Hacker News Reader

Comment by keypusher | Hacker News Reader

Disabling unsigned extensions without any opt-in is a terrible decision. Putting up barriers to entry for addon developers in a browser that survives primarily based on the addon ecosystem is suicidal. Addon developers do not want to run unstable alpha channel builds, they don't want to have to manage multiple profiles, they don't want to build Firefox from scratch because the version they need is not available via a package manager. I really don't care about the rest of these changes, but they need to rethink their stance on unsigned extensions.

View on HN

I agree.

One possible workaround would be to provide a way to add keys from which you would accept extensions. Then as part of the extension development process, you could sign your extension with your key when you are ready to install it.

If the issue Mozilla is really concerned about is security, this should be an acceptable solution.

I think you have a good idea, but

> If the issue Mozilla is really concerned about is security, this should be an acceptable solution.

I don't know what you're implying here. That they're not concerned about security? What are they concerned about?

No, indeed I do hope that security is the primary thing they are concerned about.

But it is possible they have other motivations (like control). I hope that is not the case, but I think it would be foolish to not even consider the possibility.

> One possible workaround would be to provide a way to add keys from which you would accept extensions.

Then malicious apps will just sideload new keys.

> a browser that survives primarily based on the addon ecosystem

Citation needed.

A lot of people in this very thread are complaining because the add-ons are the only reason they use Firefox in the first place. So basically, citing this thread.

> Addon developers do not want to run unstable alpha channel builds, they don't want to have to manage multiple profiles, they don't want to build Firefox from scratch because the version they need is not available via a package manager.

Why not use the stable versions which allow unsigned extensions?

>they don't want to build Firefox from scratch because the version they need is not available via a package manager

I really doubt Debian will flip the compile switch that completely prevents unsigned extensions on Iceweasel.

One of the maintainers already committed to flipping the switch on the mailing list. The reasoning given was that extension signing was a security feature and it is better to trust Mozilla than to trust an old add-on whose developer did not bother to update so that it could be signed.

>...than to trust an old add-on whose developer did not bother to update so that it could be signed.

Yea, those pesky deceased developers. When will they stop being so lazy and update their code?

I don't understand how technically savvy people are capable of reasoning around the walled garden approach. It isn't their place to tell me who I should trust.

Reply on news.ycombinator.com