20 ms·

Firefox 42 will not allow unsigned extensions

288 points by fernandotakai 11y ago

GeorgeOrr 11y ago
It's important to note that the Developers Editions (and the Nightlys) will have a setting for disabling the requirement. The assumption being that developers need to test as they develop. And are a more informed user.
- duncan_bayne 11y ago
  The other assumption being that there is a distinction between 'developers' and 'users'.
- ethana 11y ago
  Did they say why beta wouldn't have this setting? If anything beta is closer to release and developer would target that. Developer edition is still nightly if I'm not correct?
  - GeorgeOrr 11y ago
    I don't see anything about why the beta, but I did see the following in the FAQ. Maybe this will help: "There will also be special unbranded versions of Release and Beta that will have this setting, so that add-on developers can work on their add-ons without having to sign every build."
  - wsha 11y ago
    I think they want to encourage wider adoption of the Beta version, so they treat it similarly to the Release. The logic seems pretty questionable to me though. If you can install a Beta version of Firefox, you should be able to avoid consenting to allow malware to run on your computer (this change is primarily targeted at extensions installed by some user action -- like something silently side-loaded by an application installer).
  - mccr8 11y ago
    Generally, beta is supposed to be almost completely identical to the release version, to ensure that what gets shipped to release users is tested. This particular pref seems harmless, but you never know. Developer edition is what used to be known as "Aurora", which is in between Beta and Nightly.
- azakai 11y ago
  The link also says that there will be builds of normal (release) and beta Firefox that do not have this limitation, for those that want them. (In addition to people always being able to recompile the browser with whatever modifications they want, of course.)
  - rndgermandude 11y ago
    I was only commenting on the "trival build or not" part. You're right that there are plans to have official "unofficial" release and beta builds without signing requirements, but only for the en-US locale (yes, language packs exist, no, not every developer on Earth speaks English)
- ubernostrum 11y ago
  I had to flip that setting this morning when dev edition updated and disabled the 1Password extension. It's "xpinstall.signatures.required", for reference.
- voltagex_ 11y ago
  They've said that for a while, but the last time I had the Dev edition installed I couldn't install the Dashlane [1] plugin. 1: https://www.dashlane.com/en/cs/3bce5a89 https://www.dashlane.com/en/cs/3bce5a89
- wtbob 11y ago
  Every user should be permitted to disable that requirement: it's his browser, not Mozilla's.
mveety 11y ago
What is the point of this? Shouldn't users be allowed to make their own decisions no matter how stupid or dangerous?
- brighteyes 11y ago
  Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.
  - mveety 11y ago
    Why don't we teach people the don't understand so they can make informed choices instead of preventing it entirely?
    - brighteyes 11y ago
      We should teach people, yes! At the same time, educating hundreds of millions of people takes time.
    - smtddr 11y ago
      There are a lot of things I wish the general public would try to get educated about so they can make informed choices. 1) Nutrition 2) Politics(especially taxes & wars) 3) Computers 4) Finances If you can figure out how get people properly educated on even 2 of those things, the world would be a very different place.
    - x0x0 11y ago
      Because that's been such an unqualified success for the last 30 years we've tried it.
      - userbinator 11y ago
        30 years is not long enough. Literacy took much longer, but the benefits are clear today.
mercurial 11y ago
An important point is that the review process before signing takes seconds, according to the article. Considering the frequency of FF updates, it's an important point. Now, let's just hope that the other side of the coin is a concern for API backward compatibility, so that people don't need nightly versions of addons and a developer edition to keep their addons in a usable state...
nathanb 11y ago
It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never catches the breakage. But that's a side rant.... There can be a decent turnaround lag (sometimes on the order of a few days) to get a new version of an extension reviewed by addons.mozilla.org. In the meantime, I have made a habit of building a new version of the extension and giving it to anyone who asks. Some people rely on it to use the web and can't wait for Mozilla to do their thing (another side rant: I once stupidly forgot to check in a key resource. I've since changed my development process to keep this from happening again. But the non-functional extension that I pushed passed Mozilla's review just fine. Makes me wonder how much value the review process is really adding.) If I want to be able to continue this process, I will need to sign the extension myself (and who knows what histrionics Firefox will throw if a user tries to replace an extension with one that has the same UUID but a different signature!)
- brighteyes 11y ago
  > There can be a decent turnaround lag (sometimes on the order of a few days) Actually, the link says > Files submitted for signing will go through an automated review process. If they pass this review, they are automatically signed and sent back to the developer. This process should normally take seconds You may be thinking of a different type of review process, the signing one sounds almost instantaneous.
  - tomjen3 11y ago
    If it passes. Nobody knows what it checks for or how it works.
    - icebraining 11y ago
      https://github.com/mozilla/amo-validator https://github.com/mozilla/amo-validator
mukundmr 11y ago
What happens to all of those extensions that are on they gray area of DMCA? Who is this move benefiting? The users or the sponsors?
- Buge 11y ago
  >>Is this a way for Mozilla to censor add-ons they don't like, enforce copyright, government demands, etc.? >No, the purpose of this is to protect users from malicious add-ons. We have clear guidelines[1] for when it is appropriate to blocklist an add-on and have refused multiple times to block for other reasons. [1] https://developer.mozilla.org/en-US/Add-ons/Add-on_guidelines https://developer.mozilla.org/en-US/Add-ons/Add-on_guideline... Copyright, DMCA, and legal concerns are not listed. So I take that to mean nothing will be rejected from signing for those reasons. Hosting on AMO has stricter rules, so they could sign the extension for you to host, but refuse to host it themselves.
  - michaelt 11y ago
    Today, Mozilla doesn't get demands to take down extensions because sending demands would be pointless. If EvilCorp tried to force Mozilla to take down uBlock and friends from addons.mozilla.org they would just get hosted elsewhere and EvilCorp would look like assholes. It's all downside, no upside, so EvilCorp don't even bother to ask. If tomorrow Mozilla can shut down any extension, the calculus changes. Forcing Mozilla to kill ad blockers still makes EvilCorp look like assholes, but it might be successful. There's a big upside now, so much more reason to try and force Mozilla's hand.
    - protomyth 11y ago
      I do wonder if some lawyer will argue that a take down notice for an extension should include revocation of its signing?
scintill76 11y ago
Ah, feels like they're following Chrome's example, which decreed that it should be exceedingly difficult for Windows Chrome users to install extensions from somewhere other than https://chrome.google.com/webstore/ https://chrome.google.com/webstore/ . This basically killed an internal app we had at work (a fork of a "REST client", with some added request-signing features specific to our internal APIs.) There was no strong reason to keep it secret, but there had previously been no need to put it in the store either, and there was a $5 charge to publish in the Web Store, which I didn't feel like dealing with. Anyway, they are both measures taken to stop malware, by taking an option away from the user, that most users won't even notice, but many "power users" will be inconvenienced to varying degrees. I'm guessing Firefox's won't be as bad, since the "developer version" that will let you keep doing the old way probably won't differ from the normal version as much as Chrome's does.
- deleted 11y ago
  [deleted]
- _yy 11y ago
  You can still install custom extensions in Chrome for Windows using - among others - group policy: https://support.google.com/chrome/a/answer/188453 https://support.google.com/chrome/a/answer/188453
- Jordrok 11y ago
  This is the exact reason why I moved to Firefox from Chrome back when Google started tightening the noose around developer mode extensions. I had written a few extensions for my own personal use and had no interest in putting them up in the Chrome Web Store. This was fine and good until Google decided it was A Bad Thing and Chrome started popping up annoying warning windows on every startup and then eventually disabled my extensions entirely. I switched to Firefox since it let me have more control over my own browsing experience (and gave me a good excuse to extract myself just a little bit from the Google hivemind). I'm extremely annoyed to see that Firefox is now going down this route too.
mindcrime 11y ago
Well, at least they're paying lip-service to enterprise users who may have internal extensions to deal with: What about private add-ons used in enterprise environments? We haven't announced our plan for this case yet. Stay tuned. In the interim, ESR will not support signing at least until version 45, which won't come out until 2016.
- b101010 11y ago
  I have seen several suggestions along the following lines as far back as the original blog post which announced the intention to require extension signing Allow an extension signing certificate to be place in a directory/store which requires elevated privileges to modify (ie /etc/ or similar). Extensions in the user's profile signed by this certificate will load as if they were signed with the Mozilla certificate. If the user has enough privileges to add an extension signing certificate then they also most likely have the ability to modify the Firefox itself, I think this addresses any concerns that this method could be used to load malicious extensions (if the user is willing to run unknown executables with elevated privileges then extensions with apparently valid signatures are the least of their worries). This allows enterprises to sign and distribute their own extensions, with the additional step of creating and distributing the signing certificate, and could work also work for home users.
ekianjo 11y ago
It should still possible to fork Firefox and remove this requirement, right ?
- kragen 11y ago
  In theory, but that will be very difficult.
  - ekianjo 11y ago
    How about Pale Moon ?
  - Dylan16807 11y ago
    Difficult how? Even though Mozilla is going to providing builds of just such a fork themselves? Is it particularly hard to build firefox?
  - rockdoe 11y ago
    It's trivial.
- situmorang2015 11y ago
  ofc, you can since firefox is opensource
- a3_nm 11y ago
  It's not really a full fork, but I'm fairly confident that Iceweasel, the patched and no-branding Firefox that ships with Debian, will not have this problem. (So as I Debian user I don't really care, but it worries me slightly for the future of Mozilla.)
- wsha 11y ago
  Mozilla has said that this requirement is set by one flag at build time, so building a version without this requirement should not be any more difficult than just compiling Firefox I have never done that, but I think it's slightly non-trivial. The hardest part though would be distributing the fork though, so a Linux distribution like Debian mentioned this change as others have mentioned would be one way to build a popular fork without this requirement.
kragen 11y ago
