Firefox 3.6 locks down component directory

[Ci7]

The Mozilla developers have announced that Firefox 3.6 will "lockdown" the components directory of the browser to stop third party applications bypassing the standard add-ons and plug-in support by pushing user invisible changes directly into Firefox. From today's planned release of Firefox 3.6's beta 3, and onwards, the components directory will be for Firefox code only and third party developers will only be able to extend the browser through the officially supported add-ons system.

Johnathan Nightingale, "Human Shield" at Mozilla, announced the change in a blog posting where he explained that the change in policy was driven by a need to increase the stability of Firefox. Extensions that are installed through the components directory, called "raw components", are not visible in the users Add-On Manager dialogue and do not carry version information with them. This means that neither Firefox or the user can detect out of date versions of these extensions, or update or disable them.

Nightingale directs add-on developers who use "raw components" to a document on the Mozilla Developer Center which covers the process of migrating "raw components" into add-ons.

source

[zeroday]

Wait a sec, people can install extras that don't show up on the add-ons list and bypass the confirmation UI? Am I the only one wondering why it's taken them until 3.6 to fix this? Didn't they think for a second this might be a security problem and lets put that confirmation UI to some use? :rolleyes:

[torrentthief]

sounds like a good thing to me!

[i_was_here]

Woohoo!

[Rudy]

About time, this will prevent stuff like that MS addon that installed without the user knowing

[Argi]

Will this affect plugins like Flash and Silverlight? Or does this only apply to addons?

[primexx]

About time, this will prevent stuff like that MS addon that installed without the user knowing

that one was actually a proper addon, just installed without prompt.

i get the feeling that this is talking about the invisible stuff like the java console for example.

[Rudy]

that one was actually a proper addon, just installed without prompt.

i get the feeling that this is talking about the invisible stuff like the java console for example.

im not saying it wasn't a "proper" addon, but it should have never been installed without a prompt. This should hopefully fix this issue

[Lord Ba'al]

Wait a sec, people can install extras that don't show up on the add-ons list and bypass the confirmation UI? Am I the only one wondering why it's taken them until 3.6 to fix this? Didn't they think for a second this might be a security problem and lets put that confirmation UI to some use? :rolleyes:

At least they thought about it now. Better late than never.

[Zetaprime]

At least they thought about it now. Better late than never.

I don't like this new lockout 'feature'. When 3.6 beta 3 installed it disabled many of my extensions. I'd like to be the one to decide how stable I need Firefox to be and which extensions I want to use. I don't want this security crap forced down my throat Windows Vista style. I had to reinstall beta 2 to get my extensions back. Now I guess I won't be updating Firefox anymore.

[The_Decryptor Veteran]

That is unrelated to this, those extensions just weren't compatible with 3.6.

Well, I assume, the components this stops from loading never showed up in the extensions panel anyway.

[toadeater]

I don't like this new lockout 'feature'. When 3.6 beta 3 installed it disabled many of my extensions. I'd like to be the one to decide how stable I need Firefox to be and which extensions I want to use. I don't want this security crap forced down my throat Windows Vista style. I had to reinstall beta 2 to get my extensions back. Now I guess I won't be updating Firefox anymore.

It has always done that. You mean Nightly Tester Tools won't re-enable them anymore?

https://addons.mozilla.org/en-US/firefox/addon/6543

[hdood]

I don't like this new lockout 'feature'. When 3.6 beta 3 installed it disabled many of my extensions. I'd like to be the one to decide how stable I need Firefox to be and which extensions I want to use. I don't want this security crap forced down my throat Windows Vista style. I had to reinstall beta 2 to get my extensions back. Now I guess I won't be updating Firefox anymore.

Like other people have pointed out, that is a compatibility issue and completely unrelated to this new feature that is intended to stop other software from silently slipping extensions and plugins into your Firefox and potentially compromising it. You have to accept these compatibility issues when running a pre-release version of Firefox. If you don't want to have to deal with this, simply avoid pre-release versions that clearly are not intended for you, and wait for the final release to come out and the extension authors to verify the compatibility. You don't have to have the absolutely latest pre-release build.

Also, it would have taken you mere seconds to find out that you can easily disable the compatibility check in b3 by simply going into the settings and setting the boolean extensions.checkCompatibility.3.6b to false. In fact, this is discussed in the beta 3 thread just a few lines below this one in the forum index.

[Zetaprime]

It has always done that. You mean Nightly Tester Tools won't re-enable them anymore?

https://addons.mozilla.org/en-US/firefox/addon/6543

Nope.

[Zetaprime]

Like other people have pointed out, that is a compatibility issue and completely unrelated to this new feature that is intended to stop other software from silently slipping extensions and plugins into your Firefox and potentially compromising it. You have to accept these compatibility issues when running a pre-release version of Firefox. If you don't want to have to deal with this, simply avoid pre-release versions that clearly are not intended for you, and wait for the final release to come out and the extension authors to verify the compatibility. You don't have to have the absolutely latest pre-release build.

