9 ms·

Firefox Addons Unable to Update, Undisclosed AMO Issues

184 points by gilrain 5y ago

topynate 5y ago
Smells like an unpatched critical vulnerability.
LilBytes 5y ago
'Hi @idk, we have a few issues on our end that are causing a delay for some add-ons to be signed or released right now. We’re still trying to work through the backlog (and we understand that some developers have been waiting quite awhile for a review) but it still may take some time to get to everyone.' Mozilla's response. Interesting
- dathinab 5y ago
  My guess: Some bug caused a whole lot of extensions which normally need no manual review to now need a manual review overloading the manual review team. And even through the bug has been fixed for some reason or another all the "fallout" still needs to be processed manually. Maybe?
  - nabakin 5y ago
    That's what I'm thinking too. Possibly a security issue.
    - throwawaybutwhy 5y ago
      That... or they fired the reviewers.
      - dathinab 5y ago
        That would be stupid.
        marcinzm 5y ago
        Why? Firefox has relatively few users and has basically no viable path for growing it's users. At the same time they get a massive amount of money from Google that isn't based on the number of users. Cutting costs seems like the perfect MBA approach to increasing profits in this case. Sure you lose some more users but that's not relevant for profit. By the time it might matter those in charge would have cashed their bonuses and moved onto the next company.
        Wowfunhappy 5y ago
        > At the same time they get a massive amount of money from Google that isn't based on the number of users. Is that really true? Surely, even if the contract isn't directly tied to user numbers, it's relevant whenever the deal is up for renewal...
        marcinzm 5y ago
        See the last sentence. The people involved won't be there anymore by then. Short term focus is pretty standard for corporations.
        craftinator 5y ago
        > Short term focus is pretty standard for corporations. I would rewrite this as "Short term focus is pretty standard for those not making the product." From everywhere I've worked, the more actual work a person is doing on a product, the better they want to make it, and the less they want to deal with architecture problems down the road. The short term morons are always the ones that aren't actually making anything.
        marcinzm 5y ago
        Sure, but the people making long term decisions in corporations are generally not the ones making the product. I would say in a way everyone cares about their own personal objectives and goals. Someone making a product cares about the joy they get from seeing it released and running and people using it. They want to minimize their own annoyance down the line. Those higher up care about the money they get in their bank account from their bonus. Neither particularly cares about the success of the corporation.
      - sudosysgen 5y ago
        Then who's doing the reviews? Higher paid people with more responsibilities?
peakaboo 5y ago
Wonder how many people are still working on Firefox at Mozilla. Seems to me the users voted for Chrome and soon there won't be a Firefox to talk of. Users are stupid, can't fix that.
- leeoniya 5y ago
  s/stupid/brainwashed and/or accept defaults set by an OEM that has incentives aligned with profit
- willvarfar 5y ago
  Mozilla-the-company had the most crazy confused direction, mission and leadership and basically squandered a whole lot of money too.
  - darthvoldemort 5y ago
    They are forced to spend all/most their money every year. They can't save their money like a regular company due to their status.
    - slig 5y ago
      They should spend their money paying more engineers then, instead of laying off 250 people last year and upping bonuses for the C-level staff.
    - deleted 5y ago
      [deleted]
    - sciurus 5y ago
      You can read the financial statements and see that this is mistaken. The latest is https://www.mozilla.org/en-US/foundation/annualreport/2019/ https://www.mozilla.org/en-US/foundation/annualreport/2019/
- Valmar 5y ago
  I'll never use Chrome, given the increasingly-worrying directions Google is taking it. Google has too much influence and power, and has become the new Microsoft in terms of browser monopolization.
happynacho 5y ago
And then Mozilla wonders why people don't use Firefox.
- SilasX 5y ago
  Yes, this kind of thing just shouldn't happen after the "sudden global outage of all add-ons [incl. privacy ones]", followed "no, no, don't worry guys, we forced out a fix via a secret backdoor!" https://news.ycombinator.com/item?id=19823701 https://news.ycombinator.com/item?id=19823701
  - kosasbest 5y ago
    > [incl. privacy ones] I remember when all my privacy extensions were entirely absent and I accidentally surfed the web. I felt so vulnerable after that, as if I surfed the web bareback
