Slashdot Mirror
Firefox 48 Released With Multi-Process Support, Mandatory Add-On Signing (softpedia.com)
Mozilla on Tuesday released Firefox v48, touted as one of the most important updates the browser has ever received. With the new version, Firefox starts migrating users to using mullti-process threads (e10s, Electrolysis), and it is also the first version to ship with Rust component. In addition, Firefox is now also making add-on signing mandatory. From a Softpedia article: Announced last year, Electrolysis, e10s, or multi-process support is Firefox's ability to process core browser operations separately from the content viewed on a Web page. Multi-process support allows a page to crash without bringing the entire browser down with it and improves the browser's overall performance. e10s rollout will take place in two phases, first in Firefox 48, and it will finish in Firefox 49, set for release on September 13, 2016. Mandatory add-on signing refers to Firefox preventing users from installing any add-ons that have not been approved by Mozilla's testers. This is something similar to what Chrome employs, but Firefox users have been spoiled all these years, always having the capability of installing any add-on they've desired. Rust is a programming language that's a revamped and improved version of C++ but that protects developers from accidentally including dangerous memory bugs in their code. It achieves this by how the language was constructed and by how developers write the code.
accidentally including dangerous memory bugs in their code
Good, now I can be assured that all of my dangerous memory bugs in my code are intentional.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I've been on Nightly for awhile now and the performance with e10s is now almost as good as Chrome's. Firefox Hello is thankfully going to get axed in a future release, and if Mozilla continues to fine-tune the performance a bit more and rips out Pocket, I think Firefox will be back on top.
Firefox has about 10% market share (several studies collected here), which is hundreds of millions of people.
Can we please stop posting about minor, useless OSS software releases? It's not like anyone uses this piece of shit anymore.
Really? Wow and here I thought I was using Firefox to type this. Thanks for letting me know that I'm not really using the browser I think I am.
I was about to rush and grab it until...
"Firefox is now also making add-on signing mandatory"
I don't see what the big deal about this is. Everything on addons.mozilla.org is already signed. If you have some legacy thing that hasn't been signed yet, you can use the Extended Support Release until Firefox 52.
No changes in the UI. And Classic Theme Restorer still works: https://addons.mozilla.org/en-...
I was kind of excited by this so updated immediately instead of my usual process of waiting a couple days.
While it was updating I did another unsual thing - clicked through to the article - where I read the following:
That's probably going to drop a bit it they break all the add-ons.
(Again...)
No sig today...
Firefox users have been spoiled all these years, always having the capability of installing any add-on they've desired.
Yes how pampered a life I've led in my fantasy-land where the computer performs in accordance with my instruction. oh i was a fool to think personal computing would remain my own personal fucking shangri-la. Thank god Mozilla has come to the rescue and spirited me away from this dubotcherous land of sodom called personal computing. But hey, you know, whatever it takes for your corporate masters to reign in ad blocking, cookie whitelisting, and script blocking. I just cant wait to watch another taylor swift autoplay video.
Good people go to bed earlier.
"mandatory add-on signing refers to Firefox preventing users from installing any add-ons that have not been approved by mozilla's testers. ... firefox users have been spoiled all these years, always having the capability of installing any add-on they've desired."
of course doing what we "desire" should not be allowed.
stay within the plantation and obey the rules, that way nothing gets broken or get crashed (hopefully). and nobody gets "spoiled", god forbid!
we, the user children, should not be 'spoiled" by allowing us to make mistakes, by too much freedom to do what we 'desire'.
be calm, be correct, be at peace, ... as in "rest in peace"? in mozilla's politically correct heaven.
That's probably going to drop a bit it they break all the add-ons.
(Again...)
My interpretation of Mozilla's plans is that they plan to gradually deprecate XUL in order to give time for developers to keep their extensions working with every version of Firefox. So it's not as if they're all going to break overnight. Some will break and won't get fixed if they're not maintained, but that happens on every platform.
Ah, I follow your logic: "Whoa. Firefox is now better in performance and memory footprint than Chrome. But it has THE EXACT SAME ADD-ON SIGNING POLICY AS CHROME, so... you know... fuck it. I'll stay on the worse browser."
Replying to myself, because I realize this isn't entirely accurate: Firefox lets you host your (signed) add-on on your own site if you want. Chrome absolutely requires you to download it from Google servers.
The largest problem with mandatory signing is that you must send your source-code to mozilla to be signed and they do not (and really, can not) guarantee that it won't leak out to someone else. So if you have an in-house developed extension that contains proprietary business information, you must choose between getting it signed or running versions of firefox that do not receive regular security updates and do not have signature checking for any extensions at all, so are basically the worst of both worlds. They could avoid this problem with one level of abstraction, you sign your own extension then they sign that signature. They could even automate it so the extra layer of indirection is invisible to anyone who is OK with sending their source to mozilla for signing.
But even that's brittle in the face of unexpected circumstances. Which is the fundamental problem with the "everything not explicitly allowed is forbidden" security models. They have their place, but they do take the "general" out of "general computing." Unforeseen consequences and all that.
The correct solution would be to have a signature checking config setting stored somewhere that is writeable only by an administrator account. All the major OSes have that kind of ability.
The firefox executable is also admin writeable, so if someone were inclined they could run a binary patcher to hack out the signature checking in the binary itself. Might as well just put it in a config setting with the equivalent permissions. Save us all the trouble of having different builds.
