18 ms·

Firefox to Discontinue Sideloaded Extensions

432 points by rahidz 7y ago

dbetteridge 7y ago
To me this seems shortsighted to say the least, sounds like you now need Mozilla to validate and approve your extension for use? Please correct me if I'm reading it wrong. Saying "To give users more control over their extensions, support for sideloaded extensions will be discontinued." Also seems disingenuous at best...
- adrinavarro 7y ago
  The post clearly states that users can install extensions through the developer's website. The main difference here is that extensions cannot be silently installed — users have to explicitly install them. Sounds good to me. No more annoying adware extensions.
  - dbetteridge 7y ago
    I agree regarding adware, I think its just a poorly written post in terms of clarity. It could have been better summarised as We are removing sideloading (The ability to silently install extensions from your local machine as an xpi file) - This will not affect the ability to manually install extensions, they will need to be installed from a source code directory (Link to chrome post on same) - This makes users safer (Malicious extensions will need to be approved and installed by a user) - This makes it more obvious when an extension is installed (Confirmation dialog) ETC Thanks for making me read into it further
- megous 7y ago
  > Saying "To give users more control over their extensions, support for sideloaded extensions will be discontinued." Also seems disingenuous at best... Isn't this how distributions install browser extensions from package repositories? Now I can pacman -S an extension. With this change I will not be able to. More control, right.
  - londons_explore 7y ago
    Presumably pacman -S will still work, but on first run, Firefox will then ask if you really want the extension installed, listing it's permissions etc. I think that's pretty fair. Lots of other software that interacts/loads into another bit of software requires manual configuration.
    - jraph 7y ago
      I guess distributions may be able to build a Firefox version that would load extensions installed using the package manager without prompt.
SaltySolomon 7y ago
So, how do you now install Add-Ons on computers without internet access?
- hereisdx 7y ago
  Sideloadong is automatic installation of extensions by 3rd party software. You can still install extensions manually using the extension package file and opening it with firefox. What you cant do is automate this.
  - mantap 7y ago
    Wait what? Sideloading means installing software directly, rather than from a first party distribution mechanism. If a user installs software manually they are still sideloading it, that's what the word means!!
    - cyborgx7 7y ago
      Yeah, they just used a terrible internal name for the feature they are removing, that makes it sound way more severe than it actually is. Seems somewhat tone-deaf with one of the big criticisms of the project being their restrictiveness regarding add-ons.
  - duncanawoods 7y ago
    Sideloading generally means just not using an official store so this seems to be poorly communicated.
    - deleted 7y ago
      [deleted]
- deleted 7y ago
  [deleted]
- warpech 7y ago
  I guess you will still be able to do "Add-Ons" -> "Extensions" -> [Gear icon] -> "Install Add-On From File"
deleted 7y ago
[deleted]
justinclift 7y ago
Sounds like it'll be useful for stopping things like "McAfee" from automatically installing their crap into Firefox without asking.
- ahbyb 7y ago
  It's not like you don't install McAfee on purpose.
  - jmkni 7y ago
    Sometimes your organisation installs Mcafee, you then proceed to install Firefox.
    - wlkr 7y ago
      In addition to this, many products come preinstalled as bloatware. McAfee products (amongst a hoard of other programs) have come preinstalled on Windows laptops I've purchased from Dell and Lenovo.
      - jedieaston 7y ago
        The "Fresh Start" feature in newer builds of Windows 10 (1709-onwards if I'm not mistaken) will automatically remove these kinds of applications preinstalled on new systems. https://www.microsoft.com/en-us/software-download/windows10startfresh https://www.microsoft.com/en-us/software-download/windows10s...
        tubbs 7y ago
        Excellent feature. It's important to note that it's a good idea to have a copy of all of your devices' drivers before using it.
        anoncake 7y ago
        Excellent feature in itself, but also a cludge around a broken economic system. OEMs shouldn't be prioritizing their profits at the expense of the users their business exists for.
Etheryte 7y ago
This seems to be somewhat badly written copy on Mozilla's part. To clear up what this change actually means for an end user: - You can still manually install extensions. From now on, all installations will need explicit user confirmation. - No extensions can be installed silently. This is what sideloading did, all extensions in a special folder were installed in all Firefox instances on the computer without the user's consent. This is most definitely a Good Thing, as it means for example no malicious extensions can be silently installed by malware etc. Communicating this change could've been done better, though.
- twapi 7y ago
  "- You can still manually install extensions" Yes, but not as XPI file. For manual installation, you can install similar to Chrome, that's from source code folder
  - devcpp 7y ago
    Will Firefox stop copying Chrome's features that are hostile to power users at some point?
    - ghaff 7y ago
      Probably not. There's a clear conflict between what (some) power users want and what the best/safest choices are for the general public. And, in general, mainstream platforms like Firefox should default to what's best for the general public. (Yes, you could have bypass mechanisms but backdoors like that are more or less asking for trouble.) See also Apple. Added: It's not clear to me how "hostile to power users" this particular change is. But my general statement still applies.
      - ptero 7y ago
