Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

331–340 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#331

Post by nodja »

pritambaral wrote: post #325

Run this in your Browser Console[1] to delay signature checking for a day: function set_xpi_sign_time_now() { const {Services} = ChromeUtils.import("resource://gre/modules/Services.jsm"); const now = (new Date()).getTime() / 1000; Services.prefs.setIntPref('app.update.lastUpdateTime.xpi-signature-verification', now); } set_xpi_sign_time_now(); EDIT: Changed `Components.utils.import` to `ChromeUtils.import` because ap…

Can you set this to the future and get say a week of buffer time for the fix to get pushed?

edit: nope, you cannot:(

Re: All extensions disabled due to expiration of intermediate signing cert

#332

Post by kitotik »

needle0 wrote: post #12

I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…

Systems designed around long TTLs make this problem worse. I love the default of 90 days for Let’s Encrypt. It forces some good discipline and hygiene. Wish there was a better solution for short lived CAs

Re: All extensions disabled due to expiration of intermediate signing cert

#333

Post by pinjiz »

MrStonedOne wrote: post #257
Godel_unicode wrote: post #157

Earlier quoted context omitted.

If only there were a way to revoke certificates. Like, some kind of list.

Revocation requires the private key

This is not true. In Let's Encrypt/ACME for example, you can simply obtain authorizations for all the domains a certificate is valid for and request revocation [1]. The only thing you still need to revoke the certificate, is the certificate itself. The certificate can be obtained from CT logs.

[1] https://tools.ietf.org/html/rfc8555#section-7.6

Re: All extensions disabled due to expiration of intermediate signing cert

#334

Post by hu3 »

gpm wrote: post #280
Animats wrote: post #276

It's pathetic to see the attitude demonstrated by Mozilla support on this. diox commented 4 hours ago I'm locking this like I did in #851 because no new information is being added. We're aware and we're working on it. This conversation has been locked as spam and limited to collaborators. [1] Bug 1548973 (armagadd-on-2.0) All extensions disabled due to expiration of intermediate signing cert NEW Unassigned (Needinfo…

> Then users have to reload all the addons I'm pretty sure Mozilla will implement a fix in a way that users only have to update their browser, not do anything to all their addons.

I'm curious about how an update will be able to differentiate tracking cookies from legit ones?

Re: All extensions disabled due to expiration of intermediate signing cert

#335

Post by pritambaral »

nodja wrote: post #331
pritambaral wrote: post #325

Run this in your Browser Console[1] to delay signature checking for a day: function set_xpi_sign_time_now() { const {Services} = ChromeUtils.import("resource://gre/modules/Services.jsm"); const now = (new Date()).getTime() / 1000; Services.prefs.setIntPref('app.update.lastUpdateTime.xpi-signature-verification', now); } set_xpi_sign_time_now(); EDIT: Changed `Components.utils.import` to `ChromeUtils.import` because ap…

Can you set this to the future and get say a week of buffer time for the fix to get pushed? edit: nope, you cannot:(

1. I don't think that'd be necessary; I believe Mozilla will fix it in a day, or two at most (PS: they're currently testing a fix); and

2. I don't know if there's sanity-checking code in Firefox to ignore times in the future.

Re: All extensions disabled due to expiration of intermediate signing cert

#336

Post by Karunamon »

saulrh wrote: post #320
fnrslvr wrote: post #296

Mozilla doesn't seem to have communicated the issue well. I could imagine a lot of unsavvy users have tried some wild things in an attempt to fix the problem, and maybe made a mess in the process. Doesn't Mozilla have a mechanism for blasting out a message to all Firefox browsers? Also I have a Firefox account, why haven't I been inboxed about this? Otherwise I'm not bothered. I won't be switching as long as this get…

> Doesn't Mozilla have a mechanism for blasting out a message to all Firefox browsers? The cynical side of me says that it must not have this feature because if it did I'd have seen someone complaining about the browser "phoning home" or "forcing Mozilla's opinions into my eyeballs".

...unlike the mothership breaking all addons, and the browser being designed intentionally in a way that prevents me from working around the breakage?

This isn't just a petty snipe borne out of annoyance. Ads being the malware vector that they are, and the degree of tracking and data mining out there, all of those countermeasures being turned off overnight is an exposure that should be treated with the same degree of seriousness as PII breach at a company you have an account with.

God forbid you use FoxyProxy or Tor Browser or something else that masks your connection source - this could have legitimate, real-life consequences if you don't notice the change.

Re: All extensions disabled due to expiration of intermediate signing cert

#337

Post by albru123 »

n42 wrote: post #322
tass wrote: post #309

Earlier quoted context omitted.

90 days is 4 times a year. 60 is 6 times, 50% more expensive when you’re paying someone to perform the task.

I had the same thought, but I still find that absurd. Say they host 500,000 websites with HTTPS. 1,000,000 renewals they save spread across the year, roughly 2 renewals a minute. That is pennies. A t2.medium could handle that type of load increase

A bit OT, but what's up with this usage of Amazon EC2 tiers as a unit of computational power?

Re: All extensions disabled due to expiration of intermediate signing cert

#338

Post by pinjiz »

Godel_unicode wrote: post #157
tty2300 wrote: post #108

Earlier quoted context omitted.

Its also more secure. Long lived certs risk the possibility that someone who used to own the domain got a certificate on it and it still works after the domain is resold. Once you automate it there is no downside to short lived certs.

If only there were a way to revoke certificates. Like, some kind of list.

OCSP stapling together with OCSP Must Staple is the way to go here. All major browsers support these.

Firefox still does normal OCSP requests, Chromes does not. So if you are a Chrome user, to my understanding, there is now way to know if the server certificate was revoked or not, other than OCSP stapling together with OCSP Must Staple. Additionally, both Chrome and Firefox ship a list of revoked certificates, but it may not be updated quickly enough and as far as i can tell it mostly contains roots and intermediates.

Re: All extensions disabled due to expiration of intermediate signing cert

#339

Post by thekyle »

gpm wrote: post #239
pepa65 wrote: post #232

Earlier quoted context omitted.

I just set xpinstall.signatures.required to True in about:config and that fixed it after a restart.

Curious, that shouldn't work on branded stable installs.

It works on Linux but not Windows or Mac installs. I assume that repo maintainers use different compiler options than the official Firefox binaries.

Re: All extensions disabled due to expiration of intermediate signing cert

#340

Post by hu3 »

mirimir wrote: post #327
hu3 wrote: post #275

Earlier quoted context omitted.

It was Friday night on most parts of the Western hemisphere. I'm guessing it took some time to get the right people back to work and assess the situation.

Yes. I was upset. Sorry. I ought to know to stop when I'm upset.

Nah don't worry. We're all upset and a bit disappointed.
Post reply on HN