Firefox Changing Policy for Add-Ons!

Corrine

Administrator,
Microsoft MVP,
Security Analyst
Staff member
Joined
Feb 22, 2012
Posts
12,394
Location
Upstate, NY
When Firefox version 57 is released, only add-ons built on the new WebExtensions API will work. As indicated in Martin Brinkman's article, Firefox will only support WebExtensions by the end of 2017, the following add-on types will be allowed in Firefox 57:
  • Signed WebExtensions.
  • Signed bootstrapped system add-ons.
  • Language packs.
  • Dictionaries.
  • OpenSearch plugins.
  • Lightweight themes.
Personally, it was the "rapid release" schedule that sent me back to using Pale Moon several years ago when I got tired of what seemed more like change for the sake of change rather than browser improvements. As Martin said in the referenced article,

Some Firefox users who rely on certain add-ons may migrate away from Firefox to Pale Moon or another third-party browser that shares code with Firefox.

I'm glad I already made that move!
 
I am not a big add-on fan so this move does not affect me. I switched to PM (when you first introduced me to PM) as my first secondary scanner because of security concerns with FF, not because of the "rapid release" schedule.

I thought Martin's closing sentence was most telling,
It is too early to ring the Doomsday bell but if this move tanks, it could very well have disastrous consequences for Mozilla.
 
I agree with Martin's closing.

At LzD a member was upset because the latest Pale Moon upgrade no longer supports Jetpack/SDK extensions for technical reasons and the person was unable to find substitutes that meets his needs. According to The Future of Developing Firefox Add-ons, the changes could also eliminate some of those as well if they use "require(‘chrome’) or some of the low-level APIs".

I do have some favorite extensions that I've used for years and would certainly miss if they didn't continue to work. My favorite is Athena, a canned speech manger that GravityGripp developed ~2008 but is no longer developing.
 
My favorite is Athena, a canned speech manger that GravityGripp developed ~2008 but is no longer developing.
Not familiar with that. I have a 68 page Word document I use for canned texts. I could (and should) trim down by culling out all the XP stuff no longer needed. But it falls under one of those "Why do today what you can put off until tomorrow?" headings. ;)

Happy Thanksgiving!
 
I still have old XP things around too. (What I love about Athena is the simplicity -- a right-click in the reply window, scroll to the category and select the instructions to be posted. They can then be altered if needed but the main thing is that instructions are consistent and no other programs have to be opened.)
 
I suspect Mozilla have a big enough developer team to react fast enough to community needs to ride this out without tanking the project.

Also...some of the current technologies used by Mozilla aren't really sustainable or secure in the long term.

Any move towards a standardised, unified, secure and sustainable extension platform common to all browsers can only be a good thing. It's a bold move, which, even if it backfires on the Firefox project, can only be good for the industry.
 
Sometimes, having a big developer team might mean that they lose focus on certain core aspects.
I used to work at Northrop Grumman IT (NGIT) as a hardware guy in a software company. We had 400 developers at my location. One of my many "other hats" was as 1 of 25 or so alpha and beta testers for our secure networking system used for DoD and State Department secure global communications.

An important fact is while many of the beta testers were developers, no developer beta tested his or her own code.

I don't really want to call it "in-fighting" but I can think of no better term. There was always a lot of in-fighting among the developer teams (and sub-teams) on what should be the best approach. This often resulted in a lack of focus until the big doggies (and client) decided on the course they wanted. It was a big PITA because there were so many people making inputs from so many directions. Too many cooks... .

And speaking of the client, to make matters worse it was not uncommon for the client to force a course change in the middle of the stream too. In some cases, we had to go two directions at once until DoD and State came to a consensus on what they wanted which typically did not happen until the 11th hour before the release deadline - a colossal PITA resulting in many all-nighters in a SCIF. Not fun at all.

In fact, it was brutal. So were the associated "peer reviews" which we, as the hardware guys, went through too with our hardware. There is just no place for bruised egos or "pride of authorship". It had to be a team thing with the absolute best course of action in the end product.

But the results were over the 25 years the program was in use, it was extremely rare for any "bug" to make it into the final release. And of the 10s of millions of highly classified messages sent to and from US and allied embassies and military installations around the world, not 1 message was ever lost, misdirected, compromised, corrupted, or otherwise went unaccounted for. End result: Happy clients. :smile9:

I have also beta tested for small companies with as little as 1 or 2 developers on the "team". It is common in small companies for the developers to beta test their own code. This is like proof reading your own report. Your brain inserts missing words and autocorrects misspellings. Not good. Besides the inevitable in-fighting and ego issues, the results almost always resulted in more problems found during beta testing, and worse, more bugs in the final releases - typically resulting in unhappy clients. :(

So having a large development team can be a real PITA, but I think it results in a better, complete and more robust product in the end (once everyone gets on the same page anyway).
 
Sometimes, having a big developer team might mean that they lose focus on certain core aspects.

Canadian retailer of Estes/Aerotech/Quest/Rocketarium/LOC Precision/Public Missiles/Aeropack/PerfectFlite/Jolly Logic rockets, rocket engines/motors, launch supplies and electronics

Try that site in Firefox and/or Chrome then in Pale Moon.

I'll admit that I haven't tried it with Chrome, I rarely ever have it installed.

SSL Server Test: [url]www.allrocketengines.ca (Powered by Qualys SSL Labs)[/url]

I became distracted by the joyous discovery I have in fact visited that website before under my own volition ;) I seem to remember it wouldn't ship to the UK...sad really :)
 
I became distracted by the joyous discovery I have in fact visited that website before under my own volition ;) I seem to remember it wouldn't ship to the UK...sad really :)
Would you trust the site's security settings?

But did you test out the CA link with a variety of browsers, Bill?

;)
They all get an F so that means they are equally "good", right? ;)

No, "they all" don't get an F, only the site does.

Which browsers inform you off the bat that the site security is outdated and vulnerable?
 
Unlike FF, Pale Moon didn't open that CA link. Instead, it showed a "Secure Connection Failed" error.
 
Yes, that's the result for the server security, which PM flags up with a notice as it disallows connection to it.

Chrome and Firefox both allow connection without any obvious warning that the server security is old and vulnerable = insecure - not so good for an https site where you put in your card details, eh?
 
Okay, I see what you mean now. Sometimes it is a real challenge to live up to my name. ;)

IE, FF, Chrome, and Edge work fine. But with PM, I get a different error than you, Corrine. It says, "The Connection was interrupted".

The connection was interrupted

The connection to h ttp://www.allrocketengines.ca was interrupted while the page was loading.
  • The site could be temporarily unavailable or too busy. Try again in a few moments.
  • If you are unable to load any pages, check your computer's network connection.
  • If your computer or network is protected by a firewall or proxy, make sure that Pale Moon is permitted to access the Web.
Try Again
(my space in h ttp to keep site from changing it)
 
Last edited:
Must of this went over my head so I have a question.

Before I order something from a new for me site should I go to SSL Server test and put the https site in to see if it is indeed secure?
Note: there are ordinarily only a few sites that I order from at present and I haven't had a problem up to this point in time.
 
Yes, I think it would be a good idea to do that, check the known limitations section of the Qualys server tests as well, as they might change, currently: Known Issues | Qualys Community

If you do find a 'bad' server that you have dealings with, report it to them.

For someone who regularly buys online from a number of different sources, it might make sense to use a current Pale Moon (Portable?) to run initial checks with; FF doesn't make it easy to check (I haven't tried to drill into Chrome's innards yet).
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top