Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

871–880 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#871

Post by bscphil »

robolange wrote: post #631
neilv wrote: post #604

Earlier quoted context omitted.

I've been through all of Firefox `about:config` a few times in the past, fixing preferences to, e.g., try to disable umpteen different services that leak info or create potential vulnerabilities gratuitously, but this is the first I recall hearing of Normandy. Apparently I missed `app.normandy.enabled`, because I think I would've remembered a name with connotations of a bloody massive surprise attack. Incidentally, `…

I too use Debian's Firefox ESR. I noticed the "Allow Firefox to install and run studies" option in Privacy & Security Preferences a long time ago. It was unchecked and greyed out (i.e., unclickable), and a label below it says "Data reporting is disabled for this build configuration", so I gave it no further thought. This morning I woke up and launched Firefox, noticed this headline, and then noticed my extensions wer…

Thank you for reporting it. Debian's pro-user stance is one of the things I like about it... now tell me they've disabled Pocket too and I might just switch from Arch to Debian Sid.

FYI, I have learned from other user's comments and the Wiki page below that Studies and Normandy are different things. The former depends on the latter, but not vice versa. So it is possible that Debian disabled the studies program but did not disable the underlying Normandy tool. You might also want to look at whether firefox is affected in addition to firefox-esr.

https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout#...

Re: All extensions disabled due to expiration of intermediate signing cert

#872

Post by bscphil »

Certhas wrote: post #726
betterunix2 wrote: post #677

Earlier quoted context omitted.

At some point in the next five-ten years we will see this "feature" abused. Maybe Mozilla will use it to "soften" commonly used ad blockers to enable "acceptable" ads for Firefox users. Maybe Mozilla will be hacked by some government that wants to enable MITM attacks against its citizens, and Normandy will make that happen. Or maybe Mozilla will just cooperate with the government trying to do so. You say it is "typic…

The level of paranoia throughout this thread is truly through the roof..... Mozilla has had several "PR nightmare" decisions that a vocal set of users didn't like, and sometimes were genuinely ill advised/bad/shitty. But as far as I can see they do not have a bad track record when it comes to security/privacy. Do you have any examples of actual serious security/privacy fuck ups by Mozilla/Firefox? I mean that stood u…

> But as far as I can see they do not have a bad track record when it comes to security/privacy. Do you have any examples of actual serious security/privacy fuck ups by Mozilla/Firefox?

I mean, they are currently shipping real actual ads on the new tab page that aren't blocked by ad blockers - and possibly can't be (there are limits to what WebExtensions can modify on Firefox internal pages). Sure, maybe your parent comment was exaggerating a little bit, but what if Mozilla instead starts inserting "privacy-friendly" "recommendations" into webpages in order to "enhance users' browsing experiences"? That doesn't sound at all far-fetched for the Mozilla we know today.

Re: All extensions disabled due to expiration of intermediate signing cert

#873

Post by abrowne »

floatingatoll wrote: post #745
abrowne wrote: post #586

Earlier quoted context omitted.

FWIW I started using beta, nightly and the old "UX" channel, first on Mac and then on Linux, and before I knew it could be a problem I switched between them with the same profile all the time. Maybe there were subtle bugs I wasn't aware of, but nothing I ever noticed.

I haven’t run into any issues in a while, but you only have to get hit by lightning one time to lose your profile data. Best to be consciously careful about it.

I do agree, and I'm more careful now. Always keep a backup, at the very least. I now symlink ~/bin/firefox to nightly because some apps seem to have it hardcoded to open "firefox" rather than what's set as default.

Re: All extensions disabled due to expiration of intermediate signing cert

#874

Post by QQ00 »

gpm wrote: post #843
gpm wrote: post #728

Earlier quoted context omitted.

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Hey ConeBone, hoping you see this here since your comment is marked as dead. The .xpi has already fixed the problem permanently (I think). You can just leave it, or if you want you can uninstall it now just as a matter of cleanliness. I'm linking to this comment about how to uninstall because I'm not satisfied with my solution and I'm hoping someone will contribute a better one: https://news.ycombinator.com/item?id=1…

>You can see the addon in about:support, but it doesn't give you a way to uninstall it, just see that it is installed.

you can uninstall it from about:studies

Re: All extensions disabled due to expiration of intermediate signing cert

#875

Post by mfo4321 »

Certhas wrote: post #726
betterunix2 wrote: post #677

Earlier quoted context omitted.

