15 ms·

Mozilla Firefox Add-On Signing Update

75 points by e15ctr0n 11y ago

doomrobo 11y ago
Can somebody please explain to me the purpose of this change. I read the blog post explaining the decision[0]. The crux of the argument was >many tens of millions of users have non-hosted add-ons that were installed without their informed consent" Why go thermonuclear and require add-on signing for everyone? Why not just make the add-on installation screen a little bit scarier. And if the concern is to make sure that people are installing what they think they're installing (i.e not something served by a man in the middle), then maybe just require that add-ons be downloaded from a site with HTTPS. I just really don't see the point in this extreme choice. [0] https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/ https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte...
- hayksaakian 11y ago
  people become 'blind' to scary screens. see: windows UAC dialogs. i wish they would clearly indicate what problem it is that they're solving. --- edit: after reading the post you linked, it's clear they're fighting against software installers that 'conveniently' install firefox addons. for example you download skype, and it 'helpfully' installs an addon for firefox. --- their solutions might solve the problem, but I think it goes too far. Is it possible to require the user to approve and addons before they are active on the user's firefox install? even if they came from a 3rd party source?
  - Pxtl 11y ago
    Android does it best - you can install non-play-store stuff, but you have to go into a scary menu and fiddle with settings. Better than an are you sure popup.
    - Flimm 11y ago
      Because all apps are sandboxed on Android, it's hard for an app to fiddle with the settings. But desktop applications can fiddle with Firefox settings, so I can see why Mozilla don't want to allow even a setting.
  - cpeterso 11y ago
    Skype's "Click to Call" add-on is a good (bad?) example of the harm caused by "side-loaded" add-ons. It causes Firefox to crash, hang, or take multiple seconds to respond to mouse clicks. The add-on is quietly injected into Firefox by Skype's application installer and can't be disabled or uninstalled from Firefox's Add-on Manager. Users must uninstall it from the Windows' "Add/Remove Programs" Control Panel. https://bugzilla.mozilla.org/show_bug.cgi?id=1215970 https://bugzilla.mozilla.org/show_bug.cgi?id=1215970
- ossreality 11y ago
  because they're being installed OUT of the browser. It's not about being scarier. It's about drawing a line in the ground and saying "fuck you, we're not loading you into memory without a guarantee that you are legit and the user added you intentionally."
- mattbasta 11y ago
  They tried making it scarier. They even tried adding a timer so you couldn't just blindly click the install button.
  - xjay 11y ago
    I assumed the timer was there to prevent clicking Install by accident. Popup dialogs may appear right "above" something else you were clicking on, or while you're typing; hitting Enter, or Escape, which then causes the dialog to eat the input and vanish. Putting a dialog on cooldown like that would be interesting UX behavior. So if a dialog receives input < 1 sec after creation, it would discard the input and put itself on a cooldown timer, like that install dialog, or you could just change the context and avoid popups altoghether. PS: I'd mark my post Off-Topic/Digression/UX if HN had that option.
whoopdedo 11y ago
TLDR: People complained so we're back-pedaling. There are good technical reasons for requiring signed add-ons. Well, maybe not so much "good" but necessary because of other bad things in Firefox that prevent a less extreme requirement from being implemented. But the signing requirement isn't what upsets anyone. It's that add-ons must be signed _only by Mozilla_. The whole mess could have been avoided from the start by saying that add-ons must be signed by a trusted certificate but the end-user gets to choose what certificates are trusted.
- comex 11y ago
  I don't think that would work very well. After all, the list of certificates would have to be a preference, so crapware could just stick its own certificate into the preferences file before installing its addon. Of course, baking the requirement into the binary isn't perfect either, since the crapware can just patch or replace it if it has sufficient access rights, but I'd say it 'feels' drastic in a way changing preferences doesn't (which matters if the crapware is trying to be semi-legitimate), and it requires somewhat more work to come up with a suitable binary and keep it up to date.
  - tenfingers 11y ago
