Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Firefox Mozilla The Internet

Mozilla To Stop Supporting Sideloaded Extensions In Firefox (zdnet.com) 34

Posted by BeauHD from the cease-and-desist dept.
An anonymous reader quotes a report from ZDNet: Mozilla has announced today plans to discontinue one of the three methods through which extensions can be installed in Firefox. Starting next year, Firefox users won't be able to install extensions by placing an XPI extension file inside a special folder inside a user's Firefox directory. The method, known as sideloading, was initially created to aid developers of desktop apps. In case they wanted to distribute a Firefox extension with their desktop app, the developers could configure the app's installer to drop a Firefox XPI extension file inside the Firefox browser's folder.

This method has been available to Firefox extension developers since the browser's early days. However, today, Mozilla announced plans to discontinue supporting sideloaded extensions, citing security risks. Mozilla plans to stop supporting this feature next year in a two-phase plan. The first will take place with the release of Firefox 73 in February 2020. Firefox will continue to read sideloaded extensions, but they'll be slowly converted into normal add-ons inside a user's Firefox profile, and made available in the browser's Add-ons section. By March 2020, with the release of Firefox 74, Mozilla plans to completely remove the ability to sideload an extension. By that point, Mozilla hopes that all sideloaded extensions will be moved inside users' Add-ons section.
This discussion has been archived. No new comments can be posted.

Mozilla To Stop Supporting Sideloaded Extensions In Firefox More

Mozilla To Stop Supporting Sideloaded Extensions In Firefox

Comments Filter:

  • Bullshit power grab. (Score:4, Funny)

    by BAReFO0t ( 6240524 ) on Friday November 01, 2019 @09:16AM (#59369378)

    No, Mozilla. You can't do shit. It's open source. It is MY computer! And you are not our master. You are an asshole. Your for-profit closed-source business origins are showing.

    I'm already patching out a lot of your bullshit, which is thankfully very easy on Gentoo. (Just put the patch in /etc/portage/patches/www-client/firefox/.)

    I will just adapt my patch which already removes you disabling which extensions I can install.

    And the only reason I'm still using Firefox, is because you are the only ones still keeping up with Google's deliberate killer pace, while not being Google.
    This changes, when you are just like them.

    • Re:Bullshit power grab. (Score:5, Insightful)

      by squiggleslash ( 241428 ) on Friday November 01, 2019 @09:18AM (#59369384) Homepage Journal

      Slashdot is lying to you (or rather, repeating ZDNet's false headline.) Firefox is not removing sideloading, it's removing a non-obvious way to add extensions that existed only to make things easier to develop certain types of desktop application. So "your patch" isn't going to "remove (Mozilla) disabling which extensions (you) can install".

      • Re: (Score:2)

        by doom ( 14564 )

        I can't figure out what's supposed to be so deceptive and misleading here. This is from the mozilla announcement itself:

        Sideloading is a method of installing an extension in Firefox by adding an extension file to a special location using an executable application installer. This installs the extension in all Firefox instances on a computer.

        Sideloaded extensions frequently cause issues for users since they did not explicitly choose to install them and are unable to remove them from the Add-ons Manager.

        • Simple before/after comparison.

          New versions / After the change :

          - A user can download an web extensions from Mozilla Extensions website
          - A user can click and open an .XPI file, that was manually downloaded from a website (e.g.: Github)

          Notice how both of the above require user interaction and therefore under user control.

          Old versions / Before the change:
          (same as above and additionally)

          - A software installer can drop a .XPI file in a specific directory and then Firefox will automagical

        • Your translation is reasonable, however it's also incomplete.

          Sideloading is a common technical term for allowing people to add software to a system without involving the system vendor. For example, sideloading an Android app means downloading an APK and installing it without using the Play store.

          Mozilla's announcement is misleading, though not as misleading as the headline to this article. They're using the word "sideloading" as a shorthand for a specific method of sideloading. While this is almost jus

      • So yeah, my patch is already factually removing that "protection".
        (It's just a config setting, and the optional removal of the code doing the blocking.)

    • They are some good ones out there. Improved spelling and grammar checking, Ad blocking, Basically an extension that works with all web site. However ones I am weary of are ones which allows Firefox to display non-Stanard HTML elements. Flash, Silver Light, and the other security holes in your system. Because a web developer was too lazy to code in HTML 5.

