Hacker News Reader

Comment by alphabet9000 | Hacker News Reader

firefox/mozilla doesn't really make it easy (compared to chrome)

mozilla now requires "add-on signing" [0]; extensions now have to be "signed" (By mozilla) before you can permanently side-load your own private extension onto regular firefox. they also require you to use 2FA [1] when setting up a firefox.com account (which is required in order for you to upload extensions so they can be signed).

at least with chrome you can just enable 'developer mode' and drag and drop your own extensions and use it right away without having to deal with any of that.

[0] https://blog.mozilla.org/addons/2020/03/10/support-for-exten...

[1] https://blog.mozilla.org/addons/2021/03/11/two-factor-authen...

View on HN

The signing requirement only applies to the stable and beta versions of Firefox. It can be disabled in about:config in Firefox Developer Edition (which is basically the same as beta), as well as in Nightly, ESR, and Unbranded builds [1].

[1]: https://wiki.mozilla.org/Add-ons/Extension_Signing

this is not true. with Android version at least, an AMO account is also required.

I was referring to desktop, not Android here. To my knowledge, Android currently requires a custom collection on AMO for installing anything outside the default list.

I can understand why the first example is burdensome and don't have any quarrel with it but I can't help but lack sympathy for the second example. If your barrier as a developer is setting up 2FA I can't help but doubt you ever cared much about supporting Firefox anyway. This is like a taxi driver complaining about needing to have proof of insurance and a driver's license.

I'm just an old-fashioned programmer, I don't think I should have to register with an authority and submit all of my code to them just to be able to run something I've written for myself on my own computer.

I think mail confirmation or yubikey is fine but I never understood why I need an app on my phone for authentication. What if I lose the phone? How would I get my account back? Tried some authenticator app on the desktop once also and got locked out of my account after that because my computer crashed and I had to reinstall it. Never again.

i very much care about supporting firefox users. for example, i maintain a separate, mozilla-signed, manifest v2 version of an extension i made [0] just so firefox users can keep using it. i do so even though this compromises my own ideals about not wanting to use 2FA out of principle.

[0] https://github.com/fanfare/googleimagesrestored/releases

Huh? To the best of my knowledge, to get a development extension working in FF:

1. Ctrl-shift-a to open add-ons page

2. Click the cog, and select "debug add-ons"

3. Click "load temporary add-on"

4. Select a file in your extension.

5. Done.

This worked for me earlier this week.

Key word from the grandparent post: "permanently"

Key word from the parent post: "temporary"

Ah I reckon what you meant was "Oh this approach only temporarily installed the add-on, your parent post was asking about a way to permanently install an add-on." Took me a while to figure out what you meant.

Ah missed that; yep, the add-on will remain installed until the browser is restarted. That is a little annoying!

Hm. I tried this with an super simple extension[1] I had lying around and couldn't get any network requests to work. The error thrown in console was a generic "NetworkError", but the network tab shows no relevant entries at all. Not a great developer experience, especially compared to chromium.

https://github.com/JacksonKearl/FeelingBlue/blob/main/extens...

Odd! Were you trying to fetch a public, CORS-enabled API? That should just work. If you were trying to make a network request for a non-CORS endpoint (eg fetch the google homepage or something), you'll need to add the domain to your permissions section.

Eg:

"permission": [ "storage", "https://google.com" ]

I have CORS configured to allow the https//twitter.com/ origin. I could see firefox perhaps using a different origin for worker scripts? But hard to tell since the network tab doesn’t show any of the requests.

I could set up server logs locally, but there’s only so many hours in my life.

Not OP, I built an extension for a site that sent CSP headers. Because the browser extension wasn't allowed in the list of JS sources, it all borked.

Not certain that's this user's issue, but that is another thing to check.

I suspect this is it. There were a lot of things logged to console for twitter violating its own CSP, but I didn’t see any for my script.

It seems the overall handling of network errors in add-ons has a lot of room for improvement.

It should be noted that chromium allows the network request regardless of the CSP. This is the correct, User-Empowering approach. Firefox’s deference to the Origin to control the code the User is attempting to run is the antithesis of what a User Agent ought to be.

Yep. Firefox is my browser, but their add-on story is garbage.

It is great they require 2FA, it increases everyone security in case a developer account is compromised.

I'd prefer to choose how much risk I want to take when installing extensions. Just give me a warning and let me do what I want.

Signed extensions can be loaded into release versions of FF. A compromised dev account can create signed malicious extensions. TFA protects everyone.

yes, thats all true. however people should be able to choose their own level of protection. not have the most secure (and most cumbersome) rammed down their throats.

Reply on news.ycombinator.com