Firefox 3.6 locks down component directory


Recommended Posts

The Mozilla developers have announced that Firefox 3.6 will "lockdown" the components directory of the browser to stop third party applications bypassing the standard add-ons and plug-in support by pushing user invisible changes directly into Firefox. From today's planned release of Firefox 3.6's beta 3, and onwards, the components directory will be for Firefox code only and third party developers will only be able to extend the browser through the officially supported add-ons system.

Johnathan Nightingale, "Human Shield" at Mozilla, announced the change in a blog posting where he explained that the change in policy was driven by a need to increase the stability of Firefox. Extensions that are installed through the components directory, called "raw components", are not visible in the users Add-On Manager dialogue and do not carry version information with them. This means that neither Firefox or the user can detect out of date versions of these extensions, or update or disable them.

Nightingale directs add-on developers who use "raw components" to a document on the Mozilla Developer Center which covers the process of migrating "raw components" into add-ons.

source

Wait a sec, people can install extras that don't show up on the add-ons list and bypass the confirmation UI? Am I the only one wondering why it's taken them until 3.6 to fix this? Didn't they think for a second this might be a security problem and lets put that confirmation UI to some use? :rolleyes:

About time, this will prevent stuff like that MS addon that installed without the user knowing

that one was actually a proper addon, just installed without prompt.

i get the feeling that this is talking about the invisible stuff like the java console for example.

that one was actually a proper addon, just installed without prompt.

i get the feeling that this is talking about the invisible stuff like the java console for example.

im not saying it wasn't a "proper" addon, but it should have never been installed without a prompt. This should hopefully fix this issue

Wait a sec, people can install extras that don't show up on the add-ons list and bypass the confirmation UI? Am I the only one wondering why it's taken them until 3.6 to fix this? Didn't they think for a second this might be a security problem and lets put that confirmation UI to some use? :rolleyes:

At least they thought about it now. Better late than never.

At least they thought about it now. Better late than never.

I don't like this new lockout 'feature'. When 3.6 beta 3 installed it disabled many of my extensions. I'd like to be the one to decide how stable I need Firefox to be and which extensions I want to use. I don't want this security crap forced down my throat Windows Vista style. I had to reinstall beta 2 to get my extensions back. Now I guess I won't be updating Firefox anymore.

I don't like this new lockout 'feature'. When 3.6 beta 3 installed it disabled many of my extensions. I'd like to be the one to decide how stable I need Firefox to be and which extensions I want to use. I don't want this security crap forced down my throat Windows Vista style. I had to reinstall beta 2 to get my extensions back. Now I guess I won't be updating Firefox anymore.

It has always done that. You mean Nightly Tester Tools won't re-enable them anymore?

https://addons.mozilla.org/en-US/firefox/addon/6543

I don't like this new lockout 'feature'. When 3.6 beta 3 installed it disabled many of my extensions. I'd like to be the one to decide how stable I need Firefox to be and which extensions I want to use. I don't want this security crap forced down my throat Windows Vista style. I had to reinstall beta 2 to get my extensions back. Now I guess I won't be updating Firefox anymore.

Like other people have pointed out, that is a compatibility issue and completely unrelated to this new feature that is intended to stop other software from silently slipping extensions and plugins into your Firefox and potentially compromising it. You have to accept these compatibility issues when running a pre-release version of Firefox. If you don't want to have to deal with this, simply avoid pre-release versions that clearly are not intended for you, and wait for the final release to come out and the extension authors to verify the compatibility. You don't have to have the absolutely latest pre-release build.

Also, it would have taken you mere seconds to find out that you can easily disable the compatibility check in b3 by simply going into the settings and setting the boolean extensions.checkCompatibility.3.6b to false. In fact, this is discussed in the beta 3 thread just a few lines below this one in the forum index.

Like other people have pointed out, that is a compatibility issue and completely unrelated to this new feature that is intended to stop other software from silently slipping extensions and plugins into your Firefox and potentially compromising it. You have to accept these compatibility issues when running a pre-release version of Firefox. If you don't want to have to deal with this, simply avoid pre-release versions that clearly are not intended for you, and wait for the final release to come out and the extension authors to verify the compatibility. You don't have to have the absolutely latest pre-release build.

Also, it would have taken you mere seconds to find out that you can easily disable the compatibility check in b3 by simply going into the settings and setting the boolean extensions.checkCompatibility.3.6b to false. In fact, this is discussed in the beta 3 thread just a few lines below this one in the forum index.

Actually, this is only going from beta 2 to beta 3. You would have me believe that suddenly all the stuff that worked with beta 2 is incompatible with beta 3? I don't buy it. And instead of being condescending you might want to try being nice. As a matter of fact I have set extensions.checkCompatibility to False. I've been using it that way for a long time..and I also have nightly tester tools installed, and it has worked up till now. So I think it's the new component directory lockdown feature and not mere compatibility issues.

