11 ms·

This seems to be somewhat badly written copy on Mozilla's part. To clear up what this change actually means for an end user: - You can still manually install e

This seems to be somewhat badly written copy on Mozilla's part. To clear up what this change actually means for an end user: - You can still manually install extensions. From now on, all installations will need explicit user confirmation. - No extensions can be installed silently. This is what sideloading did, all extensions in a special folder were installed in all Firefox instances on the computer without the user's consent. This is most definitely a Good Thing, as it means for example no malicious extensions can be silently installed by malware etc. Communicating this change could've been done better, though.

twapi 7y ago
"- You can still manually install extensions" Yes, but not as XPI file. For manual installation, you can install similar to Chrome, that's from source code folder
- devcpp 7y ago
  Will Firefox stop copying Chrome's features that are hostile to power users at some point?
  - ghaff 7y ago
    Probably not. There's a clear conflict between what (some) power users want and what the best/safest choices are for the general public. And, in general, mainstream platforms like Firefox should default to what's best for the general public. (Yes, you could have bypass mechanisms but backdoors like that are more or less asking for trouble.) See also Apple. Added: It's not clear to me how "hostile to power users" this particular change is. But my general statement still applies.
    - ptero 7y ago
      It is not clear what is best for the general public. You can aim for the "safest" choice, which seems to be what you are advocating. If so, it needs to be said explicitly and the implications of functionality reduction (that safety increases always brings) openly discussed and debated. The model of claiming "we will do what is best for users" with a freedom to replace "best" by "X" has been thoroughly compromised by googles and facebooks of this world. We need to be explicit about goals and tradeoffs. Not attacking your post, just arguing for being clear and honest on goals of non-commercial software. My 2c.
      - ghaff 7y ago
        Yes, I'd argue "safest" is usually the best default for the general public. My reasoning is that a bit more fine-grained control, performance, choice, etc. doesn't have much upside for most people whereas getting compromised can be a very big downside. Perhaps Firefox hasn't been very clear on its tradeoffs but Apple, for example, seems to have been IMO. (Yes, it tends to be wrapped in marketing rather than tech speak but I think they've been pretty consistent about their priorities.)
        ptero 7y ago
        I personally have no objections (usually not even strong feelings) to setting defaults, as long as that's what they are -- default choices that users can change if they see fit. But an option that cannot be changed is not a default choice -- it is a hard coded design decision. My 2c.
        ghaff 7y ago
        Firefox is open source. AFAIK you could always run a fork with your preferred behaviors. Same applies to speculative execution mitigations in Linux.
        ptero 7y ago
        And so is, for example, Android. But due to some (shady) tactics, a successful fork of either is impossible for a small group. Saying to a hungry kid in a favela "you are free to get rich" is technically correct, but ignores practicalities. You could argue that Mozilla is either a shepherd (making best decisions for most users and that's it; take it or leave it) or a partner (listen to users and try to implement features they want) but you cannot eat your cake and have it too.
        jtgeibel 7y ago
        What makes it nearly impossible to fork Firefox? Mozilla already distributes an unbranded "fork" that allows unigned extensions. It's just a build flag away. What potentially shady tactics am I missing?
    - grawprog 7y ago
      >what the best/safest choices are for the general public. Sometimes I think tech people forget 'the general public' is made up of adults capable of learning and making their own choices if educated properly on matters.
      - ghaff 7y ago
        Sure. Most adults can learn lots of things. Most of us only care enough and have time enough to educate ourselves on a very small subset of the tools we use and tasks we perform on a daily basis. By and large, I trust the tools I use out of the box to be safe (subject to what common sense typical functional adults would be expected to have). It is often reasonable to provide the option to use tools in ways that are less safe. Sometimes that's unavoidable. You can certainly use a chainsaw unsafely although I also think it's perfectly reasonable for chainsaw manufacturers to not provide easy ways to defeat the various safety mechanisms that are built in.
        pbhjpbhj 7y ago
        So you'd only buy a chainsaw with a codepad entry where you have to contact the manufacturer and ask them 'can I cut this log'; ooh, so much safer! But where does that leave the people who been buying that brand of chainsaw for a decade or more and don't want the restrictions? Just remove the codepad, well yes, so long as the manufacturer doesn't weld it on ... oh, and they just decided to weld it on. Such safety, much wow.
