Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Update Regarding Add-Ons in Firefox

blog.mozilla.org

Post reply on HN
Print view View original

121–130 of 504 posts

Re: Update Regarding Add-Ons in Firefox

#121

Post by rebolek »

overgard wrote: post #104
wool_gather wrote: post #81

Earlier quoted context omitted.

This is not entirely accurate. Nothing was done remotely to disable the add-ons. It happened locally. A certificate that's on your machine as part of the Firefox install expired. When that happened, add-ons that were signed via a cert chain that included the expired one started appearing to be invalidly signed . And that's why it requires an update to completely fix. That part is remote, because they need to push a n…

This is bad design. Installed software shouldn't just stop working because the clock ticked. (And yes, I know browsers should stay up to date etc. etc., but come on, no software should just stop functioning because of a calendar) And to the downvoters: doesn't this entire fiasco ENTIRELY PROVE MY POINT?

You obviously never used Windows, so you’ve never encountered them restarting just because of an update.

Re: Update Regarding Add-Ons in Firefox

#123

Post by vesinisa »

For me (repository firefox on ArchLinux), the temporary fix was setting devtools.chrome.enabled = true in about:config, and running this small JavaScript snippet in Chrome DevTools (Ctrl+Shift+J):

https://wiki.archlinux.org/index.php/Firefox#Firefox_disable...

AFAIK, this will enable all the disabled add-ons until the next check, which is in 24 hours. This will be hopefully enough time for Mozilla to release a stable channel update, instead of the "Studies hack".

At least for me, fiddling with the Studies settings had no effect; the about:studies page remained empty regardless of what I did. I've also seen multiple reports from people who got the Studies hack working that the fix actually failed to address the issue properly.

Re: Update Regarding Add-Ons in Firefox

#124

Post by nine_k »

floatingatoll wrote: post #60
JamesMcGill wrote: post #37

Earlier quoted context omitted.

Hold up there. Before people start clicking and installing random add-on links, how about linking to something official (either from a FF dev, or in a soure repository) that references this URL?

The blog post linked by this HN post is the official URL for the patch. Any installation method not described there is unofficial DIY, no matter how Mozilla-signed any given version of the XPI is.

Sir, this is Hacker News.

Re: Update Regarding Add-Ons in Firefox

#125

Post by overgard »

wool_gather wrote: post #105
overgard wrote: post #104

Earlier quoted context omitted.

This is bad design. Installed software shouldn't just stop working because the clock ticked. (And yes, I know browsers should stay up to date etc. etc., but come on, no software should just stop functioning because of a calendar) And to the downvoters: doesn't this entire fiasco ENTIRELY PROVE MY POINT?

No, I totally agree with that (I just edited to expand on this point). It was a bad user experience.

Well, I disagree that it's a UX issue. The problem is they shouldn't be expiring local software at all. If it was trustworthy at the time of install, why should the calendar date matter?

If users don't want to stay up to date, that may be unwise, but that's there call.

Re: Update Regarding Add-Ons in Firefox

#126

Post by overgard »

rebolek wrote: post #121
overgard wrote: post #104

Earlier quoted context omitted.

This is bad design. Installed software shouldn't just stop working because the clock ticked. (And yes, I know browsers should stay up to date etc. etc., but come on, no software should just stop functioning because of a calendar) And to the downvoters: doesn't this entire fiasco ENTIRELY PROVE MY POINT?

You obviously never used Windows, so you’ve never encountered them restarting just because of an update.

I have and it still infuriates me :-)

I also did a bunch of sketchy registry hacks to fix that. (I keep up to date, but I don't need microsoft restarting my system at random hours)

Re: Update Regarding Add-Ons in Firefox

#127

Post by LifeLiverTransp »

yborg wrote: post #111
Tharkun wrote: post #67

I have a bunch of privacy-enhancing addons installed, which have now all been disabled. If I hadn't read HN this morning, I wouldn't even have known why. Until now, I had no idea that it was even possible to remotely disable my addons. And now Mozilla are saying that the "fix" is to allow them to install & run "studies" on my machine? What are they smoking? I'm having a hard time trusting a company that randomly & re…

I enjoy a nice cup of outrage in the morning just like the next guy, but this one is really weak and lacks that fresh taste of evil conspiracy that I really crave. You use a browser that has remote update capability, which allows them to install and run new software on your machine all the time. There is a whole separate section of the Preferences that says "Privacy" in large print that has a section that clearly ide…

There is a whole section of buttons that in effect do nothing and are ignored like the windows buttons, but you as a user get the ilusion of choice and power and can busy yourself with this Fun Time Pop Up Farmyard Friends of Privacy.

All your entitlement to control your own machine is melting away.

Re: Update Regarding Add-Ons in Firefox

#128

Post by eh78ssxv2f »

Tharkun wrote: post #67

I have a bunch of privacy-enhancing addons installed, which have now all been disabled. If I hadn't read HN this morning, I wouldn't even have known why. Until now, I had no idea that it was even possible to remotely disable my addons. And now Mozilla are saying that the "fix" is to allow them to install & run "studies" on my machine? What are they smoking? I'm having a hard time trusting a company that randomly & re…

> And now Mozilla are saying that the "fix" is to allow them to install & run "studies" on my machine? What are they smoking?

Can you elaborate what's your concern with "studies"? By installing Firefox that updates automatically, the user is already giving control of the software and letting Mozilla decide what's the best. How is modifying software logic using studies different than modifying logic by updating the binary?

Re: Update Regarding Add-Ons in Firefox

#129

Post by pbhjpbhj »

0xffff2 wrote: post #85
bhauer wrote: post #74

Earlier quoted context omitted.

I'm also interested in why existing adds-ons are failing to run due to this problem. (There was a similar question in another thread about the issue here at HN.) I understand why an add-on update or new installation would be prevented from succeeding by a certificate expiration. But why would a certificate expiration prevent an already-installed from running? Any already-installed add-ons were previously validated at…

I believe it's set up this way specifically to allow revocation for addons that are initially approved but later found to be malicious.

If it is, without requesting user authorisation, then that's an illegal act under the UK Computer Misuse Act (and the USA's CFAA I think too) - modification of a computer without authorisation.

Re: Update Regarding Add-Ons in Firefox

#130

Post by LifeLiverTransp »

SiempreViernes wrote: post #103
Tharkun wrote: post #93

Earlier quoted context omitted.

If you can disable all my addons by having a certificate expire, you can effectively remotely disable all my addons. And that's exactly what happened. The fact that this was (presumably?) not intentional is irrelevant. The switch may not be an actual switch, but it's there nevertheless. And it shouldn't be.

So you are saying there should be no way for an installed addon to fail an integrity check?

Yes.. the choice should be taken to the user- and the users choice should trump them all.
Post reply on HN