News for hackers. Stuff that matters.
Re:Update Regarding Add-Ons in Firefox by SiempreViernes on Saturday May 04, 2019 @12:52PM (#19827618)
So you are saying there should be no way for an installed addon to fail an integrity check?
Re:Update Regarding Add-Ons in Firefox by wool_gather on Saturday May 04, 2019 @12:57PM (#19827664)
I think Tharkun is saying that there should be a (reasonably accessible) way for a user to choose to override the check's failure. Which is not that far-fetched as a proposal.

It's a classic and ongoing debate of "who knows best?" -- the vendor, or the end user?

Re:Update Regarding Add-Ons in Firefox by yawaramin on Saturday May 04, 2019 @03:43PM (#19828800)
Non sequitur. An installed addon could be signed with a certificate. Mozilla can push out a revocation for that certificate if it deems it appropriate. The revocation can pop up a modal telling users it wants to disable the addon. The user can click 'Disable addon' or 'Ignore (dangerous)'.

This doesn't need to be done through a dead man's switch (expiring certificate) that someone will forget to renew.

Re:Update Regarding Add-Ons in Firefox by LifeLiverTransp on Saturday May 04, 2019 @01:06PM (#19827727)
Yes.. the choice should be taken to the user- and the users choice should trump them all.
Re:Update Regarding Add-Ons in Firefox by sgift on Saturday May 04, 2019 @01:32PM (#19827883)
If you want full user choice about this you can use nightly or use a community packaged version with the option to disable the checks enabled or compile it yourself and enable the flag. It's not impossible to do that.