Mandatory signing requirement for add-ons is coming

Talk about add-ons and extension development.
Post Reply
User avatar
Frank Lion
Posts: 21177
Joined: April 23rd, 2004, 6:59 pm
Location: ... The Exorcist....United Kingdom
Contact:

Re: Mandatory signing requirement for add-ons is coming

Post by Frank Lion »

mightyglydd wrote:Frank, FWIW I've been offered -signed Tiger and Graphite updates, 'updated' a couple of times, but on restart the unsigned version remains and I'm offered the update again..and again..and.. @About 12 extensions 'signed' OK ?

As far as Firefox themes and extensions on AMO are concerned, as some of mine are, the important point is this - users are being offered exactly the same themes and extension versions (as far as the dev is concerned) as they would have been offered the last time the dev themselves updated them.

I'm also betting that AMO hasn't yet cottoned onto the fact that multi-package-install addons (a system that was their idea) will require a more complex signing procedure, i.e. each part will require signing, not just the outside shell or the main .jar/.xpi. This many will recognise as the 'Whoa! I didn't see that one coming!' approach that we all know and love from Mozilla.

In other words, from a practical point of view, users neither gain nothing or lose nothing. Yes, it will be a minor irritation to witness AMO **** this up over and over again to no effect, but it makes no substantial difference. When the dust settles, you just have the same theme and extension versions as you would have done last week, except that, eventually, the version numbers will be suffixed with the word 'signed'. A non-event.

Where I suspect users will feel a proper impact from this *insert your own term* is later on when the non-AMO addon signing is supposed to take place and the reason why requires a small explanation - to the casual observer, addons on AMO seem much the same as they have always done, plenty of them and doing different things, etc. Unfortunately, close inspection reveals that many of the present day addons are actually total crap, churned out by vested/commercial interests and that many of the 'old school' addons, i.e. ones that actually do something useful, are now hosted elsewhere.

The reasons for this vary from a simple desire for independence, right through to a deep seated loathing of the 'behind the scenes' behaviour over the years by the AMO people or even of Mozilla themselves. It is to the credit of the latter sector that they still hold dear their values and self-imposed responsibilities to their users and still maintain their stuff to the same high standards of old. Standards that always did spring from the moral values and responsibility of the theme and extension writers themselves, however much AMO kids itself that it has somehow played a part. Well, unless allowing utter crap to be hosted there by less ethical interests constitutes playing a part.

Time will tell, but I do know that many of those self hosting authors would rather eat worms than submit their stuff to AMO for vetting/signing. Which, I suspect, will result in the vanishing of many, extremely good and useful addons and that, of course, would have an impact of users. Although, in fairness, users of social media addons would be totally unaffected.

Then again, that group seem to be unaffected by very little, apart from just how quickly they can upload a photo of the meal that they are about to consume or someone else being run over by a bus, etc.
"The only thing necessary for the triumph of evil, is for good men to do nothing." - Edmund Burke (attrib.)
.
User avatar
mightyglydd
Posts: 9813
Joined: November 4th, 2006, 7:07 pm
Location: Hollywood Ca.

Re: Mandatory signing requirement for add-ons is coming

Post by mightyglydd »

Oops.. I thought this was a bit OT, deleted and went through the 'proper channel' . :)
@It's
allowing utter crap to be hosted there by less ethical interests
that really gets me steamed, jeez their past justification for allowing adware infested crap's been stomach churning, surely it kinda negates the whole point of 'signing'..?
Last edited by mightyglydd on May 29th, 2015, 7:06 pm, edited 1 time in total.
#KeepFightingMichael and Alex.
User avatar
LoudNoise
New Member
Posts: 39900
Joined: October 18th, 2007, 1:45 pm
Location: Next door to the west

Re: Mandatory signing requirement for add-ons is coming

Post by LoudNoise »

It will be substantial to the folks who write new extensions. I use an extension that has been trapped in "not reviewed" forever. Not a big deal now but I would suspect that it will be so in the future.

