Tab Mix Plus secure update for Firefox 3

matp75 · Guest

Firefox 3.0b1 refuses to update or install Tab Mix Plus.(included last dev build as of today)
See
http://wiki.mozilla.org/User:Mossop:Fx-Docs:AddonUpdateSecurity

Could either the extension be hosted on a secure site, or could the developper sign the extension instead ?

Guest · Posted: Tue Nov 20, 2007 4:12 pm Post subject:

in about:config, create a boolean preference called 'extensions.checkUpdateSecurity'. set the value to 'false'.

misterdan · Posted: Tue Nov 20, 2007 6:13 pm Post subject:

but is that really a good way? no. would be better if there was a secure connection.

and will you remember to delete that variable?

CPU · Admin

the only secure sit i can think of is using the addons site. but we only use it for final versions

sigining the extension ourself would defeat the purpose of having signed extensions since anyone could just do it

matp75 · Guest

misterdan · Posted: Thu Nov 22, 2007 12:23 am Post subject:

yes, if you look at the firefox notes, you can sign the extension yourself...

http://wiki.mozilla.org/User:Mossop:Fx-Docs:AddonUpdateSecurity

then users would be able to install the extension without you using SSL (use digital signatures and hashes)

RyanVM · Guest

There's no reason to not be signing your update manifests, especially when there's a supported tool for doing it.
http://wiki.mozilla.org/McCoy
http://developer.mozilla.org/en/docs/McCoy

Guest · Guest

There exists an advantage to using the "about:config" modification, not only will it allow Tab Mix Plus to work in FF 3.0 Beta, it will allow your other non-complying extensions to work as well. Please note, if you toggle the new Boolean entry back to "true" TMP, and the other extensions, will be disabled.

RyanVM · Guest

Yeah, except that completely defeats the purpose of the new security mechanism Rolling Eyes

DeepFreeze3 · Posted: Thu Nov 22, 2007 7:52 pm Post subject:

Guest 2 · Guest

First, to clear up any confusion the second posting regarding about:config was not by the original "Guest", but by me, now Guest 2. Second, yes, using the about:config modification does disable the new security feature. That said, it puts one in no different position than continuing to use FF2 excect that now one possesses the advantage of using FF3 (beta) and its other security enhancements as well as keeping the functionality of all of one's current extensions. Third, even when FF3 reaches its actual release, there will be a period of time when developers have not made the modifications to allow FF3 to download existing non-complying extensions. About:config is a useful tool that does possess a risk: One that some feel comfortable taking under current circumstance.

matp75 · Guest

No need to disable secure update to try making a "incompatible" extension installable with firefox 3.
You can use the nighty tester tool extension, which allow to "make compatible" an extension (obviously, you're on your own, it may not work)
I don't wish to stay in an insecure mode for ever.
From my Firefox 2 extensions, my essentials extensions are working well with firefox 3.
Some are already providing secure update (mostly by signing it when they are not hosted on the addon site).
One has just signed it's extension after asking for it and as a new version has been made public today, every user of this extension has now secure update.
Others have signed their dev version so at least it's installable without disabling security and it will be transparent for users migrating when they release a new stable version.
Hope TMP dev version will be signed soon...

onemen · Posted: Sun Nov 25, 2007 6:30 am Post subject:

The next TMP dev version will be signed

RyanVM · Guest

Great news, onemen! Thanks for keeping up with the trunk so diligently Smile

Guest · Posted: Sun Nov 25, 2007 1:53 pm Post subject:

Help ... need 3b1 update. I can live without all but Roboform and Tab Mix Plus. Got Roboform. How long until TMP? Thanks for a great addon.

Atreus · Guest

Guest · Posted: Mon Nov 26, 2007 9:56 pm Post subject:

WildcatRay · Posted: Tue Nov 27, 2007 9:00 am Post subject:

Another way to "disable" the security check blocking an add-on install is to edit the install.rdf file within the xpi file itself. In the case of TMP dev, delete or comment out the line <em>http://tmp.garyr.net/updates-dev.rdf</em>

As I understand it, the security check looks for this line. If it does not contain "https" meaning future updates will be from a secure site like "https://addons.mozilla.org", it blocks the installation.

On the philosophical side, I cannot fault the intent. However, I do wonder about the heavy-handed approach. This along with coding the browser to force the scanning of downloads for virus' if the user does not have their antivirus program already running in the proper mode, the Places (bookmarks, history, downloads, etc.) organizer and the "Larry" enhancement to go beyond using yellow in the location/address bar to signify you are on a secure site seems to be moving Firefox into the realm of code bloat that may end up defeating the original purpose of it; creating a lean, mean, customizable browsing machine. Besides, if they are so intent on providing the most secure web browser on the market, then why have they not incorporated the NoScript code into it? And, for that matter, why not incorporate ad-blocking into the base browser code, too?

If I were in the product develop meetings I would push for making Firefox 3 the best, leanest, meanest browsing machine that meets the original intent of Firefox and incorporate all the "security" enhancements into a strongly-recommended add-on or, offer it is two forms, a base and "high-security" version. But, who am I? Just some "dumb" user. Why would user's desires matter?

Thank you for indulging my rant. Now, back to your regularly scheduled programming.

Guest · Posted: Tue Nov 27, 2007 9:56 am Post subject:

Alan Baxter · Posted: Wed Nov 28, 2007 12:23 am Post subject:

	Tab Mix Plus Forum Index -> Builds	All times are GMT - 6 Hours Goto page 1, 2, 3 Next
Page 1 of 3