Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

561–570 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#561

Post by inferiorhuman »

lawl wrote: post #557
daleharvey wrote: post #545

Earlier quoted context omitted.

> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout > What about a UI knob to disable it? app.normandy.enabled

The UI knob is Options -> Privacy & Security > Allow Firefox to install and run studies They're using the studies system to push this hotfix faster for those that have it enabled. Edit: Source: See: https://discourse.mozilla.org/t/certificate-issue-causing-ad... > In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Pre…

No, it's not. This Normandy nonsense and stories are two separate, yet creepy features. I've already disabled stories but it looks like Mozilla still retains control of my preferences (without disclosing it).

Re: All extensions disabled due to expiration of intermediate signing cert

#562

Post by [deleted] »

oAlbe wrote: post #554
daleharvey wrote: post #545

Earlier quoted context omitted.

> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout > What about a UI knob to disable it? app.normandy.enabled

> app.normandy.enabled I fail to see both the "UI" and the "knob" part of this. Why is this not a checkbox in the preferences? Why do so many people not know about Normandy?

[deleted]

Re: All extensions disabled due to expiration of intermediate signing cert

#563

Post by nanis »

lawl wrote: post #557
daleharvey wrote: post #545

Earlier quoted context omitted.

> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout > What about a UI knob to disable it? app.normandy.enabled

The UI knob is Options -> Privacy & Security > Allow Firefox to install and run studies They're using the studies system to push this hotfix faster for those that have it enabled. Edit: Source: See: https://discourse.mozilla.org/t/certificate-issue-causing-ad... > In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Pre…

> The UI knob is

> Options -> Privacy & Security > Allow Firefox to install and run studies

That is not true. I've had that disabled forever Despite that, when I went into about:config, app.normandy.enabled was set to true, and app.normandy.user_id was defined.

So, overnight Firefox decides it won't let me use uBlock Origin any more and now I find out all my browsing history has been logged to Firefox servers.

All of this stinks.

Re: All extensions disabled due to expiration of intermediate signing cert

#564

Post by IceWreck »

user17843 wrote: post #529
rmbryan wrote: post #520

Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.

Thanks! Do you know how many active users were affected by this certificate error and subsequent addon disabling? I guess most users were spared due to the timing and short duration of the error.

Their system runs a check every 24 hours. So a lot of users were affected. They've rolled out a partial fix via their Normandy thingy, and according to them it will fix the issue for most people over the next couple of hours.

Re: All extensions disabled due to expiration of intermediate signing cert

#565

Post by [deleted] »

inferiorhuman wrote: post #538
verdandi wrote: post #530

Earlier quoted context omitted.

Type about:config in the address bar and search for 'app.normandy.enabled' flag.

Well that's interesting. I see Normandy enabled, but if I go to the "Privacy and Security" section of the preferences page I see all the data collection and use stuff disabled. There's no obvious way to disable the Normandy back door. Oh well, at least we don't have another season of Mr Robot spam to look forward to.

[deleted]

Re: All extensions disabled due to expiration of intermediate signing cert

#566

Post by Yoric »

nanis wrote: post #559
daleharvey wrote: post #545

Earlier quoted context omitted.

> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout > What about a UI knob to disable it? app.normandy.enabled

>> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? > It will even be documented for them: That sounds like you do not think the concern is warranted. I've used Firefox since the first time it was available, and Netscape starting with the first ever betas. At no point was there a dialog that said "Do you want us to be able to change your browser setting…

> So, the question can be rephrased as "is the fact that Firefox has been logging all users' entire browsing history despite the fact that the user has not chosen to set up a Firefox account going to be disclosed?"

Chill out, this preference only determines what is logged locally (never sent to the server). It's a debugging tool.

Sources: - https://searchfox.org/mozilla-central/source/toolkit/compone... - https://searchfox.org/mozilla-central/source/services/common...

Re: All extensions disabled due to expiration of intermediate signing cert

#567

Post by Yoric »

inferiorhuman wrote: post #560
daleharvey wrote: post #551

Earlier quoted context omitted.

In the recent version we added the ability to always prevent autoplaying of videos, in the next version we will be adding further UI to let the user disable all (not just muted) videos from autoplaying - https://bugzilla.mozilla.org/show_bug.cgi?id=1543812

That does nothing to mitigate the wholesale disabling of already trusted plugins like uBlock.

Well, if you follow the OP, you'll realize that it's a bug and people are working to fix it :)

Re: All extensions disabled due to expiration of intermediate signing cert

#568

Post by Yoric »

DoctorOetker wrote: post #535
verdandi wrote: post #530

Earlier quoted context omitted.

Type about:config in the address bar and search for 'app.normandy.enabled' flag.

here the flag is true but the extensions are still unsupported

It may take a little time for the partial fix to be distributed.

Re: All extensions disabled due to expiration of intermediate signing cert

#569

Post by tssva »

megous wrote: post #547
chinathrow wrote: post #528

Earlier quoted context omitted.

So is that a backdoor into my prefs? How can I check if Normandy is active on my installation?

Something with a public wiki page describing what it does exactly is hardly a backdoor. Also here's the code for the server: https://github.com/mozilla/normandy

The wiki entry evidently doesn't describe what it does because according to the wiki entry it allows for the enabling and disabling of preferences. The updating of a certificate is beyond what is described in the wiki.

Mozilla should follow up with a post describing exactly how Normandy works and the full capabilities it gives them.

Re: All extensions disabled due to expiration of intermediate signing cert

#570

Post by tinus_hn »

rmbryan wrote: post #520

Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.

I don’t like you editing my preferences. How can I switch to this new certificate manually?
Post reply on HN