Mozilla is, to some extend understandably, concerned with the image of Firefox and patrolling what Addons are available in the store is part of that. Apple does the very same thing.
This is a non-sequitur. Reviewing things on their addon store has nothing to do with requiring a mozilla signature for sideloading.
One is happening on their property. The other is happening on the user's property. They also want to exert control over the latter, which is causing these problems.
It's a big annoyance for me too, because I use private extensions extensively for some business stuff (used by the users here), but had to switch to a different mechanism (because I don't want to deal with verification). It sucks for me, but I totally understand why they are doing it.
And the decision to not even let users add additional signing root keys is yet another axis on the decision space that was totally neglected.
Until you have different access levels and can both restrict users/programs from running at the base level required to do this, and condition users to recognize when increased access is being requested, I don't see this problem going away. Windows UAC is basically what we're talking about, and it still took years to users to understand it and not just always allow it (if that's even true!), and that's a system shared over all of windows.
I think the only sane way to accomplish this that worked for users and didn't cause enterprise admins to totally shun Firefox would be to piggy back on Windows' certificate store and register certificate for Firefox use only (I assume this is possible, I'm pretty sure you can do this for app-to-app communication such as MSSQL encrypted connections), but then you have to make sure you also handle the mechanisms to do the same in Linux and OS X, and now we're seeing it's a much more complex undertaking.
Protecting users from their own stupidity is a tough and mostly unsolved problem. Punting and eating their own resources to provide the safest solution they can, even if it's annoying for a more technically literate subset of users, is a solution I can understand and respect, even if it's problematic for me, because it's putting safety and security the majority of users over a simple solution that would be worse overall.
And I really dislike the "can be socially engineered around" buldgeon. If taken to its final conclusion you would have to lock-down systems and give users no freedoms at all because they could be convinced to do something bad with enough effort.
And yet you don't take the "freedom" argument to its final conclusion, which is that you must grant Freedom -1. That's the freedom for anyone, anywhere, to run any software on your hardware, at any time and for any purpose.
And this is only half-joking: all access restrictions, even ones as basic as filesystem permissions, impinge on freedom in some fashion. You can work around them, of course, but you can work around Firefox's extension signing (and Apple's app signing, and lots and lots of other systems that people insist are objectively reducing "freedom"). Which means that to be consistent, you either have to be against even those basic access-control mechanisms, or you have to compromise on absolute "freedom" and begin arguing about how difficult or complex a workaround can be before you personally would rule out allowing a system to require it.
If you don't like that, you can use the unbranded version of firefox or the dev edition.
This was a change introduced in ~August 2016, to ignore your preferences on that setting.
(As you note in the sibling thread, you can get it in a special development version, but that still contradicts your claim that you can toggle something to allow it.)
2. You have the set of people who can compile the code from source and who want to get outside of the wall.
3. You have the set of people who want to get out of the wall but don’t have the technical expertise to know the dangers of doing so.
4. You have people who have the technical expertise to know the dangers but not the technical expertise to compile code.
I think people in group 4 should learn how to be in group 2, because we have almost four decades worth of evidence to know how badly people in group 3 can do.
Edit: changed group 2 to group 3 in the last sentence.
And I don’t think expecting the user to personally recompile for every update is reasonable, especially if you claim to let users gain control of their machines again.
Googlers working on Chromium dev get maxed-out machines for this reason.
I’m all for platforms being in a wall gardener by default where you have to jump through a few hoops to unlock an “advanced mode”.
And signing up for WDN (Windows Developer Network?) hopefully you would get signed drivers.
You can’t imagine the number of times my mom has done the perfectly reasonable thing of searching for Windows printer drivers on Google and ended up installing crapware from a third party site instead of getting the official driver. Signing requirements from MS would hopefully alleviate that and let advanced users try to figure out how to load unsigned drivers.
(Also tangentially, why are printer drivers still a thing on Windows anyway? Anyone who connects a Mac, iPad, or iPhone to my home network - if I give them access to the non-guest network - automatically can print.)
I'm not dismissing people who aren't as capable as me either, I've mentioned alternative approaches and I'm getting tired of having to repeat "there is the dev and nightly edition" to the same 5 people over and over again.
Mozilla is making tradeoffs in protecting the average user and giving the power users a little bit less freedom unless they use an edition of firefox intended for power users and developers. Simple as that.
You can't live in the modern world and expect all choices to be handed down without consequences and tradeoffs.
The average user cannot be trusted with full control of their machine and it's fairly reasonable to say that power users need to take the extra steps to, for example, install a power user edition of firefox.