        It is not clear what is best for the general public. You can aim for the "safest" choice, which seems to be what you are advocating. If so, it needs to be said explicitly and the implications of functionality reduction (that safety increases always brings) openly discussed and debated. The model of claiming "we will do what is best for users" with a freedom to replace "best" by "X" has been thoroughly compromised by googles and facebooks of this world. We need to be explicit about goals and tradeoffs. Not attacking your post, just arguing for being clear and honest on goals of non-commercial software. My 2c.
jressey 7y ago
> If you self-distribute your extension via sideloading, please update your install flows and direct your users to download your extension through a web property that you own, or through addons.mozilla.org (AMO). Everything is fine. This is blocking automatic extension installation. You can still install extensions manually.
gtirloni 7y ago
It seems Chrome already does that since June 2018: https://blog.chromium.org/2018/06/improving-extension-transparency-for.html https://blog.chromium.org/2018/06/improving-extension-transp...
vbezhenar 7y ago
Sounds good for public users, sounds bad for intranet users. Is there some Firefox fork without all those restrictions?
- deleted 7y ago
  [deleted]
- evilpie 7y ago
  For intranet/companies you should use Group Policies to install extensions: https://github.com/mozilla/policy-templates#extensions https://github.com/mozilla/policy-templates#extensions
  - aasasd 7y ago
    Oh! Sounds like this can help with keeping the setup in Ansible.
  - ahmedalsudani 7y ago
    What prevents a shitty vendor from setting up policies? It looks like all you need to do is create a file and put it in the right place.
- sp332 7y ago
  I'm not sure about this new change, but Firefox "unbranded" builds don't require extension signing.
dealpete 7y ago
I was amused by this doublespeak: "To give users more control over their extensions, support for sideloaded extensions will be discontinued."
- rocqua 7y ago
  Sideloading isn't always under the control of the user. Thus removing the option gives more control. It's not like removing a hole in your city wall gives you less control over entry into your city, even though it does remove a method of entry.
  - chinhodado 7y ago
    I don't see how removing the option gives more control. If you want more control why not just add a confirmation step the first time the extension is loaded, and make it possible/easy to remove it?
  - pbhjpbhj 7y ago
    In you analogy it doesn't give the users of the hole more control of how they get in to their city, it gives the city gate controllers more control. This doesn't give users more control, it gives less. People who wanted to control their own 'hole' might have wanted to let people in that the city elders didn't care for.
- majewsky 7y ago
  I know where you're coming from, I don't see a contradiction here. This is about extensions that are side-loaded e.g. through an enterprise group policy or by a snake oil product, where the user in front of the screen did not explicitly approve the installation of the extension. Disabling this means that users have to approve each extension, which does indeed give them more control.
  - chinhodado 7y ago
    Thẹn why not just leave the functionality there but force users to confirm the installation the next time you restart the browser? And make it possible to remove the sideloaded extension always?
Mindwipe 7y ago
The communication around this is completely atrocious. Given the obvious threats that a single signing authority presents (as proven by Apple recently) Mozilla should be decentralising the signing here to a few hundred redundant parties worldwide.
prashnts 7y ago
I got concerned for a moment that this will end up forcing all extensions to be available only from Add On store, (similar to Chrome). Thankfully it’s not that. Note that even extensions distributed outside their store need an automatic signing. It takes a few seconds and is done through the web-ext cli tool. This is good!
- dessant 7y ago
  > I got concerned for a moment that this will end up forcing all extensions to be available only from Add On store, (similar to Chrome). Thankfully it’s not that. Mozilla is working on achieving exactly that, and in fact Firefox is already worse than Chrome in this aspect, see my comment here: https://news.ycombinator.com/item?id=21418604 https://news.ycombinator.com/item?id=21418604
  - prashnts 7y ago
    Thanks for this. I want to say that it’s all bad choice from Mozilla and rant, but instead I want to understand the threat model they’re considering. Extensions do get a lot of access to browser, and may also use side-channels[1] to work around inaccessible apis. From a brief look at the linked discussions, I grock that they’re thinking about a malware with admin privileges installing the add-on. Is it likely that some malware only has access to “side-load addons” and nothing more? If not, then can’t it just install keylogger, network monitor, etc? I can’t find better answers other than my speculations. [1]: Not that I have one such exploit, but even without access to “tabs” permissions, extensions can still query the status of tabs, run benchmark processes, and add context menus with various “filters” such as right click on a text or image. Sure this doesn’t give direct access to data, but timing attacks and such should be possible.
    - dessant 7y ago
      I agree that having a discussion on the actual threat model Mozilla is working with is the best way to approach this issue. Mozilla is trying to defend against malware or adware with root access on the device. Malware with root access can do what it wants, inluding just replacing the Firefox executable, keylogging, making screenshots, intercepting traffic, or patching Firefox in any number of ways. Adware can legally do the same if users give consent. Most antivirus software in fact injects code and is capable of controlling processes, they also intercept traffic to monitor for threats. If both malware and adware can do esentially what they want on the device, then we are left with how this change affects users. Users can install a different browser, or patch Firefox, but it becomes prohibitive for regular users to control their own browsers if they choose to continue using Firefox, because they lack the expertise to make the necessary changes. Disallowing local extensions at all costs in Firefox has minimal security benefits, while greatly harming user and software freedom.
