Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

921–930 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#921

Post by Doodlebobb »

gpm wrote: post #728
igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

It fixed my addons and I uninstalled and my Add on are still working.

Re: All extensions disabled due to expiration of intermediate signing cert

#922

Post by phyzome »

calcifer wrote: post #705
phyzome wrote: post #629

Earlier quoted context omitted.

Easy: There's a difference between static, shipped code and a capability to modify software at a distance (which could even by hijacked by an attacker who infiltrates Mozilla's infrastructure.)

If your threat model includes the hijacking of Mozilla's infrastructure, I assume you read and verify the entirety of the Firefox source with every new version before using it, right?

Obviously not?

But there are trustworthy people working with and integrating that code, there's a good chance they'll notice a hinky commit, and they're very close to having completely reproducible builds—which means that there can be verification that the shipped binary matches the inspected source.

https://gregoryszorc.com/blog/2018/06/20/deterministic-firef...

Re: All extensions disabled due to expiration of intermediate signing cert

#924

Post by bscphil »

Certhas wrote: post #917
bscphil wrote: post #872

Earlier quoted context omitted.

> But as far as I can see they do not have a bad track record when it comes to security/privacy. Do you have any examples of actual serious security/privacy fuck ups by Mozilla/Firefox? I mean, they are currently shipping real actual ads on the new tab page that aren't blocked by ad blockers - and possibly can't be (there are limits to what WebExtensions can modify on Firefox internal pages). Sure, maybe your parent…

Besides your claim not being true AFAIK tell [1](there are no ads on my new tab page, and as far as I can tell there was no incident of paid for content showing up on peoples new tab), how exactly would shipping ads be a privacy/security violation? This is exactly the sensationalist misrepresentation I was talking about. You don't like what they are doing, fine. Misrepresenting it as something that it's not is not fi…

Maybe you've opted out of studies or otherwise disabled Pocket? That's how they're bundling much of this new stuff in.

See: https://help.getpocket.com/article/1142-firefox-new-tab-reco... especially the part that says "From time to time, the occasional sponsored story may appear as a recommendation from Pocket. These stories will always be clearly marked, and you have control over whether they’re shown on your new tab page."

All so-called recommendations I've seen have been spammy, the sort of stuff you see linked as "other articles you may enjoy" when you disable your ad blocker on bad sites. Regardless, this directly contradicts your claim that there haven't been incidents of sponsored content on the new tab page: this is explicitly what is happening according to Pocket's own website. Mozilla themselves explicitly said they are introducing sponsored stories to the new tab page: https://blog.mozilla.org/futurereleases/2018/01/24/update-on...

I think there's a world of difference between making a search engine that sells ads the default, and selling ads yourself and inserting them into the browser's chrome. Among other issues, if I help someone install an ad blocker, that ad blocker will block ads on Google, but will not block ads in the browser chrome.

So, given this and other recent behavior by Mozilla, I have to say I don't think seeing "related stories" inserted into the browser chrome for certain web pages is at all far fetched. That should worry us.

Re: All extensions disabled due to expiration of intermediate signing cert

#925

Post by OzMerry »

midlandsfirst wrote: post #902
OzMerry wrote: post #893

Earlier quoted context omitted.

"The add-on could not be downoaded because of a connection failure." Win 10 FF 66.0.3 64-bit (Studies checked by default anyway). In Australia.

right click, download to desktop. Drag it into your firefox window. It will install then.

Thank you!

Re: All extensions disabled due to expiration of intermediate signing cert

#926

Post by OzMerry »

gpm wrote: post #728
igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Thanks to advice from @midlandsfirst, all is restored to its rightful place. Just leaves me wondering if I would've got the auto fix from Mozilla eventually if I hadn't done this myself. When I first logged on today (Monday in Australia), it still wasn't fixed.

To see all add-ons and theme disappear before my eyes with no explanation was pretty disconcerting and leads me to say that I totally disagree with Mozilla (or anyone else) having that kind of control. Bad policy (which it is) aside, though, someone dropped the ball big-time. I'm still astonished this was even allowed to happen, bad policy or not.

Re: All extensions disabled due to expiration of intermediate signing cert

#927

Post by Certhas »

bscphil wrote: post #924
Certhas wrote: post #917

Earlier quoted context omitted.

Besides your claim not being true AFAIK tell [1](there are no ads on my new tab page, and as far as I can tell there was no incident of paid for content showing up on peoples new tab), how exactly would shipping ads be a privacy/security violation? This is exactly the sensationalist misrepresentation I was talking about. You don't like what they are doing, fine. Misrepresenting it as something that it's not is not fi…

Maybe you've opted out of studies or otherwise disabled Pocket? That's how they're bundling much of this new stuff in. See: https://help.getpocket.com/article/1142-firefox-new-tab-reco... especially the part that says "From time to time, the occasional sponsored story may appear as a recommendation from Pocket. These stories will always be clearly marked, and you have control over whether they’re shown on your new ta…

I thought you were referring to the snippets.

I actually don't see the pocket recommendations on my desktop (maybe the Linux Mint build has them disabled by default), but they are there on mobile. There is a UI setting to disable them of course. It's explained right on the page that you link to.

More importantly, that page also explains that no data gets sent to Mozilla or pocket or anyone else for these ads to show up.

So again, no privacy violation here. I also think it's an extreme leap from "they show this in the new tab page which they design and control" to "they could start showing it overlayed on other peoples content".

I think they got some decisions very wrong. Among them not implementing a way to allow people to override signing of addons, which people did warn about. Having signatures enforced as a strong default is certainly good and right, but if they had included a "right click on addon, use without signature (WARNING THIS IS SKETCHY REAL ADDONS DON'T ASK YOU TO DO THIS)" option this signing issue would have been relatively mild.

But their track record on privacy/security simply isn't as bad as people make it out to be.

Re: All extensions disabled due to expiration of intermediate signing cert

#928

Post by denibertovic »

gpm wrote: post #728
igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

How do I verify that this is signed by Mozilla?

Re: All extensions disabled due to expiration of intermediate signing cert

#929

Post by botc76 »

gpm wrote: post #728
igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

I'm running Firefox 56 and installed this fix yesterday, but it does nothing for me.

Is there a way to fix this that works on older versions. Updating the browser isn't an option because I've legacy addons running that I can't work without.

Re: All extensions disabled due to expiration of intermediate signing cert

#930

Post by botc76 »

H0LL0FIED wrote: post #899
gpm wrote: post #728

Earlier quoted context omitted.

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Thank you for this, all of my add-ons were immediately re-enabled except for my selected theme. Mozilla was warned beforehand about this, this problem was completely avoidable which is upsetting. I've been a fan of this browser for years but this is the 2nd time this has happened to add-ons that I can recall and to be blunt it's unacceptable. It makes absolutely no sense that add-ons the user installs can be disabled…

Interestingly enough Greasemonkey is among the add-ons that are still running on my browser.
Post reply on HN