4 ms·

Long time coming, the FF extensions system has been a security risk and a development burden for years. Yes, it offered unique advantages, at a significant cost

Long time coming, the FF extensions system has been a security risk and a development burden for years. Yes, it offered unique advantages, at a significant cost though. Judging by the number of users on Chrome, it's hardly a dealbreaker change for most. Signing & locking down extensions is a necessity. Anyone who has to deal with the user side of IT will attest to that. You can't bury your head in the sand and expect the problem to go away or wipe your hands of it and insist users should know better. The fact of the matter is, browser extensions are one of the most common malware attack vectors nowadays and vendors should be concerned about that. It's going to be an unpopular change amongst hard-core Firefox users and FF-only extension developers, but you can't let diehards force you to drown with the ship. They'll live and find a way. It's regular users who will happily jump ship to Chrome, Edge and Safari without a second thought.

nightpool 11y ago
Chrome doesn't sign extensions though, and getting them listed isn't anything more specific then a 5$ charge—how can you judge whether its "hardly a dealbreaking change" based on that?
- shinratdr 11y ago
  Chrome has moved quite steadily towards only installing extensions listed in the Chrome Web Store, which results in roughly the same restriction. http://blog.chromium.org/2015/05/continuing-to-protect-chrome-users-from.html http://blog.chromium.org/2015/05/continuing-to-protect-chrom... Each vendor is moving at their own pace and in their own way, but the endgame is clear. With that comment, I was also referring to the depreciation of XUL more than the signing requirement.
  - nightpool 11y ago
    No, its absolutely not. The new firefox addon signing requirements are a hundred percent more restrictive then the requirements to get listed on the chrome store.
    - shinratdr 11y ago
      Just wait, they'll sure up soon enough.
      - nightpool 11y ago
        yeah that's fair.
    - rctgamer3 11y ago
      Wrong. Chrome IS more restrictive, they don't allow non-Chrome Store add-ons AT all. With Mozilla's implementation all non-AMO add-ons need to do is go through the automated signing process. Which only takes a couple of minutes, at most.
      - nacs 11y ago
        > they don't allow non-Chrome Store add-ons AT all This is wrong. You can drag and drop an extension into the Chrome extensions folder (or enable the developer mode in the extensions page) to install any extension in Chrome.
        TazeTSchnitzel 11y ago
        You used to be able to. You can't now.
        chr1 11y ago
        You can, it just shows a warning about developer mode.
- uxcn 11y ago
  I agree. > Judging by the number of users on Chrome, it's hardly a dealbreaker change for most. Signing & locking down extensions is a necessity. Anyone who has to deal with the user side of IT will attest to that. Fewer people might need the flexibility, but Mozilla effectively dictating the browser experience still seems excessive. Comparing it to Windows, it's almost akin to Microsoft requiring signatures on all software that can be installed.
  - pcwalton 11y ago
    > Comparing it to Windows, it's almost akin to Microsoft requiring signatures on all software that can be installed. The equivalent of a Windows app is a Web app. Nobody is requiring signatures on all Web pages that you visit. A better analogy would be Windows requiring signatures on all kernel-mode drivers that you install. Which, in fact, it does, and has for 8 years now, starting with 64-bit Windows Vista.
    - uxcn 11y ago
      Requiring code-signing is fairly controversial by itself, but even still, comparing add-ons to drivers isn't really accurate. For monolithic systems, drivers imply kernel mode, which implies Ring-O privileges, which also implies root access. An add-on is restricted to user privileges or less. These are by pretty far not comparable.
      - nathankleyn 11y ago
        Said add-ons can also access your entire browsing history, listen to you type in your passwords to your online banking account, get access to your emails and hence online identities, and generally know everything there is to know about you in a very short amount of time and code. I'd argue the threat here is that malicious extensions at this level can be done by somebody with little to no experience, compared to kernel extensions which actually require some modicum of skill. Requiring signing is a recognition of the fact we are increasingly moving our lives online, and hence into the browser.

nightpool 11y ago

Chrome doesn't sign extensions though, and getting them listed isn't anything more specific then a 5$ charge—how can you judge whether its "hardly a dealbreaking change" based on that?

shinratdr 11y ago
Chrome has moved quite steadily towards only installing extensions listed in the Chrome Web Store, which results in roughly the same restriction. http://blog.chromium.org/2015/05/continuing-to-protect-chrome-users-from.html http://blog.chromium.org/2015/05/continuing-to-protect-chrom... Each vendor is moving at their own pace and in their own way, but the endgame is clear. With that comment, I was also referring to the depreciation of XUL more than the signing requirement.
- nightpool 11y ago
  No, its absolutely not. The new firefox addon signing requirements are a hundred percent more restrictive then the requirements to get listed on the chrome store.
  - shinratdr 11y ago
    Just wait, they'll sure up soon enough.
    - nightpool 11y ago
      yeah that's fair.
  - rctgamer3 11y ago
    Wrong. Chrome IS more restrictive, they don't allow non-Chrome Store add-ons AT all. With Mozilla's implementation all non-AMO add-ons need to do is go through the automated signing process. Which only takes a couple of minutes, at most.
    - nacs 11y ago
      > they don't allow non-Chrome Store add-ons AT all This is wrong. You can drag and drop an extension into the Chrome extensions folder (or enable the developer mode in the extensions page) to install any extension in Chrome.
      - TazeTSchnitzel 11y ago
        You used to be able to. You can't now.
        chr1 11y ago
        You can, it just shows a warning about developer mode.
uxcn 11y ago
I agree. > Judging by the number of users on Chrome, it's hardly a dealbreaker change for most. Signing & locking down extensions is a necessity. Anyone who has to deal with the user side of IT will attest to that. Fewer people might need the flexibility, but Mozilla effectively dictating the browser experience still seems excessive. Comparing it to Windows, it's almost akin to Microsoft requiring signatures on all software that can be installed.
- pcwalton 11y ago
  > Comparing it to Windows, it's almost akin to Microsoft requiring signatures on all software that can be installed. The equivalent of a Windows app is a Web app. Nobody is requiring signatures on all Web pages that you visit. A better analogy would be Windows requiring signatures on all kernel-mode drivers that you install. Which, in fact, it does, and has for 8 years now, starting with 64-bit Windows Vista.
  - uxcn 11y ago
    Requiring code-signing is fairly controversial by itself, but even still, comparing add-ons to drivers isn't really accurate. For monolithic systems, drivers imply kernel mode, which implies Ring-O privileges, which also implies root access. An add-on is restricted to user privileges or less. These are by pretty far not comparable.
    - nathankleyn 11y ago
      Said add-ons can also access your entire browsing history, listen to you type in your passwords to your online banking account, get access to your emails and hence online identities, and generally know everything there is to know about you in a very short amount of time and code. I'd argue the threat here is that malicious extensions at this level can be done by somebody with little to no experience, compared to kernel extensions which actually require some modicum of skill. Requiring signing is a recognition of the fact we are increasingly moving our lives online, and hence into the browser.