doguozkan 7y ago
I think the main point here is that sideloaded add-ons cannot be removed through the add-on manager. Malicious software can still install add-ons silently and without explicit consent, but now the user can view and remove those much more easily.
yosefzeev 7y ago
The timing of this event is curious. Hasn't this been an issue since almost the inception of web browsers?
TeMPOraL 7y ago
All is fine, but: > If you self-distribute your extension via sideloading, please update your install flows and direct your users to download your extension through a web property that you own, or through addons.mozilla.org (AMO). And what if I don't want to use a "web property" to distribute an extension? What if I want to give my users a honest-to-God file, whether via e-mail or IM message or USB drive? > Please note that all extensions must meet the requirements outlined in our Add-on Policies and Developer Agreement. Or what? I can't make an extension and give it to friends unless it meets your policy? That's pushing it a bit.
- dmurray 7y ago
  Maybe the file you distribute on a USB stick should contain a self-contained webserver on localhost that your users can run, then install the extension through Firefox? This raises some security concerns in theory (your user now has to run an executable that is not sandboxed by the browser), but they were already trusting you enough to plug in a USB stick.
  - TeMPOraL 7y ago
    As you say, this wouldn't impact security any more than inserting the USB stick itself would - but having to run a HTTP server on loopback just to circumvent some security mechanism on the browser you own[0] would only say that some engineering mistakes have been made. -- [0] - Do you still own a copy of Firefox? That's probably the hidden crux of the issue.
- arnvidr 7y ago
  You can still do that of course, with the same file that you would offer your friends through your "web property". A file is still a file.
  - oefrha 7y ago
    I doubt it. According to https://extensionworkshop.com/documentation/publish/submitting-an-add-on/#self-distribution https://extensionworkshop.com/documentation/publish/submitti... the file has to be validated and signed through their submission form, and, I quote, > Note, however, that your add-on may still be subject to further review, if it is you’ll receive notification of the outcome of the review later. So other than hosting, I fail to see how this is different from distributing through the official channel — you still have to pass their review. Note that I’ve never written a Firefox add-on (I’ve written plenty of Chrome extensions though), so please correct me if I’m wrong.
zAy0LfpBZLC8mAC 7y ago
So, from now on malware will come with a minimal Firefox binary included where this functionality is patched out, and the malware will use that binary for installing extensions into the Firefox profile on your machine. What will Mozilla do next then? Close the source so malware authors can't compile their own Firefox, for security reasons? Only allow installation on DRMed systems?
- zAy0LfpBZLC8mAC 7y ago
  I would really like to know why people are downvoting this ... like, how is this not exactly what is going to happen next on the malware side?
  - deleted 7y ago
    [deleted]
  - unqueued 7y ago
    It does not appear anything you said was wrong, so I don't know why you are being downvoted.
bayindirh 7y ago
The question in my mind is how this change is gonna affect the enterprise installations. I'm aware of some installations which rely on both auto configuration and some proprietary extensions to the enterprises themselves which needs to be non-removable and always active. Disabling installation of sideloaded extensions may make these installations harder, if not impossible.
dessant 7y ago
Mozilla intends to remove all methods for installing private extensions in the release version of Firefox. The extension source code must be disclosed to Mozilla during signing, and it must adhere to their add-on policies [1]. Mozilla is blocklisting benign extensions distributed outside of Firefox Add-ons which do not follow these guidelines [2]. They are working on disabling a method which allows users with root access to configure Firefox to load unsigned extensions [3], citing concerns over adware with root access. The feature is being disabled even on Linux, where such adware was never really a problem, despite making several other use cases impossible. Requiring extensions to be signed by default is a great initiative by Mozilla, but we must be given ways to install private extensions in the release version of Firefox without disclosing the source code to Mozilla, or worrying that an extension for personal use may be blocklisted. Forbidding local extensions in the release version of Firefox, without a way to override the option, guarded by administrative access and appropriate warnings, is heavy-handed and has a questionable threat model. Signing can be turned off in Firefox Developer Edition (based on Firefox Beta) and unbranded builds (no automatic updates), but those browsers are not meant for end users. We must be given ways to install private extensions in the best version of Firefox, and that is the release version of the browser. Not even Google is this heavy-handed, they allow installing local extensions in Chrome after users enable an option, although a warning is shown on browser restarts about the presence of external extensions, which can be dismissed. [1] https://extensionworkshop.com/documentation/publish/add-on-policies/ https://extensionworkshop.com/documentation/publish/add-on-p... [2] https://github.com/jeremiahlee/page-translator/issues/26 https://github.com/jeremiahlee/page-translator/issues/26 [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1514451 https://bugzilla.mozilla.org/show_bug.cgi?id=1514451
