Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

nakedsecurity.sophos.com

Post reply on HN
Print view View original

31–40 of 104 posts

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#31

Post by scottjad »

And what about other xulrunner applications, such as Conkeror? Do their extensions need to be signed by Mozilla?

So if I use a xulrunner based app, and I want to run a Firefox extension (like ABP, mozrepl, etc), right now all I have to do is edit it's install.rdf and whitelist my application, and if there's a signature (META-INF folder), delete that. In this scheme, as I understand it, that would not work, unless I was running the Firefox Developer edition or had an app popular enough to get developers to include it in their whitelist before signing, and even then there would be plenty of exceptions.

So now no one can run my xulrunner based app (with extensions) with the normal firefox installed on their system (or likely available in their distro package repository).

Please tell me this won't apply to apps launched via xulrunner or firefox -app (with the normal firefox).

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#32

Post by chimeracoder »

smhenderson wrote: post #20
StevePerkins wrote: post #16

I know that people love to reflexively bash anything that Mozilla does (and I'm critical more often than not myself), but this seems positive overall. As a savvy user, I can always manually install a plugin just as I can side-load an Android app that isn't on Google Play. However, my mom and other casual users who probably shouldn't be installing plugins at all have a somewhat more curated experience. I'm a bit skept…

According to the article you won't be able to do that; although not all extensions have to go through addons.mozilla.org they do all have to be digitally signed. There are exceptions - something about "in house, corporate" (whatever that means), developer editions of Firefox and nightly builds. But if I read correctly users of the current, stock Firefox will not be able to suppress the signature check when installing…

To be honest, I don't think people who aren't capable of or interested in downloading a developer edition should be installing unsigned extensions. If there's an unsigned extension you really can't live without, just download Iceweasel - problem solved.

It's not like this will be that hard to get around for people who know what they're doing, so I'm not too worried about this change.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#33

Post by tokenizerrr »

yc1010 wrote: post #3

Instead of a walled garden approach, why cant they do a "Verified by Mozilla" badge for each plugin, with warnings if one doesn't have it BUT still giving the user control and choice of whether to use a plugin. I a made a quick and dirty plugin for chrome a month ago only to find out i need to undergo an anal exam and give over credit card information to Google, fuck that! is that where Mozilla want to endup?

Actually for the Chrome store you can make a developer account, never send them any money and then publish your extension as unlisted. This way it will not show up in search results, but you can still link to it directly.

Less nice than being able to self-host them which used to be possible, though...

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#34

Post by mbel »

sonnyp wrote: post #25
onli wrote: post #21

The problem here is not the signing. It is a perfectly valid reasoning: Addons can be like malware, and that is something Mozilla should protect its users from. Reviewing and then signing extensions is an ok way to do that. But the focus here is not the signing, it is the reviewing. The problem is not the reviewing either. That may take time and is unpleasant, but it offers something good in return. The problem is th…

true but if Malware.exe ships with an addon, it could tweak Firefox user profile to allow the addon install

Theoretically Malware.exe could be able to replace (or alias, or provide a convenient shortcut on Windows' desktop) the Firefox binary with one, that does not perform a certificate check. It is hard to protect user from something that is already running on their computer.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#35

Post by mschuster91 »

Normally, I dislike "walled garden" approaches.

The problem with browser extensions is that there are too many bad players on the field, preying on the non-technical people. The situation is not as bad as in the IE heydays where I regularly cleaned up 10+ (!) toolbars from customers' computers, but it's still a problem.

And I, unfortunately, don't see any way to avoid a walled garden approach - as long as there is a sideload option like on Android, I'm fine with it.

edit: downvotes? Care to explain how else to solve the bundled crapware toolbar plague?

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#36

Post by barrkel »

byuu wrote: post #2

With each passing day, Mozilla tries harder and harder to get me to stop using their browser. If not for Chrome being the only viable alternative, they would have long since succeeded. Wreck the address bar algorithm? Ugh. Move the tabs on top? Ugh. Force me to keep download history? Ugh. Bury all the configuration options (like JS features) into about:config? Ugh. Turn the UI into a poor Chrome imitation? Ugh. Turn…

I hear you - very few of Mozilla's moves have been to my liking, and I have to work harder and harder on every fresh install to get Firefox looking and working the way I like it.

However, thus far, I've been able to do it. I disable the magic address bar, I use tree style tabs, I have history disabled, and I use combo of menu, toolbar and status bar (Status 4 Evar, addon bar, whatever) to maintain what I consider to be a usable UI. These are all extra work, but I haven't been locked out.

My concern about this latest move is the lag when Firefox needs an upgrade, and not all extensions have been updated and signed. I've had to download and install custom treestyle tabs builds in the past in particular.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#37

Post by wodenokoto »

"This, of course, raises the question, "Will the unbranded or the Developer builds be sufficiently similar to the Release versions out in the real world that developers can stand by their testing results?""

Yes. It's the same code with different logo.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#38

Post by acdha »

onli wrote: post #21

The problem here is not the signing. It is a perfectly valid reasoning: Addons can be like malware, and that is something Mozilla should protect its users from. Reviewing and then signing extensions is an ok way to do that. But the focus here is not the signing, it is the reviewing. The problem is not the reviewing either. That may take time and is unpleasant, but it offers something good in return. The problem is th…

Microsoft already disproved this belief with Window’s UAC mechanism. Unless you have an unusually savvy user-base, you have to assume that a non-trivial percentage of people will approve any prompt which is claimed to give music, games, coupons, porn, etc.

Just to illustrate how unworkable this is currently, Facebook had to include a huge warning in the developer console telling you not to XSS yourself because people would follow instructions to open the developer tools and paste in a blob of JavaScript: https://www.facebook.com/help/246962205475854

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#39

Post by Ded7xSEoPKYNsDd »

scottjad wrote: post #31

And what about other xulrunner applications, such as Conkeror? Do their extensions need to be signed by Mozilla? So if I use a xulrunner based app, and I want to run a Firefox extension (like ABP, mozrepl, etc), right now all I have to do is edit it's install.rdf and whitelist my application, and if there's a signature (META-INF folder), delete that. In this scheme, as I understand it, that would not work, unless I w…

The initial announcement said, that there are no immediate plans to enable this for Thunderbird. I'd guess it's just a compile-time flag in .mozconfig. In that case it would affect firefox -app. (But I didn't bother to actually look at the source!)

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#40

Post by userbinator »

It's funny to read this and the previous articles about the loss of freedom in Firefox, then see the description on its download page (https://www.mozilla.org/en-US/firefox/new/):

"Download Mozilla Firefox, a free Web browser. Firefox is created by a global non-profit dedicated to putting individuals in control online."

I find the "appeal to security" argument that's being increasingly popular these days as nothing more than an excuse to restrict general-purpose computing and control the users, and I am not happy about it at all. "Malware is the new terrorism." The idea that we should take away freedom just because someone could possibly make a wrong decision is personally quite horribly disturbing. On the other hand, from the perspective of wanting to exert control, it makes perfect sense: by decreasing the amount of decisions users have to do, it induces atrophy of their critical thinking skills, and makes them more inclined to accept things without questioning...

"Freedom is not worth having if it does not include the freedom to make mistakes."

Post reply on HN