6 ms·

Does everything need to be signed? Use a tool to much and you end up becoming it's slave. For a long time a had problems with some websites not loading videos

Does everything need to be signed? Use a tool to much and you end up becoming it's slave. For a long time a had problems with some websites not loading videos when opened in background because I had an addon which disabled the page visibility api. So I download the source of the addon ( straight from the addons store right click the install button and save as..) changed the manifest to exclude the said sites, zip it back and install it again? Well your addon needs to be signed to be installed permanent even when you manualy install it. I understand that this is to keep tech-illiterate users safe from malicious addons. So is there a flag/about:config setting for advanced users to enable which skips the check? Nope, there was one but not anymore. So what options do I have? Either use beta version of Firefox as my main browser (no thanks). Or create an account as a developer, upload my addon and wait for Mozzila to check and sign my addon (that I created for myself).

braiamp 2y ago
The reason for that is like you expect, someone abused that, and we do not have nice things anymore. That's the same reason why apt-get doesn't allow you to remove essential packages on Debian, without modifying a configuration file.
- bravetraveler 2y ago
  DNF has a similar mechanism, I appreciate it when poorly-written third party package manifests try to remove/deprecate more than they should
- megous 2y ago
  I can not run my own extension in Firefox by modifying a config file. It's not possible. Not even if I don't let dishonest actors anywhere near my Firefox install. I can murder some trees and poison the environment for all of us, to do pointless mutli-hour re-builds of Firefox for each release and point release to have it accept my add-ons, though. I've also never seen a reason, why I can't at least place my CA into Firefox /usr/lib/firefox folder or /etc/firefox and have it be respected. Or just place local extensions there and have firefox not require signatures for them, because there's no way these can be installed accidentally from web by clicking some link. And if someone can trick me into modifying /usr/lib, they can just trick me into replacing Firefox completly with their malwared build, so signing will not save me anyway.
  - reubenmorais 2y ago
    > And if someone can trick me into modifying /usr/lib, they can just trick me into replacing Firefox completly with their malwared build, so signing will not save me anyway. As you said yourself, that's a much bigger hassle and cost. In other words, it's an effective deterrent. Writing to a user owned file is a very low bar for allowing privileged code execution in the browser. A long time ago browsers used to be infested with all kinds of toolbars and extensions automatically installed by third party software, I for one am glad to not have to worry about that in my computer and on networks I manage or frequent.
    - SunlitCat 2y ago
      It's an effective deterrent to keep power user away from your software as well! So if that's what Mozilla wants, they have their mission accomplished!
      - reubenmorais 2y ago
        A power user only needs to RTFD: https://wiki.mozilla.org/Add-ons/Extension_Signing#FAQ https://wiki.mozilla.org/Add-ons/Extension_Signing#FAQ
        SunlitCat 2y ago
        Yeah...no. Only preview versions and developer versions can run unsigned addons. Both coming with their own set of reasons why you shouldn't use them as your daily browser.
        megous 2y ago
        And ESR, but that may not be normally distributed in Linux distros. It's not in Arch Linux. There's no hassle free solution. Only way to run your own code on normal branded Firefox release is to rely on third party signed extensions (eg. Violentmonkey), but that's not really hassle free either if you have 10s of userscripts and multiple browser profiles, and you have to trust some third-party to not go rogue. I got pretty terrible malware from mozilla add-on store in the past.
- eadmund 2y ago
  Honestly, that trade-off is not worth it, particularly with browsers. People who do ignorant things are ignorant (note that I did not say stupid: they may be quite intelligent in other areas of life). Tools should do what their owners direct them to do, even if it is a mistake. With apt, there is a bit of method to the madness: if one imagines that apt’s job is to do the thing the user requested and then deliver a correct system, then clearly essential packages can’t be removed. But there is not a reason to prevent the user of the software from using the software in the way he wishes on his own machine.
  - lrvick 2y ago
    Advanced users can modify the source code to disable things that get in their way. Anyone not capable of that is not capable of knowing when it is safe to turn off safety defaults. Chromebooks at least get this one thing right. You can disable firmware signing, but only if you are comfortable taking the laptop apart to remove a magic write protection screw. That is something a scammer cannot easily convince a grandma to do.
    - toast0 2y ago
      I think chromebooks have moved away from screws to special key combinations for the most part. The screw is a good idea, but having to take apart the whole thing to get to the screw is a bit much.
    - eadmund 2y ago
