5 ms·

It's upsetting to see all this corporate double-speak when Firefox fails to support the most basic extension functionally: the User Agent should allow the User

by jakear 4y ago

It's upsetting to see all this corporate double-speak when Firefox fails to support the most basic extension functionally: the User Agent should allow the User to run their own code on their own machine without any requirement of phoning home to the manufacturer. This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own code on their own machine persistently to file for a developer code signing certificate, essentially copying Apple's approach to marketplace management. Further, this limitation makes auditing the code of extensions you install from third party sources effectively impossible: I don't see any way to stop automatic updates in settings, so at any point the third party code you've installed and enabled to execute on any website you visit can just change out from under you workout warning. This is all trivial in Edge. It is difficult to understand where the HN vulpephillia comes from.

4bpp 4y ago
> It is difficult to understand where the HN vulpephillia comes from. I imagine it is in part backlash, fueled by political impulse. Mozilla's appointment of Mitchell Baker and subsequent course of Firefox development have taken on unmistakable political valence in the US culture war (especially seeing how its drift could be uncharitably glossed as "coddling non-technical users at the expense of power users"), which resulted in criticism invariably sounding like, and, I guess, even really somewhat functioning* as an attack on the political group that Mozilla is associated with. This, in turn, makes those who support said political group, or simply are exasperated with its most vocal opponents, instinctively oppose the criticism. *I'm thinking of something like the affect-loading concept in https://slatestarcodex.com/2014/11/04/ethnic-tension-and-meaningless-arguments/ https://slatestarcodex.com/2014/11/04/ethnic-tension-and-mea....
Arnavion 4y ago
>This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own code on their own machine persistently to file for a developer code signing certificate, essentially copying Apple's approach to marketplace management. My distro's firefox package loads extensions I zip'd and placed in /usr/lib64/firefox/browser/extensions , probably because it's compiled with `--with-unsigned-addon-scopes=app --allow-addon-sideload` FOSS authors are catching on to all the tricks that Windows etc closed source authors have been doing - locking down their software, phoning home with telemetry, bundling in closed-source components with non-free licenses and what not. Distro maintainers are the last line of defence against this shit. Don't use upstream binaries.
throwingtoofar 4y ago
You can keep your extensions loaded by setting this about:config value to false: xpinstall.signatures.required At least I think thats the one. Also extension updating can be disabled globally or on a per extension basis in the addons setting page. Edit: note that you have to package (zip) the extension. You can't keep an unpacked extension loaded.
- tech234a 4y ago
  Yes, but note that this only works in Nightly, Dev, Unbranded and ESR builds, not Beta or Release builds.
TazeTSchnitzel 4y ago
Mozilla provide unbranded versions of Firefox that don't require extensions to be signed: https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... The official branded releases only require signatures because everything else they tried to stop malware hijacking the browser ultimately failed. Mozilla are not trying to copy iOS, they don't stop you leaving the walled garden if you want to.
- PurpleRamen 4y ago
  Unbranded seems to be only available as nightly or beta. No option just for this problem.
  - TazeTSchnitzel 4y ago
    The page I linked to has release builds. The branding isn't the same as normal release builds, but that's why it's called unbranded.
    - PurpleRamen 4y ago
      Yes, and downloading such a release-versions gives me an installation with codename Nightly, not a stable version. Even the version-number is newer.
      - TazeTSchnitzel 4y ago
        They have Nightly branding but they aren't nightlies.
        jakear 4y ago
        When I download the Unbranded/"Nightly" build, it says it's v107.0.1, versus Stable is v109.0. You seemed to be of the impression the declared version string was incorrect, so I dug a bit deeper. The security fixes mentioned in the changelog for v109, such as CVE-2023-23601 [1] are not present in the latest Unbranded/"Nightly" release. So basically Mozilla telling developers: want to be able to run your own code? Fine. But only if you use a months-old browser subject to a bunch of security vulnerabilities we keep a list of on our website for any would-be attacker to consult. [1] https://www.mozilla.org/en-US/security/advisories/mfsa2023-01/#CVE-2023-23601 https://www.mozilla.org/en-US/security/advisories/mfsa2023-0...
_23sd 4y ago
>I don't see any way to stop automatic updates in settings Hit the gear and uncheck "Update Add-ons Automatically". >This is all trivial in Edge. Is it? I can't find the toggle for extension autoupdates in Edge, and a search only turns up hacky methods for Chrome, nothing specific to Edge.
- jakear 4y ago
  > Hit the gear and uncheck "Update Add-ons Automatically". Thanks, my bad for looking for settings in Settings. > Is it? I can't find the toggle for extension autoupdates in Edge, and a search only turns up hacky methods for Chrome, nothing specific to Edge. I can't speak to extensions downloaded from the store, as I only sideload. But when sideloaded, the extensions of course do not update unless you explicitly pull changes in or make changes yourself. Sideloading itself is trivial, even Stable builds provide a "Developer Mode" toggle that allows loading unsigned unpacked extensions from local directories.

