Earlier quoted context omitted.
Then you're not affected. What's the matter?
That means: the installation is a while old, installation security is not useful now because the add-ons were installed ages ago, but using them is.
Precisely.
Firefox 66.0.4 is out, fixes disabled add-ons
301–310 of 392 posts
Re: Firefox 66.0.4 is out, fixes disabled add-ons
#302Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains: - why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) - what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies…
Chromium is definitely worse.
While these deserve an explanation, you should not wait to move.
Chrome is spyware that does web browsing. It's parent company also shows ads, all the time.
Chrome's auto update not only allows them to silently update or change your browser, it allows them to silently install other software on your computer.
Firefox is a browser. It can auto-update in a way that may be questionable, but it also has a lot of cranky devs looking over their shoulder to call them out years later because Mr. Robot may have been able to show them an ad. FF deserves to be called out on their mistakes, and need offer an explanation. But perspective!
Why would you not move now?
Re: Firefox 66.0.4 is out, fixes disabled add-ons
#303No release for android yet, at least not on [1], where I am getting the apk files from. As of now, latest release uploaded there is 66.0.2 from March. [1]: https://archive.mozilla.org/pub/mobile/releases/ EDIT it's up: https://archive.mozilla.org/pub/mobile/releases/66.0.4/
xpinstall.signatures.required = false worked for me on android
This did NOT work for me with the Windows version.
Had to install that .xpi from the previous HN thread on the subject.
Re: Firefox 66.0.4 is out, fixes disabled add-ons
#304Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains: - why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) - what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies…
> why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) I came here to mention exactly this. I don't mind the certificate issue (as long as there is a post mortem and they learn something from it). I was wondering how my addons came back automatically (without me having to upgrade to 66.0.4) and I found out about this studies thing, which I never consented…
>I don't mind the certificate issue
For me, it's the other way around.
They should have forseen the certificate issues and never implemented the system as it is, i.e. disabling addons that have been installed with a valid cert. At most there should be a warning. Addons are losing their configuration because of this and we have yet to see how they fix old FF versions. All of this indicates a total lack of foresight.
However, I see the value in having studies enabled and being able to test features and fixes with certain hardware configurations. Almost every software does it, because it's very useful. Maybe Mozilla, being an advocate for privacy, should be more transparent about it though.
Re: Firefox 66.0.4 is out, fixes disabled add-ons
#305Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains: - why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) - what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies…
Chromium has a working exploit (AFAIK it still is not patched) that allows third-party code to masquerade as first-party code. Unless you run a special addon[1], you are vulnerable to this.
The fact that I still can't find that it's patched now tells me nothing good about the health of the ecosystem and who it is meant to serve. That should be all the reason you need to switch to Firefox, which admittedly also has huge warts but to my mind ones that aren't quite so egregious.
[1] https://chrome.google.com/webstore/detail/ublock-origin-extr...
Re: Firefox 66.0.4 is out, fixes disabled add-ons
#306studies, normandy, looking glass, forced signing of addons... Mozilla is giving away a lot of good-will lately. Still my favorite browser, but I don't like the general direction. Privacy should always default to true.
I hope for Mozilla to find a source of income that isn't Google, because they did a lot for the web. Let us just hope they don't need to make too many compromises.
Re: Firefox 66.0.4 is out, fixes disabled add-ons
#307Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains: - why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) - what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies…
Chromium has a working exploit (AFAIK it still is not patched) that allows third-party code to masquerade as first-party code. Unless you run a special addon[1], you are vulnerable to this. The fact that I still can't find that it's patched now tells me nothing good about the health of the ecosystem and who it is meant to serve. That should be all the reason you need to switch to Firefox, which admittedly also has hu…
Wow this is... scary and you say it is still not patched? Thank you.
Re: Firefox 66.0.4 is out, fixes disabled add-ons
#308Earlier quoted context omitted.
> why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) I came here to mention exactly this. I don't mind the certificate issue (as long as there is a post mortem and they learn something from it). I was wondering how my addons came back automatically (without me having to upgrade to 66.0.4) and I found out about this studies thing, which I never consented…
You could just turn off all studies in Firefox. It's a simple option: https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...
I'm a privacy conscious person so I disabled all spyware that Firefox included. But I went to check, studies was enabled, probably because it was included and enabled by default in the last years and I didn't notice. So how long until Firefox adds something else to have remote code execution rights on my machine?
Re: Firefox 66.0.4 is out, fixes disabled add-ons
#309I'm really worried about the average users not knowing what happened here. At least an email should be sent informing about the issue. But I guess many of those average users don't have a single extension installed, no problems for them.
Why would Mozilla have my/average users email-address?
Re: Firefox 66.0.4 is out, fixes disabled add-ons
#310Our extension sets https://www.givero.com as the default search engine. After the extension got disabled and re-enabled, searches now default to Google. So this fix is not complete. Our efforts in getting Firefox users to install our extension has been in vain. "Luckily" we didn't have many users yet but imagine the amount of money this will cost bigger search engines like DDG, Qwant, etc.
Can't you do the switch on the next extension update, for instance?