DEdessant·Nov 1, 2019
Mozilla intends to remove all methods for installing private extensions in the release version of Firefox. The extension source code must be disclosed to Mozilla during signing, and it must adhere to their add-on policies [1].
Mozilla is blocklisting benign extensions distributed outside of Firefox Add-ons which do not follow these guidelines [2].
They are working on disabling a method which allows users with root access to configure Firefox to load unsigned extensions [3], citing concerns over adware with root access. The feature is being disabled even on Linux, where such adware was never really a problem, despite making several other use cases impossible.
Requiring extensions to be signed by default is a great initiative by Mozilla, but we must be given ways to install private extensions in the release version of Firefox without disclo
Read the rest
sing the source code to Mozilla, or worrying that an extension for personal use may be blocklisted.
Forbidding local extensions in the release version of Firefox, without a way to override the option, guarded by administrative access and appropriate warnings, is heavy-handed and has a questionable threat model.
Signing can be turned off in Firefox Developer Edition (based on Firefox Beta) and unbranded builds (no automatic updates), but those browsers are not meant for end users. We must be given ways to install private extensions in the best version of Firefox, and that is the release version of the browser.
Not even Google is this heavy-handed, they allow installing local extensions in Chrome after users enable an option, although a warning is shown on browser restarts about the presence of external extensions, which can be dismissed.
[1] https://extensionworkshop.com/documentation/publish/add-on-p...
[2] https://github.com/jeremiahlee/page-translator/issues/26
[3] https://bugzilla.mozilla.org/show_bug.cgi?id=1514451