8 ms·
> The Beta and Release versions of Firefox based on 42 and above (Beta 42 will be released at the same time as Firefox 41) will remove the preference that allow
by shock 11y ago
> The Beta and Release versions of Firefox based on 42 and above (Beta 42 will be released at the same time as Firefox 41) will remove the preference that allows unsigned extensions to be installed, and will disable and/or prevent the installation of unsigned extensions.
This is very bad news for me. I'm a power user that prefers the balance of new features/chance of breakage that the Beta channel offers and I take full responsibility for the addons I install and the security decisions I make. I don't need Mozilla to be "defending" me in this case.
- zawaideh 11y agoFully agree. On Mac OS X you can still run unsigned apps, but you have to be savvy enough to do so. Mozilla should at the very least adopt such an approach.
- geekingfrog 11y agoxpinstall.signatures.required should be the setting you're looking for.
- super_mario 11y agoThis option will be removed from about:config in Firefox 42.
- shock 11y agoThat's the option I'm currently using and that Mozilla plans to remove in Firefox 42.
- CmdrKrool 11y agoCould someone make an extension to re-enable this config option? And... would Mozilla agree to sign it? (Since, you know, the standard response over the years to users complaining about removed functionality in Firefox has been, "use an extension")
- shock 11y agoI doubt an extension could do that since the signing mechanism needs to be secure, otherwise it would be pointless.
- nightpool 11y agono, because then any malware would immediately install that extension first, and then flip the about:config bit on the filesystem, and then install their extension, and then you're right back where you were before signing.
- ianbicking 11y agoA big problem for a lot of Firefox users is addons that are side-loaded into a profile. Like when you download some junk and it comes with an installer that injects an addon into your profile. This is a good expose on what even a seemingly legitimate site like download.com does: http://www.howtogeek.com/198622/heres-what-happens-when-you-install-the-top-10-download.com-apps/ http://www.howtogeek.com/198622/heres-what-happens-when-you-... (and several of the malware examples in that article are side-loaded addons). Unfortunately hoops aren't enough to fix this problem, because hoops generally involve some flag that you've gone through the hoop, and the installer can easily fake that.
- ptx 11y agoCouldn't those installers patch Firefox to remove the signing requirement? Or, if they don't get sufficient privileges to modify the executable, patch the user's Firefox process in memory?
- Tobu 11y agoChrome did a similar change which led to a pretty spectacular drop: http://blog.chromium.org/2015/05/continuing-to-protect-chrome-users-from.html http://blog.chromium.org/2015/05/continuing-to-protect-chrom...
- ianbicking 11y agoYeah, this might end up being just a salvo in a longer battle. But maybe part of the problem is that some of these malware authors are lying to themselves and believe they are just grayhat hackers, and once you start patching executables it becomes a bit clearer you are a blackhat. So far download.com isn't distributing actual rootkits. They could of course. And yet still they probably won't. Relatedly I did notice when putting my own addon through the signing process that there was a checkbox specifically for sideloaded addons, with the implication that the checks would be even more stringent. I'm not sure if that's enforced or not, or how.
- deno 11y agoHow is that Mozilla’s problem? If you close all the “hoops” the rogue installer can just simply replace Firefox with its own build of “Firefox.” I truly don’t understand why Mozilla is trying to do Microsoft’s job.
- sonnyp 11y agoUse Firefox Beta or Firefox Nightly
- shock 11y agoI'm already using Firefox Beta. I don't want to be using Firefox Nightly.
- brighteyes 11y agoAs others said elsewhere, mozilla will provide builds of Beta that do not have this issue. It's just that the default build will.
- sandyarmstrong 11y agoThe preference is being removed from Beta, as quoted above. Nightly is just not a great answer for a "power user".
- gcb0 11y agobut i actually do work. I'm not testing new ff releases all the time. i also run Aurora for that. now you say release/sign your extensions.... well they mostly contain internal data and URLs. no way I'm publishing any of those.
- nightpool 11y agoYou don't need to publish extensions to get them signed, AMO will sign unlisted extensions that are submitted. this doesn't really change the situation for enterprise users though.
- detaro 11y agoAllow enterprise users to generate firefox executables with additional trusted certificates and distribute that on their machines instead of the original?
- nine_k 11y ago«The Nightly and Developer Editions of Firefox based on 42 and above will retain the preference to disable signing enforcement, allowing the development and/or use of unsigned add-ons in those versions» So I think running the Developer Edition (which I expect to be much more stable than Nightly) is probably your best bet.
- shock 11y agoThe thing is, I'm not a web developer and I don't think I should be forced to use the Developer Edition just so I can remain in charge of what I install in my browser. Now that I'm writing this it occurs to me that after this change it's not really my browser anymore, is it?
- catern 11y agoUse Iceweasel or GNU Icecat?
- shock 11y agoThanks for the suggestion! That's what I'll prolly end up doing although neither of them are in the Ubuntu repos.
- outworlder 11y agoAre you sure you are a 'power user', then?
- Animats 11y agoOne reason for add-on signing is that there's a major attack on Firefox using stolen add-on IDs to insert malware. This started in early 2015, and one of my add-ons has about one-third bogus versions out there. They all have different random version numbers, typically above 1000. Those are about to get flushed out of the ecosystem. Whether add-on signing is part of a power trip at Mozilla to enforce a walled garden with Mozilla-favorable policies remains to be seen. When Mozilla blocks an add-on which disables Pocket or Sync or Hello, we'll know that AMO has turned to the dark side.
- makomk 11y agoThat could presumably be solved by allowing developers to sign their own add-ons and tying the ID to the key they used to sign it - it doesn't require a centralised signing system of the kind Mozilla introduced.