- kelnos 5y ago
  The vast majority of users are not extension developers. I'd not heard of this issue until now. It sucks, but it wouldn't make me decide to stop using the browser.
  - happynacho 5y ago
    You're not looking at the full picture. Mozilla's pure incompetence to even maintain their addons ecosystem. Remember when all live addons failed due to a cert failure? Besides dumbing down the browser now they can't even seem to get addons running smoothly. Extensions/addons are a core part of a modern browser.
WallyFunk 5y ago
It's `Armagaddon` part deux! https://bugzilla.mozilla.org/show_bug.cgi?id=1548973 https://bugzilla.mozilla.org/show_bug.cgi?id=1548973 https://hacks.mozilla.org/2019/05/technical-details-on-the-recent-firefox-add-on-outage/ https://hacks.mozilla.org/2019/05/technical-details-on-the-r...
- WallyFunk 5y ago
  But this is different. The addons still work, they just don't update.
  - jackewiehose 5y ago
    It's a different outcome but it is again a problem caused by their signing requirement bullshit. It wouldn't be that bad if they would just let us developers use our unsigned extensions.
ArchStanton 5y ago
I'm speaking outside of my bailiwick here, but are browsers now the equivalent of Microsoft Windows? Great big, crufty, no-one-really-knows-how-they-work, security risk laden, feature-fat, clumps of software that everyone uses?
- solmag 5y ago
  Correct.
- spicybright 5y ago
  Yup!
- dathinab 5y ago
  Worse in a certain way as part of the problem are "feature-fat, clumps or over-complicated" web standards every new browser would have to implement.
prophesi 5y ago
Um, it's just a delay in add-on approvals. In this thread you can even see one complainant report back that their add-on was approved a day or two later.
- thayne 5y ago
  Two months is a really long time to be delayed. And they probably prioritized the one person who complained, and everyone else is still delayed.
  - prophesi 5y ago
    It's a company with less than a thousand employees, compared to Google's 100k. The author didn't even state what their extension was, so for all we know it could be a legitimately sketchy add-on with tons of bloated JS that requires extensive review.
    - gilrain 5y ago
      Is uBlock Origin being unable to update any more concerning to you? https://reddit.com/r/firefox/comments/pv15k2/_/he7qm5u/?context=1 https://reddit.com/r/firefox/comments/pv15k2/_/he7qm5u/?cont...
      - prophesi 5y ago
        Their latest version was released on Sept 15th, 10 days ago. Can't imagine this version has been in manual review for even a week. Edit: Nevermind, it was submitted 10 days ago. The latest on Firefox is from months ago. Concerning, but I've had plenty of apps on the App/Play store take longer for review with the most innocuous updates. We moved to OTA updates because of this.
        gorhill 5y ago
        The issue is the signing of self-hosted dev builds being stalled. It had always taken only a few minutes before I would get a self-hosted dev build to be signed, allowing for the dev build to be used by volunteers so as to be able to spot regressions. I haven't been able to get a signed self-hosted dev build for 12 days now. This means I can't move forward with a stable Firefox release -- which is manually reviewed and is expected to take a number of days. The signed self-hosted dev builds are required steps to keep releasing stable releases, and they are currently stalled for unknown reasons.
cute_boi 5y ago
Adding to this issue I would like to give some of my opinion on webext. To be honest Firefox add-ons process is so grotesque. For instance I can't load my extension without signing in Firefox stable version. And their tool especially web-ext has lot of issues like takes lot of time, gives pesky error if your system time is incorrect (my isp has blocked ntp servers and idk why and switching to vpn just to update is painful tbh). And developing addon is also hard for firefox compared to chrome as the dev tools frequently give message unrelated to extension etc. Sometime I get so angry but I have been using firefox nearly for decades. Its so hard for me :(
- tomsmeding 5y ago
  Unrelated to your core point but your ISP blocks ntp servers? Wtf? Either some part of the story is missing or that ISP is insane, blocking a piece of core internet infrastructure for which there is, I would guess, no reason.
  - manquer 5y ago
    Not OP , but I have seen type of behaviour , ISPs act like corporate firewalls and block everything by default just allow http on 80 and 443 in their consumer plan and try and sell enterprise/higher plans for literally anything else . Not just that once a ISP was using a single CG-NATed IP for a ton of users, that the IP was constantly getting rate limited with captcha everywhere including Google Search and Cloudflare. They suggested I buy a plan with dedicated static IP instead of rotating a few more in their routers.
