7 ms·

In my opinion, Firefox imposes complex constraints on casual developers, and web-ext is part of it. I have a few web extensions I wrote in order to customize a

In my opinion, Firefox imposes complex constraints on casual developers, and web-ext is part of it. I have a few web extensions I wrote in order to customize a few web sites (automate tasks, alter display, etc). After a Firefox update, they were not allowed anymore, because they're not signed. The extensions page cannot load local extensions. Then I discovered the secret debug-extensions page of Firefox where I could load them. Unfortunately, Firefox removes local extension when it closes. I had the choice between loading each local extension after launching a new Firefox, which mean a dozen of clicks, or installing web-ext in order to sign my extensions, and sign them again after each change (no idea if there were extra actions needed in the process, like manual reload). I opted for a much simple option: with Chromium-based browsers, you can enable the extension-developer mode, and then you're allowed to load local extensions from the normal extensions page. Extensions are kept across restarts.

badsectoracula 6y ago
I had the same issue but i solved it by using Firefox Developer edition instead which allows you to install unsigned extensions. This allowed me to use my Firefox profile (by manually copying the files over the existing profile files) which i have going back several years now. If that ever changes i'll look into making my own Firefox binaries or whatever that have this check removed.
- diegocg 6y ago
  Unbranded stable (and beta) builds also allows disabling the signature check. There are plenty of options, just not in the official stable builds.
  - iggldiggl 6y ago
    And the long-term support (ESR) version as well, if I remember correctly.
  - badsectoracula 6y ago
    That makes things even easier then :-P
    - Spivak 6y ago
      I think the argument is that if you’re knowledgeable enough to write an extension you can switch to the “I know what I’m doing version” and let everyone else reap the benefits of malware protection.
  - mook 6y ago
    Does the unbranded stable build have automatic updates yet? Last time I checked (which was quite a while ago) it didn't, which made using it day-to-day seem like a bad idea. I'd totally switch to it if I can just use it normally.
  - johnisgood 6y ago
    What is up with this "Developer edition", "Unbranded stable", and God knows what else?
    - badsectoracula 6y ago
      Developer edition: https://www.mozilla.org/en-US/firefox/developer/ https://www.mozilla.org/en-US/firefox/developer/ This updates frequently since it is basically Firefox beta (though in practice i never had any issue). Note that this has telemetry enabled by default so you may want to disable it via the options. Unbranded stable: https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... The unbranded stable isn't updated automatically so you'll need to check for new versions yourself (shouldn't be too hard to automate it with a python script or whatever that runs via cronjob or windows task scheduler and notifies you for new versions).
calpaterson 6y ago
They don't document it well but they will sign pretty much anything over the web so long as you're not distributing it on add-ons.mozilla.org (AMO). You don't have to use web-ext. There isn't even a manual review gate for AMO releases after the first one (but it can happen after that fact). I find Mozilla's policies friendlier than Google's but this is the first I've heard of "extension developer mode" - will have to look into that as my extension is cross browser.
freethinky 6y ago
At least until 82 I (have to try if it still works), I used: about:config xpinstall.signatures.required -> false zip -0 mywebext.xpi manifest.json *.js *.png *.html about:addons -> install xpi
- AlexITC 6y ago
  That worked for me only after including this snippet on the manifest: "browser_specific_settings": { "gecko": { "id": "example@gmail.com" } }
Farow 6y ago
It might be a bit tiresome if you make regular changes but you can have mozilla sign your extension without having to wait for them to review or place it on AMO. https://extensionworkshop.com/documentation/publish/signing-and-distribution-overview/ https://extensionworkshop.com/documentation/publish/signing-...
- account42 6y ago
  What is the signature good for if they hand it out without review? Might as well get rid of the requirement.
  - toyg 6y ago
    They get an archive of stuff they can (theoretically) ban if found to be malware. Which I guess (or rather I hope) spreads a bit of a chilling effect among potential malware writers.
  - dblohm7 6y ago
    Then there’s something to revoke if necessary.
madushan1000 6y ago
You can still use firefox autoconfig scripts to do a lot of things that they locked down(like using old XUL apis) https://support.mozilla.org/en-US/kb/customizing-firefox-using-autoconfig#w_functions-of-autoconfig https://support.mozilla.org/en-US/kb/customizing-firefox-usi...
maple3142 6y ago
If you only need to tweak websites, using a userscript manager is much more easier: https://addons.mozilla.org/en-US/android/addon/violentmonkey/ https://addons.mozilla.org/en-US/android/addon/violentmonkey...
AlexITC 6y ago
I feel you, while the debugging option is handy for development, it is annoying that you can't easily install the extension permanently. The way I do it now is to package the extension as zip (no webext needed) with a custom manifest, which can be installed by setting xpinstall.signatures.required to false in the about:config page. On the manifest side, you just need to include this snippet: "browser_specific_settings": { "gecko": { "id": "example@gmail.com" } }
weaksauce 6y ago
you can sign up for a free account on mozilla's site to sign personal extensions without any oversight as long as you don't select the option to list it on the marketplace. (even that is free but it requires a bit more review on the part of mozilla)

