4 ms·

That's coming in 44 in 6 weeks: > Firefox 44: Release and Beta versions of Firefox will not allow unsigned extensions to be installed, with no override.

vocatus_gate 11y ago
Sigh. Why are they doing this? It's condescending and insulting. "No, you're too stupid to be allowed to install what you want to."
- mccr8 11y ago
  Firefox is changing this because malware injects itself into Firefox using this mechanism. Power users who really want to install unsigned addons can switch to the Developer Edition.
  - eitland 11y ago
    I have cleaned my share of malware infections and I can't think of one were the attack vector seemed to be FF. Now we seem to be nerfing the beast because someone might do stupid things.
    - zackboe 11y ago
      I worked in university IT for a year, focused on student's personal machines. A good majority of malware we experienced installed extensions and reconfigured browser preferences. I understand why Mozilla and Google have done similar things to restrict extension installation, but can't help but think there has to be a better way for users who know what they're doing.
    - azakai 11y ago
      You may not have seen one yourself, but browser vendors have data on this: there is a lot of malware out there that infects browsers. Browsers are putting a lot of effort into preventing this, they wouldn't do it if they didn't have clear information showing the problem was serious.
      - nikbackm 11y ago
        I don't doubt that malware adds browser extensions, but is that the initial infection vector or just installed later after the malware is already in place?
  - khc 11y ago
    the problem with that is the developer edition is also firefox nightly. Power users don't always want the absolute latest :-P
    - mccr8 11y ago
      Developer Edition is different than Nightly. They both do update about once a day, but far fewer changes land on Developer Edition so it should be more stable.
      - yuhong 11y ago
        Yes, I think it was formerly called "aurora".
- Spidler 11y ago
  Malware. That's why.
- semi-extrinsic 11y ago
  As others point out, they want to combat malware. But they've botched the process and particularly the timeframe quite badly; they should have started by 1. Fixing the extension "code review" process, which is a mess. Make it be actually automatic 99% of the time and not a big hassle. 2. Implementing non-mandatory signing a long time ago and let that run for at least a year before making it mandatory. (The initial announcement that extension signing was going to happen was Feb 10 2015.) 3. Waiting for at least half a year after making signing mandatory to start even announcing "we will change the API and severely break all non-trivial extensions in the near future". Right now, I think Firefox has set themselves up to decimate the number of extensions, by telling extension devs they have a mountain of work ahead of them for very little benefit. I can't imagine it will do anything but further reduce the number of users. Not sure what will come off it in the end. As a pentadactyl addict, I'm worried that I'll be on the next LTS release (without signing) for years to come. Either that, or we'll see a fork.
  - listic 11y ago
    Won't the next LTS release require signing, as well as the regular version? And by LTS here you mean the ESR version, right?
    - semi-extrinsic 11y ago
      Yes, they call it ESR, but did we really need Yet Another TLA? As for requiring signing, from the moz wiki: "The current plan is to have ESR 45 work like 40-42, with a preference that can turn off [signing] enforcement." Edit: source: https://wiki.mozilla.org/Add-ons/Extension_Signing https://wiki.mozilla.org/Add-ons/Extension_Signing
  - tired_man 11y ago
    I have more faith in the AV package I use than in Mozilla's part-time coders. The people producing my AV package do just that, 8 hours a day, all year long. How much time does Mozilla's AV coders have? How much practical experience? IMHO, Mozilla's FireFox team should concentrate on making the browser work fast and smooth. Period. FireFox has been slowly deteriorating for years while they've diddled with cutesy GUI crap. Too many spoons in the pot.
- zeveb 11y ago
  Is there any way for me to sign extensions myself and trust my own root? I trust Mozilla about as far as I can throw them. How long until they withhold their signature from an extension which blocks ads from one of their funders, or which supports a political cause they dislike, or are pressured to dislike? In fact, what assurance at all does Mozilla's signature give me? As far as I can tell, none whatsoever.
- datalist 11y ago
  The same can be said about any other security measure.
- wodenokoto 11y ago
  It's to ensure other apps don't install add-ons.
shostack 11y ago
But will this do anything to address the problem of companies buying existing signed extensions, and then updating them to include shady tracking, ad redirects, etc.?