  - magnat 5y ago
    NTP is commonly used for DDoS amplitication.
    - wbl 5y ago
      The right way to do this is to police, not block, and by length.
  - addingnumbers 5y ago
thayne 5y ago
This would be a lot less of an issue if Mozilla let you install addons that weren't signed on the stable channel. Or at least had a way to add a custom signing CA.
- SilasX 5y ago
  Or, if they did force you to go through their CA, actually make sure they keep it updated. https://news.ycombinator.com/item?id=19823701 https://news.ycombinator.com/item?id=19823701
- derefr 5y ago
  Anything the user can do (like adding a signing CA), malware can do too. The only safe policy flags a browser can provide/respect for extensions, are ones the user can’t affect from their own computer—e.g. GPOs / MDM profile attributes set by a domain administrator. (And both Firefox and Chrome do have management-domain-level extension policies!) Everything else is just one “trick the user into an elevation” away, and then they’re unknowingly part of a browser-embedded botnet.
  - gilrain 5y ago
    A process that is preventing gorhill from testing and updating uBlock Origin is a failed process.
  - Nextgrid 5y ago
    Malware can just replace or patch the Firefox binary if it wanted to, so enforcing add-on signing wouldn't protect against this.
    - AshamedCaptain 5y ago
      Technically then at least the windows signature failed prompt would show up. Also the firefox binary is usually somewhere you need admin access to write (i.e. admin prompt). I don't really agree with the method Mozilla is using, but at least the explanation makes sense.
morsch 5y ago
I think this is their extension: https://addons.mozilla.org/en-US/firefox/addon/i2p-in-private-browsing/ https://addons.mozilla.org/en-US/firefox/addon/i2p-in-privat... Updated two months ago. The forum post is from late August. They still haven't been able to update it. Evidently, app stores suck even when maintained by well meaning people. The latest update in the thread, nine days ago, is pure corporateese: Hi @zephyr, unfortunately we don’t have a lot more we can share at the moment. However, I’ll talk to the team and see if there are any updates for next week.
- ploxiln 5y ago
  It's a frustrating state of affairs that this extension review process even exists ... Of course we'll be called entitled whiners for demanding prompt customer service from an open source foundation which does this completely for free. But then why does such an organization with such an offering lock it down with a mandatory capricious review process like Apple? What profit is in it for them? It's to prevent the bad publicity which results from malicious extensions affecting thousands of poor helpless users. How repugnantly negligent would mozilla be considered by news commentators, to allow so many of their users to be violated so badly by their extensions! But I can install any debian package I want from anywhere? Or download and compile a source tarball from anywhere? Use pip to install from pypi which is a free-for-all ... or from any tarball or git url? Even windows users can install arbitrary things! I do find it surprising that there is trend for shady companies to try to buy out popular Chrome extensions to slip adware and then malware into them, this has hardly been seen anywhere else (except mobile app stores maybe). Anyway, I would love a completely different solution: something easy and obvious in settings to disable extension lock-down, with whatever scary warning is needed to let the commoner know they will probably hurt themselves badly, if they can choose what software to run on their computer. Let this option be disabled by GPO for corporate-controlled workstations. Let third-parties provide "trusted extension registries", similar to adblock lists, with hashes of versions of extensions that have been checked by someone who is savvy enough to install debian packages, and can tell when a popular extension has changed ownership. Yeah I know this is unlikely, and again, I'm a whining entitled idiot for demanding anything from a benevolent organization providing open-source software at no monetary cost. I think we just need an "un-mozilla'd firefoxium" ...
dannysu 5y ago
I have an add-on that I submitted an update for on June 21, 2021. It’s still “Awaiting Review”. It’s an add-on that only I use. It’s not published broadly. I basically only needed Mozilla to sign it so I can install it. Very frustrating. After waiting for a long while, I gave up and switched to the Developer Edition so I can use my own add-on.
- prophesi 5y ago
  Here you go https://github.com/mozilla/web-ext https://github.com/mozilla/web-ext
  - benatkin 5y ago
    That just calls the API. https://extensionworkshop.com/documentation/develop/web-ext-command-reference/#web-ext-sign https://extensionworkshop.com/documentation/develop/web-ext-...