This is deeply disappointing. Two details: the extensions need to be signed by Mozilla, and only US English speakers will be allowed to disable this requirement. The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software ethos that made Firefox possible in the first place. I understand the issue of users being tricked into downloading and installing malicious extensions. If you let someone program, they will be able to paste malicious code. I just don’t think that taking away users’ ability to modify their own browsers is an acceptable solution to that. If this disturbing move sticks, Mozilla will become an increasingly tempting target for whatever group wants to control what software you can install on your own computer — whether that’s Sony Pictures, the NSA, or Amazon. The old free software movement has died. We need a new free software movement.
- dtech 11y ago
  > only US English speakers will be allowed to disable this requirement Do they assume that non-English speakers are just drooling baboons who cannot decide this for themselves unlike English speakers?...
  - kragen 11y ago
    Perhaps they assume that to program enough to write an extension, you need to learn English. I’ve met people here in Argentina who say that. My view is that, even if that is the status quo ante (and I’m not sure it really is) it’s a status quo we must disrupt, not ossify.
    - kome 11y ago
      Wise words, kragen. With the excuse "you need english because" a new form of imperialism is on the making. And what is worse, is that this attitude is often self-imposed.
      - chronial 11y ago
hamza001 11y ago
http://googler700.blogspot.com/ http://googler700.blogspot.com/
tyho 11y ago
How does this policy interact with greasemonkey, an extension that allows running random JavaScript on sites with access to the extension API. You could write your malware as a greasemonkey extension, convince a user to install a signed greasemonkey release, and then convince them to install your malicious extension.
- paulryanrogers 11y ago
  Great point. Does anyone know what--if any--limits Grease Monkey puts in place to prevent users from bring exploited?
legulere 11y ago
I wonder how long it will take until adware producers patch out the requirement for signed extensions in the binary when you install stuff from them on your computer.
- wsha 11y ago
  That route is getting harder with application signing becoming more prevalent on Windows and OS X.
alfapla 11y ago
It's little more than a year ago that Brendan Eich was ousted from Mozilla by an ugly orchestrated cabal. When I read Mitchell Baker's vapid blog post [1] on the decision, filled with polite backstabbing and politically correct buzzwordery I understood that Mozilla has been taken over by politicians and that its decline is just a matter of time. [1] https://blog.mozilla.org/blog/2014/04/03/brendan-eich-steps-down-as-mozilla-ceo/ https://blog.mozilla.org/blog/2014/04/03/brendan-eich-steps-...
- mahouse 11y ago
  I can't think of many OSS projects that aren't being manipulated by a strong community of liberals.
  - andybak 11y ago
    Is that the US definition of 'liberal'? i.e. the one that would apply to most center-right parties in the rest of the world?
    - toyg 11y ago
      A U.S. "liberal" is very socially-progressive (pro-gay marriage, pro-choice, pro-environment, anti-racist, mostly pro-regulation and anti-corporate). I think that's the sort of people the parent poster intended to describe. In Europe "liberals" are usually pro-business and socially-conservative. (Btw, I wouldn't say a U.S. liberal will automatically sit on the right of the European discourse, today. Traditional socialism has virtually disappeared as a political choice in Europe as well, so really there is very little disagreement today between a U.S. liberal and a European with mainstream social-democratic sensibilities -- except maybe on foreign policy.)
    - LeoNatan25 11y ago
      "Liberals" in the US - democrats - are indeed center-right of the rest of the world. Look at Obama, Clinton, Biden. They are very center on some issues and quite right on others.
    - 11y ago
deleted 11y ago
[deleted]
sergimansilla 11y ago
I recently made an update my own Firefox extension, called Tab Grenade. It took them 4 months to review. 4 months. And that's for a (very) minor update. Because of that, I was definitely considering to start releasing it on my own, instead of through Mozilla's add-on website. It looks like I will be able to do that, but I'll have to use the signed extension process. I'll believe this system works when I see it. After my experience with add-on reviewing, I am very skeptical.
- rockdoe 11y ago
  Signing != Reviewing.
- soapdog 11y ago
  The review is mostly done by volunteers. Sorry for the delay, I feel your pain. Will check here if we can try to get more people onboard to help review stuff.
- nightpool 11y ago
  Addons get signed by an automated process that is independent from the public store review.
rak_112 11y ago
At this point I don't think I'll ever return to using firefox after the mountain of stupid shit mozilla has pulled in the last ~2 years.
- NotOscarWilde 11y ago
  I share your sentiment, but Google Chrome is better only in terms of performance [1], it fares worse in both privacy and extensibility (no ad blockers/addons on mobile Chrome). For people like me, who want: * a free software browser * android/desktop sync * adblock and other addons it is pretty much a binary choice between two evils. [1]: Possibly, of course -- but that is a debate for another time.
- tenfingers 11y ago
  The nice thing is that they're doing for "security", although they're absolutely fine pulling insane amounts of crap into their browser to improve the "web experience" and incidentally increasing the attack surface [which is how you get most of the malware actually].
systemz 11y ago
Mozilla is doing everything to stop using their browser.
- glass- 11y ago
  And instead people are going to use what?
  - bigbugbag 11y ago
    not sure yet, but as soon as there's something I'm making the switch. Too many extensions are required to try to make firefox into something usable, mainly reverting changes or fiwing broken or missing features: ad blocking, sidebar, download manager, bringing back the add on bar, putting back the ability to disable javascript, session manager, cookie manager ability to take screenshot, mouse gestures, tab manager, …
RexRollman 11y ago
And slowly, freedom everywhere was destroyed in the name of security.
- waspleg 11y ago
  ^ This.
- coldpie 11y ago
  Firefox is open source. Disabling the signature check will probably be a one-line change. Yes, it's a much larger barrier to entry (building Firefox is not trivial), but it's not like IE or Chrome where you have no choice in the matter at all.
  - rockdoe 11y ago
    building Firefox is not trivial ./mach bootstrap ./mach build
    - rndgermandude 11y ago
      Yeah? You at the very least forgot to obtain the source code first somehow. What about build-dependencies, because ./mach bootstrap does not fully handle that? Now please tell me how to do a Windows release-build with all release features enabled (except for official branding), aka. a ton of configure switches, and also please do it for my language using the official de locale, because neither the source tar.bz2 nor the hg you'd normally clone contains that. I'm starting from scratch of course. And suddenly it is less easy and trivial..
      - azakai 11y ago
        As the link mentions, you don't need to build from source. Binary builds are provided that do not have this restriction, for those that want that.
rjempson 11y ago
Here is an idea, sometimes it is a good idea to look inwards rather than outwards.
tenfingers 11y ago
So much for beta-testing your extension prior to release. It's already hard to get users involved, now they just can't. Or using any other channel to get your extension. !Thanks Mozilla, really.
- wsha 11y ago
  If your extension has been fully reviewed by AMO, you can upload beta versions that only have to pass the automated signing review to be posted to AMO.
  - tenfingers 11y ago
    Please don't assume all extensions have a reason to be on AMO. There are plenty of extensions which are developed in-house for in-house use only. Also, as a developer, I never cared to run the "nighties": I don't want an unstable browser, and I don't want fancy new features. I always ran the stock version, also to ensure compatibility with the user base, and never needed anything else. Maybe Mozilla should also remove the developer tools from the stock version, because clearly it's too dangerous in the hand of people that could cut&paste code with full privileges into it, and it's only a keystroke away! This is a giant slap in the face, frankly. I don't see a difference between a walled garden such as google play and this.
    - tired_man 11y ago
      I gave Mozilla money back in the day when they asked for donations in the beginning to be on that full-page NY Times ad. I wonder if I can have a refund? I'm very disappointed in how Firefox has aged.
jsingleton 11y ago
I wonder if this will mean that all the extension version numbers will stop ending in -signed. I'm used to having any build number with -label in its name denote it's a pre-release and isn't stable [0]. I was recently searching for user agent switcher add-ons as part of a blog post [1] and almost all have -signed in the name. To some people it could look like the un-signed ones are more stable and better. [0] http://semver.org http://semver.org [1] https://unop.uk/dev/how-to-watch-bbc-news-videos-on-a-desktop-without-flash-in-firefox https://unop.uk/dev/how-to-watch-bbc-news-videos-on-a-deskto...
- wsha 11y ago
  The -signed label was a one time effect to update existing extensions to signed versions (since AMO didn't want to arbitrarily bump the version numbers of all its hosted extensions). Future updates do not have this label.
ck2 11y ago
Between that and e10s being on by default, FF42 is going to go over like a lead balloon. I hope 41 is an ESR update, nope: only 38 and 45 are ESR https://mozorg.cdn.mozilla.net/media/img/firefox/organizations/release-overview-high-res.7f1fea43e9e2.png https://mozorg.cdn.mozilla.net/media/img/firefox/organizatio...
- shdon 11y ago
  What would be the problem with e10s? Sure, it's a big change, but it seems quite desirable imho.
  - TheLoneWolfling 11y ago
    2-3x the memory use and lower performance due to the additional overhead of talking between processes. There are advantages, but it is not without its disadvantages.
    - shdon 11y ago
      https://wiki.mozilla.org/Electrolysis/Firefox https://wiki.mozilla.org/Electrolysis/Firefox "Goals There are number of things we believe the e10s project will give us: ... 2. Improved performance, especially on multi-core machines. 3. Better memory core stats." That seems to directly contradict your concerns. However, these are stated goals and may not align with practical reality. I'd be surprised if, when these are numbers 2 and 3 on their list of priorities, the reality would be so very different.
      - TheLoneWolfling 11y ago
        See https://news.ycombinator.com/item?id=9558745 https://news.ycombinator.com/item?id=9558745 (and actually the rest of that submission also) Now, mind you, that was nearly 3 months ago. But the concerns there are still very relevant.
        shdon 11y ago
Taylor_OD 11y ago
Isnt chrome already like this? I spent 45 minutes trying to find a way to install a non extension store extension this weekend and gave up after being blocked repeatedly.
- mythealias 11y ago
  I don't think what chrome does is relevant in this discussion at least not in the context of defining what is the the correct way for mozilla to go forward.
  - MiddleEndian 11y ago
    Unfortunately it's relevant in the discussion of what Mozilla can get away with.
- HappyTypist 11y ago
  It's actually incredibly simple, just rename the .crx to a .zip and load it as an unpacked extension. https://developer.chrome.com/extensions/getstarted#unpacked https://developer.chrome.com/extensions/getstarted#unpacked
Communitivity 11y ago