      - acdha 7y ago
        How many topics do you have time and energy to be “educated properly” on? What are the odds that learning about the issue would lead to a different outcome than what Mozilla is doing? Firefox's openness means it attracts a lot of attention from people who have relatively uncommon preferences but believe they speak for a large group of users and that group tends to portray every disagreement as a betrayal rather than reasoned decisions.
        hqcsfvwn 7y ago
    - apostacy 7y ago
      Do you really consider being able to provision your own profile a backdoor? I do it all the time. Do you think that Apple is a good example of what to do? Having a single entity control what extensions you get to install is not what is best for the general public. Personally, I think that Firefox should be the more flexible extensible alternative to Chrome. It should be to Chrome as Linux is to Windows. They need to stop chasing the demographic that is going to hurt themselves.
      - ghaff 7y ago
        >Do you think that Apple is a good example of what to do? For certain purposes and audiences, yes.
    - vbezhenar 7y ago
      In the end Firefox will anger power users and general public still will use Chrome because they can't resist when it's advertised from every corner (and, honestly, just works better).
  - Endy 7y ago
    No, I doubt they will. And thank you for voicing these concerns.
  - zozbot234 7y ago
    Power users should probably use unbranded versions of the browser that don't have these issues. AIUI, such versions are widely available, even from Mozilla themselves.
    - rndgermandude 7y ago
      >don't have these issues What issues does this change create?
    - pseudalopex 7y ago
      Do unbranded builds get automatic updates now?
  - rndgermandude 7y ago
    What exactly is hostile to power users here?
  - apostacy 7y ago
    Can we place bets onto how long it will take for Firefox to copy Google's malware-like Keystone Agent updater?[1] Then they will have another way to wantonly steamroll over users. But Google is actually benefiting from doing this kind of evil stuff, while Firefox is not. [1]: https://news.ycombinator.com/item?id=21065504 https://news.ycombinator.com/item?id=21065504
- yorwba 7y ago
  The documentation for self-distribution clearly shows the workflow for an XPI file: https://extensionworkshop.com/documentation/publish/submitting-an-add-on/#self-distribution https://extensionworkshop.com/documentation/publish/submitti... What gave you the impression that XPI files would not be supported?
  - ahbyb 7y ago
    That doesn't seem to show how to install an XPI file locally? Unless I'm missing something that's some web interface from AMO
    - minty_phoenix 7y ago
      The original article only discusses a specific, non-standard (to me, at least – probably made more sense for IT departments) method that Mozilla is calling ‘sideloading’ will be disabled. Per the article, ‘sideloading’ is defined as putting an extension file in a special folder that results in all instances of Firefox on the machine automatically loading that extension. In the page yorwba linked, it shows how to generate a signed XPI file that can be distributed and installed locally from that file in a more conventional manner (e.g. drag & drop the file onto Firefox’s Add-ons page).
      - derefr 7y ago
        > probably made more sense for IT departments Yes, the older method of extension side-loading, supported at some point by Edge, Chrome, and Firefox, was for IT departments who created OS deployment images with software (incl. extensions) burned into them. Usually this was combined with Group Policy / Device Profile settings that made the extensions impossible to deactivate or remove ("force enabled") and potentially blocked any extensions other than those preinstalled. I believe that all the browser makers have, at this point, reached a consensus that deploying extensions directly as on-disk files this way makes it 1. too easy for malware to just set itself up as seemingly "deployed by Group Policy"; and 2. makes it too hard for these extensions to be updated as often as they might need to be, or disabled if the browser-maker declares incompatibility with an API in them, etc. What all the browser-makers seem to favor nowadays, for IT departments who want to do OS-image deployment, is an approach where the burned-in Group Policy will just list out a set of extension IDs that are to be force-installed and force-enabled; and then the browser itself will do the work of retrieving and installing them (but will still treat them like any other extension as it goes through the install process, vetting it for compatibility, upgrading it through its registered upgrade channel, etc.) This means that every extension in these browsers now has to live in the browser's extension store—even if it's a private, just-for-your-own-company extension. (Which, honestly, there's not much to be said against; the "enterprise deployment" parts of app-stores don't usually force developers to go through pre-vetting before new versions are published or anything. It's just cloud hosting—with the proviso that, due to having download logs, the app-store can see if your "enterprise extension" has an install profile that looks more like that of a virus rather than an enterprise, and then blacklist it.) Here's Google's documentation on the Group Policy settings that modern Chrome looks for, for comparison: https://support.google.com/chrome/a/answer/7532015?hl=en https://support.google.com/chrome/a/answer/7532015?hl=en. Probably Firefox wants to move toward a similar model. And more power to them, honestly; right now, Firefox's extension ecosystem is far too easy a target for malware authors.
