Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla Firefox Add-On Signing Update

blog.mozilla.org

Post reply on HN
Print view View original

11–20 of 68 posts

Re: Mozilla Firefox Add-On Signing Update

#11

Post by mattbasta »

doomrobo wrote: post #2

Can somebody please explain to me the purpose of this change. I read the blog post explaining the decision[0]. The crux of the argument was >many tens of millions of users have non-hosted add-ons that were installed without their informed consent" Why go thermonuclear and require add-on signing for everyone? Why not just make the add-on installation screen a little bit scarier. And if the concern is to make sure that…

They tried making it scarier. They even tried adding a timer so you couldn't just blindly click the install button.

Re: Mozilla Firefox Add-On Signing Update

#12

Post by JohnTHaller »

jMyles wrote: post #8
whoopdedo wrote: post #4

TLDR: People complained so we're back-pedaling. There are good technical reasons for requiring signed add-ons. Well, maybe not so much "good" but necessary because of other bad things in Firefox that prevent a less extreme requirement from being implemented. But the signing requirement isn't what upsets anyone. It's that add-ons must be signed _only by Mozilla_. The whole mess could have been avoided from the start b…

> good technical reasons For forcing signed add-ons? Maybe. Mayyybe. For removing the ability to opt-out of this requirement via the preference? What's the good technical reason?

Because a third party app on Windows can edit the Firefox preferences file to set the opt-out preference and then install its unsigned malware/spying/ad-injecting extension and it'll be loaded the next time Firefox starts up with no warning to the user.

This is why Chrome hashes its settings files on Windows so that when any 3rd party app tries to mess with it, it wipes all extensions and extension settings and resets the homepage and search engine to the defaults. Unfortunately this also means that you can't move your Chrome settings to another PC as they'll all get reset. You have to sync to Google to ensure all your settings aren't wiped by a badware app or a corrupt byte in the Chrome settings file.

Re: Mozilla Firefox Add-On Signing Update

#13

Post by xjay »

mattbasta wrote: post #11
doomrobo wrote: post #2

Can somebody please explain to me the purpose of this change. I read the blog post explaining the decision[0]. The crux of the argument was >many tens of millions of users have non-hosted add-ons that were installed without their informed consent" Why go thermonuclear and require add-on signing for everyone? Why not just make the add-on installation screen a little bit scarier. And if the concern is to make sure that…

They tried making it scarier. They even tried adding a timer so you couldn't just blindly click the install button.

I assumed the timer was there to prevent clicking Install by accident.

Popup dialogs may appear right "above" something else you were clicking on, or while you're typing; hitting Enter, or Escape, which then causes the dialog to eat the input and vanish.

Putting a dialog on cooldown like that would be interesting UX behavior. So if a dialog receives input PS: I'd mark my post Off-Topic/Digression/UX if HN had that option.

Re: Mozilla Firefox Add-On Signing Update

#15

Post by superkuh »

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser.

I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not a solution. They say they'll be producing an "unbranded" non-walled garden version that for technical users but no such build has been revealed yet. And if they do make it the unbranded version won't be in my OS repos.

This walled garden, the addition of Adobe EME/DRM, the bundling of "Pocket", and the incoming drop of XUL based extensions are too much.

Re: Mozilla Firefox Add-On Signing Update

#16

Post by jMyles »

mattbasta wrote: post #10
jMyles wrote: post #9

I honest-to-goodness don't understand. Why not just let the preference remain forever?

For the same reason Facebook puts a big loud warning in the developer console. People will follow any instructions they're given. "Press ctrl+shift+I and paste this in the box and you'll get a free puppy" "Put this in your address bar and your crush will be revealed" "Go to about:config and double click this thing, and then click this link and we'll show you nearby singles that want to hook up" Firefox add-ons essent…

This argument doesn't really square with me.

Why not just remove sudo then?

Why give me any access to my computer at all?

Re: Mozilla Firefox Add-On Signing Update

#17

Post by xjay »

mappu wrote: post #14
jMyles wrote: post #9

I honest-to-goodness don't understand. Why not just let the preference remain forever?

Malware is currently setting the preference and installing itself. How can you stop that?

If software could reliably know when the setting was changed--

--It could warn the user: Hey, isn't it convenient that this check was disabled just before this addon was about to be installed?

Perhaps a three strikes approach, where, if you disabled the warning, you'd still have to suffer through the warning three more times. You'd need a reliable way to store the state to avoid tampering.

Re: Mozilla Firefox Add-On Signing Update

#18

Post by cpeterso »

superkuh wrote: post #15

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser. I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not…

Chrome requires extensions to be both signed and distributed through Google's "Chrome Web Store".

You can use the Firefox Developer Edition, which will continue to support the xpinstall.signatures.required preference allowing unsigned extensions.

Re: Mozilla Firefox Add-On Signing Update

#19

Post by superkuh »

cpeterso wrote: post #18
superkuh wrote: post #15

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser. I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not…

Chrome requires extensions to be both signed and distributed through Google's "Chrome Web Store". You can use the Firefox Developer Edition, which will continue to support the xpinstall.signatures.required preference allowing unsigned extensions.

"Chrome did it." isn't an excuse. It makes it worse, actually.

Developer edition is "Aurora". Aurora is alpha. Alphas have more bugs. It's not reasonable to tell me to use an alpha.

Re: Mozilla Firefox Add-On Signing Update

#20

Post by currysausage »

JohnTHaller wrote: post #12
jMyles wrote: post #8

Earlier quoted context omitted.

> good technical reasons For forcing signed add-ons? Maybe. Mayyybe. For removing the ability to opt-out of this requirement via the preference? What's the good technical reason?

Because a third party app on Windows can edit the Firefox preferences file to set the opt-out preference and then install its unsigned malware/spying/ad-injecting extension and it'll be loaded the next time Firefox starts up with no warning to the user. This is why Chrome hashes its settings files on Windows so that when any 3rd party app tries to mess with it, it wipes all extensions and extension settings and reset…

Pretty fascinating. How do they store the hash?
Post reply on HN