Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

581–590 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#581

Post by tialaramex »

rocqua wrote: post #397
tialaramex wrote: post #389

Earlier quoted context omitted.

CRLs can be sharded, the cert carries the URL for the relevent CRL inside it. So they wouldn't need to have grown as huge as you suggest. But, this sharing carries a cost for user privacy, if I shard certs 16 ways then each CRL download gives me 4 bits of info about which sites you were visiting. OCSP effectively takes this to the extreme, each lookup is tiny because it's just for one cert, but it gives away exactly…

Besides leaking data by on demand CLR checking, you also have a difficult fail open v fail closed decision. Failing closed means failure of a third party immediately breaks your site. Failing open means a MitM can simply block the CRL check. OCSP stapling and the 'must staple' header are a lot better for privacy, and OCSP responses have some validity so at least a 5 hour outage of your CA doesn't bring your site down…

I would like to live in a world where OCSP stapling is widely deployed and we can require OCSP and advise people to set must-staple if possible while everybody who doesn't staple will just have to eat the privacy implications. But this is not (yet and for the foreseeable future) that world.

Apache and nginx both shipped OCSP stapling implementations that are very bad, awful enough that for almost anyone I'd say "No, don't enable that" rather than try to explain how they need to use it and get them to a place where it's useful and safe. Adam Langley wrote years ago about how to do this correctly, and there does seem to be a little bit of movement in the correct direction at Apache, but the situation remains pretty poor.

Re: All extensions disabled due to expiration of intermediate signing cert

#582

Post by DangerousPie »

DoctorOetker wrote: post #548
rmbryan wrote: post #520

Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.

I read at https://discourse.mozilla.org/t/certificate-issue-causing-ad... >12:50 p.m. UTC / 03:50 a.m. PDT: We rolled-out a fix for release, beta and nightly users. The fix will be automatically applied in the background within the next few hours, you don’t need to take active steps. >In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by…

> This comes very close after the IE6 conspiracy revelation, where ends justifies the means.

What?!

Re: All extensions disabled due to expiration of intermediate signing cert

#583

Post by Vinnl »

DoctorOetker wrote: post #548
rmbryan wrote: post #520

Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.

I read at https://discourse.mozilla.org/t/certificate-issue-causing-ad... >12:50 p.m. UTC / 03:50 a.m. PDT: We rolled-out a fix for release, beta and nightly users. The fix will be automatically applied in the background within the next few hours, you don’t need to take active steps. >In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by…

The last sentence you quoted literally said that they will provide you with the option to fix this without needing to enable studies.

Re: All extensions disabled due to expiration of intermediate signing cert

#584

Post by conanbatt »

tripzilch wrote: post #532
xvector wrote: post #523

Earlier quoted context omitted.

Thanks. This must be terribly stressful to you.

Meanwhile, having to browse the web without an adblocker has been nothing but relaxing for everybody else.

There is a before and after with adblockers. Its a real pity they are the worst privacy-vioolating tools ever.

Re: All extensions disabled due to expiration of intermediate signing cert

#586

Post by abrowne »

floatingatoll wrote: post #301
weavejester wrote: post #48

There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false. However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition. To fix this on MacOS I did the following: 1. Downloaded and installed Firefox Nightly 2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/fir…

Upgrading your profile from Release to Nightly, which occurs automatically when you open it with Nightly, is a one-way irreversible step. This could prevent your profile from being used with Release without crashes, or lose profile data such as bookmarks or saved passwords when later used with Release, depending on what work is underway in Nightly and if it happens to be backwards-compatible. Be sure to backup your p…

FWIW I started using beta, nightly and the old "UX" channel, first on Mac and then on Linux, and before I knew it could be a problem I switched between them with the same profile all the time. Maybe there were subtle bugs I wasn't aware of, but nothing I ever noticed.

Re: All extensions disabled due to expiration of intermediate signing cert

#587

Post by alskdj21 »

rmbryan wrote: post #520

Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.

I've deleted my extensions thinking it was the extensions' issue. I'm trying to download again but it's telling me I don't have internet connection. Any work-arounds?

Re: All extensions disabled due to expiration of intermediate signing cert

#588

Post by conanbatt »

tripzilch wrote: post #578
mrep wrote: post #225

Earlier quoted context omitted.

> Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :( Try turning it off. I got rid of ublock after arstechnica complained about a lot of their users blocking ads years ago and it honestly isn't that bad. Every once in a while I do back out of a page for maxing out one of my cpu cores but otherwise, nothing ever bad happens. With ads: either it takes me half…

The alternative is those websites not using third party ads with third party trackers on it. Adblockers already do not block those (cause they're indistinguishable from image links). If they really just want my eyeballs they know how they can get them. But they really want to track me. And I'm not having that. The moment they stop tracking their users through third party ad networks, most adblockers stop blocking (be…

Which adblocker do you trust not to track you?

Re: All extensions disabled due to expiration of intermediate signing cert

#589

Post by onli »

tripzilch wrote: post #578
mrep wrote: post #225

Earlier quoted context omitted.

> Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :( Try turning it off. I got rid of ublock after arstechnica complained about a lot of their users blocking ads years ago and it honestly isn't that bad. Every once in a while I do back out of a page for maxing out one of my cpu cores but otherwise, nothing ever bad happens. With ads: either it takes me half…

The alternative is those websites not using third party ads with third party trackers on it. Adblockers already do not block those (cause they're indistinguishable from image links). If they really just want my eyeballs they know how they can get them. But they really want to track me. And I'm not having that. The moment they stop tracking their users through third party ad networks, most adblockers stop blocking (be…

Just FYI, that's not really true. Adblocker use mostly all the same filter lists and those do regularly block ads that just are regular images, and even text notes. https://www.troyhunt.com/ad-blockers-are-part-of-the-problem... is an example, even if that specific one got resolved

Adblock Plus has the ability to not block ads that conform to a certain standard, but in addition to conform to standards ad publishers need to pay for that. At least that's what they claim.

Re: All extensions disabled due to expiration of intermediate signing cert

#590

Post by megous »

tssva wrote: post #569
megous wrote: post #547

Earlier quoted context omitted.

Something with a public wiki page describing what it does exactly is hardly a backdoor. Also here's the code for the server: https://github.com/mozilla/normandy

The wiki entry evidently doesn't describe what it does because according to the wiki entry it allows for the enabling and disabling of preferences. The updating of a certificate is beyond what is described in the wiki. Mozilla should follow up with a post describing exactly how Normandy works and the full capabilities it gives them.

So search elsewhere if you want more info. All code is available.
Post reply on HN