Cannot download/save .xpi Topic is solved

About this bulletin board and the Pale Moon website

Moderators: FranklinDM, Lootyhoof

GStathops
Hobby Astronomer
Hobby Astronomer
Posts: 28
Joined: 2015-06-14, 08:08
Location: Greece

Cannot download/save .xpi

Post by GStathops » 2020-09-04, 13:16

Upon right mouse click on 'Install Now' button of extensions, we're not presented anymore with "save link as" context menu option ,to save xpi file locally ...

What changed it ?
ScreenShot01.jpg
Thank you

User avatar
adesh
Board Warrior
Board Warrior
Posts: 1277
Joined: 2017-06-06, 07:38

Re: Cannot download/save .xpi

Post by adesh » 2020-09-04, 13:25

It's probably a security measure to make files available for install and not "download" by people using other browsers.

User avatar
New Tobin Paradigm
Knows the dark side
Knows the dark side
Posts: 8550
Joined: 2012-10-09, 19:37
Location: Skaro

Re: Cannot download/save .xpi

Post by New Tobin Paradigm » 2020-09-04, 14:44

Using InstallTrigger will allow us to send the hash for extra verification on an install action in the future. Though atm it is using an older function for evaluation.

Why do you need to download rather than install an add-on? Also, what makes you think this was ever intentional behavior?
Is it that you have no idea where you are going or what you're supposed to be doing right now?
Or did you just assume when you saw that timer that something in this room is capable of turning it off?

Image

User avatar
RealityRipple
Lunatic
Lunatic
Posts: 253
Joined: 2018-05-17, 02:34
Location: Los Berros Canyon, California
Contact:

Re: Cannot download/save .xpi

Post by RealityRipple » 2020-09-04, 16:13

Off-topic:
Long as your on-click event returns false, you can include the link to the file directly and provide a clean install trigger, and just clicking it will install while still allowing ctrl+click and right-click>save as to work as expected.
For the immediate problem, you can use ExtExp to export the extension after you've installed it. This doesn't resolve anything if your purpose was to check the code before installation, but it's easier than searching through your profile's extension directory by hand.

User avatar
New Tobin Paradigm
Knows the dark side
Knows the dark side
Posts: 8550
Joined: 2012-10-09, 19:37
Location: Skaro

Re: Cannot download/save .xpi

Post by New Tobin Paradigm » 2020-09-04, 16:53

I am completely aware of how links and the js event handlers work.
Is it that you have no idea where you are going or what you're supposed to be doing right now?
Or did you just assume when you saw that timer that something in this room is capable of turning it off?

Image

GStathops
Hobby Astronomer
Hobby Astronomer
Posts: 28
Joined: 2015-06-14, 08:08
Location: Greece

Re: Cannot download/save .xpi

Post by GStathops » 2020-09-04, 18:09

New Tobin Paradigm wrote:
2020-09-04, 14:44
...Also, what makes you think this was ever intentional behavior?
Since you ask ... why do you think that i was ever care about the intentionality of that behavior in the first place ?
i thought that it was a natural / self explanatory thing to do. That's why i posted the question/observation..
New Tobin Paradigm wrote:
2020-09-04, 14:44
Why do you need to download rather than install an add-on?
Sometime's i do , sometimes i don't..
Because i have a habit to archive stuff (OS/Programs/Addons/my software) locally for the past 10-15 years,
it comes handy when building PC's here and there..
I tend to not relying in online "services" wherever that is possible ....
the mentality goes like this ..
New Tobin Paradigm wrote:
2020-07-24, 14:47
Personas are fundamentally "Themes as a Service" .. Your browser only caches the current one in use (and maybe can pull others out of standard webcache)
but if they are gone from their original source they are gone never the less.

This is why I despise them.. That and they helped kill true skinning.
I hope you don't mind..

Also in the past , for my own use, and in couple of addons , needed to extract .xpi file in order to change/delete a .wav file inside them to my liking for example.. (i'm not a coder btw)

Now
Using InstallTrigger will allow us to send the hash for extra verification on an install action in the future.
Sweet.. i guess i can live with your desision..

Thank you...

User avatar
ron_1
Moon Magic practitioner
Moon Magic practitioner
Posts: 2358
Joined: 2012-06-28, 01:20

Re: Cannot download/save .xpi

Post by ron_1 » 2020-09-05, 13:01

I just now noticed this new thing on the extension page. (I'm glad I did a search first, I was about to post a new thread.) I also like to archive things locally. Honestly I hate it that the "Save link as" option is gone. I guess I'm a control freak (at least my wife accuses me of that from time to time). I guess one day I'll have a look at RealityRipple's extension.

