All extensions disabled due to expiration of intermediate signing cert
221–230 of 955 posts
Re: All extensions disabled due to expiration of intermediate signing cert
#222I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…
> I’ll still keep using Firefox since I recognize the importance of browser diversity Also, Chrome is not immune to "crashes for everyone at the same time" bugs. Like that time when the start of daylight saving time made it crash for a full day (a quick search tells me it probably was https://bugs.chromium.org/p/chromium/issues/detail?id=287821 ).
What else would you expect for auto-updating software that relies on the internet to work? It's a monoculture attached to a firehose of disease.
This is exactly the same as "pushing out a security fix to all users," except it apparently wasn't intentional. You can't have one without the other.
Re: All extensions disabled due to expiration of intermediate signing cert
#223The goal of recurring task is to get people's attention to review and perform tasks the happen periodically. It could be as simple as reviewing it and marking it done. They will show up as part of the bug report to the assignees, so they can at one place see all the bugs, feature requests, tasks, and recurring tasks.
Cert renewing would fall under the recurring task category.
Re: All extensions disabled due to expiration of intermediate signing cert
#224If you have a well-designed system that only works with encryption, then sure, but this idea of using the same mistaken systems as the WWW clearly doesn't work well.
I've never seen a Tor Hidden Service fail because of something expiring.
Much of this nonsense about encrypting everything, without reason and excuse, is to protect advertisements from being modified.
That this hit Tor Browser and disabled NoScript is damning, but I already disable JavaScript in about:config and I'm not even using a version of Firefox this new, anyway.
I can't tell if my opinion of Mozilla is lower or if it can't get lower.
Re: All extensions disabled due to expiration of intermediate signing cert
#225Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now. Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(
Try turning it off. I got rid of ublock after arstechnica complained about a lot of their users blocking ads years ago and it honestly isn't that bad. Every once in a while I do back out of a page for maxing out one of my cpu cores but otherwise, nothing ever bad happens. With ads: either it takes me half a second to tell I'm not interested in an ad, or I actually am interested and i follow the ad because I am interested and I want to support the website.
The alternative is websites charging insane amounts of money with paywalls (Wall street journal has their "best" price for 12 months at $360 a year). That is horrible because it means only rich people can pay for high quality news as ads are one of the most progressive forms of payment (rich people ads are way more valuable than poor peoples and yet everyone gets the same quality services/news with the ad model despite their income/net worth).
Re: All extensions disabled due to expiration of intermediate signing cert
#226I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…
> Still, this type of oversight seems all too common even in large companies. (...) Has anyone developed a tool designed specifically to avoid certificate expiry disasters? LetsEncrypt renewal is supposed to be automated. [1] I know of a company that hosted blogs for thousands of customers. They used LetsEncrypt, but the CTO considered automatic renewals a possible security risk, so they did it manually. Problem is,…
Re: All extensions disabled due to expiration of intermediate signing cert
#227Open the browser console by hitting ctrl-shift-j
Copy and paste the following code, hit enter. Until mozilla fixes the problem you will need to redo this once every 24 hours:
// Re-enable *all* extensions
async function set_addons_as_signed() {
Components.utils.import("resource://gre/modules/addons/XPIDatabase.jsm");
Components.utils.import("resource://gre/modules/AddonManager.jsm");
let addons = await XPIDatabase.getAddonList(a => true);
for (let addon of addons) {
// The add-on might have vanished, we'll catch that on the next startup
if (!addon._sourceBundle.exists())
continue;
if( addon.signedState != AddonManager.SIGNEDSTATE_UNKNOWN )
continue;
addon.signedState = AddonManager.SIGNEDSTATE_NOT_REQUIRED;
AddonManagerPrivate.callAddonListeners("onPropertyChanged",
addon.wrapper,
["signedState"]);
await XPIDatabase.updateAddonDisabledState(addon);
}
XPIDatabase.saveChanges();
}
set_addons_as_signed();
Edit: Cleanup up code slightly...Re: All extensions disabled due to expiration of intermediate signing cert
#228Re: All extensions disabled due to expiration of intermediate signing cert
#229Re: All extensions disabled due to expiration of intermediate signing cert
#230They don't use cryptographic timestamps with their signatures ? The certificate might now be invalid, but the signatures were done at a time when it was valid...