- dessant 7y ago
  Chrome allows installing local extensions from a source folder, and the installation persists across browser sessions. Firefox extensions installed from a local source folder in about:debugging are removed at the end of the browser session.
einpoklum 7y ago
But if you can "manually install" an extension, why can't a third-party manipulate files on disk to reflect the same state of affairs as though you've manually installed? And assuming that's possible, doesn't that mean they've just made side-loading more difficult to do than actually prevented it? If that's the case, it just means that _you_ won't be able to sideload, effectively, but Skype et al will put in some programming time and be able to sideload again. Correct me if I'm wrong!
- lopmotr 7y ago
  There's no way Firefox can protect itself from a 3rd party that can write to the disk. It's only making it more difficult. Viruses will still manage OK.
  - GetOutOfBed 7y ago
    I think his point was that the following statement doesn't make much sense: > This is most definitely a Good Thing, as it means for example no malicious extensions can be silently installed by malware etc.
- gwbas1c 7y ago
  Great question! I think you'll need to review whatever method Firefox uses to flag what extensions the user approved. In general, the OS provides different ways to store data in an encrypted manner so that only your application can read it back. (Keychain on Mac, and DPAPI on Windows.) Furthermore, modern OSes provide sandboxing so that your application can not be tampered with. I'm not sure if Firefox uses this. Also, if you're able to figure out how to hide a private key, (perhaps in the Keychain or via DPAPI) you can then use things like digital signatures to know what the user really allowed, and know if your approval mechanism was tampered with. Granted, these mechanisms aren't foolproof... They just make it harder for malware to see things it shouldn't.
  - vbezhenar 7y ago
    AFAIK DPAPI is basically encryption with key specific for current user, not application. So malicious application can easily replicate that process.
KallDrexx 7y ago
Oh is this why some of my computers seem to have 2 1Password extensions installed and others have only 1. I was trying to figure out what the deal was with that.
behnamoh 7y ago
Thanks for clearing this up.
xg15 7y ago
I agree that installing extensions silently or making them unremovable are problematic - however I take issue at them removing the ability to install extensions automatically. So, imagine I'm writing some kind of desktop app that needs a companion browser extension to work correctly - a malware scanner, password manager, etc. The program will break if the companion extension is not present. I guess for the user who installs the program, the installer can ask the user to visit AMO and install the extension themselves - however, how would this be accomplished for other users?
- TheRealPomax 7y ago
  If your application _needs_ a companion extension installed, be a good citizen of other people's computers and during the installation, add a step that says "this application needs the Bleep Bloop extension to work. Do that now?" and if they click yes, you do a system call to open https://yoursite.kibbles/products/bleepbloop/extension https://yoursite.kibbles/products/bleepbloop/extension so they can take care of that part. And if they click no, go "in order for this software to work, you will need to install the Bleep Bloop extension. You can do this from help -> install web extension after installation" so that your users have a completion path afterwards, when they simply run your application. Or, when they click OK you can make your installer tell the OS to "run" your .xpi file, which will open Firefox, and ask the user whether that extension is really something they want to install. And then when they click no you tell them that they can initiate the .xpi install process at any time by going to your application's help -> install extension or something. What you _can't_ do, and what you should never have done in the first place, is copy a file into the magic Firefox directory that forces that extensions to be loaded outside of the control of every user and profile for Firefox on that computer.
  - deleted 7y ago
    [deleted]
jammygit 7y ago
Thanks for clarifying
thereare5lights 7y ago
Goodbye Avast Firefox Extension. I hate that thing so much.
rkachowski 7y ago
Thanks for the clarification. My first thought was that manual installs were disabled ala the android manual install sideloading concept.