      Having extensions installed from placing a file into a folder, is just scary. It is like IE6 with Active X. Where malware can be installed simply by th
    • They aren't and never were disabling the ability to install extensions you want. What they are disabling is your ability to install extensions without opening the browser. IE by copying them straight to firefox's directory. If you want to load them straight from a website, or add the extension in firefox... go to town. Honestly I fully see why they did this, I'd say it's safe to estimate 99.99% of extensions installed this way, were not installed by choice, rather by some other program that either adds with

      • Re: (Score:2)

        by doom ( 14564 )

        They aren't and never were disabling the ability to install extensions you want. What they are disabling is your ability to install extensions without opening the browser.

        Which means if I want to ship an extension via the system's package management, I've got problems, don't I?

        In recent years firefox has been on this kick to protect us from our own hard-drives, as though there's something inherently better about trusting crap off of the web.

        • Which means if I want to ship an extension via the system's package management, I've got problems, don't I?

          ... you say this like it's a bad thing.

          In recent years firefox has been on this kick to protect us from our own hard-drives, as though there's something inherently better about trusting crap off of the web.

          Nope. This sentence has nothing to do with what's being proposed here. Again you can load your own XPI files from your own hard drive. What can't happen is a third party application can't insta

    • Reading the blog post: "It is about removing an attack vector." What it doesn't say is that the logic behind 'removing all attack vectors' must conclude with : "All plugins verified by Mozilla". Yes, it seems alarmist, but it just the logical conclusion of this perception of the problem. The logic: There are attack vectors, we must eliminate them one by one. I can't conceive another conclusion other than 'in the end, we are the source for truth'. It would be alarmist, except recent history shows that it

  • BEFORE ANYONE COMMENTS (Score:5, Informative)

    by squiggleslash ( 241428 ) on Friday November 01, 2019 @09:16AM (#59369380) Homepage Journal

    The headline is misleading, if not completely false. They're removing one of two ways to sideload an extension. The way they're removing is the less obvious way, and only existed to help people who wanted to embed Firefox in their desktop applications.

    Firefox will continue to have the ability to sideload .XPI files using "Install Add-on From File [extensionworkshop.com] within the extensions manager.

    • Re: (Score:2)

      by Junta ( 36770 )

      So I was unable to find at a glance whether I can sign my own XPI if I were so inclined:
      "Regardless of the sideloading method used, you must prepare the add-on as follows:"
      "Sign the add-on in addons.mozilla.org (AMO)."

      The first person to point out this is how they were doing it to desktop deployments was told to use Windows Group Policies, but nothing about OSX or Linux.

      They needed to be very crisp about other ways to do it if they have an equivalent.

      It was deficient that the extensions would exist without

      • Re:BEFORE ANYONE COMMENTS (Score:5, Informative)

        by squiggleslash ( 241428 ) on Friday November 01, 2019 @09:38AM (#59369420) Homepage Journal

        You can use unsigned XPIs in the developers edition of Firefox, ESR, or the nightlies. You have to flip one flag, xpinstall.signatures.required, in about:config but otherwise the process is pretty good.

        The developers edition is almost identical to the regular version, and is updated along the same schedule, so if unsigned XPIs are something you need, it's a good choice.

        That said, the signing process for unlisted XPIs is pretty much automated, so it's going to be a fairly obscure set of circumstances in which you must use any of the three versions of Firefox I mentioned.

        • Re: (Score:2)

          by Junta ( 36770 )

          Are you able to install your own certificates? In other words, if I had an add-on I wanted to keep *completely* in house without mozilla ever seeing it and sign it myself instead, is it possible?

          • If you're keeping extensions in house, I'm guessing that Mozilla would recommend that you use Firefox ESR (which gets updated annually instead of every few weeks).

            • >"If you're keeping extensions in house, I'm guessing that Mozilla would recommend that you use Firefox ESR (which gets updated annually instead of every few weeks)."

              Actually, ESR gets updated almost as much as the other branches. But it doesn't change functionality with those updates. No features are added or removed. So the updates consist only of bug fixes and security patches. The idea is that it isn't constantly breaking compatibility and requiring retesting with stuff.

          • Re:BEFORE ANYONE COMMENTS (Score:4, Informative)

            by squiggleslash ( 241428 ) on Friday November 01, 2019 @10:51AM (#59369550) Homepage Journal

            In other words, if I had an add-on I wanted to keep *completely* in house without mozilla ever seeing it and sign it myself instead, is it possible?

