<story><title>Firefox 42 will not allow unsigned extensions</title><url>https://wiki.mozilla.org/Addons/Extension_Signing</url></story><parent_chain><item><author>grincho</author><text>Hi, Mozilla developer here, speaking for only myself. I&amp;#x27;m not sure why we don&amp;#x27;t make this clearer on the wiki page, but I think the reason there&amp;#x27;s no override is that any malware installation routine would simply activate it and continue on its merry way. (Disclaimer: I didn&amp;#x27;t work on this feature and am going by recollection and my own logic.)&lt;p&gt;We see many copies of Firefox infested with rogue add-ons the user didn&amp;#x27;t ask for or isn&amp;#x27;t even aware of. Sometimes these add-ons even ship with big-name software, with no opt out or with the opt out squirreled away in some dark corner. Typically, they do one or more of the following: (1) spy on the user, (2) add affiliate codes for money, (3) cause performance problems and crashes.&lt;p&gt;The network is a pretty hostile place these days. It&amp;#x27;s no longer 14-year-olds playing around for fun; there are moneyed interests in the game. And the sorts of people who don&amp;#x27;t frequent HN are pretty much helpless and clueless in the perpetual tug of war between various companies and mafias. As a &amp;quot;user agent&amp;quot;, we have the opportunity defend users who lack the sophistication to root around and remove invasive software they didn&amp;#x27;t ask for.&lt;p&gt;Of course, if you&amp;#x27;re reading this, you&amp;#x27;re in a different category. You have a better idea which software to trust, and you know how to scour your machine if something gets past you. That&amp;#x27;s why nightlies and the Developer Edition let you do whatever you want: you aren&amp;#x27;t the ones who need hard-coded protections to shield you from pref-twiddling installers.&lt;p&gt;I hope that provides some needed context. Safe surfing, all!</text></item><item><author>nathanb</author><text>It&amp;#x27;s the &amp;quot;no override&amp;quot; part that concerns me.&lt;p&gt;I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example).&lt;p&gt;Occasionally a Firefox update breaks this extension. OK, fine, that&amp;#x27;s the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never catches the breakage. But that&amp;#x27;s a side rant....&lt;p&gt;There can be a decent turnaround lag (sometimes on the order of a few days) to get a new version of an extension reviewed by addons.mozilla.org. In the meantime, I have made a habit of building a new version of the extension and giving it to anyone who asks. Some people rely on it to use the web and can&amp;#x27;t wait for Mozilla to do their thing (another side rant: I once stupidly forgot to check in a key resource. I&amp;#x27;ve since changed my development process to keep this from happening again. But the non-functional extension that I pushed passed Mozilla&amp;#x27;s review just fine. Makes me wonder how much value the review process is really adding.)&lt;p&gt;If I want to be able to continue this process, I will need to sign the extension myself (and who knows what histrionics Firefox will throw if a user tries to replace an extension with one that has the same UUID but a different signature!)</text></item></parent_chain><comment><author>Arcsech</author><text>&amp;gt; We see many copies of Firefox infested with rogue add-ons the user didn&amp;#x27;t ask for or isn&amp;#x27;t even aware of.&lt;p&gt;Like Pocket or Hello?</text></comment>
<story><title>Firefox 42 will not allow unsigned extensions</title><url>https://wiki.mozilla.org/Addons/Extension_Signing</url></story><parent_chain><item><author>grincho</author><text>Hi, Mozilla developer here, speaking for only myself. I&amp;#x27;m not sure why we don&amp;#x27;t make this clearer on the wiki page, but I think the reason there&amp;#x27;s no override is that any malware installation routine would simply activate it and continue on its merry way. (Disclaimer: I didn&amp;#x27;t work on this feature and am going by recollection and my own logic.)&lt;p&gt;We see many copies of Firefox infested with rogue add-ons the user didn&amp;#x27;t ask for or isn&amp;#x27;t even aware of. Sometimes these add-ons even ship with big-name software, with no opt out or with the opt out squirreled away in some dark corner. Typically, they do one or more of the following: (1) spy on the user, (2) add affiliate codes for money, (3) cause performance problems and crashes.&lt;p&gt;The network is a pretty hostile place these days. It&amp;#x27;s no longer 14-year-olds playing around for fun; there are moneyed interests in the game. And the sorts of people who don&amp;#x27;t frequent HN are pretty much helpless and clueless in the perpetual tug of war between various companies and mafias. As a &amp;quot;user agent&amp;quot;, we have the opportunity defend users who lack the sophistication to root around and remove invasive software they didn&amp;#x27;t ask for.&lt;p&gt;Of course, if you&amp;#x27;re reading this, you&amp;#x27;re in a different category. You have a better idea which software to trust, and you know how to scour your machine if something gets past you. That&amp;#x27;s why nightlies and the Developer Edition let you do whatever you want: you aren&amp;#x27;t the ones who need hard-coded protections to shield you from pref-twiddling installers.&lt;p&gt;I hope that provides some needed context. Safe surfing, all!</text></item><item><author>nathanb</author><text>It&amp;#x27;s the &amp;quot;no override&amp;quot; part that concerns me.&lt;p&gt;I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example).&lt;p&gt;Occasionally a Firefox update breaks this extension. OK, fine, that&amp;#x27;s the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never catches the breakage. But that&amp;#x27;s a side rant....&lt;p&gt;There can be a decent turnaround lag (sometimes on the order of a few days) to get a new version of an extension reviewed by addons.mozilla.org. In the meantime, I have made a habit of building a new version of the extension and giving it to anyone who asks. Some people rely on it to use the web and can&amp;#x27;t wait for Mozilla to do their thing (another side rant: I once stupidly forgot to check in a key resource. I&amp;#x27;ve since changed my development process to keep this from happening again. But the non-functional extension that I pushed passed Mozilla&amp;#x27;s review just fine. Makes me wonder how much value the review process is really adding.)&lt;p&gt;If I want to be able to continue this process, I will need to sign the extension myself (and who knows what histrionics Firefox will throw if a user tries to replace an extension with one that has the same UUID but a different signature!)</text></item></parent_chain><comment><author>_lce0</author><text>&amp;gt; We see many copies of Firefox infested with rogue add-ons the user didn&amp;#x27;t ask for or isn&amp;#x27;t even aware of.&lt;p&gt;GoogleUpdate?&lt;p&gt;why Firefox could not remove these extension itself? I needed to remove some files from the harddisk --I doubt john.doe will be able to remove such evils&lt;p&gt;Please excuse the rant tone, these things make me feel my intimacy raped</text></comment>