twapi 7y ago

"- You can still manually install extensions" Yes, but not as XPI file. For manual installation, you can install similar to Chrome, that's from source code folder

devcpp 7y ago
Will Firefox stop copying Chrome's features that are hostile to power users at some point?
- ghaff 7y ago
  Probably not. There's a clear conflict between what (some) power users want and what the best/safest choices are for the general public. And, in general, mainstream platforms like Firefox should default to what's best for the general public. (Yes, you could have bypass mechanisms but backdoors like that are more or less asking for trouble.) See also Apple. Added: It's not clear to me how "hostile to power users" this particular change is. But my general statement still applies.
  - ptero 7y ago
    It is not clear what is best for the general public. You can aim for the "safest" choice, which seems to be what you are advocating. If so, it needs to be said explicitly and the implications of functionality reduction (that safety increases always brings) openly discussed and debated. The model of claiming "we will do what is best for users" with a freedom to replace "best" by "X" has been thoroughly compromised by googles and facebooks of this world. We need to be explicit about goals and tradeoffs. Not attacking your post, just arguing for being clear and honest on goals of non-commercial software. My 2c.
    - ghaff 7y ago
      Yes, I'd argue "safest" is usually the best default for the general public. My reasoning is that a bit more fine-grained control, performance, choice, etc. doesn't have much upside for most people whereas getting compromised can be a very big downside. Perhaps Firefox hasn't been very clear on its tradeoffs but Apple, for example, seems to have been IMO. (Yes, it tends to be wrapped in marketing rather than tech speak but I think they've been pretty consistent about their priorities.)
      - ptero 7y ago
        I personally have no objections (usually not even strong feelings) to setting defaults, as long as that's what they are -- default choices that users can change if they see fit. But an option that cannot be changed is not a default choice -- it is a hard coded design decision. My 2c.
        ghaff 7y ago
        Firefox is open source. AFAIK you could always run a fork with your preferred behaviors. Same applies to speculative execution mitigations in Linux.
        ptero 7y ago
        And so is, for example, Android. But due to some (shady) tactics, a successful fork of either is impossible for a small group. Saying to a hungry kid in a favela "you are free to get rich" is technically correct, but ignores practicalities. You could argue that Mozilla is either a shepherd (making best decisions for most users and that's it; take it or leave it) or a partner (listen to users and try to implement features they want) but you cannot eat your cake and have it too.
        jtgeibel 7y ago
        What makes it nearly impossible to fork Firefox? Mozilla already distributes an unbranded "fork" that allows unigned extensions. It's just a build flag away. What potentially shady tactics am I missing?
  - grawprog 7y ago
    >what the best/safest choices are for the general public. Sometimes I think tech people forget 'the general public' is made up of adults capable of learning and making their own choices if educated properly on matters.
    - ghaff 7y ago
      Sure. Most adults can learn lots of things. Most of us only care enough and have time enough to educate ourselves on a very small subset of the tools we use and tasks we perform on a daily basis. By and large, I trust the tools I use out of the box to be safe (subject to what common sense typical functional adults would be expected to have). It is often reasonable to provide the option to use tools in ways that are less safe. Sometimes that's unavoidable. You can certainly use a chainsaw unsafely although I also think it's perfectly reasonable for chainsaw manufacturers to not provide easy ways to defeat the various safety mechanisms that are built in.
      - pbhjpbhj 7y ago
        So you'd only buy a chainsaw with a codepad entry where you have to contact the manufacturer and ask them 'can I cut this log'; ooh, so much safer! But where does that leave the people who been buying that brand of chainsaw for a decade or more and don't want the restrictions? Just remove the codepad, well yes, so long as the manufacturer doesn't weld it on ... oh, and they just decided to weld it on. Such safety, much wow.
    - acdha 7y ago
      How many topics do you have time and energy to be “educated properly” on? What are the odds that learning about the issue would lead to a different outcome than what Mozilla is doing? Firefox's openness means it attracts a lot of attention from people who have relatively uncommon preferences but believe they speak for a large group of users and that group tends to portray every disagreement as a betrayal rather than reasoned decisions.
      - hqcsfvwn 7y ago
  - apostacy 7y ago
