[tbb-bugs] #14970 [Tor Browser]: Don't allow third parties to block our own Tor Browser extensions

[Tor Bug Tracker & Wiki]

#14970: Don't allow third parties to block our own Tor Browser extensions
-----------------------------+------------------------------------
     Reporter:  gk           |      Owner:  tbb-team
         Type:  enhancement  |     Status:  new
     Priority:  normal       |  Milestone:
    Component:  Tor Browser  |    Version:
   Resolution:               |   Keywords:  ff45-esr, tbb-security
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+------------------------------------

Comment (by mcs):

 I agree with this approach (just exempt our own bundled add-ons from the
 3rd party signing requirement). There is also a ticket that I cannot find
 at the moment that proposes that we should build in Tor Launcher and
 Torbutton so they cannot be disabled or removed. Since the changes for
 #10280 landed, disabling or removing Torbutton makes it so that
 about:addons cannot be opened, which means that users can paint themselves
 into a corner (the file toolkit/mozapps/extensions/content/extensions.xul
 directly uses entities that are part of Torbutton's  brand.dtd file).

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/14970#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online