6 ms·

New Firefox Add-On Policies

90 points by ReadCarlBarks 1y ago

proaralyst 1y ago
> “Closed group” prohibition lifted This is great: I've wanted a personal extension for a while (roughly to replace my userscripts but with more power and better sync) but was put off by it having to be public or manually installed. Now I can make this!
- qiine 1y ago
  Wow so I can upload my extension to firefox servers privately and without needing review process maybe ? and install it on all my device ? (via autosync I suppose?) Thats handy.
- sdovan1 1y ago
  I have to reinstall my personal extension every time Firefox restarts. It's so annoying that I ended up writing an AutoHotKey script just to automate it (go to about:debugging#/runtime/this-firefox -> load temporary extension -> select manifest.json). Glad to see the announcement!
  - arp242 1y ago
    You can already use web-ext to sign it; it doesn't need to be published (you can keep the extension private). It's just that you need to be logged in to download it and can't really provide a "share link" (but you can of course upload/send that .xpi to anyone). I have a few private extensions like this (e.g. for HN, GOG, my own new tab page, etc.). I don't have the exact steps for this at the handy, been meaning to do a write-up at some point, but my mk script is just "$webext sign --channel unlisted --api-key $jwt_issue --api-secret $jwt_secret" – I don't recall if you need to create it the extension in the Mozilla web UI first, but I don't think so(?)
    - sdovan1 1y ago
      Thanks! I thought this was impossible. Gonna try it out today. Edit: I successfully signed the key on AMO. Here are the steps: Get an access token from https://addons.mozilla.org/developers/addon/api/key/ In manifest.json, add browser_specific_settings.gecko.id and set it to something like "myext@example.com" Run command: web-ext sign --api-key=<jwt-issuer> --api-secret=<jwt-secret> --channel=unlisted That command will upload your extension to AMO. After an automatic review, you can download the .xpi file from AMO. That said, it's not ideal for me since I make extensions for work. Looks like a human reviewer can check your code at any time.
      - arp242 1y ago
        > Looks like a human reviewer can check your code at any time. Yeah, not entirely sure how this works. I've been doing this for a few years with a bunch of extensions, and thus far it's always just been automatically approved (although that does take a few minutes).
- gruez 1y ago
  >but was put off by it having to be public or manually installed Even prior to this there was an option to upload an extension to AMO for "private distribution". Mozilla will sign your extension so it installs without a fuss, but it won't be hosted on AMO. You can still host it on your personal website, or share the .xpi file though.
akkartik 1y ago
10 years too late. I'm never going back. These days I try to use my browser as vanilla as possible so I don't get my heart broken.
- motorest 1y ago
  > 10 years too late. I'm never going back. These days I try to use my browser as vanilla as possible so I don't get my heart broken. Pray tell, which usable browser do you believe provides better assurances than Firefox? Certainly it's not Chrome or Edge, is it?
  - msgodel 1y ago
    tbh it's a lot easier to install ad-hoc extensions in Chromium than Firefox.
    - deleted 1y ago
      [deleted]
  - akkartik 1y ago
    Oh I use a Firefox fork. I just don't develop extensions for it anymore. Firefox could have been the chosen one, the hackable browser. But it's just another hermetically sealed product.
    - arp242 1y ago
      > It's just another hermetically sealed product. Everything is open source, mostly under a fairly permissive license. You can still do quite a lot with extensions or various tweaks (more than most programs, including open source ones). It's demonstrably not "hermetically sealed".
      - akkartik 1y ago
        "Everything is open source" does not contradict "hermetically sealed product". I built myself an extension. Just for myself, nobody else. It worked great, then in one of these "policy changes" I couldn't use it anymore. Just for myself. That is a betrayal of trust. If I could use it before, and now I need to hack/mod Firefox by building it on a machine with umpteen hundreds of gigabytes of storage, that is a betrayal of trust. Firefox is "demonstrably" a hermetically sealed product. As demonstrated by my lived experience.
Am4TIfIsER0ppos 1y ago
If you're not removing the DRM on them (code signing) then what do I care?
