5 ms·

Firefox follows Chrome and prepares to block insecure downloads

68 points by CTOSian 5y ago

SevenSigs 5y ago
The way Firefox is acting the last few years, you would think that Google owns them. "One company for one government." Luckily a few promising alternative browsers are popping up.
- jackewiehose 5y ago
  > Luckily a few promising alternative browsers are popping up. anything not based on chromium?
  - SevenSigs 5y ago
    So far, my favorite one is the Otter Browser but I am still a new user: https://otter-browser.org/ https://otter-browser.org/
  - teitoklien 5y ago
    Librewolf is there Qutebrowser pretty good too
    - The-Compiler 5y ago
      Well, thanks for the heads-up, I suppose ;) https://github.com/qutebrowser/qutebrowser/commit/c022893a76ab388a552b420728edb19fcb122bb8 https://github.com/qutebrowser/qutebrowser/commit/c022893a76...
      - teitoklien 5y ago
        Oh haha
      - teitoklien 5y ago
        Woah i just realised you’re THECompiler Thanks a lot for your work ! You’re the reason i could bring a 10-12 yr old laptop of mine back to life with a gui browser to go along with it , and also being able to use vi-keybindings ! Really appreciate it
        The-Compiler 5y ago
        Hehe, yeah, I sometimes show up in random places when people mention qutebrowser thanks to https://f5bot.com/ https://f5bot.com/ :) Thanks for the nice words, much appreciated too!
- atok1 5y ago
  Thank you for listing that alternative browser, although I'm not sure why it marked your post as dead? We need as many non-Chrome based alternatives as possible.
  - hulitu 5y ago
    Seamonkey, brave, vivaldi.
    - SevenSigs 5y ago
      I'm pretty sure that Vivaldi and Brave are Chromium-based, unlike Otter and Seamonkey.
Buttons840 5y ago
The article is very short and to the point. Bravo! This Firefox change sounds reasonable to me. Why would this not be a good idea?
- jeroenhd 5y ago
  As long as they plan to keep the option up download over HTTP forever, I think this is a good idea. However, I fear the day Mozilla will consider HTTP downloads obsolete the same wah they did away with FTP. The direction Mozilla is taking Firefox makes me distrust any barriers they're throwing up that are coined as "security" features.
  - Santosh83 5y ago
    Mozilla is being forced to follow the industry leaders here. And if ever HTTP is completely removed, that will first happen from their tech giants and browser choke hold, and Mozilla will have little choice but to follow behind.
    - Buttons840 5y ago
      If Chrome blocks plain old HTTP, why would Firefox have to do the same?
    - LocalH 5y ago
      That doesn't make sense. Mozilla is forced to do nothing just because Chrome does it. In what way are they "forced"?
  - sp332 5y ago
    Firefox Nightly did just block the downloads for a while. I think this implementation must have been based on feedback from that very annoying experiment.
  - breakingcups 5y ago
    I run Nightly and it had the very annoying issue that overruling the browser to actually download the HTTP-only download would fail 100% of the time. I hope they fixed that because there are still hundreds of valuable, older resources out there that I regularly download documents from.
zozbot234 5y ago
Tl;dr: the browser will alert the user when they try to download a file from an HTTP link within an HTTPS page ("mixed content"). Users will have to explicitly confirm the download if they want it to proceed. And there will be an about:config option to disable this warning altogether. Seems like a sensible choice to me.
- ducktective 5y ago
  > And there will be an about:config option to disable this Only to be removed in the next release (possibly)...
ComputerGuru 5y ago
I approve of asking the customer to confirm the download. I have a huge problem with the Chrome implementation: it fails silently. The only way to see what happened after you hammer a download link but your download does not start is to look at the dev console for logged browser errors! That UX is terrible for customers dealing with legacy sites. It's even worse than the UX for dealing with self-signed certificates - surely an HTTPS site linking to an HTTP download deserves at least the same chance that a self-signed HTTPS site gets?
- apostacy 5y ago
  This all makes perfect sense from a market perspective. Why tell the user what is wrong, when you can silently fail and make the user blame the website? The goal of Google is to gaslight users away from using technologies that Google does not like. And of course they prefer that you use an unencrypted connection over a self signed certificate. They want you be connected to a larger system in order to benefit from TLS. If Google were to just cut to the chase, they would just forbid downloads from any domains that they didn't charge a fee to approve. Malware will of course get through sometimes, but Google will still get paid. They want to turn the web into an app store. But the saddest thing of all, is that Mozilla will replicate whatever dark patterns Google implements, without any benefit to themselves or their users.
SimeVidas 5y ago
Already enabled in Nightly.
sysadm1n 5y ago
Long time downloader of things from `http / port 80` here. I treat every Windows binary I download as if it's a trojan or something with some malicious behavior in it. One heuristic to look at is: Does this binary have a 'digital signature'[0]? If not, why does the author of the software not add one, and does not having a signature make the binary suspicious? Even with a signature present, I still upload the .EXE to Virustotal[1] to scan for malware. I don't trust modern AV software that sits in your machine since it is a privacy concern, but Virustotal is a website that runs in the cloud and doesn't scan every file on my computer and report back to HQ. [0] https://www.ghacks.net/2018/04/16/how-to-verify-digital-signatures-programs-in-windows/ https://www.ghacks.net/2018/04/16/how-to-verify-digital-sign... [1] https://www.virustotal.com/old-browsers/ https://www.virustotal.com/old-browsers/
- judge2020 5y ago
  The biggest thing with digital signatures is that getting one trusted by Windows means entertaining a racket enabled by Microsoft. There are two types of code signing certificates: regular, and EV. With regular certificates, all you get is effectively a way to carry your antivirus-based reputation with you as you continue to sign new binaries with it. At first sight, Windows will still throw up smartscreen warnings about it being potentially dangerous, until it's seen the certificate enough to trust it for new binaries. With EV certificates, everything is smooth sailing - only if actual malware is reported does your certificate get slammed by antivirus reputation, otherwise you can sign anything and it'll instantly bypass all AV software and Windows smartscreen prompts. The issue with getting either of these is that absolute cheapest one you can get is $59 a year for 3 years via a reseller[0] of Sectigo certificates, and that is only for regular code signing. If you want an EV certificate, it's going to be $219 a year for 3 years at the minimum via the same reseller (do not try to go through the regular channels or you'll likely be paying 2x-3x more[1]). Thankfully Microsoft is aware of these concerns[2,3] and there is a potential solution coming up called Azure Code Signing[4] however no new public information has been released since that video went up. 0: https://codesigncert.com/brand https://codesigncert.com/brand (this is just the cheapest site I've found - I am not affiliated with them beyond being a customer) 1: https://sectigo.com/ssl-certificates-tls/code-signing https://sectigo.com/ssl-certificates-tls/code-signing 2: https://github.com/MicrosoftDocs/windows-driver-docs/issues/2001#issuecomment-610700857 https://github.com/MicrosoftDocs/windows-driver-docs/issues/... 3: https://github.com/MicrosoftDocs/windows-driver-docs/issues/2001#issuecomment-611705469 https://github.com/MicrosoftDocs/windows-driver-docs/issues/... 4: https://youtu.be/Wi-4WdpKm5E?t=530 https://youtu.be/Wi-4WdpKm5E?t=530
theodric 5y ago
More freedom being taken away for my protection. More obsession with safety over all else. Looks like I'll be using wget more in the near future!
- contingencies 5y ago
  Firefox will have a setting. Chrome, maybe not. Console-wise, try axel or similar offerings which are far more modern than wget in offering parallel multi-socket downloads (huge speed increase in many situations).