    Easy: just provide a certificate that cannot be changed within FF (must be modified by changing a file in the installation directory). No preference needed. This would allow developers to roll their own, and organizations to allow their custom policy as well (which could mean that the privileges of the user himself aren't sufficient to change the cert). There's really no reason as of why this couldn't be implemented properly. There' also no reason to not include a switch for it, really. This is all just smoke: most users have the privileges to change the FF binary, meaning that in most contextes malware has too (either through social manipulation or through exploits).
- jMyles 11y ago
  > good technical reasons For forcing signed add-ons? Maybe. Mayyybe. For removing the ability to opt-out of this requirement via the preference? What's the good technical reason?
jMyles 11y ago
I honest-to-goodness don't understand. Why not just let the preference remain forever?
- mattbasta 11y ago
  For the same reason Facebook puts a big loud warning in the developer console. People will follow any instructions they're given. "Press ctrl+shift+I and paste this in the box and you'll get a free puppy" "Put this in your address bar and your crush will be revealed" "Go to about:config and double click this thing, and then click this link and we'll show you nearby singles that want to hook up" Firefox add-ons essentially have full, unrestricted access to your computer. Locking this down good and well is pretty important.
  - jMyles 11y ago
    This argument doesn't really square with me. Why not just remove sudo then? Why give me any access to my computer at all?
    - cpeterso 11y ago
      Non-technical users do not use sudo, but they do use a web browser. Do you think Facebook add this JavaScript console warning for no reason at all? .d8888b. 888 888 d88P Y88b 888 888 Y88b. 888 888 This is a browser feature intended for "Y888b. 888888 .d88b. 88888b. 888 developers. If someone told you to copy-paste "Y88b. 888 d88""88b 888 "88b 888 something here to enable a Facebook feature "888 888 888 888 888 888 Y8P or "hack" someone's account, it is a Y88b d88P Y88b. Y88..88P 888 d88P scam and will give them access to your "Y8888P" "Y888 "Y88P" 88888P" 888 Facebook account. 888 888 888 See https://www.facebook.com/selfxss https://www.facebook.com/selfxss for more information.
      - jMyles 11y ago
superkuh 11y ago
I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser. I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not a solution. They say they'll be producing an "unbranded" non-walled garden version that for technical users but no such build has been revealed yet. And if they do make it the unbranded version won't be in my OS repos. This walled garden, the addition of Adobe EME/DRM, the bundling of "Pocket", and the incoming drop of XUL based extensions are too much.
- cpeterso 11y ago
  Chrome requires extensions to be both signed and distributed through Google's "Chrome Web Store". You can use the Firefox Developer Edition, which will continue to support the xpinstall.signatures.required preference allowing unsigned extensions.
  - superkuh 11y ago
    "Chrome did it." isn't an excuse. It makes it worse, actually. Developer edition is "Aurora". Aurora is alpha. Alphas have more bugs. It's not reasonable to tell me to use an alpha.
    - notnarb 11y ago
      Have you actually used Aurora? I can only speak to my own experience, but I have found it far more stable than any other 'alpha' software I've used.
      - superkuh 11y ago
        Yes. When Firefox first announced their plans for the walled garden back near FF37/38 I did as everyone said and tried Aurora. It crashed on me twice in as many hours. I'm pretty hard on browsers since I typically have 200+ tabs loaded. That never happens with final release versions.
verusfossa 11y ago
I think this whole thing is a bad idea. They won't allow a scary opt-out button because some software could turn it on, don't allow about:config because it could be flipped, don't allow a build flag in stable because malware could flip it and build. I mean... by that logic, couldn't someone reskin and redistribute alpha or the 'unbranded' with malware? Firefox is so afraid of malware, yet it encourages users to store their passwords in plain text in the browser? It really feels like a landgrab and not anything anyone has been asking for. Firefox has to compete with the Chrome web store, but you can't burn your house down to save a room. What's left if Firefox becomes some centralized market akin to iOS, Windows Store, Play etc. Forced AMO signing flies in the face of the decentralized web. "Malware happened" and "Chrome does it" aren't really answers. I think getting backed into a corner has made Moz take risks with their ideology. Hopefully they give developers and users a lot more time to deal with the upcoming changes.
