<div dir="ltr"><div>We have a new ExtensionSettings policy that will allow you to enable extensions by ID.</div><div><br></div><div>this will be in the next ESR update and Firefox 69 (It was in 68 but had some bugs so I didn't release it)</div><div><br></div><div>Mike<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Aug 20, 2019 at 12:24 PM Robert Marcano <<a href="mailto:robert@marcanoonline.com">robert@marcanoonline.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 8/19/19 12:31 PM, Mike Kaply wrote:<br>
> The Firefox ESR has always supported turning off extension signing so <br>
> you can install local extensions.<br>
<br>
I wish it wasn't an on or off switch, but more a list of allowed <br>
certificates (hashes?), and be able to disable Mozilla's certificates <br>
That way you can allow your users to use approved internal extensions <br>
without giving them the privilege to usa any Mozilla approved ones or <br>
install random XPIs without signatures<br>
<br>
> <br>
> Mike<br>
> <br>
> On Sun, Aug 18, 2019 at 10:58 AM Paul Kosinski via Enterprise <br>
> <<a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a> <mailto:<a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a>>> wrote:<br>
> <br>
> As a long-time Firefox user, I went to ESR because I prefer stability to<br>
> new features, and I especially don't like gratuitous changes to the User<br>
> Interface. The move to Tabs on Top was ugly: I think Google started it<br>
> so that users would view the Web (and hence Google) as their computing<br>
> environment, rather than Windows et al. But at least Classic Theme<br>
> Restorer could fix that.<br>
> <br>
> The move to Quantum killed much of the ability to make Firefox look the<br>
> way the user wanted and was used to. This has meant that users had to<br>
> learn the new interface rather than doing useful work (sort of like<br>
> The Microsoft Office "Ribbon" debacle). And the modern fad of replacing<br>
> text-labeled icons with pure icons means that no one can know for sure<br>
> what they mean, no matter what language they speak. (Plus, "hovering"<br>
> over the icon to get the tool-tip wastes more time.) Not all users have<br>
> to make do with tiny smartphone screens which don't have the space for<br>
> labeled icons.<br>
> <br>
> The move to Quantum also required some really critical add-ons, such as<br>
> NoScript, to be totally reimplemented, and made many other add-ons<br>
> (such as Classic Theme Restore) apparently impossible. In the case of<br>
> NoScript, there may have been a period where the overall security of<br>
> using Firefox suffered in spite of the more secure internal structure<br>
> of Quantum.<br>
> <br>
> And speaking of security, although the idea of requiring add-ons to be<br>
> signed by Mozilla (only!) may be good for the consumer versions of<br>
> Firefox, it is totally inappropriate for the *Enterprise* version<br>
> (ESR). It means that any organization that wants add-ons that *need* to<br>
> be kept private can't use Firefox at all. The notion that they could<br>
> use a local build or an unofficial build (daily etc.) could mean that<br>
> they are violating some other corporate or government regulation<br>
> concerning what software they are allowed to use. And how would one<br>
> even *find* the daily etc. build that is essentially identical to the<br>
> release build?<br>
> <br>
> Since ESR is for enterprise use, surely it should be possible to allow<br>
> enterprise-private add-ons to be loaded in ESR if their *hash* is signed<br>
> by Mozilla. (Mozilla should not be in the business of trying to protect<br>
> enterprises from software they themselves write.) In other words, an<br>
> enterprise would just submit a hash of the add-on XPI to Mozilla the<br>
> way they now can submit the whole XPI. Then if so configured (e.g., via<br>
> about:config) the ESR version of Firefox would allow the add-on to be<br>
> loaded iff its hash passed the signature test. To add to "public<br>
> safety", Firefox could display a caveat stating that the add-on belongs<br>
> to XYZ Corp. and is in no way certified by Mozilla. Plus, of course,<br>
> such hash-signed add-ons would never be hosted by Mozilla.<br>
> <br>
> <br>
> <br>
> <br>
> <br>
> On Sat, 17 Aug 2019 00:54:28 +0000<br>
> Ramkrishna Reddy D S <<a href="mailto:ramkrishna.reddy.d.s@ericsson.com" target="_blank">ramkrishna.reddy.d.s@ericsson.com</a><br>
> <mailto:<a href="mailto:ramkrishna.reddy.d.s@ericsson.com" target="_blank">ramkrishna.reddy.d.s@ericsson.com</a>>> wrote:<br>
> <br>
> > Hi Mike,<br>
> ><br>
> > Less major updates would be good as it's hard for us to manage.<br>
