Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Update Regarding Add-Ons in Firefox

blog.mozilla.org

Post reply on HN
Print view View original

241–250 of 504 posts

Re: Update Regarding Add-Ons in Firefox

#241

Post by Xylakant »

rauhl wrote: post #87
wool_gather wrote: post #81

Earlier quoted context omitted.

This is not entirely accurate. Nothing was done remotely to disable the add-ons. It happened locally. A certificate that's on your machine as part of the Firefox install expired. When that happened, add-ons that were signed via a cert chain that included the expired one started appearing to be invalidly signed . And that's why it requires an update to completely fix. That part is remote, because they need to push a n…

Clearly, downstream distributors need to create a patch which causes their distributes Firefox builds to only check certificates on add-on installation (and to check revocations too, sure): it should never be possible for a browser to fail into an unsafe configuration.

Cert expiration is the only safe revocation. You cannot rely on revocation lists in many settings. Access to them might be maliciously blocked or, if locally kept, tampered with. The list could for example be replaced with an older one, which would circumvent signing the list unless the signature contains an expiration date and then you’re back to “oh, list expired, how do we fail?”

You cannot rely on check at extension install. That would assume that all malicious extensions are installed via FF proper. Oracles crapware bundling in the Java installer taught us that’s now how things go. You cannot remember the trust flag when an extension is installed via FF as a crapware installer could just set the trust flag, too. After all, that storage would be accessible, too. You cannot sign or encrypt that trust storage as the key material would have to be kept locally and would be accessible to the crapware installer.

Re: Update Regarding Add-Ons in Firefox

#242

Post by DannyBee »

pcwalton wrote: post #91
Grollicus wrote: post #14

I'm interested in the general writeup what went wrong that they missed this certificate expiring. That's a structural problem. Also why it took 6 hrs to assign P1 to the bug

> Also why it took 6 hrs to assign P1 to the bug Because people were staying up until the wee hours of the morning working on fixing it instead of toggling priorities in Bugzilla. This was treated as a five-alarm fire.

The normal practice would be to have someone operating as an incident communication manager who would be taking care of status/things like this.

Saying "we were too busy fixing to communicate" is actually a really bad sign, because it's not just about what you are communicating to the outside world, but also, for example, about making sure people that need to be brought in are getting consistent information.

Re: Update Regarding Add-Ons in Firefox

#243

Post by watermelon0 »

IMHO it seems problematic, that they can remotely push code changes, including replacement of trusted certificate, and bypass package managers.

I don't expect software to (significantly?) change during runtime, outside of what was packaged, signed, distributed and installed as part of apt/yum/pacman/etc.

I understand (not that I like or agree with) that some apps are just embedded web browsers, and load everything externally, and that Firefox extensions are in the end just some JS/CSS/HTML loaded outside of system's package manager. However, extensions have limited API they can interact with, and you need to allow permissions for each extension. Having Mozilla owned extension, that can modify core functionality, seems a bit scary.

Re: Update Regarding Add-Ons in Firefox

#244

Post by Twirrim »

rhizome wrote: post #143
JamesMcGill wrote: post #44

Earlier quoted context omitted.

This is one of the things about this whole episode that I find baffling. Stuff like adjusting bug priorities and arranging for someone to tweet an announcement is the work of a good engineering manager. This is the right person to run interference and handle comms and deal with things outside of the critical path, like bugzilla updates.

Stuff like adjusting bug priorities and arranging for someone to tweet an announcement is the work of a good engineering manager So we can come to the obvious conclusion about Mozilla, then? No good "engineering" managers? Miss one reprioritization and you're out! This is what sane people think?

At no stage did the parent post state there are no good engineering managers at Mozilla. They just said that adjusting bug priorities is the work of a good engineering manager. There's a world of difference.

If you want to complain about knee-jerk overreactions, I think you might want to look in the mirror first.