- SpicyLemonZest 7y ago
  But I think Chrome’s example clearly shows why they feel they have to do this. The average user doesn’t understand extensions the same way you do; to them, Firefox is Firefox no matter how many bells and whistles are added on. So it’s a serious reputational risk that Mozilla currently allows unsafe code to run in an official Firefox release. edit: Like, look at your second link. The extension was running remote code loaded from a third-party site! I'm sure you see why Mozilla can't just let that happen.
nullc 7y ago
Won't the "bundleware" just directly frob Firefox's state to make it think the user authorized it?
greatgib 7y ago
This moment when you have no say anymore on what you want to install on your own computer without a corporate cloud server deciding for you...
- aembleton 7y ago
  You don't have to use a cloud server, just host it yourself.
  - ersii 7y ago
    Oh, you mean like Firefox Sync? Which was self-hostable.. Promised to be that once again, but still hasn't been opened up again.
    - drdaeman 7y ago
      Well, it is self-hostable, but it's a giant mess. I've self-hosted Accounts+Sync with a lots of elbow grease. Even had my own alternative re-implementation - because running all this Mozilla code was more complicated than hacking up something of my own. I gave up about a half an year ago.
kwk1 7y ago
How will this affect extensions packaged in Linux distributions, e.g. Debian's webext-* packages. I for one want to be able to do stuff like `sudo apt install firefox webext-ublock-origin` and have all the users on the system have this extension installed and enabled.
- ripdog 7y ago
  Debian will need to patch Firefox for this to continue to work.
  - dessant 7y ago
    I think Debian already compiles Firefox with a flag to allow unsigned extensions, but this may require further changes.
g3houdini 7y ago
Time for a new browser introduction....
nathancahill 7y ago
Title is flame-bait. It should say "Firefox to Discontinue Silently Sideloading Extensions"
fareesh 7y ago
There is a rule about ensuring the original title is the same as the submission title but in this case the original title is quite badly written. Is there some way to submit this post or edit the title to maintain compliance with the submission rule and also make it less misleading?
2ion 7y ago
Say I wanted to provide a multi-seat computer where all users have a certain default addon experience using Firefox, like installing uBlock Origin. This seems to make provisioning such a setup impossible? Or I would have to generate Firefox profiles dynamically, on-the-fly?
4bpp 7y ago
What would be a reasonable way to let Mozilla know that I strongly disagree with this decision (and, really, the majority of calls they have made surrounding extension security lately)? Who was responsible for making this decision on their end? I am very close to the point where I can no longer recommend Firefox to anyone (after sticking with them through some of the darkest years in terms of product quality), because they are becoming a worse enemy of the open internet than Google but harder to hold accountable for it.
- balelayers 7y ago
  I don't know the answer to your question, but why do disagree so strongly?
TazeTSchnitzel 7y ago
What this is: • Preventing malware and enterprises from silently installing unremovable extensions through a special mechanism What this is not: • Preventing users from installing extensions without using the Internet (they can just load an xpi file like always) • Preventing power users from installing unsigned extensions (already not possible in standard Firefox except non-persistently for development, but Mozilla provide unbranded builds which let you use extensions) Why this is being done: • Preventing adware adding itself to your browser without your consent and making itself difficult to remove Not why this is being done: • Mozilla hates users / the open Internet / freedom (their foremost concern is protecting users from malware nonconsensually installing extensions, they have always provided versions of Firefox allowing you to do whatever you want if you want that, and indeed standard Firefox does let you load unsigned extensions temporarily)
- mike_hock 7y ago
  I do hope that Debian will start patching out these nanny features, though, including the ones we've already had for a while (like no unsigned extensions). Maybe it's time for a revival of Iceweasel. If malware gains enough access to my system to put extensions in the sideloading folder I have bigger problems than Mozilla can protect me from.
qwerty456127 7y ago
If an extension can't be installed silently (e.g. by a -rd party app installer once you forget to uncheck a checkbox) that's great (except for enterprise users perhaps as they need to automate such tasks). If I can't just install an extension/app manually from a file on my hard drive - I don't need such a browser/platform.
hartator 7y ago
> To give users more control over their extensions, support for sideloaded extensions will be discontinued. Isn't kind of contradictory?
vkaku 7y ago
Bad, bad Mozilla! For me, personally, it's what makes this model so fallible and not developer / community friendly. What if, tomorrow, some country blacklists the Firefox website, and one still needs to load some privacy extensions? This is exactly the sort of usecase Firefox should allow, if it's pro privacy.
- mintplant 7y ago
  Add-ons can still be installed from outside addons.mozilla.org, as long as they're signed (an automated process), or you're using something other than an official stable-channel Firefox build and have unsigned add-on install enabled. The announcement in question pertains to a specific method of silently force-installing unremovable add-ons to Firefox.

