Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

471–480 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#471

Post by mk89 »

matthewmacleod wrote: post #421
Grue3 wrote: post #390

What kind of idiot thought that the add-ons I have personally installed on my browser need to have a capability to be remotely disabled despite literally nothing being changed. This is absolutely inexcusable. I want to see everyone being responsible for this "verified add-ons" fiasco fired from the team (after they roll it back of course).

How do you verify that nothing has been changed, if not by checking signatures? Your call for everyone to be fired is very much in vogue but perhaps not at all useful. This isn’t a great thing to have happened, but the important outcome is, as always, knowledge and process that can prevent similar mistakes in the future.

Standard answer from a person that didn't understand the issue - "who is this bunch of idiots? Fire them all". Sounds like a C*O. :)

Re: All extensions disabled due to expiration of intermediate signing cert

#473

Post by papaf »

59nadir wrote: post #454
s9w wrote: post #394

What a spectacular failure... it's hours later, and still not working. The only thing firefox has going for itself stopped working. Already one family member and one friend switched to chrome.

Just switch for a day. You're making this out to be a much bigger issue than it has the capacity to be.

I switched to Brave today and I must say that I am impressed:

- Adblocker and Tracker protection without installing extensions.

- Nice background pictures.

- Caching Cdnjs requests -- for some reason Firefox was always hitting the CDN.

To be honest, despite the good work Mozilla does, I don't want to switch back.

Re: All extensions disabled due to expiration of intermediate signing cert

#474

Post by gonhidi »

weavejester wrote: post #48

There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false. However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition. To fix this on MacOS I did the following: 1. Downloaded and installed Firefox Nightly 2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/fir…

It is probably safer to use an unbranded build with the same version as the currently installed Firefox (take note that it will not update). Page with links to the latest release builds: https://wiki.mozilla.org/Add-ons/Extension_Signing

Re: All extensions disabled due to expiration of intermediate signing cert

#475

Post by konart »

Animats wrote: post #276

It's pathetic to see the attitude demonstrated by Mozilla support on this. diox commented 4 hours ago I'm locking this like I did in #851 because no new information is being added. We're aware and we're working on it. This conversation has been locked as spam and limited to collaborators. [1] Bug 1548973 (armagadd-on-2.0) All extensions disabled due to expiration of intermediate signing cert NEW Unassigned (Needinfo…

Closing a duplicate issue is an inuslt these days?

Or are you talking about them not putting "Best regards, Tim" at the end of every message?

People these days are offended really by every and any little thing.

Re: All extensions disabled due to expiration of intermediate signing cert

#476

Post by lugg »

gboudrias wrote: post #205
lvh wrote: post #192

Earlier quoted context omitted.

Many cloud providers will make this process pretty much entirely automated. But let's say you don't want to do that: when is the last time the way you run caddy changed? Or the last time python-certbot-nginx changed?

This was a few years ago, so things may have changed by now. But as they say, once bitten twice shy, and the wisdom of "just cron it" doesn't work with highly experimental tools like LE was for what I estimate to be the majority of its lifetime.

A tool not working well or being "experimental" does not dismiss the premise that frequently run automated tools are a better than infrequently run manual tasks when those manual tasks can take down your infrastructure if done improperly, missed or forgotten.

All it being new means is that depending on your risk ratio you need to decide whether updates to the software need testing or whether you need to invest in your own solution - or, how about just wait until it matures and keep the old process until then.

Waiting doesn't invalidate the premise either. It just means you lack the resources to implement it safely and that's ok.

Re: All extensions disabled due to expiration of intermediate signing cert

#478

Post by mk89 »

Grue3 wrote: post #390

What kind of idiot thought that the add-ons I have personally installed on my browser need to have a capability to be remotely disabled despite literally nothing being changed. This is absolutely inexcusable. I want to see everyone being responsible for this "verified add-ons" fiasco fired from the team (after they roll it back of course).

I disagree. Probably what they need is a better monitoring an alerting system that triggers when these certs are expiring. The software did what it was supposed to do -> prevent MITM attacks, fake extensions, etc. What they could have done better is give users the possibility to say "keep using the extensions despite the certificate expiration".

Re: All extensions disabled due to expiration of intermediate signing cert

#479

Post by fmhul »

s9w wrote: post #394

What a spectacular failure... it's hours later, and still not working. The only thing firefox has going for itself stopped working. Already one family member and one friend switched to chrome.

This is particularly bad because it's the kind of failure that will make people try Chrome. And when they do and see it's faster there's no way they'll be back with Firefox. It's simply catastrophic. Mark my words when I say there will be a very visible dive in the number of Firefox users as reported by StatCounter.

Re: All extensions disabled due to expiration of intermediate signing cert

#480

Post by inawarminister »

envolt wrote: post #470
gspetr wrote: post #461

Earlier quoted context omitted.

NoScript and uBlock Origin have stopped working. This opens up a LOT of attack surface for malicious hackers. If this isn't a critical security issue, what is?

The Container extension is no longer working. I'm logged out of mostly everything. There are few sites I don't want to open without container.

Exactly my use case. Already installed chromium-ungoogled and am using a judicious amount of profiles to emulate this. Still not as nice as what the Container extension do, unfortunately.
Post reply on HN