6 ms·

Fully agree. On Mac OS X you can still run unsigned apps, but you have to be savvy enough to do so. Mozilla should at the very least adopt such an approach.

geekingfrog 11y ago
xpinstall.signatures.required should be the setting you're looking for.
- super_mario 11y ago
  This option will be removed from about:config in Firefox 42.
- shock 11y ago
  That's the option I'm currently using and that Mozilla plans to remove in Firefox 42.
  - CmdrKrool 11y ago
    Could someone make an extension to re-enable this config option? And... would Mozilla agree to sign it? (Since, you know, the standard response over the years to users complaining about removed functionality in Firefox has been, "use an extension")
    - shock 11y ago
      I doubt an extension could do that since the signing mechanism needs to be secure, otherwise it would be pointless.
    - nightpool 11y ago
      no, because then any malware would immediately install that extension first, and then flip the about:config bit on the filesystem, and then install their extension, and then you're right back where you were before signing.
ianbicking 11y ago
A big problem for a lot of Firefox users is addons that are side-loaded into a profile. Like when you download some junk and it comes with an installer that injects an addon into your profile. This is a good expose on what even a seemingly legitimate site like download.com does: http://www.howtogeek.com/198622/heres-what-happens-when-you-install-the-top-10-download.com-apps/ http://www.howtogeek.com/198622/heres-what-happens-when-you-... (and several of the malware examples in that article are side-loaded addons). Unfortunately hoops aren't enough to fix this problem, because hoops generally involve some flag that you've gone through the hoop, and the installer can easily fake that.
- ptx 11y ago
  Couldn't those installers patch Firefox to remove the signing requirement? Or, if they don't get sufficient privileges to modify the executable, patch the user's Firefox process in memory?
  - Tobu 11y ago
    Chrome did a similar change which led to a pretty spectacular drop: http://blog.chromium.org/2015/05/continuing-to-protect-chrome-users-from.html http://blog.chromium.org/2015/05/continuing-to-protect-chrom...
  - ianbicking 11y ago
    Yeah, this might end up being just a salvo in a longer battle. But maybe part of the problem is that some of these malware authors are lying to themselves and believe they are just grayhat hackers, and once you start patching executables it becomes a bit clearer you are a blackhat. So far download.com isn't distributing actual rootkits. They could of course. And yet still they probably won't. Relatedly I did notice when putting my own addon through the signing process that there was a checkbox specifically for sideloaded addons, with the implication that the checks would be even more stringent. I'm not sure if that's enforced or not, or how.
- deno 11y ago
  How is that Mozilla’s problem? If you close all the “hoops” the rogue installer can just simply replace Firefox with its own build of “Firefox.” I truly don’t understand why Mozilla is trying to do Microsoft’s job.

geekingfrog 11y ago

xpinstall.signatures.required should be the setting you're looking for.

super_mario 11y ago
This option will be removed from about:config in Firefox 42.
shock 11y ago
That's the option I'm currently using and that Mozilla plans to remove in Firefox 42.
- CmdrKrool 11y ago
  Could someone make an extension to re-enable this config option? And... would Mozilla agree to sign it? (Since, you know, the standard response over the years to users complaining about removed functionality in Firefox has been, "use an extension")
  - shock 11y ago
    I doubt an extension could do that since the signing mechanism needs to be secure, otherwise it would be pointless.
  - nightpool 11y ago
    no, because then any malware would immediately install that extension first, and then flip the about:config bit on the filesystem, and then install their extension, and then you're right back where you were before signing.

ianbicking 11y ago

A big problem for a lot of Firefox users is addons that are side-loaded into a profile. Like when you download some junk and it comes with an installer that injects an addon into your profile. This is a good expose on what even a seemingly legitimate site like download.com does: http://www.howtogeek.com/198622/heres-what-happens-when-you-install-the-top-10-download.com-apps/ http://www.howtogeek.com/198622/heres-what-happens-when-you-... (and several of the malware examples in that article are side-loaded addons). Unfortunately hoops aren't enough to fix this problem, because hoops generally involve some flag that you've gone through the hoop, and the installer can easily fake that.

ptx 11y ago
Couldn't those installers patch Firefox to remove the signing requirement? Or, if they don't get sufficient privileges to modify the executable, patch the user's Firefox process in memory?
- Tobu 11y ago
  Chrome did a similar change which led to a pretty spectacular drop: http://blog.chromium.org/2015/05/continuing-to-protect-chrome-users-from.html http://blog.chromium.org/2015/05/continuing-to-protect-chrom...
- ianbicking 11y ago
  Yeah, this might end up being just a salvo in a longer battle. But maybe part of the problem is that some of these malware authors are lying to themselves and believe they are just grayhat hackers, and once you start patching executables it becomes a bit clearer you are a blackhat. So far download.com isn't distributing actual rootkits. They could of course. And yet still they probably won't. Relatedly I did notice when putting my own addon through the signing process that there was a checkbox specifically for sideloaded addons, with the implication that the checks would be even more stringent. I'm not sure if that's enforced or not, or how.
deno 11y ago
How is that Mozilla’s problem? If you close all the “hoops” the rogue installer can just simply replace Firefox with its own build of “Firefox.” I truly don’t understand why Mozilla is trying to do Microsoft’s job.