432 points by rahidz 7y ago

To me this seems shortsighted to say the least, sounds like you now need Mozilla to validate and approve your extension for use? Please correct me if I'm reading it wrong. Saying "To give users more control over their extensions, support for sideloaded extensions will be discontinued." Also seems disingenuous at best...

adrinavarro 7y ago
The post clearly states that users can install extensions through the developer's website. The main difference here is that extensions cannot be silently installed — users have to explicitly install them. Sounds good to me. No more annoying adware extensions.
- dbetteridge 7y ago
  I agree regarding adware, I think its just a poorly written post in terms of clarity. It could have been better summarised as We are removing sideloading (The ability to silently install extensions from your local machine as an xpi file) - This will not affect the ability to manually install extensions, they will need to be installed from a source code directory (Link to chrome post on same) - This makes users safer (Malicious extensions will need to be approved and installed by a user) - This makes it more obvious when an extension is installed (Confirmation dialog) ETC Thanks for making me read into it further
megous 7y ago
> Saying "To give users more control over their extensions, support for sideloaded extensions will be discontinued." Also seems disingenuous at best... Isn't this how distributions install browser extensions from package repositories? Now I can pacman -S an extension. With this change I will not be able to. More control, right.
- londons_explore 7y ago
  Presumably pacman -S will still work, but on first run, Firefox will then ask if you really want the extension installed, listing it's permissions etc. I think that's pretty fair. Lots of other software that interacts/loads into another bit of software requires manual configuration.
  - jraph 7y ago
    I guess distributions may be able to build a Firefox version that would load extensions installed using the package manager without prompt.

SaltySolomon 7y ago

So, how do you now install Add-Ons on computers without internet access?

hereisdx 7y ago
Sideloadong is automatic installation of extensions by 3rd party software. You can still install extensions manually using the extension package file and opening it with firefox. What you cant do is automate this.
- mantap 7y ago
  Wait what? Sideloading means installing software directly, rather than from a first party distribution mechanism. If a user installs software manually they are still sideloading it, that's what the word means!!
  - cyborgx7 7y ago
    Yeah, they just used a terrible internal name for the feature they are removing, that makes it sound way more severe than it actually is. Seems somewhat tone-deaf with one of the big criticisms of the project being their restrictiveness regarding add-ons.
- duncanawoods 7y ago
  Sideloading generally means just not using an official store so this seems to be poorly communicated.
  - deleted 7y ago
    [deleted]
deleted 7y ago
[deleted]
warpech 7y ago
I guess you will still be able to do "Add-Ons" -> "Extensions" -> [Gear icon] -> "Install Add-On From File"

deleted 7y ago

[deleted]

justinclift 7y ago

Sounds like it'll be useful for stopping things like "McAfee" from automatically installing their crap into Firefox without asking.

ahbyb 7y ago
It's not like you don't install McAfee on purpose.
- jmkni 7y ago
  Sometimes your organisation installs Mcafee, you then proceed to install Firefox.
  - wlkr 7y ago
    In addition to this, many products come preinstalled as bloatware. McAfee products (amongst a hoard of other programs) have come preinstalled on Windows laptops I've purchased from Dell and Lenovo.
    - jedieaston 7y ago
      The "Fresh Start" feature in newer builds of Windows 10 (1709-onwards if I'm not mistaken) will automatically remove these kinds of applications preinstalled on new systems. https://www.microsoft.com/en-us/software-download/windows10startfresh https://www.microsoft.com/en-us/software-download/windows10s...
      - tubbs 7y ago
        Excellent feature. It's important to note that it's a good idea to have a copy of all of your devices' drivers before using it.
        anoncake 7y ago
        Excellent feature in itself, but also a cludge around a broken economic system. OEMs shouldn't be prioritizing their profits at the expense of the users their business exists for.

Etheryte 7y ago

This seems to be somewhat badly written copy on Mozilla's part. To clear up what this change actually means for an end user: - You can still manually install extensions. From now on, all installations will need explicit user confirmation. - No extensions can be installed silently. This is what sideloading did, all extensions in a special folder were installed in all Firefox instances on the computer without the user's consent. This is most definitely a Good Thing, as it means for example no malicious extensions can be silently installed by malware etc. Communicating this change could've been done better, though.

