5 ms·

Meanwhile Mozilla is attempting to prevent users with administrative access from installing private extensions in the release version of Firefox, extensions for

Meanwhile Mozilla is attempting to prevent users with administrative access from installing private extensions in the release version of Firefox, extensions for which the source code has not been handed over to Mozilla for signing. https://bugzilla.mozilla.org/show_bug.cgi?id=1514451 https://bugzilla.mozilla.org/show_bug.cgi?id=1514451

st3fan 7y ago
Yes whenever Mozilla announces something exciting that could get some positive feedback, be sure to use the opportunity to complain about something unrelated.
- dessant 7y ago
  Locking down Firefox to not allow installing private extensions is not unrelated to extension support.
  - Spivak 7y ago
    So install the developer edition? Yes it’s a little more annoying for people who want private extensions but you’re forgetting that we’re in a small minority and this change is a massive win for security and privacy overall. This site is full of threads talking about how friends, family, and coworkers’ browsers are riddled with badware that was installed behind their backs.
    - dessant 7y ago
      Again, this change prevents regular users from configuring Firefox the way they want. We should not need to install the developer edition, which is based on Firefox Beta, or an unbranded build that does not auto-update to be able to run local extensions in our browsers. Not even Google is this heavy-handed, they allow installing local extensions in Chrome after users enable an option, although a warning is shown on browser restarts about the presence of external extensions, which can be dismissed. Why not have sensible defaults, then educate and warn users about certain actions, instead of treating them like cattle?
      - Vinnl 7y ago
        You can load local extensions in Firefox as well with warnings: https://developer.mozilla.org/en-US/docs/Tools/about:debugging#This_Firefox https://developer.mozilla.org/en-US/docs/Tools/about:debuggi... And has been pointed out in most of these threads, the reason for not allowing people to circumvent some things is because that also allows malicious software to circumvent it.
        dessant 7y ago
        > You can load local extensions in Firefox as well with warnings Extensions loaded in about:debugging are not persistent, they are removed at the end of the browsing session. > And has been pointed out in most of these threads, the reason for not allowing people to circumvent some things is because that also allows malicious software to circumvent it. Yes, and the discussion mostly ends after people point out that malware if free to circumvent extension signing in any number of ways when it has root access on the device. The threat model is flawed, or at the very least they're placing minimal security benefits above important user liberties. Forcing extension signing by default is a great initiative, but we must be given ways to override defaults, guarded by administrative access and appropiate warnings, and be able to install local extensions in the browser we love, and that is the release version of Firefox.
        Vinnl 7y ago
        > when it has root access on the device. But that's a big if. Extensions can be installed without root access, and can wreck a lot of havoc. I'd also dare to state the the organisation with the best insight into the extent of security benefits is the organisation that has data on the number and nature of exploits, i.e. Mozilla. > we must be given ways to override defaults, guarded by administrative access and appropiate warnings, and be able to install local extensions Guarded by administrative access sounds reasonable, and I think that's even already possible with Firefox ESR? I'd also consider an unbranded version of Firefox equal to the branded one, with the unbrandedness being an "appropriate warning". It does need to support auto-updating first, though.
  - Jonnax 7y ago
    It must be so frustrating working in open source and seeing such entitled comment such as yours. Malware extensions is a real problem that affects literally millions more people than people who want to use the standard Firefox release with an unsigned extension. And it's such a lazy thing to say "oh they can just replace the Firefox binary" when that's clearly a significantly more complex task than just writing an extension. What's so secret about your extension code that you want to be able to distribute it to users without getting it reviewed by Mozilla? You posted on that Bugzilla post but gave no details as to what your use case is. Also why can't a user take the code for your extension, create an account on the add-on marketplace and privately get it signed for themselves. It's a multistep process but works.