- jsploit 5y ago
  > After waiting for a long while, I gave up and switched to the Developer Edition so I can use my own add-on. I find it very frustrating that they now force users into Nightly / Developer Edition if they want to permanently install unsigned add-ons. What's the harm in simply locking that functionality with a config option?
  - the8472 5y ago
    Mozilla is like apple in that regard, users can't be trusted with their own machines and the well-intentioned mothership must at all times be in control since at any moment they could fall to social engineering and then they (apple/mozilla) would get blamed for whatever the malware did. Installing developer edition is the blessed way to opt out of that.
    - dessant 5y ago
      You can install a locally built and signed extension in the release version of Safari, without disclosing the source code to Apple.
gilrain 5y ago
gorhill is unable to test and update uBlock Origin: > This is unfortunate. Development of uBO for Firefox is completely stalled as a result -- the purpose of dev builds is to test code changes before publishing a stable release. It used to take less than five minutes to obtain a signed version of uBO. There are changes in 1.38.0 which the filter list authors are awaiting and this is also stalling proper filter list maintenance. https://reddit.com/r/firefox/comments/pv15k2/_/he7qm5u/?context=1 https://reddit.com/r/firefox/comments/pv15k2/_/he7qm5u/?cont...
pessimizer 5y ago
So first they take complete control of add-ons by deprecating an old (admittedly creaky) system and replacing it with a nerfed one that can't even hide the tab bar; and by requiring add-ons to be signed by them to be installed. Now they'll let what's left die of neglect. Really poor and predictable. edit: I've found of late that my accuracy goes up when instead of trying to predict the future, I just imagine the most dystopian development of a situation possible. Right now I'm imagining add-on developers having to pay Mozilla for the review of their extensions, and their placement on the site.
- cutemonster 5y ago
  Why not paying them to review? It takes time for them, why should they do it for free? I was just thinking "a way to solve this problem might be if they started charging for reviewing add-ons and updates". Maybe they could charge more from organizations with lots of money, and less from indie devs with less money
  - hda2 5y ago
    Or they can let people side-load addons like every other desktop browser.
    - cutemonster 5y ago
      An idea: To strike a balance between flexibility for individuals / small groups, and security for the masses, Firefox could let people side load add-ons used by less than say 1 000 people. However once an add-on gets more than 1 000 users, only the first 1 000 can side load it; the others need to wait until it's been approved (reviewed).
ameshkov 5y ago
Same issue with all our addons. What’s even more frustrating is that unlisted addons are also affected, you cannot even sign an addon since it needs to go through a manual review now.
fartcannon 5y ago
Are there any forks of Firefox with these add on limitations removed?
rastafang 5y ago
I think that Mozilla are trying to make addons disappear.... they started with Firefox Mobile, only about 10-15 addons are available now (which is why I use an ancient version of Firefox Mobile). They are getting a lot of money from Google, so it MIGHT be a request from Google.
preinheimer 5y ago
It took 2+ months for our extension update to be approved, it was a small incremental update. Getting it done in that time frame required us to email Caitlin and an HN'er who commented on another thread to try and get things done in an expedited manner. For a time there was a little ticker showing your place in the queue. We graphed that for a while, then they pulled the feature entirely: https://twitter.com/preinheimer/status/1422577415780450311 https://twitter.com/preinheimer/status/1422577415780450311 The queue of course isn't a straight queue. Some people end up traversing the entire queue, very slowly. Other folks manage to jump out of the queue and get listed sooner. We've seriously considered abandoning our FF extension. FF's market share is shrinking, and we see the difference in the usage stats for our extension specifically. Some of our updates require coordination on our website and the extension. So holding onto FF means that some updates take months to roll out for everyone.
kmeisthax 5y ago
Ruffle nightly builds broke for a good week because Firefox signing broke. We eventually decided to let nightly builds continue without a working Firefox release, but the end result is that Firefox users can't update Ruffle anyway.
esyrahmawati2 5y ago
hello all nothing is useful if you don't have money let's join me to get free money https://coincircle.com/l/aj7jxAQ4f_ https://coincircle.com/l/aj7jxAQ4f_