- irq-1 11y ago
  > It really feels like a landgrab and not anything anyone has been asking for. Benevolent DRM. Mozilla wants to control the software, even though users want to be in control. Plugins are the reason people always give for using Firefox. Justifying control by citing non-technical users is telling: users are to be managed and controlled; users aren't "us" but the other.
nabla9 11y ago
The goal should be to make Firefox brand maximally safe for average user. Recognizable name is important for non-technical users. Mozilla should take every effort to make browsing safe for anyone who uses browsers originating from mozilla.org. Even for average developers. There should be no way to trick people following instructions that disable add-on signing if they download and use something they know by the name "Firefox" What we want is separate no-brand Firefox build that follows Firefox closely. It should work exactly like Firefox including updates (except when it explicitly deviates) but have no name recognition or easy association to Firefox/Mozilla.org. In theory it could be automatic build from Firefox development team as long as it's impossible to download it from mozilla.org and associate it with the same site as Firefox unless you know what you are doing. Any bug or security issue arising form the deviant version should not have Firefox in the news headline.
- yuhong 11y ago
  I think Mozilla already will do something like this.
ck2 11y ago
Still stuck on Firefox 41, they broke too many extensions after that.
- cm3 11y ago
  I switched to ESR channel (38.5.2) but I don't know how I'm going to use a newer ESR when it moves to a broken release. Too many extensions stop working and XUL extensions are the essence of Firefox. Tried using Chrome but so much of the ux is different or incomplete to a Firefox user that it's impossible to feel at home.
tenfingers 11y ago
Add-On Signing which can be automated does provide very little added security for the user, and just serves as a big pain the butt for everyone else involved. I'm routinely questioned to do support for users, and I find malware extensions regularly installed in Chrome which has even stricter requirements. The other day I found a laptop with one extension that redirected google.com to a scraper. Chrome did EVEN include a drop-down warning just below the URL bar that the homepage was being currently redirected by an add-on. Did the user notice? Not a bit. In fact, Chrome adding a WARNING for it made me feel even more sad: they know this is going on. Is FF going to do the same? If I was an user with an extension that did that for whatever reason I wanted, I would be furious as hell to see an added warning which I need to disable (IF possible), and that will be ignored by most users anyway. Malware developers will just get by faster, so Mozilla will not be able to keep up with the list of addons to blacklist. At the same time, initial approvals for legitimate addons will get slower. Reporting issues with Addons is clearly insufficient as Chrome Store demonstrates. In fact, I'm also NOT ok with the idea that extensions can be blacklisted at all, in spite of that "added security" aura around it. By the same logic, if extensions are required to be signed, then blacklisting (and blacklisting updates) shouldn't be allowed to be disabled. And, let's remind ourselves, that most of the extensions I've seen installed were side-loaded with other software (with "extras") that was installed in the system with the same privileges of the browsers. So really, I do expect malware to simply patch the FF binary to either disable the check or change the public key, or change it entirely with a patched version. I do not support walled gardens of any kind. Use a fork.
kozukumi 11y ago
They have the EME build for people who don't want the DRM stuff so why can't they just offer a build with unsigned extensions allowed in a similar way? Yes it gets messy but they are making it so. I don't want to use a non-release (i.e. possibly buggy) version just so I can sideload an unsigned extension. Just offer a non-front-page build in the same way they do for EME and let's move on to more important things. Seriously Mozilla waste so much time and energy discussing all this stuff when it is patently obvious what the right thing to do is.
- RubyPinch 11y ago
  > so why can't they just offer a build with unsigned extensions allowed in a similar way? From the article that you are commenting on > at which point unbranded builds based on [...] release will be provided for testing. The article was 3 paragraphs long.
  - kozukumi 11y ago
    Apologies, I didn't see release mentioned when I read the article.

