6 ms·

> If this wasn't Mozilla ... They already disabled (private) extension support on the Windows build (you have to upload your extension to Mozilla servers) and

> If this wasn't Mozilla ... They already disabled (private) extension support on the Windows build (you have to upload your extension to Mozilla servers) and they completely disabled extension support on Firefox mobile (no, that small list of approved extensions isn't enough). I'm not sure they care much about their user base.

derefr 5y ago
In practice, private extensions are malware. 99+% of them. "Put a thing at a path on disk, the web browser picks it up and runs it un-sandboxed and gives it access to all your web traffic" — that's a Grand Canyon-sized security hole in the middle of an otherwise-secure design, and widely exploited. (And there's nothing you can do to plug it through local security, since a virus running with your account's permissions can do all that just as well.) Have you noticed that public-use PCs (in e.g. libraries, hotel lobbies, kiosks) used to have Firefox installs, but now mostly have Chrome installs? It's not that the IT people setting these up are any less fans of FOSS than they used to be. It's that Chrome has, for a while now, only persistently loaded local extensions if they're declared in an MDM policy (this being remote security), while Firefox has continued to trust the local filesystem. Public PCs with Firefox (and without some OS change-reversion tool like Faronics DeepFreeze) have been cesspools of malware extensions since ~2011. Besides — if your private extension isn't malware, why not just upload it to Mozilla's servers, but never set it to public, instead just personally being its only user? (What, are you burning evidence of illegal activities into browser extensions or something? That's bad engineering! Make your illegal activities runtime state!) > they completely disabled extension support on Firefox mobile (no, that small list of approved extensions isn't enough). That's the platforms' idiocy, not Mozilla's. Apple and now Google both say that all non-sandboxed executable code an app ever runs must be part of the app's submission package, to be checked over and approved by the platform owner. That "small list of approved extensions" is a set of extensions that gets burned into the Firefox Mobile binary and audited by the platform-owner during publication. It's small because every extension on it is another chance for a Firefox update to be shot down during QA by an overzealous platform owner. The extensions in the approved set are the ones whose developers understand well exactly what's required to ship code as part of Firefox Mobile, and who therefore do what they can to appease the platform-owners in each release.
- userbinator 5y ago
  What is "malware"? It is already turning into "what they don't want you to run." It is frankly shocking to see such a hardcore authoritarian viewpoint here.
  - quotemstr 5y ago
    The whole industry (outside the cryptocurrency sector) has moved in a sadly authoritarian direction over the past decade or so. You would not believe some of the infantilizing and paternalistic rhetoric I've heard behind closed doors at major tech companies from people who believe they have a "responsibility" to protect the public from itself and promote correct thinking.
  - derefr 5y ago
    > What is “malware” Things that steal your password, track your information, and show you ads. Y’know, BonziBuddy-esque things. Things that have a registered signature in an antivirus database, with nobody complaining about that. Let me rephrase my initial statement to make it more clear: 99+% of the usage of the private extension install API — whether you choose to measure by volume of installations, or by variety of software installed — is by malware. Just like usage of the modern POTS phone system is 50+% by scam callers. Both because of the sheer quantity and variety of bad actors, and how automated and wide-reaching their attacks are; but also because of the dwindling valid use-cases, as most users’ needs have since been met by other technologies that meet those needs better. In the POTS phone case, most people have switched to using email/texting/collab software/IP video-calling, which is why it feels like every ordinary phone call you receive is a spam/scam call. In the browser extension case, most people with more complex needs — e.g. the people who thought Chrome Apps were a good idea, the people who needed their extensions to have a native-library component, etc. — have switched to building standalone apps that have a browser embedded in them, where their “extension” can run un-sandboxed on your OS, not sandboxed within the browser. Y’know, Electron and the like. (And moving your extension to Electron actually solves a great amount of the problem, because now your functionality itself is considered a base part of an “app” that can be independently quarantined by the OS, installation-constrained by MDM/GPO, sandboxed with a capabilities manifest to just what its use-case needs rather than what an entire browser needs, etc. IT admins love the shift from extensions to purpose-built Electron apps.) > hardcore authoritarian I have nothing against having control over your own system. For modern security, though, you truly have to have control over your own system — i.e. not let it control itself, but rather have two systems, where one follows the other’s whims via MDM. The only truly-secure systems are ones where their choices are out of their own hands, and rather in some other system’s hands. Either interactively, via MDM; or non-interactively, via limited-capability ephemeral immutable-image infrastructure. Such systems have no entrypoint for a rootkit: in the immutable-image case, because the OS itself doesn’t have the physical capability to modify the boot volume (because it’s an NFS/iSCSI mount from a server that’s sharing it read-only; or because the OS kernel is a simplified unikernel that just doesn’t have “write to disk” as an implemented code path; or because it’s running as an instanced VM that disappears if it reboots.) And, in the MDM case, because there’s a chain of trust (signed BIOS → signed bootloader), where the bootloader will only boot a boot volume if that boot volume has been signed by the MDM controller; and where the keys for doing that aren’t on the device. (If you like, instead of an additional MDM system, you could in theory have your boot-volume signing key held offline in a smart card/hardware wallet. No OS currently has the capability to use that offline signing key during the OS update flow, but it’d sure be neat if they started doing that.) Is that authoritarian? In the same way as someone on a space station telling you not to open the airlock, perhaps.

