Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

621–630 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#621
post #232

Earlier quoted context omitted.

I just set xpinstall.signatures.required to True in about:config and that fixed it after a restart.

I can confirm this on Ubuntu 19.04 with Firefox 66.0.3. Changing xpinstall.signatures.required from the default 'True' to 'False' resulted in addons working again.

Android too.

Re: All extensions disabled due to expiration of intermediate signing cert

#622
post #590
post #569

Earlier quoted context omitted.

The wiki entry evidently doesn't describe what it does because according to the wiki entry it allows for the enabling and disabling of preferences. The updating of a certificate is beyond what is described in the wiki. Mozilla should follow up with a post describing exactly how Normandy works and the full capabilities it gives them.

So search elsewhere if you want more info. All code is available.

All code is available – as a tar.xzipped archive of Firefox source code containing over 150k files and measuring over 1GB in size when unpacked.

Re: All extensions disabled due to expiration of intermediate signing cert

#623
post #557

Earlier quoted context omitted.

> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout > What about a UI knob to disable it? app.normandy.enabled

The UI knob is Options -> Privacy & Security > Allow Firefox to install and run studies They're using the studies system to push this hotfix faster for those that have it enabled. Edit: Source: See: https://discourse.mozilla.org/t/certificate-issue-causing-ad... > In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Pre…

Why is it supposed to be reassuring that their “studies” can override the cryptographic infrastructure?

Edit: rephrase for clarity

Re: All extensions disabled due to expiration of intermediate signing cert

#624
post #227

To re-enable all disabled non-system addons you can do the following. I am not responsible if this fucks up your install: Open the browser console by hitting ctrl-shift-j Copy and paste the following code, hit enter. Until mozilla fixes the problem you will need to redo this once every 24 hours: // Re-enable *all* extensions async function set_addons_as_signed() { Components.utils.import("resource://gre/modules/addon…

Thank you for this.

Re: All extensions disabled due to expiration of intermediate signing cert

#625
This is absolutely going to tank Firefoxs market-share and reputation. I have a site full of tech-illiterate users and they're all uninstalling Firefox and searching for alternatives. None of them are interested in the workarounds presented, most of them even struggle to turn their computers on! Mozilla really dropped the ball here.

Re: All extensions disabled due to expiration of intermediate signing cert

#626
post #66
post #12

I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…

> Still, this type of oversight seems all too common even in large companies. (...) Has anyone developed a tool designed specifically to avoid certificate expiry disasters? LetsEncrypt renewal is supposed to be automated. [1] I know of a company that hosted blogs for thousands of customers. They used LetsEncrypt, but the CTO considered automatic renewals a possible security risk, so they did it manually. Problem is,…

Didn't Mozilla invent Let's encrypt? That would make this disaster doubly embarrassing.

Re: All extensions disabled due to expiration of intermediate signing cert

#627

Earlier quoted context omitted.

Meanwhile, having to browse the web without an adblocker has been nothing but relaxing for everybody else.

There is a before and after with adblockers. Its a real pity they are the worst privacy-vioolating tools ever.

> Its a real pity they are the worst privacy-vioolating tools ever.

What do you mean?

Re: All extensions disabled due to expiration of intermediate signing cert

#628

Earlier quoted context omitted.

Type about:config in the address bar and search for 'app.normandy.enabled' flag.

Well that's interesting. I see Normandy enabled, but if I go to the "Privacy and Security" section of the preferences page I see all the data collection and use stuff disabled. There's no obvious way to disable the Normandy back door. Oh well, at least we don't have another season of Mr Robot spam to look forward to.

Presumably the logic is something like:

    if (studies.enabled) {
      if (normandy.enabled) {
        ...
      }
    }

Re: All extensions disabled due to expiration of intermediate signing cert

#629

Earlier quoted context omitted.

No, it's not. This Normandy nonsense and stories are two separate, yet creepy features. I've already disabled stories but it looks like Mozilla still retains control of my preferences (without disclosing it).

I sure wonder how people so suspicious of Mozilla dare use their browser .

Easy: There's a difference between static, shipped code and a capability to modify software at a distance (which could even by hijacked by an attacker who infiltrates Mozilla's infrastructure.)

Re: All extensions disabled due to expiration of intermediate signing cert

#630
post #589

Earlier quoted context omitted.

The alternative is those websites not using third party ads with third party trackers on it. Adblockers already do not block those (cause they're indistinguishable from image links). If they really just want my eyeballs they know how they can get them. But they really want to track me. And I'm not having that. The moment they stop tracking their users through third party ad networks, most adblockers stop blocking (be…

Just FYI, that's not really true. Adblocker use mostly all the same filter lists and those do regularly block ads that just are regular images, and even text notes. https://www.troyhunt.com/ad-blockers-are-part-of-the-problem... is an example, even if that specific one got resolved Adblock Plus has the ability to not block ads that conform to a certain standard, but in addition to conform to standards ad publishers n…

If the images are hosted on the site instead of a third party the list won't matter.
Post reply on HN