- kevingadd 1y ago
  By what standard is code signing DRM? Lots of stuff is codesigned.
- _verandaguy 1y ago
  Code signing doesn't stop redistribution of unmodified copies of software, and it allows for cryptographic attestation of its origin (when used properly). If you modify the software, you'll have to re-sign it and make sure your code's consumers trust that signature's chain of trust. DRM prevents you from redistributing original media (with varying degrees of effectiveness) and doesn't do much for cryptographic attestation (nominally). These are two very different systems for different purposes.
  - Am4TIfIsER0ppos 1y ago
    No both prevent me from using my computer as I want without 3rd party permission or even just after some date.
    - _verandaguy 1y ago
      In what way does code signing prevent you from using your computer as you want? As far as I know you can run unsigned code pretty easily still (especially, though not uniquely, as a technical user), and the process of stripping attestation/signing information from an executable on most popular platforms is well-documented with freely-available tools in most cases. I'm almost certain there are ways to disable code signature checking completely on the major OSes if you really want to, but why you'd want to do that, I don't get. Is your argument that running code with an invalid signature should happen with no notice, no hurdles, no nothing, by default?
      - 1y ago
knowitnone 1y ago
"we encourage developers to link to self-hosted privacy policies" So now, extensions can change to anything they want at any time they want with our without consent?
- bartvk 1y ago
  Yes and this actually is the same when you publish an app in the App Store.
  - Sporktacular 1y ago
    Maybe I'm misunderstanding, but under the previous process, submitting a policy with an update freezes it to a specific version. That holds the developer to account at least for that update.
- somat 1y ago
  Why do they need to change anything? As far as I know a privacy policy has zero legal weight, that is, a company can put anything it wants into the privacy policy, it has no effect on what is actually done.
- arp242 1y ago
  In the end a privacy policy is little more than the proverbial "ink on a piece of paper". It's doesn't actually prevent anything. Where and how it's published seems like a minor detail.
account42 1y ago
Add-on policies shouldn't be a thing in the first place - it's my computer, not Mozilla's.
- abraham 1y ago
  > We’ve updated Add-on policies for addons.mozilla.org (AMO). Their policy doesn't apply to your computer. Only to developers that want to use Mozilla's infrastructure for distribution.
  - Zak 1y ago
    There are artificial limitations to that. For example, stable versions of Firefox for Android won't install extensions from anywhere but Mozilla's infrastructure. I find that limitation bizarre from an open source browser; it's the sort of behavior I'd expect from Apple.
    - arp242 1y ago
      I get why they do it; for better or worse, the browser is a major way many people interact with email, banking, etc. etc. A malicious extension would be a world of hurt. Some of that is moving to mobile, but with 5 billion people on the internet, Firefox's "low" market share at 4 or 5% is still over 200 million people, so it's still used by dozens or perhaps even hundreds of millions of people for these high-security tasks. When I did IT support I've seen so many people do completely crazy things. I've seen people with 6 or 7 different browser toolbars and they use none of them. People with 3 different virus scanners they never remember installing, and of course ransomware they never recall installing either. etc. etc. And honestly, can you really say you'd never click on the wrong "allow this untrusted extension" button when distracted, engaged in something else, tired, or whatnot? I agree it can be annoying, but it's not impossible to maintain your private (signed) extensions. And for >99% of people, it's probably a sensible thing to do – this includes most tech people because most tech don't have a bunch of private extensions. For everyone else, you can sign your own private extensions (some effort, but fairly minor) or use the Developer Edition, which allows installing unsigned extensions.
- deleted 1y ago
Melatonic 1y ago
Sounds great - Closed Group extensions could be very useful!
quintu5 1y ago
But do they still have an arbitrary 4mb max file size on extension assets? This makes chunking for any sizable extension an absolute nightmare!

