Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

nakedsecurity.sophos.com

Post reply on HN
Print view View original

81–90 of 104 posts

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#81

Post by nsgi »

wsha wrote: post #26
onli wrote: post #21

The problem here is not the signing. It is a perfectly valid reasoning: Addons can be like malware, and that is something Mozilla should protect its users from. Reviewing and then signing extensions is an ok way to do that. But the focus here is not the signing, it is the reviewing. The problem is not the reviewing either. That may take time and is unpleasant, but it offers something good in return. The problem is th…

Actually, the point of this change is that there is no opt out. The main target of this change is to prevent grayware from silently sideloading bad add-ons onto users' systems. Up to this point, such grayware could hide behind the argument that some user action implied consent to the add-on installation. With this new change, that is no longer possible. It is almost as easy for such grayware to silently modify the Fi…

Not to mention that if the greyware enabled the option, this would also make it possible for other unsigned addons to be installed.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#82

Post by nsgi »

shiftpgdn wrote: post #64
eklavya wrote: post #14

I can totally see why such a thing would be required. I have always wanted to have add-ons vetted by someone I can trust. This will be really effective at least on windows where softwares randomly install shitty add ons and hijack the browser. And mozilla not likely to give in to unreasonable requests from governments because if they are not then add ons should be the least of our worries.

My Chrome profile is current infected with malware due to Google's laissez-faire attitude towards their app store. I consider myself a pretty tech savvy user and still managed to get infected. A bit of vetting for add-ons is probably a good thing in the long run.

Is it something you can't uninstall?

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#83

Post by tokenizerrr »

acdha wrote: post #80
tokenizerrr wrote: post #28

Earlier quoted context omitted.

It could also patch firefox.exe to allow it. Or, just run in the background in its own process because malware.exe is already running. Once you have malicious binaries running on the user's computer all bets are off.

This is partially true – code-signing defeats it on modern operating systems – but don't forget that much of the problem isn't outright malware but rather ad-ware like the ask.com toolbar where the companies try to claim that users chose to enable it to avoid prosecution or lawsuits. This is a relatively minor change but the automated checks prevent some of the more blatant abuse and, more importantly, the fact that…

My windows box will still happily run unsigned binaries, so I don't see how code-signing would help it there. Unless you were not referring to regular windows/linux as modern. I'm not sure if there's anything special with regards to replacing signed binaries with unsigned ones, but if so you could just put the binary elsewhere and replace the shortcuts.

With regard to the ad-ware like toolbars, is that really reason enough to lock everyone into a walled garden? I'd rather deal with the occasional toolbar than only being allowed run blessed extensions.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#84

Post by acdha »

tokenizerrr wrote: post #83
acdha wrote: post #80

Earlier quoted context omitted.

This is partially true – code-signing defeats it on modern operating systems – but don't forget that much of the problem isn't outright malware but rather ad-ware like the ask.com toolbar where the companies try to claim that users chose to enable it to avoid prosecution or lawsuits. This is a relatively minor change but the automated checks prevent some of the more blatant abuse and, more importantly, the fact that…

My windows box will still happily run unsigned binaries, so I don't see how code-signing would help it there. Unless you were not referring to regular windows/linux as modern. I'm not sure if there's anything special with regards to replacing signed binaries with unsigned ones, but if so you could just put the binary elsewhere and replace the shortcuts. With regard to the ad-ware like toolbars, is that really reason…

> My windows box will still happily run unsigned binaries, so I don't see how code-signing would help it there. Unless you were not referring to regular windows/linux as modern

Close: it's not the OS flavor so much as the security configuration. All of the major operating systems can be configured to restrict execution – whether that's mandatory code-signing, only running code from white-listed restricted directories, etc. this can be used by a security-aware admin to prevent whole classes of attacks or escalation for successful attacks.

That's the default on OS X but can also be enabled if you're willing to break with tradition on most other operating systems. That certainly has a compatibility cost but much of that cost is born by users who don't benefit from it.

> With regard to the ad-ware like toolbars, is that really reason enough to lock everyone into a walled garden?

First, the nakedesecurity writer used a click-bait headline to troll for clicks but that hinges on a redefinition for the accepted meaning of “walled garden”. It's highly misleading since Mozilla isn't charging for signatures or deciding which companies are allowed to publish add-ons.

