Hacker News Reader

Comment by Manishearth | Hacker News Reader

Not WebExtensions (which are the only kind of extension allowed on Firefox 57+ unless you change another pref).

I mean, Firefox even has a `security.turn_off_all_security_so_that_viruses_can_take_over_this_computer` pref (used in testing; you won't see it in about:config but IIRC you can manually add it. Don't.). Prefs that break security are not new :)

View on HN

Oh, really? I hope not in production builds, at least.

Defense in depth concept is not new either.

You also need an environment variable to be set for it to work.

But yes, it seems to be something you can flip in production. The argument being that if you're in a position to flip prefs you already can break security in a million ways. It's not something you can accidentally flip either.

(The pref doesn't actually "let viruses take over the computer", it just turns off all the security checks)

I feel like having a global switch for all security checks is already not a good idea.

It's unlikely to be abused by am attacker, if it requires starting Firefox with a certain environment variable. Chrome has the same thing with a command line switch.

Useful for some internal unit/integration tests for release and test builds, but really dangerous when pointed to the web.

Actually, "all the security checks" is inaccurate; it seems to enable certain special powers in JS. It turns off one security measure. These special powers seem to be enough to compromise other stuff; but again, if you're in a position to flip that switch you already can compromise other stuff.

It doesn't even turn off "all the security checks". It does make it so that certain APIs that let you do all sorts of stuff web content can't normally do are exposed.

Reply on news.ycombinator.com