4 ms·
You can if you use the Developer Edition. It's permanently disabled in the normal version because malware would piggyback on the browser to steal passwords and
by TazeTSchnitzel 8y ago
You can if you use the Developer Edition.
It's permanently disabled in the normal version because malware would piggyback on the browser to steal passwords and so on. Obviously Mozilla have no problem with people wanting to make their own extensions and so on.
- Krasnol 8y agoWeird, I have 63.0.3 as far as I see the normal version and had no problem downloading and with that updating the November version of "bypass-paywalls" which was also affected from the releases page here: https://github.com/iamadamdev/bypass-paywalls-firefox/releases https://github.com/iamadamdev/bypass-paywalls-firefox/releas...
- TazeTSchnitzel 8y agoThat means it's signed with Mozilla's signature. Actually, I think extensions can maybe be signed by Mozilla even if they're not on addons.mozilla.org.
- totfz 8y agoYes, but Mozilla will refuse to sign extensions that are not hosted in their app store.
- falien 8y agoNo they wont (and don't) but it's possible they will choose to not sign these extensions, probably depending on their lawyers.
- fbender 8y agoTheir addon tool includes a well documented facility to sign an extension without listing it in the addon store so you can host it somewhere else. This can e.g. be used for company-internal extensions.
- zaarn 8y agoAddons can be unlisted, ie, they don't show up on a.m.o but you can download and install them as normal.
- techload 8y agoThanks for the link. Installed without problems.
- quarterlyresult 8y agoI wonder to what extent that helps prevent malware from installing a malicious addon to Firefox, because by using the same mechanism as cheating in video games, you can hot-patch a running browser process to disable the functionality to keep it from installing unsigned addons. Technically, in Windows you would just call WriteProcessMemory to modify memory content of another process.
- fbender 8y agoIt‘s the injection vector. People used to sideload malicious addons a lot by „accident“ when a rogue website told them to („You must install X player to see this video. Click here …“).
- zcid 8y agoWould it be difficult to set up a list of allowed signatures in Firefox? By making it unintuitive for the average user to modify, you would prevent most bad actors from succeeding but still allow power users to control their own experience.
- fbender 8y ago„This cool trick gives your Firefix super powers“ articles will appear instantly. This happened before with noobs following instructions to copy & paste code into the developer console(!), which pwned quite a few Facebook (and other) accounts. Same for banking websites, intranets, … social engineering works well on the unsuspecting. This is btw why browser vendors implemented measurements to make it harder to copy & paste into the dev console, as well as disallowed pasting „javascript:“ URLs to the address bar.
- superkuh 8y agoTelling people to use a buggy beta is not acceptable. This is anti-user and pro-corporation.
- Spivak 8y agoFirefox Developer Edition isn't beta.
- AnaniasAnanas 8y agoIsn't the developer edition the replacement for Aurora? (which is supposed to be more unstable than beta)
- fbender 8y agoAurora is no more because it was not necessary for stability (when nightly merges to beta it is already very stable, this improved a lot over time) and incurred a cost on speed of development (one less stop for the train to ride). DevEdition is now based on Beta and extremely stable. I use it alongside the stable version on both of my main computers in an equal way and I have max. 1-2 issues in DevEdition in a year (and those issues do not even prevent me from doing my work).