3 ms·

My most essential fix is getting the unbranded builds of Firefox so that I can control my own browser. These builds have no FF branding and they've disabled aut

My most essential fix is getting the unbranded builds of Firefox so that I can control my own browser. These builds have no FF branding and they've disabled auto-update in them but they have the major advantage of actually allowing you to edit your extensions/add-ons without having to play security theater with Mozilla's automated signing portal every time you make a change. https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... - the linked 97.0.1 is still exploitable with the xslt bug so you have to dig into the build system at, https://treeherder.mozilla.org/#/jobs?repo=mozilla-release&searchStr=addon https://treeherder.mozilla.org/#/jobs?repo=mozilla-release&s... And no, running the unstable developer builds is not an option. The dev line goes back to "alpha"/aurora in the old times and it still plays that role. It crashes in my experience on weird setups.

eli 5y ago
Giving up the security and ease of auto update seems like a huge trade off
- superkuh 5y ago
  Yeah, I really wish they'd allow auto-update for the unbranded builds. Now I just do it manually, often. But with the profiles being the same it's not too bad. It's much better than having to ask Moz every time I tweak an extension.
  - fabrice_d 5y ago
    It's not disallowed: you can setup your own (even local) update server and point to it, but it's a bit of an undocumented chore. Depending on you OS, it may be easier to eg. use an apt repo if you are running a Debian derivative.
    - superkuh 5y ago
      Sure. It's technically possible for me to re-make Mozilla's infrastructure with a great effort. But what I mean is, Mozilla doesn't want to provide support (like security updates) or services for their browser unless they completely control it. Probably the argument is that this prevents ignorant users from accidentally downloading unbranded and accidentally installing some malware extension and blaming FF brand for it. But it's about branding and perception far more that security or resources.
notriddle 5y ago
> These builds have no FF branding and they've disabled auto-update in them but they have the major advantage of actually allowing you to edit your extensions/add-ons without having to play security theater with Mozilla's automated signing portal every time you make a change. “Security” isn’t even the word I’d use for what extension signing seems to do. After all, full-out malware — the illegal stuff — can replace firefox.exe with their own. What it really seems to be intended to protect against is legal-but-scummy applications like Oracle Java that installed random toolbars and add-ons that almost nobody wants. They can legally install an add-on, but patching Firefox itself would be a clear-cut trademark violation, so they won’t do that. Since the Java installer ran with the same permissions that a regular user runs as, they can’t really stop that thing without stopping you. The phrase I’d use to describe this is brand protection, not security.

eli 5y ago

Giving up the security and ease of auto update seems like a huge trade off

superkuh 5y ago
Yeah, I really wish they'd allow auto-update for the unbranded builds. Now I just do it manually, often. But with the profiles being the same it's not too bad. It's much better than having to ask Moz every time I tweak an extension.
- fabrice_d 5y ago
  It's not disallowed: you can setup your own (even local) update server and point to it, but it's a bit of an undocumented chore. Depending on you OS, it may be easier to eg. use an apt repo if you are running a Debian derivative.
  - superkuh 5y ago
    Sure. It's technically possible for me to re-make Mozilla's infrastructure with a great effort. But what I mean is, Mozilla doesn't want to provide support (like security updates) or services for their browser unless they completely control it. Probably the argument is that this prevents ignorant users from accidentally downloading unbranded and accidentally installing some malware extension and blaming FF brand for it. But it's about branding and perception far more that security or resources.

notriddle 5y ago

> These builds have no FF branding and they've disabled auto-update in them but they have the major advantage of actually allowing you to edit your extensions/add-ons without having to play security theater with Mozilla's automated signing portal every time you make a change. “Security” isn’t even the word I’d use for what extension signing seems to do. After all, full-out malware — the illegal stuff — can replace firefox.exe with their own. What it really seems to be intended to protect against is legal-but-scummy applications like Oracle Java that installed random toolbars and add-ons that almost nobody wants. They can legally install an add-on, but patching Firefox itself would be a clear-cut trademark violation, so they won’t do that. Since the Java installer ran with the same permissions that a regular user runs as, they can’t really stop that thing without stopping you. The phrase I’d use to describe this is brand protection, not security.