derefr 5y ago

In practice, private extensions are malware. 99+% of them. "Put a thing at a path on disk, the web browser picks it up and runs it un-sandboxed and gives it access to all your web traffic" — that's a Grand Canyon-sized security hole in the middle of an otherwise-secure design, and widely exploited. (And there's nothing you can do to plug it through local security, since a virus running with your account's permissions can do all that just as well.) Have you noticed that public-use PCs (in e.g. libraries, hotel lobbies, kiosks) used to have Firefox installs, but now mostly have Chrome installs? It's not that the IT people setting these up are any less fans of FOSS than they used to be. It's that Chrome has, for a while now, only persistently loaded local extensions if they're declared in an MDM policy (this being remote security), while Firefox has continued to trust the local filesystem. Public PCs with Firefox (and without some OS change-reversion tool like Faronics DeepFreeze) have been cesspools of malware extensions since ~2011. Besides — if your private extension isn't malware, why not just upload it to Mozilla's servers, but never set it to public, instead just personally being its only user? (What, are you burning evidence of illegal activities into browser extensions or something? That's bad engineering! Make your illegal activities runtime state!) > they completely disabled extension support on Firefox mobile (no, that small list of approved extensions isn't enough). That's the platforms' idiocy, not Mozilla's. Apple and now Google both say that all non-sandboxed executable code an app ever runs must be part of the app's submission package, to be checked over and approved by the platform owner. That "small list of approved extensions" is a set of extensions that gets burned into the Firefox Mobile binary and audited by the platform-owner during publication. It's small because every extension on it is another chance for a Firefox update to be shot down during QA by an overzealous platform owner. The extensions in the approved set are the ones whose developers understand well exactly what's required to ship code as part of Firefox Mobile, and who therefore do what they can to appease the platform-owners in each release.

userbinator 5y ago
What is "malware"? It is already turning into "what they don't want you to run." It is frankly shocking to see such a hardcore authoritarian viewpoint here.
- quotemstr 5y ago
  The whole industry (outside the cryptocurrency sector) has moved in a sadly authoritarian direction over the past decade or so. You would not believe some of the infantilizing and paternalistic rhetoric I've heard behind closed doors at major tech companies from people who believe they have a "responsibility" to protect the public from itself and promote correct thinking.
- derefr 5y ago
  > What is “malware” Things that steal your password, track your information, and show you ads. Y’know, BonziBuddy-esque things. Things that have a registered signature in an antivirus database, with nobody complaining about that. Let me rephrase my initial statement to make it more clear: 99+% of the usage of the private extension install API — whether you choose to measure by volume of installations, or by variety of software installed — is by malware. Just like usage of the modern POTS phone system is 50+% by scam callers. Both because of the sheer quantity and variety of bad actors, and how automated and wide-reaching their attacks are; but also because of the dwindling valid use-cases, as most users’ needs have since been met by other technologies that meet those needs better. In the POTS phone case, most people have switched to using email/texting/collab software/IP video-calling, which is why it feels like every ordinary phone call you receive is a spam/scam call. In the browser extension case, most people with more complex needs — e.g. the people who thought Chrome Apps were a good idea, the people who needed their extensions to have a native-library component, etc. — have switched to building standalone apps that have a browser embedded in them, where their “extension” can run un-sandboxed on your OS, not sandboxed within the browser. Y’know, Electron and the like. (And moving your extension to Electron actually solves a great amount of the problem, because now your functionality itself is considered a base part of an “app” that can be independently quarantined by the OS, installation-constrained by MDM/GPO, sandboxed with a capabilities manifest to just what its use-case needs rather than what an entire browser needs, etc. IT admins love the shift from extensions to purpose-built Electron apps.) > hardcore authoritarian I have nothing against having control over your own system. For modern security, though, you truly have to have control over your own system — i.e. not let it control itself, but rather have two systems, where one follows the other’s whims via MDM. The only truly-secure systems are ones where their choices are out of their own hands, and rather in some other system’s hands. Either interactively, via MDM; or non-interactively, via limited-capability ephemeral immutable-image infrastructure. Such systems have no entrypoint for a rootkit: in the immutable-image case, because the OS itself doesn’t have the physical capability to modify the boot volume (because it’s an NFS/iSCSI mount from a server that’s sharing it read-only; or because the OS kernel is a simplified unikernel that just doesn’t have “write to disk” as an implemented code path; or because it’s running as an instanced VM that disappears if it reboots.) And, in the MDM case, because there’s a chain of trust (signed BIOS → signed bootloader), where the bootloader will only boot a boot volume if that boot volume has been signed by the MDM controller; and where the keys for doing that aren’t on the device. (If you like, instead of an additional MDM system, you could in theory have your boot-volume signing key held offline in a smart card/hardware wallet. No OS currently has the capability to use that offline signing key during the OS update flow, but it’d sure be neat if they started doing that.) Is that authoritarian? In the same way as someone on a space station telling you not to open the airlock, perhaps.