Update Regarding Add-Ons in Firefox • Hacker News Board

Re: Update Regarding Add-Ons in Firefox

#211

Post by deogeo » Sat, May 04, 2019, 6:07 PM UTC

Mindless2112 wrote: post #202

the8472 wrote: post #161

At the minimum they should add a testsuite that runs at least a month into the future to catch these kinds of things. There was a similar issue[0] a few years ago that was only caught a month in advance. Even better would be to set things up to only do a verify on install instead on every startup. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1267318

> Even better would be to set things up to only do a verify on install instead on every startup. That would defeat the purpose of verification: "Add-on signing in Firefox helps protect against browser hijackers and other malware by making it harder for them to be installed." [1] And it's not just malware that was doing that. Microsoft force-installed the ".NET Framework Assistant" into Firefox on Windows, and you had…

Could you explain why verifying on every startup, instead of just on install, is necessary? The page you linked doesn't mention it.

Edit: Let me amend my question - why is it necessary for the certificates to expire? If a plugin is signed by Mozilla, why wouldn't it be trusted once it gets old?

Re: Update Regarding Add-Ons in Firefox

#212

Post by dwaite » Sat, May 04, 2019, 6:07 PM UTC

overgard wrote: post #144

Xylakant wrote: post #113

Earlier quoted context omitted.

And the reason you can install 20 year old windows software without caring about code signing certs is that 20 years ago nobody bothered to sign code.

Not every piece of code needs to be signed. Should my ancient copy of Doom 2 stop working because it's not with the times? Or a level editor for it? Or an old turboC compiler? Some software lives a LONG time and it's fine, and it's up to the user whether that software is still useful to them or not. Seriously how many posts do we see on hacker news about like "We rebuilt this ancient machine from the 1970s to learn a…

Typically software signatures are not just pass/fail, but used to give audited entitlements for API.

So a secure system would let you run Doom, but could forbid:'

- Access to the filesystem outside the application domain due to potential for exfiltrating or destroying user data

- Likewise, access to global system data may be limited

- Access to the network due to (raw TCP/UDP) traffic not having been audited for security, and the network connectivity being usable for exfiltration

- Access to run full-screen due to the ability to perform user phishing attacks by presenting fake UI.

- The ability to disable system-registered keyboard sequences (on windows, such as the windows key or sticky keys)

- Access to mouse events outside its window

- Access to key scan data, although this likely will be emulated

- Access to change display color modes to e.g. 256 color indexed, although this will likely be emulated as well

Re: Update Regarding Add-Ons in Firefox

#213

Post by Fnoord » Sat, May 04, 2019, 6:08 PM UTC

overgard wrote: post #203

Fnoord wrote: post #184

Earlier quoted context omitted.

You are putting words in my mouth, please stop that. Instead of disabling this historically working feature which normally works great against hostile attacks such as MITM and malware this problem would've been avoided by a simple cron script which runs daily, and checks for expired certificates used within the infrastructure (both interaly used and externally used). The main competitor you mention, Google Chrome, is…

I'm not putting words in your mouth, you literally said this is a "Good Thing (tm)", because of hypothetical security reasons. Whereas I'm literally saying that this actually broke real privacy extensions, broke peoples software, and badly damaged their reputation. As to your argument about security: doing the check on install instead of all the time, as I suggest is preferable, still protects against MITM and malwar…

Things might change after install. Its a Good Thing (tm) to periodically recheck, or check revocations.

> > I'm not putting words in your mouth [..]

Yes, you did:

> "So you think [..]"

Re: Update Regarding Add-Ons in Firefox

#214

Post by floatingatoll » Sat, May 04, 2019, 6:09 PM UTC

human20190310 wrote: post #197

floatingatoll wrote: post #180

Earlier quoted context omitted.

Yes, we are all quite advanced enough to footgun ourselves with abandon :) For everyone else, the fix is magically healing their browser without any intervention at all, and some of my high-skilled tech friends haven’t even noticed yet because they’re weekending and this all resolved itself before they realized it. Never underestimate the burden that being an “expert” places on your future time spend.

That hadn't occurred to me, but the fact that this is occurring on a weekend probably mitigates the impact to organizations that operate Monday-through-Friday. Sucks for the Mozillans who are scrambling right now though. Hope they get a long weekend to compensate.

I have to assume that’s why they focused on releasing a fix first and communicating second, because there was still hope to save everyone before the impact worsened. I hope they’re able to get at least a few hours of rest before Monday.