User avatar
moonbat
Moon Magic practitioner
Moon Magic practitioner
Posts: 2543
Joined: 2015-12-09, 15:45

Re: Cannot download/save .xpi

Post by moonbat » 2020-09-05, 13:11

Why would you not save the extension from your profile folder for backing up instead of going to the site if it's an extension you use? :shock:
"One hosts to look them up, one DNS to find them and in the darkness BIND them."

Image
Linux Mint 20 Xfce x64 on HP i5-5200 laptop, 12 GB RAM.
Advanced URL Builder(fork)|PermissionsPlus|PMPlayer|Pure URL|RecordRewind|TextFX

User avatar
ron_1
Moon Magic practitioner
Moon Magic practitioner
Posts: 2358
Joined: 2012-06-28, 01:20

Re: Cannot download/save .xpi

Post by ron_1 » 2020-09-05, 13:22

moonbat wrote:
2020-09-05, 13:11
Why would you not save the extension from your profile folder for backing up instead of going to the site if it's an extension you use? :shock:
Everybody has their own way of doing things. I think you should stop questioning how other people choose to do things. :shock: And that's not quite how I did it anyway. First I would (used to, at least) download the xpi file, then install it from the locally saved file. For me, that's easier than backing it up from the profile. I'm sure some here, maybe the majority, will think that's "stoopid" (that would be their opinion, everybody's got one, just like . . .) but that's how I've always done it.
Last edited by ron_1 on 2020-09-05, 16:17, edited 2 times in total.

User avatar
moonbat
Moon Magic practitioner
Moon Magic practitioner
Posts: 2543
Joined: 2015-12-09, 15:45

Re: Cannot download/save .xpi

Post by moonbat » 2020-09-05, 13:29

One would think it's easier to just copy a file that is already present on your PC than complain about the site, but well, I must be getting old to not consider that asking this is somehow horribly offensive.
"One hosts to look them up, one DNS to find them and in the darkness BIND them."

Image
Linux Mint 20 Xfce x64 on HP i5-5200 laptop, 12 GB RAM.
Advanced URL Builder(fork)|PermissionsPlus|PMPlayer|Pure URL|RecordRewind|TextFX

User avatar
ron_1
Moon Magic practitioner
Moon Magic practitioner
Posts: 2358
Joined: 2012-06-28, 01:20

Re: Cannot download/save .xpi

Post by ron_1 » 2020-09-05, 13:33

Who's complaining, Sherlock? I just stated a fact that I hate that "Save link as" is gone. But like the OP, I can live with it.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 28812
Joined: 2011-08-28, 17:27
Location: Tranås, SE
Contact:

Re: Cannot download/save .xpi

Post by Moonchild » 2020-09-05, 13:53

The purpose of the add-ons site it to allow people to install add-ons. It's not an archive or a front-end for otherwise generic file storage. The fact that it was possible for a while because we've been using the "present a specific MIME type to the browser and it will accept it as an install trigger" feature of Pale Moon doesn't mean that that is the best (or intended) method of install, and these changes are to improve the site's primary function.
"Son, in life you do not fight battles because you expect to win, you fight them merely because they need to be fought." -- Snagglepuss
Image

User avatar
New Tobin Paradigm
Knows the dark side
Knows the dark side
Posts: 8550
Joined: 2012-10-09, 19:37
Location: Skaro

Re: Cannot download/save .xpi

Post by New Tobin Paradigm » 2020-09-05, 14:50

It is quite clear that from early on that more than just scrapers, bots, and XPeople have been abusing our services and taking advantage of the open way that things were designed and accomplished.

This has been allowed to go on far long enough. I should have been using InstallTrigger from day one due to its advantages but I didn't for my own reasons and biases even though the InstallTrgger was very traditional.

Given the massive increase in entitlement and rampant rightous indignation on display now it is totally the correct call. This of course does not prevent the service from accomplishing its goal in any way. Which as Moonchild stated is to get people to add-ons and get add-ons installed in the applications.

The fact that we switched to InstallTrigger will also have the benefit of preventing casual abuse is only a side bonus but the primary reason it should be used is that it is assured that it is going to install and not get rejected by a few post-tycho security mitigations people have hit occasionally such as "could not verify the origin" which could happen if the link was middle clicked or just copied and pasted. It will also, when adjusted later, provide the hash which we have calulated and stored to the XPIProvider for verification on installation which this has been asked about and requested before and is already done for other methods such as installation via Add-ons Manager internal search and the Add-ons Update Service.

There simply is no reason not to do this for new installation of add-ons as well. Simply linking to xpi files was a bad call and InstallTrigger is the correct method and had been since add-ons were a thing even way back in the XPInstall days.

