Re:Update Regarding Add-Ons in Firefox
by SiempreViernes on Saturday May 04, 2019 @12:52PM
(#19827618)
So you are saying there should be no way for an installed addon to fail an integrity check?
[ Parent
| on HN ]
Re:Update Regarding Add-Ons in Firefox
by wool_gather on Saturday May 04, 2019 @12:57PM
(#19827664)
I think Tharkun is saying that there should be a (reasonably accessible) way for a user to choose to override the check's failure. Which is not that far-fetched as a proposal.
It's a classic and ongoing debate of "who knows best?" -- the vendor, or the end user?
Non sequitur. An installed addon could be signed with a certificate. Mozilla can push out a revocation for that certificate if it deems it appropriate. The revocation can pop up a modal telling users it wants to disable the addon. The user can click 'Disable addon' or 'Ignore (dangerous)'.
This doesn't need to be done through a dead man's switch (expiring certificate) that someone will forget to renew.
Re:Update Regarding Add-Ons in Firefox
by LifeLiverTransp on Saturday May 04, 2019 @01:06PM
(#19827727)
Yes.. the choice should be taken to the user- and the users choice should trump them all.
If you want full user choice about this you can use nightly or use a community packaged version with the option to disable the checks enabled or compile it yourself and enable the flag. It's not impossible to do that.