Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla Firefox Add-On Signing Update

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 68 posts

Re: Mozilla Firefox Add-On Signing Update

#41

Post by alexvoda »

cpeterso wrote: post #23
jMyles wrote: post #16

Earlier quoted context omitted.

This argument doesn't really square with me. Why not just remove sudo then? Why give me any access to my computer at all?

Non-technical users do not use sudo, but they do use a web browser. Do you think Facebook add this JavaScript console warning for no reason at all? .d8888b. 888 888 d88P Y88b 888 888 Y88b. 888 888 This is a browser feature intended for "Y888b. 888888 .d88b. 88888b. 888 developers. If someone told you to copy-paste "Y88b. 888 d88""88b 888 "88b 888 something here to enable a Facebook feature "888 888 888 888 888 888 Y8…

I think this is unnecessary, especially in the land of FLOSS licensed software where the developer disclaims any and all warranties. Developers should focus on usability, and not on idiot-proofing software.

There is no way to guard against users installing malware themselves. No matter what kind of safeguards and check summing and signing you use for your application once a program has full access to a machine it can do anything, including bypass your safeties.

You can't fight user stupidity. In doing so developers do a disservice to their regular users. (The way Chorme prevents this issue is exactly an example of this because the app is no longer portable) No matter what kind of padding you add, stupid users will still manage to hurt themselves in the most unexpected and unimaginable ways.

I really despise this trend stared in the US and the rest of the western world where idiots sue companies for the effects of their own idiocy and this results in all kinds of redundant warnings on products that just serve to guard the manufacturer from stupid lawsuits. We should not strive so much to go against natural selection. Darwin awards exist for a reason.

Re: Mozilla Firefox Add-On Signing Update

#42

Post by verusfossa »

cpeterso wrote: post #23
jMyles wrote: post #16

Earlier quoted context omitted.

This argument doesn't really square with me. Why not just remove sudo then? Why give me any access to my computer at all?

Non-technical users do not use sudo, but they do use a web browser. Do you think Facebook add this JavaScript console warning for no reason at all? .d8888b. 888 888 d88P Y88b 888 888 Y88b. 888 888 This is a browser feature intended for "Y888b. 888888 .d88b. 88888b. 888 developers. If someone told you to copy-paste "Y88b. 888 d88""88b 888 "88b 888 something here to enable a Facebook feature "888 888 888 888 888 888 Y8…

Oh you're right! We need EME'd web assembly so Facebook can hide everything behind a proprietary binary blob. THEN the user will really be free from themselves and their own stupidity. \s

Re: Mozilla Firefox Add-On Signing Update

#43

Post by superkuh »

awalGarg wrote: post #39
superkuh wrote: post #19

Earlier quoted context omitted.

"Chrome did it." isn't an excuse. It makes it worse, actually. Developer edition is "Aurora". Aurora is alpha. Alphas have more bugs. It's not reasonable to tell me to use an alpha.

> Aurora is alpha Excuse my ignorance, but is this official? I use FF Dev edition as my primary browser and it is very stable for me. Context, if it helps: I am a web dev most of the time, and my browser usage is almost always >100 tabs or so. More than half of those have the devtools open all the time (each of which basically count as another instance of Firefox). My machine is pretty modest (i5, dual core, 8gigs RA…

It's official. Aurora is explicitly alpha. When they bump the version number Nightly turns into Aurora turns into Beta turns into Release.

Re: Mozilla Firefox Add-On Signing Update

#44

Post by nabla9 »

The goal should be to make Firefox brand maximally safe for average user.

Recognizable name is important for non-technical users. Mozilla should take every effort to make browsing safe for anyone who uses browsers originating from mozilla.org. Even for average developers. There should be no way to trick people following instructions that disable add-on signing if they download and use something they know by the name "Firefox"

What we want is separate no-brand Firefox build that follows Firefox closely. It should work exactly like Firefox including updates (except when it explicitly deviates) but have no name recognition or easy association to Firefox/Mozilla.org. In theory it could be automatic build from Firefox development team as long as it's impossible to download it from mozilla.org and associate it with the same site as Firefox unless you know what you are doing. Any bug or security issue arising form the deviant version should not have Firefox in the news headline.

Re: Mozilla Firefox Add-On Signing Update

#45

Post by yuhong »

nabla9 wrote: post #44

The goal should be to make Firefox brand maximally safe for average user. Recognizable name is important for non-technical users. Mozilla should take every effort to make browsing safe for anyone who uses browsers originating from mozilla.org. Even for average developers. There should be no way to trick people following instructions that disable add-on signing if they download and use something they know by the name…

I think Mozilla already will do something like this.