At some point in the next five-ten years we will see this "feature" abused. Maybe Mozilla will use it to "soften" commonly used ad blockers to enable "acceptable" ads for Firefox users. Maybe Mozilla will be hacked by some government that wants to enable MITM attacks against its citizens, and Normandy will make that happen. Or maybe Mozilla will just cooperate with the government trying to do so. You say it is "typic…

The level of paranoia throughout this thread is truly through the roof..... Mozilla has had several "PR nightmare" decisions that a vocal set of users didn't like, and sometimes were genuinely ill advised/bad/shitty. But as far as I can see they do not have a bad track record when it comes to security/privacy. Do you have any examples of actual serious security/privacy fuck ups by Mozilla/Firefox? I mean that stood u…

you call it paranoia, I call it healthy skepticism

mozilla should and does know better

your inane ramblings aside, firefox has a focus and this is right in it

Re: All extensions disabled due to expiration of intermediate signing cert

#876

Post by daveFNbuck »

johnchristopher wrote: post #387
daveFNbuck wrote: post #265

Earlier quoted context omitted.

What's bad about supporting a site you like while learning about something that interests you? If this were really all ads were I wouldn't block them.

That's not what the post says at all.

The person who I am responding to said the following describes something bad:

> either it takes me half a second to tell I'm not interested in an ad, or I actually am interested and i follow the ad because I am interested and I want to support the website

The second half of that sentence is precisely what I'm describing. Do you disagree with my characterization of that sentence?

I assume they included that part in the quote rather than cutting it off earlier because this was part of what they were saying is bad. Do you disagree with me there?

Re: All extensions disabled due to expiration of intermediate signing cert

#877

Post by Skittlez »

gpm wrote: post #870
YLuminary wrote: post #861

Earlier quoted context omitted.

I'm running 58.0.2. (i thought I read somewhere that this should work from 57 on.) When I turn on Studies, and do about:studies, I see: "What's this? Firefox may install and run studies from time to time. Learn more" Is this what I'm supposed to be seeing?

Hey, I think so (but I didn't go that route), now you either need to wait or use one of the tricks to cause it to update right away. If I was you I would ignore Mozilla's advice to do it their way and do what I suggested above, of just clicking on the .xpi link and disabling shield studies. It will act immediately, which will give you a better idea of whether or not it will actually work with 58.0.2. I'm not sure it…

I'm on 66.0.3 and it worked for me. All my addons worked. I removed the study from about:studies and everything is fine.

Re: All extensions disabled due to expiration of intermediate signing cert

#878

Post by BlackPlatypus »

BlackPlatypus wrote: post #865
gpm wrote: post #863

Earlier quoted context omitted.

Hey, so if you're going to do this, you're porting the wrong code. My code (which you ported) will need to be rerun every 24h to reset the signing state (assuming old firefox works like new firefox, it probably does). You should figure out how to make the following code (pulled from the .xpi mozilla created) work in firefox 56's browser console instead: /* eslint no-unused-vars: ["error", { "varsIgnorePattern": "skel…

Oh, thank you for the pointer in the right direction! In the mean time, I was just glad to have any way to use my browser again!

In the mean time, installing the hotfix extension and running the script seems to help :)

Re: All extensions disabled due to expiration of intermediate signing cert

#879

Post by XORcat »

DoctorOetker wrote: post #763
XORcat wrote: post #592

Earlier quoted context omitted.

JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_sign... hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... From the looks, it installs the above plugin, and changes `app.update.lastUpdateTime.xpi-signature-verification` to `1556945257` I can't get it to work in ESR 60 though. Getting file not found on…

Thanks for the sleuthing, but who does this repository belong to? I'd like to apply it but only if mozilla provides such instruction on their issue page, I don't know who the actual owner of /moz-fx-normandy-prod-addons/ is... https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... Can mozilla please verify, confirm authenticity, and list this instruction on their issue page?

I would have the same question if I didn't see the response come back from https://normandy.cdn.mozilla.net/ myself.

I encourage you to go through the whole Normandy process yourself in a test environment, and even better (if possible), check out the code to see whether it looks legit or benign.

I'm happy, because I went through and checked it out myself without needing to enable Normandy on my actual Firefox, but ultimately, it will be great when Moz can get instructions for manually applying the fix out.

Re: All extensions disabled due to expiration of intermediate signing cert

#880

Post by conanbatt »

feanaro wrote: post #627
conanbatt wrote: post #584

Earlier quoted context omitted.

There is a before and after with adblockers. Its a real pity they are the worst privacy-vioolating tools ever.

> Its a real pity they are the worst privacy-vioolating tools ever. What do you mean?

They read your entire page content, they have access to all your information.
Post reply on HN