I never liked change that extensions had to be signed by mozilla. Why do my personal extensions need to be hooked into some third party service that can go out at anytime?
The developer edition allows that just fine.
All extensions disabled due to expiration of intermediate signing cert
141–150 of 955 posts
Re: All extensions disabled due to expiration of intermediate signing cert
#142Earlier quoted context omitted.
Oh relax. A cert expired. An intermediate cert at that... This has probably happened to every major cloud provider and countless companies at least once. Certs are hard . Should Mozilla have had monitoring on their cert expiration? Yes. Will they after this? Probably. Is any one person ever at fault for something like this? No. Firefox is an open source project. You're welcome to contribute and make things better.
>Firefox is an open source project. You're welcome to contribute and make things better. Well no because they won't accept a patch that lets us plebs turn off the signed extension requirement.
The Developer edition allows that just fine.
Re: All extensions disabled due to expiration of intermediate signing cert
#143Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now.
Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(
Re: All extensions disabled due to expiration of intermediate signing cert
#144Looks like all extensions have been disabled for all Firefox users. I think this fail-closed behavior is more of a security issue than the one it is trying to solve. All of my security add-ons - Privacy Badger, NoScript, Decentraleyes, and many more were disabled. Even worse, it happened without notice to the user. One moment I was browsing the internet (just barely) secured by these add-ons, and the next moment, all…
[deleted]
Re: All extensions disabled due to expiration of intermediate signing cert
#145This is a goddamned disaster. I'm just thankful that I use an offline password manager, but even still ... I like FF, don't get me wrong, but this is going to absolutely fucking destroy user trust in Mozilla. This kind of incompetence, on a browser scale , is breathtaking.
On Linux, Dashlane only has a browser extension. Luckily, Bitwarden has both desktop and browser versions on Linux.
Re: All extensions disabled due to expiration of intermediate signing cert
#146Earlier quoted context omitted.
You can find lots of programs like this one to monitor certs: https://pypi.org/project/check-tls-certs/ I run one daily from cron and have it email me a report with the days to expiration for the certs I’m responsible for, even for certs that auto renew. I don’t filter the email. Daily is not too frequent for it to go to my inbox, but frequent enough that I’ll notice if it doesn’t mail me. YMMV.
Discovery of all the certs is what I think is the harder problem.
We have an agent that pulls certs from an internal service and stores them on disk where apps can use them. We no longer manually install certificates. This solves discovery, and gives us alerts on services that have stopped refreshing their certs for any reason. The internal service is wired into lets encrypt and a commercial certificate provider. Setup is minimal, and after that completely automated.
Re: All extensions disabled due to expiration of intermediate signing cert
#147I'm a bit confused. I thought that the way signing works in general is that the signer issues a certificate for the thing being signed (domain, code, whatever) that contains identifying information for the thing signed (host name for an SSL certificate, checksum of the code for a code signing certificate), the valid from and valid to dates of that certificate, and assorted other information, and either a reference to…
As noted, in practice, without additional info, there's no way to tell when a signature was created and so all signatures die when the signing cert expires.
That said, existing signatures that have already been verified, for existing extensions, should still be trusted.
Re: All extensions disabled due to expiration of intermediate signing cert
#148Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now. Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(
Yikes.
Re: All extensions disabled due to expiration of intermediate signing cert
#149Still beats using chrome.
Re: All extensions disabled due to expiration of intermediate signing cert
#150I never liked change that extensions had to be signed by mozilla. Why do my personal extensions need to be hooked into some third party service that can go out at anytime?
The developer edition allows that just fine.
Developer edition is effectively aurora/alpha. It is buggy compared to release. And yes, I do mean that. If it were not it'd be 'release'.
Asking people to either give up control of their software (ie, walled garden release versions) or use buggy and insecure software Dev/Nightly/etc is not acceptable.
It's why I switched to a freedom respecting Firefox fork as soon as they announced walled garden extension signing in Firefox 37.