90 points by ReadCarlBarks 1y ago

> “Closed group” prohibition lifted This is great: I've wanted a personal extension for a while (roughly to replace my userscripts but with more power and better sync) but was put off by it having to be public or manually installed. Now I can make this!

qiine 1y ago
Wow so I can upload my extension to firefox servers privately and without needing review process maybe ? and install it on all my device ? (via autosync I suppose?) Thats handy.
sdovan1 1y ago
I have to reinstall my personal extension every time Firefox restarts. It's so annoying that I ended up writing an AutoHotKey script just to automate it (go to about:debugging#/runtime/this-firefox -> load temporary extension -> select manifest.json). Glad to see the announcement!
- arp242 1y ago
  You can already use web-ext to sign it; it doesn't need to be published (you can keep the extension private). It's just that you need to be logged in to download it and can't really provide a "share link" (but you can of course upload/send that .xpi to anyone). I have a few private extensions like this (e.g. for HN, GOG, my own new tab page, etc.). I don't have the exact steps for this at the handy, been meaning to do a write-up at some point, but my mk script is just "$webext sign --channel unlisted --api-key $jwt_issue --api-secret $jwt_secret" – I don't recall if you need to create it the extension in the Mozilla web UI first, but I don't think so(?)
  - sdovan1 1y ago
    Thanks! I thought this was impossible. Gonna try it out today. Edit: I successfully signed the key on AMO. Here are the steps: Get an access token from https://addons.mozilla.org/developers/addon/api/key/ In manifest.json, add browser_specific_settings.gecko.id and set it to something like "myext@example.com" Run command: web-ext sign --api-key=<jwt-issuer> --api-secret=<jwt-secret> --channel=unlisted That command will upload your extension to AMO. After an automatic review, you can download the .xpi file from AMO. That said, it's not ideal for me since I make extensions for work. Looks like a human reviewer can check your code at any time.
    - arp242 1y ago
      > Looks like a human reviewer can check your code at any time. Yeah, not entirely sure how this works. I've been doing this for a few years with a bunch of extensions, and thus far it's always just been automatically approved (although that does take a few minutes).
gruez 1y ago
>but was put off by it having to be public or manually installed Even prior to this there was an option to upload an extension to AMO for "private distribution". Mozilla will sign your extension so it installs without a fuss, but it won't be hosted on AMO. You can still host it on your personal website, or share the .xpi file though.

akkartik 1y ago

10 years too late. I'm never going back. These days I try to use my browser as vanilla as possible so I don't get my heart broken.

motorest 1y ago
> 10 years too late. I'm never going back. These days I try to use my browser as vanilla as possible so I don't get my heart broken. Pray tell, which usable browser do you believe provides better assurances than Firefox? Certainly it's not Chrome or Edge, is it?
- msgodel 1y ago
  tbh it's a lot easier to install ad-hoc extensions in Chromium than Firefox.
  - deleted 1y ago
    [deleted]
- akkartik 1y ago
  Oh I use a Firefox fork. I just don't develop extensions for it anymore. Firefox could have been the chosen one, the hackable browser. But it's just another hermetically sealed product.
  - arp242 1y ago
    > It's just another hermetically sealed product. Everything is open source, mostly under a fairly permissive license. You can still do quite a lot with extensions or various tweaks (more than most programs, including open source ones). It's demonstrably not "hermetically sealed".
    - akkartik 1y ago
      "Everything is open source" does not contradict "hermetically sealed product". I built myself an extension. Just for myself, nobody else. It worked great, then in one of these "policy changes" I couldn't use it anymore. Just for myself. That is a betrayal of trust. If I could use it before, and now I need to hack/mod Firefox by building it on a machine with umpteen hundreds of gigabytes of storage, that is a betrayal of trust. Firefox is "demonstrably" a hermetically sealed product. As demonstrated by my lived experience.