Epic fail. Mozilla should be making the browser subsystems more secure, not saying 'Trust us, we'll ensure your add-ons are secure'. Will the add-ons source code be reviewed by a CISSP skilled in the languages used within the add-on? Will the add-on be tested with the top 1000 add-on combinations out there? If the add-on provides an API, will it be tested using fuzzing? The list of these questions, and the others to which your answer is likely 'no', goes on. If you are not doing these things then you are providing a false sense of security. You may catch the bottom 60-80% of malware and unstable add-ons, but the most dangerous 20% will likely slip through, in my opinion. This does not make sense from a UX perspective, as MANY others here have pointed out, so I won't go into that further. I will point out that it doesn't make sense from a business perspective either. If you are saying your add-on signing program improves security, and you let an add-on through that has malware, then you might be sued (I am not a lawyer, this does not constitute legal advice, etc.). So to recap and summarize, with brevity, and with accuracy... EPIC FAIL
- TazeTSchnitzel 11y ago
  The law allows people to make mistakes. You clearly have no idea what you are talking about.
  - Communitivity 11y ago
    Heh. Sure :) You're right about law, I know little - I am not a lawyer. I suspect there will be someone who blames their corporate data breach on Mozilla's policy, if they can make even the flimsiest case. Mozilla might win, at the cost of money, time, and bad PR. I suspect it more likely that they'd settle out of court. I'd love to hear a lawyer weigh in. I also love how I posted on here (I seldom do) about an issue I felt passionately about, in an area that I do know a bit about, and you responded with a personal attack. Ask yourself this, what is it you hate so much about the world, yourself, me, or my post that compelled you to personally attack a complete stranger who was donating time and thought to the discussion? Did it make you feel better? Stronger? Isn't that the very behavior you've campaigned against, elsewhere on the web?
- TazeTSchnitzel 11y ago
Sir_Cmpwn 11y ago
I use several small add-ons I wrote myself. Why should I have to get Mozilla's approval before I can install my own damn add-ons? One of them executes processes and I'm 99% sure it'll fail the automated review. EDIT: It passed the automated review, but my point stands. If I wrote the code, then you can be damn sure I trust it.
- atopal 11y ago
  > I use several small add-ons I wrote myself. Why should I have to get Mozilla's approval before I can install my own damn add-ons? Mozilla has to balance the needs of several hundred million users, who are being attacked by malware every day, with the needs of people who write their own add-ons. Is it really that difficult to see it from that perspective? And it's not like you have no options now. You can either use the developer edition or the special release version where this feature is disabled.
  - Sir_Cmpwn 11y ago
    They've always catered to the hacker perspective, too. Why take out the about:config flag? How about letting me trust my own certificate, instead of just AMO's? What about running AMO alternatives?
    - atopal 11y ago
      Did you not read the blog post? You can use the dev edition or the special release and beta version that don't have this limitation. Nobody is forcing you to live with this limitation. If this was done as an about:config flag it could easily be changed by an add-on too.
      - Sir_Cmpwn 11y ago
        I did read the blog post. It says I have to use a less stable (beta) or less customizable (dev edition) version of Firefox to avoid this burden.
SCHiM 11y ago
I like the fact that a security issue is being tackled. What I absolutely hate is the fact that there are no ways to turn this option off. Just like HSTS I can't turn this off and it leaves a bad taste in my mouth. Were originally I considered firebox to be a browser for power users, now I'm not too sure any more.
- acdha 11y ago
  I'm mixed on the general issue – an option to turn it off is an option which is certain to be used to social engineer millions of people – but this is somewhat different from HSTS: HSTS allows a site owner to set a security policy for access their own servers. There's no downside to using it, it doesn't affect anyone else, and in any case if you choose to use a service you're subject to their security policies. The fundamental choice is unaffected: use their service or go somewhere else. In contrast, this is more controversial because it involves telling the user that they cannot do something they want to do. I think there's a strong argument that this is a pragmatic choice in the current security environment but it really does undercut user choice unless you reach the point of saying that the users who want to do this should know how to compile Mozilla.
  - SCHiM 11y ago
    I really, really disagree. If your data is on my computer I should have a say in what happens to it. If I want to tunnel your hsts connection through a proxy I should be able to do so. You can't imagine how frustrated I was when I found out that I couldn't use my proxy any more, because some guy somewhere decided that it'd bee too hard to hard to add the following lines to firefox: if (user_doesn't_want_hsts) { dont_do_hsts(); } I can't even bend my head around how someone thought it was acceptable to totally take this option away from people. I understand that such an option should be hidden deep inside a config somewhere so as to prevent a normal user from compromising his/her own security. But please don't presume that you did everyone a service by taking this option away. I can't express how angry and frustrated I become when I even think about it. As for your 'no downside', as I said, perhaps not for normal users. But I most definitively am not. And I probably need to jump though a lot of hoops to tear this "feature" out of my own firefox build.
userbinator 11y ago
Mozilla's hypocrisy is astounding: https://blog.mozilla.org/security/2013/01/29/putting-users-in-control-of-plugins/ https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." https://blog.mozilla.org/theden/2014/12/15/introducing-a-smarter-way-to-search-with-firefox/ https://blog.mozilla.org/theden/2014/12/15/introducing-a-sma... "Firefox is dedicated to putting users in control of their online experience" More recently: https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in-control-of-your-online-life/ https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in... "Firefox Puts You in Control of Your Online Life". The slogan, as found on https://www.mozilla.org/en-US/firefox/new/ https://www.mozilla.org/en-US/firefox/new/ , is now "Firefox is created by a global non-profit dedicated to putting individuals in control online." I believe it used to be "users" - see above - but was silently changed. I suppose these "individuals" are the people at Mozilla...?
- TazeTSchnitzel 11y ago
  Users still have control. You can remove plugins you don't like, and if you really want to, use a version of a plugin which allows unsigned extensions. Arguably this change might give users more control: Trojan horses can no longer secretly side load malware.
  - userbinator 11y ago
    Users still have control. You can remove plugins you don't like, and if you really want to, use a version of a plugin which allows unsigned extensions. You could argue that as long as users can still download a disk editor and change any byte of the disk on their machine they still have control (in fact patching out this signature check could probably be done with a single-byte change to the binary...); the problem is when this control is made more and more difficult.
- SkatAndRap 11y ago
  Firefox users see through this feel-good marketing nonsense from Mozilla. They've seen Firefox's UI change for the worse in so many ways, even in the face of wide opposition. They've seen unwanted bloat, like Hello and Pocket, forced upon them, again in the face of wide opposition. They've seen their requests for bug fixes and performance improvements go unheeded, sometimes for years. The easy use of extensions has been the only thing keeping many of these people using Firefox. They've been using many extensions to undo, as much as is possible, the unwanted changes that Mozilla has made. I use Firefox Nightly, and was recently surprised when, after an update, some custom extensions I had written myself were not loading, and could not be easily enabled. When I found out it was due to this, and I had to start adjusting about:config settings, it was nearly the last straw for me. I don't want to use another browser, but it's like Mozilla is doing everything in its power to make using Firefox a bad experience for me. I know I'm not alone. We've already seen Firefox' share of the browser market drop from well over 30% to a level of around 10% today, if it isn't actually lower than that. It's truly sad to see what's happening to what was once such a great browser.
bpodgursky 11y ago
Ad-blockers have finally reached a point that the financiers of the major browsers are setting the groundwork for tightening the screws on them. Not right now, but in a couple years when earnings start trending down. Google and Yahoo -- driven by ads -- fund Chrome and Firefox, over half the browser market. Nobody innately wants to be evil; these are still * mostly * engineer driven companies. But when it comes to an extensential crisis of revenue vs freedom, there is no real choice. So thanks guys. We had a good run with open browsers, but it is quickly drawing closed because you just couldn't stand the ANNOYANCE of seeing ads next to your content. It's been fun, and now back to the darkness we go.
- adamc 11y ago
  I don't see what would prevent folks from switching to a fork if that happened.
  - bpodgursky 11y ago
    Sure. It will be a fork that falls behind master without funding or support. Get enough momentum and push it far enough and Chromium and Firefox will stop being OSS altogether.
    - acdha 11y ago
      This is indistinguishable from the conspiracy theories people used to circulate about a magic carburetor design which got 85MPG and was killed by Detroit automakers for unknown reasons. Just look at the chain of unsupported assertions which have to all come true for this to make any sense: Mozilla will prevent you from installing ad-blockers, and that this will bother enough users to matter but somehow that won't lead to enough volunteered developer time to maintain even an almost unmodified “fork” which changes only a build flag (or a signing key)? Or that somehow if that proved popular enough to attract a large number of users they'd react not by reconsidering such policies but instead push everyone over to Edge/WebKit? Microsoft and Apple are not primarily advertising companies and at least Apple is marketing actively on the idea of respecting your privacy – it's hard to imagine anyone working at a browser vendor not realizing that such a move is simply going to push users to switch.
mashed_potato 11y ago
As if it wasn't already difficult enough explaining to people why I use Firefox...
rquirk 11y ago
Will this also affect Firefox for Android? Mozilla currently don't provide a dev build for Android, just regular and beta versions https://play.google.com/store/apps/developer?id=Mozilla https://play.google.com/store/apps/developer?id=Mozilla The security problem that this "fixes" is not really an issue on Android due to Android's own app sandboxing, so maybe the Android build will allow unsigned extensions? It's not mentioned in the FAQ.
- rockdoe 11y ago
  Mozilla provides Aurora and Nightly for Android. They're just not on the Play Store, but you can download them from their website. https://nightly.mozilla.org/ https://nightly.mozilla.org/ not really an issue on Android due to Android's own app sandboxing A malicious add-on could still steal all your passwords.
  - zeveb 11y ago
    > A malicious add-on could still steal all your passwords. Of course, so can Mozilla, because Firefox Accounts are no longer secure (the login page downloads JavaScript assets from Mozilla, and could be used to snarf a particular user's password in a targeted attack, leaving no traces observable by other users).
- discreditable 11y ago
  > Mozilla currently don't provide a dev build for Android, just regular and beta versions Nightly versions of Firefox are available from https://nightly.mozilla.org/ https://nightly.mozilla.org/.
dieg0 11y ago
readability extension i miss you so much
wtbob 11y ago
You know, there was something beautiful about users being able to pick up a tutorial and extend their browsers, if they wanted. There was something very empowering about being able to write extensions even in a corporate environment. I've written Firefox extensions for personal and business use, and Mozilla are preventing that from every happening again. Why? Cui bono? I'll mention, again, that they completely broke the security of Firefox Sync: it's no longer a trustworthy place to store passwords. Why? Cui bono?