For all you people who think downloading and saving is somehow going to benefit more than your obsessive packrat tendancies.. Do know that the Add-ons Datastore is automatically archived up every sunday at midnight and is stored away on my system and Moonchild's NAS and that no user will be able to rage-delete their add-ons off the Add-ons Sites because that functionality will never even be implemented into the software to allow them that ability. Though they will be able to deactivate they cannot and will never be allowed to destroy.

So, any other questions or attempts to justify the reasoning of downloading you want to make?
Is it that you have no idea where you are going or what you're supposed to be doing right now?
Or did you just assume when you saw that timer that something in this room is capable of turning it off?

Image

User avatar
RealityRipple
Lunatic
Lunatic
Posts: 253
Joined: 2018-05-17, 02:34
Location: Los Berros Canyon, California
Contact:

Re: Cannot download/save .xpi

Post by RealityRipple » 2020-09-05, 15:13

New Tobin Paradigm wrote:
2020-09-05, 14:50
So, any other questions or attempts to justify the reasoning of downloading you want to make?
"Know what you install before you install it"?

User avatar
New Tobin Paradigm
Knows the dark side
Knows the dark side
Posts: 8550
Joined: 2012-10-09, 19:37
Location: Skaro

Re: Cannot download/save .xpi

Post by New Tobin Paradigm » 2020-09-05, 15:14

Then read the page before clicking the green button? This is the reason you don't get a green button in category view but have to go to the actual page and why the install button is after the content. To give you a chance to read and know before installing.
Is it that you have no idea where you are going or what you're supposed to be doing right now?
Or did you just assume when you saw that timer that something in this room is capable of turning it off?

Image

User avatar
RealityRipple
Lunatic
Lunatic
Posts: 253
Joined: 2018-05-17, 02:34
Location: Los Berros Canyon, California
Contact:

Re: Cannot download/save .xpi

Post by RealityRipple » 2020-09-05, 15:58

New Tobin Paradigm wrote:
2020-09-05, 15:14
Then read the page before clicking the green button? This is the reason you don't get a green button in category view but have to go to the actual page and why the install button is after the content. To give you a chance to read and know before installing.
By "know", I meant "read the source code and make sure there aren't any packaged EXEs or random JS that bundles up all your passwords and sends them to a third-party website".

User avatar
hitokage
Moon lover
Moon lover
Posts: 94
Joined: 2014-05-03, 02:19
Location: Frederick, MD

Re: Cannot download/save .xpi

Post by hitokage » 2020-09-05, 16:05

The reason I had for downloading them was I would be getting them from the server only once, and then manually updating them on the various computers I use/am responsible for (computers belonging to family members). This also can be important when you have a a data usage limit (with no other ISP options) or connection issues leading to frequent download retries.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 28812
Joined: 2011-08-28, 17:27
Location: Tranås, SE
Contact:

Re: Cannot download/save .xpi

Post by Moonchild » 2020-09-05, 16:09

By "know", I meant "read the source code
So you're accusing us of not vetting what is approved, then? Please.
Access to the source isn't necessary nor does it guarantee anything (and for some extensions won't even be an option since not everything is public domain, either). I doubt you're going to examine every line of every application's source you install for every version, so it's clearly just for the sake of argument that you even bring this up -- please don't, it's not realistic.
For Open Source extensions the source will be available (and even linked to from the add-ons' page in most cases!) so there is no reason to claim we must make a direct download available. There is not.

If you cannot trust our add-ons team to be pro-active and diligent about the safety of what is hosted, then you should not be considering installing add-ons at all from the site regardless of what method is being used. Please don't try to twist that into somehow getting your hoarding addiction satisfied against a proper judgement call regarding security.
"Son, in life you do not fight battles because you expect to win, you fight them merely because they need to be fought." -- Snagglepuss
Image

User avatar
RealityRipple
Lunatic
Lunatic
Posts: 253
Joined: 2018-05-17, 02:34
Location: Los Berros Canyon, California
Contact:

Re: Cannot download/save .xpi

Post by RealityRipple » 2020-09-05, 16:16

The only person or system I trust to keep my computer secure is me.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 28812
Joined: 2011-08-28, 17:27
Location: Tranås, SE
Contact:

Re: Cannot download/save .xpi

Post by Moonchild » 2020-09-05, 16:17

RealityRipple wrote:
2020-09-05, 16:16
The only person or system I trust to keep my computer secure is me.
Then don't install extensions that weren't written by you. Don't run any programs you haven't vetted every line of. Don't run Linux that is too large to keep tabs on every change of. In fact, you would be better of not running anything at all and use your computer as a paperweight :)

i.e.: that kind of attitude is completely unrealistic in this day and age.
"Son, in life you do not fight battles because you expect to win, you fight them merely because they need to be fought." -- Snagglepuss
Image

Locked