            That isn't the same question! (I have no idea if you can install custom certs for extension signing, I assume not, and Mozilla doesn't document the process) but again, look at my answer. Yes, you can, but you have to use a specific edition of Firefox (Developer or ESR, or a nightly if you're brave.) You can also use unbranded builds.

            If you just want them with a browser more or less the same as the one you use, unbranded Firefox might be the way to go [mozilla.org], they're identical to Firefox (yes, release editions are available), but lack Mozilla branding.

            There is very little functional difference between Firefox Developer Edition and regular Firefox beyond the former having various flags you can tweak, some additional tools that you can ignore, and it having some features before regular Firefox. You can read more about the differences here [howtogeek.com] and download it here [mozilla.org].

            Basically the logic is "You can use Firefox with anything you want, but if you want the defaults, they make it harder for someone to hack your browser, including you." Which seems a reasonable compromise. It feels a little like the "Developer button" on Chromebooks.

    • Re:BEFORE ANYONE COMMENTS (Score:5, Insightful)

      by slack_justyb ( 862874 ) on Friday November 01, 2019 @09:44AM (#59369438)

      The headline is misleading, if not completely false

      This is absolutely correct, this is on purpose misleading just to incite people to get angry for no absolute reason. The method that is being removed is an incredible old method for side-loading that was around shortly after Firefox 4 back when Mozilla was priming for Prism [mozilla.org] and going the way of Firefox OS [wikipedia.org]. That was way back when people thought they would be writing desktop applications using XUL. Side loading by the vast majority of users does not use this method.

      Firefox will continue to have the ability to sideload .XPI files using "Install Add-on From File" within the extensions manager.

      Exactly. Mozilla is still supporting side loading, just not side loading via this old ass method. The headline for this article is pure bullshit, is completely hyped up to get people angry when they need not to be, and is a fucking disgrace to the term "news". This is complete garbage.

      • Exactly. Mozilla is still supporting side loading, just not side loading via this old ass method. The headline for this article is pure bullshit, is completely hyped up to get people angry when they need not to be, and is a fucking disgrace to the term "news". This is complete garbage.

        I see you've never heard of clickbait before. Unfortunately, that's what news is these days, just a bunch of hyperbolic shit.

  • This method was often used for an organization that uses Firefox as an organizational browser and has a base set of required extensions that need to be installed. Previously, admins could just drop an XPI into a well-known place in the filesystem and Firefox would load that XPI for every user that uses firefox. Also, this location would not be non-superuser writeable by default. With the new system, you can only install extensions with user interaction. Now users can choose not to install user required ext

    • I seriously doubt any admins are going to lose sleep over this: if anything, it'll be the exact opposite - there's one less vector for malware to infiltrate an organization. I can't imagine why a organization would host a web application that requires a Firefox extension (not even a plugin, an extension!) to be used: that would tie the application to Firefox, which would be an even stranger corporate decision than tying it to Internet Explorer.

      The only serious reason I can think of why an admin might not

  • Some time ago, gab.ai (aka "nazi twitter", though that's perhaps unfair) established an addon called "Dissenter". This addon allows people to comment on any article- anyone running the addon will see other comments from other users of the addon.

    Dissenter, like Gab, is a free speech platform- meaning that all the rabble that have been kicked out of every other space gather there. Which means you'll find, well, exactly what you expect there. Free speech is absolutely not tolerated by Mozilla and Chrome (or

    • Re: (Score:2)

      by cfalcon ( 779563 )

      Ehhh, I just read more of this. I think you'd still be able to install it by shoving it into your profile directory or something. If that's the case, then I have no such concern. I think the summaries of this I've seen have been overly hyperbolic, unless I'm missing something.

    • Merits of Dissenter aside, this move makes no difference whatsoever. You can install any XPI file by going to Hamburger->Add-ons (or CTRL-SHIFT-A), clicking on the gear icon, and selecting "Install Add-on from file".

      This announcement, despite the misleading headline, is about preventing third parties from secretly installing extensions by dropping them in a special directory, a feature that was never supposed to exist (for that purpose) but was a side effect of an early Mozilla project to create a ver

Slashdot Top Deals

Veni, Vidi, VISA: I came, I saw, I did a little shopping.

Close