    Do you really consider being able to provision your own profile a backdoor? I do it all the time. Do you think that Apple is a good example of what to do? Having a single entity control what extensions you get to install is not what is best for the general public. Personally, I think that Firefox should be the more flexible extensible alternative to Chrome. It should be to Chrome as Linux is to Windows. They need to stop chasing the demographic that is going to hurt themselves.
    - ghaff 7y ago
      >Do you think that Apple is a good example of what to do? For certain purposes and audiences, yes.
  - vbezhenar 7y ago
    In the end Firefox will anger power users and general public still will use Chrome because they can't resist when it's advertised from every corner (and, honestly, just works better).
- Endy 7y ago
  No, I doubt they will. And thank you for voicing these concerns.
- zozbot234 7y ago
  Power users should probably use unbranded versions of the browser that don't have these issues. AIUI, such versions are widely available, even from Mozilla themselves.
  - rndgermandude 7y ago
    >don't have these issues What issues does this change create?
  - pseudalopex 7y ago
    Do unbranded builds get automatic updates now?
- rndgermandude 7y ago
  What exactly is hostile to power users here?
- apostacy 7y ago
  Can we place bets onto how long it will take for Firefox to copy Google's malware-like Keystone Agent updater?[1] Then they will have another way to wantonly steamroll over users. But Google is actually benefiting from doing this kind of evil stuff, while Firefox is not. [1]: https://news.ycombinator.com/item?id=21065504 https://news.ycombinator.com/item?id=21065504
yorwba 7y ago
The documentation for self-distribution clearly shows the workflow for an XPI file: https://extensionworkshop.com/documentation/publish/submitting-an-add-on/#self-distribution https://extensionworkshop.com/documentation/publish/submitti... What gave you the impression that XPI files would not be supported?
- ahbyb 7y ago
  That doesn't seem to show how to install an XPI file locally? Unless I'm missing something that's some web interface from AMO
  - minty_phoenix 7y ago
    The original article only discusses a specific, non-standard (to me, at least – probably made more sense for IT departments) method that Mozilla is calling ‘sideloading’ will be disabled. Per the article, ‘sideloading’ is defined as putting an extension file in a special folder that results in all instances of Firefox on the machine automatically loading that extension. In the page yorwba linked, it shows how to generate a signed XPI file that can be distributed and installed locally from that file in a more conventional manner (e.g. drag & drop the file onto Firefox’s Add-ons page).
    - derefr 7y ago
      > probably made more sense for IT departments Yes, the older method of extension side-loading, supported at some point by Edge, Chrome, and Firefox, was for IT departments who created OS deployment images with software (incl. extensions) burned into them. Usually this was combined with Group Policy / Device Profile settings that made the extensions impossible to deactivate or remove ("force enabled") and potentially blocked any extensions other than those preinstalled. I believe that all the browser makers have, at this point, reached a consensus that deploying extensions directly as on-disk files this way makes it 1. too easy for malware to just set itself up as seemingly "deployed by Group Policy"; and 2. makes it too hard for these extensions to be updated as often as they might need to be, or disabled if the browser-maker declares incompatibility with an API in them, etc. What all the browser-makers seem to favor nowadays, for IT departments who want to do OS-image deployment, is an approach where the burned-in Group Policy will just list out a set of extension IDs that are to be force-installed and force-enabled; and then the browser itself will do the work of retrieving and installing them (but will still treat them like any other extension as it goes through the install process, vetting it for compatibility, upgrading it through its registered upgrade channel, etc.) This means that every extension in these browsers now has to live in the browser's extension store—even if it's a private, just-for-your-own-company extension. (Which, honestly, there's not much to be said against; the "enterprise deployment" parts of app-stores don't usually force developers to go through pre-vetting before new versions are published or anything. It's just cloud hosting—with the proviso that, due to having download logs, the app-store can see if your "enterprise extension" has an install profile that looks more like that of a virus rather than an enterprise, and then blacklist it.) Here's Google's documentation on the Group Policy settings that modern Chrome looks for, for comparison: https://support.google.com/chrome/a/answer/7532015?hl=en https://support.google.com/chrome/a/answer/7532015?hl=en. Probably Firefox wants to move toward a similar model. And more power to them, honestly; right now, Firefox's extension ecosystem is far too easy a target for malware authors.
dessant 7y ago
Chrome allows installing local extensions from a source folder, and the installation persists across browser sessions. Firefox extensions installed from a local source folder in about:debugging are removed at the end of the browser session.

