Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Update Regarding Add-Ons in Firefox

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 504 posts

Re: Update Regarding Add-Ons in Firefox

#41

Post by gpm »

JamesMcGill wrote: post #37
gpm wrote: post #18

Instead of enabling studies just click on this link. It installs that specific "study" (hotfix) without installing anything else. https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

Hold up there. Before people start clicking and installing random add-on links, how about linking to something official (either from a FF dev, or in a soure repository) that references this URL?

So, I just got this url from this HN comment:

https://news.ycombinator.com/item?id=19825921

I'm not clear if they rehosted the XPI or if that's the original mozilla url.

I'm not too worried about it either. The only reason anyone is clicking on this fine link is because firefox only lets you install addons signed by Mozilla. And since the typical signing process gives addons signed by the broken intermediary we can be pretty confident that this wasn't just signed by mozilla, but is the original study.

In general caution about installing software from random links is definitely a good idea though.

Edit: Looks to me like it's an original mozilla url (judging by github comments on mozilla/normandy - I haven't found an official source saying it is official due to lack of continuing to search: https://github.com/mozilla/normandy/pull/1697)

Re: Update Regarding Add-Ons in Firefox

#42

Post by mlthoughts2018 »

SquareWheel wrote: post #27
peshooo wrote: post #2

Firefox has an interesting backdoor...

They also have a frontdoor: built-in automatic updates.

This type of reply is ludicrous. An obscure feature (Normandy modifying default settings as part of studies) that requires you to actively opt out (and even then it’s still not clear if you _also_ have to go to about:config to _really_ disable it) and which can make such large scale errors as evicting all extensions is in absolutely no way comparable to the case of a user agreeing to auto-updates and fairly easily being able to disable them.

It is astoundingly disingenuous to act like these things are comparable.

Re: Update Regarding Add-Ons in Firefox

#43

Post by ekianjo »

open-source-ux wrote: post #20

I hate to say all these things because I use Firefox all the time, but...the communication around the add-ons issue has been poorly handled by Mozilla. I only learned of the problem by visiting HN. But what of the thousands of other users who don't visit HN? If you visit the Mozilla homepage, there is nothing to acknowledge the problem (at least at the time of writing this message). Let's try the Support page. Where…

That's sadly not the first time Mozilla fails to communicate appropriately about issues/changes that are pushed down to the end users. They should reshuffle some of their Marketing Resources to work on proper non-promotional communication instead, so that current users at least know what to deal with.

Re: Update Regarding Add-Ons in Firefox

#44

Post by JamesMcGill »

gpm wrote: post #31
Grollicus wrote: post #14

I'm interested in the general writeup what went wrong that they missed this certificate expiring. That's a structural problem. Also why it took 6 hrs to assign P1 to the bug

They closed the trees (stopped merging other code changes to prioritize this) for the bug I would assume the delay in assigning P1 is really just a result of assigning P1 not being as high priority as fixing the damn problem.

This is one of the things about this whole episode that I find baffling. Stuff like adjusting bug priorities and arranging for someone to tweet an announcement is the work of a good engineering manager. This is the right person to run interference and handle comms and deal with things outside of the critical path, like bugzilla updates.

Re: Update Regarding Add-Ons in Firefox

#45

Post by CuriousCosmic »

gpm wrote: post #21
firethief wrote: post #11

Earlier quoted context omitted.

Servo was a silly pointless separate browser once

I'm not sure I would call it "pointless", they've merged and are merging a lot of the code they used servo to experiment with into firefox. Of everything mozilla has done recently, Servo is one of the things I'm most positive about.

I think that was the point they were making.

Re: Update Regarding Add-Ons in Firefox

#46

Post by dralley »

jimmaswell wrote: post #26
firethief wrote: post #11

Earlier quoted context omitted.

Servo was a silly pointless separate browser once

I still hold that the multithreaded performance benefit was nowhere near worth wiping away so many of hours of developer time and ripping so many good extensions out of users' hands with no replacement for so much of the lost functionality.

