Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Update Regarding Add-Ons in Firefox

blog.mozilla.org

Post reply on HN
Print view View original

221–230 of 504 posts

Re: Update Regarding Add-Ons in Firefox

#221

Post by the8472 »

Mindless2112 wrote: post #202
the8472 wrote: post #161

At the minimum they should add a testsuite that runs at least a month into the future to catch these kinds of things. There was a similar issue[0] a few years ago that was only caught a month in advance. Even better would be to set things up to only do a verify on install instead on every startup. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1267318

> Even better would be to set things up to only do a verify on install instead on every startup. That would defeat the purpose of verification: "Add-on signing in Firefox helps protect against browser hijackers and other malware by making it harder for them to be installed." [1] And it's not just malware that was doing that. Microsoft force-installed the ".NET Framework Assistant" into Firefox on Windows, and you had…

Those still would have their certificates checked on installation.

And honestly, I think it is security theater to attempt to defend against attackers on the same or higher privilege level. If microsoft wants to force something down your throat on windows then there's not much you can do.

The problem is that mozilla turns the failures of others into their own problem and then they try to fix it themselves. That scope and responsibility creep leads us to the fallout we're seeing now.

Re: Update Regarding Add-Ons in Firefox

#222

Post by makomk »

deogeo wrote: post #211
Mindless2112 wrote: post #202

Earlier quoted context omitted.

> Even better would be to set things up to only do a verify on install instead on every startup. That would defeat the purpose of verification: "Add-on signing in Firefox helps protect against browser hijackers and other malware by making it harder for them to be installed." [1] And it's not just malware that was doing that. Microsoft force-installed the ".NET Framework Assistant" into Firefox on Windows, and you had…

Could you explain why verifying on every startup, instead of just on install, is necessary? The page you linked doesn't mention it. Edit: Let me amend my question - why is it necessary for the certificates to expire? If a plugin is signed by Mozilla, why wouldn't it be trusted once it gets old?

How do you propose Firefox should tell whether the unsigned, shady add-on was installed by the user, or by some other dodgy app messing with Firefox's files whilst it wasn't running to make it look like the user installed the add-on?

Re: Update Regarding Add-Ons in Firefox

#223

Post by parrellel »

gatherhunterer wrote: post #200
usecontainers wrote: post #156

Earlier quoted context omitted.

So that's pretty unfair. 1) They state they are working on a fix for normal, release channel users who don't want to run studies 2) they tell you to temporarily run studies to get the fix within up to 6 six hours (could be faster; set expectation) 3) You can explicitly install nightly or 66.4 before it's pushed if you want a fix now Yes, it's unfortunate, I'd expect them to meet it head on, push a tested fix in a tim…

It is too late to listen to reason. Many commenters have spent their Saturday morning pushing a narrative that appeals to emotion.

What narrative could there be other than "Goddamn it Cert Guy at Mozilla, you had one job?"

Re: Update Regarding Add-Ons in Firefox

#224

Post by tilolebo »

isoskeles wrote: post #209
gatherhunterer wrote: post #200

Earlier quoted context omitted.

It is too late to listen to reason. Many commenters have spent their Saturday morning pushing a narrative that appeals to emotion.

I just switched my browser. Bye bye Firefox.

I'm curious, do you switch at every fuck up?

Then it's only a matter of time until you come back to Firefox, or maybe you'll end up making your own web browser?

Re: Update Regarding Add-Ons in Firefox

#225

Post by kermitismyhero »

clairity wrote: post #216

hmm, i don't seem to have been affected by this bug somehow (my extensions are all still working). i turn off as much phoning home as i can (including turning studies off) and block connections to *.services.mozilla.com any idea why i might not be affected? it may help others who might want to retain control of their firefox browser (chromium-based browsers being non-sequiturs).

It was the same for me. Firefox 66.0.3 on Xubuntu 19.04. I also turn off a lot of phone-home behaviour. And I never had any problems with extensions getting disabled. I have no idea why I wasn't affected.

But frankly, "not being affected" isn't good enough for me. Even if I dodged this bullet I might not dodge the next. I'm looking for an alternative browser. Falkon has been interesting so far. It's a little bare-bones in many ways, but at least it's immunue to any future Mozilla screwups.

Re: Update Regarding Add-Ons in Firefox

#226

Post by C14L »

gpm wrote: post #18

Instead of enabling studies just click on this link. It installs that specific "study" (hotfix) without installing anything else. https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

Great idea!

Install from a random web link to file on a "cloud" server.

What could possibly go wrong!

Re: Update Regarding Add-Ons in Firefox

#227

Post by Xylakant »

pbhjpbhj wrote: post #117
firethief wrote: post #102

Earlier quoted context omitted.

When a certificate is no longer valid, the authority it represents expires too. Grandfathering trust in various places would make cert management even more difficult to get right, because there'd be no hard deadline when a certificate is no longer in force.

But that represents how people consider trust when choosing addons. It's trusting the code and company at the time of install, not at an arbitrary later time. Sure, if the cert expires and there's an update then the user wants to know.

You cannot rely on “check at install time.” An extension could be installed by a crapware installer behind FF’s back. You can’t go and remember the trust state at install time either, because that memory would need to be kept locally and could be modified by a crapware installer. So the only solution that prevents circumventing the check is to check the signature when the extension is loaded.

Re: Update Regarding Add-Ons in Firefox

#228

Post by username223 »

andrewshadura wrote: post #160
username223 wrote: post #53

Earlier quoted context omitted.

You would think they could have linked to that in their blog post, since people who have disabled "studies" have probably done so for a reason. Telemetry is bad enough; even without the "Mr. Robot" thing, there's no way I would let Mozilla randomly push changes to my browser just to see what happens.

What’s bad about telemetry?

It's just another database collecting unknown information about me ("anonymized" in some way that may be reversible), stored for an unknown length of time, and enabled by default. Just ask. Plenty of people will beta test software for a $20 gift certificate, or even for free, but they should be given a choice.

Re: Update Regarding Add-Ons in Firefox

#230

Post by human20190310 »

pbhjpbhj wrote: post #99
Xylakant wrote: post #79

Earlier quoted context omitted.

Your addons have not been remotely disabled. They were marked as trustworthy by a certificate that expired and thus are no longer considered trustworthy. The effect is similar, the mechanism is different. You could also enable loading of unsigned extensions, that would “fix” the issue, too.

They were effectively remotely disabled, there was a hidden dead-mans handle that's been triggered in order to effect the result; but it's logically equivalent from an end user perspective -- an external agency caused my add-ons to be disabled without my authorisation. "A certificate chain has expired, do you want to disable all add-ons?" How hard is that?

> there was a hidden dead-mans handle that's been triggered

The add-ons were signed by a certificate with an expiration date, which means that the add-ons are trusted until that certificate expires, not that they're trusted in perpetuity. It's not a hidden dead-mans hand; expiry is and has always been part of the process.

I think it's arguable that it shouldn't be part of the process, and having things like 20-year expiry satisfies the letter of the spec while being even worse than no expiry, but it's not a hidden dead-man's hand. It's how it was designed to work, and isn't considered optional.

Post reply on HN