I found a solution to my add-ons not working in beta 3...Add-on Compatibility Reporter located at:

https://addons.mozilla.org/nl/firefox/addon/15003

Installing that took care of the addons that even Nightly Tester Tools wouldn't allow me to use. I hope this is useful to anyone else having the same problem I had.

...

As a matter of fact I have set extensions.checkCompatibility to False.

...

extensions.checkCompatibility has been renamed with beta 3, now it's extensions.checkCompatibility.3.6b (it needs to be kept in sync with the version you want to make it compatibile with, since otherwise people will leave it enabled, forgetting about it and running into crashes and bugs when they upgrade.

Actually, this is only going from beta 2 to beta 3. You would have me believe that suddenly all the stuff that worked with beta 2 is incompatible with beta 3? I don't buy it. And instead of being condescending you might want to try being nice. As a matter of fact I have set extensions.checkCompatibility to False. I've been using it that way for a long time..and I also have nightly tester tools installed, and it has worked up till now. So I think it's the new component directory lockdown feature and not mere compatibility issues.

Except that is not the option I said you should set. I said, as The_Decryptor points out, extensions.checkCompatibility.3.6b. He also explains the reasoning behind the change, which you could also have found if you had spent a minimum of effort looking it up (as one might be expected to do with seemingly weird changes in pre-release software) instead of going on a rant against a new feature that is actually important and completely unrelated and proclaiming that you're never going to use Firefox in the future.

This is good news, any addon should use the front door and not try and slip in the backdoor.

BTW: This version disabled 4 of my addons which where easily forced to be enabled with Mr Tech Toolkit: https://addons.mozilla.org/en-US/firefox/addon/421

extensions.checkCompatibility has been renamed with beta 3, now it's extensions.checkCompatibility.3.6b (it needs to be kept in sync with the version you want to make it compatibile with, since otherwise people will leave it enabled, forgetting about it and running into crashes and bugs when they upgrade.
I've upgraded to 3.6 Beta 3, yet in about:config mine still says extensions.checkCompatibility. What's up with that? Isn't it supposed to have the 3.6b on it now? Also, do we not need Nightly Tester Tools to force the install of incompatible extensions as long as we have it to set to false? So there would be no use for that extension as well as the Add-On Compatibility Reporter, right? Trying to cut back on extensions. It would be nice to remove those if possible.

You have to create the preference (same way you had to create the old version), it's not there by default.

Edit: Yes, if it's set to false any extension will automatically install, but you'll run into issues eventually (like Greasemokey, last I checked it doesn't work in current builds of 3.7)

I found a solution to my add-ons not working in beta 3...Add-on Compatibility Reporter located at:

https://addons.mozilla.org/nl/firefox/addon/15003

Installing that took care of the addons that even Nightly Tester Tools wouldn't allow me to use. I hope this is useful to anyone else having the same problem I had.

If this is true, should I just uninstall Nightly Tester Tools and just use Add-On Compatibility Reporter? There's no need for both, right? I heard they conflict with each other.
You have to create the preference (same way you had to create the old version), it's not there by default.

Edit: Yes, if it's set to false any extension will automatically install, but you'll run into issues eventually (like Greasemokey, last I checked it doesn't work in current builds of 3.7)

Thanks. I didn't know that. So is there a way to erase the old one, or do I just create a new one?
Except that is not the option I said you should set. I said, as The_Decryptor points out, extensions.checkCompatibility.3.6b. He also explains the reasoning behind the change, which you could also have found if you had spent a minimum of effort looking it up (as one might be expected to do with seemingly weird changes in pre-release software) instead of going on a rant against a new feature that is actually important and completely unrelated and proclaiming that you're never going to use Firefox in the future.

