All Tridactyl installations might get removed by Firefox on Aug 21

Re:All Tridactyl installations might get removed by Firefox ... by mechnesium on Friday August 16, 2019 @05:24PM (#20719847)

The fact that third-party addons can even touch sensitive settings in the user.js prefs is a massive security flaw in Mozilla's implementation of the WebExtensions API. Addons should be sandboxed/containerized or require privilege escalation before touching files on the disk.

[ Parent | on HN ]

Re:All Tridactyl installations might get removed by Firefox ... by Mathnerd314 on Friday August 16, 2019 @05:34PM (#20719947)

It uses native messaging with a Python script: https://github.com/tridactyl/tridactyl/blob/master/native/na...

I don't think anyone who uses Tridactyl is worried about its security, it has a permissions list 15+ lines long.

[ Parent | on HN ]

Re:All Tridactyl installations might get removed by Firefox ... by gruez on Friday August 16, 2019 @05:34PM (#20719942)

This. The whole point of this security feature is to prevent extensions from interfering with Mozilla pages. What's the point of this when addons can bypass turn it off themselves?

[ Parent | on HN ]

Re:All Tridactyl installations might get removed by Firefox ... by cmcaine on Friday August 16, 2019 @05:45PM (#20720014)

Only extensions that have a native messenger can do this (which requires users to accept a scary sounding permission and install a separate application on their computer)

[ Parent | on HN ]