Re: Update Regarding Add-Ons in Firefox

#245

Post by MichaelBravo »

admax88q wrote: post #199
morpheuskafka wrote: post #178

Earlier quoted context omitted.

As I understand it, you agree to the terms of Studies as part of the ToS agreed to on installation. You can disable it later. And--while it was a ridiculous mistake--they didn't make any "unauthorized changes" to your computer. They just let a certificate expire and your computer, running the same code it always had, stopped trusting it.

Hiding behind ToS is ridiculous. Nobody reads them and a moral company should never assume that because its in the ToS they actually have informed consent.

TOS agreements should be illegal in the US, especially those that try to circumvent our 'Freedoms of Speech'.

Re: Update Regarding Add-Ons in Firefox

#246

Post by yawaramin »

Vinnl wrote: post #233
overgard wrote: post #167

Earlier quoted context omitted.

Not saying that their current actions are wrong , just that the optics of it are terrible for them. There was a chain of bad decisions that led them here though: 1) thinking it's ok to disable software after its installed (using cert expiration -- I'm ok if the cert was revoked but that's a totally different discussion), 2) Taking more control of people's local software than many people are comfortable with, especial…

> their main market is tech savvy people that tend to be more sensitive to this than most Is that so, though? Firefox is still being used by millions of users, and I doubt those are only the tech savvy internet users. (Then again, this mostly applies to Firefox users using add-ons, which probably has a higher share of technical users.)

One of their biggest 'selling points' is that they protect your privacy. It's really, really off brand for them to be distributing a critical bugfix through a telemetry collection channel.

Re: Update Regarding Add-Ons in Firefox

#247

Post by the8472 »

Mindless2112 wrote: post #232
the8472 wrote: post #221

Earlier quoted context omitted.

Those still would have their certificates checked on installation. And honestly, I think it is security theater to attempt to defend against attackers on the same or higher privilege level. If microsoft wants to force something down your throat on windows then there's not much you can do. The problem is that mozilla turns the failures of others into their own problem and then they try to fix it themselves. That scope…

> Those still would have their certificates checked on installation. How? These extensions were not being installed through the normal mechanism. The malicious extension installer will just set the flag that says "this extension has been verified". > And honestly, I think it is security theater to attempt to defend against attackers on the same or higher privilege level. I understand that, and Mozilla does too: "By b…

But that's the point. Either the installer does something malicious or it doesn't. If it does you lost the game. If it doesn't then a simple check is sufficient. Everything else is security theater which makes life worse for everyone.

Also, they could still run the verification and prompt the user instead of just forcing the decision.

Re: Update Regarding Add-Ons in Firefox

#248

Post by overgard »

Vinnl wrote: post #233
overgard wrote: post #167

Earlier quoted context omitted.

Not saying that their current actions are wrong , just that the optics of it are terrible for them. There was a chain of bad decisions that led them here though: 1) thinking it's ok to disable software after its installed (using cert expiration -- I'm ok if the cert was revoked but that's a totally different discussion), 2) Taking more control of people's local software than many people are comfortable with, especial…

> their main market is tech savvy people that tend to be more sensitive to this than most Is that so, though? Firefox is still being used by millions of users, and I doubt those are only the tech savvy internet users. (Then again, this mostly applies to Firefox users using add-ons, which probably has a higher share of technical users.)

I might be wrong, I don't have data, but, as far as I can tell most users either use the installed browser or chrome (or whatever their tech savvy friends/relatives install for them).

Re: Update Regarding Add-Ons in Firefox

#249

Post by c64ec30650ea3c4 »

I'm shocked and suprised to find out that mozilla is using EXPIRING certificates for this. It requires them to continuously take action to prevent all addons from breaking, which will eventually fail (like it did).

Firefox has a pretty robust update system and everyone is used to frequent updates. Why don't they instead have a revocation system built into updates? That way they would have to take action to disable malicious addons, and the good ones could go on working forever.

Is there something about this idea that is so much worse than what happened today?

Post reply on HN