3 ms·

On desktop Firefox, you can download an extension from anywhere and install it. All they're gatekeeping is their own repository, which I think most of us would

by Zak 2y ago

On desktop Firefox, you can download an extension from anywhere and install it. All they're gatekeeping is their own repository, which I think most of us would like them to do. I think mobile requires using a nightly build to install extensions from outside Mozilla's repository, and that suggests their thinking is becoming contaminated by the rest of the mobile ecosystem.

Semaphor 2y ago
No, the normal version blocks (at least permanent) installs. You need the developer version to install unsigned extensions.
- Zak 2y ago
  I see. The extension I installed to test that actually is signed, though it's not in AMO. I don't like this. I know there have been issues with malicious extensions, so it makes sense to me that installing unsigned extensions is turned off by default, but requiring developer builds is a step too far.
- pxc 2y ago
  What release made this change effective?
  - Semaphor 2y ago
    That was many years ago, there was a bit of a public complaint.
- sunaookami 2y ago
  Correct. It's incredibly how much misinformation there is about signing, even here where people should know better. It's very tiresome.
adduc 2y ago
Are you certain extensions can be downloaded and installed from anywhere? Firefox's documentation[1] states "Extensions and themes need to be signed by Mozilla before they can be installed in release and beta versions of Firefox." If UBlock Lite was rejected through Mozilla's signing API, they'd have no ability to create an XPI that can be installed by release/beta version of Firefox. [1]: https://extensionworkshop.com/documentation/publish/signing-and-distribution-overview/ https://extensionworkshop.com/documentation/publish/signing-...
bytebolt 2y ago
You can no longer package extensions yourself and if you try using "Load add on from file" you get that extension loaded but it's gone after a restart. All extensions have to be signed first to be permanent and Mozilla denied to fix that on their bug tracker.
- burnte 2y ago
  Signing is such a low bar to pass I agree that not offering that as an option is reasonable. It takes seconds to do.
  - Zak 2y ago
    We're talking about signing by Mozilla to indicate the extension has passed some sort of review process, not signing by the author. It isn't a low bar because it gives Mozilla veto power over what extensions users can install.
Arnavion 2y ago
To add on to the other replies, you *can* load unsigned extensions with desktop Firefox if the build you're using disabled the signing requirement at build time. A bunch of distros' FF packages do that, for example, and is why I use a bunch of extensions I wrote myself (and thus trust) for myself without having to deal with Mozilla. (Zip up the files, change the file extension to `.xpi`, drop it in `$libdir/firefox/browser/extensions/`)

by Zak 2y ago

Semaphor 2y ago

No, the normal version blocks (at least permanent) installs. You need the developer version to install unsigned extensions.

Zak 2y ago
I see. The extension I installed to test that actually is signed, though it's not in AMO. I don't like this. I know there have been issues with malicious extensions, so it makes sense to me that installing unsigned extensions is turned off by default, but requiring developer builds is a step too far.
pxc 2y ago
What release made this change effective?
- Semaphor 2y ago
  That was many years ago, there was a bit of a public complaint.
sunaookami 2y ago
Correct. It's incredibly how much misinformation there is about signing, even here where people should know better. It's very tiresome.

adduc 2y ago

Are you certain extensions can be downloaded and installed from anywhere? Firefox's documentation[1] states "Extensions and themes need to be signed by Mozilla before they can be installed in release and beta versions of Firefox." If UBlock Lite was rejected through Mozilla's signing API, they'd have no ability to create an XPI that can be installed by release/beta version of Firefox. [1]: https://extensionworkshop.com/documentation/publish/signing-and-distribution-overview/ https://extensionworkshop.com/documentation/publish/signing-...

bytebolt 2y ago

You can no longer package extensions yourself and if you try using "Load add on from file" you get that extension loaded but it's gone after a restart. All extensions have to be signed first to be permanent and Mozilla denied to fix that on their bug tracker.

burnte 2y ago
Signing is such a low bar to pass I agree that not offering that as an option is reasonable. It takes seconds to do.
- Zak 2y ago
  We're talking about signing by Mozilla to indicate the extension has passed some sort of review process, not signing by the author. It isn't a low bar because it gives Mozilla veto power over what extensions users can install.

Arnavion 2y ago

To add on to the other replies, you *can* load unsigned extensions with desktop Firefox if the build you're using disabled the signing requirement at build time. A bunch of distros' FF packages do that, for example, and is why I use a bunch of extensions I wrote myself (and thus trust) for myself without having to deal with Mozilla. (Zip up the files, change the file extension to `.xpi`, drop it in `$libdir/firefox/browser/extensions/`)