4 ms·

Probably because this workaround consists in deactivating add-on security.

by Yoric 8y ago

lugg 8y ago
Because it's not working right now..
- tfigment 8y ago
  Worked on my 2 android devices. Did not work on windows desktop. That needed the nightly or probably this build.
  - lugg 8y ago
    Referring to plugin security.
solarkraft 8y ago
And what's the problem with not having that? Does it suddenly make my installed extensions insecure? I (somewhat) get it for the standard windows user who gives admin rights to everything, but I think this crowd is a bit more aware of what they install.
curiousgal 8y ago
I haven't installed an add-on in years.
- klez 8y ago
  Then you're not affected. What's the matter?
  - chronogram 8y ago
    That means: the installation is a while old, installation security is not useful now because the add-ons were installed ages ago, but using them is.
    - curiousgal 8y ago
      Precisely.
rndgermandude 8y ago
No, it does not. David, this is just wrong. Existing add-ons do not become suddenly insecure. What it does is allow you to install add-ons not signed by mozilla. Essentially the same thing as installing software not originating from the iOS and/or Mac AppStore, or the Ubuntu/Fedora/etc distro repositories, or the Windows Store, or the Play Store. The signing stuff might protect some less tech-savvy users from installing "You need this codec to play this porn video" malware add-ons, same as the other walled gardens I listed do too (tho most I listed have still a door in the wall that you can unlock and open yourself, unlike Firefox Desktop). But that's it. It is a "seal of approval" scheme saying that mozilla reviewers decided something is secure enough and has an OK quality (and wasn't forced to remove by US laws/authorities courts yet), implemented using DRM. It reduces the chances that users will install something malicious by accident/incompetence. If users still run their add-ons from AMO, then there is no difference. Unless a bad actor can either MITM AMO connections or compromise the AMO servers. At which point the users has a lot more problems already than potentially malicious browser add-ons.
yellowapple 8y ago
Last I checked Firefox still gives at least a warning + confirmation dialog if you try to install an unsigned / improperly signed extension with xpinstall.signatures.required = false, no?

Probably because this workaround consists in deactivating add-on security.

by Yoric 8y ago

Probably because this workaround consists in deactivating add-on security.

lugg 8y ago

Because it's not working right now..

tfigment 8y ago
Worked on my 2 android devices. Did not work on windows desktop. That needed the nightly or probably this build.
- lugg 8y ago
  Referring to plugin security.

solarkraft 8y ago

And what's the problem with not having that? Does it suddenly make my installed extensions insecure? I (somewhat) get it for the standard windows user who gives admin rights to everything, but I think this crowd is a bit more aware of what they install.

curiousgal 8y ago

I haven't installed an add-on in years.

klez 8y ago
Then you're not affected. What's the matter?
- chronogram 8y ago
  That means: the installation is a while old, installation security is not useful now because the add-ons were installed ages ago, but using them is.
  - curiousgal 8y ago
    Precisely.

rndgermandude 8y ago

No, it does not. David, this is just wrong. Existing add-ons do not become suddenly insecure. What it does is allow you to install add-ons not signed by mozilla. Essentially the same thing as installing software not originating from the iOS and/or Mac AppStore, or the Ubuntu/Fedora/etc distro repositories, or the Windows Store, or the Play Store. The signing stuff might protect some less tech-savvy users from installing "You need this codec to play this porn video" malware add-ons, same as the other walled gardens I listed do too (tho most I listed have still a door in the wall that you can unlock and open yourself, unlike Firefox Desktop). But that's it. It is a "seal of approval" scheme saying that mozilla reviewers decided something is secure enough and has an OK quality (and wasn't forced to remove by US laws/authorities courts yet), implemented using DRM. It reduces the chances that users will install something malicious by accident/incompetence. If users still run their add-ons from AMO, then there is no difference. Unless a bad actor can either MITM AMO connections or compromise the AMO servers. At which point the users has a lot more problems already than potentially malicious browser add-ons.

yellowapple 8y ago

Last I checked Firefox still gives at least a warning + confirmation dialog if you try to install an unsigned / improperly signed extension with xpinstall.signatures.required = false, no?