Live data from Hacker News

Update Regarding Add-Ons in Firefox

blog.mozilla.org

461–470 of 504 posts

Re: Update Regarding Add-Ons in Firefox

#461
post #408

Earlier quoted context omitted.

This has nothing to do with "studies" and should be pushed as a general fix. There is just no excuse. What if this had been a security incident?

Then it seems it’s a good thing they had a system in place that could deliver the quick fix in less than a day, on a Friday evening, when shipping a normal fix could have — is — taking longer to ship than that quick fix did.

Why does it take longer to ship a general fix / update? They don’t do a full regression for the studies fix? Update mechanism doesn’t check for updates as often? I couldn’t find any information on this yet but would love to know.

Re: Update Regarding Add-Ons in Firefox

#462
post #373

I wonder if there is someone out there in the middle of the ocean with a browser extension based communication and navagation system which is dead in the water? It sounds to me that the real headline here is that every copy of firefox out there was timebombed and we only noticed because someone forgot to elongate the fuse.

That is my biggest complaint. Only the Firefox Linux team of included a about:config option to turn it off. Android, Windows and mac have no way to do so. It's still broken on my phone. Wtf were they thinking?

Try

xpinstall.signatures.required

Works on Fennec version of Firefox.

Also IceCat version of Firefox wasn't affected AFAIK.

Re: Update Regarding Add-Ons in Firefox

#463
post #433

Earlier quoted context omitted.

Thanks to this script, I think I just managed to apply the patch to an old Firefox 56 install, whereas the .xpi had no effect.

There are other people here who I think would really appreciate details if you still have them.

https://www.reddit.com/r/firefox/comments/bkspmk/addons_fix_...

Re: Update Regarding Add-Ons in Firefox

#464
(disclosure: I am a Mozilla employee but not commenting in any official capacity)

"Give me control over what code I run on my computer" (meaning "provide a switch to disable the requirement that extensions be signed") keeps coming up over and over. And perhaps it hasn't been clearly stated but the problem is this: if there's a switch that a user can flip, the browser has to record the state of that switch somewhere (presumably on disk). If such a switch becomes available, we'll quickly be flooded with malware that flips that switch without users' consent. At that point, there's no way to tell the difference between savvy users making an informed choice to enable unsigned extensions and malware doing it behind their backs. The browser can do various things to obscure the way that setting is stored, but ultimately any method the browser uses to read and write the state of that switch is something that other software can easily mimic.

This is not a theoretical concern, a modern web browser target is an irresistible target for all sorts of get-rich-quick scammers -- if you don't experience this day-to-day its due in no small part to the fact that browser vendors among others are constantly working to keep the bad guys at bay. But make no mistake: the bad guys are out there and they quickly find and exploit any opportunities that are available to them.

So as to the problem of how to let users disable signing but ensure that they have made a conscious decision to do so, there is a stark tradeoff here: giving the most savvy users that switch necessarily makes other users less safe. The solution that Firefox has opted for here is to handle this tradeoff differently on different channels. The release channel (aka the stable channel, or the thing you get by default when you download Firefox) is intended for a very wide audience, and so it handles this tradeoff by favoring safety for all users regardless of their level of technical knowledge. The developer edition and nightly channels are intended for more technically savvy users and they handle this tradeoff differently; specifically they do provide a switch for disabling extension signing.

If there are other (practical and effective) ways to solve this problem of determining true user intent, I (and I'm sure many many others) would be very interested in hearing about them. In the mean time, using the mass-market versus developer-focused channels as a signal for users' preferences on the risk-configurability continuum seems like a reasonable way to handle this.

Re: Update Regarding Add-Ons in Firefox

#465

I think Firefox needs to stop this add-on signing and review madness. The web is OPEN. It's not a walled-garden Apple App Store. Yes, extensions run arbitrary JavaScript code. So does any webpage you go to, and nobody from Mozilla reviewed all that JavaScript either. How are extensions any different? Chrome is doing just fine without all this non-sense process and policy.

