6 ms·

Hi, Mozilla developer here, speaking for only myself. I'm not sure why we don't make this clearer on the wiki page, but I think the reason there's no override i

by grincho 11y ago

Hi, Mozilla developer here, speaking for only myself. I'm not sure why we don't make this clearer on the wiki page, but I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way. (Disclaimer: I didn't work on this feature and am going by recollection and my own logic.) We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of. Sometimes these add-ons even ship with big-name software, with no opt out or with the opt out squirreled away in some dark corner. Typically, they do one or more of the following: (1) spy on the user, (2) add affiliate codes for money, (3) cause performance problems and crashes. The network is a pretty hostile place these days. It's no longer 14-year-olds playing around for fun; there are moneyed interests in the game. And the sorts of people who don't frequent HN are pretty much helpless and clueless in the perpetual tug of war between various companies and mafias. As a "user agent", we have the opportunity defend users who lack the sophistication to root around and remove invasive software they didn't ask for. Of course, if you're reading this, you're in a different category. You have a better idea which software to trust, and you know how to scour your machine if something gets past you. That's why nightlies and the Developer Edition let you do whatever you want: you aren't the ones who need hard-coded protections to shield you from pref-twiddling installers. I hope that provides some needed context. Safe surfing, all!

piyush_soni 11y ago
It's been a few months already, and Mozilla is still 'undecided' on what will happen to Enterprise add-ons. The only two options you are giving us are: 1) Either remain on 'ESR' branch, which is always outdated, OR, 2) Reveal private Enterprise source code to you to get it signed (it might even be illegal for employees to do that). Both of them could be unacceptable to many organizations.
- callahad 11y ago
  There will also be automated, unbranded builds of Firefox Stable that allow you to disable the signing requirement, but are otherwise bit identical.
  - TheLoneWolfling 11y ago
    In which case what's stopping the malicious software from replacing the official build with the sign-disabled version? There is no way of doing this that both respects users freedoms and prevents malicious software.
_lce0 11y ago
> We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of. GoogleUpdate? why Firefox could not remove these extension itself? I needed to remove some files from the harddisk --I doubt john.doe will be able to remove such evils Please excuse the rant tone, these things make me feel my intimacy raped
- kbrosnan 11y ago
  Mozilla does this from time to time for really egregious cases [1]. There is a high cost to staging the block. If the author is known there is a delay to try to get the author to ship a fix [2]. If it is unknown then the block can proceed rather quickly but the cost of changing the extension to avoid the block is usually cheap [3]. [1] https://addons.mozilla.org/en-US/firefox/blocked/ https://addons.mozilla.org/en-US/firefox/blocked/ [2] https://bugzilla.mozilla.org/show_bug.cgi?id=527135 https://bugzilla.mozilla.org/show_bug.cgi?id=527135 [3] https://bugzilla.mozilla.org/show_bug.cgi?id=937405 https://bugzilla.mozilla.org/show_bug.cgi?id=937405 You can still use Dev Edition or Nightly with an about:config pref set.
Arcsech 11y ago
> We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of. Like Pocket or Hello?
- piyush_soni 11y ago
  Why is this downvoted? These inbuilt add-ons might not be 'rogue', but are definitely the ones which many users didn't ask for, or aren't even aware of.
- dveditz_ 11y ago
  zing!
zeveb 11y ago
> I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way. > We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of. Sometimes these add-ons even ship with big-name software, with no opt out or with the opt out squirreled away in some dark corner. If malware is already executing on the user's computer, it's game over, full stop. That malware can do anything, to include using local-root vulnerabilities to patch Firefox to do anything. Mozilla is _breaking_ Firefox for normal users, and making itself the arbiter of what users are and are not allowed to run on their own systems. That's both dangerous and foolish.
yellowapple 11y ago
> but I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way. And what's stopping said malware installation routine from patching my firefox.exe or /usr/bin/firefox or whatever to bypass the signature check? Or patching the running program in-memory? How would it even access that checkbox? This concern seems a bit far-fetched to me.
- dveditz_ 11y ago
  The target is not illegal malware which, as you say, would do anything. But there's a vast amount of detrimental foistware doing malicious things (e.g. injecting ads, tracking) under legal cover because the user somewhere forgot to uncheck some light-grey box in an installer. Anyone tried to install something from Sourceforge lately? Modifying the Firefox installation directory would get flagged by any anti-virus, but software using the defined extension points does not -- the user "agreed" to it.
  - yellowapple 11y ago
    Right, but my point is that if some bit of adware is capable of checking that box without being able to do far more nefarious things (like outright patching/replacing Firefox itself), then one particular symptom of that ability ought to be the least of users' - and Mozilla's - concerns; that indicates an ability to modify the execution state of a program during runtime, in which case probably nothing on that computer is safe.
nathanb 11y ago
That's a fair point. Thanks for the explanation. I think it's cool that Firefox has become mainstream enough to have so many non-tech-savvy users that Mozilla has to save them from themselves. I wish there was another approach, but I understand your viewpoint.

