3 ms·

Mozilla provide unbranded versions of Firefox that don't require extensions to be signed: https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds ht

Mozilla provide unbranded versions of Firefox that don't require extensions to be signed: https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... The official branded releases only require signatures because everything else they tried to stop malware hijacking the browser ultimately failed. Mozilla are not trying to copy iOS, they don't stop you leaving the walled garden if you want to.

PurpleRamen 4y ago
Unbranded seems to be only available as nightly or beta. No option just for this problem.
- TazeTSchnitzel 4y ago
  The page I linked to has release builds. The branding isn't the same as normal release builds, but that's why it's called unbranded.
  - PurpleRamen 4y ago
    Yes, and downloading such a release-versions gives me an installation with codename Nightly, not a stable version. Even the version-number is newer.
    - TazeTSchnitzel 4y ago
      They have Nightly branding but they aren't nightlies.
      - jakear 4y ago
        When I download the Unbranded/"Nightly" build, it says it's v107.0.1, versus Stable is v109.0. You seemed to be of the impression the declared version string was incorrect, so I dug a bit deeper. The security fixes mentioned in the changelog for v109, such as CVE-2023-23601 [1] are not present in the latest Unbranded/"Nightly" release. So basically Mozilla telling developers: want to be able to run your own code? Fine. But only if you use a months-old browser subject to a bunch of security vulnerabilities we keep a list of on our website for any would-be attacker to consult. [1] https://www.mozilla.org/en-US/security/advisories/mfsa2023-01/#CVE-2023-23601 https://www.mozilla.org/en-US/security/advisories/mfsa2023-0...
        TazeTSchnitzel 4y ago
        The interface is unfriendly to say the least, but if I follow the trail • https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... (click “release”) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click the date of the most recent complete build) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon&revision=dddf31a42e95b6fcf751937c3340f772f603b3f7 https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click “B” next to your desired platform, OS X in my case) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon&revision=dddf31a42e95b6fcf751937c3340f772f603b3f7&selectedTaskRun=NglUFgUWRc2g98WLCBI-jw.0 https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click “Artifacts and Debugging”, then “target.dmg”/“target.zip”) • https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/NglUFgUWRc2g98WLCBI-jw/runs/0/artifacts/public/build/target.dmg https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task... … then I get a “Nightly” build reporting version 109.0.1. The direct links to the latest releases should be better maintained for sure, and it did take me longer than I'd like to figure out the build interface.

PurpleRamen 4y ago

Unbranded seems to be only available as nightly or beta. No option just for this problem.

TazeTSchnitzel 4y ago
The page I linked to has release builds. The branding isn't the same as normal release builds, but that's why it's called unbranded.
- PurpleRamen 4y ago
  Yes, and downloading such a release-versions gives me an installation with codename Nightly, not a stable version. Even the version-number is newer.
  - TazeTSchnitzel 4y ago
    They have Nightly branding but they aren't nightlies.
    - jakear 4y ago
      When I download the Unbranded/"Nightly" build, it says it's v107.0.1, versus Stable is v109.0. You seemed to be of the impression the declared version string was incorrect, so I dug a bit deeper. The security fixes mentioned in the changelog for v109, such as CVE-2023-23601 [1] are not present in the latest Unbranded/"Nightly" release. So basically Mozilla telling developers: want to be able to run your own code? Fine. But only if you use a months-old browser subject to a bunch of security vulnerabilities we keep a list of on our website for any would-be attacker to consult. [1] https://www.mozilla.org/en-US/security/advisories/mfsa2023-01/#CVE-2023-23601 https://www.mozilla.org/en-US/security/advisories/mfsa2023-0...
      - TazeTSchnitzel 4y ago
        The interface is unfriendly to say the least, but if I follow the trail • https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... (click “release”) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click the date of the most recent complete build) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon&revision=dddf31a42e95b6fcf751937c3340f772f603b3f7 https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click “B” next to your desired platform, OS X in my case) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon&revision=dddf31a42e95b6fcf751937c3340f772f603b3f7&selectedTaskRun=NglUFgUWRc2g98WLCBI-jw.0 https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click “Artifacts and Debugging”, then “target.dmg”/“target.zip”) • https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/NglUFgUWRc2g98WLCBI-jw/runs/0/artifacts/public/build/target.dmg https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task... … then I get a “Nightly” build reporting version 109.0.1. The direct links to the latest releases should be better maintained for sure, and it did take me longer than I'd like to figure out the build interface.