75 points by e15ctr0n 11y ago

Can somebody please explain to me the purpose of this change. I read the blog post explaining the decision[0]. The crux of the argument was >many tens of millions of users have non-hosted add-ons that were installed without their informed consent" Why go thermonuclear and require add-on signing for everyone? Why not just make the add-on installation screen a little bit scarier. And if the concern is to make sure that people are installing what they think they're installing (i.e not something served by a man in the middle), then maybe just require that add-ons be downloaded from a site with HTTPS. I just really don't see the point in this extreme choice. [0] https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/ https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte...

hayksaakian 11y ago
people become 'blind' to scary screens. see: windows UAC dialogs. i wish they would clearly indicate what problem it is that they're solving. --- edit: after reading the post you linked, it's clear they're fighting against software installers that 'conveniently' install firefox addons. for example you download skype, and it 'helpfully' installs an addon for firefox. --- their solutions might solve the problem, but I think it goes too far. Is it possible to require the user to approve and addons before they are active on the user's firefox install? even if they came from a 3rd party source?
- Pxtl 11y ago
  Android does it best - you can install non-play-store stuff, but you have to go into a scary menu and fiddle with settings. Better than an are you sure popup.
  - Flimm 11y ago
    Because all apps are sandboxed on Android, it's hard for an app to fiddle with the settings. But desktop applications can fiddle with Firefox settings, so I can see why Mozilla don't want to allow even a setting.
- cpeterso 11y ago
  Skype's "Click to Call" add-on is a good (bad?) example of the harm caused by "side-loaded" add-ons. It causes Firefox to crash, hang, or take multiple seconds to respond to mouse clicks. The add-on is quietly injected into Firefox by Skype's application installer and can't be disabled or uninstalled from Firefox's Add-on Manager. Users must uninstall it from the Windows' "Add/Remove Programs" Control Panel. https://bugzilla.mozilla.org/show_bug.cgi?id=1215970 https://bugzilla.mozilla.org/show_bug.cgi?id=1215970
ossreality 11y ago
because they're being installed OUT of the browser. It's not about being scarier. It's about drawing a line in the ground and saying "fuck you, we're not loading you into memory without a guarantee that you are legit and the user added you intentionally."
mattbasta 11y ago
They tried making it scarier. They even tried adding a timer so you couldn't just blindly click the install button.
- xjay 11y ago
  I assumed the timer was there to prevent clicking Install by accident. Popup dialogs may appear right "above" something else you were clicking on, or while you're typing; hitting Enter, or Escape, which then causes the dialog to eat the input and vanish. Putting a dialog on cooldown like that would be interesting UX behavior. So if a dialog receives input < 1 sec after creation, it would discard the input and put itself on a cooldown timer, like that install dialog, or you could just change the context and avoid popups altoghether. PS: I'd mark my post Off-Topic/Digression/UX if HN had that option.

whoopdedo 11y ago

TLDR: People complained so we're back-pedaling. There are good technical reasons for requiring signed add-ons. Well, maybe not so much "good" but necessary because of other bad things in Firefox that prevent a less extreme requirement from being implemented. But the signing requirement isn't what upsets anyone. It's that add-ons must be signed _only by Mozilla_. The whole mess could have been avoided from the start by saying that add-ons must be signed by a trusted certificate but the end-user gets to choose what certificates are trusted.

