4 ms·

As a long time FF user my opinion of it took quite a hit recently. I wanted to hack together a small personal extension, likely outside the scope of what Tamper

by rft 4y ago

As a long time FF user my opinion of it took quite a hit recently. I wanted to hack together a small personal extension, likely outside the scope of what Tampermonkey can do easily. I was really shocked by the mandatory signature enforcement. You need to get your extension signed by Mozilla with no way to disable it in the standard FF, the about:config setting does nothing (see [1]). Your temporary extension will also be deleted on browser restart. Sure, I can use the developer edition, but why? I am not a web developer. I get Mozilla's arguments about user security, but isn't an about:config tweak obscure enough? It already shows you plenty warning when you open it. Looking at the mentioned LibreWolf, the changes reminded me of my time using ungoogled Chromium. I left that path, because it seemed like an uphill battle to keep up with upstream changes in the long term. Also you potentially risk using a somewhat outdated browser until all changes are ported to the new version. I was also not a fan of giving Chromium browsers additional market share. For me switching to FF was primarily about using a browser supporting user choice and privacy, not for its UX or anything else. However Mozilla is losing my trust in this regard. Opt-out telemetry/tracking/whatever you want to call it and user experiments as well as reducing user choice with forced signatures by a central party, this sounds counter to why I switched in the first place. I hate that I have to go into settings after installing it to disable "features", it is not Windows... [1] https://support.mozilla.org/en-US/kb/add-on-signing-in-firefox https://support.mozilla.org/en-US/kb/add-on-signing-in-firef... (I am also a bit surprised I had to strip an utm key from this URL...)

pja 4y ago
Usually you find that the reason these barriers exist is because people were abusing the previous system. There are (sadly) plenty of people out there who will install a browser extension & tweak an about:config setting if you set up the right incentives to get them to look past the warnings. The price of protecting these people from those that would take advantage of them is developers having to download a different version of the browser in order to develop their extensions.
- oauea 4y ago
  When you dig deeper, you will indeed find that the public reason for these kind of restrictions is "to keep the user safe". They claim to be worried about malware installing their own extensions, so they lock everything down. As if that same malware wouldn't just patch the firefox binary to allow loading unsigned extensions. It's ridiculous and obviously meant as a first step towards a walled garden. It's very unfortunate that firefox followed google in this.
  - blendergeek 4y ago
    > It's ridiculous and obviously meant as a first step towards a walled garden. It's very unfortunate that firefox followed google in this. Check out Firefox for Android. It has a Walled Garden of extensions. There is a list of about 20 whitelisted extensions. All others are (falsely) claimed to be "incompatible".
- rft 4y ago
  > Usually you find that the reason these barriers exist is because people were abusing the previous system. I absolutely get this argument and this is also what I got from the Mozilla docs. For me the decision for user safety moved too far away from user freedom. I get that this is a tradeoff, I am not happy with the outcome personally. I have no perfect solution to this problem either, I just find the current state runs counter to what I personally would expect. I see a sliding scale from Apple walled garden to Windows XP wild west. I think I am more on the XP side than the Apple side, so my view likely clashes with what Mozilla has in mind.
- alex7734 4y ago
  > The price of protecting these people from those that would take advantage of them is developers having to download a different version of the browser in order to develop their extensions. So what stops these people from downloading a developer version of the browser themselves? You cannot protect people from themselves. The only cure for idiocy is death after all.
- pessimizer 4y ago
  > Usually you find that the reason these barriers exist is because people were abusing the previous system. Why be vague? Point out some people who were abusing the previous system who couldn't abuse it now.
- Zuiii 4y ago
  Why doesn't google do the same then? They have the same issue and have a much larger market share. They don't do it because it doesn't stop those plenty of people from doing what they want to do. This misguided decision from Mozilla only serves to drive developers and tinkerers away from their browser. (No, I will not download the nightly/beta browser just to run my own addons)
Kwpolska 4y ago
The signature process for extensions not offered to the public (on addons.mozilla.org) is automated and pretty much instantaneous, and they only verify there is no obvious malware in the extension. I’ve built a handful of extensions for myself and getting them signed is just a small nuisance.
andrewaylett 4y ago
> I am not a web developer. Maybe not, but you seem to be a browser extension developer.

by rft 4y ago

pja 4y ago

Usually you find that the reason these barriers exist is because people were abusing the previous system. There are (sadly) plenty of people out there who will install a browser extension & tweak an about:config setting if you set up the right incentives to get them to look past the warnings. The price of protecting these people from those that would take advantage of them is developers having to download a different version of the browser in order to develop their extensions.

oauea 4y ago
When you dig deeper, you will indeed find that the public reason for these kind of restrictions is "to keep the user safe". They claim to be worried about malware installing their own extensions, so they lock everything down. As if that same malware wouldn't just patch the firefox binary to allow loading unsigned extensions. It's ridiculous and obviously meant as a first step towards a walled garden. It's very unfortunate that firefox followed google in this.
- blendergeek 4y ago
  > It's ridiculous and obviously meant as a first step towards a walled garden. It's very unfortunate that firefox followed google in this. Check out Firefox for Android. It has a Walled Garden of extensions. There is a list of about 20 whitelisted extensions. All others are (falsely) claimed to be "incompatible".
rft 4y ago
> Usually you find that the reason these barriers exist is because people were abusing the previous system. I absolutely get this argument and this is also what I got from the Mozilla docs. For me the decision for user safety moved too far away from user freedom. I get that this is a tradeoff, I am not happy with the outcome personally. I have no perfect solution to this problem either, I just find the current state runs counter to what I personally would expect. I see a sliding scale from Apple walled garden to Windows XP wild west. I think I am more on the XP side than the Apple side, so my view likely clashes with what Mozilla has in mind.
alex7734 4y ago
> The price of protecting these people from those that would take advantage of them is developers having to download a different version of the browser in order to develop their extensions. So what stops these people from downloading a developer version of the browser themselves? You cannot protect people from themselves. The only cure for idiocy is death after all.
pessimizer 4y ago
> Usually you find that the reason these barriers exist is because people were abusing the previous system. Why be vague? Point out some people who were abusing the previous system who couldn't abuse it now.
Zuiii 4y ago
Why doesn't google do the same then? They have the same issue and have a much larger market share. They don't do it because it doesn't stop those plenty of people from doing what they want to do. This misguided decision from Mozilla only serves to drive developers and tinkerers away from their browser. (No, I will not download the nightly/beta browser just to run my own addons)

Kwpolska 4y ago

The signature process for extensions not offered to the public (on addons.mozilla.org) is automated and pretty much instantaneous, and they only verify there is no obvious malware in the extension. I’ve built a handful of extensions for myself and getting them signed is just a small nuisance.

andrewaylett 4y ago

> I am not a web developer. Maybe not, but you seem to be a browser extension developer.