Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla pulls Bypass Paywalls from Firefox add-ons store

github.com

Post reply on HN
Print view View original

141–150 of 288 posts

Re: Mozilla pulls Bypass Paywalls from Firefox add-ons store

#141

Post by [deleted] »

the8472 wrote: post #108
zaarn wrote: post #67

Earlier quoted context omitted.

IIRC you can install unsigned extensions in the dev and nightly as well as unbranded versions of firefox (usually the last option means compiling it yourself). Mozilla is, to some extend understandably, concerned with the image of Firefox and patrolling what Addons are available in the store is part of that. Apple does the very same thing.

> Mozilla is, to some extend understandably, concerned with the image of Firefox and patrolling what Addons are available in the store is part of that. This is a non-sequitur. Reviewing things on their addon store has nothing to do with requiring a mozilla signature for sideloading .

[deleted]

Re: Mozilla pulls Bypass Paywalls from Firefox add-ons store

#142

Post by MisterAV »

funklebunkle wrote: post #76
Vinnl wrote: post #10

Earlier quoted context omitted.

I've recently been experimenting with creating an extension, and the automated signing was literally one of the first things I did when I followed the Hello World tutorial. It's very easy to obtain an .xpi that you can distribute to your users yourself.

How do you do this without leaking your code to mozilla?

Aren't extension written in Javascript? Then the source is always visible to users.

Re: Mozilla pulls Bypass Paywalls from Firefox add-ons store

#143

Post by zaarn »

PhasmaFelis wrote: post #136
zaarn wrote: post #120

Earlier quoted context omitted.

You can install it if you use the developer edition or unbranded version, this is fairly well documented.

It is not reasonable for a user-freedom-oriented browser like Firefox to require you to install a separate version to install unsigned extensions. Hiding it in about:config behind a "this is dangerous, are you sure" warning would be the right thing to do here.

I think it's fairly reasonable for a user-freedom-oriented browser that also markets itself as a safe and fast alternative to Google Chrome. This exists to some extend to protect users who will click on any button as long as it makes them able to do what they want no matter how dangerous (which is, for example, why HSTS doesn't have a "Add Exception" button).

Mozilla focuses on maximizing the user's freedom to browser the web without being hindered by harmful addons.

And at the end of the day, Firefox is a Mozilla brand, using the Firefox browser associated with their Brand means to some extend that Mozilla will want to ensure that the average user has a certain experience with that brand. The average user is perfectly fine not installing unsigned addons, which is arguably something the more advanced and above average user might want, who has the full freedom to use a edition of the browser that is explicitly marketed to them, no?

Re: Mozilla pulls Bypass Paywalls from Firefox add-ons store

#144

Post by kbenson »

the8472 wrote: post #118
zaarn wrote: post #112

Earlier quoted context omitted.

Not quite. The signature is to ensure users install from the addon store. You can disable this if you wish to run non-store addons. Otherwise any website or external program (remember your A/V installing their safety toolbar?) could start adding fishy code to your browser.

That is a totally different issue. One thing is reviewing what's on your store. The other is restricting people to only installing what's on their store. One is happening on their property. The other is happening on the user's property. They also want to exert control over the latter, which is causing these problems.

It's the difference between on the one hand some spyware or adware shoving an addon in the right location in the Firefox profile directory and either accepting any dialogs to confirm you want to side-load or social engineering the user into accepting them, and on the other the same spyware having to actually patch the firefox binary or exploit it to get the same behavior, since the binary has verification baked in.

It's a big annoyance for me too, because I use private extensions extensively for some business stuff (used by the users here), but had to switch to a different mechanism (because I don't want to deal with verification). It sucks for me, but I totally understand why they are doing it.

Re: Mozilla pulls Bypass Paywalls from Firefox add-ons store

#145

Post by swiley »

zaarn wrote: post #67
avian wrote: post #33

> Release and Beta versions of Firefox do not allow unsigned extensions to be installed I'm really disappointed at Mozilla regarding this. I recently wanted to do some Firefox customization for my own private use (not even an extension, I just wanted to have some visual indication of which Firefox windows belong to which profile). I was surprised to find out that even just a header .png in a theme can't be loaded loc…

IIRC you can install unsigned extensions in the dev and nightly as well as unbranded versions of firefox (usually the last option means compiling it yourself). Mozilla is, to some extend understandably, concerned with the image of Firefox and patrolling what Addons are available in the store is part of that. Apple does the very same thing.

>usually the last option means compiling it yourself

The last time I did this it took so long I was able to write my own HTML parser while I was waiting (and I had never written a parser for a context free language before.)

Re: Mozilla pulls Bypass Paywalls from Firefox add-ons store

#146

Post by Mindwipe »

zaarn wrote: post #79
funklebunkle wrote: post #74

Earlier quoted context omitted.

