Hacker News Reader

Comment by gdulli | Hacker News Reader

Has the release happened yet that removed the ability to use unsigned extensions? I think this version is no longer safe to upgrade to if you want to keep that ability. As I understand it the behavior can't be disabled with a setting.

View on HN

It will block unsigned extensions by default in 43, but you can disable it: set xpinstall.signatures.required to false in about:config. This option will be removed in 44. (https://wiki.mozilla.org/Add-ons/Extension_Signing#Timeline)

But what does this mean for my precious tree-style tabs?

This is answered in GP's link. You should read it.

"The Developer Edition and Nightly versions of Firefox will have a setting to disable signature enforcement. There will also be special unbranded versions of Release and Beta that will have this setting, so that add-on developers can work on their add-ons without having to sign every build."

While you can wait until it breaks and then switch to the developer version, it is just delay of execution.

For my main browser that has all the plugins I used to appreciate in Firefox I switched to Pale Moon [1]. On other machines I continue to use Firefox.

Very happy with Pale Moon, works perfect -including all my old plugins- and I'm no longer afraid that features I depend on will stop working because the mozilla dev's decided to try and change firefox into chrome.

[1] http://www.palemoon.org

Quick note: Pale Moon removed Tab Groups because it was unpopular. The add-on meant to replace it is hacky/buggy/fails to restore tabs. If your workflow depends heavily on tab groups, Pale Moon is not the answer.

If you don't care for tab groups - my experiences with Pale Moon were great! I can imagine it's remained as awesome since I stopped using it (which is when they removed tab groups...)

Also it's totally possible the add-on has been fixed. But I don't remember anyone maintaining it, it was just segmented away from the browser and made into an add-on without development/maintenance. It's possible that has changed and the above issue is no longer relevant.

Actually the ability to be able to continue to use tab groups was one of the main reasons I changed over to Pale Moon about a month ago. Firefox has plans to remove tab groups. [1] Haven't had any issue with it so far, but I might be using tab groups in another way as you or as you say they might have ironed out the issues you bumped into.

You are correct that tab groups is offered as an add-on. Had no problem installing it, it even kept all the tabs I had in tab groups in Firefox. For me the transition from Firefox to Pale Moon was very smooth.

[1] http://www.ghacks.net/2015/11/08/mozilla-to-remove-tab-group...

Are your tab groups remembered after a browser crash? YouTube has a tendency of crashing Firefox/FF forks (incl. Waterfox and Pale Moon). I'm forced to restart maybe once every other or every third week after YouTube hangs the browser. When this happens I lose all of my tabs which is completely unacceptable for me. Tabs were also lost when updating the browser which was the straw that broke the camel's back and caused me to ditch Pale Moon and return to Firefox.

If those two issues have been fixed I'd likely very quickly switch back to Pale Moon.

As an aside, I'm aware FF is removing them as well in the near future. I've already frozen myself on FF 40 for other reasons. Before anyone mentions - I'm aware of the potential security risks of doing so and have decided given my internet browsing habits it is very low risk. Low enough that I don't even consider publicly announcing my use of FF40 to be a significant security threat.

I've not had a browser crash in a long time.

But -if it helps- the tab groups are remembered after I kill firefox from Windows task manager.

Also no problem on updating Pale Moon. But I've got to admit that there was only one update since I switched over to Pale Moon.

The Tree Style Tab I have was installed via Mozilla's extension repository, which is automatically signed. It should™ continue working.

"Tab Tree"?

I'm talking about this extension:

https://addons.mozilla.org/en-US/firefox/addon/tree-style-ta...

That one gets disabled with the new update, I believe.

I don't think so, it's hosted on AMO, these addons get signed automatically.

I'm currently running Firefox 43 on Arch Linux:

    $ pacman -Q firefox
    firefox 43.0-1

with Tree Style Tab 0.16.something from AMO and have `xpinstall.signatures.required` set to `true` (the default, I haven't changed anything).

Hm. Seems to be signed under Linux, but not on Windows.

Why would you believe so?

That extension has been clearly signed.

That's coming in 44 in 6 weeks:

> Firefox 44: Release and Beta versions of Firefox will not allow unsigned extensions to be installed, with no override.

Sigh.

