Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 66.0.4 is out, fixes disabled add-ons

ftp.mozilla.org

Post reply on HN
Print view View original

361–370 of 392 posts

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#361

Post by [deleted] »

sam_goody wrote: post #302
f4stjack wrote: post #261

Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains: - why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) - what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies…

Chromium is definitely worse. While these deserve an explanation, you should not wait to move. Chrome is spyware that does web browsing. It's parent company also shows ads, all the time. Chrome's auto update not only allows them to silently update or change your browser, it allows them to silently install other software on your computer. Firefox is a browser. It can auto-update in a way that may be questionable, but…

[deleted]

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#362

Post by adjagu »

ComodoHacker wrote: post #253
adjagu wrote: post #161

Earlier quoted context omitted.

From an updated Firefox navigate to Preferences -> Privacy & Security -> Security -> Certificates -> View Certificates Now find: Mozilla Corporation signingca1.addons.mozilla.org Select signingca1.addons.mozilla.org and then choose export. This is what you would import into the older version of Firefox.

BTW that certificate list if fairly long, has no scrollbar and no search box. That's a bad UI. Is there a way to report this without spending hours to register at Bugzilla and file a proper bug report?

Not sure why you don't have a scrollbar. On my version of Firefox (Firefox Developer Edition 67-0b16) the certificate list does have a scroll bar and can be navigated using the mousewheel. Can't speak for stable Firefox since I don't use that version.

No, not that I am aware of. In my own experience it actually took me longer to find alternative ways of bringing awareness to a bug I was having than it did to signup to Bugzilla and report it there.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#363

Post by pbhjpbhj »

krageon wrote: post #354
pbhjpbhj wrote: post #345

Earlier quoted context omitted.

You make it sound like it's a third-party RCE; but it's a cookie bypass, so it's tracking -- that's serious still [and the implementation sounds illegal to me]. The companies Instart Manager (used by cnet, tomshardware, etc., see link) and Upmanager that are doing this workaround of ublock -- are they not able to attack other browsers, only Chromium? I guess one benefit of being the biggest advertising company is tha…

> workaround of ublock This has nothing to do with ublock origin specifically, ublock origin's author just happens to have a band-aid for this exploit. Assuming I don't misunderstand what is happening, any other blocking plugin is vulnerable as well. > people don't want to mess with Google's stuff I don't understand what you're saying. Chromium is vulnerable and by extension, so is Chrome. Edit: > You make it sound l…

>third-party code

It's third-party cookies, look like first-party cookies, isn't it? Whilst they are "code", that's misleading because it's not being executed; which is what makes it sound like an RCE.

Or did my brief scan pick up the wrong idea?

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#364

Post by pbhjpbhj »

arghwhat wrote: post #353
pbhjpbhj wrote: post #337

Earlier quoted context omitted.

Firefox by default sends all your searches to Google, and uses Google search suggestions (so sends all typed in text to Google). What other integrations, specifically please, does Chromium have with Google? Aside: do Google serve the Firefox Newtab adverts, perhaps that "feature" was added for the extra money Firefox are getting from Google?

Many things. 1. It uses Google DNS internally, bypassing system DNS. 2. First-run analytics to Google, new tab page analytics to Google. 3. Various built-in google services that phone home: Google Host Detector, Google URL Tracker, Google Cloud Messaging, Google Hotwording, Google Safe Browsing, WiveDine DRM, Google AutoFill, etc. 4. Update checks for all these components (the browser does not have update, but the re…

Cool, thanks. Do you happen to know if Brave has these issues too?

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#366

Post by lugg »

Twirrim wrote: post #247
lugg wrote: post #182

Earlier quoted context omitted.

Containers are notoriously finicky datawise. I generally keep good backups of the non standard ~/.mozilla folder to compensate. I think it was issue 339 on GitHub. They basically explain they won't add it to sync data because there is no containers on mobile. https://github.com/mozilla/multi-account-containers/issues/3...

> I think it was issue 339 on GitHub. They basically explain they won't add it to sync data because there is no containers on mobile. Makes you wonder how on earth their data sync is working with regards to mobile. Surely if it doesn't have the components to leverage the data it just wouldn't read it..?

Its possible to implement the concern was that people would leak their cookies into the default container.

They should be essentially syncing but not syncing any non default container data into mobile.

Basically they had some work to do on the server end I think.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#367

Post by lugg »

8bitsrule wrote: post #267
lugg wrote: post #182

Earlier quoted context omitted.

Containers are notoriously finicky datawise. I generally keep good backups of the non standard ~/.mozilla folder to compensate. I think it was issue 339 on GitHub. They basically explain they won't add it to sync data because there is no containers on mobile. https://github.com/mozilla/multi-account-containers/issues/3...

I too lost my multi-containers and assignments. I was just reading this (2017) discussion: https://github.com/mozilla/multi-account-containers/issues/3... and noticed mention of file 'containers.json', which I found in my current Firefox profile. It contains the descriptions of the containers I created since yesterday (for the 3rd time). So it looks as though a manual backup of that (or the whole profile, knowing its…

containers.json wasn't enough in my experience. Still went through some kind of reset due to the way the plugin initializes.

ffcontainers looks promising but couldn't get it to work (spaces in my path..) probably needs a bit of a clean up.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#368

Post by reciprocity »

Crontab wrote: post #328
sequence7 wrote: post #289

Earlier quoted context omitted.

You could just turn off all studies in Firefox. It's a simple option: https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...

That's not enough. Opt-out features are wrong because organizations/companies know that most people won't pay attention or not fully appreciate the dangers of it.

What would you propose?

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#369

Post by tripzilch »

napsterbr wrote: post #356
sequence7 wrote: post #289

Earlier quoted context omitted.

You could just turn off all studies in Firefox. It's a simple option: https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...

I did. The problem is: - I had never heard of "Studies" before; which leads to - I never agreed to be a part of Studies in the first place . The docs says it must be opted in, so supposedly I have to give consent to it. I don't remember doing so. For all my life, I've always rejected any survey, opt-in request and similar stuff. I do admit there is a small, unlikely chance that I did opt-in. Maybe I misclicked it? Ma…

> If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant.

No need to apologize. It's not really an opt-in if you are certain you would never opt in if you were aware of it, and somehow you accidentally "opted in" anyway.

I'm in the same boat, I would never opt in to any of this stuff. Now I had my "studies" setting turned off, so that's good. But when I looked at about:studies, it seems as though it had been on at some point in time (because it lists a plugin that it used for a study, or something). So I suppose that I actually opted out of this studies thing at some point, meaning it had been turned on without my consent either.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#370

Post by reciprocity »

Karunamon wrote: post #202
floatingatoll wrote: post #116

Earlier quoted context omitted.

Note that these statistics would, presumably, exclude all users who disable telemetry in Firefox. Since many of those outraged at the interruption to addons seem to overlap frequently with those who object to and disable telemetry and studies on principle, their departure over this incident could well have no impact whatsoever on the metrics you linked above. It must be a nightmare for the Firefox team to have a mino…

Who's fault is that, at the end of the day? Mozilla didn't have to structure their addon system in such a way that their (in)actions could disable the addons of every Firefox user on the planet . Mozilla did not have to abuse the studies mechanism (also on by default) to ship a workaround. Mozilla did not have to disable the option that would let me work around this problem by myself (which is going to cause me no en…

Mozilla does not "hate" its users. This comment is way too emotional and dogmatic. Firefox is not above reproach but the presentation of your message leaves a lot to be desired.
Post reply on HN