Hacker News Reader

>This is currently impossible on Firefox as they forget extension loaded from local files to be removed after. The force everyone who wants to run their own code on their own machine persistently to file for a developer code signing certificate, essentially copying Apple's approach to marketplace management.

My distro's firefox package loads extensions I zip'd and placed in /usr/lib64/firefox/browser/extensions , probably because it's compiled with `--with-unsigned-addon-scopes=app --allow-addon-sideload`

FOSS authors are catching on to all the tricks that Windows etc closed source authors have been doing - locking down their software, phoning home with telemetry, bundling in closed-source components with non-free licenses and what not. Distro maintainers are the last line of defence against this shit. Don't use upstream binaries.

Mozilla provide unbranded versions of Firefox that don't require extensions to be signed: https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded...

The official branded releases only require signatures because everything else they tried to stop malware hijacking the browser ultimately failed. Mozilla are not trying to copy iOS, they don't stop you leaving the walled garden if you want to.

Unbranded seems to be only available as nightly or beta. No option just for this problem.

The page I linked to has release builds. The branding isn't the same as normal release builds, but that's why it's called unbranded.

Yes, and downloading such a release-versions gives me an installation with codename Nightly, not a stable version. Even the version-number is newer.

They have Nightly branding but they aren't nightlies.

When I download the Unbranded/"Nightly" build, it says it's v107.0.1, versus Stable is v109.0. You seemed to be of the impression the declared version string was incorrect, so I dug a bit deeper. The security fixes mentioned in the changelog for v109, such as CVE-2023-23601 [1] are not present in the latest Unbranded/"Nightly" release.

So basically Mozilla telling developers: want to be able to run your own code? Fine. But only if you use a months-old browser subject to a bunch of security vulnerabilities we keep a list of on our website for any would-be attacker to consult.

[1] https://www.mozilla.org/en-US/security/advisories/mfsa2023-0...

The interface is unfriendly to say the least, but if I follow the trail

• https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... (click “release”)

• https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click the date of the most recent complete build)

• https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click “B” next to your desired platform, OS X in my case)

• https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click “Artifacts and Debugging”, then “target.dmg”/“target.zip”)

• https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task...

… then I get a “Nightly” build reporting version 109.0.1.

The direct links to the latest releases should be better maintained for sure, and it did take me longer than I'd like to figure out the build interface.

>I don't see any way to stop automatic updates in settings

Hit the gear and uncheck "Update Add-ons Automatically".

>This is all trivial in Edge.

Is it? I can't find the toggle for extension autoupdates in Edge, and a search only turns up hacky methods for Chrome, nothing specific to Edge.

> Hit the gear and uncheck "Update Add-ons Automatically".

Thanks, my bad for looking for settings in Settings.

> Is it? I can't find the toggle for extension autoupdates in Edge, and a search only turns up hacky methods for Chrome, nothing specific to Edge.

I can't speak to extensions downloaded from the store, as I only sideload. But when sideloaded, the extensions of course do not update unless you explicitly pull changes in or make changes yourself. Sideloading itself is trivial, even Stable builds provide a "Developer Mode" toggle that allows loading unsigned unpacked extensions from local directories.

You can keep your extensions loaded by setting this about:config value to false:

xpinstall.signatures.required

At least I think thats the one. Also extension updating can be disabled globally or on a per extension basis in the addons setting page.

Edit: note that you have to package (zip) the extension. You can't keep an unpacked extension loaded.

Yes, but note that this only works in Nightly, Dev, Unbranded and ESR builds, not Beta or Release builds.

> It is difficult to understand where the HN vulpephillia comes from.

I imagine it is in part backlash, fueled by political impulse. Mozilla's appointment of Mitchell Baker and subsequent course of Firefox development have taken on unmistakable political valence in the US culture war (especially seeing how its drift could be uncharitably glossed as "coddling non-technical users at the expense of power users"), which resulted in criticism invariably sounding like, and, I guess, even really somewhat functioning* as an attack on the political group that Mozilla is associated with. This, in turn, makes those who support said political group, or simply are exasperated with its most vocal opponents, instinctively oppose the criticism.

*I'm thinking of something like the affect-loading concept in https://slatestarcodex.com/2014/11/04/ethnic-tension-and-mea....