This almost turned me into raging monster. How dare you mozilla disabling adblock? now i want an UNSEE function :D
All extensions disabled due to expiration of intermediate signing cert
71–80 of 955 posts
Re: All extensions disabled due to expiration of intermediate signing cert
#72I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…
You can find lots of programs like this one to monitor certs:
https://pypi.org/project/check-tls-certs/
I run one daily from cron and have it email me a report with the days to expiration for the certs I’m responsible for, even for certs that auto renew. I don’t filter the email. Daily is not too frequent for it to go to my inbox, but frequent enough that I’ll notice if it doesn’t mail me. YMMV.
Re: All extensions disabled due to expiration of intermediate signing cert
#73There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false. However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition. To fix this on MacOS I did the following: 1. Downloaded and installed Firefox Nightly 2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/fir…
Thank you!
Saved me tons of ultimately pointless thrashing.
Re: All extensions disabled due to expiration of intermediate signing cert
#74This is why users need to be in control of their own computers. Why can't I tell my copy of Firefox to ignore the certificate? Why can't I sign my own extensions? Mistakes happen, it's okay. But users should be empowered to work around them.
Because it's hard to tell the difference between "users" and "malicious software running on their computers".
Re: All extensions disabled due to expiration of intermediate signing cert
#75I'm a bit confused.
I thought that the way signing works in general is that the signer issues a certificate for the thing being signed (domain, code, whatever) that contains identifying information for the thing signed (host name for an SSL certificate, checksum of the code for a code signing certificate), the valid from and valid to dates of that certificate, and assorted other information, and either a reference to or a copy of the signer's certificate, and it signs the whole issued certificate with the signer's certificate.
Someone checking the signed thing is supposed to consider it validly signed if:
1. The date is in the valid range for the signed thing's certificate,
2. A check of the signature of that certificate against the signing certificate passes,
3. The signing certificate is recognized as being from an issuer considered trusted by the checker,
4. Neither the signed thing's certificate nor the signing certificate have been revoked, and
5. The signing took place during the valid date range of the signing certificate.
Note there is no "the date of the check is in the valid date range of the signing certificate". A signing certificate expiring should not invalidate things signed by it. It should just prevent signing anything else with it.
So why is a signing certificate expiring for Firefox breaking already signed extensions? Shouldn't it just be stopping new versions of extensions from being signed?
Re: All extensions disabled due to expiration of intermediate signing cert
#76Earlier quoted context omitted.
protecting 99.999% of the users It is horribly paternalistic to advocate for keeping users ignorant, unlearning, and --- dare I say it --- easily manipulated. I will refrain from mentioning again that infamous Franklin quote. I am frankly very fucking pissed off by this authoritarian walled-garden trend, and vehemently oppose anyone who helps this industry put the nooses around the necks of others as well as their ow…
I’ve been in software development and operations for 25 years. I still don’t want to have to understand everything I ever touch, even if I could.
"don't run privileged code from people you don't trust." Is both critically important to understand for anyone using a network connected computer and not at all complicated.
If we're going to be authoritarian I would rather ban anyone who doesn't understand that from connecting to the internet then have a broken walled garden.
Re: All extensions disabled due to expiration of intermediate signing cert
#77If they can't get this right, what hope is there of browser security?
Re: All extensions disabled due to expiration of intermediate signing cert
#78Newbie question: why can't they just renew the certificate, like in 5 minutes?
They would have to reissue the intermediate certificate, as well as all dependent certificates.
Re: All extensions disabled due to expiration of intermediate signing cert
#79This is a goddamned disaster. I'm just thankful that I use an offline password manager, but even still ... I like FF, don't get me wrong, but this is going to absolutely fucking destroy user trust in Mozilla. This kind of incompetence, on a browser scale , is breathtaking.
I use firefox and am probably affected by this but don't even really notice atm. This doesn't even register on my user trust spectrum when the only other option is the browser that defines surveillance capitalism. I think we'll all live. No need for the chicken little act.
I'm not sure the GP is overstating things. For technical folks with technical reasons to be using Firefox: yeah, a mass exodus is unlikely purely because there aren't any good alternatives. What are you going to jump to? Chrome, and knuckle under to the Goog? Unbranded FF forks and be weeks behind on patches? Doubtful.
My concern is around non-technical users (the group, mind you, that Firefox has been spending marketing dosh on courting recently with Quantum and all) who don't have as compelling reasons for not just switching back to Chrome. In the last hour, I've gotten several phone calls from family members asking me why the browser I convinced them to use is broken. I don't have a good answer, because platitudes about surveillance and muh freedoms don't count for shit when your grandma just wants to get rid of the ads on the local newspaper site.
I'm personally going nowhere and deeply appreciate Mozilla for all the work on FF and friends, occasional fuckups aside, but I don't think this is going to be a non-event for a browser that's been desperately fighting to regain market/mind-share.
Re: All extensions disabled due to expiration of intermediate signing cert
#80I'm not familiar with Firefox extensions (and have pretty much stayed away from the stuff ever since they started making it "mandatory"...) but shouldn't the expiration only mean new signatures won't be valid, yet signatures made before expiration should remain so? At least that's how I understand things like Windows' driver signing works (when that was first introduced, I was quite scared that it would mean perfectl…
This same behavior is how certs usually work. Stuff with expired certs just does not run after the expiration date; that's because the cert tells you what server to ask for authentication, and if you have an old cert, there's no way to be sure that the original issuer is still the one in control of that domain.
You're referring to things like HTTPS and contacting a remote server, and thus your reasoning there makes sense.
I'm referring to traditional code signing, which I assume Firefox extensions are more similar to --- the goal being to ensure that some data has not changed since it was signed, and only the validity of the certificate at the time the data was signed is meaningful; even after the certificate expires, a signature created when it was valid still asserts that the data it signed has not changed.