Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

nakedsecurity.sophos.com

Post reply on HN
Print view View original

71–80 of 104 posts

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#71

Post by TheLoneWolfling »

nine_k wrote: post #52
tokyo1000 wrote: post #24

Earlier quoted context omitted.

It's too bad to see that your comment is getting downvoted. I think it hits on some important issues. From what I can tell, Mozilla's own Firefox feedback stats support what you're saying. https://input.mozilla.org/en-US/?product=Firefox It's currently showing 77% of the reports about Firefox as being 'sad', while only 23% are 'happy'. It gets even worse if Firefox OS and Firefox for Android are included, too. In tha…

I never knew about that page to this day. I left a 'happy' piece of feedback. Should I have a serious issue, I'd probably look for a feedback page to report my problems, and would find it. So I think the feedback there is seriously skewed towards "unhappy".

And this is why feedback forms are useless. They just reinforce people's intrinsic biases.

Someone thinks that the current version is good, but the feedback is bad overall? Must just be that the feedback is skewed. Someone thinks that the current version is bad but the feedback is good overall? Must just be that the feedback is skewed.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#72

Post by TheLoneWolfling »

blueskin_ wrote: post #43

Mozilla get scummier every year. Might be time to move to Pale Moon, I think.

Already have, and as time goes on it's looking like I made a better and better choice.

At least PM actually follows through with the concept of user freedom.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#73

Post by doublextremevil »

mschuster91 wrote: post #35

Normally, I dislike "walled garden" approaches. The problem with browser extensions is that there are too many bad players on the field, preying on the non-technical people. The situation is not as bad as in the IE heydays where I regularly cleaned up 10+ (!) toolbars from customers' computers, but it's still a problem. And I, unfortunately, don't see any way to avoid a walled garden approach - as long as there is a…

the thing is, you won't be able to side-load extensions. There will be no about:config option. You will be forced to use the Development or Nightly versions to get that freedom.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#74

Post by byuu »

barrkel wrote: post #36
byuu wrote: post #2

With each passing day, Mozilla tries harder and harder to get me to stop using their browser. If not for Chrome being the only viable alternative, they would have long since succeeded. Wreck the address bar algorithm? Ugh. Move the tabs on top? Ugh. Force me to keep download history? Ugh. Bury all the configuration options (like JS features) into about:config? Ugh. Turn the UI into a poor Chrome imitation? Ugh. Turn…

I hear you - very few of Mozilla's moves have been to my liking, and I have to work harder and harder on every fresh install to get Firefox looking and working the way I like it. However, thus far, I've been able to do it. I disable the magic address bar, I use tree style tabs, I have history disabled, and I use combo of menu, toolbar and status bar (Status 4 Evar, addon bar, whatever) to maintain what I consider to…

Likewise. I am currently running Classic Theme Restorer, oldbar, Cookies Manager+, Download Cleaner, plus the usual stuff (Adblock and such.) Not only do I have to trust a bunch of third-party devs I don't know; it also takes longer and longer to setup and start using Firefox on a fresh install.

And indeed like you said ... the signing thing is a huge issue. oldbar in particular hasn't been touched since 2008. I've also had to manually load Greasemonkey before, and many times I've had to manually edit the XPI file compatibility ranges so that I could install certain extensions.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#75

Post by byuu »

sparaker wrote: post #6
byuu wrote: post #2

With each passing day, Mozilla tries harder and harder to get me to stop using their browser. If not for Chrome being the only viable alternative, they would have long since succeeded. Wreck the address bar algorithm? Ugh. Move the tabs on top? Ugh. Force me to keep download history? Ugh. Bury all the configuration options (like JS features) into about:config? Ugh. Turn the UI into a poor Chrome imitation? Ugh. Turn…

I agree with you on this. However i have also seen that alot of malware and adware does indeed make it to the browser to make it more pathetic and i think its a good direction in that regard. However i think that they really need to actually think what users are going to use then just build random features that nobody really cares for. And the imitation game is definitely not good, why be separate if you're going to…

The problem is that the malware is going to find a way through anyway. Even if it has to replace firefox.exe with a custom compiled binary that removes the signature checking function; or simply patches out the check in the binary on your system like a warez crack.

This is going to impede regular users a lot more than the advertisers.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#76

Post by scottjad »

nailer wrote: post #58
userbinator wrote: post #51

Earlier quoted context omitted.

Users are still allowed to install any extension from outside the garden they want. It's yet another hoop to jump through, one that further splits "developers" and "users" and makes it harder to be a "casual developer" - one who just wants to make an extension and share it among a small group.

> one who just wants to make an extension and share it among a small group. That's a fair point, but I don't think it's that bad. I do this all the time with Chrome, which already has walled garden: "Hey guys, I made a Chrome Extension that inlines all the images in our shitty issue tracking app rather than having to download them all. Extract the zip, visit chrome://extensions, enable developer mode, and load that f…

Except in this new scenario it's install a different version of Firefox (Firefox Developer). Good luck with that on many work machines. My dad is unable to install any applications on his work machine but he was able to install Adblock for Chrome the other day. So had he wanted to install this hypothetical extension for Firefox he would have been unable to.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#77

Post by Lawtonfogle »

danielweber wrote: post #61
userbinator wrote: post #48

Earlier quoted context omitted.

give them the resources to educate themselves Exactly. Instead of encouraging an environment of healthy suspicion and "I don't know what this does, maybe I should find out more first; else I shouldn't run it" type of attitude, we've gotten into a situation where people are seemingly loathe to educate themselves - and have been conditioned to trust whatever some piece of software says about whether something is malwar…

I appreciate your desire to improve user security, but it is a huge uphill battle, and many things that you imagine will help will just make users switch to something that nags them less. Teaching users to be safe -- assuming that's possible -- is a battle that has to be won in very very small steps.

>make users switch to something that nags them less.

Or perhaps even worse, conditions them to bypass any nags automatically without thought as to if they should or not.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#78

Post by rpdillon »

nailer wrote: post #44
userbinator wrote: post #40

It's funny to read this and the previous articles about the loss of freedom in Firefox, then see the description on its download page ( https://www.mozilla.org/en-US/firefox/new/ ): "Download Mozilla Firefox, a free Web browser. Firefox is created by a global non-profit dedicated to putting individuals in control online." I find the "appeal to security" argument that's being increasingly popular these days as nothing…

It seems like you haven't read the article. Users are still allowed to install any extension from outside the garden they want.

The article appears to indicate that the addons will still need to be signed by Mozilla, however.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#79

Post by sp332 »

onli wrote: post #21

The problem here is not the signing. It is a perfectly valid reasoning: Addons can be like malware, and that is something Mozilla should protect its users from. Reviewing and then signing extensions is an ok way to do that. But the focus here is not the signing, it is the reviewing. The problem is not the reviewing either. That may take time and is unpleasant, but it offers something good in return. The problem is th…

In this case, the opt-out is to download the unbranded version of the browser. It's identical to the normal version but it doesn't use Mozilla's trademarks (logos etc) and won't require signed extensions.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#80

Post by acdha »

tokenizerrr wrote: post #28
sonnyp wrote: post #25

Earlier quoted context omitted.

true but if Malware.exe ships with an addon, it could tweak Firefox user profile to allow the addon install

It could also patch firefox.exe to allow it. Or, just run in the background in its own process because malware.exe is already running. Once you have malicious binaries running on the user's computer all bets are off.

This is partially true – code-signing defeats it on modern operating systems – but don't forget that much of the problem isn't outright malware but rather ad-ware like the ask.com toolbar where the companies try to claim that users chose to enable it to avoid prosecution or lawsuits.

This is a relatively minor change but the automated checks prevent some of the more blatant abuse and, more importantly, the fact that you can't just anonymously upload code forces shady companies to leave more of a paper-trail.

Post reply on HN