Comment by idoubtit | Hacker News Reader

Comment by idoubtit | Hacker News Reader

In my opinion, Firefox imposes complex constraints on casual developers, and web-ext is part of it.

I have a few web extensions I wrote in order to customize a few web sites (automate tasks, alter display, etc). After a Firefox update, they were not allowed anymore, because they're not signed. The extensions page cannot load local extensions. Then I discovered the secret debug-extensions page of Firefox where I could load them.

Unfortunately, Firefox removes local extension when it closes. I had the choice between loading each local extension after launching a new Firefox, which mean a dozen of clicks, or installing web-ext in order to sign my extensions, and sign them again after each change (no idea if there were extra actions needed in the process, like manual reload). I opted for a much simple option: with Chromium-based browsers, you can enable the extension-developer mode, and then you're allowed to load local extensions from the normal extensions page. Extensions are kept across restarts.

I had the same issue but i solved it by using Firefox Developer edition instead which allows you to install unsigned extensions. This allowed me to use my Firefox profile (by manually copying the files over the existing profile files) which i have going back several years now.

If that ever changes i'll look into making my own Firefox binaries or whatever that have this check removed.

Unbranded stable (and beta) builds also allows disabling the signature check. There are plenty of options, just not in the official stable builds.

And the long-term support (ESR) version as well, if I remember correctly.

That makes things even easier then :-P

I think the argument is that if you’re knowledgeable enough to write an extension you can switch to the “I know what I’m doing version” and let everyone else reap the benefits of malware protection.

Does the unbranded stable build have automatic updates yet? Last time I checked (which was quite a while ago) it didn't, which made using it day-to-day seem like a bad idea. I'd totally switch to it if I can just use it normally.

What is up with this "Developer edition", "Unbranded stable", and God knows what else?

Developer edition: https://www.mozilla.org/en-US/firefox/developer/

This updates frequently since it is basically Firefox beta (though in practice i never had any issue). Note that this has telemetry enabled by default so you may want to disable it via the options.

Unbranded stable: https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded...

The unbranded stable isn't updated automatically so you'll need to check for new versions yourself (shouldn't be too hard to automate it with a python script or whatever that runs via cronjob or windows task scheduler and notifies you for new versions).

They don't document it well but they will sign pretty much anything over the web so long as you're not distributing it on add-ons.mozilla.org (AMO). You don't have to use web-ext.

There isn't even a manual review gate for AMO releases after the first one (but it can happen after that fact).

I find Mozilla's policies friendlier than Google's but this is the first I've heard of "extension developer mode" - will have to look into that as my extension is cross browser.

You can still use firefox autoconfig scripts to do a lot of things that they locked down(like using old XUL apis) https://support.mozilla.org/en-US/kb/customizing-firefox-usi...

It might be a bit tiresome if you make regular changes but you can have mozilla sign your extension without having to wait for them to review or place it on AMO.

https://extensionworkshop.com/documentation/publish/signing-...

What is the signature good for if they hand it out without review? Might as well get rid of the requirement.

They get an archive of stuff they can (theoretically) ban if found to be malware. Which I guess (or rather I hope) spreads a bit of a chilling effect among potential malware writers.

Then there’s something to revoke if necessary.

If you only need to tweak websites, using a userscript manager is much more easier: https://addons.mozilla.org/en-US/android/addon/violentmonkey...

I feel you, while the debugging option is handy for development, it is annoying that you can't easily install the extension permanently.

The way I do it now is to package the extension as zip (no webext needed) with a custom manifest, which can be installed by setting xpinstall.signatures.required to false in the about:config page.

On the manifest side, you just need to include this snippet:

  "browser_specific_settings": {
    "gecko": {
      "id": "example@gmail.com"
    }
  }

At least until 82 I (have to try if it still works), I used:

about:config xpinstall.signatures.required -> false

    zip -0 mywebext.xpi manifest.json *.js *.png *.html

about:addons -> install xpi

That worked for me only after including this snippet on the manifest:

  "browser_specific_settings": {
    "gecko": {
      "id": "example@gmail.com"
    }
  }

you can sign up for a free account on mozilla's site to sign personal extensions without any oversight as long as you don't select the option to list it on the marketplace. (even that is free but it requires a bit more review on the part of mozilla)

Reply on news.ycombinator.com