184 points by gilrain 5y ago

Smells like an unpatched critical vulnerability.

'Hi @idk, we have a few issues on our end that are causing a delay for some add-ons to be signed or released right now. We’re still trying to work through the backlog (and we understand that some developers have been waiting quite awhile for a review) but it still may take some time to get to everyone.' Mozilla's response. Interesting

dathinab 5y ago
My guess: Some bug caused a whole lot of extensions which normally need no manual review to now need a manual review overloading the manual review team. And even through the bug has been fixed for some reason or another all the "fallout" still needs to be processed manually. Maybe?
- nabakin 5y ago
  That's what I'm thinking too. Possibly a security issue.
  - throwawaybutwhy 5y ago
    That... or they fired the reviewers.
    - dathinab 5y ago
      That would be stupid.
      - marcinzm 5y ago
        Why? Firefox has relatively few users and has basically no viable path for growing it's users. At the same time they get a massive amount of money from Google that isn't based on the number of users. Cutting costs seems like the perfect MBA approach to increasing profits in this case. Sure you lose some more users but that's not relevant for profit. By the time it might matter those in charge would have cashed their bonuses and moved onto the next company.
        Wowfunhappy 5y ago
        > At the same time they get a massive amount of money from Google that isn't based on the number of users. Is that really true? Surely, even if the contract isn't directly tied to user numbers, it's relevant whenever the deal is up for renewal...
        marcinzm 5y ago
        See the last sentence. The people involved won't be there anymore by then. Short term focus is pretty standard for corporations.
        craftinator 5y ago
        > Short term focus is pretty standard for corporations. I would rewrite this as "Short term focus is pretty standard for those not making the product." From everywhere I've worked, the more actual work a person is doing on a product, the better they want to make it, and the less they want to deal with architecture problems down the road. The short term morons are always the ones that aren't actually making anything.
        marcinzm 5y ago
        Sure, but the people making long term decisions in corporations are generally not the ones making the product. I would say in a way everyone cares about their own personal objectives and goals. Someone making a product cares about the joy they get from seeing it released and running and people using it. They want to minimize their own annoyance down the line. Those higher up care about the money they get in their bank account from their bonus. Neither particularly cares about the success of the corporation.
    - sudosysgen 5y ago
      Then who's doing the reviews? Higher paid people with more responsibilities?

peakaboo 5y ago

Wonder how many people are still working on Firefox at Mozilla. Seems to me the users voted for Chrome and soon there won't be a Firefox to talk of. Users are stupid, can't fix that.

leeoniya 5y ago
s/stupid/brainwashed and/or accept defaults set by an OEM that has incentives aligned with profit
willvarfar 5y ago
Mozilla-the-company had the most crazy confused direction, mission and leadership and basically squandered a whole lot of money too.
- darthvoldemort 5y ago
  They are forced to spend all/most their money every year. They can't save their money like a regular company due to their status.
  - slig 5y ago
    They should spend their money paying more engineers then, instead of laying off 250 people last year and upping bonuses for the C-level staff.
  - deleted 5y ago
    [deleted]
  - sciurus 5y ago
    You can read the financial statements and see that this is mistaken. The latest is https://www.mozilla.org/en-US/foundation/annualreport/2019/ https://www.mozilla.org/en-US/foundation/annualreport/2019/
Valmar 5y ago
I'll never use Chrome, given the increasingly-worrying directions Google is taking it. Google has too much influence and power, and has become the new Microsoft in terms of browser monopolization.

happynacho 5y ago

And then Mozilla wonders why people don't use Firefox.

SilasX 5y ago
Yes, this kind of thing just shouldn't happen after the "sudden global outage of all add-ons [incl. privacy ones]", followed "no, no, don't worry guys, we forced out a fix via a secret backdoor!" https://news.ycombinator.com/item?id=19823701 https://news.ycombinator.com/item?id=19823701
- kosasbest 5y ago
  > [incl. privacy ones] I remember when all my privacy extensions were entirely absent and I accidentally surfed the web. I felt so vulnerable after that, as if I surfed the web bareback
kelnos 5y ago
The vast majority of users are not extension developers. I'd not heard of this issue until now. It sucks, but it wouldn't make me decide to stop using the browser.
- happynacho 5y ago
  You're not looking at the full picture. Mozilla's pure incompetence to even maintain their addons ecosystem. Remember when all live addons failed due to a cert failure? Besides dumbing down the browser now they can't even seem to get addons running smoothly. Extensions/addons are a core part of a modern browser.