- stinkytaco 11y ago
  Didn't Chrome take this same approach? I suspect that if multiple major browser vendors are pursuing it, it's probably to address some issue. It's not like Mozilla just thought, "let's limit people more, that will make them happy." This doesn't make it the right approach, but it does make it understandable. So I suspect it's to the benefit of the "average user" if that's what you are asking. I'm going to step outside of HN for a minute and say that in my work I work with people who rely on the Internet, but have no concept, and I mean none, how it works. They do not understand that when they create a Yahoo email account that no one can help them when they forget their password. They do not understand that if you type "yaho com" that you are not going to get anywhere (until auto search came along, that is). I've come to realize that Internet safety is not a simple set of rules, it's a complex understanding of the whole ecosystem that can't be readily taught in the time I have with these users (and never taught to some). I can't explain why I click on links in some emails and not others, so I just say "don't click on links". I can't explain why you shouldn't use the same password everywhere to someone who needs to reset their password literally every time they log on, so I just tell them to use the one their friend or child has written down for them. It's terrible, but I get it when vendors draw a line in the sand and say "this is to protect those users." That said, as a user who does understand, there's an element of frustration. Hopefully they bury an override option somewhere, or maybe just add it to their ESR but I doubt I would ever use it.
norea-armozel 11y ago
Does anyone know if the maintainers of Pale Moon or Waterfox intend to keep the extension signing requirement on their builds?
- TheLoneWolfling 11y ago
  I very much doubt Pale Moon will, based on their reaction to previous restrictions and removals of features. I know that it would be hypocritical if they did. Waterfox... I don't know.
gdulli 11y ago
I hope Firefox 41 is really good because it's the last one I'll be using.
- DarkTree 11y ago
  What do you consider the better alternative? (serious question)
  - gdulli 11y ago
    Sadly, I don't know. I don't like Chrome either.
  - Nadya 11y ago
    There's Firefox forks like Waterfox, Palemoon, etc.
  - toni 11y ago
    I think at this moment it's fair to say that switching to Pale Moon is the next obvious step for power-users in need of fiddling with their browser as they please.
debacle 11y ago
Is there a good open Firefox fork that are relatively well maintained? This is getting out of control.
- TheLoneWolfling 11y ago
  Pale Moon is decent. Or would be, except for the frustrations with addon compatibility. (Suffice to say, the Australis update pushed breaking changes to add-ons, in such a way that you cannot easily support both pre-Australis and post-Australis)
pwman 11y ago
Mozilla used to be the best place in the world for extension developers -- it was natural to have your best extension on Firefox because you could release early and often. Active developers made the platform. When Chrome came along they decided to go in a different direction entirely slowly making it more and more painful to accomplish what used to be easy in the name of security. The review process went from automatic if you were trusted to weeks and then months and then more than a quarter year. They started demanding source code. It became scary to release to addons.mozilla.org because you never knew how long it would be before your next release would be approved. Mozilla needs to realize they're hastening their own demise - Chrome now offers better features than when Mozilla was the leader including releasing to a percentage of users and faster nearly invisible to the user updates. They should go back to their roots and embrace developers again.
verusfossa 11y ago
This is disappointing. Everything is becoming centralized, even Firefox extensions. I wish there was an opt out like "unknown sources" in android, but they keep saying we're not smart enough to make or own decisions. They won't even put one in about:config. This change well undoubtedly upset developers and other techy folk, exactly the kind of people you want working with your software. Fdroid is working on third party repositories, maybe that will catch on to decentralize the mobile world a bit. Something like that for browser extensions would be sweet. Take a look at Fennec Fdroid for a cleaner Firefox mobile experience at least.
- soapdog 11y ago
  In the article they say that Firefox DevEdition, Nightly and Unbranded will have a switch to turn this requirement off. Have you read the article? In the FAQ section they explain which versions of Firefox you can use if you don't want this requirement to occur.
- Someone1234 11y ago
  The point here is to stop junkware authors (who operate pretend-legally) from trivially installing extensions into Firefox. Right now, this type of software commonly injects javascript into all web-pages a user visits which do things like add adverts or redirect searches. If you allow a tick box to disable this, then how do you stop the junkware authors from simply checking that box on behalf of the user? Because that's what would happen, the user would click "next" on some random installer (which the junkware authors argue grants them expressed permission to install), and the junkware will claim they tick the unknown sources box to fix a "backwards compatibility issue." What they're trying to do is make the option to disable the check SO niche that it really isn't a valid option for the junkware authors to use anyway (since most consumers won't have it, only corp. networks which are a hard target for junkware for other reasons).
dannysu 11y ago
It's been one month and the new version of an extension I wrote is still waiting to be reviewed. I've since stopped waiting and started using the new version myself rather than download from AMO. I was already very disappointed by the review process and now this. Tweeted to Chris Beard: "Dear @cbeard, please give your users the choice and control they deserve in @firefox. Allow extension signing to be disabled in FF42." You want to protect the user, then start making extensions more secure and require permissions to do things. E.g. If an extension can access contents of webpages, pop up a dialog and ask the first time. There are other ways to protect users without going authoritarian on us.
benmccann 11y ago
This is very frustrating. Made worse by the fact that they just replaced their packaging tool with a new jpm tool that doesn't yet match the functionality of the old tool.
hobarrera 11y ago
> [...] plugins don't need to be signed. So the worst kind of threat is still there. Great job, Mozilla!
- fernandotakai 11y ago
  yup, and that's what i don't get. statistically, plugins like java and flash are a bigger security threat than addons. i don't even remember an addon going rogue.
  - hobarrera 11y ago
    I also quite clearly recall mozilla stating that plug-ins are responsible for over 95% of all browser crashes.
- MacsHeadroom 11y ago
  That's because plugins are going to need to be white-listed (modifiable via about:config). The win64 (beta) edition of Firefox only allows the Flash Player Plugin, for example.
  - nightpool 11y ago
    isn't this still vulnerable to the attack reported up-thread where whatever malware just goes and changed about:config before installing their plugin? (and the reason that the addon opt-out is being removed from ff42)
soapdog 11y ago
Folks, There are FOUR VERSIONS OF FIREFOX WITH A SWITCH TO DISABLE THIS if you're so inclined. You can use: Nightly, Dev Edition, Unbranded Stable and Unbranded Beta. All of which have a switch that you can set to disable addons signing requirement. In contrast there are only two versions where this is a requirement, Stable and Beta. If you doubt the usefulness of this you haven't seen a browser being hijacked by malware overriding search results, inserting all types of toolbars and more. This will prevent malware from sideloading extensions. And this is good. The signing process is not the same as the AMO review process. The process takes only seconds and the signed addon is returned to the developer. They can distribute as they see fit. Now, lets face the fact: Simple signing process that takes only seconds and will help prevent lots of malware, not the most nasty ones but a huge lot of sideloaded crap. Four versions of the browser for those power users who want to disable this. Now, can someone explain to me without hate why this is a bad thing?
- josteink 11y ago
  > There are FOUR VERSIONS OF FIREFOX WITH A SWITCH TO DISABLE THIS While that may be true, requiring that you run a non-standard version of Firefox to be able to use "random" extensions will probably have a chilling effect on the Firefox extension ecosystem. That, and it reeks of Chromeism.
  - soapdog 11y ago
    you will be able to run "random" extension if the developer care enough about it and about the new security procedures to sign it. After all, it takes only couple seconds for the signing to work. The versions I quoted are not non-standard. They are all versions of Firefox being worked on and with all the relevant teams. All those versions eventually become Firefox Stable and after that becomes outdated and a new release is now current. Versions goes from Nightly -> DevEdition -> Beta -> Stable. Each version has some tweaks, for example DevEdition is where they seed and test new devtools. Which means that for the developers, thats the best edition to develop with (still test on the other versions).
    - 11y ago
norea-armozel 11y ago
This is going to be an annoying change me since I use the 1Password extension which isn't signed as far as I know. So, it's likely I'll switch over to Chrome (which I've had performance issues with in the past) or Pale Moon. Seriously, it's my browser. It's fine if you want to make users white list extensions but to completely block unsigned extensions is a bit over zealous. Unless Mozilla makes the signing process automatic (since it seems some extensions on addons.mozilla.org can go months before being updated to the current version) I don't see this working out at all.
- Eva_Schweber 11y ago
  Hi. I'm Eva and I work for AgileBits, the makers of 1Password. I wanted to reassure you that we are working with Mozilla on getting our Firefox extension signed. That will allow you to continue using Firefox as your default browser while still using the 1Password browser extension.
droithomme 11y ago
I wonder if extensions will be allowed that facilitate illegal activity, such as downloading youtube videos in violation of copyright.
djent 11y ago
Firefox disabled HTTPS Everywhere with no warning to me whatsoever. I use Dev Edition. I always just assumed it would always work, but apparently I can't rely on that anymore. Wasn't Mozilla pushing for non-encrypted HTTP to be deprecated? They should wait for that to happen before disabling HTTPS Everywhere.
flippinburgers 11y ago
Who wants malware affecting all of the naive users on the internet? I don't. I think you can all put your pitchforks away and take a deep breath knowing that Firefox is trying to improve the experience for people who are not like yourselves. The process is automated and takes little time. Stop acting so entitled.
dogma1138 11y ago
An automated review which takes seconds? What will it be looking for exactly? Seems to be something that will either break every extension out there or will be so easy to bypass that it won't do much. "This is not the same process that currently applies to AMO add-ons, which has been typically slower." Also the fact that you can't seem to be able to disable it even with some "debug/developer" mode in FF seems to be a bit over the top. What happens if you are tied to an older FF extension that isn't signed? What happens when you want to develop an extension? yes beta extensions will be signed also but what happens before the BETA what happens when i just want to make hello world and to learn what i can do?