I was under the impression that themes (a.k.a Complete Themes) didn't have to be signed. If that is limited only to personas this means that BrandThunder and their ilk will still be allowed free rein.
Post wrangler
"Choose between the Food Select Feature or other Functions. If no food or function is chosen, Toast is the default."
User avatar
KilliK
Posts: 612
Joined: June 18th, 2004, 7:11 am

Re: Mandatory signing requirement for add-ons is coming

Post by KilliK »

That is not at all an accurate characterization. Pretty much every piece of software you install from online (including Flash!) tries to install some kind of toolbar or at least a search/homepage hijacker. Mozilla's own metrics show a HUGE disparity from the number of extensions installed in the wild and the number of extensions installed that are hosted on AMO. The question here isn't whether crashy, privacy-leaking sideloaded addons are a problem... because that's universally accepted. The question is whether this insanely complicated and clunky fix is actually worth it and will work.


well, it seems to have worked for Chrome:

http://blog.chromium.org/2015/05/contin ... -from.html

ofc, this might not be the same case with FF, we will find out when 45 comes out.
User avatar
mightyglydd
Posts: 9813
Joined: November 4th, 2006, 7:07 pm
Location: Hollywood Ca.

Re: Mandatory signing requirement for add-ons is coming

Post by mightyglydd »

KilliK wrote:well, it seems to have worked for Chrome:
Yeah right ! On what planet, I've been ****** twice by Chrome Extensions :roll:
#KeepFightingMichael and Alex.
User avatar
KilliK
Posts: 612
Joined: June 18th, 2004, 7:11 am

Re: Mandatory signing requirement for add-ons is coming

Post by KilliK »

mightyglydd wrote:
KilliK wrote:well, it seems to have worked for Chrome:
Yeah right ! On what planet, I've been ****** twice by Chrome Extensions :roll:


then you belong to the 25% :D
User avatar
LoudNoise
New Member
Posts: 39900
Joined: October 18th, 2007, 1:45 pm
Location: Next door to the west

Re: Mandatory signing requirement for add-ons is coming

Post by LoudNoise »

By the way, I am thinking about doing a round up and a 40 day sticky on this. Is this a good idea or not?
Post wrangler
"Choose between the Food Select Feature or other Functions. If no food or function is chosen, Toast is the default."
User avatar
patrickjdempsey
Posts: 23686
Joined: October 23rd, 2008, 11:43 am
Location: Asheville NC
Contact:

Re: Mandatory signing requirement for add-ons is coming

Post by patrickjdempsey »

Frank Lion wrote:
patrickjdempsey wrote:For the curious: this is...

...Frank's post on this last week? -

viewtopic.php?p=14167703#p14167703


Oooops... was at the beach!
Tip of the day: If it has "toolbar" in the name, it's crap.
What my avatar is about: https://addons.mozilla.org/en-US/seamonkey/addon/sea-fox/
User avatar
patrickjdempsey
Posts: 23686
Joined: October 23rd, 2008, 11:43 am
Location: Asheville NC
Contact:

Re: Mandatory signing requirement for add-ons is coming

Post by patrickjdempsey »

Huh?
https://bugzilla.mozilla.org/show_bug.cgi?id=1038068

I'm very confused. Doesn't having a pref that disables this defeat the entire purpose? Why bother with the build switches and all the rest? Heck, why bother with any of it if an extension can just change the preferences and defeat the block?
Tip of the day: If it has "toolbar" in the name, it's crap.
What my avatar is about: https://addons.mozilla.org/en-US/seamonkey/addon/sea-fox/
Lemon Juice
Posts: 788
Joined: June 1st, 2006, 9:41 am

Re: Mandatory signing requirement for add-ons is coming

Post by Lemon Juice »

patrickjdempsey wrote:Huh?
https://bugzilla.mozilla.org/show_bug.cgi?id=1038068

I'm very confused. Doesn't having a pref that disables this defeat the entire purpose? Why bother with the build switches and all the rest? Heck, why bother with any of it if an extension can just change the preferences and defeat the block?