WallyFunk 5y ago

It's `Armagaddon` part deux! https://bugzilla.mozilla.org/show_bug.cgi?id=1548973 https://bugzilla.mozilla.org/show_bug.cgi?id=1548973 https://hacks.mozilla.org/2019/05/technical-details-on-the-recent-firefox-add-on-outage/ https://hacks.mozilla.org/2019/05/technical-details-on-the-r...

WallyFunk 5y ago
But this is different. The addons still work, they just don't update.
- jackewiehose 5y ago
  It's a different outcome but it is again a problem caused by their signing requirement bullshit. It wouldn't be that bad if they would just let us developers use our unsigned extensions.

ArchStanton 5y ago

I'm speaking outside of my bailiwick here, but are browsers now the equivalent of Microsoft Windows? Great big, crufty, no-one-really-knows-how-they-work, security risk laden, feature-fat, clumps of software that everyone uses?

solmag 5y ago
Correct.
spicybright 5y ago
Yup!
dathinab 5y ago
Worse in a certain way as part of the problem are "feature-fat, clumps or over-complicated" web standards every new browser would have to implement.

prophesi 5y ago

Um, it's just a delay in add-on approvals. In this thread you can even see one complainant report back that their add-on was approved a day or two later.

thayne 5y ago
Two months is a really long time to be delayed. And they probably prioritized the one person who complained, and everyone else is still delayed.
- prophesi 5y ago
  It's a company with less than a thousand employees, compared to Google's 100k. The author didn't even state what their extension was, so for all we know it could be a legitimately sketchy add-on with tons of bloated JS that requires extensive review.
  - gilrain 5y ago
    Is uBlock Origin being unable to update any more concerning to you? https://reddit.com/r/firefox/comments/pv15k2/_/he7qm5u/?context=1 https://reddit.com/r/firefox/comments/pv15k2/_/he7qm5u/?cont...
    - prophesi 5y ago
      Their latest version was released on Sept 15th, 10 days ago. Can't imagine this version has been in manual review for even a week. Edit: Nevermind, it was submitted 10 days ago. The latest on Firefox is from months ago. Concerning, but I've had plenty of apps on the App/Play store take longer for review with the most innocuous updates. We moved to OTA updates because of this.
      - gorhill 5y ago
        The issue is the signing of self-hosted dev builds being stalled. It had always taken only a few minutes before I would get a self-hosted dev build to be signed, allowing for the dev build to be used by volunteers so as to be able to spot regressions. I haven't been able to get a signed self-hosted dev build for 12 days now. This means I can't move forward with a stable Firefox release -- which is manually reviewed and is expected to take a number of days. The signed self-hosted dev builds are required steps to keep releasing stable releases, and they are currently stalled for unknown reasons.

cute_boi 5y ago

Adding to this issue I would like to give some of my opinion on webext. To be honest Firefox add-ons process is so grotesque. For instance I can't load my extension without signing in Firefox stable version. And their tool especially web-ext has lot of issues like takes lot of time, gives pesky error if your system time is incorrect (my isp has blocked ntp servers and idk why and switching to vpn just to update is painful tbh). And developing addon is also hard for firefox compared to chrome as the dev tools frequently give message unrelated to extension etc. Sometime I get so angry but I have been using firefox nearly for decades. Its so hard for me :(

tomsmeding 5y ago
Unrelated to your core point but your ISP blocks ntp servers? Wtf? Either some part of the story is missing or that ISP is insane, blocking a piece of core internet infrastructure for which there is, I would guess, no reason.
- manquer 5y ago
  Not OP , but I have seen type of behaviour , ISPs act like corporate firewalls and block everything by default just allow http on 80 and 443 in their consumer plan and try and sell enterprise/higher plans for literally anything else . Not just that once a ISP was using a single CG-NATed IP for a ton of users, that the IP was constantly getting rate limited with captcha everywhere including Google Search and Cloudflare. They suggested I buy a plan with dedicated static IP instead of rotating a few more in their routers.
- magnat 5y ago
  NTP is commonly used for DDoS amplitication.
  - wbl 5y ago
    The right way to do this is to police, not block, and by length.
- addingnumbers 5y ago

thayne 5y ago

This would be a lot less of an issue if Mozilla let you install addons that weren't signed on the stable channel. Or at least had a way to add a custom signing CA.