288 points by fernandotakai 11y ago

It's important to note that the Developers Editions (and the Nightlys) will have a setting for disabling the requirement. The assumption being that developers need to test as they develop. And are a more informed user.

duncan_bayne 11y ago
The other assumption being that there is a distinction between 'developers' and 'users'.
ethana 11y ago
Did they say why beta wouldn't have this setting? If anything beta is closer to release and developer would target that. Developer edition is still nightly if I'm not correct?
- GeorgeOrr 11y ago
  I don't see anything about why the beta, but I did see the following in the FAQ. Maybe this will help: "There will also be special unbranded versions of Release and Beta that will have this setting, so that add-on developers can work on their add-ons without having to sign every build."
- wsha 11y ago
  I think they want to encourage wider adoption of the Beta version, so they treat it similarly to the Release. The logic seems pretty questionable to me though. If you can install a Beta version of Firefox, you should be able to avoid consenting to allow malware to run on your computer (this change is primarily targeted at extensions installed by some user action -- like something silently side-loaded by an application installer).
- mccr8 11y ago
  Generally, beta is supposed to be almost completely identical to the release version, to ensure that what gets shipped to release users is tested. This particular pref seems harmless, but you never know. Developer edition is what used to be known as "Aurora", which is in between Beta and Nightly.
azakai 11y ago
The link also says that there will be builds of normal (release) and beta Firefox that do not have this limitation, for those that want them. (In addition to people always being able to recompile the browser with whatever modifications they want, of course.)
- rndgermandude 11y ago
  I was only commenting on the "trival build or not" part. You're right that there are plans to have official "unofficial" release and beta builds without signing requirements, but only for the en-US locale (yes, language packs exist, no, not every developer on Earth speaks English)
ubernostrum 11y ago
I had to flip that setting this morning when dev edition updated and disabled the 1Password extension. It's "xpinstall.signatures.required", for reference.
voltagex_ 11y ago
They've said that for a while, but the last time I had the Dev edition installed I couldn't install the Dashlane [1] plugin. 1: https://www.dashlane.com/en/cs/3bce5a89 https://www.dashlane.com/en/cs/3bce5a89
wtbob 11y ago
Every user should be permitted to disable that requirement: it's his browser, not Mozilla's.

mveety 11y ago

What is the point of this? Shouldn't users be allowed to make their own decisions no matter how stupid or dangerous?

brighteyes 11y ago
Users still can, they can download one of the provided builds that do not have this restriction. The issue is that most users don't understand software on a deep level, and just click "yes" on dialog boxes, etc. It does make sense to keep the defaults where it prevents most users from harm.
- mveety 11y ago
  Why don't we teach people the don't understand so they can make informed choices instead of preventing it entirely?
  - brighteyes 11y ago
    We should teach people, yes! At the same time, educating hundreds of millions of people takes time.
  - smtddr 11y ago
    There are a lot of things I wish the general public would try to get educated about so they can make informed choices. 1) Nutrition 2) Politics(especially taxes & wars) 3) Computers 4) Finances If you can figure out how get people properly educated on even 2 of those things, the world would be a very different place.
  - x0x0 11y ago
    Because that's been such an unqualified success for the last 30 years we've tried it.
    - userbinator 11y ago
      30 years is not long enough. Literacy took much longer, but the benefits are clear today.

mercurial 11y ago

An important point is that the review process before signing takes seconds, according to the article. Considering the frequency of FF updates, it's an important point. Now, let's just hope that the other side of the coin is a concern for API backward compatibility, so that people don't need nightly versions of addons and a developer edition to keep their addons in a usable state...

nathanb 11y ago

It's the "no override" part that concerns me. I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example). Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never catches the breakage. But that's a side rant.... There can be a decent turnaround lag (sometimes on the order of a few days) to get a new version of an extension reviewed by addons.mozilla.org. In the meantime, I have made a habit of building a new version of the extension and giving it to anyone who asks. Some people rely on it to use the web and can't wait for Mozilla to do their thing (another side rant: I once stupidly forgot to check in a key resource. I've since changed my development process to keep this from happening again. But the non-functional extension that I pushed passed Mozilla's review just fine. Makes me wonder how much value the review process is really adding.) If I want to be able to continue this process, I will need to sign the extension myself (and who knows what histrionics Firefox will throw if a user tries to replace an extension with one that has the same UUID but a different signature!)

brighteyes 11y ago
> There can be a decent turnaround lag (sometimes on the order of a few days) Actually, the link says > Files submitted for signing will go through an automated review process. If they pass this review, they are automatically signed and sent back to the developer. This process should normally take seconds You may be thinking of a different type of review process, the signing one sounds almost instantaneous.
- tomjen3 11y ago
  If it passes. Nobody knows what it checks for or how it works.
  - icebraining 11y ago
    https://github.com/mozilla/amo-validator https://github.com/mozilla/amo-validator

mukundmr 11y ago

What happens to all of those extensions that are on they gray area of DMCA? Who is this move benefiting? The users or the sponsors?

Buge 11y ago
>>Is this a way for Mozilla to censor add-ons they don't like, enforce copyright, government demands, etc.? >No, the purpose of this is to protect users from malicious add-ons. We have clear guidelines[1] for when it is appropriate to blocklist an add-on and have refused multiple times to block for other reasons. [1] https://developer.mozilla.org/en-US/Add-ons/Add-on_guidelines https://developer.mozilla.org/en-US/Add-ons/Add-on_guideline... Copyright, DMCA, and legal concerns are not listed. So I take that to mean nothing will be rejected from signing for those reasons. Hosting on AMO has stricter rules, so they could sign the extension for you to host, but refuse to host it themselves.
- michaelt 11y ago
  Today, Mozilla doesn't get demands to take down extensions because sending demands would be pointless. If EvilCorp tried to force Mozilla to take down uBlock and friends from addons.mozilla.org they would just get hosted elsewhere and EvilCorp would look like assholes. It's all downside, no upside, so EvilCorp don't even bother to ask. If tomorrow Mozilla can shut down any extension, the calculus changes. Forcing Mozilla to kill ad blockers still makes EvilCorp look like assholes, but it might be successful. There's a big upside now, so much more reason to try and force Mozilla's hand.
  - protomyth 11y ago
    I do wonder if some lawyer will argue that a take down notice for an extension should include revocation of its signing?

scintill76 11y ago

Ah, feels like they're following Chrome's example, which decreed that it should be exceedingly difficult for Windows Chrome users to install extensions from somewhere other than https://chrome.google.com/webstore/ https://chrome.google.com/webstore/ . This basically killed an internal app we had at work (a fork of a "REST client", with some added request-signing features specific to our internal APIs.) There was no strong reason to keep it secret, but there had previously been no need to put it in the store either, and there was a $5 charge to publish in the Web Store, which I didn't feel like dealing with. Anyway, they are both measures taken to stop malware, by taking an option away from the user, that most users won't even notice, but many "power users" will be inconvenienced to varying degrees. I'm guessing Firefox's won't be as bad, since the "developer version" that will let you keep doing the old way probably won't differ from the normal version as much as Chrome's does.

deleted 11y ago
[deleted]
_yy 11y ago
You can still install custom extensions in Chrome for Windows using - among others - group policy: https://support.google.com/chrome/a/answer/188453 https://support.google.com/chrome/a/answer/188453
Jordrok 11y ago
This is the exact reason why I moved to Firefox from Chrome back when Google started tightening the noose around developer mode extensions. I had written a few extensions for my own personal use and had no interest in putting them up in the Chrome Web Store. This was fine and good until Google decided it was A Bad Thing and Chrome started popping up annoying warning windows on every startup and then eventually disabled my extensions entirely. I switched to Firefox since it let me have more control over my own browsing experience (and gave me a good excuse to extract myself just a little bit from the Google hivemind). I'm extremely annoyed to see that Firefox is now going down this route too.

mindcrime 11y ago

Well, at least they're paying lip-service to enterprise users who may have internal extensions to deal with: What about private add-ons used in enterprise environments? We haven't announced our plan for this case yet. Stay tuned. In the interim, ESR will not support signing at least until version 45, which won't come out until 2016.

b101010 11y ago
I have seen several suggestions along the following lines as far back as the original blog post which announced the intention to require extension signing Allow an extension signing certificate to be place in a directory/store which requires elevated privileges to modify (ie /etc/ or similar). Extensions in the user's profile signed by this certificate will load as if they were signed with the Mozilla certificate. If the user has enough privileges to add an extension signing certificate then they also most likely have the ability to modify the Firefox itself, I think this addresses any concerns that this method could be used to load malicious extensions (if the user is willing to run unknown executables with elevated privileges then extensions with apparently valid signatures are the least of their worries). This allows enterprises to sign and distribute their own extensions, with the additional step of creating and distributing the signing certificate, and could work also work for home users.

ekianjo 11y ago

It should still possible to fork Firefox and remove this requirement, right ?

kragen 11y ago
In theory, but that will be very difficult.
- ekianjo 11y ago
  How about Pale Moon ?
- Dylan16807 11y ago
  Difficult how? Even though Mozilla is going to providing builds of just such a fork themselves? Is it particularly hard to build firefox?
- rockdoe 11y ago
  It's trivial.
situmorang2015 11y ago
ofc, you can since firefox is opensource
a3_nm 11y ago
It's not really a full fork, but I'm fairly confident that Iceweasel, the patched and no-branding Firefox that ships with Debian, will not have this problem. (So as I Debian user I don't really care, but it worries me slightly for the future of Mozilla.)
wsha 11y ago
Mozilla has said that this requirement is set by one flag at build time, so building a version without this requirement should not be any more difficult than just compiling Firefox I have never done that, but I think it's slightly non-trivial. The hardest part though would be distributing the fork though, so a Linux distribution like Debian mentioned this change as others have mentioned would be one way to build a popular fork without this requirement.

kragen 11y ago

This is deeply disappointing. Two details: the extensions need to be signed by Mozilla, and only US English speakers will be allowed to disable this requirement. The point of free software is that users, individually and collectively, are free to modify it as they wish, without requiring approval from third parties. (And of course to use, copy, and redistribute.) This is a sharp turn away from the free-software ethos that made Firefox possible in the first place. I understand the issue of users being tricked into downloading and installing malicious extensions. If you let someone program, they will be able to paste malicious code. I just don’t think that taking away users’ ability to modify their own browsers is an acceptable solution to that. If this disturbing move sticks, Mozilla will become an increasingly tempting target for whatever group wants to control what software you can install on your own computer — whether that’s Sony Pictures, the NSA, or Amazon. The old free software movement has died. We need a new free software movement.

