Re:Update Regarding Add-Ons in Firefox
by Tharkun on Saturday May 04, 2019 @12:48PM
(#19827591)
If you can disable all my addons by having a certificate expire, you can effectively remotely disable all my addons. And that's exactly what happened. The fact that this was (presumably?) not intentional is irrelevant. The switch may not be an actual switch, but it's there nevertheless. And it shouldn't be.
[ Parent
| on HN ]
Re:Update Regarding Add-Ons in Firefox
by SiempreViernes on Saturday May 04, 2019 @12:52PM
(#19827618)
So you are saying there should be no way for an installed addon to fail an integrity check?
Re:Update Regarding Add-Ons in Firefox
by wool_gather on Saturday May 04, 2019 @12:57PM
(#19827664)
I think Tharkun is saying that there should be a (reasonably accessible) way for a user to choose to override the check's failure. Which is not that far-fetched as a proposal.
It's a classic and ongoing debate of "who knows best?" -- the vendor, or the end user?
Non sequitur. An installed addon could be signed with a certificate. Mozilla can push out a revocation for that certificate if it deems it appropriate. The revocation can pop up a modal telling users it wants to disable the addon. The user can click 'Disable addon' or 'Ignore (dangerous)'.
This doesn't need to be done through a dead man's switch (expiring certificate) that someone will forget to renew.
Re:Update Regarding Add-Ons in Firefox
by LifeLiverTransp on Saturday May 04, 2019 @01:06PM
(#19827727)
Yes.. the choice should be taken to the user- and the users choice should trump them all.
If you want full user choice about this you can use nightly or use a community packaged version with the option to disable the checks enabled or compile it yourself and enable the flag. It's not impossible to do that.