On a slightly different note, is there some curated collection of serious incidents like this somewhere? Something we could refer to when discussing possible pitfalls?
I believe https://github.com/danluu/post-mortems is close to what you want.
All extensions disabled due to expiration of intermediate signing cert
181–190 of 955 posts
Re: All extensions disabled due to expiration of intermediate signing cert
#182On a slightly different note, is there some curated collection of serious incidents like this somewhere? Something we could refer to when discussing possible pitfalls?
I've seen a (then) current version of Glassfish (java EE server) refuse to start because of an expired internal certificate a couple of years ago.
So here is one example: https://stackoverflow.com/questions/18248020/certificate-has...
Re: All extensions disabled due to expiration of intermediate signing cert
#183Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now. Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(
That's really bad because it means it also effects Firefox ESR which is what lots of large enterprise users have installed.
Re: All extensions disabled due to expiration of intermediate signing cert
#184Earlier quoted context omitted.
The developer edition allows that just fine.
Developer edition is effectively aurora/alpha. It is buggy compared to release. And yes, I do mean that. If it were not it'd be 'release'. Asking people to either give up control of their software (ie, walled garden release versions) or use buggy and insecure software Dev/Nightly/etc is not acceptable. It's why I switched to a freedom respecting Firefox fork as soon as they announced walled garden extension signing i…
Sure: debranded versions ("freedom respecting") will also do that.
You say walled garden, I see what random WebExtensions people install on their work laptops and think "yeah maybe someone policing this thing isn't the worst thing". But most importantly: it sounds like it's not actually a problem for you?
Re: All extensions disabled due to expiration of intermediate signing cert
#185I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…
Maybe we need more browser diversity than just two different teams with two different systems. Both are sitting very close to each other geographically, and both are produced in the same culture (as in silicon valley), so it would seem likely that, while they compete with each other, they will apply very similar answers to problems they face.
Re: All extensions disabled due to expiration of intermediate signing cert
#186There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false. However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition. To fix this on MacOS I did the following: 1. Downloaded and installed Firefox Nightly 2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/fir…
This also works if you build from source, even if you build off mozilla-release. (Just tried it.)
Re: All extensions disabled due to expiration of intermediate signing cert
#187adblocker seemed stop working, no idea why, anyone know how to fix them or just wait?!
This helped me discover Firefox's Content Blocking setting, which is set to Standard by default, but now I set it to Strict. Works better than an ad block!
Preferences > Privacy and Security > Strict
Re: All extensions disabled due to expiration of intermediate signing cert
#188I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…
> Still, this type of oversight seems all too common even in large companies. (...) Has anyone developed a tool designed specifically to avoid certificate expiry disasters? LetsEncrypt renewal is supposed to be automated. [1] I know of a company that hosted blogs for thousands of customers. They used LetsEncrypt, but the CTO considered automatic renewals a possible security risk, so they did it manually. Problem is,…
I have no idea why you'd deliberately wait the full 90 days to do a manual renew. For reasons, I renew manually, but every 60 days or so. Nowhere close to the deadline.
Re: All extensions disabled due to expiration of intermediate signing cert
#189First they force code signing on everyone without a way to disable it then they break it. This is an extreme level of incompetence I didn't expect from Mozilla. They'd better have the best post mortum ever, possibly with someone being fired.
Oh relax. A cert expired. An intermediate cert at that... This has probably happened to every major cloud provider and countless companies at least once. Certs are hard . Should Mozilla have had monitoring on their cert expiration? Yes. Will they after this? Probably. Is any one person ever at fault for something like this? No. Firefox is an open source project. You're welcome to contribute and make things better.
> Oh relax. A cert expired. An intermediate cert at that...
Everyone's extensions broke. Including security ones. Including the ones bundled into the TOR browser. And end-users can't fix it. Because Mozilla decided that it was too dangerous to let users choose what extensions to run for themselves. This is an excellent moment to be upset.
Re: All extensions disabled due to expiration of intermediate signing cert
#190First they force code signing on everyone without a way to disable it then they break it. This is an extreme level of incompetence I didn't expect from Mozilla. They'd better have the best post mortum ever, possibly with someone being fired.
Hopefully management being fired. This reeks of management not letting the technical team automate something or other bad decision making that lead to this. If one person was in charge of it and they messed it up, that is as much the fault of whomever gave that important task to only one person as the person making the mistake. I don't want the low-level person punished, I want the one who put them in the place to be able to make such a bad mistake without any sort of redundancy or contingency plan.