A big problem for a lot of Firefox users is addons that are side-loaded into a profile. Like when you download some junk and it comes with an installer that injects an addon into your profile. This is a good expose on what even a seemingly legitimate site like download.com does: http://www.howtogeek.com/198622/heres-what-happens-when-you-... (and several of the malware examples in that article are side-loaded addons).

Unfortunately hoops aren't enough to fix this problem, because hoops generally involve some flag that you've gone through the hoop, and the installer can easily fake that.

Couldn't those installers patch Firefox to remove the signing requirement? Or, if they don't get sufficient privileges to modify the executable, patch the user's Firefox process in memory?

Yeah, this might end up being just a salvo in a longer battle. But maybe part of the problem is that some of these malware authors are lying to themselves and believe they are just grayhat hackers, and once you start patching executables it becomes a bit clearer you are a blackhat. So far download.com isn't distributing actual rootkits. They could of course. And yet still they probably won't.

Relatedly I did notice when putting my own addon through the signing process that there was a checkbox specifically for sideloaded addons, with the implication that the checks would be even more stringent. I'm not sure if that's enforced or not, or how.

Chrome did a similar change which led to a pretty spectacular drop: http://blog.chromium.org/2015/05/continuing-to-protect-chrom...

How is that Mozilla’s problem? If you close all the “hoops” the rogue installer can just simply replace Firefox with its own build of “Firefox.”

I truly don’t understand why Mozilla is trying to do Microsoft’s job.

Except that's malicious to a much greater extent -- an extent that ought to catch the attention of anti-virus software makers.

I don’t see how antivirus software completely failing to protect its users from “easy” attacks (rogue extension drops) should inspire any confidence they can protect you from more sophisticated attacks. Oh yeah this gun is useless now, but wait till they roll in with tanks!

Never mind the entire idea of antivirus software is completely ridiculous from security PoV and basically a scam to have people pay for a false sense of security.

xpinstall.signatures.required should be the setting you're looking for.

That's the option I'm currently using and that Mozilla plans to remove in Firefox 42.

Could someone make an extension to re-enable this config option?

And... would Mozilla agree to sign it?

(Since, you know, the standard response over the years to users complaining about removed functionality in Firefox has been, "use an extension")

no, because then any malware would immediately install that extension first, and then flip the about:config bit on the filesystem, and then install their extension, and then you're right back where you were before signing.

I doubt an extension could do that since the signing mechanism needs to be secure, otherwise it would be pointless.

This option will be removed from about:config in Firefox 42.