5 ms·

Genuine question: can Mozilla prevent Firefox from allowing an extension to be installed _at all_, or is this more a matter of de-listing an extension from the

by Arubis 7y ago

Genuine question: can Mozilla prevent Firefox from allowing an extension to be installed _at all_, or is this more a matter of de-listing an extension from the Mozilla directory?

vengefulduck 7y ago
It depends on the version most release builds of Firefox require addons to be signed by Mozilla with the exception on Linux and developer versions. You can also change this by compiling yourself.
- Arubis 7y ago
  While I was initially pretty shocked that Mozilla would make a walled-garden move like this, doing it on the mainline release (for a primarily non-technical audience) and not holding the same requirement on dev and nightly builds actually feels like an appropriate balance, if that is indeed accurate. Probably near 100% of Tridactyl users would be comfortable on at least the dev version of FF; it may be that an appropriate remediation would be to offer the `fixamo` functionality on an unsigned extension release only.
  - callahad 7y ago
    Vengefulduck's description is accurate: 1. Signing is required via a compile-time flag for official builds of Firefox and Firefox Beta. 2. Signing is optional in other builds of Firefox (Unbranded, Developer Edition, and Nightly), and follows the `xpinstall.signatures.required` user preference. 3. On Linux, add-ons installed in `/usr/{lib,share}/mozilla/extensions` are exempt from signing. 4. Add-ons manually loaded via "Load Temporary Add-on" in about:debugging are also exempt from signing.
  - TazeTSchnitzel 7y ago
    It's accurate. Mozilla's intention was that Firefox couldn't be exploited by malware installing dodgy extensions, thus they want most people's installs of Firefox to reject unsigned extensions. But people who know what they're doing are free to download unsigned unbranded builds.
  - bovine3dom 7y ago
    FWIW, I tried the dev edition (which is essentially Firefox beta) but I stopped using it as I kept running into bugs. A release that wasn't more buggy but allowed unsigned extensions would be nice.
    - mplanchard 7y ago
      I have been using exclusively dev and nightly for at least two years, and have only very occasionally run into issues. Of course, my usage is pretty typical web browsing, outside of using the dev tools. It’s been long enough now that the normal colorful Firefox logo seems weird.
    - A1kmm 7y ago
      I wrote this to help with that exact same problem: https://github.com/A1kmm/enable-unsigned-firefox-addons https://github.com/A1kmm/enable-unsigned-firefox-addons
ihuman 7y ago
Yes. All extensions have to be signed by Mozilla, even if they're distributed outside their directory. The only way would be able to install it is by downloading an unzipped version and sideloading it. However, it will be removed if you restart firefox, and you will have to re-add it.
- deleted 7y ago
  [deleted]
rebelwebmaster 7y ago
There's a built-in extension blocklist which also gets updated remotely. https://hg.mozilla.org/mozilla-central/file/tip/browser/app/blocklist.xml https://hg.mozilla.org/mozilla-central/file/tip/browser/app/...
- Mathnerd314 7y ago
  More on the policy for said blocklist: https://wiki.mozilla.org/Blocklisting https://wiki.mozilla.org/Blocklisting (2008-11) https://support.mozilla.org/en-US/kb/add-ons-cause-issues-are-on-blocklist https://support.mozilla.org/en-US/kb/add-ons-cause-issues-ar... (2012) https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/AMO/Blocking_Process https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/AMO... (2019) The expansion from "we block malicious add-on versions" to "we block add-ons with known stability or security issues" to "we err on the side of security" does not bode well for the future of hacking cool add-ons.
  - michaelmrose 7y ago
    What about a fork that only differs in allowing a second more permissive addon store.
    - SanchoPanda 7y ago
      Settings change over time and maintaing any fork is hard. Maintaining a fork of a modern browser is a sisyphian task. Even compiling it is no joke.
- Arubis 7y ago
  This is more what I’m concerned about. Does this only affect mainline FF or dev/nightly as well?

by Arubis 7y ago

Genuine question: can Mozilla prevent Firefox from allowing an extension to be installed _at all_, or is this more a matter of de-listing an extension from the Mozilla directory?

vengefulduck 7y ago

It depends on the version most release builds of Firefox require addons to be signed by Mozilla with the exception on Linux and developer versions. You can also change this by compiling yourself.

Arubis 7y ago
While I was initially pretty shocked that Mozilla would make a walled-garden move like this, doing it on the mainline release (for a primarily non-technical audience) and not holding the same requirement on dev and nightly builds actually feels like an appropriate balance, if that is indeed accurate. Probably near 100% of Tridactyl users would be comfortable on at least the dev version of FF; it may be that an appropriate remediation would be to offer the `fixamo` functionality on an unsigned extension release only.
- callahad 7y ago
  Vengefulduck's description is accurate: 1. Signing is required via a compile-time flag for official builds of Firefox and Firefox Beta. 2. Signing is optional in other builds of Firefox (Unbranded, Developer Edition, and Nightly), and follows the `xpinstall.signatures.required` user preference. 3. On Linux, add-ons installed in `/usr/{lib,share}/mozilla/extensions` are exempt from signing. 4. Add-ons manually loaded via "Load Temporary Add-on" in about:debugging are also exempt from signing.
- TazeTSchnitzel 7y ago
  It's accurate. Mozilla's intention was that Firefox couldn't be exploited by malware installing dodgy extensions, thus they want most people's installs of Firefox to reject unsigned extensions. But people who know what they're doing are free to download unsigned unbranded builds.
- bovine3dom 7y ago
  FWIW, I tried the dev edition (which is essentially Firefox beta) but I stopped using it as I kept running into bugs. A release that wasn't more buggy but allowed unsigned extensions would be nice.
  - mplanchard 7y ago
    I have been using exclusively dev and nightly for at least two years, and have only very occasionally run into issues. Of course, my usage is pretty typical web browsing, outside of using the dev tools. It’s been long enough now that the normal colorful Firefox logo seems weird.
  - A1kmm 7y ago
    I wrote this to help with that exact same problem: https://github.com/A1kmm/enable-unsigned-firefox-addons https://github.com/A1kmm/enable-unsigned-firefox-addons

ihuman 7y ago

Yes. All extensions have to be signed by Mozilla, even if they're distributed outside their directory. The only way would be able to install it is by downloading an unzipped version and sideloading it. However, it will be removed if you restart firefox, and you will have to re-add it.

deleted 7y ago
[deleted]

rebelwebmaster 7y ago

There's a built-in extension blocklist which also gets updated remotely. https://hg.mozilla.org/mozilla-central/file/tip/browser/app/blocklist.xml https://hg.mozilla.org/mozilla-central/file/tip/browser/app/...

Mathnerd314 7y ago
More on the policy for said blocklist: https://wiki.mozilla.org/Blocklisting https://wiki.mozilla.org/Blocklisting (2008-11) https://support.mozilla.org/en-US/kb/add-ons-cause-issues-are-on-blocklist https://support.mozilla.org/en-US/kb/add-ons-cause-issues-ar... (2012) https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/AMO/Blocking_Process https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/AMO... (2019) The expansion from "we block malicious add-on versions" to "we block add-ons with known stability or security issues" to "we err on the side of security" does not bode well for the future of hacking cool add-ons.
- michaelmrose 7y ago
  What about a fork that only differs in allowing a second more permissive addon store.
  - SanchoPanda 7y ago
    Settings change over time and maintaing any fork is hard. Maintaining a fork of a modern browser is a sisyphian task. Even compiling it is no joke.
Arubis 7y ago
This is more what I’m concerned about. Does this only affect mainline FF or dev/nightly as well?