6 ms·

The idea is to protect users, not hurt them in any way. Anyone can sign and run their own add-ons, or offer those add-ons for others to use. The only thing be

by tux1968 8y ago

The idea is to protect users, not hurt them in any way. Anyone can sign and run their own add-ons, or offer those add-ons for others to use. The only thing being restricted now is who can distribute their addons via addons.mozilla.org, which seems more than fair.

Endy 8y ago
The idea might be good. The execution is harmful to users, and they refuse to roll it back. That's all that matters. Mozilla has shown this pattern consistently - they have an idea they think will be good for people, and when it ends up being hurtful and damaging not only the core product but the userbase - driving more people to alternate browsers - they steadfastly refuse to see what's going on around them. Frankly, those of us who went to Pale Moon may as well have been the last rats off a sinking ship.
- __david__ 8y ago
  > The idea might be good. The execution is harmful to users, and they refuse to roll it back. Howso? I've been using FF forever and I didn't notice this change…
  - Endy 8y ago
    I'm glad that all of the addons you use are the ones they've approved of and which haven't been made incompatible by any of the major breaking changes they've introduced in the last few years.
    - rrix2 8y ago
      Those seem like two entirely unrelated issues
      - rhizome 8y ago
        I don't know the whole story, but I'm inferring that the signing change affected the ability for people to sideload plugins.
        rrix2 8y ago
        That had nothing to do with the move to WebExtensions and the associated compatibility issues though...
        Endy 8y ago
        I feel that Mozilla's misdirection is one very large issue encompassing many problems.
  - kibwen 8y ago
    The fact that this benign comment is so downvoted says a lot about the sort of people who are brigading this thread.
- kalenx 8y ago
  Firefox is still a terrific browser. Compared to forks like PaleMoon I would even say that it is now much better given the continuous improvements we've seen with quantum and others. I definitely do not agree with Mozilla on everything, but stating that they are harming their userbase based on your single point of view is moot, to say the least. And Firefox, a sinking ship with not even rats on board anymore? Come on now.
- oconnor663 8y ago
  > The execution is harmful to users Do you have a source for that? Moz has a ton of data about how harmful to users it was to have an ecosystem full of trashy spam extensions. The leap from "this solution has some downsides" to "this solution's downsides outweigh its upsides" is skipping the most important part of the question.
  - JadeNB 8y ago
    > Moz has a ton of data about how harmful to users it was to have an ecosystem full of trashy spam extensions. I wish that this data were available somewhere—not this specific data, but in general. Mozilla's response to community push-back is always "trust us, the data show that this is what's best". If you trust them already, then that might be good enough; but, when this is always their first, and often their only, response to push-back, it's hard to distinguish it from the empty response of someone with no data who wants to avoid questions.
    - oconnor663 8y ago
      That's fair, but I want to highlight the world of difference between "dubious behavior" and "it would be nice if we had your data to check your conclusions." I'm not with Mozilla, but when I've been in a similar position, it's deeply frustrating to read stuff like this on the internet. (So the healthy thing is really to just stop reading it, which is a shame.)
      - Endy 8y ago
        I consider the fact that they're hiding the data and using it as a smoke-screen to do whatever the corporate side would like to do at the time or an excuse to play with whatever side project the head dev en vogue was playing with, regardless of what the userbase wants and needs to be 'dubious' from the start. So the world of difference is a non-starter in my book. Frankly, there needs to be more community input, more opportunity to speak & act against wrongheadedness. It's part of why I prefer Pale Moon. If something is asinine, I can talk to the head dev and the team. They'll either show the community their sources for making a change or put it to a vote of the active users.
zeta0134 8y ago
If it was just distribution through the add-on app store, that would be one thing. As of Firefox 48 however, in stable builds of Firefox, unsigned addons (which haven't gone through Mozilla's review process) cannot be installed. Period. The about:config setting meant to override signature checks (and allow third-party extensions), `xpinstall.signatures.required`, is plainly ignored in stable versions from this point forward, so it's AMO or bust. The only way to install an unsigned extension is to install the Beta or Developer builds of Firefox, which still honor the above setting. Or, I suppose, to use one of the many forks of the Firefox codebase that restore user choice.
- Semaphor 8y ago
  You skipped over a part: > Anyone can sign and run their own add-ons, or offer those add-ons for others to use. And this is consistent with what Mozilla says here: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Distribution https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Dis...
  - zeta0134 8y ago
    The specific pain point we ran into was a security consideration: my company needed to sign and distribute a private internal extension whose code betrayed the layout of an internal API. The signing process for stable Firefox requires uploading the extension to AMO, which our management was not crazy about. Sure, anyone can technically do it, but the dependence on a third party service is still there. Ultimately we decided to do it anyway, figuring that the cost of having our support floor run a non-stable browser outweighed the risk of a code leak at Mozilla. But the whole process left a bad taste. I get where they're coming from, really I do. Malware is a huge problem and the average user has zero clue how to vet extension code. I dunno, I have mixed feelings about the solution. I'm not sure if there's a middle ground to be had.
    - Semaphor 8y ago
      > figuring that the cost of having our support floor run a non-stable browser Firefox Developer Edition is stable but supports unsigned addons. But I can certainly see your point.
vbezhenar 8y ago
I can download an arbitrary exe file and run it with a few clicks. It can do anything, install rootkit in my BIOS and of course completely replace Firefox.exe or anything else. What's the reasoning to forbid me to download and run addon? I can already shot myself, very easily. Additional protection does not do any good, only harms users.
- dancek 8y ago
  People don't seem to understand how dangerous browser add-ons are. Protecting people from eg. malicious add-ons emptying their bank accounts is probably one of the reasons for restricting add-ons. However, restricting add-on installations to a community-moderated app store model is not a secure enough way to do it. It's hard to prove that it helps at all, but it sure is annoying.
  - vbezhenar 8y ago
    What prevents malware from injecting itself into Firefox process, hook few functions and empty bank accounts? Browser addons are dangerous, sure. But everything is dangerous. I'd say that malware is more dangerous than browser addons. Yet I'm living in a world where it's ridiculously easy to run an arbitrary exe file. Why Firefox wants to make it different for addons? I could understand those measures for iOS Firefox version. May be Firefox could mimic macOS behaviour (need right click to run unsigned app). But making walled garden in the world where everyone can just jump over that fence does not make any sense for me.

