This is very frustrating. Made worse by the fact that they just replaced their packaging tool with a new jpm tool that doesn't yet match the functionality of the old tool.
Firefox 42 will not allow unsigned extensions
191–200 of 315 posts
Re: Firefox 42 will not allow unsigned extensions
#192> [...] plugins don't need to be signed.
So the worst kind of threat is still there. Great job, Mozilla!
Re: Firefox 42 will not allow unsigned extensions
#193Earlier quoted context omitted.
Because bad guys can just keep getting new certs when their old ones are revoked, unless you do identity validation (which costs money as it requires actual humans, so the certs can't be cheap or free).
Reviewing plugins costs somewhere around the same amount of human time/money, no?
Add-on reviews are done largely by volunteers.
Re: Firefox 42 will not allow unsigned extensions
#194Earlier quoted context omitted.
Firefox users see through this feel-good marketing nonsense from Mozilla. They've seen Firefox's UI change for the worse in so many ways, even in the face of wide opposition. They've seen unwanted bloat, like Hello and Pocket, forced upon them, again in the face of wide opposition. They've seen their requests for bug fixes and performance improvements go unheeded, sometimes for years. The easy use of extensions has b…
Some people hate the UI changes. A lot of people are just fine with them. Hello and Pocket are just two buttons in a toolbar which you can remove.
> Hello and Pocket are just two buttons in a toolbar which you can remove.
I would have preferred to see bugs fixed, rather than features that undeniably belong in extensions. Even if it'd been issues that don't even affect me.
Re: Firefox 42 will not allow unsigned extensions
#195Will this also affect Firefox for Android? Mozilla currently don't provide a dev build for Android, just regular and beta versions https://play.google.com/store/apps/developer?id=Mozilla The security problem that this "fixes" is not really an issue on Android due to Android's own app sandboxing, so maybe the Android build will allow unsigned extensions? It's not mentioned in the FAQ.
> Mozilla currently don't provide a dev build for Android, just regular and beta versions
Nightly versions of Firefox are available from https://nightly.mozilla.org/.
Re: Firefox 42 will not allow unsigned extensions
#196Earlier quoted context omitted.
Firefox users see through this feel-good marketing nonsense from Mozilla. They've seen Firefox's UI change for the worse in so many ways, even in the face of wide opposition. They've seen unwanted bloat, like Hello and Pocket, forced upon them, again in the face of wide opposition. They've seen their requests for bug fixes and performance improvements go unheeded, sometimes for years. The easy use of extensions has b…
You're being pretty grim. Hello is fucking awesome, and while I don't use Pocket it isn't the end of the world. Firefox isn't Lynx, but even as a Unix guy I enjoy and appreciate it. I also appreciate that they're trying to be more attractive to the masses, which is societally beneficial.
As you do, I have a lot of programs and extensions installed on my machine. How about you install them all on yours? Come on! Don't be grim! They are fucking awesome and if you don't use them it's not like it is the end of the world :^)
Re: Firefox 42 will not allow unsigned extensions
#197Earlier quoted context omitted.
From https://wiki.mozilla.org/Addons/Extension_Signing "What are my options if I want to install unsigned extensions in Firefox? The Developer Edition and Nightly versions of Firefox will have a setting to disable signature checks. There will also be special unbranded versions of Release and Beta that will have this setting, so that add-on developers can work on their add-ons without having to sign every build."
Ah, nice. Even so, I still have issues with this: - Special version of the software - Can't run my own version of AMO
> - Can't run my own version of AMO
You can, AMO is open source: https://github.com/mozilla/olympia
Run your own instance and make your own builds of Firefox that point to it and you're good.
Re: Firefox 42 will not allow unsigned extensions
#198> [...] plugins don't need to be signed. So the worst kind of threat is still there. Great job, Mozilla!
yup, and that's what i don't get. statistically, plugins like java and flash are a bigger security threat than addons. i don't even remember an addon going rogue.
Re: Firefox 42 will not allow unsigned extensions
#199Earlier quoted context omitted.
Ah, nice. Even so, I still have issues with this: - Special version of the software - Can't run my own version of AMO
> - Can't run my own version of AMO You can, AMO is open source: https://github.com/mozilla/olympia Run your own instance and make your own builds of Firefox that point to it and you're good.
>make your own builds of Firefox
Yeah, let me just get all of the potential users of my AMO alternative to compile a custom version of Firefox for it
Re: Firefox 42 will not allow unsigned extensions
#200Mozilla's hypocrisy is astounding: https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." https://blog.mozilla.org/theden/2014/12/15/introducing-a-sma... "Firefox is dedicated to putting users in control of their online experience" More recently: https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in... "Firefox Puts You…
WTF people. So much hate for Mozilla these days, this appear pitchfork group.
Lets review what the article says: addons needed to be signed. The process is automated. It takes only seconds. It prevents some malware from spreading.
You can still host your addon wherever you want. This is just an extra step that can actually improve security. It requires more effort by the part of the developer but it also helps prevent some security issues.
Firefox Dev Edition and Nightly will have switches to turn this off. Firefox stable and Beta will not. Do you want to switch this off? Move to more bleeding edge versions. Or pick the unbranded version.
The unbranded version is available only in English and this is a problem that can be solved with language packs which are available in the hundreds.
Heck, this is an improvement to security. You can opt out by moving to a different Firefox version, there are three versions you can use, DevEdition, Nightly and Unbranded. If you opt-in you have an extra level of confidence in the addon you're installing.
Developers take only couple seconds to submit and retrieve back their addons and the added bonus for security is great. This will prevent those pesky spyware/malware from hijacking your browser which is a problem faced by many users that are not as tech savvy as this crowd here.
And yet people throw a tantrum....