I think Firefox needs to stop this add-on signing and review madness. The web is OPEN. It's not a walled-garden Apple App Store. Yes, extensions run arbitrary JavaScript code. So does any webpage you go to, and nobody from Mozilla reviewed all that JavaScript either. How are extensions any different? Chrome is doing just fine without all this non-sense process and policy.
Update Regarding Add-Ons in Firefox
321–330 of 504 posts
Re: Update Regarding Add-Ons in Firefox
#322Re: Update Regarding Add-Ons in Firefox
#323Earlier quoted context omitted.
> Those still would have their certificates checked on installation. How? These extensions were not being installed through the normal mechanism. The malicious extension installer will just set the flag that says "this extension has been verified". > And honestly, I think it is security theater to attempt to defend against attackers on the same or higher privilege level. I understand that, and Mozilla does too: "By b…
But that's the point. Either the installer does something malicious or it doesn't. If it does you lost the game. If it doesn't then a simple check is sufficient. Everything else is security theater which makes life worse for everyone. Also, they could still run the verification and prompt the user instead of just forcing the decision.
On a typical Linux install, the Firefox binary is not writeable by a malicious extension installer that runs with user privileges. Thus baking the check into the binary fully protects the integrity.
Re: Update Regarding Add-Ons in Firefox
#324This one will be emotional as this destroyed some of my today's work. F you Mozilla. I lost all my tabs opened in other containers. The containers don't work too, so I cannot reopen them. This bug has been known for 3 years, and you did nothing to fix it. You get so much money, and what you do is basically provide a pathetic software (thunderbird) and a nice browser (which you just stopped from working) and you show…
I lose all tabs occasionally. Browsers aren't perfect, it does happen after a weird crash, or something. It's exceedingly rare, like maybe twice a year. With that said, I've always considered tabs to be volatile state. Browsers make their best effort to e.g. restore the previous session after a crash, but if you want non-volatile browser state, you should use bookmarks.
Except I specifically use an extension to ensure tab state isn't volatile (Tab Session Manager, backed up with export tabs urls & a custom script), since I don't want to bookmark 35 pages for a current project, I just want to save them to a named session and have everything avaliable when I return to the project.
I agree that tabs are volatile, although I really wish they weren't. I'm having flashbacks to the quantum switch and having to change most of my extensions. I'd consider switching, but I really don't care for the chromium monoculture that's developing.
Re: Update Regarding Add-Ons in Firefox
#325Earlier quoted context omitted.
I just switched my browser. Bye bye Firefox.
Switch to what? Chrome? Because you don't like having to re-opt-in to studies? That would be ludicrous given Google's privacy track record. Opera? They're owned by a Chinese investment firm now. Edge? MS's whole OS is based on data collection.
Typing this from a new Brave install. Just switched from Firefox after their handling of this.
Re: Update Regarding Add-Ons in Firefox
#326Instead of enabling studies just click on this link. It installs that specific "study" (hotfix) without installing anything else. https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...
How do I uninstall this? It doesn't show up anywhere after installation.
Re: Update Regarding Add-Ons in Firefox
#327This one will be emotional as this destroyed some of my today's work. F you Mozilla. I lost all my tabs opened in other containers. The containers don't work too, so I cannot reopen them. This bug has been known for 3 years, and you did nothing to fix it. You get so much money, and what you do is basically provide a pathetic software (thunderbird) and a nice browser (which you just stopped from working) and you show…
Every browser I used has managed to lose my open tabs, chrome did it most frequently and with no obvious way to restore them. Hurts every time, but the only actual answer you will not be happy to hear is you shouldn't depend on browser saving your current open tabs, that's just asking for trouble.
Ironically, I've had excellent luck with a Firefox extension (tab session manager). I've had crashes which lost tabs, normally from me being an idiot, but it's done an excellent job preserving sessions automatically.
Re: Update Regarding Add-Ons in Firefox
#328How long until heads roll? There's something really wrong with the organization. And I thought it was only their marketing/pr that was bad. > We can't afford to lose Mozilla and Firefox. https://news.ycombinator.com/item?id=18800360
nowadays they seem to make it a hobby to make negative headlines at least once every quarter. I fear there will be no negative repercussions for the leadership. Basically, the management set their own salaries, the entire work force gets a 40% yearly bonus, and they have no one from the outside to report to. On top of all of this, the money flows regardless of what anyone is doing. (While there is a yearly loss of 10…
This is categorically untrue, and unhelpful.
Re: Update Regarding Add-Ons in Firefox
#329Instead of enabling studies just click on this link. It installs that specific "study" (hotfix) without installing anything else. https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...
How do I uninstall this? It doesn't show up anywhere after installation.
Knowledge Base info of uninstalling xpi
http://kb.mozillazine.org/Uninstalling_extensions#Uninstalli...
Re: Update Regarding Add-Ons in Firefox
#330IMHO it seems problematic, that they can remotely push code changes, including replacement of trusted certificate, and bypass package managers. I don't expect software to (significantly?) change during runtime, outside of what was packaged, signed, distributed and installed as part of apt/yum/pacman/etc. I understand (not that I like or agree with) that some apps are just embedded web browsers, and load everything ex…
If you didn't have browsers auto updating no-one would update them manually, meaning bad news for web developers wanting to take advantage of newer features.