351–360 of 955 posts
Earlier quoted context omitted.
Can you set this to the future and get say a week of buffer time for the fix to get pushed? edit: nope, you cannot:(
1. I don't think that'd be necessary; I believe Mozilla will fix it in a day, or two at most (PS: they're currently testing a fix); and 2. I don't know if there's sanity-checking code in Firefox to ignore times in the future.
Earlier quoted context omitted.
Let's not forget multiple mobile networks across Europe went down on the same day last year because Ericsson(?) let a cert expire on some internal management system that had not been updated. SSL cert renewal is one of the great unsolved problems in computer science edit: not Europe, just UK and Japan apparently: https://www.zdnet.com/article/ericsson-expired-certificate-c...
>SSL cert renewal is one of the great unsolved problems in computer science Certificate expiry really only exists to make money for CAs. It doesn’t solve any security problem that CRLs don’t already solve (and solve better). There’s lots of unsolved problems relating to ‘how do you make a reliable PKI’, but cert expiry is really just an unrelated business requirement for CAs.
* Very short lifetimes get people to automate, preventing problems where one cert lasts long enough to lose the institutional knowledge around it.
* CRLs don't work. For performance you don't want to check for a revocation in serial with the request, and you don't want to block all browsing if the revocation list server is down. Revoking a cert will cover some users, but lots will still get "https://" and no warnings.
Run this in your Browser Console[1] to delay signature checking for a day: function set_xpi_sign_time_now() { const {Services} = ChromeUtils.import("resource://gre/modules/Services.jsm"); const now = (new Date()).getTime() / 1000; Services.prefs.setIntPref('app.update.lastUpdateTime.xpi-signature-verification', now); } set_xpi_sign_time_now(); EDIT: Changed `Components.utils.import` to `ChromeUtils.import` because ap…
Components.utils is undefined (Firefox 67.0b16 macOS)
A disaster like this has been brewing for a long time, and Moz leaders didn’t listen to the canaries in the coalmine.
It’s a very sad day for all the great people at Mozilla who work so hard only to see Mozilla IT let them down.
Earlier quoted context omitted.
It’s funny to me that people talk about this limitation as if it were some kind of virtue.
Short-term certs _are_ a virtue. Not only do you not have a manual event rare enough for people to forget how to do it, you also don't have to worry about which 15 services someone granted a 10 year wildcard cert to early in the company's history.
Earlier quoted context omitted.
Having a root process with write-privileges to /etc on production machines and also able to communicate over the Internet definitely is a security risk. To mitigate that you end-up building a series of privilege-restricted jobs flowing from the DMZ back into the internal network. And maintaining that might be more complicated than just manually renewing, depending upon the processes and architecture of the company.
Why would a process need to run as root or have write privileges to /etc in order to automate LetsEncrypt renewals? I run Caddy (which uses acme-go/lego as its ACME provider) as a non-root user with no access to /etc at all. It seems to be running fine.
Earlier quoted context omitted.
Let's not forget multiple mobile networks across Europe went down on the same day last year because Ericsson(?) let a cert expire on some internal management system that had not been updated. SSL cert renewal is one of the great unsolved problems in computer science edit: not Europe, just UK and Japan apparently: https://www.zdnet.com/article/ericsson-expired-certificate-c...
>SSL cert renewal is one of the great unsolved problems in computer science Certificate expiry really only exists to make money for CAs. It doesn’t solve any security problem that CRLs don’t already solve (and solve better). There’s lots of unsolved problems relating to ‘how do you make a reliable PKI’, but cert expiry is really just an unrelated business requirement for CAs.
CRLs require maintenance and distribution of a list by a 3rd party. Creating an accurate, all-inclusive CRL of all website keys that your browser should reject is far, far from easy. (Case in point: "how many web sites are there?" Is not an easy question. )
Properly propagating such a list to any browser that might need it is another daunting task - less than 100% propagation means end users are exposed to security risks.
Certificate expiry is much more elegant: the client can check the certificate's validity himself, without relying on input from 3rd parties.
If certificates didn't expire, CRLs would (by now) be huge and growing enormously every day. They'd be so big that by the time you'd have downloaded one, it'd be outdated.
Earlier quoted context omitted.
> Doesn't Mozilla have a mechanism for blasting out a message to all Firefox browsers? The cynical side of me says that it must not have this feature because if it did I'd have seen someone complaining about the browser "phoning home" or "forcing Mozilla's opinions into my eyeballs".
...unlike the mothership breaking all addons, and the browser being designed intentionally in a way that prevents me from working around the breakage? This isn't just a petty snipe borne out of annoyance. Ads being the malware vector that they are, and the degree of tracking and data mining out there, all of those countermeasures being turned off overnight is an exposure that should be treated with the same degree of…
On the other hand, I'm going to be honest, I have trouble reading your post without thinking things like "If you are literally trusting your life to FoxyProxy, you might want to rethink your entire internet safety strategy." Another favorite was "Defense in depth."
I've had dozens of different experiences where my extensions silently and unexpectedly malfunctioned. Configurations getting erased, new extension releases with breakage or different behaviors, maximum compatible versions in the manifest, new permissions, botched keystrokes in the extensions page, profile corruption, incompatibilities between extensions, internal bugs that cause them to crash-loop without doing anything, the works. Like, I run a ton of addons, some of which are a bit esoteric and a couple that I compile from head every few days, but even taking into account my outlier-sized surface area it's a bit silly.
I'm not going to claim that this isn't a problem. That said, blaming Mozilla for a life-threatening failure of FoxyProxy, of all things, is like blaming Cessna because a journalist flew one of their planes into a combat zone. There just wasn't any way it was going to end well.
Earlier quoted context omitted.
>Assuming you mean that half second looking at the ad: Name a better alternative for funding the internet. Paywalls at every website? Funding the Internet? What you're talking about (ads) is a revenue stream for what amounts to a handful of websites. google.com, amazon.com, ycombinator.com, reddit.com, thefacebook.com, tweeter.com, etc. could all go offline right now and the Internet would still be here.
That doesn't sound right. What about all the other websites with ads, like recipe sites, guitar chords, porn, diy, etc.? or apps on the Google play store with ads?
There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false. However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition. To fix this on MacOS I did the following: 1. Downloaded and installed Firefox Nightly 2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/fir…
Upgrading your profile from Release to Nightly, which occurs automatically when you open it with Nightly, is a one-way irreversible step. This could prevent your profile from being used with Release without crashes, or lose profile data such as bookmarks or saved passwords when later used with Release, depending on what work is underway in Nightly and if it happens to be backwards-compatible. Be sure to backup your p…