I'm asking for: "If the user goes into a deep part of the obscure developer options and bypasses the warnings about unsigned addons, and then uses a non-obvious but documented process for side-loading, something virus peddlers can't really walk users through, then Firefox should honor that while explicitly displaying the list of unsigned addons the users added."
>I'm not dismissing people who aren't as capable as me either, I've mentioned alternative approaches and I'm getting tired of having to repeat "there is the dev and nightly edition" to the same 5 people over and over again.
And I and others have explained how those involve unacceptable tradeoffs and run directly contrary to "give users back control over their machines" ethos, though not, of course, to your extremely limited version of the ethos.
Any such process would have to be difficult for external programs. As it stands, the best way to get verification of such a setting is through the built in binary verification that firefox does, which require that any application needs to reverse engineer and patch the binary to install it's own addons.
Your process requires editing the about:config values, which is possible for an external application and installing an addon, which copies it into a specific folder and is also possible for an external application. We know this is possible because this is what other applications did to install their shitty toolbars.
>And I and others have explained how those involve unacceptable tradeoffs and run directly contrary to "give users back control over their machines" ethos, though not, of course, to your extremely limited version of the ethos.
It seems to me that further discussion is unnecessary considering you continue to ignore significant portions of my comments.
Why? If the user already has a malicious 'external application' running on their system with sufficient privileges to do any of this, then they're already screwed, and they have bigger problems to worry about than malicious WebExtensions.
More generally, I don't think we should hold applications responsible for the security or behaviour of parts of the software/hardware stack at equal or higher privilege level to them, including other applications. Mostly because, well, they can't do anything truly effective in that regard.
I see you're worried about average users unknowingly installing random malicious crap, and I've seen a lot of that myself. I think the way forward is pretty much what is being done on mobile platforms currently: universally applied application sandboxing, usage of existing fine-grained access control models (and also the development of ones that are saner to use), and better communication to the user about what their applications are doing and what the permissions they are requesting actually mean. Yes, it's still a clusterfuck, but it's an improvement.
A security model involving applications in an arms-war with one another, using increasingly byzantine restictions in an attempt to prevent external manipulation, feels less like something I would want any part of, and more like something out of a dystopian sci-fi novel.
: Although I think Google went too far on the "lock things down completely" side of things when they made it outright impossible to, say, use rsync to backup or sync the entire contents of a phone's sd card to/from the network
Most users, ie, the average user plus a significant amount, don't really care that they can't install random addons from outside the addon store.
Mozilla wants their branded Firefox to be something the user can trust and that means controlling what code with elevated privileges (ie, Addons) can run in the browser.
edit: It should be mentioned that in response to the first question; Firefox performs some binary verification and won't run or attempt to repair if it detects tampering.
It's a really long-winded way of saying "we know better, you cannot be trusted, freedom is slavery".
The correct solution is to remove malware, not to play games with it that require freedom-reducing gambits.
I think it's a bit unfair to quote Orwell when the overall goal is to prevent the user from hurting themselves, not brainwashing them into thinking they don't need unsigned addons. If they need those there is the developer edition, which is officially supported by mozilla and allows installing any addon you like.
The default installs that most users will see simply have a different default setting. If you don't like that you can choose another edition or compile Firefox yourself.
As my dear old mom used to say, 'if everyone else were jumping off a bridge, would you?' The fact that Apple constrain their users doesn't justify Mozilla doing the same.
My browser belongs to me, not to Mozilla and not to anyone else: I should be able to load any extension into it that I wish to, just as I should be able to load any program onto my phone or install any root cert in my operating system.
Mozilla does claim to live up to that standard.
[1] This isn't to say they're wrong; there are legit reasons to want a device with good defaults that are hard to bypass.
Apple constraints their users for certain reasons which they believe are good for the user (with some negative side effects that Apple also likes). Mozilla likely has a similar motive; doing good for their users.
It doesn't mean every user will be happy with that, the average user will however be better off. The non-average user can then install the developer or nightly edition of firefox or even compile it themselves too get unsigned addongs if they so choose. Choosing the branded release branch of firefox means that Mozilla wants to keep you safe to some extend. This means not allowing third parties to install arbitrary addons into your browser, for example. Users rarely know what they want or if they do, they go about it in destructive ways.
Install the developer edition and you get your "I want to be able to load any extension".
I understand that Apple does everything in its power to make the life of developers miserable (such as requiring a Mac to be used for iOS development), but Mozilla were supposed to be the good guys on the web.
Apple's primary aim by limiting the access to the store isn't to make devs miserable, it's to have users trust the app store.
Mozilla's aim is (likely) the same. If a user finds an addon in Mozilla's addon store, then Mozilla wants the user to fully trust that this addon will not violate their privacy in unexpected ways or install malware on their computer or otherwise interfere with them.
