Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

701–710 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#701

Post by pedrocr »

bilbo0s wrote: post #694
neilv wrote: post #657

Earlier quoted context omitted.

There are already channels for bug fixes, and some of the friction on those channels is intentional, such as for visibility and oversight/approval.

Exactly. Why even have an official channel, providing visibility and official oversight, if when it comes down to it, you're just gonna push remote code updates through the same side channel a potential hacker would use? People are saying it's for convenience. OK, but then they have to understand that doing things in that fashion is a really bad look. And now your users are set up to believe that, at least some of th…

This is a piece of code downloaded from Mozilla servers to re-enable extensions, which are other pieces of code you download from Mozilla servers. If your threat model includes not trusting Mozilla servers then you've presumably disabled browser extensions (or sideloaded them) and this issue is irrelevant to you. If you do use extensions and get updated versions from Mozilla I don't see any way in which this increases your attack surface.

Re: All extensions disabled due to expiration of intermediate signing cert

#702

Post by shawnz »

neilv wrote: post #676
fjsolwmv wrote: post #672

Earlier quoted context omitted.

ESR means extended support, not "never changes". As long as it is supported (and it is: the bug got fixed), it's appropriate for ESR.

As I said elsewhere: There are already channels for bug fixes, and some of the friction on those channels is intentional, such as for visibility and oversight/approval.

And this is another channel. How can you be sure this one has less friction than the others?

Re: All extensions disabled due to expiration of intermediate signing cert

#703

Post by megous »

greendestiny_re wrote: post #622
megous wrote: post #590

Earlier quoted context omitted.

So search elsewhere if you want more info. All code is available.

All code is available – as a tar.xzipped archive of Firefox source code containing over 150k files and measuring over 1GB in size when unpacked.

grep -iR normandy

I expect code related to normandy to be ~1k LOC in size and probably written in JS. I haven't checked though, because I don't really care today.

Re: All extensions disabled due to expiration of intermediate signing cert

#704

Post by gpm »

XORcat wrote: post #592
DoctorOetker wrote: post #548

Earlier quoted context omitted.

I read at https://discourse.mozilla.org/t/certificate-issue-causing-ad... >12:50 p.m. UTC / 03:50 a.m. PDT: We rolled-out a fix for release, beta and nightly users. The fix will be automatically applied in the background within the next few hours, you don’t need to take active steps. >In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by…

JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_sign... hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... From the looks, it installs the above plugin, and changes `app.update.lastUpdateTime.xpi-signature-verification` to `1556945257` I can't get it to work in ESR 60 though. Getting file not found on…

Hey, if you just click on that storage.googleapis.com link it installs the hotfix directly without having to enable normandy ;)

Re: All extensions disabled due to expiration of intermediate signing cert

#705

Post by calcifer »

phyzome wrote: post #629
vesinisa wrote: post #598

Earlier quoted context omitted.

I sure wonder how people so suspicious of Mozilla dare use their browser .

Easy: There's a difference between static, shipped code and a capability to modify software at a distance (which could even by hijacked by an attacker who infiltrates Mozilla's infrastructure.)

If your threat model includes the hijacking of Mozilla's infrastructure, I assume you read and verify the entirety of the Firefox source with every new version before using it, right?

Re: All extensions disabled due to expiration of intermediate signing cert

#706

Post by pynabi »

vesinisa wrote: post #689
taxatu wrote: post #681

Earlier quoted context omitted.

Can we get a clarification: Unchecking "Allow Firefox to install and run studies" in the UI does not change "app.normandy.enabled" to "false". Then, does unchecking "Allow Firefox to install and run studies" really disable Normandy, or not?

As explained on Normandy's wiki page, they are related but two different things: > Preference rollout is meant for permanent changes that we are sure of. Shield is meant for testing variations and figuring out what, if anything, is the best thing to do. https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout#...

That doesn't answer the question: does Normandy get disabled by the UI option or not?

One can guess based on the wiki page that the answer is "no", but that's just a guess.

Re: All extensions disabled due to expiration of intermediate signing cert

#707

Post by jillesvangurp »

rmbryan wrote: post #520

Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.

It seems to have worked. My extensions reappeared.

Re: All extensions disabled due to expiration of intermediate signing cert

#709

Post by [deleted] »

rmbryan wrote: post #520

Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.

[deleted]

Re: All extensions disabled due to expiration of intermediate signing cert

#710

Post by oldjokes »

inferiorhuman wrote: post #541
rmbryan wrote: post #520

Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.

pushed it out to users via Normandy (this should be most users) Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? What about a UI knob to disable it?

I have spent ~10 years using Firefox daily, tweaking the config and getting the addons set up the way I want. I was a professional web developer for most of those years.

This is the first I have heard of Firefox changing my config settings invisibly in the background. This is obscene. Who on earth thought this was a good idea? The security ramifications are limitless.

I understand all too well that most companies have decided to start A/B testing things on subsets of users, but that doesn't mean you should force that mode of thinking into everything. What a horrible decision. I don't recall ever seeing any news or notifications or checkboxes about studies or "Normandy" at any point.

Are there some other good open source alternatives to Firefox? I remember hearing about Brave but also that it was tied into some cryptocoin nonsense, so I'm not sure what else to look at.

Post reply on HN