> ><br>
> > Regards,<br>
> > Ram<br>
> ><br>
> > Sent from Workspace ONE Boxer<br>
> ><br>
> > On 17-Aug-2019 12:16 AM, Mike Kaply <<a href="mailto:mkaply@mozilla.com" target="_blank">mkaply@mozilla.com</a><br>
> <mailto:<a href="mailto:mkaply@mozilla.com" target="_blank">mkaply@mozilla.com</a>>> wrote:<br>
> > I know this is generally considered a support list, but I have a<br>
> > couple things I'd like to let you know about. Going forward, if you'd<br>
> > like to continue to receive these kind of updates, you can follow the<br>
> > instructions at the end of this email.<br>
> ><br>
> > Legacy Browser Support for Windows now<br>
> ><br>
> available!<<a href="https://protect2.fireeye.com/url?k=0ab11a4d-5665120e-0ab15ad6-86a1150bc3ba-e41f2431dfb71a8b&q=1&u=https%3A%2F%2Fgithub.com%2Fmozilla%2Flegacy-browser-support%2Freleases%2Ftag%2Fv1.0" rel="noreferrer" target="_blank">https://protect2.fireeye.com/url?k=0ab11a4d-5665120e-0ab15ad6-86a1150bc3ba-e41f2431dfb71a8b&q=1&u=https%3A%2F%2Fgithub.com%2Fmozilla%2Flegacy-browser-support%2Freleases%2Ftag%2Fv1.0</a>><br>
> ><br>
> > It is quite possible that you still require the use of websites and<br>
> > apps running ActiveX, Java, or Silverlight that need a legacy browser<br>
> > for it to work. You can now get Legacy Browser Support which will<br>
> > allow you to easily switch between Firefox and your legacy browser of<br>
> > choice. You can add websites to the policy and when your users try to<br>
> > access the site via the URL bar or a link, it will open in the legacy<br>
> > browser automatically. Legacy Browser Support requires a native<br>
> > component installed via MSI as well as an extension.<br>
> ><br>
> > Share your thoughts on ESR Release Cadence<br>
> ><br>
> > We would love your feedback in our current cadence of Firefox<br>
> > Extended Support releases.<br>
> ><br>
> > Today, an ESR life cycle spans between 9 months to a year. We would<br>
> > like to understand if a shorter life cycle, with more releases each<br>
> > year, would help meet the needs of you and your organization.<br>
> ><br>
> > We believe faster cycles will allow more flexibility to back port<br>
> > features and functionality to the ESR and will reduce occurrence of<br>
> > web app compatibility issues that arise due to the ESR being too<br>
> > outdated. While the ESR helps lower QA overhead through less frequent<br>
> > updates, would a biannual release bring more benefits to you? Please<br>
> > chime in on this feedback form<<a href="https://forms.gle/jdwWYKQ3inqP3jwL9" rel="noreferrer" target="_blank">https://forms.gle/jdwWYKQ3inqP3jwL9</a>>.<br>
> ><br>
> > Want to receive enterprise news?<br>
> ><br>
> > This is our second note to you in the past few weeks and we would<br>
> > like to share more news about our enterprise work as new features and<br>
> > offerings are developed. If my recent emails have been helpful, I’d<br>
> > love to have you complete this brief<br>
> > form<<a href="https://www.mozilla.org/en-US/firefox/enterprise/signup/" rel="noreferrer" target="_blank">https://www.mozilla.org/en-US/firefox/enterprise/signup/</a>> to<br>
> > receive periodic news from our enterprise team.<br>
> ><br>
> > Thanks<br>
> > [<a href="https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif" rel="noreferrer" target="_blank">https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif</a>]<br>
> > Mike Kaply<br>
> > Technical Lead, Enterprise Firefox<br>
> _______________________________________________<br>
> Enterprise mailing list<br>
> <a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a> <mailto:<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a>><br>
> <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
> <br>
> To unsubscribe from this list, please visit<br>
> <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a> or send an email to<br>
> <a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a><br>
> <mailto:<a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a>> with a subject of "unsubscribe"<br>
> <br>
> <br>
> _______________________________________________<br>
> Enterprise mailing list<br>
> <a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
> <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
> <br>
> To unsubscribe from this list, please visit <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<br>
> <br>
<br>
_______________________________________________<br>
Enterprise mailing list<br>
<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
<br>
To unsubscribe from this list, please visit <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<br>
</blockquote></div>