Hacker News Reader

Comment by silverwind | Hacker News Reader

That's coming in 44 in 6 weeks:

> Firefox 44: Release and Beta versions of Firefox will not allow unsigned extensions to be installed, with no override.

View on HN

Sigh.

Why are they doing this? It's condescending and insulting. "No, you're too stupid to be allowed to install what you want to."

Firefox is changing this because malware injects itself into Firefox using this mechanism. Power users who really want to install unsigned addons can switch to the Developer Edition.

I have cleaned my share of malware infections and I can't think of one were the attack vector seemed to be FF.

Now we seem to be nerfing the beast because someone might do stupid things.

I worked in university IT for a year, focused on student's personal machines. A good majority of malware we experienced installed extensions and reconfigured browser preferences.

I understand why Mozilla and Google have done similar things to restrict extension installation, but can't help but think there has to be a better way for users who know what they're doing.

You may not have seen one yourself, but browser vendors have data on this: there is a lot of malware out there that infects browsers.

Browsers are putting a lot of effort into preventing this, they wouldn't do it if they didn't have clear information showing the problem was serious.

I don't doubt that malware adds browser extensions, but is that the initial infection vector or just installed later after the malware is already in place?

the problem with that is the developer edition is also firefox nightly. Power users don't always want the absolute latest :-P

Developer Edition is different than Nightly. They both do update about once a day, but far fewer changes land on Developer Edition so it should be more stable.

Yes, I think it was formerly called "aurora".

Malware. That's why.

As others point out, they want to combat malware. But they've botched the process and particularly the timeframe quite badly; they should have started by

1. Fixing the extension "code review" process, which is a mess. Make it be actually automatic 99% of the time and not a big hassle.

2. Implementing non-mandatory signing a long time ago and let that run for at least a year before making it mandatory. (The initial announcement that extension signing was going to happen was Feb 10 2015.)

3. Waiting for at least half a year after making signing mandatory to start even announcing "we will change the API and severely break all non-trivial extensions in the near future".

Right now, I think Firefox has set themselves up to decimate the number of extensions, by telling extension devs they have a mountain of work ahead of them for very little benefit. I can't imagine it will do anything but further reduce the number of users. Not sure what will come off it in the end. As a pentadactyl addict, I'm worried that I'll be on the next LTS release (without signing) for years to come. Either that, or we'll see a fork.

Won't the next LTS release require signing, as well as the regular version? And by LTS here you mean the ESR version, right?

Yes, they call it ESR, but did we really need Yet Another TLA?

As for requiring signing, from the moz wiki: "The current plan is to have ESR 45 work like 40-42, with a preference that can turn off [signing] enforcement."

Edit: source: https://wiki.mozilla.org/Add-ons/Extension_Signing

I have more faith in the AV package I use than in Mozilla's part-time coders.

The people producing my AV package do just that, 8 hours a day, all year long. How much time does Mozilla's AV coders have? How much practical experience?

IMHO, Mozilla's FireFox team should concentrate on making the browser work fast and smooth. Period. FireFox has been slowly deteriorating for years while they've diddled with cutesy GUI crap.

Too many spoons in the pot.

Full time coders

>1. Fixing the extension "code review" process, which is a mess. Make it be actually automatic 99% of the time and not a big hassle

Also read as "doing the literally impossible (but not really)".

http://danstillman.com/2015/11/23/firefox-extension-scanning...

From the blog post you linked, a quote which goes to show just how stupid Firefox devs are being over this:

""" It’s been a maddening discussion, with Mozilla folks repeatedly suggesting that Zotero — a leading research tool put out by a large public research university as a non-profit open-source project and recommended by nearly every university worldwide — will either turn rogue or become an attack vector if we’re allowed to continue releasing it unimpeded as we have for nine years. """

I've switched to Pale Moon, a fork that respects my ability to make my own decisions about whether something is dangerous or not. I hope they get all this stuff sorted out, FF used to be my favorite browser.

Is there any way for me to sign extensions myself and trust my own root? I trust Mozilla about as far as I can throw them.

How long until they withhold their signature from an extension which blocks ads from one of their funders, or which supports a political cause they dislike, or are pressured to dislike?

In fact, what assurance at all does Mozilla's signature give me? As far as I can tell, none whatsoever.

The same can be said about any other security measure.

It's to ensure other apps don't install add-ons.

But will this do anything to address the problem of companies buying existing signed extensions, and then updating them to include shady tracking, ad redirects, etc.?

Reply on news.ycombinator.com