by grincho 11y ago

piyush_soni 11y ago

It's been a few months already, and Mozilla is still 'undecided' on what will happen to Enterprise add-ons. The only two options you are giving us are: 1) Either remain on 'ESR' branch, which is always outdated, OR, 2) Reveal private Enterprise source code to you to get it signed (it might even be illegal for employees to do that). Both of them could be unacceptable to many organizations.

callahad 11y ago
There will also be automated, unbranded builds of Firefox Stable that allow you to disable the signing requirement, but are otherwise bit identical.
- TheLoneWolfling 11y ago
  In which case what's stopping the malicious software from replacing the official build with the sign-disabled version? There is no way of doing this that both respects users freedoms and prevents malicious software.

_lce0 11y ago

> We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of. GoogleUpdate? why Firefox could not remove these extension itself? I needed to remove some files from the harddisk --I doubt john.doe will be able to remove such evils Please excuse the rant tone, these things make me feel my intimacy raped

kbrosnan 11y ago
Mozilla does this from time to time for really egregious cases [1]. There is a high cost to staging the block. If the author is known there is a delay to try to get the author to ship a fix [2]. If it is unknown then the block can proceed rather quickly but the cost of changing the extension to avoid the block is usually cheap [3]. [1] https://addons.mozilla.org/en-US/firefox/blocked/ https://addons.mozilla.org/en-US/firefox/blocked/ [2] https://bugzilla.mozilla.org/show_bug.cgi?id=527135 https://bugzilla.mozilla.org/show_bug.cgi?id=527135 [3] https://bugzilla.mozilla.org/show_bug.cgi?id=937405 https://bugzilla.mozilla.org/show_bug.cgi?id=937405 You can still use Dev Edition or Nightly with an about:config pref set.

Arcsech 11y ago

> We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of. Like Pocket or Hello?

piyush_soni 11y ago
Why is this downvoted? These inbuilt add-ons might not be 'rogue', but are definitely the ones which many users didn't ask for, or aren't even aware of.
dveditz_ 11y ago
zing!

zeveb 11y ago

> I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way. > We see many copies of Firefox infested with rogue add-ons the user didn't ask for or isn't even aware of. Sometimes these add-ons even ship with big-name software, with no opt out or with the opt out squirreled away in some dark corner. If malware is already executing on the user's computer, it's game over, full stop. That malware can do anything, to include using local-root vulnerabilities to patch Firefox to do anything. Mozilla is _breaking_ Firefox for normal users, and making itself the arbiter of what users are and are not allowed to run on their own systems. That's both dangerous and foolish.

yellowapple 11y ago

> but I think the reason there's no override is that any malware installation routine would simply activate it and continue on its merry way. And what's stopping said malware installation routine from patching my firefox.exe or /usr/bin/firefox or whatever to bypass the signature check? Or patching the running program in-memory? How would it even access that checkbox? This concern seems a bit far-fetched to me.

dveditz_ 11y ago
The target is not illegal malware which, as you say, would do anything. But there's a vast amount of detrimental foistware doing malicious things (e.g. injecting ads, tracking) under legal cover because the user somewhere forgot to uncheck some light-grey box in an installer. Anyone tried to install something from Sourceforge lately? Modifying the Firefox installation directory would get flagged by any anti-virus, but software using the defined extension points does not -- the user "agreed" to it.
- yellowapple 11y ago
  Right, but my point is that if some bit of adware is capable of checking that box without being able to do far more nefarious things (like outright patching/replacing Firefox itself), then one particular symptom of that ability ought to be the least of users' - and Mozilla's - concerns; that indicates an ability to modify the execution state of a program during runtime, in which case probably nothing on that computer is safe.

nathanb 11y ago

That's a fair point. Thanks for the explanation. I think it's cool that Firefox has become mainstream enough to have so many non-tech-savvy users that Mozilla has to save them from themselves. I wish there was another approach, but I understand your viewpoint.