    - dessant 7y ago
      I gave more details about my use case here: https://github.com/jeremiahlee/page-translator/issues/26#issuecomment-545170847 https://github.com/jeremiahlee/page-translator/issues/26#iss... Though its worth noting that we do not need reasons to expect our privacy being respected. And this issue is not just about me and my needs, but about user liberties, so please refrain from making it personal. > Also why can't a user take the code for your extension, create an account on the add-on marketplace and privately get it signed for themselves. It's a multistep process but works. No, it does not work, as the maintainer of Page Translator can attest. https://github.com/jeremiahlee/page-translator/issues/26 https://github.com/jeremiahlee/page-translator/issues/26 This change is hostile to users and concentrates power in the hands of the browser vendor. Consider that they are making third-party extension stores impossible.
      - Vinnl 7y ago
        > No, it does not work, as the maintainer of Page Translator can attest. > > https://github.com/jeremiahlee/page-translator/issues/26 https://github.com/jeremiahlee/page-translator/issues/26 Ouch. I'm generally in favour of having add-ons signed, but I do have an extension that injects an external script into the browser and web pages - for a completely non-nefarious use case. I do understand the security risk and why they'd block it, but I'm not looking forward to the day my extension is no longer flying under the radar and gets pulled. Edit: Of note is that the Chrome web-store does allow my extension, but requires a multi-week review every time I upload a new version. Somehow they're fine with the remote code, even though it could change after their review.
- mcny 7y ago
  Speaking of something unrelated, I wish the walled gardens (Apple and Google) required developers to hand over source code and machine readable build instructions so the apps get built on their servers.
- ahbyb 7y ago
  The Mozilla Corporation is the only entity that can save us from Google; I can't blame people for getting salty whenever they screw up (which seems to be pretty often). Given that the leadership of the Mozilla Corporation is completely useless, users have the responsibility to raise these issues so we can push them to fix them.
  - deleted 7y ago
    [deleted]
- dessant 7y ago
  It is related to extension support in Firefox. Not offering any way to override this option, even if it takes 10 steps and it is marked by warnings, is hostile to users. We will continue to raise awareness of Mozilla's actions whenever we believe they go against the public good. It would be more productive to allow others to learn about the issue and give us a chance to have a public discourse about it, where technical details can be explained and their threat model shared, and possibly allow for feedback by the community to shape the final implementation.
Spivak 7y ago
Because “user with administrative access” also describes software installers “helpfully” installing their add-on into the browser. This continues the long trend of browsers not trusting the underlying OS to actually protect users from soft-malware.
- dessant 7y ago
  Malware will have an unlimited number of methods to continue patching Firefox, this change only makes it harder for regular users to configure Firefox manually for installing extensions that have not been blessed by Mozilla.
  - bepvte 7y ago
    Binary patching a software that has its exe signed by mozilla is very impossible without it triggering smartscreen or alerting users
  - Spivak 7y ago
    The target for this has never really been outright malware but it does make it far more annoying for them. The target is badware or bundleware where a few missed checkboxes means users with 15 different spyware add-ons “search fixers” or ad-injectors. These grey-market apps aren’t suddenly going to jump the ship into actual malware and binary patch Firefox. I feel like the people we consider ”regular users” to be really different. Like we’re talking about a subset of the population that want’s to install their own private extensions or sideload someone else’s but doesn’t understand how to uninstall the release version and install the developer edition when prompoted.
    - dessant 7y ago
      Adware will continue to be able to legally circumvent extension signing when it has root access and consent by the user. This only makes it prohibitive for users to customize their own browsers. It's also possible to make this setting configurable only from the browser UI, where you get a chance to educate and properly warn your users. They also want to restrict the config option on Linux, where the adware problem you describe is not really present.
cyborgx7 7y ago
Every single time. Give it a rest already.

