5 ms·

This would be a lot less of an issue if Mozilla let you install addons that weren't signed on the stable channel. Or at least had a way to add a custom signing

by thayne 5y ago

This would be a lot less of an issue if Mozilla let you install addons that weren't signed on the stable channel. Or at least had a way to add a custom signing CA.

SilasX 5y ago
Or, if they did force you to go through their CA, actually make sure they keep it updated. https://news.ycombinator.com/item?id=19823701 https://news.ycombinator.com/item?id=19823701
derefr 5y ago
Anything the user can do (like adding a signing CA), malware can do too. The only safe policy flags a browser can provide/respect for extensions, are ones the user can’t affect from their own computer—e.g. GPOs / MDM profile attributes set by a domain administrator. (And both Firefox and Chrome do have management-domain-level extension policies!) Everything else is just one “trick the user into an elevation” away, and then they’re unknowingly part of a browser-embedded botnet.
- gilrain 5y ago
  A process that is preventing gorhill from testing and updating uBlock Origin is a failed process.
- Nextgrid 5y ago
  Malware can just replace or patch the Firefox binary if it wanted to, so enforcing add-on signing wouldn't protect against this.
  - AshamedCaptain 5y ago
    Technically then at least the windows signature failed prompt would show up. Also the firefox binary is usually somewhere you need admin access to write (i.e. admin prompt). I don't really agree with the method Mozilla is using, but at least the explanation makes sense.
    - thayne 5y ago
      > Also the firefox binary is usually somewhere you need admin access to write (i.e. admin prompt). No reason custom certs couldn't also be stored somewhere that needs admin access.
- notriddle 5y ago
  Archetypal “malware,” the kind that’s illegal to distribute, doesn’t have to worry about any of this stuff. It can just patch the browser. The problem is “legitimate” businesses that engage in scummy-but-not-illegal behavior. Stuff like the Ask toolbar being shipped with Java, and five years later my friends wind up with dozens of toolbars and they don’t even know where they came from. Those sorts of companies will not patch Firefox.exe, because that would require violating Mozilla’s registered trademark.
- feanaro 5y ago
  Yet Chrome allows the user to install their own extensions. Where is the malware exploiting this for Chrome?
- AlexAndScripts 5y ago
  Malware can also just read the saved passwords, or saved cookies, or keylog, etc, etc. If you've got malware, installing browser extensions is the least of your worries.
- hda2 5y ago
  Malware that has user-level access won't need to bother with addons. Adding user MITM certs strikes me as a far easier way to access browsing traffic.
zksmk 5y ago
I believe you can do this on the Developer Edition, install unsigned add-ons. The DE is basically the same as Firefox Beta but with these kinds of tweaks.
- thayne 5y ago
  But as you said, developer edition is based on beta, not stable.

by thayne 5y ago

This would be a lot less of an issue if Mozilla let you install addons that weren't signed on the stable channel. Or at least had a way to add a custom signing CA.

SilasX 5y ago

Or, if they did force you to go through their CA, actually make sure they keep it updated. https://news.ycombinator.com/item?id=19823701 https://news.ycombinator.com/item?id=19823701

derefr 5y ago

Anything the user can do (like adding a signing CA), malware can do too. The only safe policy flags a browser can provide/respect for extensions, are ones the user can’t affect from their own computer—e.g. GPOs / MDM profile attributes set by a domain administrator. (And both Firefox and Chrome do have management-domain-level extension policies!) Everything else is just one “trick the user into an elevation” away, and then they’re unknowingly part of a browser-embedded botnet.

gilrain 5y ago
A process that is preventing gorhill from testing and updating uBlock Origin is a failed process.
Nextgrid 5y ago
Malware can just replace or patch the Firefox binary if it wanted to, so enforcing add-on signing wouldn't protect against this.
- AshamedCaptain 5y ago
  Technically then at least the windows signature failed prompt would show up. Also the firefox binary is usually somewhere you need admin access to write (i.e. admin prompt). I don't really agree with the method Mozilla is using, but at least the explanation makes sense.
  - thayne 5y ago
    > Also the firefox binary is usually somewhere you need admin access to write (i.e. admin prompt). No reason custom certs couldn't also be stored somewhere that needs admin access.
notriddle 5y ago
Archetypal “malware,” the kind that’s illegal to distribute, doesn’t have to worry about any of this stuff. It can just patch the browser. The problem is “legitimate” businesses that engage in scummy-but-not-illegal behavior. Stuff like the Ask toolbar being shipped with Java, and five years later my friends wind up with dozens of toolbars and they don’t even know where they came from. Those sorts of companies will not patch Firefox.exe, because that would require violating Mozilla’s registered trademark.
feanaro 5y ago
Yet Chrome allows the user to install their own extensions. Where is the malware exploiting this for Chrome?
AlexAndScripts 5y ago
Malware can also just read the saved passwords, or saved cookies, or keylog, etc, etc. If you've got malware, installing browser extensions is the least of your worries.
hda2 5y ago
Malware that has user-level access won't need to bother with addons. Adding user MITM certs strikes me as a far easier way to access browsing traffic.

zksmk 5y ago

I believe you can do this on the Developer Edition, install unsigned add-ons. The DE is basically the same as Firefox Beta but with these kinds of tweaks.

thayne 5y ago
But as you said, developer edition is based on beta, not stable.