Why are they doing this? It's condescending and insulting. "No, you're too stupid to be allowed to install what you want to."

Firefox is changing this because malware injects itself into Firefox using this mechanism. Power users who really want to install unsigned addons can switch to the Developer Edition.

I have cleaned my share of malware infections and I can't think of one were the attack vector seemed to be FF.

Now we seem to be nerfing the beast because someone might do stupid things.

I worked in university IT for a year, focused on student's personal machines. A good majority of malware we experienced installed extensions and reconfigured browser preferences.

I understand why Mozilla and Google have done similar things to restrict extension installation, but can't help but think there has to be a better way for users who know what they're doing.

You may not have seen one yourself, but browser vendors have data on this: there is a lot of malware out there that infects browsers.

Browsers are putting a lot of effort into preventing this, they wouldn't do it if they didn't have clear information showing the problem was serious.

I don't doubt that malware adds browser extensions, but is that the initial infection vector or just installed later after the malware is already in place?

the problem with that is the developer edition is also firefox nightly. Power users don't always want the absolute latest :-P

Developer Edition is different than Nightly. They both do update about once a day, but far fewer changes land on Developer Edition so it should be more stable.

Yes, I think it was formerly called "aurora".

Malware. That's why.

As others point out, they want to combat malware. But they've botched the process and particularly the timeframe quite badly; they should have started by

1. Fixing the extension "code review" process, which is a mess. Make it be actually automatic 99% of the time and not a big hassle.

2. Implementing non-mandatory signing a long time ago and let that run for at least a year before making it mandatory. (The initial announcement that extension signing was going to happen was Feb 10 2015.)

3. Waiting for at least half a year after making signing mandatory to start even announcing "we will change the API and severely break all non-trivial extensions in the near future".

Right now, I think Firefox has set themselves up to decimate the number of extensions, by telling extension devs they have a mountain of work ahead of them for very little benefit. I can't imagine it will do anything but further reduce the number of users. Not sure what will come off it in the end. As a pentadactyl addict, I'm worried that I'll be on the next LTS release (without signing) for years to come. Either that, or we'll see a fork.

Won't the next LTS release require signing, as well as the regular version? And by LTS here you mean the ESR version, right?

Yes, they call it ESR, but did we really need Yet Another TLA?

As for requiring signing, from the moz wiki: "The current plan is to have ESR 45 work like 40-42, with a preference that can turn off [signing] enforcement."

Edit: source: https://wiki.mozilla.org/Add-ons/Extension_Signing

I have more faith in the AV package I use than in Mozilla's part-time coders.

The people producing my AV package do just that, 8 hours a day, all year long. How much time does Mozilla's AV coders have? How much practical experience?

IMHO, Mozilla's FireFox team should concentrate on making the browser work fast and smooth. Period. FireFox has been slowly deteriorating for years while they've diddled with cutesy GUI crap.

Too many spoons in the pot.

Full time coders

>1. Fixing the extension "code review" process, which is a mess. Make it be actually automatic 99% of the time and not a big hassle

Also read as "doing the literally impossible (but not really)".

http://danstillman.com/2015/11/23/firefox-extension-scanning...

From the blog post you linked, a quote which goes to show just how stupid Firefox devs are being over this:

""" It’s been a maddening discussion, with Mozilla folks repeatedly suggesting that Zotero — a leading research tool put out by a large public research university as a non-profit open-source project and recommended by nearly every university worldwide — will either turn rogue or become an attack vector if we’re allowed to continue releasing it unimpeded as we have for nine years. """

I've switched to Pale Moon, a fork that respects my ability to make my own decisions about whether something is dangerous or not. I hope they get all this stuff sorted out, FF used to be my favorite browser.

Is there any way for me to sign extensions myself and trust my own root? I trust Mozilla about as far as I can throw them.

How long until they withhold their signature from an extension which blocks ads from one of their funders, or which supports a political cause they dislike, or are pressured to dislike?

In fact, what assurance at all does Mozilla's signature give me? As far as I can tell, none whatsoever.

The same can be said about any other security measure.

It's to ensure other apps don't install add-ons.

But will this do anything to address the problem of companies buying existing signed extensions, and then updating them to include shady tracking, ad redirects, etc.?

Reply on news.ycombinator.com