Cannot download/save .xpi Topic is solved

[GStathops]

Upon right mouse click on 'Install Now' button of extensions, we're not presented anymore with "save link as" context menu option ,to save xpi file locally ...

What changed it ?

Thank you

[adesh]

It's probably a security measure to make files available for install and not "download" by people using other browsers.

[New Tobin Paradigm]

Using InstallTrigger will allow us to send the hash for extra verification on an install action in the future. Though atm it is using an older function for evaluation.

Why do you need to download rather than install an add-on? Also, what makes you think this was ever intentional behavior?

[RealityRipple]

Off-topic:
Long as your on-click event returns false, you can include the link to the file directly and provide a clean install trigger, and just clicking it will install while still allowing ctrl+click and right-click>save as to work as expected.

For the immediate problem, you can use ExtExp to export the extension after you've installed it. This doesn't resolve anything if your purpose was to check the code before installation, but it's easier than searching through your profile's extension directory by hand.

[New Tobin Paradigm]

I am completely aware of how links and the js event handlers work.

[GStathops]

...Also, what makes you think this was ever intentional behavior?

Since you ask ... why do you think that i was ever care about the intentionality of that behavior in the first place ?
i thought that it was a natural / self explanatory thing to do. That's why i posted the question/observation..

Why do you need to download rather than install an add-on?

Sometime's i do , sometimes i don't..
Because i have a habit to archive stuff (OS/Programs/Addons/my software) locally for the past 10-15 years,
it comes handy when building PC's here and there..
I tend to not relying in online "services" wherever that is possible ....
the mentality goes like this ..

Personas are fundamentally "Themes as a Service" .. Your browser only caches the current one in use (and maybe can pull others out of standard webcache)
but if they are gone from their original source they are gone never the less.

This is why I despise them.. That and they helped kill true skinning.

I hope you don't mind..

Also in the past , for my own use, and in couple of addons , needed to extract .xpi file in order to change/delete a .wav file inside them to my liking for example.. (i'm not a coder btw)

Now

Using InstallTrigger will allow us to send the hash for extra verification on an install action in the future.

Sweet.. i guess i can live with your desision..

Thank you...

[ron_1]

I just now noticed this new thing on the extension page. (I'm glad I did a search first, I was about to post a new thread.) I also like to archive things locally. Honestly I hate it that the "Save link as" option is gone. I guess I'm a control freak (at least my wife accuses me of that from time to time). I guess one day I'll have a look at RealityRipple's extension.

[moonbat]

Why would you not save the extension from your profile folder for backing up instead of going to the site if it's an extension you use?

[ron_1]

Why would you not save the extension from your profile folder for backing up instead of going to the site if it's an extension you use?

Everybody has their own way of doing things. I think you should stop questioning how other people choose to do things. And that's not quite how I did it anyway. First I would (used to, at least) download the xpi file, then install it from the locally saved file. For me, that's easier than backing it up from the profile. I'm sure some here, maybe the majority, will think that's "stoopid" (that would be their opinion, everybody's got one, just like . . .) but that's how I've always done it.

[moonbat]

One would think it's easier to just copy a file that is already present on your PC than complain about the site, but well, I must be getting old to not consider that asking this is somehow horribly offensive.

[ron_1]

Who's complaining, Sherlock? I just stated a fact that I hate that "Save link as" is gone. But like the OP, I can live with it.

[Moonchild]

The purpose of the add-ons site it to allow people to install add-ons. It's not an archive or a front-end for otherwise generic file storage. The fact that it was possible for a while because we've been using the "present a specific MIME type to the browser and it will accept it as an install trigger" feature of Pale Moon doesn't mean that that is the best (or intended) method of install, and these changes are to improve the site's primary function.

[New Tobin Paradigm]

It is quite clear that from early on that more than just scrapers, bots, and XPeople have been abusing our services and taking advantage of the open way that things were designed and accomplished.

This has been allowed to go on far long enough. I should have been using InstallTrigger from day one due to its advantages but I didn't for my own reasons and biases even though the InstallTrgger was very traditional.

Given the massive increase in entitlement and rampant rightous indignation on display now it is totally the correct call. This of course does not prevent the service from accomplishing its goal in any way. Which as Moonchild stated is to get people to add-ons and get add-ons installed in the applications.

The fact that we switched to InstallTrigger will also have the benefit of preventing casual abuse is only a side bonus but the primary reason it should be used is that it is assured that it is going to install and not get rejected by a few post-tycho security mitigations people have hit occasionally such as "could not verify the origin" which could happen if the link was middle clicked or just copied and pasted. It will also, when adjusted later, provide the hash which we have calulated and stored to the XPIProvider for verification on installation which this has been asked about and requested before and is already done for other methods such as installation via Add-ons Manager internal search and the Add-ons Update Service.

There simply is no reason not to do this for new installation of add-ons as well. Simply linking to xpi files was a bad call and InstallTrigger is the correct method and had been since add-ons were a thing even way back in the XPInstall days.

For all you people who think downloading and saving is somehow going to benefit more than your obsessive packrat tendancies.. Do know that the Add-ons Datastore is automatically archived up every sunday at midnight and is stored away on my system and Moonchild's NAS and that no user will be able to rage-delete their add-ons off the Add-ons Sites because that functionality will never even be implemented into the software to allow them that ability. Though they will be able to deactivate they cannot and will never be allowed to destroy.

So, any other questions or attempts to justify the reasoning of downloading you want to make?

[RealityRipple]

So, any other questions or attempts to justify the reasoning of downloading you want to make?

"Know what you install before you install it"?

[New Tobin Paradigm]

Then read the page before clicking the green button? This is the reason you don't get a green button in category view but have to go to the actual page and why the install button is after the content. To give you a chance to read and know before installing.

[RealityRipple]

Then read the page before clicking the green button? This is the reason you don't get a green button in category view but have to go to the actual page and why the install button is after the content. To give you a chance to read and know before installing.

By "know", I meant "read the source code and make sure there aren't any packaged EXEs or random JS that bundles up all your passwords and sends them to a third-party website".

[hitokage]

The reason I had for downloading them was I would be getting them from the server only once, and then manually updating them on the various computers I use/am responsible for (computers belonging to family members). This also can be important when you have a a data usage limit (with no other ISP options) or connection issues leading to frequent download retries.

[Moonchild]

By "know", I meant "read the source code

So you're accusing us of not vetting what is approved, then? Please.
Access to the source isn't necessary nor does it guarantee anything (and for some extensions won't even be an option since not everything is public domain, either). I doubt you're going to examine every line of every application's source you install for every version, so it's clearly just for the sake of argument that you even bring this up -- please don't, it's not realistic.
For Open Source extensions the source will be available (and even linked to from the add-ons' page in most cases!) so there is no reason to claim we must make a direct download available. There is not.

If you cannot trust our add-ons team to be pro-active and diligent about the safety of what is hosted, then you should not be considering installing add-ons at all from the site regardless of what method is being used. Please don't try to twist that into somehow getting your hoarding addiction satisfied against a proper judgement call regarding security.

[RealityRipple]

The only person or system I trust to keep my computer secure is me.

[Moonchild]

The only person or system I trust to keep my computer secure is me.

Then don't install extensions that weren't written by you. Don't run any programs you haven't vetted every line of. Don't run Linux that is too large to keep tabs on every change of. In fact, you would be better of not running anything at all and use your computer as a paperweight

i.e.: that kind of attitude is completely unrealistic in this day and age.