Second, millions of people are affected by dishonest software. I'm not terribly enthusiastic about needing to sign things now but I'm not cavalier enough to dismiss the argument that a minor inconvenience for a few developers is worth more than improving the average user’s experience. Any time I look at my front-end JavaScript logs, I'm reminded of just how many people are browsing the web with untrustworthy code injected into every page.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#85

Post by nailer »

scottjad wrote: post #76
nailer wrote: post #58

Earlier quoted context omitted.

> one who just wants to make an extension and share it among a small group. That's a fair point, but I don't think it's that bad. I do this all the time with Chrome, which already has walled garden: "Hey guys, I made a Chrome Extension that inlines all the images in our shitty issue tracking app rather than having to download them all. Extract the zip, visit chrome://extensions, enable developer mode, and load that f…

Except in this new scenario it's install a different version of Firefox (Firefox Developer). Good luck with that on many work machines. My dad is unable to install any applications on his work machine but he was able to install Adblock for Chrome the other day. So had he wanted to install this hypothetical extension for Firefox he would have been unable to.

Does your Dad want to run unsigned Firefox extensions?

For a Jira-fixer extension, we'd be running FF Developer, but yes, if I did want to distribute it wider, then signing would be reasonable.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#86

Post by daw___ »

hobarrera wrote: post #55
daw___ wrote: post #46

From the announcement: For developers hosting their add-ons on AMO, this means that they will have to either test on Developer Edition, Nightly, or one of the unbranded builds. Does this mean that developers won't be able to test the add-ons on official stable binaries end users will consume their add-ons on? Good luck with that.

I find this unbelieveable too. Developers being unable to test the addons in the same browser that end-users use is stupid. That aside, I honestly can't see the value of the developer edition at all.

Me neither. Maintaining a set of features that will be unused by most users is definitely more convenient than maintaining a whole separate build that will be used by a small subset of users.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#87

Post by sonnyp »

tokenizerrr wrote: post #28
sonnyp wrote: post #25

Earlier quoted context omitted.

true but if Malware.exe ships with an addon, it could tweak Firefox user profile to allow the addon install

It could also patch firefox.exe to allow it. Or, just run in the background in its own process because malware.exe is already running. Once you have malicious binaries running on the user's computer all bets are off.

Not if it is signed or doesn't have write permissions.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#88

Post by sonnyp »

barrkel wrote: post #29
sonnyp wrote: post #25

Earlier quoted context omitted.

true but if Malware.exe ships with an addon, it could tweak Firefox user profile to allow the addon install

Malware.exe doesn't need Firefox to do its dirty work.

No but it degrades Firefox user experience and that's bad for Mozilla.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#89

Post by peri »

tzs wrote: post #17
peri wrote: post #10

Earlier quoted context omitted.

Sorry for the rude question here, but is this speculation on your part or based on stuff said by folks at Mozilla (the corp, not just contributors/clients)? Some clearer sources would be helpful this early in the morning.

From the Mozilla add-ons blog, which is linked to in the article: Extensions that change the homepage and search settings without user consent have become very common, just like extensions that inject advertisements into Web pages or even inject malicious scripts into social media sites. To combat this, we created a set of add-on guidelines all add-on makers must follow, and we have been enforcing them via blocklisti…

Thanks, was in a hurry to catch my train.

Re: Firefox to get a “walled garden” for extensions, Mozilla to be sole arbiter

#90

Post by mcovey »

I'm not sure how this will bode for my own extension, which I maintain for my own private use to do whatever comes to mind, like redirecting certain pages, applying userscripts and css files, and some other customization. Also I wouldn't have tried out all the spiffy new ES6 features that Firefox supports except that I can freely use them because it can only run in Firefox anyway.

One thing I did realize in learning how to make these extensions is that, unlike with Chrome, Firefox extensions can do anything any other executable file on your computer can do, or at least, they can move, delete, edit, and rename any file anywhere on the hard drive, spawn any process, download anything and save it, so effectively all a malware author has to do is make the extension's install hook download their payload and execute it. It's a one liner to wipe out your $HOME (I have no idea if it will work I'm not going to try it!):

    require("sdk/system/child_process").spawn("/bin/rm", ["-rf", "~/*"])
I'm expecting/hopeful that there will be some kind of about:config flag to disable enforcing signed packages, it just seems typical of Mozilla to include such a feature for power users.
Post reply on HN