Ancient Extension -- Unhosted, Unsupported and Unsigned. Work Around?

[edh...@gmail.com]

I am using OpenBook 2.0.1.1. The last version was published April 12,2012. It makes the crimped and cramped Firefox Edit Bookmarks dialog big enough to be usable. Because it is no longer hosted, I keep a copy on my HD. Since it is no longer supported, there is no one to sign it. Now Firefox 40 won't let me use it.

Is there a work-around for this gimped Firefox?

[Jorge Villalobos]

On 8/14/15 2:11 PM, edh...@gmail.com wrote:
> I am using OpenBook 2.0.1.1. The last version was published April 12,2012. It makes the crimped and cramped Firefox Edit Bookmarks dialog big enough to be usable. Because it is no longer hosted, I keep a copy on my HD. Since it is no longer supported, there is no one to sign it. Now Firefox 40 won't let me use it.
>
> Is there a work-around for this gimped Firefox?
>

If you just need to keep using that particular version of the extension,
you can change its ID and submit it to AMO as Unlisted. Then you'll get
a signed file that you can continue using.

Jorge

[The Wanderer]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

If this is the recommended approach, that would seem to leave open the
possibility of multiple people (potentially dozens or more) doing this
with the same "unsupported by its author, but still works fine" add-on.
At the least that would burn ID space and consume signing/review
resources. Is this scenario considered "OK" by the Mozilla side?

(Also, given the hurdles people have mentioned here for getting their
own still-active unhosted add-ons to pass signing review, there's no
guarantee at all that such an add-on will pass without modification
either - in which case the described approach won't work as described.)

- --
The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man. -- George Bernard Shaw
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJVzx/+AAoJEASpNY00KDJrgAMP/Re37LdkYk5Y2M7Qh9Qrz82t
LVCg978xfIUbYC6oiHYcqKc4Dldqt0Ly1UeCOgQ4j7UAIeNkwhi6ax8OIl+mRGPt
oajdA1FSuxpQE/26TTE3ZjKdoNDCVSqoHkTkujF6xhP+k9/0uML6KXtPyITX028H
g03AhZmfYsdf9WryQ/5D2UZZNfWEVu39AaNazSMATeNhqBW5jFsn2dq9nBatJebZ
yWjwa3L7ZwVrdgyB/LWV5FIZQI6w2tGvHRd5OjwEUb07zN1prXqRbU7Szx5cQeNb
kX6NiKAWg8/WPxU0Ui3BvlIXAjZFPc/zlTpCBN9sn3/+FIaJKPEcDz3O3BNidyhO
L+qi5mrnwd1T6mkVqU1xJWamACO+wujtBfmrpL4Mt3E8bJu1347mfbjhHIT1S49H
cbNfW4AfNzXBfC5oa/8BNoh4AzpNJeVjFL1RcYRJPkO+TzlFZMvHNJSNqRpD/I8Q
nGIa02tJ4XxUzZ1BAZ/FwkqnngI3PF8PXPUxdRf6GPtZsjr7yA2cijWlHibX2VnZ
RCFzt6Svmd/hX543fBbR8UPDlroEkf0WkVtk93Z0ToNapuHzOQ335xBK5VUj8bkb
qvijxAlWDhPAglMTArmuMbHQ/WJf7MTEoCxdbnkYzzrvgVy7mKQjzBP5mEpVGeZF
wlf93pd8Zy6A7sgjdE2T
=SxGF
-----END PGP SIGNATURE-----

[Jorge Villalobos]

On 8/15/15 5:18 AM, The Wanderer wrote:
> On 08/14/2015 at 07:13 PM, Jorge Villalobos wrote:
>
>> On 8/14/15 2:11 PM, edh...@gmail.com wrote:
>
>>> I am using OpenBook 2.0.1.1. The last version was published
>>> April 12,2012. It makes the crimped and cramped Firefox Edit
>>> Bookmarks dialog big enough to be usable. Because it is no longer
>>> hosted, I keep a copy on my HD. Since it is no longer supported,
>>> there is no one to sign it. Now Firefox 40 won't let me use it.
>>>
>>> Is there a work-around for this gimped Firefox?
>
>> If you just need to keep using that particular version of the
>> extension, you can change its ID and submit it to AMO as Unlisted.
>> Then you'll get a signed file that you can continue using.
>
> If this is the recommended approach, that would seem to leave open the
> possibility of multiple people (potentially dozens or more) doing this
> with the same "unsupported by its author, but still works fine" add-on.
> At the least that would burn ID space and consume signing/review
> resources. Is this scenario considered "OK" by the Mozilla side?

We knew that private add-on forks would constitute a significant portion
of unlisted submissions. So, yes, this is okay by us.

> (Also, given the hurdles people have mentioned here for getting their
> own still-active unhosted add-ons to pass signing review, there's no
> guarantee at all that such an add-on will pass without modification
> either - in which case the described approach won't work as described.)

That's certainly a possibility. However, most private forks are very
straightforward and have passed review without any problems.

Jorge

[the.s...@gmail.com]

Is there no way for one person to submit an older add-on for signing and have that, through some process, become the de-facto standard download for the add-on? If it's signed based on code already on AMO, that shouldn't present any kind of added risk to users, no?

[Jorge Villalobos]

That could lead to confusion and probably some big copyright and
trademark problems. The policy on AMO has always been to consider the
listing to be owned by the developer, not us, and it can't be
transferred without explicit permission by the owner. We do tell people
to try hard to contact the developers. If that doesn't work, forking is
the next best option.

Jorge