3 ms·
Exactly. If me/firefox has verified the signature (or approved the download) when downloading or updating the addon, that should be all that's necessary. Why do
by swalladge 7y ago
Exactly. If me/firefox has verified the signature (or approved the download) when downloading or updating the addon, that should be all that's necessary. Why does firefox have to check signatures constantly?
- egwor 7y agoin case it was revoked? Seems fairly reasonable approach
- TeMPOraL 7y agoDisabling with no option of user override is not reasonable. It only creates unnecessary dependency on third parties. When product recalls happen, the manufacturer isn't taking your product away by force.
- hinkley 7y agoI worked on a code signing system a number of years ago and it was surprising the degree to which I had to rearrange the logic and the tool chain in order to get high code coverage on all the failure modes. IIRC one of the tools wouldn’t let me work with expired certs. I can’t recall now whether I fixed that or made carts that expire in ten seconds and just waited it out. Anyway, a number of people weren’t even sure why I was going through the trouble. It’s easier to get something wrong than it should be (super obtuse APIs) and you don’t always get enough support or pushback to get everything absolutely right.