      > Advanced users can modify the source code to disable things that get in their way. Anyone not capable of that is not capable of knowing when it is safe to turn off safety defaults. Modifying a morass of C++ source code is not nearly the same thing as writing an extension in Javascript. Mozilla is just fundamentally in the wrong here.
- solarkraft 2y ago
  The biggest browser by far, Chrome, can somehow afford allowing people to install unsigned extensions, so Firefox ought to be able to as well.
  - sameerds 2y ago
    A close friend who is a professional has been losing customers because he was too careful and wanted only the most reliable thing for every customer. Customers drifted away, and business dwindled. Our guess is that word-of-mouth publicity stopped because "he takes too much time to get anything done". Things have started improving ever since he pulled back his quality slightly, thinking that if say a "small N" out of 100 customers are dissatisfied, at least the remaining will retain business. Is that what is ailing Firefox? I mean is Firefox losing because it tries to be safest and the best for every user, while Chrome just carries on with basic safety and nothing more? [EDIT: Clarified the question.]
    - ttoinou 2y ago
      Good point, maybe it comes from who's paying for the browser, hence how companies behind browsers are incentivized. Google gets money from advertiser and Mozilla from Google and users donations
    - eviks 2y ago
      Given the fact that Firefox was ailing long before mandatory signing, this seems like a clear no? Besides, this isn't "safest and best for every user", just like the quality vs speed tradeoff in your friend's story is not something he can decide entirely on his own for his customers (though there are other complications in real life)
  - lrvick 2y ago
    Lack of signing on extensions makes it really easy for pentesters and blackhats to trick people into installing malicious versions of password manager plugins.
umvi 2y ago
> Does everything need to be signed? Use a tool to much and you end up becoming it's slave. In a trusted society full of honest people, no. In an untrusted society with dishonest people, the amount of resources (money, time, cpu, memory) required to protect yourself from abusers will only ever keep growing.
- megous 2y ago
  No. For SW distribution, yeah sign the software in transit to my disk or whatnot. That's good so I know who I'm getting it from. But requiring it for running the code, that's just anti-software-freedom behavior.
userbinator 2y ago
Or just patch the binary to remove the check, like what real users did when they encountered software they didn't like 100% the behaviour of, whether or not they had the source. (Yes, I know Firefox is open-source and you can theoretically compile it with the check removed, but that is going to take far more time and effort than finding and NOP'ing a jump.)
- SunlitCat 2y ago
  Yeah that one! I wonder when the first installer comes around patching known versions of Firefox to accept unsigned addons to dump their awesome toolbar onto the user. (Or just outright overwrite the users Firefox with an own version of Firefox, not including said check)
  - megous 2y ago
    It's (was) implemented in omni.ja. I was patching it in the past, until they started signing that too. Bleh.
- prerok 2y ago
  Yeah, and you have to do that for every update. No, thanks.
  - userbinator 2y ago
    You can do that automatically once you match the pattern, it's highly unlikely that the relevant code changes much.
Ayesh 2y ago
You can still run unsigned extensions on Firefox Developer Edition (FF beta with some developer tooling) with an about:config tweak.
- SunlitCat 2y ago
  The privacy notice[0] says: > In addition to the data collection described in this Privacy Notice, these versions by default may send certain types of web activity and crash data to Mozilla and in some cases to our partners. Is there any way to switch off that additional snooping around in stuff they shouldn't do because it's not their business what I do on the web with the only version allowing me to run unsigned addons? [0] https://www.mozilla.org/en-US/privacy/firefox/#pre-release https://www.mozilla.org/en-US/privacy/firefox/#pre-release
SunlitCat 2y ago
The required signing of addons (even local installed ones) is the main reason i won't use firefox anymore. And no, using a developer build (which might work or not) isn't fixing it. Even Edge allows me to run unsigned addons (even if it's with a warning, but for my use case I am fine with that one).
- UltraSane 2y ago
  just patch the binary to remove the check
  - Wowfunhappy 2y ago
    How?
    - jaharios 2y ago
      If you can't do that maybe you shouldn't install custom extensions. (Joking, but maybe mozilla thinks that way?) Anyway if you want to be able to run normal Firefox version (no beta,developer or esr) and want to install custom extensions there is an easier way but not well know. Firefox Unbranded https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... It works fine expect for the "ugly" icon, but it is possible to modify it.
      - Wowfunhappy 2y ago
        The biggest issue with the unbranded builds is that there are no automatic updates. Mind, it would probably be easier to write your own autoupdater than to runtime patch the signature check in official Firefox...
        jaharios 2y ago
        Actually I had set a policy to block automatic updates. Sometimes they break things, and having a profile backup before updating to roll back in case of breakage is a must. So it is a win win for me.

