Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 42 will not allow unsigned extensions

wiki.mozilla.org

Post reply on HN
Print view View original

91–100 of 315 posts

Re: Firefox 42 will not allow unsigned extensions

#91

Post by wsha »

tenfingers wrote: post #84
brighteyes wrote: post #8

Earlier quoted context omitted.

Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.

But it doesn't ! As long as downloading anything is allowed, signing requirements on extensions will not prevent anything. And by experience supporting users, this is not how bad extensions get installed on the system: they're pulled in by malware which gets installed by other means. This is only going to irate legitimate extension developers, which already have to wait weeks for AMO to review even the most basic cha…

But ths change will prevent bad extensions pulled in by malware installed by other means.... On systems that require application signing, that should do some good (otherwise I'd expect malware to just switch from sideloading extensions to sideloading a modified version of Firefox).

Re: Firefox 42 will not allow unsigned extensions

#92

Post by wsha »

legulere wrote: post #39

I wonder how long it will take until adware producers patch out the requirement for signed extensions in the binary when you install stuff from them on your computer.

That route is getting harder with application signing becoming more prevalent on Windows and OS X.

Re: Firefox 42 will not allow unsigned extensions

#94

Post by antsar »

aembleton wrote: post #59
kragen wrote: post #30

This is deeply disappointing. Two details: the extensions need to be signed by Mozilla , and only US English speakers will be allowed to disable this requirement. The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software etho…

Perhaps we need to fork it. Call it Firedog

Or Iceweasel.

https://wiki.debian.org/Iceweasel

Re: Firefox 42 will not allow unsigned extensions

#95

Post by toyg »

andybak wrote: post #56
mahouse wrote: post #51

Earlier quoted context omitted.

I can't think of many OSS projects that aren't being manipulated by a strong community of liberals.

Is that the US definition of 'liberal'? i.e. the one that would apply to most center-right parties in the rest of the world?

A U.S. "liberal" is very socially-progressive (pro-gay marriage, pro-choice, pro-environment, anti-racist, mostly pro-regulation and anti-corporate). I think that's the sort of people the parent poster intended to describe. In Europe "liberals" are usually pro-business and socially-conservative.

(Btw, I wouldn't say a U.S. liberal will automatically sit on the right of the European discourse, today. Traditional socialism has virtually disappeared as a political choice in Europe as well, so really there is very little disagreement today between a U.S. liberal and a European with mainstream social-democratic sensibilities -- except maybe on foreign policy.)

Re: Firefox 42 will not allow unsigned extensions

#96

Post by chriswarbo »

jsingleton wrote: post #74
nathanb wrote: post #11

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…

I don't use many extensions but I'm finding I have to use more as Mozilla remove features from Firefox. For example you can no longer set the User Agent string on a per site basis natively in Firefox preferences [0]. This would be very handy to force HTML5 video on BBC News when you don't want to install flash [1]. I only discovered this setting was deprecated by finding that bug report whilst researching the blog po…

> I don't use many extensions but I'm finding I have to use more as Mozilla remove features from Firefox.

To me, that's the way Firefox should work: a fast, lightweight browser, with a powerful extension system.

I get disappointed when Mozilla add "features" to Firefox, like PDF viewers, Pocket, etc.

Re: Firefox 42 will not allow unsigned extensions

#97

Post by gerv »

cpeterso wrote: post #50
nathanb wrote: post #11

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never cat…

> If I want to be able to continue this process, I will need to sign the extension myself This seems like a good approach to me. Instead of Mozilla itself signing developers' extensions, why can't Mozilla issue certificates so developers can sign their own extensions locally? If a developer turns rogue, Mozilla can revoke their certificate.

Because bad guys can just keep getting new certs when their old ones are revoked, unless you do identity validation (which costs money as it requires actual humans, so the certs can't be cheap or free).

Re: Firefox 42 will not allow unsigned extensions

#99

Post by Kankuro »

kragen wrote: post #30

This is deeply disappointing. Two details: the extensions need to be signed by Mozilla , and only US English speakers will be allowed to disable this requirement. The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software etho…

> only US English speakers will be allowed to disable this requirement You can install any non-English locale (language-pack) on top of Firefox. I do that (because I want to be able to switch from a language to another). So it is a two-steps installation.

Re: Firefox 42 will not allow unsigned extensions

#100

Post by Communitivity »

Epic fail. Mozilla should be making the browser subsystems more secure, not saying 'Trust us, we'll ensure your add-ons are secure'.

Will the add-ons source code be reviewed by a CISSP skilled in the languages used within the add-on? Will the add-on be tested with the top 1000 add-on combinations out there? If the add-on provides an API, will it be tested using fuzzing? The list of these questions, and the others to which your answer is likely 'no', goes on. If you are not doing these things then you are providing a false sense of security. You may catch the bottom 60-80% of malware and unstable add-ons, but the most dangerous 20% will likely slip through, in my opinion.

This does not make sense from a UX perspective, as MANY others here have pointed out, so I won't go into that further. I will point out that it doesn't make sense from a business perspective either. If you are saying your add-on signing program improves security, and you let an add-on through that has malware, then you might be sued (I am not a lawyer, this does not constitute legal advice, etc.).

So to recap and summarize, with brevity, and with accuracy...

EPIC FAIL

Post reply on HN