Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

841–850 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#841

Post by rue »

Certhas wrote: post #726
betterunix2 wrote: post #677

Earlier quoted context omitted.

At some point in the next five-ten years we will see this "feature" abused. Maybe Mozilla will use it to "soften" commonly used ad blockers to enable "acceptable" ads for Firefox users. Maybe Mozilla will be hacked by some government that wants to enable MITM attacks against its citizens, and Normandy will make that happen. Or maybe Mozilla will just cooperate with the government trying to do so. You say it is "typic…

The level of paranoia throughout this thread is truly through the roof..... Mozilla has had several "PR nightmare" decisions that a vocal set of users didn't like, and sometimes were genuinely ill advised/bad/shitty. But as far as I can see they do not have a bad track record when it comes to security/privacy. Do you have any examples of actual serious security/privacy fuck ups by Mozilla/Firefox? I mean that stood u…

…This one?

This one isn’t very privacy-friendly or open. And that raises all the previous questions again. Should they maybe have learned something about clandestinely fucking with people’s systems?

Re: All extensions disabled due to expiration of intermediate signing cert

#842

Post by gpm »

arrivance wrote: post #839
gpm wrote: post #832

Earlier quoted context omitted.

So, I don't have any good ideas why. Can you give me more information about what exactly happens? Can't promise anything but details might help. I.e. something like - I open the browser console - I click the .xpi link - The following appears in the browser console immediately after clicking the link: WebExtensions: new intermediate certificate added api.js:15 WebExtensions: signatures re-verified api.js:23 - My addon…

Thanks for the response! So, I click the link. I click "Add", and Mozilla says addon could not be downloaded due to connection failure. Nothing appears in browser console. Downloading an addon gives me "Download failed. Please check your connection." on the Addons site. In console, I get: Events to handle the installation initialized. BigInteger.js:27 [GA: OFF] sendEvent {"hitType":"event","eventCategory":"AMO Addon…

Hmm, what happens if you right click and save-link-as on the .xpi link? Or if you download it via curl or wget or something?

Edit: That studies image looks like it has already been installed, which is weird if your extensions aren't back...

Re: All extensions disabled due to expiration of intermediate signing cert

#843

Post by gpm »

gpm wrote: post #728
igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Hey ConeBone, hoping you see this here since your comment is marked as dead.

The .xpi has already fixed the problem permanently (I think). You can just leave it, or if you want you can uninstall it now just as a matter of cleanliness. I'm linking to this comment about how to uninstall because I'm not satisfied with my solution and I'm hoping someone will contribute a better one: https://news.ycombinator.com/item?id=19827428

You can see the addon in about:support, but it doesn't give you a way to uninstall it, just see that it is installed.

Re: All extensions disabled due to expiration of intermediate signing cert

#844

Post by gray_-_wolf »

gpm wrote: post #728
igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Worked for me, awesome! Now only question left is why this isn't mentioned in the blog post as fix for the no-studies people like me... Everybody put on your tinfoil hats.

Re: All extensions disabled due to expiration of intermediate signing cert

#845

Post by arrivance »

gpm wrote: post #842
arrivance wrote: post #839

Earlier quoted context omitted.

Thanks for the response! So, I click the link. I click "Add", and Mozilla says addon could not be downloaded due to connection failure. Nothing appears in browser console. Downloading an addon gives me "Download failed. Please check your connection." on the Addons site. In console, I get: Events to handle the installation initialized. BigInteger.js:27 [GA: OFF] sendEvent {"hitType":"event","eventCategory":"AMO Addon…

Hmm, what happens if you right click and save-link-as on the .xpi link? Or if you download it via curl or wget or something? Edit: That studies image looks like it has already been installed, which is weird if your extensions aren't back...

OK, so... I right clicked, saved-as and then ran the XPI... and that worked. So thank you for that suggestion.

As for the studies image, that's only half of the fix according to the blog post [1], mine is only verification-timestamp, not signing-intermediate-bug.

[1]: https://blog.mozilla.org/addons/2019/05/04/update-regarding-...

Re: All extensions disabled due to expiration of intermediate signing cert

#846

Post by gpm »

gray_-_wolf wrote: post #844
gpm wrote: post #728

Earlier quoted context omitted.