SilasX 5y ago
Or, if they did force you to go through their CA, actually make sure they keep it updated. https://news.ycombinator.com/item?id=19823701 https://news.ycombinator.com/item?id=19823701
derefr 5y ago
Anything the user can do (like adding a signing CA), malware can do too. The only safe policy flags a browser can provide/respect for extensions, are ones the user can’t affect from their own computer—e.g. GPOs / MDM profile attributes set by a domain administrator. (And both Firefox and Chrome do have management-domain-level extension policies!) Everything else is just one “trick the user into an elevation” away, and then they’re unknowingly part of a browser-embedded botnet.
- gilrain 5y ago
  A process that is preventing gorhill from testing and updating uBlock Origin is a failed process.
- Nextgrid 5y ago
  Malware can just replace or patch the Firefox binary if it wanted to, so enforcing add-on signing wouldn't protect against this.
  - AshamedCaptain 5y ago
    Technically then at least the windows signature failed prompt would show up. Also the firefox binary is usually somewhere you need admin access to write (i.e. admin prompt). I don't really agree with the method Mozilla is using, but at least the explanation makes sense.

morsch 5y ago

I think this is their extension: https://addons.mozilla.org/en-US/firefox/addon/i2p-in-private-browsing/ https://addons.mozilla.org/en-US/firefox/addon/i2p-in-privat... Updated two months ago. The forum post is from late August. They still haven't been able to update it. Evidently, app stores suck even when maintained by well meaning people. The latest update in the thread, nine days ago, is pure corporateese: Hi @zephyr, unfortunately we don’t have a lot more we can share at the moment. However, I’ll talk to the team and see if there are any updates for next week.

ploxiln 5y ago
It's a frustrating state of affairs that this extension review process even exists ... Of course we'll be called entitled whiners for demanding prompt customer service from an open source foundation which does this completely for free. But then why does such an organization with such an offering lock it down with a mandatory capricious review process like Apple? What profit is in it for them? It's to prevent the bad publicity which results from malicious extensions affecting thousands of poor helpless users. How repugnantly negligent would mozilla be considered by news commentators, to allow so many of their users to be violated so badly by their extensions! But I can install any debian package I want from anywhere? Or download and compile a source tarball from anywhere? Use pip to install from pypi which is a free-for-all ... or from any tarball or git url? Even windows users can install arbitrary things! I do find it surprising that there is trend for shady companies to try to buy out popular Chrome extensions to slip adware and then malware into them, this has hardly been seen anywhere else (except mobile app stores maybe). Anyway, I would love a completely different solution: something easy and obvious in settings to disable extension lock-down, with whatever scary warning is needed to let the commoner know they will probably hurt themselves badly, if they can choose what software to run on their computer. Let this option be disabled by GPO for corporate-controlled workstations. Let third-parties provide "trusted extension registries", similar to adblock lists, with hashes of versions of extensions that have been checked by someone who is savvy enough to install debian packages, and can tell when a popular extension has changed ownership. Yeah I know this is unlikely, and again, I'm a whining entitled idiot for demanding anything from a benevolent organization providing open-source software at no monetary cost. I think we just need an "un-mozilla'd firefoxium" ...

dannysu 5y ago

I have an add-on that I submitted an update for on June 21, 2021. It’s still “Awaiting Review”. It’s an add-on that only I use. It’s not published broadly. I basically only needed Mozilla to sign it so I can install it. Very frustrating. After waiting for a long while, I gave up and switched to the Developer Edition so I can use my own add-on.

