4 ms·
I think we're at the point where we need to ask, how the fsck supposedly "open browser" prohibits their own users from installing extensions they want to instal
by smsm42 2y ago
I think we're at the point where we need to ask, how the fsck supposedly "open browser" prohibits their own users from installing extensions they want to install? I mean, I get signing - if you want signing, you can use it. I even get the config option for enterprise setups, maybe - so if an org wants to standardize on Firefox and prohibit workers from installing unsigned extensions - fine. But when it comes to my own install, that's just bullshit.
- paulryanrogers 2y agoIt's a trade off between security for normies and power for technical users. I disagreed at the time (as an addon author) yet have come around to agreeing with the choice.
- smsm42 2y agoNormies don't know what the "addon" is and likely would have IT to install them anyway.
- lmz 2y agoIt's not IT. It's the "potentially unwanted software" installers they download. There's no way to distinguish a user installing an unsigned addon vs some malware doing so.
- smsm42 2y agoIf you're already running an unverified third-party installer, your system is gone. There's nothing Firefox addon signing can do to save you at that moment. You are already at the "running arbitrary code" stage.