comex 11y ago
I don't think that would work very well. After all, the list of certificates would have to be a preference, so crapware could just stick its own certificate into the preferences file before installing its addon. Of course, baking the requirement into the binary isn't perfect either, since the crapware can just patch or replace it if it has sufficient access rights, but I'd say it 'feels' drastic in a way changing preferences doesn't (which matters if the crapware is trying to be semi-legitimate), and it requires somewhat more work to come up with a suitable binary and keep it up to date.
- tenfingers 11y ago
  Easy: just provide a certificate that cannot be changed within FF (must be modified by changing a file in the installation directory). No preference needed. This would allow developers to roll their own, and organizations to allow their custom policy as well (which could mean that the privileges of the user himself aren't sufficient to change the cert). There's really no reason as of why this couldn't be implemented properly. There' also no reason to not include a switch for it, really. This is all just smoke: most users have the privileges to change the FF binary, meaning that in most contextes malware has too (either through social manipulation or through exploits).
jMyles 11y ago
> good technical reasons For forcing signed add-ons? Maybe. Mayyybe. For removing the ability to opt-out of this requirement via the preference? What's the good technical reason?

jMyles 11y ago

I honest-to-goodness don't understand. Why not just let the preference remain forever?

mattbasta 11y ago
For the same reason Facebook puts a big loud warning in the developer console. People will follow any instructions they're given. "Press ctrl+shift+I and paste this in the box and you'll get a free puppy" "Put this in your address bar and your crush will be revealed" "Go to about:config and double click this thing, and then click this link and we'll show you nearby singles that want to hook up" Firefox add-ons essentially have full, unrestricted access to your computer. Locking this down good and well is pretty important.
- jMyles 11y ago
  This argument doesn't really square with me. Why not just remove sudo then? Why give me any access to my computer at all?
  - cpeterso 11y ago
    Non-technical users do not use sudo, but they do use a web browser. Do you think Facebook add this JavaScript console warning for no reason at all? .d8888b. 888 888 d88P Y88b 888 888 Y88b. 888 888 This is a browser feature intended for "Y888b. 888888 .d88b. 88888b. 888 developers. If someone told you to copy-paste "Y88b. 888 d88""88b 888 "88b 888 something here to enable a Facebook feature "888 888 888 888 888 888 Y8P or "hack" someone's account, it is a Y88b d88P Y88b. Y88..88P 888 d88P scam and will give them access to your "Y8888P" "Y888 "Y88P" 88888P" 888 Facebook account. 888 888 888 See https://www.facebook.com/selfxss https://www.facebook.com/selfxss for more information.
    - jMyles 11y ago

superkuh 11y ago

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser. I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not a solution. They say they'll be producing an "unbranded" non-walled garden version that for technical users but no such build has been revealed yet. And if they do make it the unbranded version won't be in my OS repos. This walled garden, the addition of Adobe EME/DRM, the bundling of "Pocket", and the incoming drop of XUL based extensions are too much.

cpeterso 11y ago
Chrome requires extensions to be both signed and distributed through Google's "Chrome Web Store". You can use the Firefox Developer Edition, which will continue to support the xpinstall.signatures.required preference allowing unsigned extensions.
- superkuh 11y ago
  "Chrome did it." isn't an excuse. It makes it worse, actually. Developer edition is "Aurora". Aurora is alpha. Alphas have more bugs. It's not reasonable to tell me to use an alpha.
  - notnarb 11y ago
    Have you actually used Aurora? I can only speak to my own experience, but I have found it far more stable than any other 'alpha' software I've used.
    - superkuh 11y ago
      Yes. When Firefox first announced their plans for the walled garden back near FF37/38 I did as everyone said and tried Aurora. It crashed on me twice in as many hours. I'm pretty hard on browsers since I typically have 200+ tabs loaded. That never happens with final release versions.

verusfossa 11y ago

I think this whole thing is a bad idea. They won't allow a scary opt-out button because some software could turn it on, don't allow about:config because it could be flipped, don't allow a build flag in stable because malware could flip it and build. I mean... by that logic, couldn't someone reskin and redistribute alpha or the 'unbranded' with malware? Firefox is so afraid of malware, yet it encourages users to store their passwords in plain text in the browser? It really feels like a landgrab and not anything anyone has been asking for. Firefox has to compete with the Chrome web store, but you can't burn your house down to save a room. What's left if Firefox becomes some centralized market akin to iOS, Windows Store, Play etc. Forced AMO signing flies in the face of the decentralized web. "Malware happened" and "Chrome does it" aren't really answers. I think getting backed into a corner has made Moz take risks with their ideology. Hopefully they give developers and users a lot more time to deal with the upcoming changes.

