5 ms·

Chrome doesn't sign extensions though, and getting them listed isn't anything more specific then a 5$ charge—how can you judge whether its "hardly a dealbreaki

Chrome doesn't sign extensions though, and getting them listed isn't anything more specific then a 5$ charge—how can you judge whether its "hardly a dealbreaking change" based on that?

shinratdr 11y ago
Chrome has moved quite steadily towards only installing extensions listed in the Chrome Web Store, which results in roughly the same restriction. http://blog.chromium.org/2015/05/continuing-to-protect-chrome-users-from.html http://blog.chromium.org/2015/05/continuing-to-protect-chrom... Each vendor is moving at their own pace and in their own way, but the endgame is clear. With that comment, I was also referring to the depreciation of XUL more than the signing requirement.
- nightpool 11y ago
  No, its absolutely not. The new firefox addon signing requirements are a hundred percent more restrictive then the requirements to get listed on the chrome store.
  - shinratdr 11y ago
    Just wait, they'll sure up soon enough.
    - nightpool 11y ago
      yeah that's fair.
  - rctgamer3 11y ago
    Wrong. Chrome IS more restrictive, they don't allow non-Chrome Store add-ons AT all. With Mozilla's implementation all non-AMO add-ons need to do is go through the automated signing process. Which only takes a couple of minutes, at most.
    - nacs 11y ago
      > they don't allow non-Chrome Store add-ons AT all This is wrong. You can drag and drop an extension into the Chrome extensions folder (or enable the developer mode in the extensions page) to install any extension in Chrome.
      - TazeTSchnitzel 11y ago
        You used to be able to. You can't now.
        chr1 11y ago
        You can, it just shows a warning about developer mode.
uxcn 11y ago
I agree. > Judging by the number of users on Chrome, it's hardly a dealbreaker change for most. Signing & locking down extensions is a necessity. Anyone who has to deal with the user side of IT will attest to that. Fewer people might need the flexibility, but Mozilla effectively dictating the browser experience still seems excessive. Comparing it to Windows, it's almost akin to Microsoft requiring signatures on all software that can be installed.
- pcwalton 11y ago
  > Comparing it to Windows, it's almost akin to Microsoft requiring signatures on all software that can be installed. The equivalent of a Windows app is a Web app. Nobody is requiring signatures on all Web pages that you visit. A better analogy would be Windows requiring signatures on all kernel-mode drivers that you install. Which, in fact, it does, and has for 8 years now, starting with 64-bit Windows Vista.
  - uxcn 11y ago
    Requiring code-signing is fairly controversial by itself, but even still, comparing add-ons to drivers isn't really accurate. For monolithic systems, drivers imply kernel mode, which implies Ring-O privileges, which also implies root access. An add-on is restricted to user privileges or less. These are by pretty far not comparable.
    - nathankleyn 11y ago
      Said add-ons can also access your entire browsing history, listen to you type in your passwords to your online banking account, get access to your emails and hence online identities, and generally know everything there is to know about you in a very short amount of time and code. I'd argue the threat here is that malicious extensions at this level can be done by somebody with little to no experience, compared to kernel extensions which actually require some modicum of skill. Requiring signing is a recognition of the fact we are increasingly moving our lives online, and hence into the browser.

Chrome doesn't sign extensions though, and getting them listed isn't anything more specific then a 5$ charge—how can you judge whether its "hardly a dealbreaking change" based on that?

shinratdr 11y ago

Chrome has moved quite steadily towards only installing extensions listed in the Chrome Web Store, which results in roughly the same restriction. http://blog.chromium.org/2015/05/continuing-to-protect-chrome-users-from.html http://blog.chromium.org/2015/05/continuing-to-protect-chrom... Each vendor is moving at their own pace and in their own way, but the endgame is clear. With that comment, I was also referring to the depreciation of XUL more than the signing requirement.

nightpool 11y ago
No, its absolutely not. The new firefox addon signing requirements are a hundred percent more restrictive then the requirements to get listed on the chrome store.
- shinratdr 11y ago
  Just wait, they'll sure up soon enough.
  - nightpool 11y ago
    yeah that's fair.
- rctgamer3 11y ago
  Wrong. Chrome IS more restrictive, they don't allow non-Chrome Store add-ons AT all. With Mozilla's implementation all non-AMO add-ons need to do is go through the automated signing process. Which only takes a couple of minutes, at most.
  - nacs 11y ago
    > they don't allow non-Chrome Store add-ons AT all This is wrong. You can drag and drop an extension into the Chrome extensions folder (or enable the developer mode in the extensions page) to install any extension in Chrome.
    - TazeTSchnitzel 11y ago
      You used to be able to. You can't now.
      - chr1 11y ago
        You can, it just shows a warning about developer mode.

uxcn 11y ago

I agree. > Judging by the number of users on Chrome, it's hardly a dealbreaker change for most. Signing & locking down extensions is a necessity. Anyone who has to deal with the user side of IT will attest to that. Fewer people might need the flexibility, but Mozilla effectively dictating the browser experience still seems excessive. Comparing it to Windows, it's almost akin to Microsoft requiring signatures on all software that can be installed.

pcwalton 11y ago
> Comparing it to Windows, it's almost akin to Microsoft requiring signatures on all software that can be installed. The equivalent of a Windows app is a Web app. Nobody is requiring signatures on all Web pages that you visit. A better analogy would be Windows requiring signatures on all kernel-mode drivers that you install. Which, in fact, it does, and has for 8 years now, starting with 64-bit Windows Vista.
- uxcn 11y ago
  Requiring code-signing is fairly controversial by itself, but even still, comparing add-ons to drivers isn't really accurate. For monolithic systems, drivers imply kernel mode, which implies Ring-O privileges, which also implies root access. An add-on is restricted to user privileges or less. These are by pretty far not comparable.
  - nathankleyn 11y ago
    Said add-ons can also access your entire browsing history, listen to you type in your passwords to your online banking account, get access to your emails and hence online identities, and generally know everything there is to know about you in a very short amount of time and code. I'd argue the threat here is that malicious extensions at this level can be done by somebody with little to no experience, compared to kernel extensions which actually require some modicum of skill. Requiring signing is a recognition of the fact we are increasingly moving our lives online, and hence into the browser.