braiamp 2y ago

The reason for that is like you expect, someone abused that, and we do not have nice things anymore. That's the same reason why apt-get doesn't allow you to remove essential packages on Debian, without modifying a configuration file.

bravetraveler 2y ago
DNF has a similar mechanism, I appreciate it when poorly-written third party package manifests try to remove/deprecate more than they should
megous 2y ago
I can not run my own extension in Firefox by modifying a config file. It's not possible. Not even if I don't let dishonest actors anywhere near my Firefox install. I can murder some trees and poison the environment for all of us, to do pointless mutli-hour re-builds of Firefox for each release and point release to have it accept my add-ons, though. I've also never seen a reason, why I can't at least place my CA into Firefox /usr/lib/firefox folder or /etc/firefox and have it be respected. Or just place local extensions there and have firefox not require signatures for them, because there's no way these can be installed accidentally from web by clicking some link. And if someone can trick me into modifying /usr/lib, they can just trick me into replacing Firefox completly with their malwared build, so signing will not save me anyway.
- reubenmorais 2y ago
  > And if someone can trick me into modifying /usr/lib, they can just trick me into replacing Firefox completly with their malwared build, so signing will not save me anyway. As you said yourself, that's a much bigger hassle and cost. In other words, it's an effective deterrent. Writing to a user owned file is a very low bar for allowing privileged code execution in the browser. A long time ago browsers used to be infested with all kinds of toolbars and extensions automatically installed by third party software, I for one am glad to not have to worry about that in my computer and on networks I manage or frequent.
  - SunlitCat 2y ago
    It's an effective deterrent to keep power user away from your software as well! So if that's what Mozilla wants, they have their mission accomplished!
    - reubenmorais 2y ago
      A power user only needs to RTFD: https://wiki.mozilla.org/Add-ons/Extension_Signing#FAQ https://wiki.mozilla.org/Add-ons/Extension_Signing#FAQ
      - SunlitCat 2y ago
        Yeah...no. Only preview versions and developer versions can run unsigned addons. Both coming with their own set of reasons why you shouldn't use them as your daily browser.
        megous 2y ago
        And ESR, but that may not be normally distributed in Linux distros. It's not in Arch Linux. There's no hassle free solution. Only way to run your own code on normal branded Firefox release is to rely on third party signed extensions (eg. Violentmonkey), but that's not really hassle free either if you have 10s of userscripts and multiple browser profiles, and you have to trust some third-party to not go rogue. I got pretty terrible malware from mozilla add-on store in the past.
eadmund 2y ago
Honestly, that trade-off is not worth it, particularly with browsers. People who do ignorant things are ignorant (note that I did not say stupid: they may be quite intelligent in other areas of life). Tools should do what their owners direct them to do, even if it is a mistake. With apt, there is a bit of method to the madness: if one imagines that apt’s job is to do the thing the user requested and then deliver a correct system, then clearly essential packages can’t be removed. But there is not a reason to prevent the user of the software from using the software in the way he wishes on his own machine.
- lrvick 2y ago
  Advanced users can modify the source code to disable things that get in their way. Anyone not capable of that is not capable of knowing when it is safe to turn off safety defaults. Chromebooks at least get this one thing right. You can disable firmware signing, but only if you are comfortable taking the laptop apart to remove a magic write protection screw. That is something a scammer cannot easily convince a grandma to do.
  - toast0 2y ago
    I think chromebooks have moved away from screws to special key combinations for the most part. The screw is a good idea, but having to take apart the whole thing to get to the screw is a bit much.
  - eadmund 2y ago
    > Advanced users can modify the source code to disable things that get in their way. Anyone not capable of that is not capable of knowing when it is safe to turn off safety defaults. Modifying a morass of C++ source code is not nearly the same thing as writing an extension in Javascript. Mozilla is just fundamentally in the wrong here.
solarkraft 2y ago
The biggest browser by far, Chrome, can somehow afford allowing people to install unsigned extensions, so Firefox ought to be able to as well.
- sameerds 2y ago
  A close friend who is a professional has been losing customers because he was too careful and wanted only the most reliable thing for every customer. Customers drifted away, and business dwindled. Our guess is that word-of-mouth publicity stopped because "he takes too much time to get anything done". Things have started improving ever since he pulled back his quality slightly, thinking that if say a "small N" out of 100 customers are dissatisfied, at least the remaining will retain business. Is that what is ailing Firefox? I mean is Firefox losing because it tries to be safest and the best for every user, while Chrome just carries on with basic safety and nothing more? [EDIT: Clarified the question.]
  - ttoinou 2y ago
    Good point, maybe it comes from who's paying for the browser, hence how companies behind browsers are incentivized. Google gets money from advertiser and Mozilla from Google and users donations
  - eviks 2y ago
    Given the fact that Firefox was ailing long before mandatory signing, this seems like a clear no? Besides, this isn't "safest and best for every user", just like the quality vs speed tradeoff in your friend's story is not something he can decide entirely on his own for his customers (though there are other complications in real life)
- lrvick 2y ago
  Lack of signing on extensions makes it really easy for pentesters and blackhats to trick people into installing malicious versions of password manager plugins.