Endy 8y ago

The idea might be good. The execution is harmful to users, and they refuse to roll it back. That's all that matters. Mozilla has shown this pattern consistently - they have an idea they think will be good for people, and when it ends up being hurtful and damaging not only the core product but the userbase - driving more people to alternate browsers - they steadfastly refuse to see what's going on around them. Frankly, those of us who went to Pale Moon may as well have been the last rats off a sinking ship.

__david__ 8y ago
> The idea might be good. The execution is harmful to users, and they refuse to roll it back. Howso? I've been using FF forever and I didn't notice this change…
- Endy 8y ago
  I'm glad that all of the addons you use are the ones they've approved of and which haven't been made incompatible by any of the major breaking changes they've introduced in the last few years.
  - rrix2 8y ago
    Those seem like two entirely unrelated issues
    - rhizome 8y ago
      I don't know the whole story, but I'm inferring that the signing change affected the ability for people to sideload plugins.
      - rrix2 8y ago
        That had nothing to do with the move to WebExtensions and the associated compatibility issues though...
        Endy 8y ago
        I feel that Mozilla's misdirection is one very large issue encompassing many problems.
- kibwen 8y ago
  The fact that this benign comment is so downvoted says a lot about the sort of people who are brigading this thread.
kalenx 8y ago
Firefox is still a terrific browser. Compared to forks like PaleMoon I would even say that it is now much better given the continuous improvements we've seen with quantum and others. I definitely do not agree with Mozilla on everything, but stating that they are harming their userbase based on your single point of view is moot, to say the least. And Firefox, a sinking ship with not even rats on board anymore? Come on now.
oconnor663 8y ago
> The execution is harmful to users Do you have a source for that? Moz has a ton of data about how harmful to users it was to have an ecosystem full of trashy spam extensions. The leap from "this solution has some downsides" to "this solution's downsides outweigh its upsides" is skipping the most important part of the question.
- JadeNB 8y ago
  > Moz has a ton of data about how harmful to users it was to have an ecosystem full of trashy spam extensions. I wish that this data were available somewhere—not this specific data, but in general. Mozilla's response to community push-back is always "trust us, the data show that this is what's best". If you trust them already, then that might be good enough; but, when this is always their first, and often their only, response to push-back, it's hard to distinguish it from the empty response of someone with no data who wants to avoid questions.
  - oconnor663 8y ago
    That's fair, but I want to highlight the world of difference between "dubious behavior" and "it would be nice if we had your data to check your conclusions." I'm not with Mozilla, but when I've been in a similar position, it's deeply frustrating to read stuff like this on the internet. (So the healthy thing is really to just stop reading it, which is a shame.)
    - Endy 8y ago
      I consider the fact that they're hiding the data and using it as a smoke-screen to do whatever the corporate side would like to do at the time or an excuse to play with whatever side project the head dev en vogue was playing with, regardless of what the userbase wants and needs to be 'dubious' from the start. So the world of difference is a non-starter in my book. Frankly, there needs to be more community input, more opportunity to speak & act against wrongheadedness. It's part of why I prefer Pale Moon. If something is asinine, I can talk to the head dev and the team. They'll either show the community their sources for making a change or put it to a vote of the active users.

