4 ms·

Chrome doesn't require extensions to be signed? Or hasn't revoked the signature?

by SilasX 5y ago

gnicholas 5y ago
I could be wrong, but I think you can side-load any extension locally. About 3 years ago Google made it impossible to have users click a link on your website and install that way (which some people referred to as side-loading), but I think you can still enable dev mode and side-load a downloaded file.
- boogies 5y ago
  At least as of 2 years ago, you could go to chrome://extensions, click a "Dev Mode' toggle in the top right, and sideload a downloaded crx (I know from installing https://adnauseam.io/ https://adnauseam.io/ every time I had to use a Chromebook, it’s banned from the webstore for adding obfuscatory privacy enhancements designed as research by Daniel C. Howe and Helen Nissenbaum to gorhill's great µBlock Origin).
gizmo686 5y ago
The linked instructions involve loading the unpacked extension in developer mode. There isn't really a way of preventing that without crippling the ability of extension developers to develop their own extensions.
- SilasX 5y ago
  Well, Firefox prevents that unless you download a separate developer version that doesn’t update, and Mozilla insists that’s for security.
  - raxxorrax 5y ago
    The greatest security threat is that browser vendors become increasingly untrustworthy, so a signed app doesn't really say it doesn't exploit you to the maximum of its ability.
    - SilasX 5y ago
      Oh agreed, I hate Mozilla’s thinking on security.
  - foepys 5y ago
    My Firefox Developer Edition updates just fine by itself. Maybe a (corporate) firewall is blocking the update server on your machine/network and your corporate software repo is only installing the enduser Firefox?
    - SilasX 5y ago
      I haven't checked it in a while and haven't tried, I've just been going by what I remember from the last time I tried to get around this restriction, and what someone brings up every time Dev Edition is suggested as an alternative. I guess it's worth trying out again. If Mozilla has unbroken the Developer edition, and it's available to everyone, great! Firefox is almost back to the functionality it had in 2016! In any case, no, I'm not on a corporate firewall, you were kind of jumping to (oddly specific) conclusions there. And firewalls don't work like that.
      - Dylan16807 5y ago
        It's always worked for me. I think the unbranded version doesn't update. Or used to not update. But that's not developer.
  - 3np 5y ago
    How so? I’m on FF 91 (not dev ed) and can load from a self-built zip file just fine

Chrome doesn't require extensions to be signed? Or hasn't revoked the signature?

by SilasX 5y ago

Chrome doesn't require extensions to be signed? Or hasn't revoked the signature?

I could be wrong, but I think you can side-load any extension locally. About 3 years ago Google made it impossible to have users click a link on your website and install that way (which some people referred to as side-loading), but I think you can still enable dev mode and side-load a downloaded file.

boogies 5y ago
At least as of 2 years ago, you could go to chrome://extensions, click a "Dev Mode' toggle in the top right, and sideload a downloaded crx (I know from installing https://adnauseam.io/ https://adnauseam.io/ every time I had to use a Chromebook, it’s banned from the webstore for adding obfuscatory privacy enhancements designed as research by Daniel C. Howe and Helen Nissenbaum to gorhill's great µBlock Origin).

gizmo686 5y ago

The linked instructions involve loading the unpacked extension in developer mode. There isn't really a way of preventing that without crippling the ability of extension developers to develop their own extensions.

SilasX 5y ago
Well, Firefox prevents that unless you download a separate developer version that doesn’t update, and Mozilla insists that’s for security.
- raxxorrax 5y ago
  The greatest security threat is that browser vendors become increasingly untrustworthy, so a signed app doesn't really say it doesn't exploit you to the maximum of its ability.
  - SilasX 5y ago
    Oh agreed, I hate Mozilla’s thinking on security.
- foepys 5y ago
  My Firefox Developer Edition updates just fine by itself. Maybe a (corporate) firewall is blocking the update server on your machine/network and your corporate software repo is only installing the enduser Firefox?
  - SilasX 5y ago
    I haven't checked it in a while and haven't tried, I've just been going by what I remember from the last time I tried to get around this restriction, and what someone brings up every time Dev Edition is suggested as an alternative. I guess it's worth trying out again. If Mozilla has unbroken the Developer edition, and it's available to everyone, great! Firefox is almost back to the functionality it had in 2016! In any case, no, I'm not on a corporate firewall, you were kind of jumping to (oddly specific) conclusions there. And firewalls don't work like that.
    - Dylan16807 5y ago
      It's always worked for me. I think the unbranded version doesn't update. Or used to not update. But that's not developer.
- 3np 5y ago
  How so? I’m on FF 91 (not dev ed) and can load from a self-built zip file just fine