Re: Update Regarding Add-Ons in Firefox

#215

Post by [deleted] » Sat, May 04, 2019, 6:10 PM UTC

kosma wrote: post #52

gpm wrote: post #18

Instead of enabling studies just click on this link. It installs that specific "study" (hotfix) without installing anything else. https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

How do I uninstall this? It doesn't show up anywhere after installation.

[deleted]

Re: Update Regarding Add-Ons in Firefox

#216

Post by clairity » Sat, May 04, 2019, 6:12 PM UTC

hmm, i don't seem to have been affected by this bug somehow (my extensions are all still working). i turn off as much phoning home as i can (including turning studies off) and block connections to *.services.mozilla.com

any idea why i might not be affected? it may help others who might want to retain control of their firefox browser (chromium-based browsers being non-sequiturs).

Re: Update Regarding Add-Ons in Firefox

#217

Post by arrivance » Sat, May 04, 2019, 6:12 PM UTC

gpm wrote: post #18

Instead of enabling studies just click on this link. It installs that specific "study" (hotfix) without installing anything else. https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

Anybody have any hints for someone who tries to install this and gets a connection error?

EDIT: Thanks to HN User gpm for suggesting a possible fix for this [1]. Right-click, save-as the XPI to somewhere on your computer (or use curl, wget or whatever tool of you choice), and then run it within Firefox. That might work (it did in my case).

EDIT 2: Also, interstingly, the blog post does have an update saying "There are a number of work-arounds being discussed in the community. These are not recommended as they may conflict with fixes we are deploying.", so, use at your own caution I guess.

[1]: https://news.ycombinator.com/item?id=19828669

Re: Update Regarding Add-Ons in Firefox

#218

Post by [deleted] » Sat, May 04, 2019, 6:13 PM UTC

mook wrote: post #188

Grollicus wrote: post #14

I'm interested in the general writeup what went wrong that they missed this certificate expiring. That's a structural problem. Also why it took 6 hrs to assign P1 to the bug

Looking at the changeset [1], I'm curious why the explicit check for expiry (line 644/646) didn't work. Unfortunately the mentioned bug is rather light on details; presumably they were collaborating on IRC or something instead. [1] GitHub mirror to not stress their infra: https://github.com/mozilla/gecko-dev/commit/1d1260c7615f1d9a...

[deleted]

Re: Update Regarding Add-Ons in Firefox

#219

Post by owl57 » Sat, May 04, 2019, 6:14 PM UTC

overgard wrote: post #175

Fnoord wrote: post #145

Earlier quoted context omitted.

> And to the downvoters: doesn't this entire fiasco ENTIRELY PROVE MY POINT? No. All it proves is that certificates expire (which is a Good Thing (tm)). If you depend on online certificates to verify content, something like this can theoretically happen.

So you think Mozilla is enjoying this right now? And that this is going to help the perception and market share of Firefox? Hypothetically, lets say they took the opposite approach, and only checked the certificate date on installation. What would have happened? There would have been a brief period of time where people couldn't install extensions, it would have been fixed in a few hours, and this story would probably…

Not only that, but now people are evaluating other decisions that Mozilla has made separately from this in an unfavorable light (Studies and Normandy, specifically).

Sounds like a good thing. Probably sounds like a good thing to some of the engineers at Mozilla.

The computing industry loses out on this too: we're all better off for chrome having a viable open source competitor.

I want a free competitor, not an open source one. And this is the most prominent example of that somewhat subtle distinction: Firefox is open source, but with all these backdoors it's no longer free, neither in spirit nor in practice.

P.S. On the other hand, it's probably indeed better to have at least two serious competing browsers, even if they are both non-free.

Re: Update Regarding Add-Ons in Firefox

#220

Post by Xylakant » Sat, May 04, 2019, 6:16 PM UTC

deogeo wrote: post #211

Mindless2112 wrote: post #202

Earlier quoted context omitted.

> Even better would be to set things up to only do a verify on install instead on every startup. That would defeat the purpose of verification: "Add-on signing in Firefox helps protect against browser hijackers and other malware by making it harder for them to be installed." [1] And it's not just malware that was doing that. Microsoft force-installed the ".NET Framework Assistant" into Firefox on Windows, and you had…

Could you explain why verifying on every startup, instead of just on install, is necessary? The page you linked doesn't mention it. Edit: Let me amend my question - why is it necessary for the certificates to expire? If a plugin is signed by Mozilla, why wouldn't it be trusted once it gets old?

There’s no guarantee that a (malicious or undesirable) extension was added via FF, so check on install could be circumvented by any of the crapware installers we all love.