Update Regarding Add-Ons in Firefox • Hacker News Board

Re: Update Regarding Add-Ons in Firefox

#111

Post by yborg » Sat, May 04, 2019, 4:59 PM UTC

Tharkun wrote: post #67

I have a bunch of privacy-enhancing addons installed, which have now all been disabled. If I hadn't read HN this morning, I wouldn't even have known why. Until now, I had no idea that it was even possible to remotely disable my addons. And now Mozilla are saying that the "fix" is to allow them to install & run "studies" on my machine? What are they smoking? I'm having a hard time trusting a company that randomly & re…

I enjoy a nice cup of outrage in the morning just like the next guy, but this one is really weak and lacks that fresh taste of evil conspiracy that I really crave.

You use a browser that has remote update capability, which allows them to install and run new software on your machine all the time. There is a whole separate section of the Preferences that says "Privacy" in large print that has a section that clearly identifies the Studies feature and lets you turn it off. And you use a browser that lets you install privacy-enhancing add-ons in the first place, and in fact which invented the whole concept of add-ons. When the browser discovered that it couldn't verify the add-on integrity with a valid cert, it did what it's supposed to do, it disabled them to protect you from someone backdooring these add-ons.

Someone at Mozilla fucked up, and they're trying in good faith to fix it. I don't know what else people are expecting them to do, putting on sackcloth and ashes won't resolve the problem.

Re: Update Regarding Add-Ons in Firefox

#112

Post by lpcvoid » Sat, May 04, 2019, 4:59 PM UTC

Tharkun wrote: post #67

I have a bunch of privacy-enhancing addons installed, which have now all been disabled. If I hadn't read HN this morning, I wouldn't even have known why. Until now, I had no idea that it was even possible to remotely disable my addons. And now Mozilla are saying that the "fix" is to allow them to install & run "studies" on my machine? What are they smoking? I'm having a hard time trusting a company that randomly & re…

Due to them easily being able to push code without much hastle using Studies, I think this is an elegant-ish solution to a problem that shouldn't even have happened (expired certs are something that's entirely avoidable), but errors happen.

Eorum est humanum.

Re: Update Regarding Add-Ons in Firefox

#113

Post by Xylakant » Sat, May 04, 2019, 5:00 PM UTC

overgard wrote: post #107

sgift wrote: post #78

Earlier quoted context omitted.

No one remotely disabled anything. There's a certificate deployed with Firefox. The certificate Firefox used to check addons was only valid till yesterday. So, when the browser started next time it couldn't validate the addons and disabled them. That all happened locally.

You could say it was remotely disabled by design. What other piece of software randomly just breaks because of the calendar date? I can boot up almost any 20 year old piece of Windows software and it'll work fine, it might not make sense in the current world but it won't go "2019? Fuck off!"

And the reason you can install 20 year old windows software without caring about code signing certs is that 20 years ago nobody bothered to sign code.

Re: Update Regarding Add-Ons in Firefox

#114

Post by lugg » Sat, May 04, 2019, 5:00 PM UTC

dingo_bat wrote: post #25

I asked this in the other thread but I guess there's too many comments there: Is there a project for Firefox that is analogous to Chromium for Chrome? I need a Firefox build with all the Mozilla shit ripped out. I don't trust the org that decided their certificate expiration was more important than giving users the choice to run what they want.

Upvoting because this is a really good question, why the hell can't I get a warning and click a button to enable the thing anyway?

Re: Update Regarding Add-Ons in Firefox

#115

Post by _0ffh » Sat, May 04, 2019, 5:00 PM UTC

dralley wrote: post #10

jchw wrote: post #8

Interesting. Sadly, I imagine many users will have studies disabled since the Mr. Robot incident. I've re-enabled it but there does not appear to be a way to force it to check for updates. Guess it will show up in the next 6 hours.

You can set app.normandy.first_run to true and then restart Firefox.

I've seen the same tip elsewhere and tried, but didn't work for me.

What did (seem to) help was setting app.normandy.run_interval_seconds to a small value (21). At least just a couple of seconds after I did, all my addons came back.