Also, it would have taken you mere seconds to find out that you can easily disable the compatibility check in b3 by simply going into the settings and setting the boolean extensions.checkCompatibility.3.6b to false. In fact, this is discussed in the beta 3 thread just a few lines below this one in the forum index.

Actually, this is only going from beta 2 to beta 3. You would have me believe that suddenly all the stuff that worked with beta 2 is incompatible with beta 3? I don't buy it. And instead of being condescending you might want to try being nice. As a matter of fact I have set extensions.checkCompatibility to False. I've been using it that way for a long time..and I also have nightly tester tools installed, and it has worked up till now. So I think it's the new component directory lockdown feature and not mere compatibility issues.

[Zetaprime]

I found a solution to my add-ons not working in beta 3...Add-on Compatibility Reporter located at:

https://addons.mozilla.org/nl/firefox/addon/15003

Installing that took care of the addons that even Nightly Tester Tools wouldn't allow me to use. I hope this is useful to anyone else having the same problem I had.

[The_Decryptor Veteran]

...

As a matter of fact I have set extensions.checkCompatibility to False.

...

extensions.checkCompatibility has been renamed with beta 3, now it's extensions.checkCompatibility.3.6b (it needs to be kept in sync with the version you want to make it compatibile with, since otherwise people will leave it enabled, forgetting about it and running into crashes and bugs when they upgrade.

[hdood]

Actually, this is only going from beta 2 to beta 3. You would have me believe that suddenly all the stuff that worked with beta 2 is incompatible with beta 3? I don't buy it. And instead of being condescending you might want to try being nice. As a matter of fact I have set extensions.checkCompatibility to False. I've been using it that way for a long time..and I also have nightly tester tools installed, and it has worked up till now. So I think it's the new component directory lockdown feature and not mere compatibility issues.

Except that is not the option I said you should set. I said, as The_Decryptor points out, extensions.checkCompatibility.3.6b. He also explains the reasoning behind the change, which you could also have found if you had spent a minimum of effort looking it up (as one might be expected to do with seemingly weird changes in pre-release software) instead of going on a rant against a new feature that is actually important and completely unrelated and proclaiming that you're never going to use Firefox in the future.

[Boeing 787]

This is good news, any addon should use the front door and not try and slip in the backdoor.

BTW: This version disabled 4 of my addons which where easily forced to be enabled with Mr Tech Toolkit: https://addons.mozilla.org/en-US/firefox/addon/421

[mancode20]

extensions.checkCompatibility has been renamed with beta 3, now it's extensions.checkCompatibility.3.6b (it needs to be kept in sync with the version you want to make it compatibile with, since otherwise people will leave it enabled, forgetting about it and running into crashes and bugs when they upgrade.

I've upgraded to 3.6 Beta 3, yet in about:config mine still says extensions.checkCompatibility. What's up with that? Isn't it supposed to have the 3.6b on it now? Also, do we not need Nightly Tester Tools to force the install of incompatible extensions as long as we have it to set to false? So there would be no use for that extension as well as the Add-On Compatibility Reporter, right? Trying to cut back on extensions. It would be nice to remove those if possible.

[The_Decryptor Veteran]

You have to create the preference (same way you had to create the old version), it's not there by default.

Edit: Yes, if it's set to false any extension will automatically install, but you'll run into issues eventually (like Greasemokey, last I checked it doesn't work in current builds of 3.7)

[mancode20]

I found a solution to my add-ons not working in beta 3...Add-on Compatibility Reporter located at:

https://addons.mozilla.org/nl/firefox/addon/15003

Installing that took care of the addons that even Nightly Tester Tools wouldn't allow me to use. I hope this is useful to anyone else having the same problem I had.

If this is true, should I just uninstall Nightly Tester Tools and just use Add-On Compatibility Reporter? There's no need for both, right? I heard they conflict with each other.

[mancode20]

You have to create the preference (same way you had to create the old version), it's not there by default.

Edit: Yes, if it's set to false any extension will automatically install, but you'll run into issues eventually (like Greasemokey, last I checked it doesn't work in current builds of 3.7)

Thanks. I didn't know that. So is there a way to erase the old one, or do I just create a new one?

[The_Decryptor Veteran]

Deleting it entirely involves editing the prefs.js file in the user profile folder, although it only takes up like 30 bytes of disk space so there's no harm keeping it.

[Zetaprime]

Except that is not the option I said you should set. I said, as The_Decryptor points out, extensions.checkCompatibility.3.6b. He also explains the reasoning behind the change, which you could also have found if you had spent a minimum of effort looking it up (as one might be expected to do with seemingly weird changes in pre-release software) instead of going on a rant against a new feature that is actually important and completely unrelated and proclaiming that you're never going to use Firefox in the future.

You call that a rant? Evidently you've never seen a real rant if you think that was one. I think I'll just add you to my ignore list since you are none too friendly.