Re:Update Regarding Add-Ons in Firefox
by firethief on Saturday May 04, 2019 @01:18PM
(#19827801)
The main trust check is at installation time, but it's possible for problems to be discovered later, and Mozilla needs to be able to do something about it. Certificate non-renewal is the only robust avenue of revocation.
[ Parent
| on HN ]
There's already an extension banlist.
See profile/blocklist-addons.json
Not sure how not renewing a certificate and letting everything get disabled is useful. It's only useful if cert key leaks.
> Mozilla needs to be able to do something about it.
No, they do not need to. They decided that they want to. Remember that there was a time before certificate signing.
And now the decision to be able protect those who install crapware is also harming those who never had those issues.
They should absolutely have asked extra permission to implement a system where they could choose to alter my browser install, in an unexpected way, at their behest without seeking further authorisation, not even a modal???
It's exceedingly poor ethics.