by jakear 4y ago

4bpp 4y ago

> It is difficult to understand where the HN vulpephillia comes from. I imagine it is in part backlash, fueled by political impulse. Mozilla's appointment of Mitchell Baker and subsequent course of Firefox development have taken on unmistakable political valence in the US culture war (especially seeing how its drift could be uncharitably glossed as "coddling non-technical users at the expense of power users"), which resulted in criticism invariably sounding like, and, I guess, even really somewhat functioning* as an attack on the political group that Mozilla is associated with. This, in turn, makes those who support said political group, or simply are exasperated with its most vocal opponents, instinctively oppose the criticism. *I'm thinking of something like the affect-loading concept in https://slatestarcodex.com/2014/11/04/ethnic-tension-and-meaningless-arguments/ https://slatestarcodex.com/2014/11/04/ethnic-tension-and-mea....

Arnavion 4y ago

>This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own code on their own machine persistently to file for a developer code signing certificate, essentially copying Apple's approach to marketplace management. My distro's firefox package loads extensions I zip'd and placed in /usr/lib64/firefox/browser/extensions , probably because it's compiled with `--with-unsigned-addon-scopes=app --allow-addon-sideload` FOSS authors are catching on to all the tricks that Windows etc closed source authors have been doing - locking down their software, phoning home with telemetry, bundling in closed-source components with non-free licenses and what not. Distro maintainers are the last line of defence against this shit. Don't use upstream binaries.

throwingtoofar 4y ago

You can keep your extensions loaded by setting this about:config value to false: xpinstall.signatures.required At least I think thats the one. Also extension updating can be disabled globally or on a per extension basis in the addons setting page. Edit: note that you have to package (zip) the extension. You can't keep an unpacked extension loaded.

tech234a 4y ago
Yes, but note that this only works in Nightly, Dev, Unbranded and ESR builds, not Beta or Release builds.

TazeTSchnitzel 4y ago

Mozilla provide unbranded versions of Firefox that don't require extensions to be signed: https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... The official branded releases only require signatures because everything else they tried to stop malware hijacking the browser ultimately failed. Mozilla are not trying to copy iOS, they don't stop you leaving the walled garden if you want to.

PurpleRamen 4y ago
Unbranded seems to be only available as nightly or beta. No option just for this problem.
- TazeTSchnitzel 4y ago
  The page I linked to has release builds. The branding isn't the same as normal release builds, but that's why it's called unbranded.
  - PurpleRamen 4y ago
    Yes, and downloading such a release-versions gives me an installation with codename Nightly, not a stable version. Even the version-number is newer.
    - TazeTSchnitzel 4y ago
      They have Nightly branding but they aren't nightlies.
      - jakear 4y ago
        When I download the Unbranded/"Nightly" build, it says it's v107.0.1, versus Stable is v109.0. You seemed to be of the impression the declared version string was incorrect, so I dug a bit deeper. The security fixes mentioned in the changelog for v109, such as CVE-2023-23601 [1] are not present in the latest Unbranded/"Nightly" release. So basically Mozilla telling developers: want to be able to run your own code? Fine. But only if you use a months-old browser subject to a bunch of security vulnerabilities we keep a list of on our website for any would-be attacker to consult. [1] https://www.mozilla.org/en-US/security/advisories/mfsa2023-01/#CVE-2023-23601 https://www.mozilla.org/en-US/security/advisories/mfsa2023-0...

_23sd 4y ago

>I don't see any way to stop automatic updates in settings Hit the gear and uncheck "Update Add-ons Automatically". >This is all trivial in Edge. Is it? I can't find the toggle for extension autoupdates in Edge, and a search only turns up hacky methods for Chrome, nothing specific to Edge.

jakear 4y ago
> Hit the gear and uncheck "Update Add-ons Automatically". Thanks, my bad for looking for settings in Settings. > Is it? I can't find the toggle for extension autoupdates in Edge, and a search only turns up hacky methods for Chrome, nothing specific to Edge. I can't speak to extensions downloaded from the store, as I only sideload. But when sideloaded, the extensions of course do not update unless you explicitly pull changes in or make changes yourself. Sideloading itself is trivial, even Stable builds provide a "Developer Mode" toggle that allows loading unsigned unpacked extensions from local directories.