will a signed version of keysnail be made available before firefox pulls the plug

[millwood]

firefox plans to enforce their add-on verification through a signing mechanism with no way to bypass it. They say 42 will kill unsigned add-ons. https://wiki.mozilla.org/Addons/Extension_Signing. Will keysnail put up with this nonsense and get signed?

[hosaka]

Very good question, would be great to hear the developers opinion.

[unmanbearpig]

Addon signatures are now required in Nightly by default. Its possible to disable it by setting xpinstall.signatures.required to false, but it would be great if this addon was signed none the less.

[thapakazi]

yep, lets get it signed... such an awesome stuff.

[mooz]

KeySnail is now under the review for add-on signing. Please wait for further information.

[mooz]

Unfortunately, KeySnail was rejected to get to be signed by the review. The reviewer complains about the use of eval, which can be dangerous. However, eval is essential for KeySnail to realize plugin and init file feature. Since high customizability through plugins is the identity of KeySnail, we don't want to remove those features.

We'll make best effort to persuade the reviewer, but we're not sure whether our request will be accepted or not.

[hosaka]

@mooz that is unfortunate, but security is impacted by flexibility, thank you for your efforts in negotiating with the reviewers

for the time being, the users can keep the xpinstall.signatures.required flag disabled until Firefox 42 comes around

[millwood]

Note that you set xpinstall.signatures.required to the string value false to turn off the check. By default it has a url.

[deadcyclo]

This really sucks. I simply cannot live without keysnail and my custom macros. So I guess when 42 comes around I'll have to ditch the firefox in my distro and go with the unbranded one.

I really really hope that this will not result in keysnail being abandoned or dev work slowing down since I can potentially see the user mass dropping when this is enforced.

I'm also 99.9% sure that keysnail will never pass. There simply is no way they will pass something that uses eval. Eval is and will always be a security risk. Specially for "dumb" users that need to be protected from themselves (which are the users Mozilla are targeting with this action), but it can also be very dangarous when combined with buffer overflow vulnerabilities.

@mooz I really hope this doesn't influence you to discontinue your great work on the most essential extension in existings which is bascially omnipresent in my life ;)

Edit: Just realized that my post could be interpreted as being negative to the use of eval in keysnail. I'm not. It is essential. Keysnail without eval would be almost as worthless as no keysnail at all. Powerusers using eval and knowing the risks involved is a great thing, but it cannot realistically be allowed by the signing process.

[mooz]

Here's a good news. I found that vimperator, which also has eval and that usage is completely same with keysnail's one (actually keysnail borrowed it), has already been signed.

• https://github.com/vimperator/vimperator-labs/blob/50abe5b445ed9a9de0c602eabb86b4e9f5b1d959/common/content/eval.js
• https://github.com/mooz/keysnail/blob/4a81af33295cc7f5acd94d134bc4b504c5530d36/content/eval.js

I've already provided this information to the reviewer. Now waiting for a response.

[hosaka]

Perhaps it comes down to a reviewer and one may be more lenient than another.
@mooz it's a very good argument against their decision, I think we stand a good chance

[deadcyclo]

That is really strange, and makes me wonder even more if they really have thought through what they are doing. But it's good news as well. Now at least you have leverage.

[mooz]

Finally KeySnail has been signed! Thank you for your concern.

https://github.com/mooz/keysnail/releases/tag/v2.1.6

[myuhe]

Congrats!! 👍

[deadcyclo]

That is awesome news. Will each new release have to go through a manual process like this?

[mooz]

@deadcyclo Yes. It's somewhat tedious. Perhaps we can refer to the previous review, and it'll take shorter.

[nekowasabi]

Awesome!!

[thapakazi]

hurray,
thanks @mooz for saving us 👍

[gardejo]

Wonderful. I'm glad you got the sign!

[ghost]

Cool, will it actually appear in https://addons.mozilla.org/en-US/firefox/ someday or is there some further action needed?

[EvaparotangCote]

@rgh36167

Cool, will it actually appear in https://addons.mozilla.org/en-US/firefox/ someday or is there some further action needed?

It seems to at one point have been listed. Quote by /u/mooz from forums.mozillazine.org:

Download from KeySnail AMO page.

But now the link returns "404 Not found". Also /u/mooz has a profile on AMO, but KeySnail is not listed among his add-ons.
Not sure why it's not listed. From the top of my head the only other examples I can think of is dorando's keyconfig and HTTPS Everywhere. I don't currently remember dorando's reason for not listing on AMO and HTTPS Everywhere has recently made the listing on AMO.

@mooz: Why isn't KeySnail listed on AMO?

[ghost]

have submitted a few extensions myself - they do get listed unless you explicitly set the "Do not list my add-on on this site (beta)" checkbox in step 1. of submission.

Such submissions are immediately viewable (by direct link only) after submission even before they are reviewed.

So it is a mystery for me how this addon can be signed but not accessible from AMO.

Also - the link previously given (https://github.com/mooz/keysnail/releases/tag/v2.1.6) points to the source but no installable xpi?

[EvaparotangCote]

@rgh36167:
Interesting, thanks for info.

As for:

Also - the link previously given (https://github.com/mooz/keysnail/releases/tag/v2.1.6) points to the source but no installable xpi?

No installable xpi still seems to be the case regarding: https://github.com/mooz/keysnail/releases/

Though going to: https://github.com/mooz/keysnail/wiki#installation
I tried saving and unpacking: https://github.com/mooz/keysnail/raw/master/keysnail.xpi
In install.rdf it says "2.1.7" as version - so there's that - hope that solves your issue, if you had any (finding proper installable xpi).