Extensions have dramatically more access to powerful APIs to affect the browser. They can be used to perform a great variety of annoying, intrusive or downright malicious actions which a website is incapable of. Of course they have much more stringent policy.

Chrome implements mandatory addon signatures as well, and only Google can sign them.

Re: Update Regarding Add-Ons in Firefox

#466
post #404
post #357

Earlier quoted context omitted.

I'm not sure I care how unfair the characterization is. I heavily use container tabs — ahem, 'usecontainers — and all of my open container tabs disappeared at once , with no indication of why or what to do about it, when this happened. I lost an absurd amount of work and state because of that. I only knew what caused it by inference, because I'd just previously read The Fine Article (which, btw, gave no indication th…

> I lost an absurd amount of work and state EDIT: after installing the fixed XPI, I have to sadly report that all data has gone. All my carefully-managed containerized life was wiped clean. Heads should roll. Complete shambles. And the worst thing is, I suspect it's all a plot to have more people opt-in to the shitty telemetry. Otherwise, why not push an update through the usual channels? Had it been a security-relat…

Locate your profile and look for session backups -- your data might still be there.

Re: Update Regarding Add-Ons in Firefox

#467
post #464

(disclosure: I am a Mozilla employee but not commenting in any official capacity) "Give me control over what code I run on my computer" (meaning "provide a switch to disable the requirement that extensions be signed") keeps coming up over and over. And perhaps it hasn't been clearly stated but the problem is this: if there's a switch that a user can flip, the browser has to record the state of that switch somewhere (…

My gripes with the switch paradigm are that it:

a) isn't transparent

b) doesn't empower the user

c) isn't easily modifiable

a), b) and c) are the exact opposites of what open source software is meant to stand for. Firefox is slowly losing its unique position of being an amazing open source browser in favor of what seems to me a negligible increase in user security. In my mind, Mozilla is wasting time on micromanaging user risk instead of actually innovating.

To put it this way, every time I go out biking, I can get hit by a car. It is a known and well understood risk, one that I have to consider whenever making a turn. However, riding a bike also provides chances to go faster, meet new people and so on. Should Firefox aim to reduce my risk of being hit by a car? No, because I get to choose the level of risk in my life, not Mozilla.

Re: Update Regarding Add-Ons in Firefox

#468
post #413
post #393

Earlier quoted context omitted.

It's cryptographically signed by Mozilla. The signature is much more important than the source.

I clicked that link and it displayed a puzzle piece with a one-way/no-entry symbol ( https://i.stack.imgur.com/eVpMr.png )... not sure how I can know that this was signed by Mozilla, a company that I trust less every year

The UI doesn't tell you, unfortunately. You would have to verify it out of band. But the browser already forces the verification, which you can verify by noticing all your add-ons are literally disabled because the signature checking is failing on them.

AFAIK the reason the UI is scary is primarily because it is from an era when add-ons were much more dangerous, and when they were not required to be centrally signed. Neither is true anymore afaik.

Re: Update Regarding Add-Ons in Firefox

#469
post #462

Earlier quoted context omitted.

That is my biggest complaint. Only the Firefox Linux team of included a about:config option to turn it off. Android, Windows and mac have no way to do so. It's still broken on my phone. Wtf were they thinking?

Try xpinstall.signatures.required Works on Fennec version of Firefox. Also IceCat version of Firefox wasn't affected AFAIK.

As far as I know that does not work on Mac and windows stable and not at all on android.

Re: Update Regarding Add-Ons in Firefox

#470
post #458

Earlier quoted context omitted.

It's a matter of degree. Your comments went an order of magnitude further over the line.

I am positive my first comment on this thread was not an order of magnitude over the line, if we can quantifiably measure such a thing, and it got censored anyway. "I just switched my browser. Bye bye Firefox." I mean if you want me to be reflective it's really not going to work if we're refusing to admit that either both of these comments should have been censored or the one above should not have been censored. But…

I can't consider only your first comment when you posted nine of them.
Post reply on HN