It depends on the version most release builds of Firefox require addons to be signed by Mozilla with the exception on Linux and developer versions. You can also change this by compiling yourself.

While I was initially pretty shocked that Mozilla would make a walled-garden move like this, doing it on the mainline release (for a primarily non-technical audience) and not holding the same requirement on dev and nightly builds actually feels like an appropriate balance, if that is indeed accurate.

Probably near 100% of Tridactyl users would be comfortable on at least the dev version of FF; it may be that an appropriate remediation would be to offer the `fixamo` functionality on an unsigned extension release only.

Vengefulduck's description is accurate:

1. Signing is required via a compile-time flag for official builds of Firefox and Firefox Beta.

2. Signing is optional in other builds of Firefox (Unbranded, Developer Edition, and Nightly), and follows the `xpinstall.signatures.required` user preference.

3. On Linux, add-ons installed in `/usr/{lib,share}/mozilla/extensions` are exempt from signing.

4. Add-ons manually loaded via "Load Temporary Add-on" in about:debugging are also exempt from signing.

It's accurate. Mozilla's intention was that Firefox couldn't be exploited by malware installing dodgy extensions, thus they want most people's installs of Firefox to reject unsigned extensions. But people who know what they're doing are free to download unsigned unbranded builds.

FWIW, I tried the dev edition (which is essentially Firefox beta) but I stopped using it as I kept running into bugs. A release that wasn't more buggy but allowed unsigned extensions would be nice.

I have been using exclusively dev and nightly for at least two years, and have only very occasionally run into issues. Of course, my usage is pretty typical web browsing, outside of using the dev tools.

It’s been long enough now that the normal colorful Firefox logo seems weird.

I wrote this to help with that exact same problem: https://github.com/A1kmm/enable-unsigned-firefox-addons

There's a built-in extension blocklist which also gets updated remotely.

https://hg.mozilla.org/mozilla-central/file/tip/browser/app/...

More on the policy for said blocklist: https://wiki.mozilla.org/Blocklisting (2008-11) https://support.mozilla.org/en-US/kb/add-ons-cause-issues-ar... (2012) https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/AMO... (2019)

The expansion from "we block malicious add-on versions" to "we block add-ons with known stability or security issues" to "we err on the side of security" does not bode well for the future of hacking cool add-ons.

What about a fork that only differs in allowing a second more permissive addon store.

Settings change over time and maintaing any fork is hard. Maintaining a fork of a modern browser is a sisyphian task. Even compiling it is no joke.

This is more what I’m concerned about. Does this only affect mainline FF or dev/nightly as well?

Yes. All extensions have to be signed by Mozilla, even if they're distributed outside their directory. The only way would be able to install it is by downloading an unzipped version and sideloading it. However, it will be removed if you restart firefox, and you will have to re-add it.