Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla Firefox Add-On Signing Update

blog.mozilla.org

Post reply on HN
Print view View original

31–40 of 68 posts

Re: Mozilla Firefox Add-On Signing Update

#31

Post by tomjen3 »

cpeterso wrote: post #18
superkuh wrote: post #15

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser. I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not…

Chrome requires extensions to be both signed and distributed through Google's "Chrome Web Store". You can use the Firefox Developer Edition, which will continue to support the xpinstall.signatures.required preference allowing unsigned extensions.

That isn't true, you can install Developer add-ons worth going through Google (otherwise how can you develop them). You might get an annoying pop-up though.

Re: Mozilla Firefox Add-On Signing Update

#32

Post by mappu »

xjay wrote: post #17
mappu wrote: post #14

Earlier quoted context omitted.

Malware is currently setting the preference and installing itself. How can you stop that?

If software could reliably know when the setting was changed-- --It could warn the user: Hey, isn't it convenient that this check was disabled just before this addon was about to be installed? Perhaps a three strikes approach, where, if you disabled the warning, you'd still have to suffer through the warning three more times. You'd need a reliable way to store the state to avoid tampering.

> You'd need a reliable way to store the state to avoid tampering.

It's the same problem. If the user can set it, then it can also be set by malware running at the same privilege as the user.

The only solution is to move the check outside of this privilege level (i.e. the readonly `.text` section of the firefox binary in /usr/ or Program Files). That's what the signing requirement does.

Re: Mozilla Firefox Add-On Signing Update

#33

Post by tomjen3 »

mappu wrote: post #14
jMyles wrote: post #9

I honest-to-goodness don't understand. Why not just let the preference remain forever?

Malware is currently setting the preference and installing itself. How can you stop that?

How can you stop malware fiddling with bits to allow installation of extensions?

Re: Mozilla Firefox Add-On Signing Update

#34

Post by dstillman »

notnarb wrote: post #22
superkuh wrote: post #15

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser. I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not…

While I would agree that these changes are unfortunate for this specific use case, I do believe there are at least two workarounds for you: 1) Creating an AMO account and running the command line "jpm sign" tool yourself. This requires a bit of overhead per each new addon you want to make modifications to, but the actual signing of unlisted addons (which is entirely automated) had been fast and mostly painless in my…

No need to use Developer Edition. The unbranded builds of Release and Beta will have an update mechanism too.

They'll be en-US only, though, so if you want a non-English interface, you're out of luck.

Re: Mozilla Firefox Add-On Signing Update

#35

Post by [deleted] »

jMyles wrote: post #8
whoopdedo wrote: post #4

TLDR: People complained so we're back-pedaling. There are good technical reasons for requiring signed add-ons. Well, maybe not so much "good" but necessary because of other bad things in Firefox that prevent a less extreme requirement from being implemented. But the signing requirement isn't what upsets anyone. It's that add-ons must be signed _only by Mozilla_. The whole mess could have been avoided from the start b…

> good technical reasons For forcing signed add-ons? Maybe. Mayyybe. For removing the ability to opt-out of this requirement via the preference? What's the good technical reason?

[deleted]

Re: Mozilla Firefox Add-On Signing Update

#36

Post by ambrop7 »

JohnTHaller wrote: post #12
jMyles wrote: post #8

Earlier quoted context omitted.

> good technical reasons For forcing signed add-ons? Maybe. Mayyybe. For removing the ability to opt-out of this requirement via the preference? What's the good technical reason?

Because a third party app on Windows can edit the Firefox preferences file to set the opt-out preference and then install its unsigned malware/spying/ad-injecting extension and it'll be loaded the next time Firefox starts up with no warning to the user. This is why Chrome hashes its settings files on Windows so that when any 3rd party app tries to mess with it, it wipes all extensions and extension settings and reset…

The security of the browser is conditional on the security of the platform in the first place, so this does not make sense. Anything that can edit the settings of the browser without its knowledge can interfere with the browser and other software in other bad ways.

It especially does not make sense for users who actually do have a reasonably secure platform, and these "security features" are then purely an annoyance.