You call that a rant? Evidently you've never seen a real rant if you think that was one. I think I'll just add you to my ignore list since you are none too friendly.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • They thought value of their goods would forever only drop like it used to and didn't account for sudden increase in price because of all the Ai hype. Tough luck Samsung, don't try to weasel this one out. Also American customer protection laws are a**. In Europe, you need to be compensated for a functioning product of same or better characteristics (not same price point as when it was originally bought!) if it can't be repaired and when you receive a replacement product your warranty starts from scratch because you received a different item than you previously had and old warranty thus cannot apply to it anymore. If your actual item was successfully repaired, warranty gets extended for the period the item was in service. If item is repaired to a significant extent, warranty also starts over from scratch because major part of it was replaced. Americans need to fight to get this kind of consumer protections because they are constantly getting screwed over.
    • Microsoft releases new Windows 11 Media Creation Tool with the latest updates by Taras Buria Patch Tuesday updates arrive every month, bringing users new features and security updates. To make sure customers have access to the most recent images, Microsoft also releases updates to the Media Creation Tool app, its official utility for Windows 11 installation. Today, the company pushed new ISOs to Media Creation Tool, allowing you to create images with the June 2026 Patch Tuesday updates. With the latest update, the Media Creation Tool now downloads KB5094126. It is Windows 11 version 25H2, build 26200.8655, which is also available via Windows Update. Note that the app itself remains on the previous version, which you can check in Properties > Details. The only change is that it now downloads a more recent Windows 11 build, so the only way to check is to download an ISO. The June 2026 Patch Tuesday update is a special release for Windows 11, as it brings a new performance profile to make the operating system more responsive and snappier when rendering various user interface surfaces, including the Start menu, quick settings, and more. It does so by spiking processor speeds for a brief moment, resulting in higher loads for a second or two. The so-called “Low latency profile” is rolling out gradually, but you can force-enable it with the ViVeTool app. Other changes include webcam improvements, Task Manager updates, shared audio support, and more. You can download the Media Creation Tool app from the official Microsoft website using this link. Besides MCT, Microsoft lets you download Windows 11 ISO as a file directly from the official Windows 11 website. However, you will need a third-party app to write it to your USB drive. Check out this guide if you want to know how to do that.
    • Louis Rossmann suing Samsung over "990 Pro SSD warranty scam" by Sayan Sen Back in 2023, if you recall, Neowin reviewer Robbie Khan had a dispute with Samsung over his 990 Pro SSD, which was rapidly losing its health. After significant back and forth, the tech giant had finally released firmware to "stop" the issue. Interestingly, its previous flagship at the time, the 980 Pro was also facing problems leading to two consecutive sets of firmware fixes. Three years later, it looks like a similar conflict has now broken out between tech repair entrepreneur YouTuber Louis Rossmann and Samsung, as it has escalated into a threatened lawsuit after the company allegedly refused to appropriately replace a failing 990 Pro SSD that remained under warranty. According to Rossmann, a 4TB Samsung 990 Pro NVMe SSD purchased for approximately $330 less than two years ago, began experiencing major hiccups and issues, even though he claims it had been operated under ideal cooling conditions. It was installed in a RAID 1 array and cooled by a heatsink and dual high-speed fans. However the drive reportedly started dropping out of the array, exhibiting controller-level failures that eventually became not useable in any meaningful way. Rossmann said Samsung’s support process was marked by delays and confusion from the very start. After initially contacting the wrong regional support channel, he was redirected to Samsung’s memory support division where he submitted detailed diagnostics, logs, and proof of purchase. Rossmann runs a repair company and owns an ACE Lab PC-3000 machine, which is a professional-grade data recovery equipment. As such, he had been confident in his diagnostics. Samsung even seemingly acknowledged that later. Regardless, Rossmann claims that his initial support ticket was automatically closed before a full 24-hour response window had elapsed, forcing him to reopen the case and resubmit documentation. The controversy however intensified further from here after Samsung accepted the drive for warranty evaluation but later returned it with a repair report stating that the drive had passed its testing and that the SSD had been verified as functional. Rossmann strongly disputed those claims citing that his own independent testing on PC-3000 showed write speeds reducing to as low as 40–60 MB/s before the drive failed entirely. Samsung subsequently informed him that the SSD had been reset and reflashed, passing internal stress tests. However, the company also stated that replacement units were unavailable due to an industry-wide memory shortage and suggested that a refund process could be initiated if further testing confirmed the fault. Thus, to settle, the company offered a refund of $330, the amount that was initially paid by him to make the purchase. Here, Rossmann pointed out the seeming hypocrisy of the tech giant as in how no Samsung drive was apparently allocated for warranty replacements, but they were abundantly available for retail sales especially when using business accounts. As you can see, Rossmann is indeed right, there are Samsung 990 Pro 4TB SSDs on Amazon currently for $950 (shipped and sold by first-party Amazon US itself), and they are also available on Samsung's own store too, albeit for an even higher price of $1100. Thus Rossmann argues that Samsung’s inability or unwillingness to provide a replacement while the same model remains available for purchase at significantly higher market prices reflects a failure to honor its warranty obligations. He has issued a formal 60-day notice and says he intends to file suit in Texas small claims court, asserting that companies should face greater costs for denying legitimate warranty claims than for fulfilling them. You can check out the full video titled "Samsung's 990 Pro SSD warranty policy is a scam; I'm taking them to court," at the link below. Source and image: Louis Rossmann (YouTube) As an Amazon Associate we earn from qualifying purchases
    • Was it too much to ask to show the icon in this article?
  • Recent Achievements

    • Week One Done
      davidbazooked earned a badge
      Week One Done
    • One Month Later
      Jamswaz earned a badge
      One Month Later
    • Week One Done
      Jamswaz earned a badge
      Week One Done
    • Rookie
      Marzoid went up a rank
      Rookie
    • Community Regular
      coch went up a rank
      Community Regular
  • Popular Contributors

    1. 1
      +primortal
      509
    2. 2
      PsYcHoKiLLa
      185
    3. 3
      +Edouard
      158
    4. 4
      Steven P.
      83
    5. 5
      ATLien_0
      75
  • Tell a friend

    Love Neowin? Tell a friend!