Am4TIfIsER0ppos 1y ago

If you're not removing the DRM on them (code signing) then what do I care?

kevingadd 1y ago
By what standard is code signing DRM? Lots of stuff is codesigned.
_verandaguy 1y ago
Code signing doesn't stop redistribution of unmodified copies of software, and it allows for cryptographic attestation of its origin (when used properly). If you modify the software, you'll have to re-sign it and make sure your code's consumers trust that signature's chain of trust. DRM prevents you from redistributing original media (with varying degrees of effectiveness) and doesn't do much for cryptographic attestation (nominally). These are two very different systems for different purposes.
- Am4TIfIsER0ppos 1y ago
  No both prevent me from using my computer as I want without 3rd party permission or even just after some date.
  - _verandaguy 1y ago
    In what way does code signing prevent you from using your computer as you want? As far as I know you can run unsigned code pretty easily still (especially, though not uniquely, as a technical user), and the process of stripping attestation/signing information from an executable on most popular platforms is well-documented with freely-available tools in most cases. I'm almost certain there are ways to disable code signature checking completely on the major OSes if you really want to, but why you'd want to do that, I don't get. Is your argument that running code with an invalid signature should happen with no notice, no hurdles, no nothing, by default?
    - 1y ago

knowitnone 1y ago

"we encourage developers to link to self-hosted privacy policies" So now, extensions can change to anything they want at any time they want with our without consent?

bartvk 1y ago
Yes and this actually is the same when you publish an app in the App Store.
- Sporktacular 1y ago
  Maybe I'm misunderstanding, but under the previous process, submitting a policy with an update freezes it to a specific version. That holds the developer to account at least for that update.
somat 1y ago
Why do they need to change anything? As far as I know a privacy policy has zero legal weight, that is, a company can put anything it wants into the privacy policy, it has no effect on what is actually done.
arp242 1y ago
In the end a privacy policy is little more than the proverbial "ink on a piece of paper". It's doesn't actually prevent anything. Where and how it's published seems like a minor detail.

account42 1y ago

Add-on policies shouldn't be a thing in the first place - it's my computer, not Mozilla's.

abraham 1y ago
> We’ve updated Add-on policies for addons.mozilla.org (AMO). Their policy doesn't apply to your computer. Only to developers that want to use Mozilla's infrastructure for distribution.
- Zak 1y ago
  There are artificial limitations to that. For example, stable versions of Firefox for Android won't install extensions from anywhere but Mozilla's infrastructure. I find that limitation bizarre from an open source browser; it's the sort of behavior I'd expect from Apple.
  - arp242 1y ago
    I get why they do it; for better or worse, the browser is a major way many people interact with email, banking, etc. etc. A malicious extension would be a world of hurt. Some of that is moving to mobile, but with 5 billion people on the internet, Firefox's "low" market share at 4 or 5% is still over 200 million people, so it's still used by dozens or perhaps even hundreds of millions of people for these high-security tasks. When I did IT support I've seen so many people do completely crazy things. I've seen people with 6 or 7 different browser toolbars and they use none of them. People with 3 different virus scanners they never remember installing, and of course ransomware they never recall installing either. etc. etc. And honestly, can you really say you'd never click on the wrong "allow this untrusted extension" button when distracted, engaged in something else, tired, or whatnot? I agree it can be annoying, but it's not impossible to maintain your private (signed) extensions. And for >99% of people, it's probably a sensible thing to do – this includes most tech people because most tech don't have a bunch of private extensions. For everyone else, you can sign your own private extensions (some effort, but fairly minor) or use the Developer Edition, which allows installing unsigned extensions.
deleted 1y ago

Melatonic 1y ago

Sounds great - Closed Group extensions could be very useful!

quintu5 1y ago

But do they still have an arbitrary 4mb max file size on extension assets? This makes chunking for any sizable extension an absolute nightmare!