Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #29853

FYI: Mandatory extension signing in Firefox

Show all headers | View raw

In case somebody missed the announcement:
https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/

Summary: starting with Firefox 46 (two versions from now), all
extensions will have to be signed by Mozilla, through addons.mozilla.org
(AMO). There will be no user override to allow the installation of
unsigned extensions, with the following exceptions:

1) running a test release of FF (Nightly, Aurory, Beta)
2) running an extended support release (ESR) - for now
3) running an unbranded version that has been modified to disable
   this feature and re-enable the relevant setting in about:config

Users of the standard ("release" channel) version have no way of
circumventing the restriction.

The primary reason for the change is that unwary users may download and
install malware, which then adds extensions to Firefox and changes
settings (start page, etc). This is currently particularly easy with
Firefox, since most config files are just text or structured database files.

To get an extension signed, you need an AMO account and submit your
extension for automated checking. If the automatic validation fails, you
can request manual validation.


~~~~~ end of FYI, the following is my interpretation ~~~~~


There has been a lot of debate about this, for example in this thread:
https://groups.google.com/forum/#!topic/mozilla.addons.user-experience/slaKs943n4c[1-25]

Personally, I'm very disappointed that they're actually going through
with this, after all the negative feedback. They acknowledge that most
malware installers run with administrator privileges on Windows, and
that in this scenario there's nothing at all that can prevent the
compromise of installed software, but they still want to make it "harder
to exploit".

There have been numerous complaints and counter-arguments:

- You can no longer write and run an extension locally.

- You can no longer simply share an xpi with friends or coworkers.

- If you rely on beta testers for your extension, they can no longer
  run an unreleased extension.

- It doesn't solve the problem: if the system has been compromised
  that badly, it cannot be protected by requiring signed extensions.

- The requirement for external validation and signing is particularly
  troublesome in corporate environments, where the extension code may
  be proprietary or contain confidential information. Not all users in
  such environments will run the ESR version.

- Mandatory external signing (with an arbitrary delay) is hard to
  integrate in automated build systems.

- Extensions like HTML Validator release pre-built versions for
  non-Windows platforms on their website instead of addons.mozilla.org.
  These builds are not signed nor will they be in the future.

Users can still use one of the alternative versions mentioned above, but
that's not always feasible:

- You can't just ask all of your beta testers to run an off-brand or
  experimental release.

- Experimental builds may be buggy and insecure.

- If you're writing an extension, but can only install it in
  non-standard FF versions, you cannot test it where it will actually
  be used.

- Non-standard versions often have no convenient upgrade methods.


As you can see, I'm not a fan of this development. IMHO, this is more
than just a small inconvenience for developers, for very little benefit.
I think Mozilla should take a good hard look at who is still using
Firefox in 2016, and WHY we're using it.
At least they currently have no plans for mandatory signing of user
scripts (GreaseMonkey).


I would be very interested in getting feedback from this group... Are
you affected by this in some way? What do you think about the problem
they're trying to solve? Do you think their solution is adequate?


- stefan

Back to comp.lang.javascript | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

FYI: Mandatory extension signing in Firefox Stefan Weiss <krewecherl@gmail.com> - 2016-03-08 02:46 +0100
  Re: FYI: Mandatory extension signing in Firefox Florian Weimer <fw@deneb.enyo.de> - 2016-03-08 08:45 +0100
  Re: FYI: Mandatory extension signing in Firefox Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-12 16:51 +0100

csiph-web