Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

741–750 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#741

Post by classichasclass »

gpm wrote: post #704
XORcat wrote: post #592

Earlier quoted context omitted.

JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_sign... hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... From the looks, it installs the above plugin, and changes `app.update.lastUpdateTime.xpi-signature-verification` to `1556945257` I can't get it to work in ESR 60 though. Getting file not found on…

Hey, if you just click on that storage.googleapis.com link it installs the hotfix directly without having to enable normandy ;)

Just tried on Android. Hooray!

Re: All extensions disabled due to expiration of intermediate signing cert

#742

Post by justinclift »

justinclift wrote: post #246
adtac wrote: post #156

Earlier quoted context omitted.

Why do you have certificates in your code to begin with?

If you have your own CA for whatever reason, it's common to distribute the root and intermediate certs with your code so things can resolve. You don't ship the signing keys with the certs, as that would be bad. ;)

s/resolve/validate/

Re: All extensions disabled due to expiration of intermediate signing cert

#743

Post by jopsen »

nimbius wrote: post #738

another month, another browser vendor that does something inconceivably bone-headed in "the service of users." first it was deprecating ALSA for pulseaudio, then it was pocket, then tiles and their suggestions, then that weird video/voice chat thing, and then running "studies" as if my use of the browser was some tacit acceptance of my position as a guinea pig of the internet. Today every extension I use to make the…

This appears to be a mistake.

It's clearly bad that things can break this way. But this happened because a certificate expired.

Mozilla didn't have to require signatures and certificates for extensions. They did so because they want to protect users.

Protecting users with signature schemes, increase complexity and, thus, the risk of debacles like this.

Re: All extensions disabled due to expiration of intermediate signing cert

#744

Post by tempodox »

rmbryan wrote: post #520

Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.

I still get “Download failed. Please check your connection” when attempting to re-download the add-on you took away without asking me. That thing was pretty much the only reason I used Firefox at all.

Re: All extensions disabled due to expiration of intermediate signing cert

#745

Post by floatingatoll »

abrowne wrote: post #586
floatingatoll wrote: post #301

Earlier quoted context omitted.

Upgrading your profile from Release to Nightly, which occurs automatically when you open it with Nightly, is a one-way irreversible step. This could prevent your profile from being used with Release without crashes, or lose profile data such as bookmarks or saved passwords when later used with Release, depending on what work is underway in Nightly and if it happens to be backwards-compatible. Be sure to backup your p…

FWIW I started using beta, nightly and the old "UX" channel, first on Mac and then on Linux, and before I knew it could be a problem I switched between them with the same profile all the time. Maybe there were subtle bugs I wasn't aware of, but nothing I ever noticed.

I haven’t run into any issues in a while, but you only have to get hit by lightning one time to lose your profile data. Best to be consciously careful about it.

Re: All extensions disabled due to expiration of intermediate signing cert

#746

Post by hedora »

taneq wrote: post #686
bilbo0s wrote: post #650

Earlier quoted context omitted.

I had mine disabled. So let's think about this for a second. If I disable a security hole that you can drive a semi-truck through, I remain foobar'd. If I run my "secure" firefox configuration, with the security hole enabled, then they un-foobar me first. Before anyone else. So I could effectively get rewarded, for always keeping a security hole open. But I didn't keep it open, so... yeah... they'll get around to me…

> So I could effectively get rewarded, for always keeping a security hole open. That's the way it always works, isn't it? Security and convenience are opposing concerns.

Good security designs increase convenience (eg ssh, touch id, single sign on).

The three goals of computer security are integrity, confidentiality and availability.

All three of those expand the usefulness of the system to the end user.

Re: All extensions disabled due to expiration of intermediate signing cert

#747

Post by gpm »

igivanov wrote: post #740
gpm wrote: post #733

Earlier quoted context omitted.

Maybe you pasted it in the wrong console? You need the 'browser console' which is different from the one you open on random webpages. Go to "about:config" (in the url bar), search for and enable devtools.chrome.enabled, then hit ctrl-shift-j (or you can open it from Menu -> Web Developer -> Browser Console).

Ha! That did the trick! Though it gave me these cryptic errors the add-ons are now enabled, thanks! TypeError: setting is undefined[Learn More] ExtensionPreferencesManager.jsm:90:7 No matching message handler for the given recipient. MessageChannel.jsm:924 1556983316679 addons.xpi-utils WARN Add-on fxmonitor@mozilla.org is not correctly signed. Edit: another weirdness: i decided to take a look at a different computer…

That's an expected error, it has to do with how that addon (which is non critical but published by mozilla and really just a part of firefox) is installed, once mozilla publishes a new version of firefox with an updated signing key it should fix itself.

Re: All extensions disabled due to expiration of intermediate signing cert

#749

Post by neiman »

shawnz wrote: post #698
bilbo0s wrote: post #650

Earlier quoted context omitted.

I had mine disabled. So let's think about this for a second. If I disable a security hole that you can drive a semi-truck through, I remain foobar'd. If I run my "secure" firefox configuration, with the security hole enabled, then they un-foobar me first. Before anyone else. So I could effectively get rewarded, for always keeping a security hole open. But I didn't keep it open, so... yeah... they'll get around to me…

Automatic updates aren't a security hole. They are a security enhancement

Unless the entity that pushes the updates become malicious, then they're a security hole.
Post reply on HN