Hacker News new | ask | show | jobs
by clipsy 747 days ago
This sort of thing is exactly why browser extensions never should have required Mozilla's "approval" in the first place; forcing people onto beta or developer builds to have proper control over their own software is an appalling failure to live up to their stated ideology. If they wanted to "protect" average users, they could have defaulted to only allowing approved extensions and made it clear how to opt out for users who wish to do so.

This sort of condescending, controlling, anti-user behavior was one of the reasons I left Mozilla, and the politically/culturally difficult situations it puts them in are a bed they have, unfortunately, made for themselves.

3 comments

Deep breath... the extensions are still signed.

If Mozilla refuses to sign the extensions, then we can pick up the pitchforks again.

What other browser might you recommend other than Firefox?
The depressing truth is I can't recommend anything. Firefox soft-forks can easily allow unrestricted use of web extensions, but I haven't kept up with which ones are popular and actively maintained so I can't recommend anything specific. If Mozilla ends up standing behind this decision I guess it'll be time to do some research.
Mozilla has been problematic for a while now, both with personnel having some... strong political ideas, their governance, executive pay, product direction....

Ugh, I don't want to go back to a chromium based browser but I don't know how what other options I have at this point, short of dropping down to links/lynx/elinks ..

I was told recently that their executives attempted to start an AI initiative without involving anyone from their data engineering team.
firefox could have some of the wackiest politics in the world but that fact remains that Google/Chrome is one of the key linchpins for the global corporate surveillance capitalism panopticon that we have today.

I still feel like it's an easy recommendation compared to the rest of the browser market.

what's wrong with strong political ideas, as long as they're the right ones?
> as long as they're the right ones?

Which ones are the right ones? Yours? Mine?

I honestly can't tell it the was meant sarcastically.

Who defines what the "right" political idea is? And do you really want to live in a society limited only to ideas that are deemed as the "right" ones by whoever has that power?

That's kind of how society works and why we have democracy.
Ladybird browser.
Not yet usable for any real work.
You can do the same with Firefox. Simply use Beta, Dev Edition or Nightly. The first two are very stable. You just need to flip `xpinstall.signatures.required` to `false` in about:config.
I plainly stated that in my original post:

> ... forcing people onto beta or developer builds to have proper control over their own software ...

1. It was for squingz 2. No one is forcing you to use Firefox. You don't even pay for it. You should have read the Open Source license buddy.
I'm stating my opinion, not asking for a refund.
The answer people don't want to hear is that the answer is to abandon the web. The standards are too complicated and evolve too fast. It costs too much. The bills have to be paid and that means everyone has to sell the users out "just a little bit, but at least we are better than the other guy".
Ungoogled-Chromium. Literally the only way to install extensions on it is to sideload them. But of course, it won't survive the Manifest-V3 onslaught.

I wish some talented bunch of people forked Brave to allow sideloading extensions and strip it of the crypto stuff.

Thorium, Mercury, or LibreWolf.
Fennec
> browser extensions never should have required Mozilla's "approval" in the first place;

You don't need Mozilla's approval; anyone can publish an add-on anywhere and anyone can install it in Firefox. I've distributed some bespoke non-public addons like this.

It's just the Mozilla add-on website/listing that's curated, which seems reasonable; it's their website and they can have their rules.[1] You can make your own "clipsy add-on listing" website if you want.

[1]: in this case, it's not even "banned", just not displayed in Russia. It was probably a "ban these extensions or we'll ban all of Firefox" type scenario. Saying "njet" to Putin is tempting, but how does all of Firefox being banned in Russia help Russian people? It doesn't. You may not like the situation, but simplistic takes which simply ignore the reality of the situation are not serious.

The extension needs to be signed by mozilla for the normal production builds of firefox to let you load it on startup. If it isn't signed, you need to manually load it in using about:debugging each time you restart firefox.
Mozilla is not preventing from signing anything here (and the "security checks" on who can sign are so weak it might as well not exist in the first place).
Same applies to Chrome as well by that logic; it allows you to sideload unverified extensions too at the cost of annoyingly making you set it up at every startup.

I guess we're all better off using Chrome then?

Okay, but you've moved the goalposts from

> You don't need Mozilla's approval

to pointing out that Mozilla has approved (signed) this extension.

That's you're pedantically language-lawyering my post while not engaging with the far greater falsehood that the previous poster was perpetuating is not a good look.

And the reality is Mozilla can always block any extension they want. They can just change the Firefox source code. It doesn't matter what functionality does or doesn't exist now or what the policy they do or don't have – everything can always be changed. That's true for almost anything.

So what they "could do" is a complete distraction in the first place because the "could do" anything. What they ARE doing matters.

No, pointing out that your claims are conceptually false is a fine look.

It's not about things Mozilla could theoretically do to block you, it's that they require you to proactively get their permission to run an extension (in a prod version of the browser on an ongoing basis, which I think is reasonable table stakes). Here's their official docs for self-distribution, i.e. not using the AMO at all: https://extensionworkshop.com/documentation/publish/submitti... Notice that step 1 starts with giving Mozilla your extension to approve of, step 4 goes so far as to say that if your extension doesn't pass their checks then

> The message informs you of what failed. You cannot continue. Address these issues and return to step 1.

then step 7 is make sure Mozilla reviewers can read your source code, step 9 is wait for them to get back to you, and step 13 is download the XPI that Mozilla has approved to be allowed to run in their browser.

So yes, you absolutely need Mozilla's approval to publish an extension, even if you self-publish the XPI after they've blessed it. If they do not perform the action of signing it, they don't need to change any source code, it won't install. It may be true that in this case they have given that approval, but that doesn't invalidate the general point, and this is a fundamental restriction, not "language-lawyering".

I have to disagree that I'm perpetuating any falsehood here. Mozilla literally needs to approve an addon for it to behave normally. That you are satisfied with the process they have for approving doesn't change that.

To me it seems absurd for a company that claims to be so pro-privacy to not allow any genuinely private extensions to exist. Anyone who wants to make a 'real' addon has to share their code with mozilla.

> You don't need Mozilla's approval; anyone can publish an add-on anywhere and anyone can install it in Firefox.

Nope. Not on Android.

Yep, but you can use Fennec from FDroid.
how do i install xpi on fennec? i'm getting file not found when trying to open xpi with fennec app
Settings > About Fennec. Tap the logo five times to unlock the debug menu, then there will be an option to install addons from a file.
This addon cannot be installed because it has not been verified
thanks, didn't know about that. with all that censorship i been backing up a lot of programs and source tarballs locally. perhaps one day i'll go completely offline and off the grid and move to the mountains or some shit like Tuva where i will have goats and cows livestock. it's all getting so tiresome, i want out of this technological hell.
Yes, seems to be exact way out