68 points by CTOSian 5y ago

The way Firefox is acting the last few years, you would think that Google owns them. "One company for one government." Luckily a few promising alternative browsers are popping up.

jackewiehose 5y ago
> Luckily a few promising alternative browsers are popping up. anything not based on chromium?
- SevenSigs 5y ago
  So far, my favorite one is the Otter Browser but I am still a new user: https://otter-browser.org/ https://otter-browser.org/
- teitoklien 5y ago
  Librewolf is there Qutebrowser pretty good too
  - The-Compiler 5y ago
    Well, thanks for the heads-up, I suppose ;) https://github.com/qutebrowser/qutebrowser/commit/c022893a76ab388a552b420728edb19fcb122bb8 https://github.com/qutebrowser/qutebrowser/commit/c022893a76...
    - teitoklien 5y ago
      Oh haha
    - teitoklien 5y ago
      Woah i just realised you’re THECompiler Thanks a lot for your work ! You’re the reason i could bring a 10-12 yr old laptop of mine back to life with a gui browser to go along with it , and also being able to use vi-keybindings ! Really appreciate it
      - The-Compiler 5y ago
        Hehe, yeah, I sometimes show up in random places when people mention qutebrowser thanks to https://f5bot.com/ https://f5bot.com/ :) Thanks for the nice words, much appreciated too!
atok1 5y ago
Thank you for listing that alternative browser, although I'm not sure why it marked your post as dead? We need as many non-Chrome based alternatives as possible.
- hulitu 5y ago
  Seamonkey, brave, vivaldi.
  - SevenSigs 5y ago
    I'm pretty sure that Vivaldi and Brave are Chromium-based, unlike Otter and Seamonkey.

Buttons840 5y ago

The article is very short and to the point. Bravo! This Firefox change sounds reasonable to me. Why would this not be a good idea?

jeroenhd 5y ago
As long as they plan to keep the option up download over HTTP forever, I think this is a good idea. However, I fear the day Mozilla will consider HTTP downloads obsolete the same wah they did away with FTP. The direction Mozilla is taking Firefox makes me distrust any barriers they're throwing up that are coined as "security" features.
- Santosh83 5y ago
  Mozilla is being forced to follow the industry leaders here. And if ever HTTP is completely removed, that will first happen from their tech giants and browser choke hold, and Mozilla will have little choice but to follow behind.
  - Buttons840 5y ago
    If Chrome blocks plain old HTTP, why would Firefox have to do the same?
  - LocalH 5y ago
    That doesn't make sense. Mozilla is forced to do nothing just because Chrome does it. In what way are they "forced"?
- sp332 5y ago
  Firefox Nightly did just block the downloads for a while. I think this implementation must have been based on feedback from that very annoying experiment.
- breakingcups 5y ago
  I run Nightly and it had the very annoying issue that overruling the browser to actually download the HTTP-only download would fail 100% of the time. I hope they fixed that because there are still hundreds of valuable, older resources out there that I regularly download documents from.

