Just Downgraded: Is there an Archive for Old Add-Ons?

[preg_match]

After upgrading to 60.3.3 and surviving the heart attack when I saw that some of my favorite add-ons no longer worked (no warning when upgrading!), I downgraded to 52.9.1 and am starting to feel a bit of relief

To reinstall some of the old add-ons which are no longer available, I had to look at an old profile back-up and grep the xpi files when none of the names where meaningful.

That worked a couple of times, but would anyone happen to know of a Repo somewhere with a collection of old add-ons?

And is everyone else surviving the upgrade?

[tanstaafl]

Old add-ons aren't removed from https://www.thunderbird.net/en-US/ . If you are searching for add-ons using tools -> add-ons -> extensions in Thunderbird, it might be hiding add-ons from you that you can't install. That search feature is pretty buggy anyways, for years it didn't find plenty of add-ons that I had no problem downloading using a browser and then installing.

One workaround is to use tools -> add-ons -> get-addons and then click on "see all" in the up&coming column. For example I can use it to browse to Color Folders which it warns me is not compatible (so it greys out the add to Thunderbird button) but still has a Download Anyways link. You could use that link to download that *.xpi file. If you wanted to try to install the add-on you could then do something like edit its manifest file to say it supported version 60 and then use the gear icon in tools -> add-ons to install the add-on from that downloaded file.

Some add-ons that don't formally support version 60 you can attempt to install if you set extensions.strictCompatibility false using the config editor. That doesn't mean they will work (60.* might be missing some APIs the add-on needs), it just means you can install them.

[tanstaafl]

The "party line" is that you ALWAYS need to use the latest version due to critical security fixes but in reality as long as you are careful on what attachments you open, don't use extensions like ThunderBrowse that try to turn Thunderbird into a browser, and don't enable "display attachments inline" you could safely stick with Thunderbird 52.9.1 for a year while waiting for things to improve. The major risk with Thunderbird is opening dangerous attachments since a email client has a much smaller attack surface than a browser.

IMHO your best defense is good judgement, being cautious and remembering that is trivial to spoof a From: address.

The security advisories in https://www.mozilla.org/en-US/security/ ... underbird/ are really describing potential security threats. Many of the security advisories start off with "In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts." My impression is that the caveats vary from release to release, but its common for many of the flaws not to effect mainstream users. I suspect these potential bugs are not widely exploited due to Thunderbird's small market share (compared to Outlook + Apple mail + webmail) and the success of cheap generic attacks (attachments with malware etc.).

One thing you will lose by sticking with an older version for a while is changes in what security certificates are considered trustworthy. For example Thunderbird (and most browsers) are starting to remove support for security certificates from Symantec and its subsidiaries due to irregularities they've discovered. https://blog.mozilla.org/security/2018/ ... tificates/

[preg_match]

Thank you very much for sharing these insights and tips, @tanstaafl. Food for thoughts!

Two of the add-ons that I couldn't find online and had to fish out of my own backups were AttachmentExtractor and FoxClocks. In the case of the latter, that might be because it was a separate download that never was on the TB add-on site.

I'll to my best not to use TB52 as a browser.

Thanks again.