Re: Mozilla Firefox Add-On Signing Update

#46

Post by yuhong »

superkuh wrote: post #30
notnarb wrote: post #22

Earlier quoted context omitted.

While I would agree that these changes are unfortunate for this specific use case, I do believe there are at least two workarounds for you: 1) Creating an AMO account and running the command line "jpm sign" tool yourself. This requires a bit of overhead per each new addon you want to make modifications to, but the actual signing of unlisted addons (which is entirely automated) had been fast and mostly painless in my…

What's going to prevent malware authors from making a bunch of AMO accounts and signing their malware if it's so easy and automated?

I think Mozilla can block the accounts and blocklist the add-ons.

Re: Mozilla Firefox Add-On Signing Update

#47

Post by Manishearth »

cpeterso wrote: post #23
jMyles wrote: post #16

Earlier quoted context omitted.

This argument doesn't really square with me. Why not just remove sudo then? Why give me any access to my computer at all?

Non-technical users do not use sudo, but they do use a web browser. Do you think Facebook add this JavaScript console warning for no reason at all? .d8888b. 888 888 d88P Y88b 888 888 Y88b. 888 888 This is a browser feature intended for "Y888b. 888888 .d88b. 88888b. 888 developers. If someone told you to copy-paste "Y88b. 888 d88""88b 888 "88b 888 something here to enable a Facebook feature "888 888 888 888 888 888 Y8…

Firefox actually has additional protection against such attacks. Minor annoyance for developers (who may not even hit it if they use the console regularly), but helps mitigate such attacks quite a bit.

http://inpursuitoflaziness.blogspot.in/2014/04/the-battle-ag...

Re: Mozilla Firefox Add-On Signing Update

#48

Post by Flimm »

Pxtl wrote: post #7
hayksaakian wrote: post #3

Earlier quoted context omitted.

people become 'blind' to scary screens. see: windows UAC dialogs. i wish they would clearly indicate what problem it is that they're solving. --- edit: after reading the post you linked, it's clear they're fighting against software installers that 'conveniently' install firefox addons. for example you download skype, and it 'helpfully' installs an addon for firefox. --- their solutions might solve the problem, but I…

Android does it best - you can install non-play-store stuff, but you have to go into a scary menu and fiddle with settings. Better than an are you sure popup.

Because all apps are sandboxed on Android, it's hard for an app to fiddle with the settings. But desktop applications can fiddle with Firefox settings, so I can see why Mozilla don't want to allow even a setting.

Re: Mozilla Firefox Add-On Signing Update

#49

Post by notnarb »

superkuh wrote: post #30
notnarb wrote: post #22

Earlier quoted context omitted.

While I would agree that these changes are unfortunate for this specific use case, I do believe there are at least two workarounds for you: 1) Creating an AMO account and running the command line "jpm sign" tool yourself. This requires a bit of overhead per each new addon you want to make modifications to, but the actual signing of unlisted addons (which is entirely automated) had been fast and mostly painless in my…

What's going to prevent malware authors from making a bunch of AMO accounts and signing their malware if it's so easy and automated?

(I do not work for Mozilla so this is speculation):

As far as I can tell, side loaded extensions require a full, non-automated, review http://i.imgur.com/r070Grv.png and it wouldn't surprise me if side-loaded extensions were the worst offenders.

Upon discovering a malicious extension, Mozilla could look through all extensions they've signed and blacklist (https://addons.mozilla.org/en-US/firefox/blocked/) all extensions with a similar signature similar to how some anti-malware databases work.

There is probably not all that much stopping you from writing a malicious extension that passes the AMO automated review (example: https://addons.mozilla.org/en-US/firefox/blocked/i1058), but the cost for malware writers is going to be significantly higher since it will be far easier for Mozilla to shut them down via their blacklists.

Re: Mozilla Firefox Add-On Signing Update

#50

Post by awalGarg »

superkuh wrote: post #43
awalGarg wrote: post #39

Earlier quoted context omitted.

> Aurora is alpha Excuse my ignorance, but is this official? I use FF Dev edition as my primary browser and it is very stable for me. Context, if it helps: I am a web dev most of the time, and my browser usage is almost always >100 tabs or so. More than half of those have the devtools open all the time (each of which basically count as another instance of Firefox). My machine is pretty modest (i5, dual core, 8gigs RA…

It's official. Aurora is explicitly alpha. When they bump the version number Nightly turns into Aurora turns into Beta turns into Release.

Well I meant, do you happen to have a link stating that? :)

> When they bump the version number Nightly turns into Aurora turns into Beta turns into Release.

Not exactly. I guess you intentionally (over-)simplified that? Firefox actually follows trainspotting for their different release channels: https://hacks.mozilla.org/2015/04/trainspotting-firefox-37-d...

Post reply on HN