4 ms·

Disabling unsigned extensions without any opt-in is a terrible decision. Putting up barriers to entry for addon developers in a browser that survives primarily

Disabling unsigned extensions without any opt-in is a terrible decision. Putting up barriers to entry for addon developers in a browser that survives primarily based on the addon ecosystem is suicidal. Addon developers do not want to run unstable alpha channel builds, they don't want to have to manage multiple profiles, they don't want to build Firefox from scratch because the version they need is not available via a package manager. I really don't care about the rest of these changes, but they need to rethink their stance on unsigned extensions.

nocman 11y ago
I agree. One possible workaround would be to provide a way to add keys from which you would accept extensions. Then as part of the extension development process, you could sign your extension with your key when you are ready to install it. If the issue Mozilla is really concerned about is security, this should be an acceptable solution.
- coldpie 11y ago
  I think you have a good idea, but > If the issue Mozilla is really concerned about is security, this should be an acceptable solution. I don't know what you're implying here. That they're not concerned about security? What are they concerned about?
  - nocman 11y ago
    No, indeed I do hope that security is the primary thing they are concerned about. But it is possible they have other motivations (like control). I hope that is not the case, but I think it would be foolish to not even consider the possibility.
- TazeTSchnitzel 11y ago
  > One possible workaround would be to provide a way to add keys from which you would accept extensions. Then malicious apps will just sideload new keys.
dblohm7 11y ago
> a browser that survives primarily based on the addon ecosystem Citation needed.
- Qwertious 11y ago
  A lot of people in this very thread are complaining because the add-ons are the only reason they use Firefox in the first place. So basically, citing this thread.
catern 11y ago
>they don't want to build Firefox from scratch because the version they need is not available via a package manager I really doubt Debian will flip the compile switch that completely prevents unsigned extensions on Iceweasel.
- wsha 11y ago
  One of the maintainers already committed to flipping the switch on the mailing list. The reasoning given was that extension signing was a security feature and it is better to trust Mozilla than to trust an old add-on whose developer did not bother to update so that it could be signed.
  - Nadya 11y ago
    >...than to trust an old add-on whose developer did not bother to update so that it could be signed. Yea, those pesky deceased developers. When will they stop being so lazy and update their code? I don't understand how technically savvy people are capable of reasoning around the walled garden approach. It isn't their place to tell me who I should trust.
TazeTSchnitzel 11y ago
> Addon developers do not want to run unstable alpha channel builds, they don't want to have to manage multiple profiles, they don't want to build Firefox from scratch because the version they need is not available via a package manager. Why not use the stable versions which allow unsigned extensions?

nocman 11y ago

I agree. One possible workaround would be to provide a way to add keys from which you would accept extensions. Then as part of the extension development process, you could sign your extension with your key when you are ready to install it. If the issue Mozilla is really concerned about is security, this should be an acceptable solution.

coldpie 11y ago
I think you have a good idea, but > If the issue Mozilla is really concerned about is security, this should be an acceptable solution. I don't know what you're implying here. That they're not concerned about security? What are they concerned about?
- nocman 11y ago
  No, indeed I do hope that security is the primary thing they are concerned about. But it is possible they have other motivations (like control). I hope that is not the case, but I think it would be foolish to not even consider the possibility.
TazeTSchnitzel 11y ago
> One possible workaround would be to provide a way to add keys from which you would accept extensions. Then malicious apps will just sideload new keys.

dblohm7 11y ago

> a browser that survives primarily based on the addon ecosystem Citation needed.

Qwertious 11y ago
A lot of people in this very thread are complaining because the add-ons are the only reason they use Firefox in the first place. So basically, citing this thread.

catern 11y ago

>they don't want to build Firefox from scratch because the version they need is not available via a package manager I really doubt Debian will flip the compile switch that completely prevents unsigned extensions on Iceweasel.

wsha 11y ago
One of the maintainers already committed to flipping the switch on the mailing list. The reasoning given was that extension signing was a security feature and it is better to trust Mozilla than to trust an old add-on whose developer did not bother to update so that it could be signed.
- Nadya 11y ago
  >...than to trust an old add-on whose developer did not bother to update so that it could be signed. Yea, those pesky deceased developers. When will they stop being so lazy and update their code? I don't understand how technically savvy people are capable of reasoning around the walled garden approach. It isn't their place to tell me who I should trust.

TazeTSchnitzel 11y ago

> Addon developers do not want to run unstable alpha channel builds, they don't want to have to manage multiple profiles, they don't want to build Firefox from scratch because the version they need is not available via a package manager. Why not use the stable versions which allow unsigned extensions?