twapi 7y ago
"- You can still manually install extensions" Yes, but not as XPI file. For manual installation, you can install similar to Chrome, that's from source code folder
- devcpp 7y ago
  Will Firefox stop copying Chrome's features that are hostile to power users at some point?
  - ghaff 7y ago
    Probably not. There's a clear conflict between what (some) power users want and what the best/safest choices are for the general public. And, in general, mainstream platforms like Firefox should default to what's best for the general public. (Yes, you could have bypass mechanisms but backdoors like that are more or less asking for trouble.) See also Apple. Added: It's not clear to me how "hostile to power users" this particular change is. But my general statement still applies.
    - ptero 7y ago
      It is not clear what is best for the general public. You can aim for the "safest" choice, which seems to be what you are advocating. If so, it needs to be said explicitly and the implications of functionality reduction (that safety increases always brings) openly discussed and debated. The model of claiming "we will do what is best for users" with a freedom to replace "best" by "X" has been thoroughly compromised by googles and facebooks of this world. We need to be explicit about goals and tradeoffs. Not attacking your post, just arguing for being clear and honest on goals of non-commercial software. My 2c.

jressey 7y ago

> If you self-distribute your extension via sideloading, please update your install flows and direct your users to download your extension through a web property that you own, or through addons.mozilla.org (AMO). Everything is fine. This is blocking automatic extension installation. You can still install extensions manually.

gtirloni 7y ago

It seems Chrome already does that since June 2018: https://blog.chromium.org/2018/06/improving-extension-transparency-for.html https://blog.chromium.org/2018/06/improving-extension-transp...

vbezhenar 7y ago

Sounds good for public users, sounds bad for intranet users. Is there some Firefox fork without all those restrictions?

deleted 7y ago
[deleted]
evilpie 7y ago
For intranet/companies you should use Group Policies to install extensions: https://github.com/mozilla/policy-templates#extensions https://github.com/mozilla/policy-templates#extensions
- aasasd 7y ago
  Oh! Sounds like this can help with keeping the setup in Ansible.
- ahmedalsudani 7y ago
  What prevents a shitty vendor from setting up policies? It looks like all you need to do is create a file and put it in the right place.
sp332 7y ago
I'm not sure about this new change, but Firefox "unbranded" builds don't require extension signing.

dealpete 7y ago

I was amused by this doublespeak: "To give users more control over their extensions, support for sideloaded extensions will be discontinued."

rocqua 7y ago
Sideloading isn't always under the control of the user. Thus removing the option gives more control. It's not like removing a hole in your city wall gives you less control over entry into your city, even though it does remove a method of entry.
- chinhodado 7y ago
  I don't see how removing the option gives more control. If you want more control why not just add a confirmation step the first time the extension is loaded, and make it possible/easy to remove it?
- pbhjpbhj 7y ago
  In you analogy it doesn't give the users of the hole more control of how they get in to their city, it gives the city gate controllers more control. This doesn't give users more control, it gives less. People who wanted to control their own 'hole' might have wanted to let people in that the city elders didn't care for.
majewsky 7y ago
I know where you're coming from, I don't see a contradiction here. This is about extensions that are side-loaded e.g. through an enterprise group policy or by a snake oil product, where the user in front of the screen did not explicitly approve the installation of the extension. Disabling this means that users have to approve each extension, which does indeed give them more control.
- chinhodado 7y ago
  Thẹn why not just leave the functionality there but force users to confirm the installation the next time you restart the browser? And make it possible to remove the sideloaded extension always?

Mindwipe 7y ago

The communication around this is completely atrocious. Given the obvious threats that a single signing authority presents (as proven by Apple recently) Mozilla should be decentralising the signing here to a few hundred redundant parties worldwide.

prashnts 7y ago

I got concerned for a moment that this will end up forcing all extensions to be available only from Add On store, (similar to Chrome). Thankfully it’s not that. Note that even extensions distributed outside their store need an automatic signing. It takes a few seconds and is done through the web-ext cli tool. This is good!

dessant 7y ago
> I got concerned for a moment that this will end up forcing all extensions to be available only from Add On store, (similar to Chrome). Thankfully it’s not that. Mozilla is working on achieving exactly that, and in fact Firefox is already worse than Chrome in this aspect, see my comment here: https://news.ycombinator.com/item?id=21418604 https://news.ycombinator.com/item?id=21418604
- prashnts 7y ago
  Thanks for this. I want to say that it’s all bad choice from Mozilla and rant, but instead I want to understand the threat model they’re considering. Extensions do get a lot of access to browser, and may also use side-channels[1] to work around inaccessible apis. From a brief look at the linked discussions, I grock that they’re thinking about a malware with admin privileges installing the add-on. Is it likely that some malware only has access to “side-load addons” and nothing more? If not, then can’t it just install keylogger, network monitor, etc? I can’t find better answers other than my speculations. [1]: Not that I have one such exploit, but even without access to “tabs” permissions, extensions can still query the status of tabs, run benchmark processes, and add context menus with various “filters” such as right click on a text or image. Sure this doesn’t give direct access to data, but timing attacks and such should be possible.
  - dessant 7y ago
    I agree that having a discussion on the actual threat model Mozilla is working with is the best way to approach this issue. Mozilla is trying to defend against malware or adware with root access on the device. Malware with root access can do what it wants, inluding just replacing the Firefox executable, keylogging, making screenshots, intercepting traffic, or patching Firefox in any number of ways. Adware can legally do the same if users give consent. Most antivirus software in fact injects code and is capable of controlling processes, they also intercept traffic to monitor for threats. If both malware and adware can do esentially what they want on the device, then we are left with how this change affects users. Users can install a different browser, or patch Firefox, but it becomes prohibitive for regular users to control their own browsers if they choose to continue using Firefox, because they lack the expertise to make the necessary changes. Disallowing local extensions at all costs in Firefox has minimal security benefits, while greatly harming user and software freedom.