The pref will work only in nightly, aurora and unbranded builds.
*** SeaMonkey — weird name, sane interface, modern bowels ***
Mouse Gestures for SeaMonkey/Firefox
Convert Fx and TB extensions to SeaMonkey
User avatar
Frank Lion
Posts: 21177
Joined: April 23rd, 2004, 6:59 pm
Location: ... The Exorcist....United Kingdom
Contact:

Re: Mandatory signing requirement for add-ons is coming

Post by Frank Lion »

One question that I've been asked a good few times now (which is a reasonable one if you are a user and not involved in the development of extensions, etc) is this - 'If the addons on AMO have already been reviewed and passed as OK, why do they now have to be signed to show that they are, er, OK?

The answer is a simple one, they can be faked. The only thing that identifies that addon as being that addon on AMO is a single internal identifier or GUID, as we grandly call it.

Thus, if they weren't all signed, a villain could take their rogue toolbar or whatever, give it the GUID of a legitimate AMO addon and it would install fine. (of course, non-moran villains will now hit the app build identifiers and update channel prefs instead, but that's a subject for another day.)

That's why I wrote earlier that this AMO signing part is a non event for users as it is just a technical stage that needs to be gone through, before tackling the original goal of this exercise. That being the prevention of installation of non-AMO routed 'rogue' extensions.

Well, that's what they tell me the goal is. Then again, I was also told that there were WMD in Iraq.

patrickjdempsey wrote:Oooops... was at the beach!

Ah, the old 'was at the beach!' excuse, used it many times myself.
"The only thing necessary for the triumph of evil, is for good men to do nothing." - Edmund Burke (attrib.)
.
User avatar
therube
Posts: 21714
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Re: Mandatory signing requirement for add-ons is coming

Post by therube »

Oh crap.
So I just "manually" looked up an extension & it says it's at version 2.5.1.1 & I'm thinking, oh, I've only got 2.5.1, wonder what change they made with "their" update to .1.1 ?
And then it dawned on me!


(When Sysinternals joined up with MS, their programs got an "agreement" speech & digital signatures, but were otherwise unchanged.)
Fire 750, bring back 250.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript
User avatar
patrickjdempsey
Posts: 23686
Joined: October 23rd, 2008, 11:43 am
Location: Asheville NC
Contact:

Re: Mandatory signing requirement for add-ons is coming

Post by patrickjdempsey »

The thing is that I don't think Mozilla's goal here has ever been to prevent genuinely "rogue" extensions from some theoretical future... but to prevent the incursion of lazily-written, quasi-legal, "unwanted" extensions as they exist today. I don't even want to know what kind of nightmare series of foot guns these cats would come up with to try to tackle a genuine threat.
Tip of the day: If it has "toolbar" in the name, it's crap.
What my avatar is about: https://addons.mozilla.org/en-US/seamonkey/addon/sea-fox/
User avatar
jez
Posts: 123
Joined: October 16th, 2003, 1:20 am

Re: Mandatory signing requirement for add-ons is coming

Post by jez »

Interesting. I just uploaded a new version of one of my Firefox-targeting extensions, and it has been approved. This version, unlike all the previous versions, does not end in ".1-signed".

Does this mean they didn't sign it, or is it just that only existing versions get suffixed with ".1-signed" and from then on the version numbers are normal again even though the extensions are signed?
== Jez ==
User avatar
jez
Posts: 123
Joined: October 16th, 2003, 1:20 am

Re: Mandatory signing requirement for add-ons is coming

Post by jez »

To answer my own question, the new version still has the "META-INF" directory in the .xpi, so it still seems to be signed by AMO, even though the version number doesn't end ".1-signed".
== Jez ==
Post Reply