6 ms·
If Mozilla hadn't locked down Firefox so much, the fix could have been as simple as going into about:config and flipping a switch to allow unsigned plugins.
by deogeo 8y ago
If Mozilla hadn't locked down Firefox so much, the fix could have been as simple as going into about:config and flipping a switch to allow unsigned plugins.
- makomk 8y agoApparently the switch to enable unsigned plugins does work in Tor Browser still - it just doesn't re-enable plugins that failed the signature check because the failure is cached somehow.
- gpm 8y agoSet `app.update.lastUpdateTime.xpi-signature-verification` to 0 and restart the browser to refresh the cache (on normal firefox).
- baku-fr 8y agoI did exactly that, it worked on Debian however not on Windows: 1. Type about:config in URL bar 2. Change xpinstall.signatures.required from true to false 3. Restart Firefox
- javagram 8y agoDebian modifies Firefox builds to set a build flag to allow this preference to work, I believe? The default Windows and Mac builds of Firefox ignore this preference.
- ishitatsuyuki 8y agoIt's the opposite: builds compiled from the source allows changing the flag, those builds from Mozilla have the option disabled.
- javagram 8y agoFWIW, since the original intent of the change to block unsigned plugins was to prevent third party software installers from adding malicious plugins without user consent, leaving a preference to toggle it back would have been pretty pointless as the third party installers could have just toggled the preference themselves (about:config is just some sort of easily modifiable data format on disk). TBH it’s not hard for me to think of ways Mozilla could have preserved user control even in the face of these constraints though. For instance, I already use a master password to encrypt/decrypt the password database in Firefox. Why not allow the master password to also protect the settings and store them encrypted so a third party can’t modify them?
- rightbyte 8y agoIf the malicious plugin or executable can write to disk it's probably to late anyway?
- deogeo 8y agoYeah, it could replace Firefox with the developer edition that allows unsigned plugins.
- Jonnax 8y agoIt was a significant issue for years. Mostly adware and things that replaced your default search engine.
- the8472 8y agothe solution is to help users remove the adware, not centralize control over addons
- jszymborski 8y agoYou're right, I think it just makes it less "gray". If Oracle bundles crapware with a Java installer that installs an unsigned plugin in Firefox, you can write a PR release to smooth things over. If the crapware uninstall Firefox, install Firefox Dev Edition, and installs the unsigned plugin, there's not much of a "gray" defence there.
- the8472 8y agoAdware came bundled with chrome itself (for the money), i.e. installing new browsers is not out of the question here. That excuse feels really flimsy and tailored to permit only the exact choices made and no other option. But there are other options, such as helping users to get rid of adware when it's detected in the browser. It would also result in a larger benefit of improving their system instead just the browser.
- 8y ago
- jopsen 8y ago> If Mozilla hadn't locked down Firefox so much.. Ordinary users would have 5 levels of toolbars!!! Installed by anti-virus apps, etc. Locking down can back fire, but think not that this wasn't done in the interest of most users.
- Vinnl 8y agoAnd if only my company would allow me to FTP into our servers directly I could hotfix a problem in production much faster. ...which is to say, it's a trade-off, and though you can disagree with the weight Mozilla assigned to the pros and cons, their reasoning was valid.