Mozilla To Stop Supporting Sideloaded Extensions In Firefox (zdnet.com) 34
An anonymous reader quotes a report from ZDNet: Mozilla has announced today plans to discontinue one of the three methods through which extensions can be installed in Firefox. Starting next year, Firefox users won't be able to install extensions by placing an XPI extension file inside a special folder inside a user's Firefox directory. The method, known as sideloading, was initially created to aid developers of desktop apps. In case they wanted to distribute a Firefox extension with their desktop app, the developers could configure the app's installer to drop a Firefox XPI extension file inside the Firefox browser's folder.
This method has been available to Firefox extension developers since the browser's early days. However, today, Mozilla announced plans to discontinue supporting sideloaded extensions, citing security risks. Mozilla plans to stop supporting this feature next year in a two-phase plan. The first will take place with the release of Firefox 73 in February 2020. Firefox will continue to read sideloaded extensions, but they'll be slowly converted into normal add-ons inside a user's Firefox profile, and made available in the browser's Add-ons section. By March 2020, with the release of Firefox 74, Mozilla plans to completely remove the ability to sideload an extension. By that point, Mozilla hopes that all sideloaded extensions will be moved inside users' Add-ons section.
This method has been available to Firefox extension developers since the browser's early days. However, today, Mozilla announced plans to discontinue supporting sideloaded extensions, citing security risks. Mozilla plans to stop supporting this feature next year in a two-phase plan. The first will take place with the release of Firefox 73 in February 2020. Firefox will continue to read sideloaded extensions, but they'll be slowly converted into normal add-ons inside a user's Firefox profile, and made available in the browser's Add-ons section. By March 2020, with the release of Firefox 74, Mozilla plans to completely remove the ability to sideload an extension. By that point, Mozilla hopes that all sideloaded extensions will be moved inside users' Add-ons section.
Bullshit power grab. (Score:4, Funny)
No, Mozilla. You can't do shit. It's open source. It is MY computer! And you are not our master. You are an asshole. Your for-profit closed-source business origins are showing.
I'm already patching out a lot of your bullshit, which is thankfully very easy on Gentoo. (Just put the patch in /etc/portage/patches/www-client/firefox/.)
I will just adapt my patch which already removes you disabling which extensions I can install.
And the only reason I'm still using Firefox, is because you are the only ones still keeping up with Google's deliberate killer pace, while not being Google.
This changes, when you are just like them.
Comment removed (Score:5, Insightful)
Re: (Score:2)
I can't figure out what's supposed to be so deceptive and misleading here. This is from the mozilla announcement itself:
Before/After compare (Score:3)
Simple before/after comparison.
New versions / After the change :
- A user can download an web extensions from Mozilla Extensions website .XPI file, that was manually downloaded from a website (e.g.: Github)
- A user can click and open an
Notice how both of the above require user interaction and therefore under user control.
Old versions / Before the change:
(same as above and additionally)
- A software installer can drop a .XPI file in a specific directory and then Firefox will automagical
Re: (Score:2)
Firefox already blocks "arbitrary" extension insta (Score:2)
So yeah, my patch is already factually removing that "protection".
(It's just a config setting, and the optional removal of the code doing the blocking.)
Re: (Score:2)
this is about extensions which are different to add-ons
Could you please explain to us, then, why the "Extensions" hyperlink on this page by Mozilla [mozilla.org] leads to a page titled "Addons"?
Extensions are native x86 code running inside the browser process, like Flash.
And yet, this other page by Mozilla [mozilla.org] calls them "plugins".
Re: (Score:2)
It's all very confused. I think I was confused actually, they seem to be talking about add-ons but calling them extensions.
I give up.
Comment removed (Score:5, Informative)
Re:Bullshit power grab. (Score:4, Insightful)
Your points are good ones, but I think you misunderstood Mozilla's terminology. "Add-ons" is a blanket term Mozilla uses for any modular component that can be added to Firefox - examples of add-ons are extensions, plugins, search engines, dictionaries, themes and language packs. The native code objects you're thinking of are termed "plugins", whereas "extensions" are actually the more commonly-used things that you were calling add-ons.
The thing being discussed in the article actually has nothing to do with plugins such as Flash, but rather is about Mozilla removing a specific vector that was being used by other applications to secretly install extensions onto Firefox without the users' permission (and worse - the users can't remove these extensions from the add-on manager). So the removal of sideloading is a good thing. Users can still install their own extensions manually without involving Mozilla (that isn't what "sideloading" refers to in this context) - the change is that other applications running on your computer can't install extensions onto your browser without your consent any more.