It's not just performance that was the issue. XPCOM gives you access to basically the entirety of the browser internals. There's no designed API, the implementation is the API. Which means that you can't change the browser internals, unless you're willing to break addons, or you perform an audit to figure out which plugins will be broken and you get them to update first.

Basically all refactors took months and months and months because of this. There was no way to address the accumulating technical debt.

Re: Update Regarding Add-Ons in Firefox

#47

Post by dralley »

super_mario wrote: post #32
asutekku wrote: post #17

Earlier quoted context omitted.

That doesn’t make money which kinda is required to work on Firefox.

But they have money to trow at Antifa fascists.

Not this shit again.

It was a private email service. The complaint was that the private email service also happens to be used by Antifa members. Which is unsurprising.

This is like complaining that they shouldn't give money to the Tor project because it gets used by unsavory people, too.

Re: Update Regarding Add-Ons in Firefox

#48

Post by ChrisSD »

JamesMcGill wrote: post #37
gpm wrote: post #18

Instead of enabling studies just click on this link. It installs that specific "study" (hotfix) without installing anything else. https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

Hold up there. Before people start clicking and installing random add-on links, how about linking to something official (either from a FF dev, or in a soure repository) that references this URL?

This is true. However it is signed by moz and looking at the source it seems safe enough (the cert is legit). It's just a normal wrapper with the following code added:

