Mozilla Firefox Add-On Signing Update

Still stuck on Firefox 41, they broke too many extensions after that.

Add-On Signing which can be automated does provide very little added security for the user, and just serves as a big pain the butt for everyone else involved.

I'm routinely questioned to do support for users, and I find malware extensions regularly installed in Chrome which has even stricter requirements. The other day I found a laptop with one extension that redirected google.com to a scraper. Chrome did EVEN include a drop-down warning just below the URL bar that the homepage was being currently redirected by an add-on. Did the user notice? Not a bit.

In fact, Chrome adding a WARNING for it made me feel even more sad: they know this is going on. Is FF going to do the same? If I was an user with an extension that did that for whatever reason I wanted, I would be furious as hell to see an added warning which I need to disable (IF possible), and that will be ignored by most users anyway.

Malware developers will just get by faster, so Mozilla will not be able to keep up with the list of addons to blacklist. At the same time, initial approvals for legitimate addons will get slower. Reporting issues with Addons is clearly insufficient as Chrome Store demonstrates. In fact, I'm also NOT ok with the idea that extensions can be blacklisted at all, in spite of that "added security" aura around it. By the same logic, if extensions are required to be signed, then blacklisting (and blacklisting updates) shouldn't be allowed to be disabled.

And, let's remind ourselves, that most of the extensions I've seen installed were side-loaded with other software (with "extras") that was installed in the system with the same privileges of the browsers. So really, I do expect malware to simply patch the FF binary to either disable the check or change the public key, or change it entirely with a patched version.

I do not support walled gardens of any kind. Use a fork.

They have the EME build for people who don't want the DRM stuff so why can't they just offer a build with unsigned extensions allowed in a similar way?

Yes it gets messy but they are making it so. I don't want to use a non-release (i.e. possibly buggy) version just so I can sideload an unsigned extension.

Just offer a non-front-page build in the same way they do for EME and let's move on to more important things.

Seriously Mozilla waste so much time and energy discussing all this stuff when it is patently obvious what the right thing to do is.

On the Google sync servers, that's the trick.

Here's the thing, though. They work. It's far easier for a low to mid-tier bundleware company to build a basic browser extension that inserts ads or takes over the homepage/search engine using basic off-the-shelf components than it is for them to install a system-level networking component that intercepts and changes browser networking calls without breaking things. Google Chrome took a dual pronged approach to disallow all extensions except those in their online store an disallow third party changes to browser settings. So, bundleware can't easily install into Chrome. It can easily install into Firefox because you or anyone else on the PC can install whatever you want.

Just because this practice doesn't apply to or benefit you doesn't mean it doesn't apply to and benefit the majority of browser users. Remember, the majority of Firefox users don't even use extensions at all. Closing this hole would increase their security browser-wise.

Ironic Note: Google Chrome, while attempting to block bundleware from interfering with its own operation, is one of the most widely distributed bundleware apps. Installers that use dark patterns (tricking users to not notice they're installing a new default browser) from Oracle's Java to Adobe Flash to Avast to Antivir all are used to install Chrome onto systems (hopefully) without the user noticing.