4 ms·

You're better off waiting a few more hours that disabling important security features.

by jopsen 8y ago

feanaro 8y ago
We've lived without the walled garden for more than 10 years, I'm sure we can manage a few more days.
jackewiehose 8y ago
Disabling all add-ons doesn't help security either. So far I have neither an update on ubuntu-desktop nor on android (with default package managers) so without this option I'm supposed to use the internet without adblock & umatrix? lol no thx
deadbunny 8y ago
Disabling noscript is a bigger security issue.
- AstralStorm 8y ago
  It only got disabled if you installed the version from addons.mozilla.org and not the noscript.net. Some sort of pinning mechanism would be nice though without having to rely on manual installs and signing. It's a trade-off, you could end up with a version having a gaping security hole.
userbinator 8y ago
The only "security" it provided was to prevent people from installing add-ons that Mozilla didn't approve of, ostensibly ones it thinks are malicious, and I'd bet that on Android (which has its own app isolation features anyway) that's even less of a problem.
- AstralStorm 8y ago
  Not exactly. You can install add-ons from outside of Mozilla add-ons site. The extra certificate is more of Mozilla's seal of approval. This is why quite a few of my add-ons were not disabled - they were installed with trust from another site and this intermediate certificate was never in chain. You could even manually sign these add-ons you trust with custom imported CA key for your personal or corporare vetting.
wvenable 8y ago
Given that all my extensions are privacy and/or adblocking features -- that seems unlikely. I can re-activate it when the Mozilla fixes the issue.
tripzilch 8y ago
My add-ons are more important security features, that are needed right now, whereas the signing thing only protects when you install a new add-on from an unreliable source. (EDIT: it actually only applies for add-ons installed from the Mozilla add-on store website ... silly me for trusting that place) Come to think of it, why did my add-ons get disabled, given that they already had been checked against the signing key when they got installed? Why is this (literally, it seems) being checked constantly instead of only when something about the add-ons changes?

You're better off waiting a few more hours that disabling important security features.

by jopsen 8y ago

You're better off waiting a few more hours that disabling important security features.

feanaro 8y ago

We've lived without the walled garden for more than 10 years, I'm sure we can manage a few more days.

jackewiehose 8y ago

Disabling all add-ons doesn't help security either. So far I have neither an update on ubuntu-desktop nor on android (with default package managers) so without this option I'm supposed to use the internet without adblock & umatrix? lol no thx

deadbunny 8y ago

Disabling noscript is a bigger security issue.

AstralStorm 8y ago
It only got disabled if you installed the version from addons.mozilla.org and not the noscript.net. Some sort of pinning mechanism would be nice though without having to rely on manual installs and signing. It's a trade-off, you could end up with a version having a gaping security hole.

userbinator 8y ago

The only "security" it provided was to prevent people from installing add-ons that Mozilla didn't approve of, ostensibly ones it thinks are malicious, and I'd bet that on Android (which has its own app isolation features anyway) that's even less of a problem.

AstralStorm 8y ago
Not exactly. You can install add-ons from outside of Mozilla add-ons site. The extra certificate is more of Mozilla's seal of approval. This is why quite a few of my add-ons were not disabled - they were installed with trust from another site and this intermediate certificate was never in chain. You could even manually sign these add-ons you trust with custom imported CA key for your personal or corporare vetting.

wvenable 8y ago

Given that all my extensions are privacy and/or adblocking features -- that seems unlikely. I can re-activate it when the Mozilla fixes the issue.

tripzilch 8y ago

My add-ons are more important security features, that are needed right now, whereas the signing thing only protects when you install a new add-on from an unreliable source. (EDIT: it actually only applies for add-ons installed from the Mozilla add-on store website ... silly me for trusting that place) Come to think of it, why did my add-ons get disabled, given that they already had been checked against the signing key when they got installed? Why is this (literally, it seems) being checked constantly instead of only when something about the add-ons changes?