Re: (Score:1)
the users can't remove these extensions from the add-on manager
Then why not just make it available for consumers to remove these extensions from the add-on manager? Why get rid of a tool?
Re: (Score:2)
Re: (Score:2)
The app maker can still deliver their code, just through the front door, not through a hacky backdoor.
Re: (Score:3)
First, this is about extensions which are different to add-ons. Extensions are native x86 code running inside the browser process, like Flash. Second, you can still use them, you just won't be able to load them in this particular way. The most common use is for antivirus apps to install some crapware extension that is supposed to protect you but is actually full of security holes. The second most common use is malware. AV software will be better served using add-ons. Flash is dead and the only other extension most people care about is for DRM infected media playback on Netflix etc, which comes installed with the browser anyway.
Please report the above post as a victim of mod abuse. There is nothing about this post that is a Troll If anything it should be modded +1, Informative.
I am weary of extensions. (Score:2)
Having extensions installed from placing a file into a folder, is just scary. It is like IE6 with Active X. Where malware can be installed simply by th
Re: (Score:2)
Re: (Score:2)
Which means if I want to ship an extension via the system's package management, I've got problems, don't I?
In recent years firefox has been on this kick to protect us from our own hard-drives, as though there's something inherently better about trusting crap off of the web.
Re: (Score:2)
Re: (Score:1)
Comment removed (Score:5, Informative)
Re: (Score:2)
So I was unable to find at a glance whether I can sign my own XPI if I were so inclined:
"Regardless of the sideloading method used, you must prepare the add-on as follows:"
"Sign the add-on in addons.mozilla.org (AMO)."
The first person to point out this is how they were doing it to desktop deployments was told to use Windows Group Policies, but nothing about OSX or Linux.
They needed to be very crisp about other ways to do it if they have an equivalent.
It was deficient that the extensions would exist without
Comment removed (Score:5, Informative)
Re: (Score:2)
Are you able to install your own certificates? In other words, if I had an add-on I wanted to keep *completely* in house without mozilla ever seeing it and sign it myself instead, is it possible?
Firefox ESR for in-house extensions (Score:2)
If you're keeping extensions in house, I'm guessing that Mozilla would recommend that you use Firefox ESR (which gets updated annually instead of every few weeks).
Re: (Score:2)
>"If you're keeping extensions in house, I'm guessing that Mozilla would recommend that you use Firefox ESR (which gets updated annually instead of every few weeks)."
Actually, ESR gets updated almost as much as the other branches. But it doesn't change functionality with those updates. No features are added or removed. So the updates consist only of bug fixes and security patches. The idea is that it isn't constantly breaking compatibility and requiring retesting with stuff.
Comment removed (Score:4, Informative)
Re:BEFORE ANYONE COMMENTS (Score:5, Insightful)
The headline is misleading, if not completely false
This is absolutely correct, this is on purpose misleading just to incite people to get angry for no absolute reason. The method that is being removed is an incredible old method for side-loading that was around shortly after Firefox 4 back when Mozilla was priming for Prism [mozilla.org] and going the way of Firefox OS [wikipedia.org]. That was way back when people thought they would be writing desktop applications using XUL. Side loading by the vast majority of users does not use this method.
Firefox will continue to have the ability to sideload .XPI files using "Install Add-on From File" within the extensions manager.
Exactly. Mozilla is still supporting side loading, just not side loading via this old ass method. The headline for this article is pure bullshit, is completely hyped up to get people angry when they need not to be, and is a fucking disgrace to the term "news". This is complete garbage.
Re: (Score:2)
Exactly. Mozilla is still supporting side loading, just not side loading via this old ass method. The headline for this article is pure bullshit, is completely hyped up to get people angry when they need not to be, and is a fucking disgrace to the term "news". This is complete garbage.
I see you've never heard of clickbait before. Unfortunately, that's what news is these days, just a bunch of hyperbolic shit.
Another block for admin control of their systems (Score:2)
Re: (Score:2)
How does this affect "Dissenter"? (Score:2)
Some time ago, gab.ai (aka "nazi twitter", though that's perhaps unfair) established an addon called "Dissenter". This addon allows people to comment on any article- anyone running the addon will see other comments from other users of the addon.
Dissenter, like Gab, is a free speech platform- meaning that all the rabble that have been kicked out of every other space gather there. Which means you'll find, well, exactly what you expect there. Free speech is absolutely not tolerated by Mozilla and Chrome (or
Re: (Score:2)
Ehhh, I just read more of this. I think you'd still be able to install it by shoving it into your profile directory or something. If that's the case, then I have no such concern. I think the summaries of this I've seen have been overly hyperbolic, unless I'm missing something.
Re: (Score:2)