Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

101–110 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#101

Post by dev_dull »

js2 wrote: post #72
needle0 wrote: post #12

I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…

You can find lots of programs like this one to monitor certs: https://pypi.org/project/check-tls-certs/ I run one daily from cron and have it email me a report with the days to expiration for the certs I’m responsible for, even for certs that auto renew. I don’t filter the email. Daily is not too frequent for it to go to my inbox, but frequent enough that I’ll notice if it doesn’t mail me. YMMV.

Discovery of all the certs is what I think is the harder problem.

Re: All extensions disabled due to expiration of intermediate signing cert

#102

Post by unreal37 »

MrEldritch wrote: post #4

This is a goddamned disaster. I'm just thankful that I use an offline password manager, but even still ... I like FF, don't get me wrong, but this is going to absolutely fucking destroy user trust in Mozilla. This kind of incompetence, on a browser scale , is breathtaking.

Seems like an over-reaction. "Destroy user trust in Mozilla?" Really? Because your extensions got disabled for a day?

Re: All extensions disabled due to expiration of intermediate signing cert

#103

Post by phyzome »

weavejester wrote: post #48

There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false. However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition. To fix this on MacOS I did the following: 1. Downloaded and installed Firefox Nightly 2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/fir…

This worked for me on Firefox 60.6.1esr on Debian 9 Linux—changing the setting instantly restored my addons.

Re: All extensions disabled due to expiration of intermediate signing cert

#106

Post by [deleted] »

weavejester wrote: post #48

There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false. However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition. To fix this on MacOS I did the following: 1. Downloaded and installed Firefox Nightly 2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/fir…

[deleted]

Re: All extensions disabled due to expiration of intermediate signing cert

#107

Post by phyzome »

jtl999 wrote: post #97

Running Firefox 66 from Ubuntu repositories on Ubuntu 18.04 and all my extensions are enabled. Does it only occur after a restart or?

I believe it happens the next time Firefox goes to check for addon updates. You may want to proactively set xpinstall.signatures.required=false which... I think might work for 66 on Linux? It worked for 60.

Re: All extensions disabled due to expiration of intermediate signing cert

#108

Post by tty2300 »

dev_dull wrote: post #98
kam wrote: post #25

Earlier quoted context omitted.

ACME / Let's Encrypt go in the direction of making expiry happen so often that renewal gets automated, rather than a being a rare manual process that can be forgotten about. Not sure that's viable for a signing certificate like this, but that's the way to solve it for the web PKI.

It’s funny to me that people talk about this limitation as if it were some kind of virtue.

Its also more secure. Long lived certs risk the possibility that someone who used to own the domain got a certificate on it and it still works after the domain is resold. Once you automate it there is no downside to short lived certs.

Re: All extensions disabled due to expiration of intermediate signing cert

#109

Post by datguacdoh »

swiley wrote: post #76
macintux wrote: post #63

Earlier quoted context omitted.

I’ve been in software development and operations for 25 years. I still don’t want to have to understand everything I ever touch, even if I could.

"don't run privileged code from people you don't trust." Is both critically important to understand for anyone using a network connected computer and not at all complicated. If we're going to be authoritarian I would rather ban anyone who doesn't understand that from connecting to the internet then have a broken walled garden.

> "don't run privileged code from people you don't trust." Is both critically important to understand for anyone using a network connected computer and not at all complicated.

That is absolutely complicated for the vast majority of the world's internet users. No one else is my family would understand what the hell "privileged code" means and shouldn't have to.

Re: All extensions disabled due to expiration of intermediate signing cert

#110

Post by hnaccy »

cheeze wrote: post #100
driverdan wrote: post #23

First they force code signing on everyone without a way to disable it then they break it. This is an extreme level of incompetence I didn't expect from Mozilla. They'd better have the best post mortum ever, possibly with someone being fired.

Oh relax. A cert expired. An intermediate cert at that... This has probably happened to every major cloud provider and countless companies at least once. Certs are hard . Should Mozilla have had monitoring on their cert expiration? Yes. Will they after this? Probably. Is any one person ever at fault for something like this? No. Firefox is an open source project. You're welcome to contribute and make things better.

>Firefox is an open source project. You're welcome to contribute and make things better.

Well no because they won't accept a patch that lets us plebs turn off the signed extension requirement.

Post reply on HN