Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

41–50 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#41

Post by MrEldritch »

vatueil wrote: post #21
dontbenebby wrote: post #7

Earlier quoted context omitted.

>This is a goddamned disaster. I'm just thankful that I use an offline password manager I'm not sure this cert is used with the PW manager?

I think MrEldritch is referring not to Firefox's built-in password manager, but third-party password managers such as Bitwarden, KeePass, and LastPass. Those rely on add-ons for browser integration.

That's what I meant, yes. (I didn't even know that KeePass could be integrated with the browser, I've just been manually copy-pasting)

Re: All extensions disabled due to expiration of intermediate signing cert

#42

Post by userbinator »

Wowfunhappy wrote: post #34

This is why users need to be in control of their own computers. Why can't I tell my copy of Firefox to ignore the certificate? Why can't I sign my own extensions? Mistakes happen, it's okay. But users should be empowered to work around them.

It's always felt somewhat unsettling that, although the Internet is decentralised, a small number of large organisations have a surprisingly large amount of control over the software which the majority of users view sites with. I don't like this concentration of power --- even if you think Mozilla is benevolent, it's not immune to making mistakes; and the more power it has, the bigger the consequences.

Before the forced code signing, before the automatic updates, Mozilla or any other organisation's mistakes would not have such dramatic effects; now, they have the power to basically break almost all their userbase nearly instantly, and that is what worries me the most.

Re: All extensions disabled due to expiration of intermediate signing cert

#43

Post by ehsankia »

Wowfunhappy wrote: post #34

This is why users need to be in control of their own computers. Why can't I tell my copy of Firefox to ignore the certificate? Why can't I sign my own extensions? Mistakes happen, it's okay. But users should be empowered to work around them.

> Why can't I tell my copy of Firefox to ignore the certificate? Why can't I sign my own extensions?

The issue is that if you leave any sort of lever that reduces security, it will be abused by bad actors. This is why browsers are having ever decreasing ways to bypass security and have full access. It is annoying, but at the end of the day, protecting 99.999% of the users trumps what us power users want.

Re: All extensions disabled due to expiration of intermediate signing cert

#44

Post by revvx »

Wowfunhappy wrote: post #34

This is why users need to be in control of their own computers. Why can't I tell my copy of Firefox to ignore the certificate? Why can't I sign my own extensions? Mistakes happen, it's okay. But users should be empowered to work around them.

It is possible, according to another post by bitbang [1]:

> Temporary work around till the cert gets fixed: set "xpinstall.signatures.required" to false

https://news.ycombinator.com/item?id=19823879

Re: All extensions disabled due to expiration of intermediate signing cert

#45

Post by steve19 »

driverdan wrote: post #23

First they force code signing on everyone without a way to disable it then they break it. This is an extreme level of incompetence I didn't expect from Mozilla. They'd better have the best post mortum ever, possibly with someone being fired.

Why does someone need to be fired? Does some blood spilled really make it better? Have some compassion.

Re: All extensions disabled due to expiration of intermediate signing cert

#46

Post by [deleted] »

MrEldritch wrote: post #41
vatueil wrote: post #21

Earlier quoted context omitted.

I think MrEldritch is referring not to Firefox's built-in password manager, but third-party password managers such as Bitwarden, KeePass, and LastPass. Those rely on add-ons for browser integration.

That's what I meant, yes. (I didn't even know that KeePass could be integrated with the browser, I've just been manually copy-pasting)

[deleted]

Re: All extensions disabled due to expiration of intermediate signing cert

#47

Post by wbl »

driverdan wrote: post #23

First they force code signing on everyone without a way to disable it then they break it. This is an extreme level of incompetence I didn't expect from Mozilla. They'd better have the best post mortum ever, possibly with someone being fired.

There is exactly one person who isn't going to do that again.

Re: All extensions disabled due to expiration of intermediate signing cert

#48

Post by weavejester »

There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false.

However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition.

To fix this on MacOS I did the following:

1. Downloaded and installed Firefox Nightly

2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/firefox-bin --profilemanager

3. Changed the profile to "default" so my normal Firefox profile would be used

4. Started up Firefox Nightly, opened about:config, then set xpinstall.signatures.required to false

Not sure if it's a good idea to use my default profile in Nightly. It might be a wiser idea to copy it instead.

Re: All extensions disabled due to expiration of intermediate signing cert

#50

Post by MrEldritch »

userbinator wrote: post #18

I'm not familiar with Firefox extensions (and have pretty much stayed away from the stuff ever since they started making it "mandatory"...) but shouldn't the expiration only mean new signatures won't be valid, yet signatures made before expiration should remain so? At least that's how I understand things like Windows' driver signing works (when that was first introduced, I was quite scared that it would mean perfectl…

This same behavior is how certs usually work. Stuff with expired certs just does not run after the expiration date; that's because the cert tells you what server to ask for authentication, and if you have an old cert, there's no way to be sure that the original issuer is still the one in control of that domain.
Post reply on HN