Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

271–280 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#271

Post by jchw »

sjwright wrote: post #263
jchw wrote: post #250

Earlier quoted context omitted.

(Big fat disclaimer: I work for Google. These are my opinions and not my employers. I don't work on browsers. I test my code in Firefox. Etc etc.) Sadly, I have to agree that this feels like a big blow to user trust. User trust is not really just about respect or values; it definitely also includes things like performance and reliability. The average user, right now feeling powerless, might even feel anger towards Mo…

> this feels like a big blow to user trust. And yet every other major browser vendor has punched their users with far worse catastrophes of privacy, security, ripping away features, breaking features, and general shitheaddedness. Switching browsers because of this incident is like ordering a burger at your favourite restaurant and one time it comes out without the meat patty, so in protest you switch to a crappy alte…

I'm going to skip the analogies and just say this: If tomorrow this is still broken and I have a choice between installing Chromium, and installing Nightly + disabling security features, It's going to be a tough dilemma for me personally.

I'm glad you have software/vendors you feel you can trust. I definitely don't feel that way about most software anymore. I do think you are being a bit hyperbolic regarding other browser vendors, but to each their own, I don't know what trying to argue about that would solve for anyone.

Re: All extensions disabled due to expiration of intermediate signing cert

#272

Post by hu3 »

ww520 wrote: post #223

Not sure what kind business processes are practiced in Mozilla. Some organizations have the notation of recurring tasks as part of their business processes. Recurring tasks are just like bug reports except they are created and assigned automatically to task owners on a schedule, such as every month, every quarter, and every year. The goal of recurring task is to get people's attention to review and perform tasks the…

Like a reminder that gets automatically added to the taskboard?

I like it! Will talk about this with my team lead!

Re: All extensions disabled due to expiration of intermediate signing cert

#273

Post by Nicksil »

mrep wrote: post #259
hnaccy wrote: post #251

Earlier quoted context omitted.

>nothing ever bad happens. With ads: either it takes me half a second to tell I'm not interested in an ad, or I actually am interested and i follow the ad because I am interested and I want to support the website. You just described something bad.

Assuming you mean that half second looking at the ad: Name a better alternative for funding the internet. Paywalls at every website?

>Assuming you mean that half second looking at the ad: Name a better alternative for funding the internet. Paywalls at every website?

Funding the Internet? What you're talking about (ads) is a revenue stream for what amounts to a handful of websites. google.com, amazon.com, ycombinator.com, reddit.com, thefacebook.com, tweeter.com, etc. could all go offline right now and the Internet would still be here.

Re: All extensions disabled due to expiration of intermediate signing cert

#274

Post by dingaling »

revvx wrote: post #169
mc32 wrote: post #89

Earlier quoted context omitted.

So did they conclude it wasn’t a security concern or did they conclude the security risk was worth the uptime?

When pressed, they admitted it was just "gut feeling". The team audited a couple ACME clients and couldn't find anything to justify not automating.

Having a root process with write-privileges to /etc on production machines and also able to communicate over the Internet definitely is a security risk.

To mitigate that you end-up building a series of privilege-restricted jobs flowing from the DMZ back into the internal network. And maintaining that might be more complicated than just manually renewing, depending upon the processes and architecture of the company.

Re: All extensions disabled due to expiration of intermediate signing cert

#275

Post by hu3 »

mirimir wrote: post #131

So why is this taking so long to fix? From https://github.com/mozilla/addons/issues/978 > diox commented 2 hours ago > I'm locking this like I did in #851 because no new information is being added. We're aware and we're working on it. I mean, two hours? WTF.

It was Friday night on most parts of the Western hemisphere. I'm guessing it took some time to get the right people back to work and assess the situation.

Re: All extensions disabled due to expiration of intermediate signing cert

#276

Post by Animats »

It's pathetic to see the attitude demonstrated by Mozilla support on this.

diox commented 4 hours ago

I'm locking this like I did in #851 because no new information is being added. We're aware and we're working on it. This conversation has been locked as spam and limited to collaborators.[1]

Bug 1548973 (armagadd-on-2.0) All extensions disabled due to expiration of intermediate signing cert NEW Unassigned (Needinfo from 3 people)

Kevin Brosnan [:kbrosnan]

We have confirmed this issue. Extra comments about this being broken will not advance this bug to being fixed.[2]

Mozilla just left their entire user base unprotected against ads, trackers, and some hostile code. Then they insult their users.

Undoing the damage is hard. First, they have to update their signing certificate. Then they have to re-sign all the add-ons. Then users have to reload all the addons. Then, something users won't do - remove all the tracking cookies, etc. that slipped in while Firefox was broken.

[1] https://github.com/mozilla/addons/issues/978

[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1548973

Re: All extensions disabled due to expiration of intermediate signing cert

#277

Post by yardstick »

In addition to the immediate fix, what needs to happen here and in general anywhere a certificate is used, is the browser should display an informational banner that the certificate is due to expire soon. I’d suggest start warning at T-7 days left.

That way even if the business messed up, they would have a heads up from users to fix it before d-day when everything stops working. This includes website certs and addon signing certs and any intermediaries.

Re: All extensions disabled due to expiration of intermediate signing cert

#278

Post by tomschlick »

weavejester wrote: post #94
driverdan wrote: post #23

First they force code signing on everyone without a way to disable it then they break it. This is an extreme level of incompetence I didn't expect from Mozilla. They'd better have the best post mortum ever, possibly with someone being fired.

A mistake of this magnitude cannot be the fault of an individual, because if it was, then the organization lacked adequate safeguards. What I'd like to see is a post-mortem, followed by an explanation of how they'll prevent the mistake from being made again in future.

> how they'll prevent the mistake from being made again in future

This could have been prevented by someone putting the expiration date on the team shared calendar with a 60 day alert.

Re: All extensions disabled due to expiration of intermediate signing cert

#279

Post by glitchcrab »

revvx wrote: post #195
Abishek_Muthian wrote: post #171

Earlier quoted context omitted.

Some shared hosting like Bluehost now provide LetsEncrypt by default for all their sites with auto-renewal (But I don't recommend Bluehost shared plans for anything even closer to serious hobby due to absurd downtimes like most other shared hosting). I used manual renewal for LetsEncrypt for about 4 websites on other shared hosts & renewing them every 3 months was a pain; had to keep reminders and schedules just not…

Another option is using a Web Server/Reverse Proxy that supports Let's Encrypt automatically, like Caddy [1]. I believe Apache HTTPD has partial support [2], too. [1] https://caddyserver.com [2] https://httpd.apache.org/docs/2.4/mod/mod_md.html

Traefik is another option here for a reverse proxy with automated renewals; I use it in a ton of places.

https://traefik.io

Re: All extensions disabled due to expiration of intermediate signing cert

#280

Post by gpm »

Animats wrote: post #276

It's pathetic to see the attitude demonstrated by Mozilla support on this. diox commented 4 hours ago I'm locking this like I did in #851 because no new information is being added. We're aware and we're working on it. This conversation has been locked as spam and limited to collaborators. [1] Bug 1548973 (armagadd-on-2.0) All extensions disabled due to expiration of intermediate signing cert NEW Unassigned (Needinfo…

> Then users have to reload all the addons

I'm pretty sure Mozilla will implement a fix in a way that users only have to update their browser, not do anything to all their addons.

Post reply on HN