Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

341–350 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#341

Post by pinjiz »

mirimir wrote: post #324
fnrslvr wrote: post #296

Mozilla doesn't seem to have communicated the issue well. I could imagine a lot of unsavvy users have tried some wild things in an attempt to fix the problem, and maybe made a mess in the process. Doesn't Mozilla have a mechanism for blasting out a message to all Firefox browsers? Also I have a Firefox account, why haven't I been inboxed about this? Otherwise I'm not bothered. I won't be switching as long as this get…

https://twitter.com/mozamo https://discourse.mozilla.org/t/certificate-issue-causing-ad...

> 429 Too Many Requests

Mozilla's discourse forum is now offline :)

Re: All extensions disabled due to expiration of intermediate signing cert

#342

Post by gianpaj »

pritambaral wrote: post #325

Run this in your Browser Console[1] to delay signature checking for a day: function set_xpi_sign_time_now() { const {Services} = ChromeUtils.import("resource://gre/modules/Services.jsm"); const now = (new Date()).getTime() / 1000; Services.prefs.setIntPref('app.update.lastUpdateTime.xpi-signature-verification', now); } set_xpi_sign_time_now(); EDIT: Changed `Components.utils.import` to `ChromeUtils.import` because ap…

Components.utils is undefined (Firefox 67.0b16 macOS)

Re: All extensions disabled due to expiration of intermediate signing cert

#343

Post by rampant_ai »

nodja wrote: post #331
pritambaral wrote: post #325

Run this in your Browser Console[1] to delay signature checking for a day: function set_xpi_sign_time_now() { const {Services} = ChromeUtils.import("resource://gre/modules/Services.jsm"); const now = (new Date()).getTime() / 1000; Services.prefs.setIntPref('app.update.lastUpdateTime.xpi-signature-verification', now); } set_xpi_sign_time_now(); EDIT: Changed `Components.utils.import` to `ChromeUtils.import` because ap…

Can you set this to the future and get say a week of buffer time for the fix to get pushed? edit: nope, you cannot:(

I tried essentially the same thing but via about:config. All it did was make it happen immediately on next restart.

Also if it hasn't happened to you yet, make a backup of your profile right now in case it wipes out your addons data as some have reported.

Re: All extensions disabled due to expiration of intermediate signing cert

#344

Post by luckylion »

gugagore wrote: post #312
Nicksil wrote: post #273

Earlier quoted context omitted.

>Assuming you mean that half second looking at the ad: Name a better alternative for funding the internet. Paywalls at every website? Funding the Internet? What you're talking about (ads) is a revenue stream for what amounts to a handful of websites. google.com, amazon.com, ycombinator.com, reddit.com, thefacebook.com, tweeter.com, etc. could all go offline right now and the Internet would still be here.

That doesn't sound right. What about all the other websites with ads, like recipe sites, guitar chords, porn, diy, etc.? or apps on the Google play store with ads?

I run sites that don't have ads. I don't make any money off of them. I still run them. Seems like a lot of people in software development think similarly.

Re: All extensions disabled due to expiration of intermediate signing cert

#345

Post by bostik »

floatingatoll wrote: post #283
userbinator wrote: post #258

Earlier quoted context omitted.

I wonder how long until the "security vultures" come upon this workaround and stop it from working... would be ironic if that happened sooner than the expired cert getting fixed.

Seems unlikely. If you’re willing and able to run code like the above, sourced from a random comment on the Internet, there’s no amount of security vulture that’s going to protect you from skillfully making your Internet experience unsafe for yourself.

Isn't that how most programming, security or not, works these days anyway?

Joe Random Developer googles for a problem, hits SO, tries a couple of the different proposed snippets and keeps the one that happens to work. (For given values of "work".)

This would be a great spot to end the post with a "", but sadly that'd be lying. Up until ~2 years ago the most common solution to requests between different subdomains subdomains failing was... "just use CORS: *"

Re: All extensions disabled due to expiration of intermediate signing cert

#346

Post by revvx »

n42 wrote: post #226
revvx wrote: post #66

Earlier quoted context omitted.

> Still, this type of oversight seems all too common even in large companies. (...) Has anyone developed a tool designed specifically to avoid certificate expiry disasters? LetsEncrypt renewal is supposed to be automated. [1] I know of a company that hosted blogs for thousands of customers. They used LetsEncrypt, but the CTO considered automatic renewals a possible security risk, so they did it manually. Problem is,…

Just curious, are you talking about Webflow? Because I had to hunt down and make sure our Let's Encrypt auto renewal was working until I realized the certificate was served by them. They wait until the last 12 hours to renew the certificate. I have no idea what type of rationalization would lead to that decision.

Nope, content marketing company

Re: All extensions disabled due to expiration of intermediate signing cert

#347

Post by dveditz_ »

drewmol wrote: post #256
pepa65 wrote: post #232

Earlier quoted context omitted.

I just set xpinstall.signatures.required to True in about:config and that fixed it after a restart.

For me this is False ;-)

Are you using an Extended Support Release (ESR)? That's expected then.

Re: All extensions disabled due to expiration of intermediate signing cert

#348

Post by mattbillenstein »

needle0 wrote: post #12

I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…

I built a tool for checking ssl certs some time ago: https://ismycertexpired.com but I'm not checking intermediate certs...

Re: All extensions disabled due to expiration of intermediate signing cert

#349

Post by Adamantcheese »

I'm surprised nobody's mentioned addon debugging if you really need an extension working. All of the extension packages are in /extensions folder and you can load them for the duration of your session by turning addon debugging on in about:debugging and loading them in. This should be fixed fast enough that this fix will be good enough, just don't close your browser.

Re: All extensions disabled due to expiration of intermediate signing cert

#350

Post by floatingatoll »

bostik wrote: post #345
floatingatoll wrote: post #283

Earlier quoted context omitted.

Seems unlikely. If you’re willing and able to run code like the above, sourced from a random comment on the Internet, there’s no amount of security vulture that’s going to protect you from skillfully making your Internet experience unsafe for yourself.

Isn't that how most programming, security or not, works these days anyway? Joe Random Developer googles for a problem, hits SO, tries a couple of the different proposed snippets and keeps the one that happens to work. (For given values of "work".) This would be a great spot to end the post with a " ", but sadly that'd be lying. Up until ~2 years ago the most common solution to requests between different subdomains su…

I believe the Mozilla Observatory has given CORS: * a -50 score penalty since the day it launched, precisely because of how horrifically dangerous that advice is.
Post reply on HN