    // first inject the new cert
    try {
      let intermediate = "MIIHLTCCBRWgAwIBAgIDEAAIMA0GCSqGSIb3DQEBDAUAMH0xCzAJBgNVBAYTAlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3ppbGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTEfMB0GA1UEAxMWcm9vdC1jYS1wcm9kdWN0aW9uLWFtbzAeFw0xNTA0MDQwMDAwMDBaFw0yNTA0MDQwMDAwMDBaMIGnMQswCQYDVQQGEwJVUzEcMBoGA1UEChMTTW96aWxsYSBDb3Jwb3JhdGlvbjEvMC0GA1UECxMmTW96aWxsYSBBTU8gUHJvZHVjdGlvbiBTaWduaW5nIFNlcnZpY2UxJjAkBgNVBAMTHXNpZ25pbmdjYTEuYWRkb25zLm1vemlsbGEub3JnMSEwHwYJKoZIhvcNAQkBFhJmb3hzZWNAbW96aWxsYS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/qluiiI+wO6qGA4vH7cHvWvXpdju9JnvbwnrbYmxhtUpfS68LbdjGGtv7RP6F1XhHT4MU3v4GuMulH0E4Wfalm8evsb3tBJRMJPICJX5UCLi6VJ6J2vipXSWBf8xbcOB+PY5Kk6L+EZiWaepiM23CdaZjNOJCAB6wFHlGe+zUk87whpLa7GrtrHjTb8u9TSS+mwjhvgfP8ILZrWhzb5H/ybgmD7jYaJGIDY/WDmq1gVe03fShxD09Ml1P7H38o5kbFLnbbqpqC6n8SfUI31MiJAXAN2e6rAOM8EmocAY0EC5KUooXKRsYvHzhwwHkwIbbe6QpTUlIqvw1MPlQPs7Zu/MBnVmyGTSqJxtYoklr0MaEXnJNY3g3FDf1R0Opp2/BEY9Vh3Fc9Pq6qWIhGoMyWdueoSYa+GURqDbsuYnk7ZkysxK+yRoFJu4x3TUBmMKM14jQKLgxvuIzWVn6qg6cw7ye/DYNufc+DSPSTSakSsWJ9IPxiAU7xJ+GCMzaZ10Y3VGOybGLuPxDlSd6KALAoMcl9ghB2mvfB0N3wv6uWnbKuxihq/qDps+FjliNvr7C66mIVH+9rkyHIy6GgIUlwr7E88Qqw+SQeNeph6NIY85PL4p0Y8KivKP4J928tpp18wLuHNbIG+YaUk5WUDZ6/2621pi19UZQ8iiHxN/XKQIDAQABo4IBiTCCAYUwDAYDVR0TBAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwMwHQYDVR0OBBYEFBY++xz/DCuT+JsV1y2jwuZ4YdztMIGoBgNVHSMEgaAwgZ2AFLO86lh0q+FueCqyq5wjHqhjLJe3oYGBpH8wfTELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE01vemlsbGEgQ29ycG9yYXRpb24xLzAtBgNVBAsTJk1vemlsbGEgQU1PIFByb2R1Y3Rpb24gU2lnbmluZyBTZXJ2aWNlMR8wHQYDVQQDExZyb290LWNhLXByb2R1Y3Rpb24tYW1vggEBMDMGCWCGSAGG+EIBBAQmFiRodHRwOi8vYWRkb25zLm1vemlsbGEub3JnL2NhL2NybC5wZW0wTgYDVR0eBEcwRaFDMCCCHi5jb250ZW50LXNpZ25hdHVyZS5tb3ppbGxhLm9yZzAfgh1jb250ZW50LXNpZ25hdHVyZS5tb3ppbGxhLm9yZzANBgkqhkiG9w0BAQwFAAOCAgEAX1PNli/zErw3tK3S9Bv803RV4tHkrMa5xztxzlWja0VAUJKEQx7f1yM8vmcQJ9g5RE8WFc43IePwzbAoum5F4BTM7tqM//+e476F1YUgB7SnkDTVpBOnV5vRLz1Si4iJ/U0HUvMUvNJEweXvKg/DNbXuCreSvTEAawmRIxqNYoaigQD8x4hCzGcVtIi5Xk2aMCJW2K/6JqkN50pnLBNkPx6FeiYMJCP8z0FIz3fv53FHgu3oeDhi2u3VdONjK3aaFWTlKNiGeDU0/lr0suWfQLsNyphTMbYKyTqQYHxXYJno9PuNi7e1903PvM47fKB5bFmSLyzB1hB1YIVLj0/YqD4nz3lADDB91gMBB7vR2h5bRjFqLOxuOutNNcNRnv7UPqtVCtLF2jVb4/AmdJU78jpfDs+BgY/t2bnGBVFBuwqS2Kult/2kth4YMrL5DrURIM8oXWVQRBKxzr843yDmHo8+2rqxLnZcmWoe8yQ41srZ4IB+V3w2TIAd4gxZAB0Xa6KfnR4D8RgE5sgmgQoK7Y/hdvd9Ahu0WEZI8Eg+mDeCeojWcyjF+dt6c2oERiTmFTIFUoojEjJwLyIqHKt+eApEYpF7imaWcumFN1jR+iUjE4ZSUoVxGtZ/Jdnkf8VVQMhiBA+i7r5PsfrHq+lqTTGOg+GzYx7OmoeJAT0zo4c=";
      let certDB = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB);
      certDB.addCertFromBase64(intermediate, ",,");
      console.log("new intermediate certificate added");
    } catch (e) {
      console.error("failed to add new intermediate certificate:", e);
    }

    // Second, force a re-verify of signatures
    try {
      XPIDatabase.verifySignatures();
      console.log("signatures re-verified");
    } catch (e) {
      console.error("failed to re-verify signatures:", e);
    }

Re: Update Regarding Add-Ons in Firefox

#49

Post by notimetorelax »

open-source-ux wrote: post #20

I hate to say all these things because I use Firefox all the time, but...the communication around the add-ons issue has been poorly handled by Mozilla. I only learned of the problem by visiting HN. But what of the thousands of other users who don't visit HN? If you visit the Mozilla homepage, there is nothing to acknowledge the problem (at least at the time of writing this message). Let's try the Support page. Where…

The way I see it, people might have gotten used to software break from time to time. Once software breaks it is reasonable to expect it to get fix in a couple days when it is updated. At least this was probably the experience for the majority of users, those that noticed the issue.
Post reply on HN