Q1. What is the problem that you are trying to solve?
Mozilla is (again) hopelessly lagging behind updating the browser extension in their addon catalog.
Given that new releases also fix security issues in the browser extensions, it is crucial to be able to update them in a timely manner and not having to wait forever on some third parties broken build infrastructure. (Or whatever flawed mechanism is holding up the extension updates at mozilla with increasing regularity)
Q2 - Who is impacted?
At least everyone using Firefox (haven’t checked if it’s as bad for Chrome-based browsers)
Q3 - Why is it important and/or urgent?
Browser extensions are often outdated for weeks in mozillas extension catalog, potentially leaving users vulnerable to security issues.
Q4 - What is your proposed solution? (optional)
Providing pre-build extensions with every release (on github) so everyone can immediately update from a trustworthy source.
Q5. Community support
People can vote for this idea to show traction:
Must have: this is critical for me to have this
Should have: this is important for me to have this
Could have: this could be nice to have
Won’t have: we should not schedule this (explain why)
Hi sko, thanks for raising this. I agree that delays in Firefox extension updates are especially frustrating when a release includes a security fix.
Publishing a build on GitHub alone would not solve the installation problem: Firefox requires extensions to be signed by Mozilla, including those distributed outside its add-on catalog. Mozilla does offer an unlisted signing route, which may let us distribute a signed extension ourselves. We’ll look into whether that could provide a useful fallback when a listed release is delayed, and how updates would work for people who install it.
Signing would still go through Mozilla, so I can’t promise this would bypass every delay. Thanks for the suggestion. I updated the title of your request accordingly.
TBH I couldn’t care less about their signature. Given the amount of garbage and malicious extensions that are/were distributed and signed via their catalog (or e.g. ‘officially looking’ extensions which were siphoning data to 3rd parties), this signature is rather meaningless.
Disabling the requirement for their signature is trivial (xpinstall.signatures.required=false) and I’d prefer downloading an extension from its original repository/project homepage 100% over some dubious app-store/catalog which is known to happily distribute malicious content. (Same goes for the android ecosystem and its google store - TBF, mozilla isn’t as bad as the google playstore, but I still trust an official source more than their catalog)
I’m not familiar with how signatures are checked in firefox, but if you can make it check signatures against another (your) certificate, which one can import e.g. during installation/onboarding, this would be a much preferred route to verify the extension is legitimate. Otherwise the tried-and-trusted way of distributing MD5-hashes alongside with the builds would also be sufficient IMHO.
Must have: this is critical for me to have this
Should have: this is important for me to have this
Could have: this could be nice to have
Won’t have: we should not schedule this (explain why)