3 ms·

If you have to upload your addons to the internet before you can install them (even if it is to have them signed) that's hardly "local".

by ahbyb 7y ago

callahad 7y ago
Signing is only required on official release and beta builds -- users on developer edition, nightly, and unbranded builds can opt-out of the signing requirement by flipping a setting in about:config.
- deleted 7y ago
  [deleted]
- whitexn--g28h 7y ago
  Unsigned extensions are also not for end-users.
  - apostacy 7y ago
    > Unsigned extensions are also not for end-users. Says who??? Part of the problem is the very delineation between developer and end user. How about Firefox just be a powerful open platform that anyone can develop for easily with as few roadblocks as possible? We should all be one step away from being developers. I am so glad I was on the old Firefox 12 years ago. I'm glad that I was able to quickly whip up extensions and share them with my friends. Wanting to automate bypassing my school's wifi captive portal, or wanting to change how the bookmark menu was displayed encouraged me to experiment. The fact that Mozilla now sees only an audience of consumers that need to be protected from themselves and marketed to is the problem. Mozilla is afraid of their precious precious brand being sullied.
    - Jonnax 7y ago
      There's a developer edition which allows unsigned add-ons. https://www.mozilla.org/en-US/firefox/developer/ https://www.mozilla.org/en-US/firefox/developer/
      - apostacy 7y ago
        The point of my post was that there should not be such a hard delineation between regular users and developers. A developer edition is not a helpful solution.
        zaroth 7y ago
        What’s the trade-off here? Browsers are trying to protect users against a metric ton of malware trying to exfiltrate login credentials, and the vast majority of users have no clue what an extension even is. Last week my dad thought he had a virus, but really it was just a BS spam site that he had accidentally allowed to send him notifications. The screen in Chrome to revoke notification access was like 8 clicks deep. Browser extensions are a powerful, beautiful, dangerous bit of tech. Is it asking too much to put some guard rails in place that really aren’t too much trouble to follow?
        apostacy 7y ago
        This would not have protected your father from any of that. If hostile code can inject an extension into your Firefox profile, it can also install a keylogger or read your unencrypted Firefox password store. There is almost no protection against your credentials being exfiltrated. Neither would it protect you against unwanted notifications. It will however greatly reduce the functionality of Firefox. This is security theater. > Browser extensions are a powerful, beautiful, dangerous bit of tech. Is it asking too much to put some guard rails in place that really aren’t too much trouble to follow? There are many layers of guard rails already. The problem is that now they want to also inspect every extension that I use, even if it is for completely private use and will never be available to the public. And Mozilla does not exactly have a good track record with trust.
        anoncake 7y ago
        > Is it asking too much to put some guard rails in place that really aren’t too much trouble to follow? No, but that's not what Mozilla is doing. A confirmation prompt is a guardrail. This is a fence. > Last week my dad thought he had a virus, but really it was just a BS spam site that he had [...] allowed to send him notifications. That's his own fault. Not an ideal outcome by any means but a private organization has no right to restrict people's freedom just to protect others from themselves.
    - Dylan16807 7y ago
      Would setting up signatures have taken more than a few extra minutes?
  - catalogia 7y ago
    Developers are end users too.
- mook 7y ago
  There are no release (as in, non-Alpha) builds with updates, last I checked. Developer edition and nighties are not release builds. Unbranded builds don't get updates.
  - deleted 7y ago
    [deleted]
  - barryvan 7y ago
    Developer edition definitely gets regular updates, fwiw.
    - Dylan16807 7y ago
      Developer edition has updates but it's a beta. Unbranded builds aren't a beta but don't get updates. There is no version that's just like normal firefox except without signing enforcement.
  - A1kmm 7y ago
    I worked around this with a script that patches the omni.ja zipfile to change the setting to require signing. It needs to be unpatched for updates - I don't allow my normal day-to-day Firefox instance to write to it's own binary anyway. Firefox tells me when there is an update, and I then restart into my special script that unpatches, runs Firefox with permissions to modify itself and a profile that I don't use for day to day browsing, only for updates, and then patches it again. Scripts to patch / unpatch it are here: https://github.com/A1kmm/enable-unsigned-firefox-addons https://github.com/A1kmm/enable-unsigned-firefox-addons