Similarly, Apple spends a lot of money on making sure the PR image of the app store is clean. People should be able to fully trust Apple's app store, in Apple's opinion.
That doesn't mean there won't be addons you don't like, it just means that malicious behavior is not allowed. If the user doesn't like it they can remove it without consequence.
They still won't let me install it.
https://blog.mozilla.org/addons/2016/07/29/extension-signing...
(Good luck compiling it yourself.)
I'm currently running the branded release but I could pick unbranded, beta, dev or nightly editions of Firefox if I wanted. It's not hard to automate and especially with the unbranded version you have permission to distribute the binary that results, a permission you don't have with the branded edition.
You can also use the Nightly or Developer Edition of Firefox as well.
And do you plan to set that all up in the middle of your workday when a forced update disables your extensions?
Plus, there is more ways than developing FF addons to get into coding that Mozilla wants to stimulate, developing the browser itself or websites is also an alternate goal you can join in addition to trying out making your own addons.
Mozilla focuses on maximizing the user's freedom to browser the web without being hindered by harmful addons.
And at the end of the day, Firefox is a Mozilla brand, using the Firefox browser associated with their Brand means to some extend that Mozilla will want to ensure that the average user has a certain experience with that brand. The average user is perfectly fine not installing unsigned addons, which is arguably something the more advanced and above average user might want, who has the full freedom to use a edition of the browser that is explicitly marketed to them, no?
Nothing prevents me from compiling my own binaries and running them on my Mac.
But the issue here (AFAICT) is that Mozilla won't even let you sideload your own stuff on your browser. This is horribly broken.
There's no way to allow that that doesn't also allow crapware / malware installers from injecting stuff into Firefox.
But it certainly guarantees there won't be any apps Apple doesn't like and haven't paid the appropriate fee.
It's incredibly naive to think the primary reason for Apple is trust and security. At least as far as their mobile ecosystem is concerned, their control over what the user can run is a major revenue source.
I'm not saying Apple's intent is pure but there is a primary driving factor behind it, that to my knowledge, seems fairly pro-consumer. Doesn't mean it has other, anti-consumer motivations.
It really isn't. It's to prop up their own services through anti-competitive blocking, to maintain a level of terrifying censorship, and to rent seek on what remains.
It's still bad overall though.
Both points are true and a problem but it's distracting from what this is about, no?
These are Apple taking aggressive measures toward developers. Squeezing them and potentially blocking them from perfectly legitimate apps.
It still means you can separate the good ideas that apple has from the bad ideas. Not everything Apple does is inherently bad or evil because they do some evil or bad things, no?
And this is simply extracting the good part of apple's store policy; patrolling and checking apps so that users can trust what is in the store.
Still costs more than any other development. Where'd you get your's second hand?
All XCode projects are automatically code signed on every build. If you have a developer membership with Apple, it uses a certificate issued by Apple. If not, it's just a locally-generated certificate.
If you use make or call Clang directly, obviously there is no signing process, but there is a command-line tool that you can use and integrate into your non-Xcode build process just fine.
> Please don't impute astroturfing or shillage. That degrades discussion and is usually mistaken. If you're worried about it, email us and we'll look at the data.
The last time I did this it took so long I was able to write my own HTML parser while I was waiting (and I had never written a parser for a context free language before.)
If interested check this plugin out:
https://addons.mozilla.org/en-GB/firefox/addon/multi-account...
1. https://www.howtogeek.com/335712/update-why-you-shouldnt-use...
I wrote this Hitler parody about it: https://www.youtube.com/watch?v=taGARf8K5J8
Text version: officers tell Hitler that he has to upgrade FF because of bugs but warn it breaks his extension again. He dismisses the importance until they break the news he can't install the recompiled extension even if he says it's okay in about::config. Hitler goes ballistic about how that defeats FF's mission to give control back to users.
Climax: "If every tweak must be personally approved by Mozilla employees, why not just shrink-wrap the browser and make me buy it from Microsoft at Best Buy?"
Epilogue (real-life): Mozilla has now broken extensions so badly that you can't recover some of Pentadactyl's functionality, like customizing key commands. (At least, they won't take effect while on a tab until that tab's JS has loaded. Seriously?)
But hey, at least I get Looking Glass forced on me with a cryptic message that makes me think I've been hacked. That's worth the tradeoff, right?
I'm really disappointed at Mozilla regarding this. I recently wanted to do some Firefox customization for my own private use (not even an extension, I just wanted to have some visual indication of which Firefox windows belong to which profile). I was surprised to find out that even just a header .png in a theme can't be loaded locally but must be on-line and vetted by Mozilla. Utter craziness.