←back to thread

288 points fernandotakai | 4 comments | | HN request time: 0.003s | source
Show context
nathanb ◴[] No.10039122[source]
It's the "no override" part that concerns me.

I created and maintain an extension that is used by visually-impaired people around the world (it has been translated by volunteers into Dutch and Chinese, for example).

Occasionally a Firefox update breaks this extension. OK, fine, that's the cost of doing business. Of course, the automated compatibility report that Firefox creates is utterly useless; it almost never catches the breakage. But that's a side rant....

There can be a decent turnaround lag (sometimes on the order of a few days) to get a new version of an extension reviewed by addons.mozilla.org. In the meantime, I have made a habit of building a new version of the extension and giving it to anyone who asks. Some people rely on it to use the web and can't wait for Mozilla to do their thing (another side rant: I once stupidly forgot to check in a key resource. I've since changed my development process to keep this from happening again. But the non-functional extension that I pushed passed Mozilla's review just fine. Makes me wonder how much value the review process is really adding.)

If I want to be able to continue this process, I will need to sign the extension myself (and who knows what histrionics Firefox will throw if a user tries to replace an extension with one that has the same UUID but a different signature!)

replies(8): >>10039130 #>>10039580 #>>10039659 #>>10039887 #>>10039941 #>>10040621 #>>10040999 #>>10041707 #
cpeterso ◴[] No.10039659[source]
> If I want to be able to continue this process, I will need to sign the extension myself

This seems like a good approach to me. Instead of Mozilla itself signing developers' extensions, why can't Mozilla issue certificates so developers can sign their own extensions locally? If a developer turns rogue, Mozilla can revoke their certificate.

replies(1): >>10040272 #
gerv ◴[] No.10040272[source]
Because bad guys can just keep getting new certs when their old ones are revoked, unless you do identity validation (which costs money as it requires actual humans, so the certs can't be cheap or free).
replies(1): >>10040680 #
1. schrodinger ◴[] No.10040680[source]
Reviewing plugins costs somewhere around the same amount of human time/money, no?
replies(3): >>10040769 #>>10041191 #>>10041288 #
2. malka ◴[] No.10040769[source]
If their review are as thorough as Android app's one, they cost about nothing.
3. reubenmorais ◴[] No.10041191[source]
Add-on reviews are done largely by volunteers.
4. soapdog ◴[] No.10041288[source]
the addons signage is an automated process.