vocatus_gate 11y ago

Sigh. Why are they doing this? It's condescending and insulting. "No, you're too stupid to be allowed to install what you want to."

mccr8 11y ago
Firefox is changing this because malware injects itself into Firefox using this mechanism. Power users who really want to install unsigned addons can switch to the Developer Edition.
- eitland 11y ago
  I have cleaned my share of malware infections and I can't think of one were the attack vector seemed to be FF. Now we seem to be nerfing the beast because someone might do stupid things.
  - zackboe 11y ago
    I worked in university IT for a year, focused on student's personal machines. A good majority of malware we experienced installed extensions and reconfigured browser preferences. I understand why Mozilla and Google have done similar things to restrict extension installation, but can't help but think there has to be a better way for users who know what they're doing.
  - azakai 11y ago
    You may not have seen one yourself, but browser vendors have data on this: there is a lot of malware out there that infects browsers. Browsers are putting a lot of effort into preventing this, they wouldn't do it if they didn't have clear information showing the problem was serious.
    - nikbackm 11y ago
      I don't doubt that malware adds browser extensions, but is that the initial infection vector or just installed later after the malware is already in place?
- khc 11y ago
  the problem with that is the developer edition is also firefox nightly. Power users don't always want the absolute latest :-P
  - mccr8 11y ago
    Developer Edition is different than Nightly. They both do update about once a day, but far fewer changes land on Developer Edition so it should be more stable.
    - yuhong 11y ago
      Yes, I think it was formerly called "aurora".
Spidler 11y ago
Malware. That's why.
semi-extrinsic 11y ago
As others point out, they want to combat malware. But they've botched the process and particularly the timeframe quite badly; they should have started by 1. Fixing the extension "code review" process, which is a mess. Make it be actually automatic 99% of the time and not a big hassle. 2. Implementing non-mandatory signing a long time ago and let that run for at least a year before making it mandatory. (The initial announcement that extension signing was going to happen was Feb 10 2015.) 3. Waiting for at least half a year after making signing mandatory to start even announcing "we will change the API and severely break all non-trivial extensions in the near future". Right now, I think Firefox has set themselves up to decimate the number of extensions, by telling extension devs they have a mountain of work ahead of them for very little benefit. I can't imagine it will do anything but further reduce the number of users. Not sure what will come off it in the end. As a pentadactyl addict, I'm worried that I'll be on the next LTS release (without signing) for years to come. Either that, or we'll see a fork.
- listic 11y ago
  Won't the next LTS release require signing, as well as the regular version? And by LTS here you mean the ESR version, right?
  - semi-extrinsic 11y ago
    Yes, they call it ESR, but did we really need Yet Another TLA? As for requiring signing, from the moz wiki: "The current plan is to have ESR 45 work like 40-42, with a preference that can turn off [signing] enforcement." Edit: source: https://wiki.mozilla.org/Add-ons/Extension_Signing https://wiki.mozilla.org/Add-ons/Extension_Signing
- tired_man 11y ago
  I have more faith in the AV package I use than in Mozilla's part-time coders. The people producing my AV package do just that, 8 hours a day, all year long. How much time does Mozilla's AV coders have? How much practical experience? IMHO, Mozilla's FireFox team should concentrate on making the browser work fast and smooth. Period. FireFox has been slowly deteriorating for years while they've diddled with cutesy GUI crap. Too many spoons in the pot.
zeveb 11y ago
Is there any way for me to sign extensions myself and trust my own root? I trust Mozilla about as far as I can throw them. How long until they withhold their signature from an extension which blocks ads from one of their funders, or which supports a political cause they dislike, or are pressured to dislike? In fact, what assurance at all does Mozilla's signature give me? As far as I can tell, none whatsoever.
datalist 11y ago
The same can be said about any other security measure.
wodenokoto 11y ago
It's to ensure other apps don't install add-ons.

shostack 11y ago

But will this do anything to address the problem of companies buying existing signed extensions, and then updating them to include shady tracking, ad redirects, etc.?