zozbot234 5y ago

Tl;dr: the browser will alert the user when they try to download a file from an HTTP link within an HTTPS page ("mixed content"). Users will have to explicitly confirm the download if they want it to proceed. And there will be an about:config option to disable this warning altogether. Seems like a sensible choice to me.

ducktective 5y ago
> And there will be an about:config option to disable this Only to be removed in the next release (possibly)...

ComputerGuru 5y ago

I approve of asking the customer to confirm the download. I have a huge problem with the Chrome implementation: it fails silently. The only way to see what happened after you hammer a download link but your download does not start is to look at the dev console for logged browser errors! That UX is terrible for customers dealing with legacy sites. It's even worse than the UX for dealing with self-signed certificates - surely an HTTPS site linking to an HTTP download deserves at least the same chance that a self-signed HTTPS site gets?

apostacy 5y ago
This all makes perfect sense from a market perspective. Why tell the user what is wrong, when you can silently fail and make the user blame the website? The goal of Google is to gaslight users away from using technologies that Google does not like. And of course they prefer that you use an unencrypted connection over a self signed certificate. They want you be connected to a larger system in order to benefit from TLS. If Google were to just cut to the chase, they would just forbid downloads from any domains that they didn't charge a fee to approve. Malware will of course get through sometimes, but Google will still get paid. They want to turn the web into an app store. But the saddest thing of all, is that Mozilla will replicate whatever dark patterns Google implements, without any benefit to themselves or their users.

SimeVidas 5y ago

Already enabled in Nightly.

sysadm1n 5y ago

Long time downloader of things from `http / port 80` here. I treat every Windows binary I download as if it's a trojan or something with some malicious behavior in it. One heuristic to look at is: Does this binary have a 'digital signature'[0]? If not, why does the author of the software not add one, and does not having a signature make the binary suspicious? Even with a signature present, I still upload the .EXE to Virustotal[1] to scan for malware. I don't trust modern AV software that sits in your machine since it is a privacy concern, but Virustotal is a website that runs in the cloud and doesn't scan every file on my computer and report back to HQ. [0] https://www.ghacks.net/2018/04/16/how-to-verify-digital-signatures-programs-in-windows/ https://www.ghacks.net/2018/04/16/how-to-verify-digital-sign... [1] https://www.virustotal.com/old-browsers/ https://www.virustotal.com/old-browsers/

judge2020 5y ago
The biggest thing with digital signatures is that getting one trusted by Windows means entertaining a racket enabled by Microsoft. There are two types of code signing certificates: regular, and EV. With regular certificates, all you get is effectively a way to carry your antivirus-based reputation with you as you continue to sign new binaries with it. At first sight, Windows will still throw up smartscreen warnings about it being potentially dangerous, until it's seen the certificate enough to trust it for new binaries. With EV certificates, everything is smooth sailing - only if actual malware is reported does your certificate get slammed by antivirus reputation, otherwise you can sign anything and it'll instantly bypass all AV software and Windows smartscreen prompts. The issue with getting either of these is that absolute cheapest one you can get is $59 a year for 3 years via a reseller[0] of Sectigo certificates, and that is only for regular code signing. If you want an EV certificate, it's going to be $219 a year for 3 years at the minimum via the same reseller (do not try to go through the regular channels or you'll likely be paying 2x-3x more[1]). Thankfully Microsoft is aware of these concerns[2,3] and there is a potential solution coming up called Azure Code Signing[4] however no new public information has been released since that video went up. 0: https://codesigncert.com/brand https://codesigncert.com/brand (this is just the cheapest site I've found - I am not affiliated with them beyond being a customer) 1: https://sectigo.com/ssl-certificates-tls/code-signing https://sectigo.com/ssl-certificates-tls/code-signing 2: https://github.com/MicrosoftDocs/windows-driver-docs/issues/2001#issuecomment-610700857 https://github.com/MicrosoftDocs/windows-driver-docs/issues/... 3: https://github.com/MicrosoftDocs/windows-driver-docs/issues/2001#issuecomment-611705469 https://github.com/MicrosoftDocs/windows-driver-docs/issues/... 4: https://youtu.be/Wi-4WdpKm5E?t=530 https://youtu.be/Wi-4WdpKm5E?t=530

theodric 5y ago

More freedom being taken away for my protection. More obsession with safety over all else. Looks like I'll be using wget more in the near future!

contingencies 5y ago
Firefox will have a setting. Chrome, maybe not. Console-wise, try axel or similar offerings which are far more modern than wget in offering parallel multi-socket downloads (huge speed increase in many situations).