Can somebody please explain to me the purpose of this change. I read the blog post explaining the decision[0]. The crux of the argument was
>many tens of millions of users have non-hosted add-ons that were installed without their informed consent"
Why go thermonuclear and require add-on signing for everyone? Why not just make the add-on installation screen a little bit scarier. And if the concern is to make sure that people are installing what they think they're installing (i.e not something served by a man in the middle), then maybe just require that add-ons be downloaded from a site with HTTPS.
I just really don't see the point in this extreme choice.
>many tens of millions of users have non-hosted add-ons that were installed without their informed consent"
Why go thermonuclear and require add-on signing for everyone? Why not just make the add-on installation screen a little bit scarier. And if the concern is to make sure that people are installing what they think they're installing (i.e not something served by a man in the middle), then maybe just require that add-ons be downloaded from a site with HTTPS.
I just really don't see the point in this extreme choice.
[0] https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte...