3 ms·

firefox/mozilla doesn't really make it easy (compared to chrome) mozilla now requires "add-on signing" [0]; extensions now have to be "signed" (By mozilla) bef

firefox/mozilla doesn't really make it easy (compared to chrome) mozilla now requires "add-on signing" [0]; extensions now have to be "signed" (By mozilla) before you can permanently side-load your own private extension onto regular firefox. they also require you to use 2FA [1] when setting up a firefox.com account (which is required in order for you to upload extensions so they can be signed). at least with chrome you can just enable 'developer mode' and drag and drop your own extensions and use it right away without having to deal with any of that. [0] https://blog.mozilla.org/addons/2020/03/10/support-for-extension-sideloading-has-ended/ https://blog.mozilla.org/addons/2020/03/10/support-for-exten... [1] https://blog.mozilla.org/addons/2021/03/11/two-factor-authentication-required-for-extension-developers/ https://blog.mozilla.org/addons/2021/03/11/two-factor-authen...

2h 4y ago
Yep. Firefox is my browser, but their add-on story is garbage.
cdrini 4y ago
Huh? To the best of my knowledge, to get a development extension working in FF: 1. Ctrl-shift-a to open add-ons page 2. Click the cog, and select "debug add-ons" 3. Click "load temporary add-on" 4. Select a file in your extension. 5. Done. This worked for me earlier this week.
- deleted 4y ago
  [deleted]
- user982 4y ago
  Key word from the grandparent post: "permanently" Key word from the parent post: "temporary"
  - cdrini 4y ago
    Ah I reckon what you meant was "Oh this approach only temporarily installed the add-on, your parent post was asking about a way to permanently install an add-on." Took me a while to figure out what you meant. Ah missed that; yep, the add-on will remain installed until the browser is restarted. That is a little annoying!
- jakear 4y ago
  Hm. I tried this with an super simple extension[1] I had lying around and couldn't get any network requests to work. The error thrown in console was a generic "NetworkError", but the network tab shows no relevant entries at all. Not a great developer experience, especially compared to chromium. https://github.com/JacksonKearl/FeelingBlue/blob/main/extension/chromium/manifest.json https://github.com/JacksonKearl/FeelingBlue/blob/main/extens...
  - cdrini 4y ago
    Odd! Were you trying to fetch a public, CORS-enabled API? That should just work. If you were trying to make a network request for a non-CORS endpoint (eg fetch the google homepage or something), you'll need to add the domain to your permissions section. Eg: "permission": [ "storage", "https://google.com https://google.com" ]
    - old_hat 4y ago
      Not OP, I built an extension for a site that sent CSP headers. Because the browser extension wasn't allowed in the list of JS sources, it all borked. Not certain that's this user's issue, but that is another thing to check.
      - jakear 4y ago
        I suspect this is it. There were a lot of things logged to console for twitter violating its own CSP, but I didn’t see any for my script. It seems the overall handling of network errors in add-ons has a lot of room for improvement. It should be noted that chromium allows the network request regardless of the CSP. This is the correct, User-Empowering approach. Firefox’s deference to the Origin to control the code the User is attempting to run is the antithesis of what a User Agent ought to be.
    - jakear 4y ago
      I have CORS configured to allow the https//twitter.com/ origin. I could see firefox perhaps using a different origin for worker scripts? But hard to tell since the network tab doesn’t show any of the requests. I could set up server logs locally, but there’s only so many hours in my life.
tech234a 4y ago
The signing requirement only applies to the stable and beta versions of Firefox. It can be disabled in about:config in Firefox Developer Edition (which is basically the same as beta), as well as in Nightly, ESR, and Unbranded builds [1]. [1]: https://wiki.mozilla.org/Add-ons/Extension_Signing https://wiki.mozilla.org/Add-ons/Extension_Signing
- 2h 4y ago
  this is not true. with Android version at least, an AMO account is also required.
  - tech234a 4y ago
    I was referring to desktop, not Android here. To my knowledge, Android currently requires a custom collection on AMO for installing anything outside the default list.
johngalt_ 4y ago
It is great they require 2FA, it increases everyone security in case a developer account is compromised.
- brycedriesenga 4y ago
  I'd prefer to choose how much risk I want to take when installing extensions. Just give me a warning and let me do what I want.
  - ThrowawayTestr 4y ago
    Signed extensions can be loaded into release versions of FF. A compromised dev account can create signed malicious extensions. TFA protects everyone.
    - 2h 4y ago
      yes, thats all true. however people should be able to choose their own level of protection. not have the most secure (and most cumbersome) rammed down their throats.
64392947 4y ago
I can understand why the first example is burdensome and don't have any quarrel with it but I can't help but lack sympathy for the second example. If your barrier as a developer is setting up 2FA I can't help but doubt you ever cared much about supporting Firefox anyway. This is like a taxi driver complaining about needing to have proof of insurance and a driver's license.
- user982 4y ago
  I'm just an old-fashioned programmer, I don't think I should have to register with an authority and submit all of my code to them just to be able to run something I've written for myself on my own computer.
- cassepipe 4y ago
  I think mail confirmation or yubikey is fine but I never understood why I need an app on my phone for authentication. What if I lose the phone? How would I get my account back? Tried some authenticator app on the desktop once also and got locked out of my account after that because my computer crashed and I had to reinstall it. Never again.
- alphabet9000 4y ago
  i very much care about supporting firefox users. for example, i maintain a separate, mozilla-signed, manifest v2 version of an extension i made [0] just so firefox users can keep using it. i do so even though this compromises my own ideals about not wanting to use 2FA out of principle. [0] https://github.com/fanfare/googleimagesrestored/releases https://github.com/fanfare/googleimagesrestored/releases

2h 4y ago

Yep. Firefox is my browser, but their add-on story is garbage.

cdrini 4y ago

Huh? To the best of my knowledge, to get a development extension working in FF: 1. Ctrl-shift-a to open add-ons page 2. Click the cog, and select "debug add-ons" 3. Click "load temporary add-on" 4. Select a file in your extension. 5. Done. This worked for me earlier this week.

deleted 4y ago
[deleted]
user982 4y ago
Key word from the grandparent post: "permanently" Key word from the parent post: "temporary"
- cdrini 4y ago
  Ah I reckon what you meant was "Oh this approach only temporarily installed the add-on, your parent post was asking about a way to permanently install an add-on." Took me a while to figure out what you meant. Ah missed that; yep, the add-on will remain installed until the browser is restarted. That is a little annoying!
jakear 4y ago
Hm. I tried this with an super simple extension[1] I had lying around and couldn't get any network requests to work. The error thrown in console was a generic "NetworkError", but the network tab shows no relevant entries at all. Not a great developer experience, especially compared to chromium. https://github.com/JacksonKearl/FeelingBlue/blob/main/extension/chromium/manifest.json https://github.com/JacksonKearl/FeelingBlue/blob/main/extens...
- cdrini 4y ago
  Odd! Were you trying to fetch a public, CORS-enabled API? That should just work. If you were trying to make a network request for a non-CORS endpoint (eg fetch the google homepage or something), you'll need to add the domain to your permissions section. Eg: "permission": [ "storage", "https://google.com https://google.com" ]
  - old_hat 4y ago
    Not OP, I built an extension for a site that sent CSP headers. Because the browser extension wasn't allowed in the list of JS sources, it all borked. Not certain that's this user's issue, but that is another thing to check.
    - jakear 4y ago
      I suspect this is it. There were a lot of things logged to console for twitter violating its own CSP, but I didn’t see any for my script. It seems the overall handling of network errors in add-ons has a lot of room for improvement. It should be noted that chromium allows the network request regardless of the CSP. This is the correct, User-Empowering approach. Firefox’s deference to the Origin to control the code the User is attempting to run is the antithesis of what a User Agent ought to be.
  - jakear 4y ago
    I have CORS configured to allow the https//twitter.com/ origin. I could see firefox perhaps using a different origin for worker scripts? But hard to tell since the network tab doesn’t show any of the requests. I could set up server logs locally, but there’s only so many hours in my life.

tech234a 4y ago

The signing requirement only applies to the stable and beta versions of Firefox. It can be disabled in about:config in Firefox Developer Edition (which is basically the same as beta), as well as in Nightly, ESR, and Unbranded builds [1]. [1]: https://wiki.mozilla.org/Add-ons/Extension_Signing https://wiki.mozilla.org/Add-ons/Extension_Signing

2h 4y ago
this is not true. with Android version at least, an AMO account is also required.
- tech234a 4y ago
  I was referring to desktop, not Android here. To my knowledge, Android currently requires a custom collection on AMO for installing anything outside the default list.

johngalt_ 4y ago

It is great they require 2FA, it increases everyone security in case a developer account is compromised.

brycedriesenga 4y ago
I'd prefer to choose how much risk I want to take when installing extensions. Just give me a warning and let me do what I want.
- ThrowawayTestr 4y ago
  Signed extensions can be loaded into release versions of FF. A compromised dev account can create signed malicious extensions. TFA protects everyone.
  - 2h 4y ago
    yes, thats all true. however people should be able to choose their own level of protection. not have the most secure (and most cumbersome) rammed down their throats.

64392947 4y ago

I can understand why the first example is burdensome and don't have any quarrel with it but I can't help but lack sympathy for the second example. If your barrier as a developer is setting up 2FA I can't help but doubt you ever cared much about supporting Firefox anyway. This is like a taxi driver complaining about needing to have proof of insurance and a driver's license.

user982 4y ago
I'm just an old-fashioned programmer, I don't think I should have to register with an authority and submit all of my code to them just to be able to run something I've written for myself on my own computer.
cassepipe 4y ago
I think mail confirmation or yubikey is fine but I never understood why I need an app on my phone for authentication. What if I lose the phone? How would I get my account back? Tried some authenticator app on the desktop once also and got locked out of my account after that because my computer crashed and I had to reinstall it. Never again.
alphabet9000 4y ago
i very much care about supporting firefox users. for example, i maintain a separate, mozilla-signed, manifest v2 version of an extension i made [0] just so firefox users can keep using it. i do so even though this compromises my own ideals about not wanting to use 2FA out of principle. [0] https://github.com/fanfare/googleimagesrestored/releases https://github.com/fanfare/googleimagesrestored/releases