Firefox To End Support For Sideloaded Extensions
Mozilla add-ons team today announced to end support for sideloaded extensions in Firefox. This is a great security enhancement, and would land to the stable builds of Firefox starting with the version 74 releasing by March 2020. It is important to note here that the extension sideloading is already blocked in Chrome.
Sideloaded extensions are those add-ons, which are installed in Firefox by the user or some third-party application. Users can sideload an extension by installing it directly using the extension files (XPI or JAR format). To install an extension file, users need to visit Firefox’s Add-on Manager page (about:addons), and then drag-and-drop the file or choose the option “Install Add-on From File…” from the gear icon menu.
Alternatively, the add-on file can also be placed directly in the standard extension folders on the user’s computer. Users need to manually approve the installation on the next Firefox launch, and the extension is installed only after the approval from the user. Many third-party applications distribute their Firefox add-ons using this method. Moreover, sideloaded extensions are not updated automatically. This is a huge problem with the sideloaded extensions.
Starting with the Firefox 74, sideloaded extensions will not be supported in Firefox. Developers now have two options to distribute their add-ons: either host it on Mozilla’s Add-on store (AMO) or self-distribute from a website. In case of self hosting the extension distribution, developers should also implement proper updating mechanism to avoid security vulnerabilities because of outdated version. Even if a developer decides to self-distribute the extension through his/her own website, it is mandatory to get a signed version of the extension file by uploading it to AMO. Unsigned extensions are not supported in Firefox, except the sideloaded extensions.
While the above announcement will definitely block third-party applications and malicious developers to distribute their extensions, it will also affect the developers who are not willing to upload their extensions to AMO or distribute a signed copy through a web property.
Also See: Firefox Preview To Support Extensions