3 ms·
> These builds have no FF branding and they've disabled auto-update in them but they have the major advantage of actually allowing you to edit your extensions/a
by notriddle 5y ago
> These builds have no FF branding and they've disabled auto-update in them but they have the major advantage of actually allowing you to edit your extensions/add-ons without having to play security theater with Mozilla's automated signing portal every time you make a change.
“Security” isn’t even the word I’d use for what extension signing seems to do. After all, full-out malware — the illegal stuff — can replace firefox.exe with their own.
What it really seems to be intended to protect against is legal-but-scummy applications like Oracle Java that installed random toolbars and add-ons that almost nobody wants. They can legally install an add-on, but patching Firefox itself would be a clear-cut trademark violation, so they won’t do that. Since the Java installer ran with the same permissions that a regular user runs as, they can’t really stop that thing without stopping you.
The phrase I’d use to describe this is brand protection, not security.