dtech 11y ago
> only US English speakers will be allowed to disable this requirement Do they assume that non-English speakers are just drooling baboons who cannot decide this for themselves unlike English speakers?...
- kragen 11y ago
  Perhaps they assume that to program enough to write an extension, you need to learn English. I’ve met people here in Argentina who say that. My view is that, even if that is the status quo ante (and I’m not sure it really is) it’s a status quo we must disrupt, not ossify.
  - kome 11y ago
    Wise words, kragen. With the excuse "you need english because" a new form of imperialism is on the making. And what is worse, is that this attitude is often self-imposed.
    - chronial 11y ago

hamza001 11y ago

http://googler700.blogspot.com/ http://googler700.blogspot.com/

tyho 11y ago

How does this policy interact with greasemonkey, an extension that allows running random JavaScript on sites with access to the extension API. You could write your malware as a greasemonkey extension, convince a user to install a signed greasemonkey release, and then convince them to install your malicious extension.

paulryanrogers 11y ago
Great point. Does anyone know what--if any--limits Grease Monkey puts in place to prevent users from bring exploited?

legulere 11y ago

I wonder how long it will take until adware producers patch out the requirement for signed extensions in the binary when you install stuff from them on your computer.

wsha 11y ago
That route is getting harder with application signing becoming more prevalent on Windows and OS X.

alfapla 11y ago

It's little more than a year ago that Brendan Eich was ousted from Mozilla by an ugly orchestrated cabal. When I read Mitchell Baker's vapid blog post [1] on the decision, filled with polite backstabbing and politically correct buzzwordery I understood that Mozilla has been taken over by politicians and that its decline is just a matter of time. [1] https://blog.mozilla.org/blog/2014/04/03/brendan-eich-steps-down-as-mozilla-ceo/ https://blog.mozilla.org/blog/2014/04/03/brendan-eich-steps-...

mahouse 11y ago
I can't think of many OSS projects that aren't being manipulated by a strong community of liberals.
- andybak 11y ago
  Is that the US definition of 'liberal'? i.e. the one that would apply to most center-right parties in the rest of the world?
  - toyg 11y ago
    A U.S. "liberal" is very socially-progressive (pro-gay marriage, pro-choice, pro-environment, anti-racist, mostly pro-regulation and anti-corporate). I think that's the sort of people the parent poster intended to describe. In Europe "liberals" are usually pro-business and socially-conservative. (Btw, I wouldn't say a U.S. liberal will automatically sit on the right of the European discourse, today. Traditional socialism has virtually disappeared as a political choice in Europe as well, so really there is very little disagreement today between a U.S. liberal and a European with mainstream social-democratic sensibilities -- except maybe on foreign policy.)
  - LeoNatan25 11y ago
    "Liberals" in the US - democrats - are indeed center-right of the rest of the world. Look at Obama, Clinton, Biden. They are very center on some issues and quite right on others.
  - 11y ago

deleted 11y ago

[deleted]

sergimansilla 11y ago

I recently made an update my own Firefox extension, called Tab Grenade. It took them 4 months to review. 4 months. And that's for a (very) minor update. Because of that, I was definitely considering to start releasing it on my own, instead of through Mozilla's add-on website. It looks like I will be able to do that, but I'll have to use the signed extension process. I'll believe this system works when I see it. After my experience with add-on reviewing, I am very skeptical.

rockdoe 11y ago
Signing != Reviewing.
soapdog 11y ago
The review is mostly done by volunteers. Sorry for the delay, I feel your pain. Will check here if we can try to get more people onboard to help review stuff.
nightpool 11y ago
Addons get signed by an automated process that is independent from the public store review.

rak_112 11y ago

At this point I don't think I'll ever return to using firefox after the mountain of stupid shit mozilla has pulled in the last ~2 years.

NotOscarWilde 11y ago
I share your sentiment, but Google Chrome is better only in terms of performance [1], it fares worse in both privacy and extensibility (no ad blockers/addons on mobile Chrome). For people like me, who want: * a free software browser * android/desktop sync * adblock and other addons it is pretty much a binary choice between two evils. [1]: Possibly, of course -- but that is a debate for another time.
tenfingers 11y ago
The nice thing is that they're doing for "security", although they're absolutely fine pulling insane amounts of crap into their browser to improve the "web experience" and incidentally increasing the attack surface [which is how you get most of the malware actually].

systemz 11y ago

Mozilla is doing everything to stop using their browser.

glass- 11y ago
And instead people are going to use what?
- bigbugbag 11y ago
  not sure yet, but as soon as there's something I'm making the switch. Too many extensions are required to try to make firefox into something usable, mainly reverting changes or fiwing broken or missing features: ad blocking, sidebar, download manager, bringing back the add on bar, putting back the ability to disable javascript, session manager, cookie manager ability to take screenshot, mouse gestures, tab manager, …

RexRollman 11y ago

And slowly, freedom everywhere was destroyed in the name of security.

waspleg 11y ago
^ This.
coldpie 11y ago
Firefox is open source. Disabling the signature check will probably be a one-line change. Yes, it's a much larger barrier to entry (building Firefox is not trivial), but it's not like IE or Chrome where you have no choice in the matter at all.
- rockdoe 11y ago
  building Firefox is not trivial ./mach bootstrap ./mach build
  - rndgermandude 11y ago
    Yeah? You at the very least forgot to obtain the source code first somehow. What about build-dependencies, because ./mach bootstrap does not fully handle that? Now please tell me how to do a Windows release-build with all release features enabled (except for official branding), aka. a ton of configure switches, and also please do it for my language using the official de locale, because neither the source tar.bz2 nor the hg you'd normally clone contains that. I'm starting from scratch of course. And suddenly it is less easy and trivial..
    - azakai 11y ago
      As the link mentions, you don't need to build from source. Binary builds are provided that do not have this restriction, for those that want that.

rjempson 11y ago

Here is an idea, sometimes it is a good idea to look inwards rather than outwards.

tenfingers 11y ago

So much for beta-testing your extension prior to release. It's already hard to get users involved, now they just can't. Or using any other channel to get your extension. !Thanks Mozilla, really.

wsha 11y ago
If your extension has been fully reviewed by AMO, you can upload beta versions that only have to pass the automated signing review to be posted to AMO.
- tenfingers 11y ago
  Please don't assume all extensions have a reason to be on AMO. There are plenty of extensions which are developed in-house for in-house use only. Also, as a developer, I never cared to run the "nighties": I don't want an unstable browser, and I don't want fancy new features. I always ran the stock version, also to ensure compatibility with the user base, and never needed anything else. Maybe Mozilla should also remove the developer tools from the stock version, because clearly it's too dangerous in the hand of people that could cut&paste code with full privileges into it, and it's only a keystroke away! This is a giant slap in the face, frankly. I don't see a difference between a walled garden such as google play and this.
  - tired_man 11y ago
    I gave Mozilla money back in the day when they asked for donations in the beginning to be on that full-page NY Times ad. I wonder if I can have a refund? I'm very disappointed in how Firefox has aged.

jsingleton 11y ago

I wonder if this will mean that all the extension version numbers will stop ending in -signed. I'm used to having any build number with -label in its name denote it's a pre-release and isn't stable [0]. I was recently searching for user agent switcher add-ons as part of a blog post [1] and almost all have -signed in the name. To some people it could look like the un-signed ones are more stable and better. [0] http://semver.org http://semver.org [1] https://unop.uk/dev/how-to-watch-bbc-news-videos-on-a-desktop-without-flash-in-firefox https://unop.uk/dev/how-to-watch-bbc-news-videos-on-a-deskto...

wsha 11y ago
The -signed label was a one time effect to update existing extensions to signed versions (since AMO didn't want to arbitrarily bump the version numbers of all its hosted extensions). Future updates do not have this label.

ck2 11y ago

Between that and e10s being on by default, FF42 is going to go over like a lead balloon. I hope 41 is an ESR update, nope: only 38 and 45 are ESR https://mozorg.cdn.mozilla.net/media/img/firefox/organizations/release-overview-high-res.7f1fea43e9e2.png https://mozorg.cdn.mozilla.net/media/img/firefox/organizatio...

shdon 11y ago
What would be the problem with e10s? Sure, it's a big change, but it seems quite desirable imho.
- TheLoneWolfling 11y ago
  2-3x the memory use and lower performance due to the additional overhead of talking between processes. There are advantages, but it is not without its disadvantages.
  - shdon 11y ago
    https://wiki.mozilla.org/Electrolysis/Firefox https://wiki.mozilla.org/Electrolysis/Firefox "Goals There are number of things we believe the e10s project will give us: ... 2. Improved performance, especially on multi-core machines. 3. Better memory core stats." That seems to directly contradict your concerns. However, these are stated goals and may not align with practical reality. I'd be surprised if, when these are numbers 2 and 3 on their list of priorities, the reality would be so very different.
    - TheLoneWolfling 11y ago
      See https://news.ycombinator.com/item?id=9558745 https://news.ycombinator.com/item?id=9558745 (and actually the rest of that submission also) Now, mind you, that was nearly 3 months ago. But the concerns there are still very relevant.
      - shdon 11y ago

Taylor_OD 11y ago

Isnt chrome already like this? I spent 45 minutes trying to find a way to install a non extension store extension this weekend and gave up after being blocked repeatedly.

mythealias 11y ago
I don't think what chrome does is relevant in this discussion at least not in the context of defining what is the the correct way for mozilla to go forward.
- MiddleEndian 11y ago
  Unfortunately it's relevant in the discussion of what Mozilla can get away with.
HappyTypist 11y ago
It's actually incredibly simple, just rename the .crx to a .zip and load it as an unpacked extension. https://developer.chrome.com/extensions/getstarted#unpacked https://developer.chrome.com/extensions/getstarted#unpacked

