[deleted]
Update Regarding Add-Ons in Firefox
141–150 of 504 posts
Re: Update Regarding Add-Ons in Firefox
#142Earlier quoted context omitted.
You could say it was remotely disabled by design. What other piece of software randomly just breaks because of the calendar date? I can boot up almost any 20 year old piece of Windows software and it'll work fine, it might not make sense in the current world but it won't go "2019? Fuck off!"
> I can boot up almost any 20 year old piece of Windows software and it'll work fine, it might not make sense in the current world but it won't go "2019? Fuck off!" Is that really true? Would it connect to 802.11m WiFi router? Would you consider it secure enough to open your banking website on it? The bar is not just booting up the machine. The bar is whether the machine is usable (secure).
> Would it connect to 802.11m WiFi router?
Sure. It's using OS networking APIs. Or running in a virtual machine.
> Would you consider it secure enough to open your banking website on it?
If I'm running 20 year old software, it's probably to interact with a legacy system. There are still businesses that run on like 486's with Windows 3.1. This is more common than you think!
> The bar is whether the machine is usable (secure).
The bar is whatever I WANT it to be, it's my machine, and it's pretentious of a software developer to assume they know what I'm using the software for and what my best interests are. For all they know I'm using the software in a museum, 20 years from now, about this era of computing.
Re: Update Regarding Add-Ons in Firefox
#143Earlier quoted context omitted.
They closed the trees (stopped merging other code changes to prioritize this) for the bug I would assume the delay in assigning P1 is really just a result of assigning P1 not being as high priority as fixing the damn problem.
This is one of the things about this whole episode that I find baffling. Stuff like adjusting bug priorities and arranging for someone to tweet an announcement is the work of a good engineering manager. This is the right person to run interference and handle comms and deal with things outside of the critical path, like bugzilla updates.
Stuff like adjusting bug priorities and arranging for someone to tweet an announcement is the work of a good engineering manager
So we can come to the obvious conclusion about Mozilla, then? No good "engineering" managers? Miss one reprioritization and you're out! This is what sane people think?
Re: Update Regarding Add-Ons in Firefox
#144Earlier quoted context omitted.
You could say it was remotely disabled by design. What other piece of software randomly just breaks because of the calendar date? I can boot up almost any 20 year old piece of Windows software and it'll work fine, it might not make sense in the current world but it won't go "2019? Fuck off!"
And the reason you can install 20 year old windows software without caring about code signing certs is that 20 years ago nobody bothered to sign code.
Not every piece of code needs to be signed. Should my ancient copy of Doom 2 stop working because it's not with the times? Or a level editor for it? Or an old turboC compiler?
Some software lives a LONG time and it's fine, and it's up to the user whether that software is still useful to them or not.
Seriously how many posts do we see on hacker news about like "We rebuilt this ancient machine from the 1970s to learn about it." People care about computing history. Not everyone, but there's no reason to force your software to break because the calendar rolls over. Remember Y2K? Things often live a LONG time. People are still actively writing Fortran and COBOL. The short-sightedness of this is amazing, as is the condescending "we know what's best for you" security argument.
Re: Update Regarding Add-Ons in Firefox
#145Earlier quoted context omitted.
This is not entirely accurate. Nothing was done remotely to disable the add-ons. It happened locally. A certificate that's on your machine as part of the Firefox install expired. When that happened, add-ons that were signed via a cert chain that included the expired one started appearing to be invalidly signed . And that's why it requires an update to completely fix. That part is remote, because they need to push a n…
This is bad design. Installed software shouldn't just stop working because the clock ticked. (And yes, I know browsers should stay up to date etc. etc., but come on, no software should just stop functioning because of a calendar) And to the downvoters: doesn't this entire fiasco ENTIRELY PROVE MY POINT?
> And to the downvoters: doesn't this entire fiasco ENTIRELY PROVE MY POINT?
No.
All it proves is that certificates expire (which is a Good Thing (tm)). If you depend on online certificates to verify content, something like this can theoretically happen.
Re: Update Regarding Add-Ons in Firefox
#146Earlier quoted context omitted.
When a certificate is no longer valid, the authority it represents expires too. Grandfathering trust in various places would make cert management even more difficult to get right, because there'd be no hard deadline when a certificate is no longer in force.
But that represents how people consider trust when choosing addons. It's trusting the code and company at the time of install, not at an arbitrary later time. Sure, if the cert expires and there's an update then the user wants to know.
The main trust check is at installation time, but it's possible for problems to be discovered later, and Mozilla needs to be able to do something about it. Certificate non-renewal is the only robust avenue of revocation.
Re: Update Regarding Add-Ons in Firefox
#147Earlier quoted context omitted.
> Also why it took 6 hrs to assign P1 to the bug Because people were staying up until the wee hours of the morning working on fixing it instead of toggling priorities in Bugzilla. This was treated as a five-alarm fire.
>This was treated as a five-alarm fire. I don't think it bothers me personally but it's funny you said that. Presumably you mean a "'no-alarm fire' because who has time to set off an alarm when there's a fire to fight"?!
Read the room, Sheldon.
Re: Update Regarding Add-Ons in Firefox
#148I'm interested in the general writeup what went wrong that they missed this certificate expiring. That's a structural problem. Also why it took 6 hrs to assign P1 to the bug
> Also why it took 6 hrs to assign P1 to the bug Because people were staying up until the wee hours of the morning working on fixing it instead of toggling priorities in Bugzilla. This was treated as a five-alarm fire.
I agree with you, it was more important to do the work than to signal.
However, I bet it’s likely they have procedures and policies for work that first involve signaling like for example the priority level.
I’d be willing to bet lots of things surrounding this issue weren’t handled in a by the book manner. So if you are always going to wing it, why have a book (or a public priority level system) at all?
Re: Update Regarding Add-Ons in Firefox
#149Granted I'm using Nightly (and previously disabled extension signing in about:config), but now all my themes are disabled, even the default one apparently, though that is what it is using. Cannot be re-enabled. When do I get my dark theme back? Also...my default search engine is now Amazon.com?? WTF is going on. EDIT: Also my only search engine. Heck of a job Mozilla.
Bezos and his strategy to name the company something starting with A so it always comes first finally pays off.
Re: Update Regarding Add-Ons in Firefox
#150Earlier quoted context omitted.
Well, I disagree that it's a UX issue. The problem is they shouldn't be expiring local software at all . If it was trustworthy at the time of install, why should the calendar date matter? If users don't want to stay up to date, that may be unwise, but that's there call.
Because if the cert is (for example) actively revoked, that probably means you should stop trusting things signed by it in the past.
Revocation should handled differently than expiration. Two entirely separate things.