Re: Mozilla Firefox Add-On Signing Update

#37

Post by jMyles »

cpeterso wrote: post #23
jMyles wrote: post #16

Earlier quoted context omitted.

This argument doesn't really square with me. Why not just remove sudo then? Why give me any access to my computer at all?

Non-technical users do not use sudo, but they do use a web browser. Do you think Facebook add this JavaScript console warning for no reason at all? .d8888b. 888 888 d88P Y88b 888 888 Y88b. 888 888 This is a browser feature intended for "Y888b. 888888 .d88b. 88888b. 888 developers. If someone told you to copy-paste "Y88b. 888 d88""88b 888 "88b 888 something here to enable a Facebook feature "888 888 888 888 888 888 Y8…

> Non-technical users do not use sudo, but they do use a web browser.

Your casual casting of a swath of the population as "non-technical" notwithstanding, the point is still sound: why do you think that it's worth gutting this feature as a safeguard against someone being fooled into navigating to "about:config" but not worth removing sudo for the same reason?

If someone can be persuaded to abuse "about:config", why not sudo?

Re: Mozilla Firefox Add-On Signing Update

#38

Post by verusfossa »

I think this whole thing is a bad idea. They won't allow a scary opt-out button because some software could turn it on, don't allow about:config because it could be flipped, don't allow a build flag in stable because malware could flip it and build. I mean... by that logic, couldn't someone reskin and redistribute alpha or the 'unbranded' with malware? Firefox is so afraid of malware, yet it encourages users to store their passwords in plain text in the browser?

It really feels like a landgrab and not anything anyone has been asking for. Firefox has to compete with the Chrome web store, but you can't burn your house down to save a room. What's left if Firefox becomes some centralized market akin to iOS, Windows Store, Play etc. Forced AMO signing flies in the face of the decentralized web. "Malware happened" and "Chrome does it" aren't really answers.

I think getting backed into a corner has made Moz take risks with their ideology. Hopefully they give developers and users a lot more time to deal with the upcoming changes.

Re: Mozilla Firefox Add-On Signing Update

#39

Post by awalGarg »

superkuh wrote: post #19
cpeterso wrote: post #18

Earlier quoted context omitted.

Chrome requires extensions to be both signed and distributed through Google's "Chrome Web Store". You can use the Firefox Developer Edition, which will continue to support the xpinstall.signatures.required preference allowing unsigned extensions.

"Chrome did it." isn't an excuse. It makes it worse, actually. Developer edition is "Aurora". Aurora is alpha. Alphas have more bugs. It's not reasonable to tell me to use an alpha.

> Aurora is alpha

Excuse my ignorance, but is this official? I use FF Dev edition as my primary browser and it is very stable for me.

Context, if it helps: I am a web dev most of the time, and my browser usage is almost always >100 tabs or so. More than half of those have the devtools open all the time (each of which basically count as another instance of Firefox). My machine is pretty modest (i5, dual core, 8gigs RAM). I don't use many extensions though. Only a lightweight custom theme and greasemonkey + lots of custom userscripts. Reason I use dev edition is because it has more devtools goodies and ES6 features. Nothing related to extension development.

Re: Mozilla Firefox Add-On Signing Update

#40

Post by jMyles »

mappu wrote: post #32
xjay wrote: post #17

Earlier quoted context omitted.

If software could reliably know when the setting was changed-- --It could warn the user: Hey, isn't it convenient that this check was disabled just before this addon was about to be installed? Perhaps a three strikes approach, where, if you disabled the warning, you'd still have to suffer through the warning three more times. You'd need a reliable way to store the state to avoid tampering.

> You'd need a reliable way to store the state to avoid tampering. It's the same problem. If the user can set it, then it can also be set by malware running at the same privilege as the user. The only solution is to move the check outside of this privilege level (i.e. the readonly `.text` section of the firefox binary in /usr/ or Program Files). That's what the signing requirement does.

But if malware is running at the same privilege as the user, I have all sorts of more serious problems. Why is this worth stripping me of sovereignty over my browser?
Post reply on HN