Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

481–490 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#481

Post by hrktb »

dajonker wrote: post #430
former_mozzer wrote: post #405

There have been major organizational problems at Mozilla for a long time that precipitated this. Many of us saw something like this coming, saw gaps and unclear responsibilities, reported these gaps and confusions up the chain, and were reprimanded and financially penalized for asking the tough questions. The questions were never answered, and we all quit, were fired, or lost motivation as a result. This is a tech pr…

You basically just described any sufficiently large organization. Complaining is not helping anyone in these situations, the only thing you can do to change things is to go ahead and try to change things. Reporting things up the chain hardly ever works because the chain is too busy with their own issues and politics. You have to make it worth their while.

> the only thing you can do to change things is to go ahead and try to change things.

You are describing taking risks and/or being penalized for little to no potential reward in most organizations.

You are doing something you are not asked to, so any inconvenience or side effect, whatever the cause is, is on you. And as it was not marketed internaly few people will be aware you did anything, accordingly you will get little recognition (financial or any).

It also presumes you already accomplished everything that was under your responsability, which is basically impossible in any org where objectives or KPIs are set so you hit a 80% target. You’ll then have to explain why you prioritized a seemingly random task, and bothered the other teams to help you do it without consulting your boss or their bosses.

Basically this approach could work for critical issues that are obvious they should be fixed. But then it should also be obvious to your boss, so getting their clearance is the normal way to do it.

This is I think the reason why people just leave instead of fighting a losing battle to fix issues they care about but the upper ranks don’t prioritize.

Re: All extensions disabled due to expiration of intermediate signing cert

#483

Post by jchw »

omnimus wrote: post #441
jchw wrote: post #271

Earlier quoted context omitted.

I'm going to skip the analogies and just say this: If tomorrow this is still broken and I have a choice between installing Chromium, and installing Nightly + disabling security features, It's going to be a tough dilemma for me personally. I'm glad you have software/vendors you feel you can trust. I definitely don't feel that way about most software anymore. I do think you are being a bit hyperbolic regarding other br…

Well when you are google employee and you are testing code in firefox... you already have chrome and chromium installed. I think what is a real tough dillema is being sad about nonfunctioning adblocker while working for the biggest internet ads company. So are you working in chrome marketing department?

>Well when you are google employee and you are testing code in firefox... you already have chrome and chromium installed.

I have computers other than my work computer(s.) I, indeed, do not have Chrome or Chromium installed on my home boxes running NixOS. I do not use my work devices for personal web browsing. I'm currently posting this message with Firefox 66.0.3 on NixOS 19.03.

>I think what is a real tough dillema is being sad about nonfunctioning adblocker while working for the biggest internet ads company. > >So are you working in chrome marketing department?

I'm a software engineer. I'm also over at Github:

https://github.com/jchv

I work at Google because it's an excellent place to work. I'm far from elite; I didn't finish college (couldn't afford) and I grew up in the suburbs of Detroit, so being able to work at any large SV company is something I don't take for granted. I don't think any single employee can claim to love 100% of the things Google does, and that's fine. Nobody is required to.

As for why I would use an adblocker, practically speaking it's both for reducing annoyances and increasing security. Malware (and 0days!) delivered via ads is not unheard of, sadly.

Re: All extensions disabled due to expiration of intermediate signing cert

#484

Post by dorgo »

mrep wrote: post #259
hnaccy wrote: post #251

Earlier quoted context omitted.

>nothing ever bad happens. With ads: either it takes me half a second to tell I'm not interested in an ad, or I actually am interested and i follow the ad because I am interested and I want to support the website. You just described something bad.

Assuming you mean that half second looking at the ad: Name a better alternative for funding the internet. Paywalls at every website?

An open, transparent, convenient, anonymous protocol for micro payments, with good cost contol build into browsers.

Re: All extensions disabled due to expiration of intermediate signing cert

#485

Post by ubercow13 »

mk89 wrote: post #478
Grue3 wrote: post #390

What kind of idiot thought that the add-ons I have personally installed on my browser need to have a capability to be remotely disabled despite literally nothing being changed. This is absolutely inexcusable. I want to see everyone being responsible for this "verified add-ons" fiasco fired from the team (after they roll it back of course).

I disagree. Probably what they need is a better monitoring an alerting system that triggers when these certs are expiring. The software did what it was supposed to do -> prevent MITM attacks, fake extensions, etc. What they could have done better is give users the possibility to say "keep using the extensions despite the certificate expiration".

The downloaded extensions already passed verification when they were installed before the expiration. Disabling them now makes absolutely no sense. Even if the cert was compromised the moment it expired, previously installed extensions can't have become vulnerable without being updated.

