Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla Firefox Add-On Signing Update

blog.mozilla.org

Post reply on HN
Print view View original

61–68 of 68 posts

Re: Mozilla Firefox Add-On Signing Update

#61

Post by reubenmorais »

awalGarg wrote: post #50
superkuh wrote: post #43

Earlier quoted context omitted.

It's official. Aurora is explicitly alpha. When they bump the version number Nightly turns into Aurora turns into Beta turns into Release.

Well I meant, do you happen to have a link stating that? :) > When they bump the version number Nightly turns into Aurora turns into Beta turns into Release. Not exactly. I guess you intentionally (over-)simplified that? Firefox actually follows trainspotting for their different release channels: https://hacks.mozilla.org/2015/04/trainspotting-firefox-37-d...

They are right. Here's a link: https://wiki.mozilla.org/Releases#Upcoming_Releases

Aurora is alpha, but FWIW, I've been using Nightly as my main browser for over 4 years now without ever losing data, so Aurora should be more than fine.

Re: Mozilla Firefox Add-On Signing Update

#62

Post by irq-1 »

verusfossa wrote: post #38

I think this whole thing is a bad idea. They won't allow a scary opt-out button because some software could turn it on, don't allow about:config because it could be flipped, don't allow a build flag in stable because malware could flip it and build. I mean... by that logic, couldn't someone reskin and redistribute alpha or the 'unbranded' with malware? Firefox is so afraid of malware, yet it encourages users to store…

> It really feels like a landgrab and not anything anyone has been asking for.

Benevolent DRM. Mozilla wants to control the software, even though users want to be in control. Plugins are the reason people always give for using Firefox. Justifying control by citing non-technical users is telling: users are to be managed and controlled; users aren't "us" but the other.

Re: Mozilla Firefox Add-On Signing Update

#63

Post by cpeterso »

jMyles wrote: post #37
cpeterso wrote: post #23

Earlier quoted context omitted.

Non-technical users do not use sudo, but they do use a web browser. Do you think Facebook add this JavaScript console warning for no reason at all? .d8888b. 888 888 d88P Y88b 888 888 Y88b. 888 888 This is a browser feature intended for "Y888b. 888888 .d88b. 88888b. 888 developers. If someone told you to copy-paste "Y88b. 888 d88""88b 888 "88b 888 something here to enable a Facebook feature "888 888 888 888 888 888 Y8…

> Non-technical users do not use sudo, but they do use a web browser. Your casual casting of a swath of the population as "non-technical" notwithstanding, the point is still sound: why do you think that it's worth gutting this feature as a safeguard against someone being fooled into navigating to "about:config" but not worth removing sudo for the same reason? If someone can be persuaded to abuse "about:config", why n…

90% of web users are on Windows, where there is no sudo. Malicious add-ons make money by injecting ads, overriding default search engine settings, capturing login credentials or even local files, or installing zombie spam relays. sudo is unnecessary for these attacks. How does one make money with sudo?

And as for locking down sudo, OS X is now "rootless" (System Integrity Protection) by default, preventing even sudo access from modifying some system settings.

Re: Mozilla Firefox Add-On Signing Update

#64

Post by kozukumi »

RubyPinch wrote: post #58
kozukumi wrote: post #55

They have the EME build for people who don't want the DRM stuff so why can't they just offer a build with unsigned extensions allowed in a similar way? Yes it gets messy but they are making it so. I don't want to use a non-release (i.e. possibly buggy) version just so I can sideload an unsigned extension. Just offer a non-front-page build in the same way they do for EME and let's move on to more important things. Ser…

> so why can't they just offer a build with unsigned extensions allowed in a similar way? From the article that you are commenting on > at which point unbranded builds based on [...] release will be provided for testing. The article was 3 paragraphs long.

Apologies, I didn't see release mentioned when I read the article.

Re: Mozilla Firefox Add-On Signing Update

#65

Post by yuhong »

JohnTHaller wrote: post #59
ambrop7 wrote: post #36

Earlier quoted context omitted.

The security of the browser is conditional on the security of the platform in the first place, so this does not make sense. Anything that can edit the settings of the browser without its knowledge can interfere with the browser and other software in other bad ways. It especially does not make sense for users who actually do have a reasonably secure platform, and these "security features" are then purely an annoyance.

Here's the thing, though. They work. It's far easier for a low to mid-tier bundleware company to build a basic browser extension that inserts ads or takes over the homepage/search engine using basic off-the-shelf components than it is for them to install a system-level networking component that intercepts and changes browser networking calls without breaking things. Google Chrome took a dual pronged approach to disal…

Of course, Google Chrome itself is probably less malicious than many of the other bundleware. I wonder how many would have supported Firefox doing the same thing in 2004.

Re: Mozilla Firefox Add-On Signing Update

#66

Post by jMyles »

cpeterso wrote: post #63
jMyles wrote: post #37

Earlier quoted context omitted.

> Non-technical users do not use sudo, but they do use a web browser. Your casual casting of a swath of the population as "non-technical" notwithstanding, the point is still sound: why do you think that it's worth gutting this feature as a safeguard against someone being fooled into navigating to "about:config" but not worth removing sudo for the same reason? If someone can be persuaded to abuse "about:config", why n…

90% of web users are on Windows, where there is no sudo. Malicious add-ons make money by injecting ads, overriding default search engine settings, capturing login credentials or even local files, or installing zombie spam relays. sudo is unnecessary for these attacks. How does one make money with sudo? And as for locking down sudo, OS X is now "rootless" (System Integrity Protection) by default, preventing even sudo…

> 90% of web users are on Windows, where there is no sudo.

This argument is becoming increasingly specious.

Firefox is the default browser on Ubuntu, where there is sudo. So do you acknowledge that it is consistent to keep this preference in at least the linux version of FF?

Re: Mozilla Firefox Add-On Signing Update

#67

Post by mappu »

tomjen3 wrote: post #33
mappu wrote: post #14

Earlier quoted context omitted.

Malware is currently setting the preference and installing itself. How can you stop that?

How can you stop malware fiddling with bits to allow installation of extensions?

>How can you stop malware fiddling with bits to allow installation of extensions?

Require signed extensions - and have the code that does the signing check be locked for modification (e.g. 755 root in /usr/)

Re: Mozilla Firefox Add-On Signing Update

#68

Post by kbrosnan »

dstillman wrote: post #34
notnarb wrote: post #22

Earlier quoted context omitted.

While I would agree that these changes are unfortunate for this specific use case, I do believe there are at least two workarounds for you: 1) Creating an AMO account and running the command line "jpm sign" tool yourself. This requires a bit of overhead per each new addon you want to make modifications to, but the actual signing of unlisted addons (which is entirely automated) had been fast and mostly painless in my…

No need to use Developer Edition. The unbranded builds of Release and Beta will have an update mechanism too. They'll be en-US only, though, so if you want a non-English interface, you're out of luck.

If you want to use a non-English interface you would install the langpack for example https://ftp.mozilla.org/pub/firefox/releases/44.0/win32/xpi/ you would need to navigate the ftp to match your particular install.
Post reply on HN