Communitivity 11y ago

Epic fail. Mozilla should be making the browser subsystems more secure, not saying 'Trust us, we'll ensure your add-ons are secure'. Will the add-ons source code be reviewed by a CISSP skilled in the languages used within the add-on? Will the add-on be tested with the top 1000 add-on combinations out there? If the add-on provides an API, will it be tested using fuzzing? The list of these questions, and the others to which your answer is likely 'no', goes on. If you are not doing these things then you are providing a false sense of security. You may catch the bottom 60-80% of malware and unstable add-ons, but the most dangerous 20% will likely slip through, in my opinion. This does not make sense from a UX perspective, as MANY others here have pointed out, so I won't go into that further. I will point out that it doesn't make sense from a business perspective either. If you are saying your add-on signing program improves security, and you let an add-on through that has malware, then you might be sued (I am not a lawyer, this does not constitute legal advice, etc.). So to recap and summarize, with brevity, and with accuracy... EPIC FAIL

TazeTSchnitzel 11y ago
The law allows people to make mistakes. You clearly have no idea what you are talking about.
- Communitivity 11y ago
  Heh. Sure :) You're right about law, I know little - I am not a lawyer. I suspect there will be someone who blames their corporate data breach on Mozilla's policy, if they can make even the flimsiest case. Mozilla might win, at the cost of money, time, and bad PR. I suspect it more likely that they'd settle out of court. I'd love to hear a lawyer weigh in. I also love how I posted on here (I seldom do) about an issue I felt passionately about, in an area that I do know a bit about, and you responded with a personal attack. Ask yourself this, what is it you hate so much about the world, yourself, me, or my post that compelled you to personally attack a complete stranger who was donating time and thought to the discussion? Did it make you feel better? Stronger? Isn't that the very behavior you've campaigned against, elsewhere on the web?
TazeTSchnitzel 11y ago

Sir_Cmpwn 11y ago

I use several small add-ons I wrote myself. Why should I have to get Mozilla's approval before I can install my own damn add-ons? One of them executes processes and I'm 99% sure it'll fail the automated review. EDIT: It passed the automated review, but my point stands. If I wrote the code, then you can be damn sure I trust it.

atopal 11y ago
> I use several small add-ons I wrote myself. Why should I have to get Mozilla's approval before I can install my own damn add-ons? Mozilla has to balance the needs of several hundred million users, who are being attacked by malware every day, with the needs of people who write their own add-ons. Is it really that difficult to see it from that perspective? And it's not like you have no options now. You can either use the developer edition or the special release version where this feature is disabled.
- Sir_Cmpwn 11y ago
  They've always catered to the hacker perspective, too. Why take out the about:config flag? How about letting me trust my own certificate, instead of just AMO's? What about running AMO alternatives?
  - atopal 11y ago
    Did you not read the blog post? You can use the dev edition or the special release and beta version that don't have this limitation. Nobody is forcing you to live with this limitation. If this was done as an about:config flag it could easily be changed by an add-on too.
    - Sir_Cmpwn 11y ago
      I did read the blog post. It says I have to use a less stable (beta) or less customizable (dev edition) version of Firefox to avoid this burden.

SCHiM 11y ago

I like the fact that a security issue is being tackled. What I absolutely hate is the fact that there are no ways to turn this option off. Just like HSTS I can't turn this off and it leaves a bad taste in my mouth. Were originally I considered firebox to be a browser for power users, now I'm not too sure any more.

acdha 11y ago
I'm mixed on the general issue – an option to turn it off is an option which is certain to be used to social engineer millions of people – but this is somewhat different from HSTS: HSTS allows a site owner to set a security policy for access their own servers. There's no downside to using it, it doesn't affect anyone else, and in any case if you choose to use a service you're subject to their security policies. The fundamental choice is unaffected: use their service or go somewhere else. In contrast, this is more controversial because it involves telling the user that they cannot do something they want to do. I think there's a strong argument that this is a pragmatic choice in the current security environment but it really does undercut user choice unless you reach the point of saying that the users who want to do this should know how to compile Mozilla.
- SCHiM 11y ago
  I really, really disagree. If your data is on my computer I should have a say in what happens to it. If I want to tunnel your hsts connection through a proxy I should be able to do so. You can't imagine how frustrated I was when I found out that I couldn't use my proxy any more, because some guy somewhere decided that it'd bee too hard to hard to add the following lines to firefox: if (user_doesn't_want_hsts) { dont_do_hsts(); } I can't even bend my head around how someone thought it was acceptable to totally take this option away from people. I understand that such an option should be hidden deep inside a config somewhere so as to prevent a normal user from compromising his/her own security. But please don't presume that you did everyone a service by taking this option away. I can't express how angry and frustrated I become when I even think about it. As for your 'no downside', as I said, perhaps not for normal users. But I most definitively am not. And I probably need to jump though a lot of hoops to tear this "feature" out of my own firefox build.

userbinator 11y ago

Mozilla's hypocrisy is astounding: https://blog.mozilla.org/security/2013/01/29/putting-users-in-control-of-plugins/ https://blog.mozilla.org/security/2013/01/29/putting-users-i... "Users should have the choice of what software and plugins run on their machine." https://blog.mozilla.org/theden/2014/12/15/introducing-a-smarter-way-to-search-with-firefox/ https://blog.mozilla.org/theden/2014/12/15/introducing-a-sma... "Firefox is dedicated to putting users in control of their online experience" More recently: https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in-control-of-your-online-life/ https://blog.mozilla.org/blog/2015/06/02/firefox-puts-you-in... "Firefox Puts You in Control of Your Online Life". The slogan, as found on https://www.mozilla.org/en-US/firefox/new/ https://www.mozilla.org/en-US/firefox/new/ , is now "Firefox is created by a global non-profit dedicated to putting individuals in control online." I believe it used to be "users" - see above - but was silently changed. I suppose these "individuals" are the people at Mozilla...?

TazeTSchnitzel 11y ago
Users still have control. You can remove plugins you don't like, and if you really want to, use a version of a plugin which allows unsigned extensions. Arguably this change might give users more control: Trojan horses can no longer secretly side load malware.
- userbinator 11y ago
  Users still have control. You can remove plugins you don't like, and if you really want to, use a version of a plugin which allows unsigned extensions. You could argue that as long as users can still download a disk editor and change any byte of the disk on their machine they still have control (in fact patching out this signature check could probably be done with a single-byte change to the binary...); the problem is when this control is made more and more difficult.
SkatAndRap 11y ago
Firefox users see through this feel-good marketing nonsense from Mozilla. They've seen Firefox's UI change for the worse in so many ways, even in the face of wide opposition. They've seen unwanted bloat, like Hello and Pocket, forced upon them, again in the face of wide opposition. They've seen their requests for bug fixes and performance improvements go unheeded, sometimes for years. The easy use of extensions has been the only thing keeping many of these people using Firefox. They've been using many extensions to undo, as much as is possible, the unwanted changes that Mozilla has made. I use Firefox Nightly, and was recently surprised when, after an update, some custom extensions I had written myself were not loading, and could not be easily enabled. When I found out it was due to this, and I had to start adjusting about:config settings, it was nearly the last straw for me. I don't want to use another browser, but it's like Mozilla is doing everything in its power to make using Firefox a bad experience for me. I know I'm not alone. We've already seen Firefox' share of the browser market drop from well over 30% to a level of around 10% today, if it isn't actually lower than that. It's truly sad to see what's happening to what was once such a great browser.

bpodgursky 11y ago

Ad-blockers have finally reached a point that the financiers of the major browsers are setting the groundwork for tightening the screws on them. Not right now, but in a couple years when earnings start trending down. Google and Yahoo -- driven by ads -- fund Chrome and Firefox, over half the browser market. Nobody innately wants to be evil; these are still * mostly * engineer driven companies. But when it comes to an extensential crisis of revenue vs freedom, there is no real choice. So thanks guys. We had a good run with open browsers, but it is quickly drawing closed because you just couldn't stand the ANNOYANCE of seeing ads next to your content. It's been fun, and now back to the darkness we go.

adamc 11y ago
I don't see what would prevent folks from switching to a fork if that happened.
- bpodgursky 11y ago
  Sure. It will be a fork that falls behind master without funding or support. Get enough momentum and push it far enough and Chromium and Firefox will stop being OSS altogether.
  - acdha 11y ago
    This is indistinguishable from the conspiracy theories people used to circulate about a magic carburetor design which got 85MPG and was killed by Detroit automakers for unknown reasons. Just look at the chain of unsupported assertions which have to all come true for this to make any sense: Mozilla will prevent you from installing ad-blockers, and that this will bother enough users to matter but somehow that won't lead to enough volunteered developer time to maintain even an almost unmodified “fork” which changes only a build flag (or a signing key)? Or that somehow if that proved popular enough to attract a large number of users they'd react not by reconsidering such policies but instead push everyone over to Edge/WebKit? Microsoft and Apple are not primarily advertising companies and at least Apple is marketing actively on the idea of respecting your privacy – it's hard to imagine anyone working at a browser vendor not realizing that such a move is simply going to push users to switch.

mashed_potato 11y ago

As if it wasn't already difficult enough explaining to people why I use Firefox...

rquirk 11y ago

Will this also affect Firefox for Android? Mozilla currently don't provide a dev build for Android, just regular and beta versions https://play.google.com/store/apps/developer?id=Mozilla https://play.google.com/store/apps/developer?id=Mozilla The security problem that this "fixes" is not really an issue on Android due to Android's own app sandboxing, so maybe the Android build will allow unsigned extensions? It's not mentioned in the FAQ.

rockdoe 11y ago
Mozilla provides Aurora and Nightly for Android. They're just not on the Play Store, but you can download them from their website. https://nightly.mozilla.org/ https://nightly.mozilla.org/ not really an issue on Android due to Android's own app sandboxing A malicious add-on could still steal all your passwords.
- zeveb 11y ago
  > A malicious add-on could still steal all your passwords. Of course, so can Mozilla, because Firefox Accounts are no longer secure (the login page downloads JavaScript assets from Mozilla, and could be used to snarf a particular user's password in a targeted attack, leaving no traces observable by other users).
discreditable 11y ago
> Mozilla currently don't provide a dev build for Android, just regular and beta versions Nightly versions of Firefox are available from https://nightly.mozilla.org/ https://nightly.mozilla.org/.