doguozkan 7y ago

I think the main point here is that sideloaded add-ons cannot be removed through the add-on manager. Malicious software can still install add-ons silently and without explicit consent, but now the user can view and remove those much more easily.

yosefzeev 7y ago

The timing of this event is curious. Hasn't this been an issue since almost the inception of web browsers?

TeMPOraL 7y ago

All is fine, but: > If you self-distribute your extension via sideloading, please update your install flows and direct your users to download your extension through a web property that you own, or through addons.mozilla.org (AMO). And what if I don't want to use a "web property" to distribute an extension? What if I want to give my users a honest-to-God file, whether via e-mail or IM message or USB drive? > Please note that all extensions must meet the requirements outlined in our Add-on Policies and Developer Agreement. Or what? I can't make an extension and give it to friends unless it meets your policy? That's pushing it a bit.

dmurray 7y ago
Maybe the file you distribute on a USB stick should contain a self-contained webserver on localhost that your users can run, then install the extension through Firefox? This raises some security concerns in theory (your user now has to run an executable that is not sandboxed by the browser), but they were already trusting you enough to plug in a USB stick.
- TeMPOraL 7y ago
  As you say, this wouldn't impact security any more than inserting the USB stick itself would - but having to run a HTTP server on loopback just to circumvent some security mechanism on the browser you own[0] would only say that some engineering mistakes have been made. -- [0] - Do you still own a copy of Firefox? That's probably the hidden crux of the issue.
arnvidr 7y ago
You can still do that of course, with the same file that you would offer your friends through your "web property". A file is still a file.
- oefrha 7y ago
  I doubt it. According to https://extensionworkshop.com/documentation/publish/submitting-an-add-on/#self-distribution https://extensionworkshop.com/documentation/publish/submitti... the file has to be validated and signed through their submission form, and, I quote, > Note, however, that your add-on may still be subject to further review, if it is you’ll receive notification of the outcome of the review later. So other than hosting, I fail to see how this is different from distributing through the official channel — you still have to pass their review. Note that I’ve never written a Firefox add-on (I’ve written plenty of Chrome extensions though), so please correct me if I’m wrong.

zAy0LfpBZLC8mAC 7y ago

So, from now on malware will come with a minimal Firefox binary included where this functionality is patched out, and the malware will use that binary for installing extensions into the Firefox profile on your machine. What will Mozilla do next then? Close the source so malware authors can't compile their own Firefox, for security reasons? Only allow installation on DRMed systems?

zAy0LfpBZLC8mAC 7y ago
I would really like to know why people are downvoting this ... like, how is this not exactly what is going to happen next on the malware side?
- deleted 7y ago
  [deleted]
- unqueued 7y ago
  It does not appear anything you said was wrong, so I don't know why you are being downvoted.

bayindirh 7y ago

The question in my mind is how this change is gonna affect the enterprise installations. I'm aware of some installations which rely on both auto configuration and some proprietary extensions to the enterprises themselves which needs to be non-removable and always active. Disabling installation of sideloaded extensions may make these installations harder, if not impossible.

dessant 7y ago

Mozilla intends to remove all methods for installing private extensions in the release version of Firefox. The extension source code must be disclosed to Mozilla during signing, and it must adhere to their add-on policies [1]. Mozilla is blocklisting benign extensions distributed outside of Firefox Add-ons which do not follow these guidelines [2]. They are working on disabling a method which allows users with root access to configure Firefox to load unsigned extensions [3], citing concerns over adware with root access. The feature is being disabled even on Linux, where such adware was never really a problem, despite making several other use cases impossible. Requiring extensions to be signed by default is a great initiative by Mozilla, but we must be given ways to install private extensions in the release version of Firefox without disclosing the source code to Mozilla, or worrying that an extension for personal use may be blocklisted. Forbidding local extensions in the release version of Firefox, without a way to override the option, guarded by administrative access and appropriate warnings, is heavy-handed and has a questionable threat model. Signing can be turned off in Firefox Developer Edition (based on Firefox Beta) and unbranded builds (no automatic updates), but those browsers are not meant for end users. We must be given ways to install private extensions in the best version of Firefox, and that is the release version of the browser. Not even Google is this heavy-handed, they allow installing local extensions in Chrome after users enable an option, although a warning is shown on browser restarts about the presence of external extensions, which can be dismissed. [1] https://extensionworkshop.com/documentation/publish/add-on-policies/ https://extensionworkshop.com/documentation/publish/add-on-p... [2] https://github.com/jeremiahlee/page-translator/issues/26 https://github.com/jeremiahlee/page-translator/issues/26 [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1514451 https://bugzilla.mozilla.org/show_bug.cgi?id=1514451