Edit: plugins -> addons

Re: Update Regarding Add-Ons in Firefox

#116

Post by derefr » Sat, May 04, 2019, 5:00 PM UTC

ajross wrote: post #88

gpm wrote: post #18

Instead of enabling studies just click on this link. It installs that specific "study" (hotfix) without installing anything else. https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

OMG. "Don't trust Mozilla to install something on your machine. Click this link instead!" Has the "privacy" community finally jumped the shark?

I think what they're saying is "don't trust someone to push software to your machine that you can't see. Instead, download and study this binary!"

Re: Update Regarding Add-Ons in Firefox

#117

Post by pbhjpbhj » Sat, May 04, 2019, 5:00 PM UTC

firethief wrote: post #102

bhauer wrote: post #74

Earlier quoted context omitted.

I'm also interested in why existing adds-ons are failing to run due to this problem. (There was a similar question in another thread about the issue here at HN.) I understand why an add-on update or new installation would be prevented from succeeding by a certificate expiration. But why would a certificate expiration prevent an already-installed from running? Any already-installed add-ons were previously validated at…

When a certificate is no longer valid, the authority it represents expires too. Grandfathering trust in various places would make cert management even more difficult to get right, because there'd be no hard deadline when a certificate is no longer in force.

But that represents how people consider trust when choosing addons. It's trusting the code and company at the time of install, not at an arbitrary later time. Sure, if the cert expires and there's an update then the user wants to know.

Re: Update Regarding Add-Ons in Firefox

#118

Post by eh78ssxv2f » Sat, May 04, 2019, 5:01 PM UTC

overgard wrote: post #107

sgift wrote: post #78

Earlier quoted context omitted.

No one remotely disabled anything. There's a certificate deployed with Firefox. The certificate Firefox used to check addons was only valid till yesterday. So, when the browser started next time it couldn't validate the addons and disabled them. That all happened locally.

You could say it was remotely disabled by design. What other piece of software randomly just breaks because of the calendar date? I can boot up almost any 20 year old piece of Windows software and it'll work fine, it might not make sense in the current world but it won't go "2019? Fuck off!"

> I can boot up almost any 20 year old piece of Windows software and it'll work fine, it might not make sense in the current world but it won't go "2019? Fuck off!"

Is that really true? Would it connect to 802.11m WiFi router? Would you consider it secure enough to open your banking website on it? The bar is not just booting up the machine. The bar is whether the machine is usable (secure).

Re: Update Regarding Add-Ons in Firefox

#119

Post by Xylakant » Sat, May 04, 2019, 5:01 PM UTC

pbhjpbhj wrote: post #99

Xylakant wrote: post #79

Earlier quoted context omitted.

Your addons have not been remotely disabled. They were marked as trustworthy by a certificate that expired and thus are no longer considered trustworthy. The effect is similar, the mechanism is different. You could also enable loading of unsigned extensions, that would “fix” the issue, too.

They were effectively remotely disabled, there was a hidden dead-mans handle that's been triggered in order to effect the result; but it's logically equivalent from an end user perspective -- an external agency caused my add-ons to be disabled without my authorisation. "A certificate chain has expired, do you want to disable all add-ons?" How hard is that?

> How hard is that?

If you think that’s trivial, I challenge you to go build it. It might seem warranted in hindsight, but thinking about all failure cases ahead of time is hard. If it weren’t, we’d not have bugs.

Re: Update Regarding Add-Ons in Firefox

#120

Post by gpm » Sat, May 04, 2019, 5:01 PM UTC

lugg wrote: post #89

bhauer wrote: post #74

Earlier quoted context omitted.

I'm also interested in why existing adds-ons are failing to run due to this problem. (There was a similar question in another thread about the issue here at HN.) I understand why an add-on update or new installation would be prevented from succeeding by a certificate expiration. But why would a certificate expiration prevent an already-installed from running? Any already-installed add-ons were previously validated at…

How do you know if it has not been changed?

Signing just verifies the .xpi file. If the addon has managed to get enough permissions to modify it's .xpi file it can bypass the signing requirement in various ways.

Revocation is, I think, the actual reason.