dieg0 11y ago

readability extension i miss you so much

wtbob 11y ago

You know, there was something beautiful about users being able to pick up a tutorial and extend their browsers, if they wanted. There was something very empowering about being able to write extensions even in a corporate environment. I've written Firefox extensions for personal and business use, and Mozilla are preventing that from every happening again. Why? Cui bono? I'll mention, again, that they completely broke the security of Firefox Sync: it's no longer a trustworthy place to store passwords. Why? Cui bono?

stinkytaco 11y ago
Didn't Chrome take this same approach? I suspect that if multiple major browser vendors are pursuing it, it's probably to address some issue. It's not like Mozilla just thought, "let's limit people more, that will make them happy." This doesn't make it the right approach, but it does make it understandable. So I suspect it's to the benefit of the "average user" if that's what you are asking. I'm going to step outside of HN for a minute and say that in my work I work with people who rely on the Internet, but have no concept, and I mean none, how it works. They do not understand that when they create a Yahoo email account that no one can help them when they forget their password. They do not understand that if you type "yaho com" that you are not going to get anywhere (until auto search came along, that is). I've come to realize that Internet safety is not a simple set of rules, it's a complex understanding of the whole ecosystem that can't be readily taught in the time I have with these users (and never taught to some). I can't explain why I click on links in some emails and not others, so I just say "don't click on links". I can't explain why you shouldn't use the same password everywhere to someone who needs to reset their password literally every time they log on, so I just tell them to use the one their friend or child has written down for them. It's terrible, but I get it when vendors draw a line in the sand and say "this is to protect those users." That said, as a user who does understand, there's an element of frustration. Hopefully they bury an override option somewhere, or maybe just add it to their ESR but I doubt I would ever use it.

norea-armozel 11y ago

Does anyone know if the maintainers of Pale Moon or Waterfox intend to keep the extension signing requirement on their builds?

TheLoneWolfling 11y ago
I very much doubt Pale Moon will, based on their reaction to previous restrictions and removals of features. I know that it would be hypocritical if they did. Waterfox... I don't know.

gdulli 11y ago

I hope Firefox 41 is really good because it's the last one I'll be using.

DarkTree 11y ago
What do you consider the better alternative? (serious question)
- gdulli 11y ago
  Sadly, I don't know. I don't like Chrome either.
- Nadya 11y ago
  There's Firefox forks like Waterfox, Palemoon, etc.
- toni 11y ago
  I think at this moment it's fair to say that switching to Pale Moon is the next obvious step for power-users in need of fiddling with their browser as they please.

debacle 11y ago

Is there a good open Firefox fork that are relatively well maintained? This is getting out of control.

TheLoneWolfling 11y ago
Pale Moon is decent. Or would be, except for the frustrations with addon compatibility. (Suffice to say, the Australis update pushed breaking changes to add-ons, in such a way that you cannot easily support both pre-Australis and post-Australis)

pwman 11y ago

Mozilla used to be the best place in the world for extension developers -- it was natural to have your best extension on Firefox because you could release early and often. Active developers made the platform. When Chrome came along they decided to go in a different direction entirely slowly making it more and more painful to accomplish what used to be easy in the name of security. The review process went from automatic if you were trusted to weeks and then months and then more than a quarter year. They started demanding source code. It became scary to release to addons.mozilla.org because you never knew how long it would be before your next release would be approved. Mozilla needs to realize they're hastening their own demise - Chrome now offers better features than when Mozilla was the leader including releasing to a percentage of users and faster nearly invisible to the user updates. They should go back to their roots and embrace developers again.

verusfossa 11y ago

This is disappointing. Everything is becoming centralized, even Firefox extensions. I wish there was an opt out like "unknown sources" in android, but they keep saying we're not smart enough to make or own decisions. They won't even put one in about:config. This change well undoubtedly upset developers and other techy folk, exactly the kind of people you want working with your software. Fdroid is working on third party repositories, maybe that will catch on to decentralize the mobile world a bit. Something like that for browser extensions would be sweet. Take a look at Fennec Fdroid for a cleaner Firefox mobile experience at least.

soapdog 11y ago
In the article they say that Firefox DevEdition, Nightly and Unbranded will have a switch to turn this requirement off. Have you read the article? In the FAQ section they explain which versions of Firefox you can use if you don't want this requirement to occur.
Someone1234 11y ago
The point here is to stop junkware authors (who operate pretend-legally) from trivially installing extensions into Firefox. Right now, this type of software commonly injects javascript into all web-pages a user visits which do things like add adverts or redirect searches. If you allow a tick box to disable this, then how do you stop the junkware authors from simply checking that box on behalf of the user? Because that's what would happen, the user would click "next" on some random installer (which the junkware authors argue grants them expressed permission to install), and the junkware will claim they tick the unknown sources box to fix a "backwards compatibility issue." What they're trying to do is make the option to disable the check SO niche that it really isn't a valid option for the junkware authors to use anyway (since most consumers won't have it, only corp. networks which are a hard target for junkware for other reasons).

dannysu 11y ago

It's been one month and the new version of an extension I wrote is still waiting to be reviewed. I've since stopped waiting and started using the new version myself rather than download from AMO. I was already very disappointed by the review process and now this. Tweeted to Chris Beard: "Dear @cbeard, please give your users the choice and control they deserve in @firefox. Allow extension signing to be disabled in FF42." You want to protect the user, then start making extensions more secure and require permissions to do things. E.g. If an extension can access contents of webpages, pop up a dialog and ask the first time. There are other ways to protect users without going authoritarian on us.

benmccann 11y ago

This is very frustrating. Made worse by the fact that they just replaced their packaging tool with a new jpm tool that doesn't yet match the functionality of the old tool.

hobarrera 11y ago

> [...] plugins don't need to be signed. So the worst kind of threat is still there. Great job, Mozilla!

fernandotakai 11y ago
yup, and that's what i don't get. statistically, plugins like java and flash are a bigger security threat than addons. i don't even remember an addon going rogue.
- hobarrera 11y ago
  I also quite clearly recall mozilla stating that plug-ins are responsible for over 95% of all browser crashes.
MacsHeadroom 11y ago
That's because plugins are going to need to be white-listed (modifiable via about:config). The win64 (beta) edition of Firefox only allows the Flash Player Plugin, for example.
- nightpool 11y ago
  isn't this still vulnerable to the attack reported up-thread where whatever malware just goes and changed about:config before installing their plugin? (and the reason that the addon opt-out is being removed from ff42)

soapdog 11y ago

Folks, There are FOUR VERSIONS OF FIREFOX WITH A SWITCH TO DISABLE THIS if you're so inclined. You can use: Nightly, Dev Edition, Unbranded Stable and Unbranded Beta. All of which have a switch that you can set to disable addons signing requirement. In contrast there are only two versions where this is a requirement, Stable and Beta. If you doubt the usefulness of this you haven't seen a browser being hijacked by malware overriding search results, inserting all types of toolbars and more. This will prevent malware from sideloading extensions. And this is good. The signing process is not the same as the AMO review process. The process takes only seconds and the signed addon is returned to the developer. They can distribute as they see fit. Now, lets face the fact: Simple signing process that takes only seconds and will help prevent lots of malware, not the most nasty ones but a huge lot of sideloaded crap. Four versions of the browser for those power users who want to disable this. Now, can someone explain to me without hate why this is a bad thing?

josteink 11y ago
> There are FOUR VERSIONS OF FIREFOX WITH A SWITCH TO DISABLE THIS While that may be true, requiring that you run a non-standard version of Firefox to be able to use "random" extensions will probably have a chilling effect on the Firefox extension ecosystem. That, and it reeks of Chromeism.
- soapdog 11y ago
  you will be able to run "random" extension if the developer care enough about it and about the new security procedures to sign it. After all, it takes only couple seconds for the signing to work. The versions I quoted are not non-standard. They are all versions of Firefox being worked on and with all the relevant teams. All those versions eventually become Firefox Stable and after that becomes outdated and a new release is now current. Versions goes from Nightly -> DevEdition -> Beta -> Stable. Each version has some tweaks, for example DevEdition is where they seed and test new devtools. Which means that for the developers, thats the best edition to develop with (still test on the other versions).
  - 11y ago

norea-armozel 11y ago

This is going to be an annoying change me since I use the 1Password extension which isn't signed as far as I know. So, it's likely I'll switch over to Chrome (which I've had performance issues with in the past) or Pale Moon. Seriously, it's my browser. It's fine if you want to make users white list extensions but to completely block unsigned extensions is a bit over zealous. Unless Mozilla makes the signing process automatic (since it seems some extensions on addons.mozilla.org can go months before being updated to the current version) I don't see this working out at all.

Eva_Schweber 11y ago
Hi. I'm Eva and I work for AgileBits, the makers of 1Password. I wanted to reassure you that we are working with Mozilla on getting our Firefox extension signed. That will allow you to continue using Firefox as your default browser while still using the 1Password browser extension.

droithomme 11y ago

I wonder if extensions will be allowed that facilitate illegal activity, such as downloading youtube videos in violation of copyright.

djent 11y ago

Firefox disabled HTTPS Everywhere with no warning to me whatsoever. I use Dev Edition. I always just assumed it would always work, but apparently I can't rely on that anymore. Wasn't Mozilla pushing for non-encrypted HTTP to be deprecated? They should wait for that to happen before disabling HTTPS Everywhere.

flippinburgers 11y ago

Who wants malware affecting all of the naive users on the internet? I don't. I think you can all put your pitchforks away and take a deep breath knowing that Firefox is trying to improve the experience for people who are not like yourselves. The process is automated and takes little time. Stop acting so entitled.

dogma1138 11y ago

An automated review which takes seconds? What will it be looking for exactly? Seems to be something that will either break every extension out there or will be so easy to bypass that it won't do much. "This is not the same process that currently applies to AMO add-ons, which has been typically slower." Also the fact that you can't seem to be able to disable it even with some "debug/developer" mode in FF seems to be a bit over the top. What happens if you are tied to an older FF extension that isn't signed? What happens when you want to develop an extension? yes beta extensions will be signed also but what happens before the BETA what happens when i just want to make hello world and to learn what i can do?