Hacker News Reader

Comment by superkuh | Hacker News Reader

I understand why they are going walled garden. Non-technical users cannot be trusted to control their browser. But Mozilla should know if they do this then I, a technical user, won't use their browser.

I am not an extension developer but it's a rare month when I don't find myself popping open an .xpi to make changes to the JS and HTML for personal aesthetics; or bugs only I have. Temporarily loading extensions is not a solution. They say they'll be producing an "unbranded" non-walled garden version that for technical users but no such build has been revealed yet. And if they do make it the unbranded version won't be in my OS repos.

This walled garden, the addition of Adobe EME/DRM, the bundling of "Pocket", and the incoming drop of XUL based extensions are too much.

View on HN

While I would agree that these changes are unfortunate for this specific use case, I do believe there are at least two workarounds for you:

1) Creating an AMO account and running the command line "jpm sign" tool yourself. This requires a bit of overhead per each new addon you want to make modifications to, but the actual signing of unlisted addons (which is entirely automated) had been fast and mostly painless in my experience.

2) Using Firefox Aurora/Developer Edition as your main browser and relying on its automatic update mechanism.

What's going to prevent malware authors from making a bunch of AMO accounts and signing their malware if it's so easy and automated?

I think Mozilla can block the accounts and blocklist the add-ons.

(I do not work for Mozilla so this is speculation):

As far as I can tell, side loaded extensions require a full, non-automated, review http://i.imgur.com/r070Grv.png and it wouldn't surprise me if side-loaded extensions were the worst offenders.

Upon discovering a malicious extension, Mozilla could look through all extensions they've signed and blacklist (https://addons.mozilla.org/en-US/firefox/blocked/) all extensions with a similar signature similar to how some anti-malware databases work.

There is probably not all that much stopping you from writing a malicious extension that passes the AMO automated review (example: https://addons.mozilla.org/en-US/firefox/blocked/i1058), but the cost for malware writers is going to be significantly higher since it will be far easier for Mozilla to shut them down via their blacklists.

No need to use Developer Edition. The unbranded builds of Release and Beta will have an update mechanism too.

They'll be en-US only, though, so if you want a non-English interface, you're out of luck.

If you want to use a non-English interface you would install the langpack for example https://ftp.mozilla.org/pub/firefox/releases/44.0/win32/xpi/ you would need to navigate the ftp to match your particular install.

You'd drop Firefox and go to, what, Chrome? The browser that by default sends all your history to Google?

Nope. I use Pale Moon. It's an actively developed full fork of Firefox. All my extensions work in it. It's more Firefox than Firefox these days.

More Firefox than Firefox.

I have used it more or less exclusively for a couple of months and it works nicely everywhere except for some pages with JS developers who manage to write "your browser is not supported" for anything but Chrome.

Chrome requires extensions to be both signed and distributed through Google's "Chrome Web Store".

You can use the Firefox Developer Edition, which will continue to support the xpinstall.signatures.required preference allowing unsigned extensions.

"Chrome did it." isn't an excuse. It makes it worse, actually.

Developer edition is "Aurora". Aurora is alpha. Alphas have more bugs. It's not reasonable to tell me to use an alpha.

Have you actually used Aurora? I can only speak to my own experience, but I have found it far more stable than any other 'alpha' software I've used.

Yes. When Firefox first announced their plans for the walled garden back near FF37/38 I did as everyone said and tried Aurora.

It crashed on me twice in as many hours. I'm pretty hard on browsers since I typically have 200+ tabs loaded. That never happens with final release versions.

"Chrome did it" is not an excuse. I was pointing out that Chrome is even more restrictive. Google requires developers to distribute their add-ons through Google's store of approved add-ons.

> Aurora is alpha

Excuse my ignorance, but is this official? I use FF Dev edition as my primary browser and it is very stable for me.

Context, if it helps: I am a web dev most of the time, and my browser usage is almost always >100 tabs or so. More than half of those have the devtools open all the time (each of which basically count as another instance of Firefox). My machine is pretty modest (i5, dual core, 8gigs RAM). I don't use many extensions though. Only a lightweight custom theme and greasemonkey + lots of custom userscripts. Reason I use dev edition is because it has more devtools goodies and ES6 features. Nothing related to extension development.

It's official. Aurora is explicitly alpha. When they bump the version number Nightly turns into Aurora turns into Beta turns into Release.

Well I meant, do you happen to have a link stating that? :)

> When they bump the version number Nightly turns into Aurora turns into Beta turns into Release.

Not exactly. I guess you intentionally (over-)simplified that? Firefox actually follows trainspotting for their different release channels: https://hacks.mozilla.org/2015/04/trainspotting-firefox-37-d...

They are right. Here's a link: https://wiki.mozilla.org/Releases#Upcoming_Releases

Aurora is alpha, but FWIW, I've been using Nightly as my main browser for over 4 years now without ever losing data, so Aurora should be more than fine.

That isn't true, you can install Developer add-ons worth going through Google (otherwise how can you develop them). You might get an annoying pop-up though.

Reply on news.ycombinator.com