irq-1 11y ago
> It really feels like a landgrab and not anything anyone has been asking for. Benevolent DRM. Mozilla wants to control the software, even though users want to be in control. Plugins are the reason people always give for using Firefox. Justifying control by citing non-technical users is telling: users are to be managed and controlled; users aren't "us" but the other.

nabla9 11y ago

The goal should be to make Firefox brand maximally safe for average user. Recognizable name is important for non-technical users. Mozilla should take every effort to make browsing safe for anyone who uses browsers originating from mozilla.org. Even for average developers. There should be no way to trick people following instructions that disable add-on signing if they download and use something they know by the name "Firefox" What we want is separate no-brand Firefox build that follows Firefox closely. It should work exactly like Firefox including updates (except when it explicitly deviates) but have no name recognition or easy association to Firefox/Mozilla.org. In theory it could be automatic build from Firefox development team as long as it's impossible to download it from mozilla.org and associate it with the same site as Firefox unless you know what you are doing. Any bug or security issue arising form the deviant version should not have Firefox in the news headline.

yuhong 11y ago
I think Mozilla already will do something like this.

ck2 11y ago

Still stuck on Firefox 41, they broke too many extensions after that.

cm3 11y ago
I switched to ESR channel (38.5.2) but I don't know how I'm going to use a newer ESR when it moves to a broken release. Too many extensions stop working and XUL extensions are the essence of Firefox. Tried using Chrome but so much of the ux is different or incomplete to a Firefox user that it's impossible to feel at home.

tenfingers 11y ago

Add-On Signing which can be automated does provide very little added security for the user, and just serves as a big pain the butt for everyone else involved. I'm routinely questioned to do support for users, and I find malware extensions regularly installed in Chrome which has even stricter requirements. The other day I found a laptop with one extension that redirected google.com to a scraper. Chrome did EVEN include a drop-down warning just below the URL bar that the homepage was being currently redirected by an add-on. Did the user notice? Not a bit. In fact, Chrome adding a WARNING for it made me feel even more sad: they know this is going on. Is FF going to do the same? If I was an user with an extension that did that for whatever reason I wanted, I would be furious as hell to see an added warning which I need to disable (IF possible), and that will be ignored by most users anyway. Malware developers will just get by faster, so Mozilla will not be able to keep up with the list of addons to blacklist. At the same time, initial approvals for legitimate addons will get slower. Reporting issues with Addons is clearly insufficient as Chrome Store demonstrates. In fact, I'm also NOT ok with the idea that extensions can be blacklisted at all, in spite of that "added security" aura around it. By the same logic, if extensions are required to be signed, then blacklisting (and blacklisting updates) shouldn't be allowed to be disabled. And, let's remind ourselves, that most of the extensions I've seen installed were side-loaded with other software (with "extras") that was installed in the system with the same privileges of the browsers. So really, I do expect malware to simply patch the FF binary to either disable the check or change the public key, or change it entirely with a patched version. I do not support walled gardens of any kind. Use a fork.

kozukumi 11y ago

They have the EME build for people who don't want the DRM stuff so why can't they just offer a build with unsigned extensions allowed in a similar way? Yes it gets messy but they are making it so. I don't want to use a non-release (i.e. possibly buggy) version just so I can sideload an unsigned extension. Just offer a non-front-page build in the same way they do for EME and let's move on to more important things. Seriously Mozilla waste so much time and energy discussing all this stuff when it is patently obvious what the right thing to do is.

RubyPinch 11y ago
> so why can't they just offer a build with unsigned extensions allowed in a similar way? From the article that you are commenting on > at which point unbranded builds based on [...] release will be provided for testing. The article was 3 paragraphs long.
- kozukumi 11y ago
  Apologies, I didn't see release mentioned when I read the article.