Re: All extensions disabled due to expiration of intermediate signing cert

#486

Post by kelnos »

whatshisface wrote: post #287

Tomorrow (or whenever this gets fixed), ad companies are going to have some great data about what the world would look like if adblock didn't exist. I really home someome does a blog post about it. Yikes, I hope it doesn't play out like a shark smelling chum.

Given that Firefox's market share has dropped below 10%, I doubt it will make much of a difference.

Re: All extensions disabled due to expiration of intermediate signing cert

#487

Post by Aeolun »

dajonker wrote: post #430
former_mozzer wrote: post #405

There have been major organizational problems at Mozilla for a long time that precipitated this. Many of us saw something like this coming, saw gaps and unclear responsibilities, reported these gaps and confusions up the chain, and were reprimanded and financially penalized for asking the tough questions. The questions were never answered, and we all quit, were fired, or lost motivation as a result. This is a tech pr…

You basically just described any sufficiently large organization. Complaining is not helping anyone in these situations, the only thing you can do to change things is to go ahead and try to change things. Reporting things up the chain hardly ever works because the chain is too busy with their own issues and politics. You have to make it worth their while.

> You have to make it worth their while.

Not having a large outage seems like it should be worth their while...

Re: All extensions disabled due to expiration of intermediate signing cert

#488

Post by rocqua »

AmericanChopper wrote: post #450
rocqua wrote: post #391

Earlier quoted context omitted.

Cert revocation suffers from a very simple issue. If your check for revocation fails, do you fail open (ie accept the cert) or fail closed (ie reject the cert). For any method, fail closed is user hostile and often a DOS vulnerability whilst fail open is another way for an attacker to use a revoked cert. This is a big issue with on-line methods like OCSP as a MitM using a bad cert can probably block OCSP traffic as w…

All TLS failures fail closed. The idea that if a cert is compromised it will eventually expire sometime within the next five years is a completely laughable security control. Leaking information is a complete non-concern too. Have you heard of certificate transparency logs? Short lived certs are quite obviously better from a security perspective, but the security difference between a certificate that expires in five…

A missing OCSP response does not fail closed, nor does a CLR url 404-ing fail closed.

The information leakage of CRLs is stating to the public that a cert needed to be revoked.

Obviously, a compromised cert that will expire in 5 years is horrible. However, a non compromised cert you are no longer using that will never expire is more off a risk than a disused cert that will expire in a year. Not to say you should leave the one year cert lying around. However, there is no desire to put the one year cert on a pre-shipped CLR.

Re: All extensions disabled due to expiration of intermediate signing cert

#489

Post by pmontra »

MrStonedOne wrote: post #254
SomeHacker44 wrote: post #85

Earlier quoted context omitted.

This is just abusive to the vast majority of users who do not care but still want to use SSL for their servers, frankly. I should be allowed to choose a near unlimited lifetime for my server's certificate if I don't care about the risks that may present.

It's not your risk to decide on. You will not always own that domain name, and allowing you to still have a valid cert for it afterwards is silly.

Actually it could be not negligence but a way to perform an attack.

Register a domain, get a certificate lasting forever, let the domain expire and somebody buy it. Then somehow redirect all or part of the traffic to that domain to your own server with a valid certificate. Chances are that few people will notice something has changed in the details of the certificate.

However you'll have left traces all over the place: credit cards, phone numbers, etc.

Re: All extensions disabled due to expiration of intermediate signing cert

#490

Post by _zephyrus_ »

lucb1e wrote: post #409

If everyone's add-ons are disabled, I wonder why mine are not. My computer has been running over night (coincidentally, first time in years) and my add-ons are intact. Does it take a browser restart? Or might I have a setting that prevents this from happening? My system time is correct. Edit: am on Firefox 66, Linux (Debian Buster/testing), using Firefox from Mozilla directly (not through repositories), and my intern…

Firefox 66.0.3 here, and this has been the case also for me, i.e. everything is still working. After looking around for a while in bewilderment, I think that what's going is that they have remotely used the "studies" feature of Firefox to temporarily work around the problem.

Indeed, I see in about:studies,

hotfix-reset-xpi-verification-timestamp-1548973•Complete This study sets app.update.lastUpdateTime.xpi-signature-verification to 1556945257

(unfortunately I can not see when it was run in about:studies)

i.e. this "study" has reset the timestamp of the last signature verification to this morning (when I have started Firefox). Since I read around that Firefox performs the check only every 24 hours, I guess that this is reason why we have not been experiencing the problem. We have now another day, after which we will have to reset the timestamp again (if it has not been solved upstream). The field is available/accessible also in about:config.

P.S. To be fairly honest, I was a bit surprised about the "studies" feature, I can not recall when it was introduced, but it is probably my fault for having overlooked it.

Post reply on HN