Avast (Free) and Firefox 40

[Cluster-Lizard2014]

I hope so too.

[Tangy]

What I have noticed is that add ons that are frequently updated are not signed. The ones that are rarely or never updated are signed.

[midnight]

Hi guys, easy solution, use FF ESR.

+1

[sabbatha]

After reading this post i've check my add-ons and reads that avast is warned..that is so stupid..
If will be impossible for me to keep add ons like classic theme restorer and web mail ad blocker..said so..i will downgrade back again to 39 IF FF 41 will disable these add-ons, period.
I'm tired of FF that more and more is turning like a copy of Chrome..i've still blocked my java into mozilla FF which is insane cause every darn update, doesn't matter which it is,it is says that firefox doesn't recommend to use.

What is FF ESR?

[Gopher John]

Firefox ESR
https://www.mozilla.org/en-US/firefox/organizations/all/

What Mozilla did was sign all up-to-date extensions that resided on AMO enmass.  If the extension was an old one that didn't pass muster for updating (the max version was outdated), it wasn't signed.  Also, if the signed extensions were later updated it lost the signing.  It seems that now extensions that reside on AMO are signed at the time of vetting and acceptance, either new extensions or updated extensions.

Those extensions that aren't on AMO require that the extension publisher request that Mozilla signs it, for each and every update.  I'm fairly sure that some won't bother, which means that come Firefox 42 it can't be installed.

[sabbatha]

I agree on everything you said BUT FF needs seriously to stop turning into a chrome clone, it's insane that i still got java disabled on FF while all is upgraded..
Same with avast: all was fine on 39 version..now i discover this..
Serioulsy why every software rushing to create update that causes merely trouble and issues to us?
Fed up.

[Gopher John]

In a default install of new releases of Java, it is disabled in all browsers.  Oracle was under pressure to do that because of the ongoing security issues with Java.  Java can be enabled in the browsers by the Java Configuration utility that any Java installation has.  Of course, if the installed Java version is not current or has a known vulnerability, Firefox will disable it per it's blocklist.
https://addons.mozilla.org/en-US/firefox/blocked/

[Tangy]

Just updated to FF40. Not even one add on is signed any more ! Currently using the following add ons :
Classic theme restorer ( was not signed before )
Cyscon security shield ( was not signed )
Flag fox ( was  signed )
Perfect Redirector ( was signed )
SSleuth ( was signed )
Traffic Light ( was signed )
ublock origin ( was not signed )
Yahoo mail hide Ad panel ( was signed )
You Tube flash player ( was signed )

[Gopher John]

Firefox 40 does not show -signed after the extension name in the Extensions Tab.  However, if you hover the cursor over the extension name -signed should show up in a tooltip.  However, very recently update extensions will lose the -signed added to their name but the extension won't be flagged as 'could not be verified' because it is signed.  An example is NoScript, which was just updated.

In most of my Firefox profiles, I have only one extension that is flagged as 'could not be verified'.  Extension List Dumper which I modified per instructions found on http://forums.mozillazine.org and bumped the MaxVersion is, of course, not signed.  It will be disabled in Firefox 42 unless Mozilla relents.  I have RefreshPolicy Continued in a couple of profiles, which is also not signed.

[Tangy]

@ Gopher John
Thanks for the tip.

[Gopher John]

@ Gopher John
Thanks for the tip.

You are welcome.

[lakrsrool]

<snip>
Firefox 40: Firefox warns about signatures but doesn't enforce them.

Firefox 41 (ETA Sept. 22) : Firefox will have a preference that allows signature enforcement to be disabled (xpinstall.signatures.required in about:config).   I take this to mean they will be disabled by default, but that this "feature" can be overridden.

Firefox 42 (ETA Nov. 3): Release and Beta versions of Firefox will not allow unsigned extensions to be installed, with no override.
<snip>

Looks like they have already done some preparation in the about:config settings, see image, which shows xpinstall.signatures.required is currently default set to false.

That is what is likely to change to true in FF 42.0 when it does, I really hope they aren't so blind/ridged  and the user can set that back to false.

Thanks DavidR for that last post with the attachment that as you say we hope will remain an option available to users to reset to "false" in version 42.

That said, what concerns me when looking at the plans that FF has regarding this quote:

As of Firefox 41 you will not get a warning and unsigned add-ons will be blocked. There will be a (hidden) preference that you can set to override for the time being.

As of Firefox 42, unsigned add-ons cannot be used in the standard release (and beta) builds of Firefox. Full stop.

More specifically what concerns me is that it would suggest that the RED part above would be the "the about:config setting" referenced as "a (hidden) preference" that can "override" the requirement "for the time being".  And that I'm afraid that there are possibly plans on removing this setting the way FF42 is described above.

[DavidR]

By the time FF 42.0 comes around, I have a suspicion that there are many people using old, no longer undeveloped add-ons who may well come up with ways round this rather than accept that they can no longer use these old, useful add-ons.

[MartinZ]

Hi,

just to confirm, we are working on signing the addon via Mozilla, it should be live before the FF 41 is released.

Martin

[Asyn]

Thanks Martin, good to know.