I'd even go one step further and make it a list of extensions that don't need a valid signature so you don't give up the benefits of signature checking for all the other extensions just because you want to run one unsigned extension.
Splitting Firefox's tab data over into the "plugin container for Firefox" hasn't done much to improve Firefox's GUI performance. Once FF hits certain ram limits, it will start ignoring mouse clicks and keyboard shortcuts. So while FF may claim its NOT unresponsive, I think the fact that now it's acceptable for FF to IGNORE hardware input from the user, instead of delaying it until it can process is far worse.
I can't wait to get off this sinking ship. Maybe Piro could crowdfund Tree Style Tab for Chrome.
Sorry for the double post, but see here: https://wiki.mozilla.org/Add-o...
"How will the unbranded versions of Firefox work?
They work just like Firefox, with two differences: they will have a setting to disable mandatory signature checks, and they will not have the Firefox name and logo (instead using a generic name and logo). These builds are available in the en-US locale only."
What if add-ons don't sign? Can we still "force" them in?
See here: https://wiki.mozilla.org/Add-o...
They could avoid this problem with one level of abstraction, you sign your own extension then they sign that signature.
Mozilla won't blindly countersign extensions because it wants to avoid a situation where you sign an extension and then distribute it to the public without Mozilla having a chance to check it for the most obvious malicious patterns.
The correct solution would be to have a signature checking config setting stored somewhere that is writeable only by an administrator account.
Firefox ESR releases have such a setting. Firefox current lacks this setting because Mozilla wants to avoid a situation where it becomes common to social-engineer users into elevating to change this setting. Home users are more likely to use Firefox current, but they're also less likely to need an in-house private extension. Home users who make their own extensions can use Firefox Developer Edition.
Checking for the most common patterns just means people will find less common patterns. It isn't hard to avoid with trivial obfuscation.
Obfuscation kicks an extension into the manual review queue.
Mozilla is not capable of hand-inspecting add-ons to that level of certainty, they either automate signatures or they take way too long.
Mozilla automates signatures for easy cases and admits to "tak[ing] way too long" for hard cases.
Someone that naive can be social-engineered into running a binary patcher too.
There exist both branded builds and unbranded builds. Unbranded builds allow use of unsigned extensions but lack the Firefox name and logo. This gives Mozilla a hook to sue the distributor of such a binary patcher for trademark infringement.
Make it warn at every startup before the add-on is initialized that they are using a questionable add-on.
Or provide a separate way to install unsigned extensions in such a way that they're automatically uninstalled when Firefox is restarted. This appears to be the current policy, implemented through about:debugging.
I just don't see the supposed performance issues with FF.
FF is my daily driver though I have IE, Edge, Opera and Chrome also installed on my computer. I use them all for various purposes (Chrome for chromecast, Opera for side project work, IE and Edge for work and FF for personal/everything else) and I just don't see any performance differences. If there are, they are measured in time increments imperceptible to me.
My eyes reflect the stars and a smile lights up my face.
I have a bunch of old extensions that are not signed. [...] I sometimes like to edit extensions
If an extension is licensed for redistribution, you can solve cases 1 and 2 by submitting it to AMO as an unlisted extension.
Some extensions have code that can't be given to Mozilla for verification because the code is proprietary.
Organizations with in-house extensions experiencing case 3 can use Firefox ESR.
And even that misses the point, I think. Until now, Firefox also let you write and deploy your own unsigned add-on, even if you don't host it anywhere. There are businesses who have created Firefox add-ons specific to their corporate intranet. These add-ons are only used inside the company, they aren't hosted anywhere, no one wants them to be hosted anywhere. And more specifically, no one wants to submit their corporate property / business logic / trade secrets to Mozilla to be blessed with an unnecessary seal of approval.
This is now no longer possible unless you install a nightly FF build on every employee's computer.
FF has not been listening to the user for a long time. You can just use a fork. There are a few out there.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
Alternately, you can grab the add-on and push it to the add-ons server for signing yourself -- it's all automated. The point of signing is that it allows Mozilla to shut off malicious add-ons when they arise. As mentioned elsewhere, all add-ons hosted on Mozilla's servers have already been signed, so you'd only have to do this if you found some unmaintained add-on lying around elsewhere on the web. To be honest, that sounds kind of fishy, so I'd proceed with caution.
While what you say is true on some level - a compromised process can dick with your system, including other processes, just fine - you're missing the point of having a multi-process browser for security. The vast majority of what a browser does requires almost no access to the rest of the computer. You can have one container process that runs with user privileges and implements the few things the browser needs to be able to do to the system at large (save downloaded files, etc.) in a very secure manner, and is also responsible for launching sandboxed, low-privilege sub-processes that do the dangerous work of a browser (parsing web server responses, running plugins, executing javascript, etc.). If these sandboxed processes are compromised, the attacker can still fuck with your browser... but they can't get out into the rest of your system.
This is how Chrome and IE have worked for years (though Chrome's sandbox is a lot tighter than IE's). It's not just about stability/reliability, there's also a very real element of security here. Chrome's sandboxed render processes are so underprivileged that there's practically nothing a compromised one can do (to the rest of the computer) except try to attack its full-user-privilege container / broker process (through the IPC channels that let it do things like say "Please ask the user where they want to save this downloaded file"), but that is a very small attack surface compared to most of what a browser does, and the trusted process can have that attack surface very well-hardened.
There's no place I could be, since I've found Serenity...