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Worked for me, awesome! Now only question left is why this isn't mentioned in the blog post as fix for the no-studies people like me... Everybody put on your tinfoil hats.

Honestly, I suspect to minimize the support load, see how many questions I got here as just a dude suggesting it unofficially that no one should really trust? It's fine at HN scale, but it's probably not fine at Mozilla scale.

They'd rather that the people who are having issues with it just wait for a new build than waste engineering time. Probably rightly so.

Re: All extensions disabled due to expiration of intermediate signing cert

#847

Post by gpm »

arrivance wrote: post #845
gpm wrote: post #842

Earlier quoted context omitted.

Hmm, what happens if you right click and save-link-as on the .xpi link? Or if you download it via curl or wget or something? Edit: That studies image looks like it has already been installed, which is weird if your extensions aren't back...

OK, so... I right clicked, saved-as and then ran the XPI... and that worked. So thank you for that suggestion. As for the studies image, that's only half of the fix according to the blog post [1], mine is only verification-timestamp, not signing-intermediate-bug. [1]: https://blog.mozilla.org/addons/2019/05/04/update-regarding-...

Glad to hear it worked.

You're right about the image, that's weird, I can't think of any reason why the verification-timestamp one would be necessary.

Re: All extensions disabled due to expiration of intermediate signing cert

#848

Post by shevegen »

gpm wrote: post #728
igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Mozilla is a spy-agency.

Why can we say this?

Simple:

https://blog.mozilla.org/addons/2019/05/04/update-regarding-...

"To provide this fix on short notice, we are using the Studies system. This system is enabled by default"

So they sniff on users, while breaking software.

For how much longer do people want to keep on trusting Mozilla?

I have said it before, I will say it again - even without Google funding Mozilla, the number one enemy to Firefox is called ... Mozilla.

It's like a movie story - The Enemy within.

Re: All extensions disabled due to expiration of intermediate signing cert

#849

Post by gpm »

igivanov wrote: post #740
gpm wrote: post #733

Earlier quoted context omitted.

Maybe you pasted it in the wrong console? You need the 'browser console' which is different from the one you open on random webpages. Go to "about:config" (in the url bar), search for and enable devtools.chrome.enabled, then hit ctrl-shift-j (or you can open it from Menu -> Web Developer -> Browser Console).

Ha! That did the trick! Though it gave me these cryptic errors the add-ons are now enabled, thanks! TypeError: setting is undefined[Learn More] ExtensionPreferencesManager.jsm:90:7 No matching message handler for the given recipient. MessageChannel.jsm:924 1556983316679 addons.xpi-utils WARN Add-on fxmonitor@mozilla.org is not correctly signed. Edit: another weirdness: i decided to take a look at a different computer…

As for your other weirdness. Signatures are only checked once every 24 hours, and it's only been 20 since the cert expired, your other computer probably just hasn't re-verified the signatures yet. You can find some comments here about how to delay it if you want.

Re: All extensions disabled due to expiration of intermediate signing cert

#850

Post by mAritz »

ApolloFortyNine wrote: post #613
Chirael wrote: post #143

Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now. Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(

The more people who use adblocker, the more ads websites need to make the same amount of money. It's been brought up that many twitch streamers don't receive ad revenue from more than half their viewers. I can only find a source right now for YouTube, but they're out there for twitch too. [1] https://www.vg247.com/2015/10/30/around-40-of-pewdiepies-aud...

To add to the specific example of twitch, their ads are broken and annoying as hell.

The broken:

- they still don't have the volume of ads under control

- the android app regularly freezes during ad display

- sometimes it disrupts and buffers the stream without then displaying the actual ad

And possibly more, I wouldn't know since all these are enough to make me either not watch twitch or block ads. I disable it once every few months to see if it got better though.

The annoying:

- the same ad every time often (when The Grand Tour started again this year, it was the only ad that ever played for me)

- most ads seem to be trailers for TV shows or movies. Most of those spoil half the story

- if you just want to see what some streamer is doing you have to watch an ad first

Twitch Prime was the only reason I still had Amazon Prime when it removed ads officially. Not anymore.

Twitch turbo was great before Twitch Prime and I had it. But now it's 9,99€ per month which I find outrageous, especially because the streamers will see very little of this money anyways, afaik.

Post reply on HN