zeta0134 8y ago

If it was just distribution through the add-on app store, that would be one thing. As of Firefox 48 however, in stable builds of Firefox, unsigned addons (which haven't gone through Mozilla's review process) cannot be installed. Period. The about:config setting meant to override signature checks (and allow third-party extensions), `xpinstall.signatures.required`, is plainly ignored in stable versions from this point forward, so it's AMO or bust. The only way to install an unsigned extension is to install the Beta or Developer builds of Firefox, which still honor the above setting. Or, I suppose, to use one of the many forks of the Firefox codebase that restore user choice.

Semaphor 8y ago
You skipped over a part: > Anyone can sign and run their own add-ons, or offer those add-ons for others to use. And this is consistent with what Mozilla says here: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Distribution https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Dis...
- zeta0134 8y ago
  The specific pain point we ran into was a security consideration: my company needed to sign and distribute a private internal extension whose code betrayed the layout of an internal API. The signing process for stable Firefox requires uploading the extension to AMO, which our management was not crazy about. Sure, anyone can technically do it, but the dependence on a third party service is still there. Ultimately we decided to do it anyway, figuring that the cost of having our support floor run a non-stable browser outweighed the risk of a code leak at Mozilla. But the whole process left a bad taste. I get where they're coming from, really I do. Malware is a huge problem and the average user has zero clue how to vet extension code. I dunno, I have mixed feelings about the solution. I'm not sure if there's a middle ground to be had.
  - Semaphor 8y ago
    > figuring that the cost of having our support floor run a non-stable browser Firefox Developer Edition is stable but supports unsigned addons. But I can certainly see your point.

vbezhenar 8y ago

I can download an arbitrary exe file and run it with a few clicks. It can do anything, install rootkit in my BIOS and of course completely replace Firefox.exe or anything else. What's the reasoning to forbid me to download and run addon? I can already shot myself, very easily. Additional protection does not do any good, only harms users.

dancek 8y ago
People don't seem to understand how dangerous browser add-ons are. Protecting people from eg. malicious add-ons emptying their bank accounts is probably one of the reasons for restricting add-ons. However, restricting add-on installations to a community-moderated app store model is not a secure enough way to do it. It's hard to prove that it helps at all, but it sure is annoying.
- vbezhenar 8y ago
  What prevents malware from injecting itself into Firefox process, hook few functions and empty bank accounts? Browser addons are dangerous, sure. But everything is dangerous. I'd say that malware is more dangerous than browser addons. Yet I'm living in a world where it's ridiculously easy to run an arbitrary exe file. Why Firefox wants to make it different for addons? I could understand those measures for iOS Firefox version. May be Firefox could mimic macOS behaviour (need right click to run unsigned app). But making walled garden in the world where everyone can just jump over that fence does not make any sense for me.