5 ms·

Mozilla intends to remove all methods for installing private extensions in the release version of Firefox. The extension source code must be disclosed to Mozill

Mozilla intends to remove all methods for installing private extensions in the release version of Firefox. The extension source code must be disclosed to Mozilla during signing, and it must adhere to their add-on policies [1]. Mozilla is blocklisting benign extensions distributed outside of Firefox Add-ons which do not follow these guidelines [2]. They are working on disabling a method which allows users with root access to configure Firefox to load unsigned extensions [3], citing concerns over adware with root access. The feature is being disabled even on Linux, where such adware was never really a problem, despite making several other use cases impossible. Requiring extensions to be signed by default is a great initiative by Mozilla, but we must be given ways to install private extensions in the release version of Firefox without disclosing the source code to Mozilla, or worrying that an extension for personal use may be blocklisted. Forbidding local extensions in the release version of Firefox, without a way to override the option, guarded by administrative access and appropriate warnings, is heavy-handed and has a questionable threat model. Signing can be turned off in Firefox Developer Edition (based on Firefox Beta) and unbranded builds (no automatic updates), but those browsers are not meant for end users. We must be given ways to install private extensions in the best version of Firefox, and that is the release version of the browser. Not even Google is this heavy-handed, they allow installing local extensions in Chrome after users enable an option, although a warning is shown on browser restarts about the presence of external extensions, which can be dismissed. [1] https://extensionworkshop.com/documentation/publish/add-on-policies/ https://extensionworkshop.com/documentation/publish/add-on-p... [2] https://github.com/jeremiahlee/page-translator/issues/26 https://github.com/jeremiahlee/page-translator/issues/26 [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1514451 https://bugzilla.mozilla.org/show_bug.cgi?id=1514451

SpicyLemonZest 7y ago
But I think Chrome’s example clearly shows why they feel they have to do this. The average user doesn’t understand extensions the same way you do; to them, Firefox is Firefox no matter how many bells and whistles are added on. So it’s a serious reputational risk that Mozilla currently allows unsafe code to run in an official Firefox release. edit: Like, look at your second link. The extension was running remote code loaded from a third-party site! I'm sure you see why Mozilla can't just let that happen.
- dessant 7y ago
  Chrome's example clearly shows that having secure default options, while also giving users more control and educating them about possible drawbacks, is a viable alternative to restricting user freedoms and keeping users ignorant. The extension was running remote code from Google Translate. The extension's author could no longer run a safe, unlisted extension in their own browser. Mozilla should have no business in what code people run in their own browsers, when that code was distributed outside of Mozilla services. This is esentially arguing that user scripts, and the extensions which enable them, should be banned too.
  - SpicyLemonZest 7y ago
    Sometimes they should be. Consider CORS for example; Firefox will refuse to load some resources it's been instructed to load, and there's no way to make it load them without breaking other things, but this is completely uncontroversial. Enforcing security boundaries is a reasonable thing for a program to do.
    - dessant 7y ago
      Users should be treated with respect and given control over their own devices, while platforms should do their best to implement safe defaults, and educate users about the potential risks of certain actions. CORS is a security directive set by sites over which users have full control through browser configuration and extensions.
      - SpicyLemonZest 7y ago
        And that's absolutely the right way to think about CORS. But what it actually does under the hood, the underlying behavior that makes CORS effective as a security directive, is: * You instruct your computer to load site A. Site A has some scripts on it, so part of the process of loading site A is executing that Javascript code. * The Javascript code instructs Firefox to display a resource from site B. * Firefox refuses to display that resource, even though your website told it to, because it doesn't think displaying the resource would be safe. I think that's also the right perspective here. Firefox won't run unsafe extensions, in the same way and for the same reasons as it won't run unsafe cross-origin requests.
apostacy 7y ago
This is horrifying on a number of levels. I don't think that even Google has tried exerting this much control over users. This does not make sense if it is just to fight malware. I no longer believe that Mozilla is acting in good faith. It seems that Mozilla is trying to claw control of Firefox away from users. I do not trust them to decide what extensions I can have. Once they have locked it down even more, are they still going to be so nice about approving extensions? Either this is just hubris and contempt for users, or a poor attempt to copy Google's restrictions, or something worse.
Mathnerd314 7y ago
> those browsers are not meant for end users. 1% of 500M users is still millions of users. I don't know what the actual fraction of Beta/Developer vs Release users is, but the scale is significant enough that the beta channel is definitely intended for end users. IMO Beta is the best channel of Firefox. Release is just an outdated version maintained for corporate/enterprise installations.

SpicyLemonZest 7y ago

But I think Chrome’s example clearly shows why they feel they have to do this. The average user doesn’t understand extensions the same way you do; to them, Firefox is Firefox no matter how many bells and whistles are added on. So it’s a serious reputational risk that Mozilla currently allows unsafe code to run in an official Firefox release. edit: Like, look at your second link. The extension was running remote code loaded from a third-party site! I'm sure you see why Mozilla can't just let that happen.

dessant 7y ago
Chrome's example clearly shows that having secure default options, while also giving users more control and educating them about possible drawbacks, is a viable alternative to restricting user freedoms and keeping users ignorant. The extension was running remote code from Google Translate. The extension's author could no longer run a safe, unlisted extension in their own browser. Mozilla should have no business in what code people run in their own browsers, when that code was distributed outside of Mozilla services. This is esentially arguing that user scripts, and the extensions which enable them, should be banned too.
- SpicyLemonZest 7y ago
  Sometimes they should be. Consider CORS for example; Firefox will refuse to load some resources it's been instructed to load, and there's no way to make it load them without breaking other things, but this is completely uncontroversial. Enforcing security boundaries is a reasonable thing for a program to do.
  - dessant 7y ago
    Users should be treated with respect and given control over their own devices, while platforms should do their best to implement safe defaults, and educate users about the potential risks of certain actions. CORS is a security directive set by sites over which users have full control through browser configuration and extensions.
    - SpicyLemonZest 7y ago
      And that's absolutely the right way to think about CORS. But what it actually does under the hood, the underlying behavior that makes CORS effective as a security directive, is: * You instruct your computer to load site A. Site A has some scripts on it, so part of the process of loading site A is executing that Javascript code. * The Javascript code instructs Firefox to display a resource from site B. * Firefox refuses to display that resource, even though your website told it to, because it doesn't think displaying the resource would be safe. I think that's also the right perspective here. Firefox won't run unsafe extensions, in the same way and for the same reasons as it won't run unsafe cross-origin requests.

apostacy 7y ago

This is horrifying on a number of levels. I don't think that even Google has tried exerting this much control over users. This does not make sense if it is just to fight malware. I no longer believe that Mozilla is acting in good faith. It seems that Mozilla is trying to claw control of Firefox away from users. I do not trust them to decide what extensions I can have. Once they have locked it down even more, are they still going to be so nice about approving extensions? Either this is just hubris and contempt for users, or a poor attempt to copy Google's restrictions, or something worse.

Mathnerd314 7y ago

> those browsers are not meant for end users. 1% of 500M users is still millions of users. I don't know what the actual fraction of Beta/Developer vs Release users is, but the scale is significant enough that the beta channel is definitely intended for end users. IMO Beta is the best channel of Firefox. Release is just an outdated version maintained for corporate/enterprise installations.