Project Squeaky: Add-on File Registration

[u251]

https://groups.google.com/forum/#!topic/mozilla.dev.planning/zLwLNyWm7es

This was recently posted and I was hoping to find out the exact implications for addon devs? Does this mean that 'unregistered' addon will be blocked from being installed?

[patrickjdempsey]

It is pretty obvious that this would have to be able to be disabled for Addons Developers since it would make it impossible to use Firefox as a development platform for a new Addon.

[LoudNoise]

It would also mean that any extensions delveloped by a company for internal use only would have to be registered.

[patrickjdempsey]

Yup. I think this is one of those features that as long as it can be turned off for "expert" users it would actually be a reallly good thing for grandma who just wants to check her email. I'm all for it. Mozilla has been beating around the bush about how to handle dangerous global extensions for a LONG time now. Unfortunately, since their official policy is to allow search hijackers under the guise of "monetization", this annoying and dangerous "feature" (which keyword.URL was removed to "fix") will undoubtedly continue.

[Elbart]

There will be a transition period where unregistered files will only be shown as an error in the Browser Console. The following step would be to show the message, but with the option to override it. Having no way to override it will be the third step.

Yeah, no, not with this user.

[LoudNoise]

By the way, the google doc does speak of either a whitelist (unuseable) or a command line option (-noaddonreg). Assuming A) they ever actually get around to this and B) they don't blow up a number of other things in the process, the command line is perfectly acceptable to me. We could easily roll out a new shortcut and it would be easy enough to add to the short cuts at home.

[patrickjdempsey]

If there's a command-line option, surely there would be an about:config pref as well.

[LoudNoise]

Patrick- you are assuming that AMO has a set of clues again....

[patrickjdempsey]

Either way, it won't bother me. Whatever switch will be required by developers will be on all of my machines anyway. They can make all of the threats they want, but it's impossible to develop extensions without an override.

And like I said, as long as "legitimate" extensions hosted on AMO continue to hijack the urbar search then all bets are off. You can't punish one group of extensions and break major features to try to stop a behavior that you ALLOW for another group of extension. All you have to do is read the Bugzilla entries about Babylon Toolbar to see how pointless it all is without a systemic ban on the behavior.

[LoudNoise]

Or Brandthunder or those idiots who purchased dead extensions and made them into spyware. The entire idea of AMO is broken and the folks in charage simply don't care. While Mozilla is chasing Chrome they aren't bothering to take Google's good ideas like providing a market place where folks who improve functionality can be paid for their efforts.

[patrickjdempsey]

Well, they DO have a "marketplace" but you can't even look at the website without a mobile device. Eventually it will be merged with AMO... so, we can expect some serious fun then.

[LoudNoise]

I am looking forward to it . With a bit of luck it will happen at the same time Squeaky goes live. Now that would be fun

[Elbart]

If there's a command-line option, surely there would be an about:config pref as well.

... which would be easy to modify for any setup-program. So the gain regarding security will be what?

Am I alone in thinking this is just like Chrome Web Store? Mandatory registration, sideloading being a PITA, constant calling-home...

[LoudNoise]

AMO already calls home alot.

[lithopsian]

AMO already calls home alot.

Every day, every addon, plus some ... even if you disable updates.