umvi 2y ago

> Does everything need to be signed? Use a tool to much and you end up becoming it's slave. In a trusted society full of honest people, no. In an untrusted society with dishonest people, the amount of resources (money, time, cpu, memory) required to protect yourself from abusers will only ever keep growing.

megous 2y ago
No. For SW distribution, yeah sign the software in transit to my disk or whatnot. That's good so I know who I'm getting it from. But requiring it for running the code, that's just anti-software-freedom behavior.

userbinator 2y ago

Or just patch the binary to remove the check, like what real users did when they encountered software they didn't like 100% the behaviour of, whether or not they had the source. (Yes, I know Firefox is open-source and you can theoretically compile it with the check removed, but that is going to take far more time and effort than finding and NOP'ing a jump.)

SunlitCat 2y ago
Yeah that one! I wonder when the first installer comes around patching known versions of Firefox to accept unsigned addons to dump their awesome toolbar onto the user. (Or just outright overwrite the users Firefox with an own version of Firefox, not including said check)
- megous 2y ago
  It's (was) implemented in omni.ja. I was patching it in the past, until they started signing that too. Bleh.
prerok 2y ago
Yeah, and you have to do that for every update. No, thanks.
- userbinator 2y ago
  You can do that automatically once you match the pattern, it's highly unlikely that the relevant code changes much.

Ayesh 2y ago

You can still run unsigned extensions on Firefox Developer Edition (FF beta with some developer tooling) with an about:config tweak.

SunlitCat 2y ago
The privacy notice[0] says: > In addition to the data collection described in this Privacy Notice, these versions by default may send certain types of web activity and crash data to Mozilla and in some cases to our partners. Is there any way to switch off that additional snooping around in stuff they shouldn't do because it's not their business what I do on the web with the only version allowing me to run unsigned addons? [0] https://www.mozilla.org/en-US/privacy/firefox/#pre-release https://www.mozilla.org/en-US/privacy/firefox/#pre-release

SunlitCat 2y ago

The required signing of addons (even local installed ones) is the main reason i won't use firefox anymore. And no, using a developer build (which might work or not) isn't fixing it. Even Edge allows me to run unsigned addons (even if it's with a warning, but for my use case I am fine with that one).

UltraSane 2y ago
just patch the binary to remove the check
- Wowfunhappy 2y ago
  How?
  - jaharios 2y ago
    If you can't do that maybe you shouldn't install custom extensions. (Joking, but maybe mozilla thinks that way?) Anyway if you want to be able to run normal Firefox version (no beta,developer or esr) and want to install custom extensions there is an easier way but not well know. Firefox Unbranded https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... It works fine expect for the "ugly" icon, but it is possible to modify it.
    - Wowfunhappy 2y ago
      The biggest issue with the unbranded builds is that there are no automatic updates. Mind, it would probably be easier to write your own autoupdater than to runtime patch the signature check in official Firefox...
      - jaharios 2y ago
        Actually I had set a policy to block automatic updates. Sometimes they break things, and having a profile backup before updating to roll back in case of breakage is a must. So it is a win win for me.