Hacker News Reader

Comment by superkuh | Hacker News Reader

Too bad firefox doesn't allow it's users to install extensions without their approval and this extension can only be installed temporarily.

>in Firefox You'll need to install as a "temporary extension", so it'll only last in your current FF session. (If you want to install permanently, see this issue: https://github.com/osnr/TabFS/issues/4#issuecomment-75344738...)

View on HN

This was the straw finally pushing me to very seriously consider migrating to Chromium. They seem to absolutely despise power users, they pull the same type of shit with Fennec/Fenix.

They hate their users so much they're perfectly willing to compromise their security. "This extension is not actively monitored by Mozilla". But you can't do the responsible thing and build it from source yourself.

Even installing the "Developer Edition" didn't enable to me to install self-built extensions (yes, with that secret flag). And it doesn't even tell you that it doesn't accept unsigned extensions, they claim that the extension is "broken".

The fuck?! This is Apple-level user hostility. Meanwhile Mozilla execs are getting Apple exec-style compensation while driving it further into the ground.

> This was the straw finally pushing me to very seriously consider migrating to Chromium.

What is the situation surrounding Manifest V3 in Chromium? Won't that throw a wrench into power user's workflows with its own arbitrary limitations?

Not as much as it initially seemed. All extensions I use work fine, including uBlock Lite. The arbitrary limits would trivially be increasable in a fork.

But of course I'm worried about Chromium going the way of the third E, which makes it quite possible I'll continue the toxic relationship with Mozilla for even longer.

> And it doesn't even tell you that it doesn't accept unsigned extensions, they claim that the extension is "broken".

It's likely you forgot to include the browser_specific_settings with a some arbitrary id in the manifest.json.

Permanently installing unsigned extensions definitely works in the Developer Edition after setting the pref in about:config.

Have you tried rebuilding the XPI in a different way or trying a different XPI? I would guess that your addon is broken, as it works for me: https://postimg.cc/9rkbMd7v

I understand the frustration and would also like improved control, but I understand firefox preventing this in the "normal" edition as it's very common for trojans to install unwanted extensions manually by fiddling with the profile files, I've had to remove them manually from family computers in the past.

It’s really not that bad. You can sign up for a free Mozilla developer account and upload the bundle you’d like to sign, and install the signed extension a few minutes later on any edition of Firefox.

Not that bad?? I'm sorry, but that's horrifying. Imagine if you couldn't run any code on Linux without uploading it to Linus's servers first.

Okay, but Linux is an operating system (kernel), Firefox is a web browser. That's two completely different things with different expectations and threat models.

Chrome lets you do it, and with the market share that it has, it means that it's the de facto expectation that you can actually install extensions without an account. And it's not like chrome is less secure than firefox, the opposite is true actually.

if this is horrifying, perhaps you should go touch some grass man. A decent security take is not a horror show when you can get even hobby stuff of your own signed fairly trivially.

Sorry, what security is this offering? At the cost of my PII?

And Mozilla still doesn't scan or do any due diligence on whatever it is you are installing.

How about I have to approve of any code you want to run before you can run it? That's dystopian.

> Even installing the "Developer Edition" didn't enable to me to install self-built extensions

For a different perspective, I’ve successfully done this on both Windows and Linux. In both cases it was pretty straightforward. (My extension was admittedly very simple, though… maybe it’s different with more complex ones.)

It is hostile to power users, but gracious to unsuspecting users who might have a sneaky person install extensions on their browser to steal their data/spy on them. In any case, a real power user could always use a developer build and set that flag.

> In any case, a real power user could always use a developer build and set that flag.

...this one?

>>Even installing the "Developer Edition" didn't enable to me to install self-built extensions (yes, with that secret flag).

I just tested it and it does work for me: https://postimg.cc/9rkbMd7v

I would guess that they are trying to install is actually broken.

Yes, my not so nice implication was that they aren't a real power user and it was PEBKAC. I usually try to be nicer but it's hard when someone is saying "X sucks because..."

lol, I feel that Firefox is chrome but using Firefox engine. What I don't understand is that can see evidence of this if you cause an error and view source. It has chrome:// literally hard-coded and commented out.

Host a web server, kill the web-server, try to visit the URL, open inspector and look chrome.

Examples:

"<script xmlns="http://www.w3.org/1999/xhtml" src="chrome://global/content/neterror/aboutNetErrorCodes.js"></script>"

Visit chrome://global/content/aboutNetError.mjs in your firefox browser. Why is Firefox accepting chrome:// URI's?

You can even browse: chrome://global/skin/icons/

Visit: jar:file:///usr/local/lib/firefox/omni.ja!/chrome/

(i'm on freebsd, so if linux: /usr/lib/firefox/omni.ja!/chrome or something) too drunk to care. The internet is fucked.

Firefox version: 109.0 (64-bit)

root@cuddles:/usr/crystal/doublerabbit/ # pkg install chromium Updating FreeBSD repository catalogue... FreeBSD repository is up to date. All repositories are up to date. The following 3 package(s) will be affected (of 0 checked):

New packages to be INSTALLED: chromium: 109.0.5414.119 noto-basic: 2.0_1 sndio: 1.9.0

Call me skeptical, what a coincidence. Convince me.

Oh gosh, "chrome" here is not the browser...

https://developer.mozilla.org/en-US/docs/Glossary/Chrome

https://www.nngroup.com/articles/browser-and-gui-chrome/

> 'Chrome' is the user interface overhead that surrounds user data and web page content.

Browser/GUI's "chrome" terminology existed before google "chrome" browser. That's why you use "userChrome.css" to modify the visual look by yourself.

Well you've convinced me, call me skeptical. Thanks!

I always assumed Google Chrome was named Chrome BECAUSE of "Chrome" being the internal name for the Firefox UI styling. I guess I'm old :)

Chrome is named after this :-)

It's not the prettiest solution, but you can work around this problem with web-ext: https://www.npmjs.com/package/web-ext

Reply on news.ycombinator.com