What’s going on in the world of extensions • Hacker News Board

Re: What’s going on in the world of extensions

#71

Post by ultrasaurus » Wed, Jan 18, 2023, 4:34 AM UTC

We build a browser extension for people to demo their own SaaS ( https://www.demogorilla.com ) and while it's never explicitly blocked us, we definitely feel the friction in development from design choices because browsers are being used both as business tools (GSuite) and viewers of webpages funded by ads.

We don't touch anything but the websites a customer already owns, but there are a lot of design choices that really seem to focus on making adblockers (or cookie blockers, JS blockers etc) harder to make (in addition to some very reasonable cross-domain security choices that are annoying but 100% legit).

Re: What’s going on in the world of extensions

#72

Post by _23sd » Wed, Jan 18, 2023, 5:56 AM UTC

jakear wrote: post #28

It's upsetting to see all this corporate double-speak when Firefox fails to support the most basic extension functionally: the User Agent should allow the User to run their own code on their own machine without any requirement of phoning home to the manufacturer. This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own…

>I don't see any way to stop automatic updates in settings

Hit the gear and uncheck "Update Add-ons Automatically".

>This is all trivial in Edge.

Is it? I can't find the toggle for extension autoupdates in Edge, and a search only turns up hacky methods for Chrome, nothing specific to Edge.

Re: What’s going on in the world of extensions

#73

Post by Vinnl » Wed, Jan 18, 2023, 7:22 AM UTC

karaterobot wrote: post #43

> The panel shows the user’s installed and enabled extensions and their current permissions. Users are free to grant ongoing access to a website or to make that decision per visit and can remove, report, and manage extensions and their permissions directly from the toolbar. Does anybody know whether this change allows me (the user) to grant an extension permission to a specific, arbitrary domain only? That is, to tak…

As I understand it, yes. See also https://blog.mozilla.org/addons/2022/11/17/unified-extension...

Re: What’s going on in the world of extensions

#74

Post by PurpleRamen » Wed, Jan 18, 2023, 2:36 PM UTC

TazeTSchnitzel wrote: post #57

jakear wrote: post #28

It's upsetting to see all this corporate double-speak when Firefox fails to support the most basic extension functionally: the User Agent should allow the User to run their own code on their own machine without any requirement of phoning home to the manufacturer. This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own…

Mozilla provide unbranded versions of Firefox that don't require extensions to be signed: https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... The official branded releases only require signatures because everything else they tried to stop malware hijacking the browser ultimately failed. Mozilla are not trying to copy iOS, they don't stop you leaving the walled garden if you want to.

Unbranded seems to be only available as nightly or beta. No option just for this problem.

Re: What’s going on in the world of extensions

#75

Post by PurpleRamen » Wed, Jan 18, 2023, 2:41 PM UTC

contravariant wrote: post #3

Ah so this is why they messed up the overflow menu. Kind of hoping I can actually order the extensions at some point though, it's a bit messy if you can no longer control which extensions are in the overflow menu or what order they're in.

That lack of sorting in the new extension-menu makes question whether the developers are even using their own work. This seems like an obvious problem one would realize early when using it.

Re: What’s going on in the world of extensions

#76

Post by TazeTSchnitzel » Wed, Jan 18, 2023, 4:25 PM UTC

PurpleRamen wrote: post #74

TazeTSchnitzel wrote: post #57

Earlier quoted context omitted.

Mozilla provide unbranded versions of Firefox that don't require extensions to be signed: https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... The official branded releases only require signatures because everything else they tried to stop malware hijacking the browser ultimately failed. Mozilla are not trying to copy iOS, they don't stop you leaving the walled garden if you want to.

Unbranded seems to be only available as nightly or beta. No option just for this problem.

The page I linked to has release builds. The branding isn't the same as normal release builds, but that's why it's called unbranded.

Re: What’s going on in the world of extensions

#77

Post by PurpleRamen » Wed, Jan 18, 2023, 5:27 PM UTC

TazeTSchnitzel wrote: post #76

PurpleRamen wrote: post #74

Earlier quoted context omitted.

Unbranded seems to be only available as nightly or beta. No option just for this problem.

The page I linked to has release builds. The branding isn't the same as normal release builds, but that's why it's called unbranded.

Yes, and downloading such a release-versions gives me an installation with codename Nightly, not a stable version. Even the version-number is newer.

Re: What’s going on in the world of extensions

#78

Post by TazeTSchnitzel » Wed, Jan 18, 2023, 6:14 PM UTC

PurpleRamen wrote: post #77

TazeTSchnitzel wrote: post #76

Earlier quoted context omitted.

The page I linked to has release builds. The branding isn't the same as normal release builds, but that's why it's called unbranded.

Yes, and downloading such a release-versions gives me an installation with codename Nightly, not a stable version. Even the version-number is newer.

They have Nightly branding but they aren't nightlies.

Re: What’s going on in the world of extensions

#79

Post by jakear » Wed, Jan 18, 2023, 10:28 PM UTC

_23sd wrote: post #72

jakear wrote: post #28

It's upsetting to see all this corporate double-speak when Firefox fails to support the most basic extension functionally: the User Agent should allow the User to run their own code on their own machine without any requirement of phoning home to the manufacturer. This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own…

>I don't see any way to stop automatic updates in settings Hit the gear and uncheck "Update Add-ons Automatically". >This is all trivial in Edge. Is it? I can't find the toggle for extension autoupdates in Edge, and a search only turns up hacky methods for Chrome, nothing specific to Edge.

> Hit the gear and uncheck "Update Add-ons Automatically".

Thanks, my bad for looking for settings in Settings.

> Is it? I can't find the toggle for extension autoupdates in Edge, and a search only turns up hacky methods for Chrome, nothing specific to Edge.

I can't speak to extensions downloaded from the store, as I only sideload. But when sideloaded, the extensions of course do not update unless you explicitly pull changes in or make changes yourself. Sideloading itself is trivial, even Stable builds provide a "Developer Mode" toggle that allows loading unsigned unpacked extensions from local directories.

Re: What’s going on in the world of extensions

#80

Post by jakear » Wed, Jan 18, 2023, 11:07 PM UTC

TazeTSchnitzel wrote: post #78

PurpleRamen wrote: post #77

Earlier quoted context omitted.

Yes, and downloading such a release-versions gives me an installation with codename Nightly, not a stable version. Even the version-number is newer.

They have Nightly branding but they aren't nightlies.

When I download the Unbranded/"Nightly" build, it says it's v107.0.1, versus Stable is v109.0. You seemed to be of the impression the declared version string was incorrect, so I dug a bit deeper. The security fixes mentioned in the changelog for v109, such as CVE-2023-23601 [1] are not present in the latest Unbranded/"Nightly" release.

So basically Mozilla telling developers: want to be able to run your own code? Fine. But only if you use a months-old browser subject to a bunch of security vulnerabilities we keep a list of on our website for any would-be attacker to consult.

[1] https://www.mozilla.org/en-US/security/advisories/mfsa2023-0...