NoScript is not yet signed for Firefox use

[SoItBegins]

Firefox is adding the requirement that extensions must be signed shortly. I'm using Firefox Developer Edition so I'm immune, but I can see which extensions are signed and NoScript isn't one of them. Just a heads-up!

[SoItBegins]

PS: I'm using the dev build of NoScript 2.6.9.26rc3.

[therube]

NoScript on AMO doesn't show -signed, but is?

#dev build, from AMO, would be signed.
Direct from here, not sure how that would work? Suppose he'd have to submit it for signing by AMO, & then host it here?

(How ridiculous something like that would be!)

[barbaz]

stable release channel on AMO is already signed - and Giorgio frequently has to push a lot of dev builds in short order and it's better if we dev build testers give him quick feedback if possible... so i'm not sure how practical getting dev builds signed is going to be
after all, the whole point of a "dev channel" is to give the developer feedback before changes hit release channel...

@therube: i think fx developer edition puts warning stripes over addons that aren't signed, so that's not related

[SoItBegins]

Oh, OK then.

@therube: That's exactly what he'd have to do— get AMO to give it the once-over and sign it, then host it here.

[Thrawn]

That's exactly what he'd have to do— get AMO to give it the once-over and sign it, then host it here.

Except that half the reason for the dev channel is because Giorgio doesn't want to have to wait for AMO's reviewers (the other half is for beta-testing - but he normally tries to make even the dev channel quite stable).

[SeaPuppy]

but he normally tries to make even the dev channel quite stable).

Indeed!
Last I heard, Giorgio's on the Moz security panel; hence NS dev versions are as trustable in my books for bugs as the ones on AMO..... and given the very rushed and disorganised implementation of "signing" on AMO, I'd be more likely to trust the latest dev NS than anything coming off the AMO server right now.
At least until Fx 41.
Right now I've got auto-update for extensions turned off, and I'm only going to noscript.net for NS updates. No other extensions are important for security, so they can stay in their current versions until I suss out Fx 41's final solution. heh.

[barbaz]

@SeaPuppy: You seem to be using SeaMonkey... SeaMonkey will not implement the addon signing requirement, so you don't have to worry about this (unless, of course, you want to )

[SeaPuppy]

Thanks @ barbaz.
If AMO's not working so well for Firefox over the signing stuff, I'm not going to trust it to serve anything properly for anything Moz until the smoke clears. It's not so much about security but that I'm trying to avoid misconfiguration and that kind of mess. But yes it's great that SM's going to be a proper Moz browser still. At least for the time being.

The useragent by the way is a total fraud, but it gets me through more silly webmaster's gates than any other right now.
I have very little networking understanding, but with the little I've learned from being an NS early adopter and follower, I run naked with a live Puppy and only NS as a shield. Very bracing! But so far, never a single piece of bad code has managed to climb aboard the good ship SeaPuppy.

You're doing super support for the Moz community all round, btw!

[barbaz]

Thanks @ barbaz

You're welcome.

The useragent by the way is a total fraud, but it gets me through more silly webmaster's gates than any other right now.

Protip: if you're using a fake UA "everywhere" just to appease poorly designed UA sniffing scripts, use the UA string of latest Firefox release running on Windows (either 7 or 8.1) WOW-64; and apply site-specific overrides for the sites that aren't OK with that. I've seen some sites which aren't even OK with SeaMonkey + Fx compatibility mode (then again, I don't use Windows).

I have very little networking understanding, but with the little I've learned from being an NS early adopter and follower, I run naked with a live Puppy and only NS as a shield. Very bracing! But so far, never a single piece of bad code has managed to climb aboard the good ship SeaPuppy.

No surprise, you are actually not at all "naked" to the Internet with that setup, which to my knowledge is actually quite secure. Nice job figuring that out with "very little networking understanding"

You're doing super support for the Moz community all round, btw!

(Me? If so: thanks for the compliment, but actually I'm not active - or even signed up - in very many places.. should I know you from mozillaZine? )

[SeaPuppy]

I've seen some sites which aren't even OK with SeaMonkey + Fx compatibility mode (then again, I don't use Windows).

Ha! Win users tip back at you: if a webmaster doesn't include Mozilla recognition under a Win OS, then I wouldn't trust them enough to use their site.
So far, my use of financial and government sites hasn't been prevented by the current UA. That's all that is worth stuffing around for in my use of the Web (I'm not a big fan of much of it to be completely honest) If/when that changes, I update the UA. I like to keep the actual browser in my UA for webmasters who may have some actual positive use for collecting that kind of statistic. Heaven knows what the tipping point is before SM becomes an irrelevance by virtue of low numbers.

but actually I'm not active - or even signed up - in very many places

Sorry for my poor expression; I mean Moz *users*. I lurk mostly around here and the Zine forums. Your work here is exemplary of the highest kind of support and in the Zine forums you're doing more and more. I do occasionally come out of lurk in bursts when there's stuff going on in SM - - like the really unfortunate delay in getting the next Official out. - - but I don't keep current enough with the rest of it all to be any kind of notable participant. I hung on to Fx while I had to admin a home network, but with everyone using mobiles these days I've put the router in the bottom drawer and am very pleased to be free of all the fiddling with Fx that seems to have become necessary to keep it free of the creeping cruft of Capital.

In here I used to be active but I haven't posted for years until this thread. I'm not really interested in reviving my rep either here or there because I no longer have the motivation to participate fully.

[barbaz]

Ha! Win users tip back at you: if a webmaster doesn't include Mozilla recognition under a Win OS, then I wouldn't trust them enough to use their site.

Sure, except that one of the sites I was referring to is AMO. They don't let SeaMonkey access very many available addons for SeaMonkey (and AFAICT they don't allow SM access to ANY "preliminarily reviewed" / yellow-caution-stripe addons), but using a Firefox UA you can get them no problem.

But I guess there are also other reasons (e.g. as you noted above) not to trust them enough to use their site

Your work here is exemplary of the highest kind of support and in the Zine forums you're doing more and more.

Wow, thanks for the positive feedback