SpicyLemonZest 7y ago
But I think Chrome’s example clearly shows why they feel they have to do this. The average user doesn’t understand extensions the same way you do; to them, Firefox is Firefox no matter how many bells and whistles are added on. So it’s a serious reputational risk that Mozilla currently allows unsafe code to run in an official Firefox release. edit: Like, look at your second link. The extension was running remote code loaded from a third-party site! I'm sure you see why Mozilla can't just let that happen.

nullc 7y ago

Won't the "bundleware" just directly frob Firefox's state to make it think the user authorized it?

greatgib 7y ago

This moment when you have no say anymore on what you want to install on your own computer without a corporate cloud server deciding for you...

aembleton 7y ago
You don't have to use a cloud server, just host it yourself.
- ersii 7y ago
  Oh, you mean like Firefox Sync? Which was self-hostable.. Promised to be that once again, but still hasn't been opened up again.
  - drdaeman 7y ago
    Well, it is self-hostable, but it's a giant mess. I've self-hosted Accounts+Sync with a lots of elbow grease. Even had my own alternative re-implementation - because running all this Mozilla code was more complicated than hacking up something of my own. I gave up about a half an year ago.

kwk1 7y ago

How will this affect extensions packaged in Linux distributions, e.g. Debian's webext-* packages. I for one want to be able to do stuff like `sudo apt install firefox webext-ublock-origin` and have all the users on the system have this extension installed and enabled.

ripdog 7y ago
Debian will need to patch Firefox for this to continue to work.
- dessant 7y ago
  I think Debian already compiles Firefox with a flag to allow unsigned extensions, but this may require further changes.

g3houdini 7y ago

Time for a new browser introduction....

nathancahill 7y ago

Title is flame-bait. It should say "Firefox to Discontinue Silently Sideloading Extensions"

fareesh 7y ago

There is a rule about ensuring the original title is the same as the submission title but in this case the original title is quite badly written. Is there some way to submit this post or edit the title to maintain compliance with the submission rule and also make it less misleading?

2ion 7y ago

Say I wanted to provide a multi-seat computer where all users have a certain default addon experience using Firefox, like installing uBlock Origin. This seems to make provisioning such a setup impossible? Or I would have to generate Firefox profiles dynamically, on-the-fly?

4bpp 7y ago

What would be a reasonable way to let Mozilla know that I strongly disagree with this decision (and, really, the majority of calls they have made surrounding extension security lately)? Who was responsible for making this decision on their end? I am very close to the point where I can no longer recommend Firefox to anyone (after sticking with them through some of the darkest years in terms of product quality), because they are becoming a worse enemy of the open internet than Google but harder to hold accountable for it.

balelayers 7y ago
I don't know the answer to your question, but why do disagree so strongly?

TazeTSchnitzel 7y ago

What this is: • Preventing malware and enterprises from silently installing unremovable extensions through a special mechanism What this is not: • Preventing users from installing extensions without using the Internet (they can just load an xpi file like always) • Preventing power users from installing unsigned extensions (already not possible in standard Firefox except non-persistently for development, but Mozilla provide unbranded builds which let you use extensions) Why this is being done: • Preventing adware adding itself to your browser without your consent and making itself difficult to remove Not why this is being done: • Mozilla hates users / the open Internet / freedom (their foremost concern is protecting users from malware nonconsensually installing extensions, they have always provided versions of Firefox allowing you to do whatever you want if you want that, and indeed standard Firefox does let you load unsigned extensions temporarily)

mike_hock 7y ago
I do hope that Debian will start patching out these nanny features, though, including the ones we've already had for a while (like no unsigned extensions). Maybe it's time for a revival of Iceweasel. If malware gains enough access to my system to put extensions in the sideloading folder I have bigger problems than Mozilla can protect me from.

qwerty456127 7y ago

If an extension can't be installed silently (e.g. by a -rd party app installer once you forget to uncheck a checkbox) that's great (except for enterprise users perhaps as they need to automate such tasks). If I can't just install an extension/app manually from a file on my hard drive - I don't need such a browser/platform.

hartator 7y ago

> To give users more control over their extensions, support for sideloaded extensions will be discontinued. Isn't kind of contradictory?

vkaku 7y ago

Bad, bad Mozilla! For me, personally, it's what makes this model so fallible and not developer / community friendly. What if, tomorrow, some country blacklists the Firefox website, and one still needs to load some privacy extensions? This is exactly the sort of usecase Firefox should allow, if it's pro privacy.

mintplant 7y ago
Add-ons can still be installed from outside addons.mozilla.org, as long as they're signed (an automated process), or you're using something other than an official stable-channel Firefox build and have unsigned add-on install enabled. The announcement in question pertains to a specific method of silently force-installing unremovable add-ons to Firefox.