st3fan 7y ago

Yes whenever Mozilla announces something exciting that could get some positive feedback, be sure to use the opportunity to complain about something unrelated.

dessant 7y ago
Locking down Firefox to not allow installing private extensions is not unrelated to extension support.
- Spivak 7y ago
  So install the developer edition? Yes it’s a little more annoying for people who want private extensions but you’re forgetting that we’re in a small minority and this change is a massive win for security and privacy overall. This site is full of threads talking about how friends, family, and coworkers’ browsers are riddled with badware that was installed behind their backs.
  - dessant 7y ago
    Again, this change prevents regular users from configuring Firefox the way they want. We should not need to install the developer edition, which is based on Firefox Beta, or an unbranded build that does not auto-update to be able to run local extensions in our browsers. Not even Google is this heavy-handed, they allow installing local extensions in Chrome after users enable an option, although a warning is shown on browser restarts about the presence of external extensions, which can be dismissed. Why not have sensible defaults, then educate and warn users about certain actions, instead of treating them like cattle?
    - Vinnl 7y ago
      You can load local extensions in Firefox as well with warnings: https://developer.mozilla.org/en-US/docs/Tools/about:debugging#This_Firefox https://developer.mozilla.org/en-US/docs/Tools/about:debuggi... And has been pointed out in most of these threads, the reason for not allowing people to circumvent some things is because that also allows malicious software to circumvent it.
      - dessant 7y ago
        > You can load local extensions in Firefox as well with warnings Extensions loaded in about:debugging are not persistent, they are removed at the end of the browsing session. > And has been pointed out in most of these threads, the reason for not allowing people to circumvent some things is because that also allows malicious software to circumvent it. Yes, and the discussion mostly ends after people point out that malware if free to circumvent extension signing in any number of ways when it has root access on the device. The threat model is flawed, or at the very least they're placing minimal security benefits above important user liberties. Forcing extension signing by default is a great initiative, but we must be given ways to override defaults, guarded by administrative access and appropiate warnings, and be able to install local extensions in the browser we love, and that is the release version of Firefox.
        Vinnl 7y ago
        > when it has root access on the device. But that's a big if. Extensions can be installed without root access, and can wreck a lot of havoc. I'd also dare to state the the organisation with the best insight into the extent of security benefits is the organisation that has data on the number and nature of exploits, i.e. Mozilla. > we must be given ways to override defaults, guarded by administrative access and appropiate warnings, and be able to install local extensions Guarded by administrative access sounds reasonable, and I think that's even already possible with Firefox ESR? I'd also consider an unbranded version of Firefox equal to the branded one, with the unbrandedness being an "appropriate warning". It does need to support auto-updating first, though.
- Jonnax 7y ago
  It must be so frustrating working in open source and seeing such entitled comment such as yours. Malware extensions is a real problem that affects literally millions more people than people who want to use the standard Firefox release with an unsigned extension. And it's such a lazy thing to say "oh they can just replace the Firefox binary" when that's clearly a significantly more complex task than just writing an extension. What's so secret about your extension code that you want to be able to distribute it to users without getting it reviewed by Mozilla? You posted on that Bugzilla post but gave no details as to what your use case is. Also why can't a user take the code for your extension, create an account on the add-on marketplace and privately get it signed for themselves. It's a multistep process but works.
  - dessant 7y ago
    I gave more details about my use case here: https://github.com/jeremiahlee/page-translator/issues/26#issuecomment-545170847 https://github.com/jeremiahlee/page-translator/issues/26#iss... Though its worth noting that we do not need reasons to expect our privacy being respected. And this issue is not just about me and my needs, but about user liberties, so please refrain from making it personal. > Also why can't a user take the code for your extension, create an account on the add-on marketplace and privately get it signed for themselves. It's a multistep process but works. No, it does not work, as the maintainer of Page Translator can attest. https://github.com/jeremiahlee/page-translator/issues/26 https://github.com/jeremiahlee/page-translator/issues/26 This change is hostile to users and concentrates power in the hands of the browser vendor. Consider that they are making third-party extension stores impossible.
    - Vinnl 7y ago
      > No, it does not work, as the maintainer of Page Translator can attest. > > https://github.com/jeremiahlee/page-translator/issues/26 https://github.com/jeremiahlee/page-translator/issues/26 Ouch. I'm generally in favour of having add-ons signed, but I do have an extension that injects an external script into the browser and web pages - for a completely non-nefarious use case. I do understand the security risk and why they'd block it, but I'm not looking forward to the day my extension is no longer flying under the radar and gets pulled. Edit: Of note is that the Chrome web-store does allow my extension, but requires a multi-week review every time I upload a new version. Somehow they're fine with the remote code, even though it could change after their review.
mcny 7y ago
Speaking of something unrelated, I wish the walled gardens (Apple and Google) required developers to hand over source code and machine readable build instructions so the apps get built on their servers.
ahbyb 7y ago
The Mozilla Corporation is the only entity that can save us from Google; I can't blame people for getting salty whenever they screw up (which seems to be pretty often). Given that the leadership of the Mozilla Corporation is completely useless, users have the responsibility to raise these issues so we can push them to fix them.
- deleted 7y ago
  [deleted]
dessant 7y ago
It is related to extension support in Firefox. Not offering any way to override this option, even if it takes 10 steps and it is marked by warnings, is hostile to users. We will continue to raise awareness of Mozilla's actions whenever we believe they go against the public good. It would be more productive to allow others to learn about the issue and give us a chance to have a public discourse about it, where technical details can be explained and their threat model shared, and possibly allow for feedback by the community to shape the final implementation.

Spivak 7y ago

Because “user with administrative access” also describes software installers “helpfully” installing their add-on into the browser. This continues the long trend of browsers not trusting the underlying OS to actually protect users from soft-malware.

dessant 7y ago
Malware will have an unlimited number of methods to continue patching Firefox, this change only makes it harder for regular users to configure Firefox manually for installing extensions that have not been blessed by Mozilla.
- bepvte 7y ago
  Binary patching a software that has its exe signed by mozilla is very impossible without it triggering smartscreen or alerting users
- Spivak 7y ago
  The target for this has never really been outright malware but it does make it far more annoying for them. The target is badware or bundleware where a few missed checkboxes means users with 15 different spyware add-ons “search fixers” or ad-injectors. These grey-market apps aren’t suddenly going to jump the ship into actual malware and binary patch Firefox. I feel like the people we consider ”regular users” to be really different. Like we’re talking about a subset of the population that want’s to install their own private extensions or sideload someone else’s but doesn’t understand how to uninstall the release version and install the developer edition when prompoted.
  - dessant 7y ago
    Adware will continue to be able to legally circumvent extension signing when it has root access and consent by the user. This only makes it prohibitive for users to customize their own browsers. It's also possible to make this setting configurable only from the browser UI, where you get a chance to educate and properly warn your users. They also want to restrict the config option on Linux, where the adware problem you describe is not really present.

cyborgx7 7y ago

Every single time. Give it a rest already.