Hacker News new | ask | show | jobs
by abrookins 3231 days ago
Totally valid. If they were going to change one thing about Safari, though, for me it would be to drop the required $99/year payment for a developer program membership just to distribute a signed Safari plugin. You can't really distribute plugins without a developer certificate, as Safari uninstalls them automatically when the browser restarts. Probably the worst Safari-related decision Apple has made recently, much worse than favicons, though I completely agree that they should return.
1 comments

You can always distribute unsigned ones. You lose the ability to auto update however, as well as the extension store
So far, I haven't found a way to stop Safari from uninstalling an unsigned extension when it restarts. Have you? Because that would be great! More conversation about this issue: https://forums.developer.apple.com/thread/3675
Yes I’ve found a way, enable the develop menu, and at the bottom of the menu you will see an option to “allow unsigned extensions” .
I've just installed the following extension, and it persists when I restart the browser:

https://github.com/JoeKuhns/PiedPiPer.safariextension

That extension is signed. You cannot build a .safariextz archive without paying for a signing certificate.
Indeed. If you add an unsigned plugin (that is, one lacking a .safariextz file) to Extension Builder and try to install it from there, and you do not already have a developer certificate, you will see the message, "Without a Safari Extensions Certificate, this extension will only be available until you quit Safari." And it will be so.
Firefox has a similar annoyance but at least it's not behind a paywall. I wrote a plug-in I intended to be for personal use but I had to register and publish it on their site because it was removed on close. I'm not sure why they want to encourage a bunch of crap in their add-ons store but what infuriates me to no end is that they think they know better than me what I want to allow to run on my machine.
> I'm not sure why they want to encourage a bunch of crap in their add-ons store but what infuriates me to no end is that they think they know better than me what I want to allow to run on my machine.

The issue, as always, are malware installers on Windows.

Many companies (including Google) pay developers on Windows to ship their addons (or even entire browsers) with the installer, and to auto-install them.

This is how Google got their toolbar addon installed everywhere in the past, how Chrome is installed as default browser without the user noticing, how Bing gets their toolbar installed everywhere, and so on.

It's also used by other actors, not quite as evil as Google or MS, to distribute their malware addons and automatically install it in browsers.

By enforcing registration on AMO, Mozilla can easily remove an addon that was distributed this way for all users.

AMO allows for unlisted add-ons that just get auto-scanned for obvious problems and then signed immediately. That's the preferred method for cases like yours.

Alternatively, you could run Nightly (or an unbranded build[1]) and disable add-on signing, although that opens you up to having _any_ unsigned add-on installed, not just your own.

[1] https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded...