3 ms·

Wait. Isn't that the browser¹ that requires you to use an online certification process to install even your own addons/developments, unless you're on a Nightly

Wait. Isn't that the browser¹ that requires you to use an online certification process to install even your own addons/developments, unless you're on a Nightly version and change a hidden setting? skims the article Ah yeah, they avoid the subject by using Nightly anyway due to the changing API. Note that any build other than Nightly won't let you install unsigned extensions, period. Not by changing about:config values or in any way for form I'd know about. ①: Firefox fan forever. Since they decided that no, you are not allowed to install your own build of Vimperator/TST etc. without a signature from Mozilla, I'm looking for alternatives. Unfortunately there's no real competition, it's either Chrome or FF - and FF seems to move into directions I don't like.

kevingadd 11y ago
You can install unsigned addons in Developer Edition. I've been using Developer Edition as my primary browser for over a year. If you're the kind of power user that needs to install unsigned extensions, it's a pretty reasonable compromise... You can always build release channel from source. Adding a pref to release/beta for this would defeat some of the purpose of the feature - bad actors always find ways to install their shitty extensions into the browser. When the browser does signing checks before loading them, that raises the challenge significantly vs. setting some prefs and dropping a file in the right place. Chrome has a similar extension policy. Edge probably will too. History has shown that nothing less than this will cut it. :-(
- darklajid 11y ago
  I feel that Developer Edition would solve my problem. That said: Building FF from source takes ages. It's not something I like to do, honestly, to build/package/install a couple of JS files. And I do think that this is a crappy idea. Okay, require signatures if you want to install something directly from the web, maybe? But if I point that thing at a .xpi file, locally, let me install that. Hide it behind a flag in about:config, but let me install that. Saying 'ah, but someone might toggle that box for you' is weird and reminds me of Raymond Chen's 'Wrong side of the hatch' security reports. If you can do that, if your installer can mess with my about:config, why can't it f* up my whole system? A free idea for malware distributors: Bundle your own release channel build of FF and just remove the official one, keep the user's profile. Your MSI runs elevated, I'm reasonably sure I could do that ~somewhat easily~, if you make your money with shady stuff you're bound to make this work. Tada! Every extension can be installed again, please add a couple useful and set a decent home page. The premise is crap. The implementation is unfortunate and follows the premise. (Again: Thanks for the DE hint. That's listed in [1] as well, I must have missed that in the past and - Nightly isn't exactly what I want to run on a daily basis. Or at least not as my main browser, a side by side install is often present on my machines) [1]: https://wiki.mozilla.org/Addons/Extension_Signing https://wiki.mozilla.org/Addons/Extension_Signing
  - kevingadd 11y ago
    Bad actors in this case are not exclusively malware authors. Among others, they include the developers of Skype, Java, Adobe Acrobat, most antivirus software... EDIT: For a more specific example, at various points in the past local native apps like uPlay have been exploitable such that random websites could drive-by execute scripts or download malware. Pretty much any native app (legit or not) could potentially load an extension or install a protocol handler that lets a random website own your machine.
- vetinari 11y ago
  Developer edition is unstable, it's basically renamed Aurora.

kevingadd 11y ago

You can install unsigned addons in Developer Edition. I've been using Developer Edition as my primary browser for over a year. If you're the kind of power user that needs to install unsigned extensions, it's a pretty reasonable compromise... You can always build release channel from source. Adding a pref to release/beta for this would defeat some of the purpose of the feature - bad actors always find ways to install their shitty extensions into the browser. When the browser does signing checks before loading them, that raises the challenge significantly vs. setting some prefs and dropping a file in the right place. Chrome has a similar extension policy. Edge probably will too. History has shown that nothing less than this will cut it. :-(

darklajid 11y ago
I feel that Developer Edition would solve my problem. That said: Building FF from source takes ages. It's not something I like to do, honestly, to build/package/install a couple of JS files. And I do think that this is a crappy idea. Okay, require signatures if you want to install something directly from the web, maybe? But if I point that thing at a .xpi file, locally, let me install that. Hide it behind a flag in about:config, but let me install that. Saying 'ah, but someone might toggle that box for you' is weird and reminds me of Raymond Chen's 'Wrong side of the hatch' security reports. If you can do that, if your installer can mess with my about:config, why can't it f* up my whole system? A free idea for malware distributors: Bundle your own release channel build of FF and just remove the official one, keep the user's profile. Your MSI runs elevated, I'm reasonably sure I could do that ~somewhat easily~, if you make your money with shady stuff you're bound to make this work. Tada! Every extension can be installed again, please add a couple useful and set a decent home page. The premise is crap. The implementation is unfortunate and follows the premise. (Again: Thanks for the DE hint. That's listed in [1] as well, I must have missed that in the past and - Nightly isn't exactly what I want to run on a daily basis. Or at least not as my main browser, a side by side install is often present on my machines) [1]: https://wiki.mozilla.org/Addons/Extension_Signing https://wiki.mozilla.org/Addons/Extension_Signing
- kevingadd 11y ago
  Bad actors in this case are not exclusively malware authors. Among others, they include the developers of Skype, Java, Adobe Acrobat, most antivirus software... EDIT: For a more specific example, at various points in the past local native apps like uPlay have been exploitable such that random websites could drive-by execute scripts or download malware. Pretty much any native app (legit or not) could potentially load an extension or install a protocol handler that lets a random website own your machine.
vetinari 11y ago
Developer edition is unstable, it's basically renamed Aurora.