Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla Firefox Add-On Signing Update

blog.mozilla.org

Post reply on HN
Print view View original

21–30 of 68 posts

Re: Mozilla Firefox Add-On Signing Update

#21

Post by cpeterso »

hayksaakian wrote: post #3
doomrobo wrote: post #2

Can somebody please explain to me the purpose of this change. I read the blog post explaining the decision[0]. The crux of the argument was >many tens of millions of users have non-hosted add-ons that were installed without their informed consent" Why go thermonuclear and require add-on signing for everyone? Why not just make the add-on installation screen a little bit scarier. And if the concern is to make sure that…

people become 'blind' to scary screens. see: windows UAC dialogs. i wish they would clearly indicate what problem it is that they're solving. --- edit: after reading the post you linked, it's clear they're fighting against software installers that 'conveniently' install firefox addons. for example you download skype, and it 'helpfully' installs an addon for firefox. --- their solutions might solve the problem, but I…

Skype's "Click to Call" add-on is a good (bad?) example of the harm caused by "side-loaded" add-ons. It causes Firefox to crash, hang, or take multiple seconds to respond to mouse clicks. The add-on is quietly injected into Firefox by Skype's application installer and can't be disabled or uninstalled from Firefox's Add-on Manager. Users must uninstall it from the Windows' "Add/Remove Programs" Control Panel.

https://bugzilla.mozilla.org/show_bug.cgi?id=1215970

Re: Mozilla Firefox Add-On Signing Update

#22

Post by notnarb »

superkuh wrote: post #15

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser. I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not…

While I would agree that these changes are unfortunate for this specific use case, I do believe there are at least two workarounds for you:

1) Creating an AMO account and running the command line "jpm sign" tool yourself. This requires a bit of overhead per each new addon you want to make modifications to, but the actual signing of unlisted addons (which is entirely automated) had been fast and mostly painless in my experience.

2) Using Firefox Aurora/Developer Edition as your main browser and relying on its automatic update mechanism.

Re: Mozilla Firefox Add-On Signing Update

#23

Post by cpeterso »

jMyles wrote: post #16
mattbasta wrote: post #10

Earlier quoted context omitted.

For the same reason Facebook puts a big loud warning in the developer console. People will follow any instructions they're given. "Press ctrl+shift+I and paste this in the box and you'll get a free puppy" "Put this in your address bar and your crush will be revealed" "Go to about:config and double click this thing, and then click this link and we'll show you nearby singles that want to hook up" Firefox add-ons essent…

This argument doesn't really square with me. Why not just remove sudo then? Why give me any access to my computer at all?

Non-technical users do not use sudo, but they do use a web browser. Do you think Facebook add this JavaScript console warning for no reason at all?

   .d8888b.  888                       888    
  d88P  Y88b 888                       888    
  Y88b.      888                       888    This is a browser feature intended for 
   "Y888b.   888888  .d88b.  88888b.   888    developers. If someone told you to copy-paste 
      "Y88b. 888    d88""88b 888 "88b  888    something here to enable a Facebook feature 
        "888 888    888  888 888  888  Y8P    or "hack" someone's account, it is a 
  Y88b  d88P Y88b.  Y88..88P 888 d88P         scam and will give them access to your 
   "Y8888P"   "Y888  "Y88P"  88888P"   888    Facebook account.
                             888              
                             888              
                             888
See https://www.facebook.com/selfxss for more information.

Re: Mozilla Firefox Add-On Signing Update

#24

Post by notnarb »

superkuh wrote: post #19
cpeterso wrote: post #18

Earlier quoted context omitted.

Chrome requires extensions to be both signed and distributed through Google's "Chrome Web Store". You can use the Firefox Developer Edition, which will continue to support the xpinstall.signatures.required preference allowing unsigned extensions.

"Chrome did it." isn't an excuse. It makes it worse, actually. Developer edition is "Aurora". Aurora is alpha. Alphas have more bugs. It's not reasonable to tell me to use an alpha.

Have you actually used Aurora? I can only speak to my own experience, but I have found it far more stable than any other 'alpha' software I've used.

Re: Mozilla Firefox Add-On Signing Update

#25

Post by cpeterso »

superkuh wrote: post #19
cpeterso wrote: post #18

Earlier quoted context omitted.

Chrome requires extensions to be both signed and distributed through Google's "Chrome Web Store". You can use the Firefox Developer Edition, which will continue to support the xpinstall.signatures.required preference allowing unsigned extensions.

"Chrome did it." isn't an excuse. It makes it worse, actually. Developer edition is "Aurora". Aurora is alpha. Alphas have more bugs. It's not reasonable to tell me to use an alpha.

"Chrome did it" is not an excuse. I was pointing out that Chrome is even more restrictive. Google requires developers to distribute their add-ons through Google's store of approved add-ons.

Re: Mozilla Firefox Add-On Signing Update

#26

Post by mintplant »

superkuh wrote: post #15

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser. I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not…

You'd drop Firefox and go to, what, Chrome? The browser that by default sends all your history to Google?

Re: Mozilla Firefox Add-On Signing Update

#27

Post by cbd1984 »

jMyles wrote: post #8
whoopdedo wrote: post #4

TLDR: People complained so we're back-pedaling. There are good technical reasons for requiring signed add-ons. Well, maybe not so much "good" but necessary because of other bad things in Firefox that prevent a less extreme requirement from being implemented. But the signing requirement isn't what upsets anyone. It's that add-ons must be signed _only by Mozilla_. The whole mess could have been avoided from the start b…

> good technical reasons For forcing signed add-ons? Maybe. Mayyybe. For removing the ability to opt-out of this requirement via the preference? What's the good technical reason?

Couldn't a rogue add-on unset the preference for you and keep it unset?

I'm not entirely sure how much control add-ons have over internal browser preferences.

Re: Mozilla Firefox Add-On Signing Update

#28

Post by superkuh »

notnarb wrote: post #24
superkuh wrote: post #19

Earlier quoted context omitted.

"Chrome did it." isn't an excuse. It makes it worse, actually. Developer edition is "Aurora". Aurora is alpha. Alphas have more bugs. It's not reasonable to tell me to use an alpha.

Have you actually used Aurora? I can only speak to my own experience, but I have found it far more stable than any other 'alpha' software I've used.

Yes. When Firefox first announced their plans for the walled garden back near FF37/38 I did as everyone said and tried Aurora.

It crashed on me twice in as many hours. I'm pretty hard on browsers since I typically have 200+ tabs loaded. That never happens with final release versions.

Re: Mozilla Firefox Add-On Signing Update

#29

Post by superkuh »

mintplant wrote: post #26
superkuh wrote: post #15

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser. I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not…

You'd drop Firefox and go to, what, Chrome? The browser that by default sends all your history to Google?

Nope. I use Pale Moon. It's an actively developed full fork of Firefox. All my extensions work in it. It's more Firefox than Firefox these days.

Re: Mozilla Firefox Add-On Signing Update

#30

Post by superkuh »

notnarb wrote: post #22
superkuh wrote: post #15

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser. I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not…

While I would agree that these changes are unfortunate for this specific use case, I do believe there are at least two workarounds for you: 1) Creating an AMO account and running the command line "jpm sign" tool yourself. This requires a bit of overhead per each new addon you want to make modifications to, but the actual signing of unlisted addons (which is entirely automated) had been fast and mostly painless in my…

What's going to prevent malware authors from making a bunch of AMO accounts and signing their malware if it's so easy and automated?
Post reply on HN