5 ms·

Again, this change prevents regular users from configuring Firefox the way they want. We should not need to install the developer edition, which is based on Fir

Again, this change prevents regular users from configuring Firefox the way they want. We should not need to install the developer edition, which is based on Firefox Beta, or an unbranded build that does not auto-update to be able to run local extensions in our browsers. Not even Google is this heavy-handed, they allow installing local extensions in Chrome after users enable an option, although a warning is shown on browser restarts about the presence of external extensions, which can be dismissed. Why not have sensible defaults, then educate and warn users about certain actions, instead of treating them like cattle?

Vinnl 7y ago
You can load local extensions in Firefox as well with warnings: https://developer.mozilla.org/en-US/docs/Tools/about:debugging#This_Firefox https://developer.mozilla.org/en-US/docs/Tools/about:debuggi... And has been pointed out in most of these threads, the reason for not allowing people to circumvent some things is because that also allows malicious software to circumvent it.
- dessant 7y ago
  > You can load local extensions in Firefox as well with warnings Extensions loaded in about:debugging are not persistent, they are removed at the end of the browsing session. > And has been pointed out in most of these threads, the reason for not allowing people to circumvent some things is because that also allows malicious software to circumvent it. Yes, and the discussion mostly ends after people point out that malware if free to circumvent extension signing in any number of ways when it has root access on the device. The threat model is flawed, or at the very least they're placing minimal security benefits above important user liberties. Forcing extension signing by default is a great initiative, but we must be given ways to override defaults, guarded by administrative access and appropiate warnings, and be able to install local extensions in the browser we love, and that is the release version of Firefox.
  - Vinnl 7y ago
    > when it has root access on the device. But that's a big if. Extensions can be installed without root access, and can wreck a lot of havoc. I'd also dare to state the the organisation with the best insight into the extent of security benefits is the organisation that has data on the number and nature of exploits, i.e. Mozilla. > we must be given ways to override defaults, guarded by administrative access and appropiate warnings, and be able to install local extensions Guarded by administrative access sounds reasonable, and I think that's even already possible with Firefox ESR? I'd also consider an unbranded version of Firefox equal to the branded one, with the unbrandedness being an "appropriate warning". It does need to support auto-updating first, though.

Vinnl 7y ago

You can load local extensions in Firefox as well with warnings: https://developer.mozilla.org/en-US/docs/Tools/about:debugging#This_Firefox https://developer.mozilla.org/en-US/docs/Tools/about:debuggi... And has been pointed out in most of these threads, the reason for not allowing people to circumvent some things is because that also allows malicious software to circumvent it.

dessant 7y ago
> You can load local extensions in Firefox as well with warnings Extensions loaded in about:debugging are not persistent, they are removed at the end of the browsing session. > And has been pointed out in most of these threads, the reason for not allowing people to circumvent some things is because that also allows malicious software to circumvent it. Yes, and the discussion mostly ends after people point out that malware if free to circumvent extension signing in any number of ways when it has root access on the device. The threat model is flawed, or at the very least they're placing minimal security benefits above important user liberties. Forcing extension signing by default is a great initiative, but we must be given ways to override defaults, guarded by administrative access and appropiate warnings, and be able to install local extensions in the browser we love, and that is the release version of Firefox.
- Vinnl 7y ago
  > when it has root access on the device. But that's a big if. Extensions can be installed without root access, and can wreck a lot of havoc. I'd also dare to state the the organisation with the best insight into the extent of security benefits is the organisation that has data on the number and nature of exploits, i.e. Mozilla. > we must be given ways to override defaults, guarded by administrative access and appropiate warnings, and be able to install local extensions Guarded by administrative access sounds reasonable, and I think that's even already possible with Firefox ESR? I'd also consider an unbranded version of Firefox equal to the branded one, with the unbrandedness being an "appropriate warning". It does need to support auto-updating first, though.