858832 - stop giving signed add-ons special treatment in the add-ons installation prompt

Status: RESOLVED WONTFIX

(Toolkit :: Add-ons Manager, defect)

Description

[:Gavin Sharp [email: [e-mail]]]

We don't currently do a good job of monitoring and reacting to breaches of code signing certs, so bsmith argues that exposing the name of the author for signed certs and suggesting that they can be trusted does more harm than it does good.

Given that few add-ons use this mechanism to begin with, perhaps we should remove this UI until we can devise a more secure system.

Comment 1

[Kaspar]

(In reply to :Gavin Sharp (use [e-mail] for email) from comment #0)
> We don't currently do a good job of monitoring and reacting to breaches of
> code signing certs

Perhaps it's a quixotism, but it would be sad to see support for properly signed XPIs go with this change... Provided that the code signing cert includes an AIA extension with an OCSP responder URI, revocation checking for such certs is comparable to those for SSL.

> Given that few add-ons use this mechanism to begin with, perhaps we should
> remove this UI until we can devise a more secure system.

Few in terms of the overall number of available add-ons, that's true. But on the other hand, a couple of the most popular addons do include proper signatures: Adblock Plus, NoScript, or WOT, to name a few. Simply ignoring signatures for all XPIs (apparently motivated by bug 835177) seems like throwing out the baby with the bathwater to me.

Comment 2

[Andrew Swan [:aswan]]

This became irrelevant with bug 1366243