3 ms·

I feel that Developer Edition would solve my problem. That said: Building FF from source takes ages. It's not something I like to do, honestly, to build/packag

I feel that Developer Edition would solve my problem. That said: Building FF from source takes ages. It's not something I like to do, honestly, to build/package/install a couple of JS files. And I do think that this is a crappy idea. Okay, require signatures if you want to install something directly from the web, maybe? But if I point that thing at a .xpi file, locally, let me install that. Hide it behind a flag in about:config, but let me install that. Saying 'ah, but someone might toggle that box for you' is weird and reminds me of Raymond Chen's 'Wrong side of the hatch' security reports. If you can do that, if your installer can mess with my about:config, why can't it f* up my whole system? A free idea for malware distributors: Bundle your own release channel build of FF and just remove the official one, keep the user's profile. Your MSI runs elevated, I'm reasonably sure I could do that ~somewhat easily~, if you make your money with shady stuff you're bound to make this work. Tada! Every extension can be installed again, please add a couple useful and set a decent home page. The premise is crap. The implementation is unfortunate and follows the premise. (Again: Thanks for the DE hint. That's listed in [1] as well, I must have missed that in the past and - Nightly isn't exactly what I want to run on a daily basis. Or at least not as my main browser, a side by side install is often present on my machines) [1]: https://wiki.mozilla.org/Addons/Extension_Signing https://wiki.mozilla.org/Addons/Extension_Signing

kevingadd 11y ago
Bad actors in this case are not exclusively malware authors. Among others, they include the developers of Skype, Java, Adobe Acrobat, most antivirus software... EDIT: For a more specific example, at various points in the past local native apps like uPlay have been exploitable such that random websites could drive-by execute scripts or download malware. Pretty much any native app (legit or not) could potentially load an extension or install a protocol handler that lets a random website own your machine.

kevingadd 11y ago

Bad actors in this case are not exclusively malware authors. Among others, they include the developers of Skype, Java, Adobe Acrobat, most antivirus software... EDIT: For a more specific example, at various points in the past local native apps like uPlay have been exploitable such that random websites could drive-by execute scripts or download malware. Pretty much any native app (legit or not) could potentially load an extension or install a protocol handler that lets a random website own your machine.