badsectoracula 6y ago

I had the same issue but i solved it by using Firefox Developer edition instead which allows you to install unsigned extensions. This allowed me to use my Firefox profile (by manually copying the files over the existing profile files) which i have going back several years now. If that ever changes i'll look into making my own Firefox binaries or whatever that have this check removed.

diegocg 6y ago
Unbranded stable (and beta) builds also allows disabling the signature check. There are plenty of options, just not in the official stable builds.
- iggldiggl 6y ago
  And the long-term support (ESR) version as well, if I remember correctly.
- badsectoracula 6y ago
  That makes things even easier then :-P
  - Spivak 6y ago
    I think the argument is that if you’re knowledgeable enough to write an extension you can switch to the “I know what I’m doing version” and let everyone else reap the benefits of malware protection.
- mook 6y ago
  Does the unbranded stable build have automatic updates yet? Last time I checked (which was quite a while ago) it didn't, which made using it day-to-day seem like a bad idea. I'd totally switch to it if I can just use it normally.
- johnisgood 6y ago
  What is up with this "Developer edition", "Unbranded stable", and God knows what else?
  - badsectoracula 6y ago
    Developer edition: https://www.mozilla.org/en-US/firefox/developer/ https://www.mozilla.org/en-US/firefox/developer/ This updates frequently since it is basically Firefox beta (though in practice i never had any issue). Note that this has telemetry enabled by default so you may want to disable it via the options. Unbranded stable: https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... The unbranded stable isn't updated automatically so you'll need to check for new versions yourself (shouldn't be too hard to automate it with a python script or whatever that runs via cronjob or windows task scheduler and notifies you for new versions).

calpaterson 6y ago

They don't document it well but they will sign pretty much anything over the web so long as you're not distributing it on add-ons.mozilla.org (AMO). You don't have to use web-ext. There isn't even a manual review gate for AMO releases after the first one (but it can happen after that fact). I find Mozilla's policies friendlier than Google's but this is the first I've heard of "extension developer mode" - will have to look into that as my extension is cross browser.

freethinky 6y ago

At least until 82 I (have to try if it still works), I used: about:config xpinstall.signatures.required -> false zip -0 mywebext.xpi manifest.json *.js *.png *.html about:addons -> install xpi

AlexITC 6y ago
That worked for me only after including this snippet on the manifest: "browser_specific_settings": { "gecko": { "id": "example@gmail.com" } }

Farow 6y ago

It might be a bit tiresome if you make regular changes but you can have mozilla sign your extension without having to wait for them to review or place it on AMO. https://extensionworkshop.com/documentation/publish/signing-and-distribution-overview/ https://extensionworkshop.com/documentation/publish/signing-...

account42 6y ago
What is the signature good for if they hand it out without review? Might as well get rid of the requirement.
- toyg 6y ago
  They get an archive of stuff they can (theoretically) ban if found to be malware. Which I guess (or rather I hope) spreads a bit of a chilling effect among potential malware writers.
- dblohm7 6y ago
  Then there’s something to revoke if necessary.

madushan1000 6y ago

You can still use firefox autoconfig scripts to do a lot of things that they locked down(like using old XUL apis) https://support.mozilla.org/en-US/kb/customizing-firefox-using-autoconfig#w_functions-of-autoconfig https://support.mozilla.org/en-US/kb/customizing-firefox-usi...

maple3142 6y ago

If you only need to tweak websites, using a userscript manager is much more easier: https://addons.mozilla.org/en-US/android/addon/violentmonkey/ https://addons.mozilla.org/en-US/android/addon/violentmonkey...

AlexITC 6y ago

I feel you, while the debugging option is handy for development, it is annoying that you can't easily install the extension permanently. The way I do it now is to package the extension as zip (no webext needed) with a custom manifest, which can be installed by setting xpinstall.signatures.required to false in the about:config page. On the manifest side, you just need to include this snippet: "browser_specific_settings": { "gecko": { "id": "example@gmail.com" } }

weaksauce 6y ago

you can sign up for a free account on mozilla's site to sign personal extensions without any oversight as long as you don't select the option to list it on the marketplace. (even that is free but it requires a bit more review on the part of mozilla)