review what the article says: addons needed to be signed. The process is automated. It takes only seconds. It prevents some malware from spreading. You can still host your addon wherever you want. This is just an extra step that can actually improve security. It requires more effort by the part of the developer but it also helps preven…

It's not "hatred" you're seeing. It's exasperation after repeated disappointment, so much of it totally unnecessary. Many of us have been using software from Mozilla, and Netscape before them, for decades now. Generally we've been happy with the software. We were more than happy with earlier versions of Firefox, in fact. But lately we've seen changes made that have not benefited the users of Mozilla's software. Your…

Thanks for keeping it civil. I will address some of your comments in the best way I can.

>It wasn't always like that. We used to be able to download a sub-10 MB installer, run it, and have a usable installation of Firefox ready for use.

The Web Platform advanced a lot in the last few years. A lot has been added to browsers. They are no longer a simple HTML engine with some CSS and bad JS engines. Browsers these days are almost their own operating systems for good and bad. They have so much stuff going on between all the multimedia features, multiple JS engines and compilers, there are lots of stuff going on. Browsers are larger because the Web grew a lot (not in the sense of size but in complexity)

> Now we have to choose from the "correct" stream, download a 40 MB or larger installer, run it, change numerous about:config options to allow us to install our own custom unsigned extensions and to disable unwanted functionality that Mozilla has added, manually remove unwanted toolbar buttons, install a number of third-party extensions that also fix additional problems introduced by Mozilla, and in the end we're still stuck with a user interface and a user experience that isn't very good.

Firefox has always been customizable and the about:config feature enables lots of under the hood tweaks that are not possible everywhere. Making Firefox your own its part of what makes it great. Its a browser you can change to suit your needs, thats less common than people think. Your needs are not the same needs of others. As for running your unsigned extension, there will be six versions of Firefox available (stable, unbranded stable, beta, unbranded beta, dev edition and nightly). Of these six, only two will force addon signing. All the others are a tweak away.

> Now if we're developing extensions, we'll have to also jump through more hoops thanks to this signing process. You say it "takes only seconds", but I've seen enough comments here from other developers saying they've been waiting months for reviews. That's not acceptable.

Please don't mix addon signing with AMO review, they are different process with different objectives. Addon signing happens in seconds because its automated. The signed addon is returned to you in seconds and you're free to distribute it as you see fit. Now, if you want to have your addon on AMO then you need to submit to AMO review which may take a long time due to the lack of people and the overall complexity of reviewing that type of code.

Re: Firefox 42 will not allow unsigned extensions

#296

Post by ectoplasm »

soapdog wrote: post #295
SkatAndRap wrote: post #268

Earlier quoted context omitted.

It's not "hatred" you're seeing. It's exasperation after repeated disappointment, so much of it totally unnecessary. Many of us have been using software from Mozilla, and Netscape before them, for decades now. Generally we've been happy with the software. We were more than happy with earlier versions of Firefox, in fact. But lately we've seen changes made that have not benefited the users of Mozilla's software. Your…

Thanks for keeping it civil. I will address some of your comments in the best way I can. >It wasn't always like that. We used to be able to download a sub-10 MB installer, run it, and have a usable installation of Firefox ready for use. The Web Platform advanced a lot in the last few years. A lot has been added to browsers. They are no longer a simple HTML engine with some CSS and bad JS engines. Browsers these days…

> As for running your unsigned extension, there will be six versions of Firefox available (stable, unbranded stable, beta, unbranded beta, dev edition and nightly). Of these six, only two will force addon signing. All the others are a tweak away.

Okay, I want a branded Firefox. I don't want to run a dev edition or nightly. My choices are stable or beta. I probably don't even want beta, but it doesn't really matter. So, I don't really have a choice here.

I can see why signed extensions are a good thing, but removing the option from about:config is unnecessary.

Re: Firefox 42 will not allow unsigned extensions

#297

Post by rndgermandude »

soapdog wrote: post #293
rndgermandude wrote: post #225

Earlier quoted context omitted.

Mozilla will certainly continue to sign my piracy-enabling add-on that is perfectly legal in many jurisdictions worldwide, even after an US court ordered them not to sign it explicitly? I also heard mozilla got an NSL for my "Ed Snowden for president, Find out more on wikileaks" add-on, or rather, I didn't because NSL. Then again, I hear a brought coalition of human rights, LGBT and feminist groups lobbying mozilla n…

You understand that the addon signing process is automated right? Addon signing is not the same as AMO review. You can sign your addons and distribute them on other channels if they don't match AMO review criterias.

You do understand that mozilla still could reject certain add-ons, even when only to be signed to be hosted elsewhere, and in fact they do:

>Files submitted for signing will go through an automated review process. If they pass this review, they are automatically signed and sent back to the developer. This process should normally take seconds. If the file doesn't pass review, the developer will have the option to request a manual review, which should take less than two days.

Right now, the automatic signing will probably only fail if malware is detected. The "Right now" part is what worries me a bit, tho.

Re: Firefox 42 will not allow unsigned extensions

#298

Post by rndgermandude »

azakai wrote: post #7
GeorgeOrr wrote: post #2

It's important to note that the Developers Editions (and the Nightlys) will have a setting for disabling the requirement. The assumption being that developers need to test as they develop. And are a more informed user.

The link also says that there will be builds of normal (release) and beta Firefox that do not have this limitation, for those that want them. (In addition to people always being able to recompile the browser with whatever modifications they want, of course.)

I was only commenting on the "trival build or not" part. You're right that there are plans to have official "unofficial" release and beta builds without signing requirements, but only for the en-US locale (yes, language packs exist, no, not every developer on Earth speaks English)

Re: Firefox 42 will not allow unsigned extensions

#299

Post by cpeterso »

SkatAndRap wrote: post #269
asadotzler wrote: post #237

Earlier quoted context omitted.

"I have been looking at https://input.mozilla.org/ now and then for a long time, and I am still astounded at how it's typically around 90% unhappy, 10% happy." I've been reading Mozilla's bug system for 17 years and the bug numbers keep going up. That can't be a good sign.

It's disappointing to see Mozilla's leadership respond with sarcasm and denial when faced with the fact that 80% or more of their users are not happy with recent versions of Firefox.

That should be 80% of the users who have some reason to be poking around in Firefox's Help menu and are motivated enough to click "Submit Feedback". That group does not include many people who have a perfectly good experience with Firefox.

Re: Firefox 42 will not allow unsigned extensions

#300

Post by josteink »

soapdog wrote: post #292
josteink wrote: post #278

Earlier quoted context omitted.

They are non-standard in the sense that 99% of Firefox users are not using them.

Do you understand that the Unbranded Stable version and Firefox Stable version have the same codebase? You can use that version for testing or if your users don't want signing they can move to that version. They lose the cute icon and branding but the code is the same.

I think you missed my very clear point: now it's not enough to just run Firefox. You need to ask for users to run the "right" version if Firefox.

Telling people what browser to use is user hostile behaviour. Users will not bother. Non-official extensions will get less interest. Authors will see a smaller user base and have less interest in writing new extensions.

This will have a chilling effect all over.

Post reply on HN