If you have to upload your addons to the internet before you can install them (even if it is to have them signed) that's hardly "local".

by ahbyb 7y ago

If you have to upload your addons to the internet before you can install them (even if it is to have them signed) that's hardly "local".

callahad 7y ago

Signing is only required on official release and beta builds -- users on developer edition, nightly, and unbranded builds can opt-out of the signing requirement by flipping a setting in about:config.

deleted 7y ago
[deleted]
whitexn--g28h 7y ago
Unsigned extensions are also not for end-users.
- apostacy 7y ago
  > Unsigned extensions are also not for end-users. Says who??? Part of the problem is the very delineation between developer and end user. How about Firefox just be a powerful open platform that anyone can develop for easily with as few roadblocks as possible? We should all be one step away from being developers. I am so glad I was on the old Firefox 12 years ago. I'm glad that I was able to quickly whip up extensions and share them with my friends. Wanting to automate bypassing my school's wifi captive portal, or wanting to change how the bookmark menu was displayed encouraged me to experiment. The fact that Mozilla now sees only an audience of consumers that need to be protected from themselves and marketed to is the problem. Mozilla is afraid of their precious precious brand being sullied.
  - Jonnax 7y ago
    There's a developer edition which allows unsigned add-ons. https://www.mozilla.org/en-US/firefox/developer/ https://www.mozilla.org/en-US/firefox/developer/
    - apostacy 7y ago
      The point of my post was that there should not be such a hard delineation between regular users and developers. A developer edition is not a helpful solution.
      - zaroth 7y ago
        What’s the trade-off here? Browsers are trying to protect users against a metric ton of malware trying to exfiltrate login credentials, and the vast majority of users have no clue what an extension even is. Last week my dad thought he had a virus, but really it was just a BS spam site that he had accidentally allowed to send him notifications. The screen in Chrome to revoke notification access was like 8 clicks deep. Browser extensions are a powerful, beautiful, dangerous bit of tech. Is it asking too much to put some guard rails in place that really aren’t too much trouble to follow?
        apostacy 7y ago
        This would not have protected your father from any of that. If hostile code can inject an extension into your Firefox profile, it can also install a keylogger or read your unencrypted Firefox password store. There is almost no protection against your credentials being exfiltrated. Neither would it protect you against unwanted notifications. It will however greatly reduce the functionality of Firefox. This is security theater. > Browser extensions are a powerful, beautiful, dangerous bit of tech. Is it asking too much to put some guard rails in place that really aren’t too much trouble to follow? There are many layers of guard rails already. The problem is that now they want to also inspect every extension that I use, even if it is for completely private use and will never be available to the public. And Mozilla does not exactly have a good track record with trust.
        anoncake 7y ago
        > Is it asking too much to put some guard rails in place that really aren’t too much trouble to follow? No, but that's not what Mozilla is doing. A confirmation prompt is a guardrail. This is a fence. > Last week my dad thought he had a virus, but really it was just a BS spam site that he had [...] allowed to send him notifications. That's his own fault. Not an ideal outcome by any means but a private organization has no right to restrict people's freedom just to protect others from themselves.
  - Dylan16807 7y ago
    Would setting up signatures have taken more than a few extra minutes?
- catalogia 7y ago
  Developers are end users too.
mook 7y ago
There are no release (as in, non-Alpha) builds with updates, last I checked. Developer edition and nighties are not release builds. Unbranded builds don't get updates.
- deleted 7y ago
  [deleted]
- barryvan 7y ago
  Developer edition definitely gets regular updates, fwiw.
  - Dylan16807 7y ago
    Developer edition has updates but it's a beta. Unbranded builds aren't a beta but don't get updates. There is no version that's just like normal firefox except without signing enforcement.
- A1kmm 7y ago
  I worked around this with a script that patches the omni.ja zipfile to change the setting to require signing. It needs to be unpatched for updates - I don't allow my normal day-to-day Firefox instance to write to it's own binary anyway. Firefox tells me when there is an update, and I then restart into my special script that unpatches, runs Firefox with permissions to modify itself and a profile that I don't use for day to day browsing, only for updates, and then patches it again. Scripts to patch / unpatch it are here: https://github.com/A1kmm/enable-unsigned-firefox-addons https://github.com/A1kmm/enable-unsigned-firefox-addons