einpoklum 7y ago

But if you can "manually install" an extension, why can't a third-party manipulate files on disk to reflect the same state of affairs as though you've manually installed? And assuming that's possible, doesn't that mean they've just made side-loading more difficult to do than actually prevented it? If that's the case, it just means that _you_ won't be able to sideload, effectively, but Skype et al will put in some programming time and be able to sideload again. Correct me if I'm wrong!

lopmotr 7y ago
There's no way Firefox can protect itself from a 3rd party that can write to the disk. It's only making it more difficult. Viruses will still manage OK.
- GetOutOfBed 7y ago
  I think his point was that the following statement doesn't make much sense: > This is most definitely a Good Thing, as it means for example no malicious extensions can be silently installed by malware etc.
gwbas1c 7y ago
Great question! I think you'll need to review whatever method Firefox uses to flag what extensions the user approved. In general, the OS provides different ways to store data in an encrypted manner so that only your application can read it back. (Keychain on Mac, and DPAPI on Windows.) Furthermore, modern OSes provide sandboxing so that your application can not be tampered with. I'm not sure if Firefox uses this. Also, if you're able to figure out how to hide a private key, (perhaps in the Keychain or via DPAPI) you can then use things like digital signatures to know what the user really allowed, and know if your approval mechanism was tampered with. Granted, these mechanisms aren't foolproof... They just make it harder for malware to see things it shouldn't.
- vbezhenar 7y ago
  AFAIK DPAPI is basically encryption with key specific for current user, not application. So malicious application can easily replicate that process.

KallDrexx 7y ago

Oh is this why some of my computers seem to have 2 1Password extensions installed and others have only 1. I was trying to figure out what the deal was with that.

behnamoh 7y ago

Thanks for clearing this up.

xg15 7y ago

I agree that installing extensions silently or making them unremovable are problematic - however I take issue at them removing the ability to install extensions automatically. So, imagine I'm writing some kind of desktop app that needs a companion browser extension to work correctly - a malware scanner, password manager, etc. The program will break if the companion extension is not present. I guess for the user who installs the program, the installer can ask the user to visit AMO and install the extension themselves - however, how would this be accomplished for other users?

TheRealPomax 7y ago
If your application _needs_ a companion extension installed, be a good citizen of other people's computers and during the installation, add a step that says "this application needs the Bleep Bloop extension to work. Do that now?" and if they click yes, you do a system call to open https://yoursite.kibbles/products/bleepbloop/extension https://yoursite.kibbles/products/bleepbloop/extension so they can take care of that part. And if they click no, go "in order for this software to work, you will need to install the Bleep Bloop extension. You can do this from help -> install web extension after installation" so that your users have a completion path afterwards, when they simply run your application. Or, when they click OK you can make your installer tell the OS to "run" your .xpi file, which will open Firefox, and ask the user whether that extension is really something they want to install. And then when they click no you tell them that they can initiate the .xpi install process at any time by going to your application's help -> install extension or something. What you _can't_ do, and what you should never have done in the first place, is copy a file into the magic Firefox directory that forces that extensions to be loaded outside of the control of every user and profile for Firefox on that computer.
- deleted 7y ago
  [deleted]

jammygit 7y ago

Thanks for clarifying

thereare5lights 7y ago

Goodbye Avast Firefox Extension. I hate that thing so much.

rkachowski 7y ago

Thanks for the clarification. My first thought was that manual installs were disabled ala the android manual install sideloading concept.