Mozilla signing of addons in upstream firefox

Paolo Inaudi p91paul at gmail.com
Thu Feb 19 10:38:10 UTC 2015


Mozilla recently announced 
(https://blog.mozilla.org/addons/2015/02/10/extension-signing-safer-experience/) 
they will be introducing a new model for Firefox add ons signing.

Only Mozilla will be able to sign addons when the feature will be fully 
implemented, and there will be no way for the user to disable it, apart 
for installing a different browser.

In comments to the blog post and in Mozilla developers mailing lists 
(https://groups.google.com/forum/#!forum/mozilla.addons.user-experience) 
there are many concerns for user freedom coming from this.

I expressed my own in this thread
https://groups.google.com/forum/#!topic/mozilla.addons.user-experience/2Tb9ndgzBkg

Basically the problems are:
* Developers being unable to give beta-testers a bugfix version in a 
timely manner
* Censorship implications, with Mozilla and any government with legal 
power on Mozilla being able to remotely disable any add-on
* Enterprise installs must submit to Mozilla extensions for approval
* General freedom implications, with users no more being in charge to 
decide what they want to install

Since debian ships packages with addons, the binary version of those 
packages will need to be mozilla-signed to comply with this, and thus 
you won't be able to provide security fixes in a timely manner.

Apparently, a configure switch when building firefox will cause the 
binary to check an option in about:config that can either enable the 
whole system, with Mozilla-only signing, or disable it entirely, without 
any signing checks. Mozilla itself will be distributing an unbranded 
version with that setting available (although with signing on by default).

My question is: what will be the policy for Iceweasel?

Paolo Inaudi



More information about the pkg-mozilla-maintainers mailing list