Hacker News Reader

Comment by TazeTSchnitzel | Hacker News Reader

You can if you use the Developer Edition.

It's permanently disabled in the normal version because malware would piggyback on the browser to steal passwords and so on. Obviously Mozilla have no problem with people wanting to make their own extensions and so on.

View on HN

Telling people to use a buggy beta is not acceptable. This is anti-user and pro-corporation.

Firefox Developer Edition isn't beta.

Isn't the developer edition the replacement for Aurora? (which is supposed to be more unstable than beta)

Aurora is no more because it was not necessary for stability (when nightly merges to beta it is already very stable, this improved a lot over time) and incurred a cost on speed of development (one less stop for the train to ride). DevEdition is now based on Beta and extremely stable. I use it alongside the stable version on both of my main computers in an equal way and I have max. 1-2 issues in DevEdition in a year (and those issues do not even prevent me from doing my work).

I wonder to what extent that helps prevent malware from installing a malicious addon to Firefox, because by using the same mechanism as cheating in video games, you can hot-patch a running browser process to disable the functionality to keep it from installing unsigned addons. Technically, in Windows you would just call WriteProcessMemory to modify memory content of another process.

It‘s the injection vector. People used to sideload malicious addons a lot by „accident“ when a rogue website told them to („You must install X player to see this video. Click here …“).

Would it be difficult to set up a list of allowed signatures in Firefox? By making it unintuitive for the average user to modify, you would prevent most bad actors from succeeding but still allow power users to control their own experience.

„This cool trick gives your Firefix super powers“ articles will appear instantly. This happened before with noobs following instructions to copy & paste code into the developer console(!), which pwned quite a few Facebook (and other) accounts. Same for banking websites, intranets, … social engineering works well on the unsuspecting. This is btw why browser vendors implemented measurements to make it harder to copy & paste into the dev console, as well as disallowed pasting „javascript:“ URLs to the address bar.

Weird, I have 63.0.3 as far as I see the normal version and had no problem downloading and with that updating the November version of "bypass-paywalls" which was also affected from the releases page here: https://github.com/iamadamdev/bypass-paywalls-firefox/releas...

That means it's signed with Mozilla's signature. Actually, I think extensions can maybe be signed by Mozilla even if they're not on addons.mozilla.org.

Yes, but Mozilla will refuse to sign extensions that are not hosted in their app store.

No they wont (and don't) but it's possible they will choose to not sign these extensions, probably depending on their lawyers.

Their addon tool includes a well documented facility to sign an extension without listing it in the addon store so you can host it somewhere else. This can e.g. be used for company-internal extensions.

Addons can be unlisted, ie, they don't show up on a.m.o but you can download and install them as normal.

Thanks for the link. Installed without problems.

Reply on news.ycombinator.com