> Apple does the very same thing. I understand that Apple does everything in its power to make the life of developers miserable (such as requiring a Mac to be used for iOS development), but Mozilla were supposed to be the good guys on the web.

I think you misunderstood there. Apple's primary aim by limiting the access to the store isn't to make devs miserable, it's to have users trust the app store. Mozilla's aim is (likely) the same. If a user finds an addon in Mozilla's addon store, then Mozilla wants the user to fully trust that this addon will not violate their privacy in unexpected ways or install malware on their computer or otherwise interfere with…

> Apple's primary aim by limiting the access to the store isn't to make devs miserable, it's to have users trust the app store.

It really isn't. It's to prop up their own services through anti-competitive blocking, to maintain a level of terrifying censorship, and to rent seek on what remains.

Re: Mozilla pulls Bypass Paywalls from Firefox add-ons store

#147

Post by Mindwipe »

soapdog wrote: post #71
Aissen wrote: post #53

Earlier quoted context omitted.

If you read correctly, it was removed 15 days ago, and we have no idea what's the status since then.

Did you try reaching out for the team in IRC or the mailing list?

As a process, that is a flat out awful one.

Re: Mozilla pulls Bypass Paywalls from Firefox add-ons store

#148

Post by logfromblammo »

laktak wrote: post #2

I don't want to subscribe, I also don't want to see ads or be tracked. I wish there was a universal micropayments way of paying for what I read.

The economics and game theory of this suggests that newspapers should be forced to cooperate with each other.

Cartelize on-line journalism. Make the 4th estate official. Create a pseudo-governmental entity like the US post office, Fannie Mae, or the Fed. If you have an Internet connection, you have the option, through your ISP, to pay $X towards journalism on the web. Your ISP will then cryptographically vouch for any request that goes from a paying subscriber to a cartel member site, such that the member doesn't know exactly who the subscriber is. If you're on a foreign network provider that doesn't participate, you'd have to get crypto keys and a standalone program (or browser add-on) directly from the cartel (that could make you identifiable), or go through a VPN that participates.

If a request comes in with valid crypto, the response is the requested article, with no tracking, and a cartel-fixed standard for ad content. If it does not, it is up to the publisher as to what to do with the response. Deny. Inject intrusive ads. Infect with tracking malware. If you didn't pay, you get what you get. Cartel members are paid from the common fund via analysis of the server logs, targeting X% of the total amount paid out as potentially lost to fraud (so as to not overspend on analysis and fraud detection). Baseline income is determined by quantity of eyeballs. The cartel can then dole out bonuses for quality--if one of your writers wins the Pulitzer, your paper gets extra money. And it's no big deal if bots are visiting sites, because each bot has to pay in order for its requests to count towards the circulation-based distributions.

I'm sure there are a lot of people out there willing to pay $10 a month or more for online journalism, but they don't want that whole budget to get sucked up by one newspaper, only to get locked out by all the others. And there are plenty of sites out there that can't seem to manage online subscriptions or micro-transactions very well.

Re: Mozilla pulls Bypass Paywalls from Firefox add-ons store

#149

Post by SilasX »

zaarn wrote: post #112
the8472 wrote: post #108

Earlier quoted context omitted.

> Mozilla is, to some extend understandably, concerned with the image of Firefox and patrolling what Addons are available in the store is part of that. This is a non-sequitur. Reviewing things on their addon store has nothing to do with requiring a mozilla signature for sideloading .

Not quite. The signature is to ensure users install from the addon store. You can disable this if you wish to run non-store addons. Otherwise any website or external program (remember your A/V installing their safety toolbar?) could start adding fishy code to your browser.

As in the sibling, thread, no, you can't disable the signature check, not in the regular, mainline FF download. Even if you enable it in about::config!

This was a change introduced in ~August 2016, to ignore your preferences on that setting.

(As you note in the sibling thread, you can get it in a special development version, but that still contradicts your claim that you can toggle something to allow it.)

Re: Mozilla pulls Bypass Paywalls from Firefox add-ons store

#150

Post by bigpicture »

funklebunkle wrote: post #74
zaarn wrote: post #67

Earlier quoted context omitted.

IIRC you can install unsigned extensions in the dev and nightly as well as unbranded versions of firefox (usually the last option means compiling it yourself). Mozilla is, to some extend understandably, concerned with the image of Firefox and patrolling what Addons are available in the store is part of that. Apple does the very same thing.

> Apple does the very same thing. I understand that Apple does everything in its power to make the life of developers miserable (such as requiring a Mac to be used for iOS development), but Mozilla were supposed to be the good guys on the web.

> I understand that Apple does everything in its power to make the life of developers miserable

All XCode projects are automatically code signed on every build. If you have a developer membership with Apple, it uses a certificate issued by Apple. If not, it's just a locally-generated certificate.

If you use make or call Clang directly, obviously there is no signing process, but there is a command-line tool that you can use and integrate into your non-Xcode build process just fine.

Post reply on HN