prophesi 5y ago
Here you go https://github.com/mozilla/web-ext https://github.com/mozilla/web-ext
- benatkin 5y ago
  That just calls the API. https://extensionworkshop.com/documentation/develop/web-ext-command-reference/#web-ext-sign https://extensionworkshop.com/documentation/develop/web-ext-...
jsploit 5y ago
> After waiting for a long while, I gave up and switched to the Developer Edition so I can use my own add-on. I find it very frustrating that they now force users into Nightly / Developer Edition if they want to permanently install unsigned add-ons. What's the harm in simply locking that functionality with a config option?
- the8472 5y ago
  Mozilla is like apple in that regard, users can't be trusted with their own machines and the well-intentioned mothership must at all times be in control since at any moment they could fall to social engineering and then they (apple/mozilla) would get blamed for whatever the malware did. Installing developer edition is the blessed way to opt out of that.
  - dessant 5y ago
    You can install a locally built and signed extension in the release version of Safari, without disclosing the source code to Apple.

gilrain 5y ago

gorhill is unable to test and update uBlock Origin: > This is unfortunate. Development of uBO for Firefox is completely stalled as a result -- the purpose of dev builds is to test code changes before publishing a stable release. It used to take less than five minutes to obtain a signed version of uBO. There are changes in 1.38.0 which the filter list authors are awaiting and this is also stalling proper filter list maintenance. https://reddit.com/r/firefox/comments/pv15k2/_/he7qm5u/?context=1 https://reddit.com/r/firefox/comments/pv15k2/_/he7qm5u/?cont...

pessimizer 5y ago

So first they take complete control of add-ons by deprecating an old (admittedly creaky) system and replacing it with a nerfed one that can't even hide the tab bar; and by requiring add-ons to be signed by them to be installed. Now they'll let what's left die of neglect. Really poor and predictable. edit: I've found of late that my accuracy goes up when instead of trying to predict the future, I just imagine the most dystopian development of a situation possible. Right now I'm imagining add-on developers having to pay Mozilla for the review of their extensions, and their placement on the site.

cutemonster 5y ago
Why not paying them to review? It takes time for them, why should they do it for free? I was just thinking "a way to solve this problem might be if they started charging for reviewing add-ons and updates". Maybe they could charge more from organizations with lots of money, and less from indie devs with less money
- hda2 5y ago
  Or they can let people side-load addons like every other desktop browser.
  - cutemonster 5y ago
    An idea: To strike a balance between flexibility for individuals / small groups, and security for the masses, Firefox could let people side load add-ons used by less than say 1 000 people. However once an add-on gets more than 1 000 users, only the first 1 000 can side load it; the others need to wait until it's been approved (reviewed).

ameshkov 5y ago

Same issue with all our addons. What’s even more frustrating is that unlisted addons are also affected, you cannot even sign an addon since it needs to go through a manual review now.

fartcannon 5y ago

Are there any forks of Firefox with these add on limitations removed?

rastafang 5y ago

I think that Mozilla are trying to make addons disappear.... they started with Firefox Mobile, only about 10-15 addons are available now (which is why I use an ancient version of Firefox Mobile). They are getting a lot of money from Google, so it MIGHT be a request from Google.

preinheimer 5y ago

It took 2+ months for our extension update to be approved, it was a small incremental update. Getting it done in that time frame required us to email Caitlin and an HN'er who commented on another thread to try and get things done in an expedited manner. For a time there was a little ticker showing your place in the queue. We graphed that for a while, then they pulled the feature entirely: https://twitter.com/preinheimer/status/1422577415780450311 https://twitter.com/preinheimer/status/1422577415780450311 The queue of course isn't a straight queue. Some people end up traversing the entire queue, very slowly. Other folks manage to jump out of the queue and get listed sooner. We've seriously considered abandoning our FF extension. FF's market share is shrinking, and we see the difference in the usage stats for our extension specifically. Some of our updates require coordination on our website and the extension. So holding onto FF means that some updates take months to roll out for everyone.

kmeisthax 5y ago

Ruffle nightly builds broke for a good week because Firefox signing broke. We eventually decided to let nightly builds continue without a working Firefox release, but the end result is that Firefox users can't update Ruffle anyway.

esyrahmawati2 5y ago

hello all nothing is useful if you don't have money let's join me to get free money https://coincircle.com/l/aj7jxAQ4f_ https://coincircle.com/l/aj7jxAQ4f_