Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical Details on the Recent Firefox Add-On Outage

hacks.mozilla.org

Post reply on HN
Print view View original

41–50 of 279 posts

Re: Technical Details on the Recent Firefox Add-On Outage

#41

Post by rst »

jzl wrote: post #11

Looks like a good read. I haven't finished reading it yet, but there's something I still don't get ... Windows and macOS both have a signing infrastructure for apps. The rules of that infrastructure dictate only that apps must have been signed by a valid certificate at the time they were signed. That way old app downloads don't need to be periodically re-signed just to account for expiring certificates. I can downloa…

I share the confusion. I can understand wanting to re-check addon validity somehow to allow for recalls on malicious addons that somehow slipped through. But I'm not sure what threat is mitigated by allowing a recheck to fail just because the clock has advanced, if all the certs were valid at the time of the installation. (Unless placing time bombs is the actual intent?)

The post did say that they'll "be looking more generally at our add-on security architecture to make sure that it’s enforcing the right security properties at the least risk of breakage". I hope they'll be looking at that point here; if they want to support explicit revocation, there may be other ways to do it which aren't quite so prone to invocation by accident (e.g., publishing a revocation list signed by certs valid at the time of revocation).

Re: Technical Details on the Recent Firefox Add-On Outage

#42

Post by jzl »

johncolanduoni wrote: post #32
jzl wrote: post #11

Looks like a good read. I haven't finished reading it yet, but there's something I still don't get ... Windows and macOS both have a signing infrastructure for apps. The rules of that infrastructure dictate only that apps must have been signed by a valid certificate at the time they were signed. That way old app downloads don't need to be periodically re-signed just to account for expiring certificates. I can downloa…

For the time stamp method to work, you need a trusted mechanism to attest that the timestamp is correct, otherwise the mechanism is useless (an attacker with an outdated private key can just backdate the timestamp in the executable and then sign it). Windows code signing uses a server Microsoft runs to provide this, and Mozilla would need to do the same. I’m not saying they shouldn’t, but it is a significant piece of…

Ahh, right. Good point. I wonder then if the current system was a deliberate choice over the timestamp method, or just deemed easier to deal with on their end.

Re: Technical Details on the Recent Firefox Add-On Outage

#43

Post by chrisseaton »

rossdavidh wrote: post #22
chrisseaton wrote: post #8

After the last PR disaster - the Mr Robot tie-in - one of the ways Mozilla tried to make it right was that they promised that the survey system would never again be used for something that was not an experiment. https://blog.mozilla.org/firefox/retrospective-looking-glass... > A SHIELD study must be designed to answer a specific question. Why have they abused it again here to deploy a hot fix, breaking their promise…

I think the reason was probably that the vast majority of Firefox users, if asked, would prefer that they did this. Not too many would say, "I am willing to participate in your study, but please don't fix my browser's add-ons if they all break". Sure, approval might not be 100%, but it would be something well north of 90%, and they probably took the right action. Given, of course, that the truly right action of not l…

> the reason was probably that the vast majority of Firefox users, if asked, would prefer that they did this

I’m sure they thought the same about the Mr Robot addon, but their judgement was wrong so this policy was put in place.

Re: Technical Details on the Recent Firefox Add-On Outage

#44

Post by silversconfused »

mlthoughts2018 wrote: post #15
chrisseaton wrote: post #8

After the last PR disaster - the Mr Robot tie-in - one of the ways Mozilla tried to make it right was that they promised that the survey system would never again be used for something that was not an experiment. https://blog.mozilla.org/firefox/retrospective-looking-glass... > A SHIELD study must be designed to answer a specific question. Why have they abused it again here to deploy a hot fix, breaking their promise…

It is indeed a huge violation of trust. I’ve seen some folks trying to explain it away and compare the Normandy preference system to standard auto-updates, acting like this is no problem if you already trust them for auto-updates. Flat wrong. This is a dark pattern by Mozilla pure & simple. It’s confusing, hard to disable fully, and clearly can be abused for non-experiment modifications to the user’s settings.

Mozilla has gone full "helicopter parent" mode, and will do whatever they can to keep you safe from yourself despite your wishes. Use GNU icecat instead. It has all that junk turned off.

Re: Technical Details on the Recent Firefox Add-On Outage

#46

Post by clucas »

chrisseaton wrote: post #8

After the last PR disaster - the Mr Robot tie-in - one of the ways Mozilla tried to make it right was that they promised that the survey system would never again be used for something that was not an experiment. https://blog.mozilla.org/firefox/retrospective-looking-glass... > A SHIELD study must be designed to answer a specific question. Why have they abused it again here to deploy a hot fix, breaking their promise…

The SHIELD policies they promulgated after that incident has to do with studies. This was not a study. This was an emergency band-aid to help as many users as possible get their browsers back to the way they (the users) chose to make them work by re-enabling their add-ons, using the fastest avenue available.

This was a user-friendly move, and while it's unfortunate that it was necessary in the first place, your criticism reads like a "gotcha."

Re: Technical Details on the Recent Firefox Add-On Outage

#47

Post by sciurus »

tedunangst wrote: post #34

> For the other groups we are developing a patch to Firefox that will install the new certificate once people update. This was released as a “dot release” so people will get it — and probably have already — through the ordinary update channel. If you have a downstream build, you’ll need to wait for your build maintainer to update. Why not link to the xpi that can be installed now?

FYI that should read "we have developed" instead of "we are developing". Firefox 66.0.4 and later have the patch.

(Disclaimer: I work for Mozilla)

Re: Technical Details on the Recent Firefox Add-On Outage

#48

Post by chrisseaton »

clucas wrote: post #46
chrisseaton wrote: post #8

After the last PR disaster - the Mr Robot tie-in - one of the ways Mozilla tried to make it right was that they promised that the survey system would never again be used for something that was not an experiment. https://blog.mozilla.org/firefox/retrospective-looking-glass... > A SHIELD study must be designed to answer a specific question. Why have they abused it again here to deploy a hot fix, breaking their promise…

The SHIELD policies they promulgated after that incident has to do with studies. This was not a study. This was an emergency band-aid to help as many users as possible get their browsers back to the way they (the users) chose to make them work by re-enabling their add-ons, using the fastest avenue available. This was a user-friendly move, and while it's unfortunate that it was necessary in the first place, your criti…

> This was not a study.

I don’t get it. Distributing something that was not a study as a study was what upset people last time. So they promised not to do it again. And they have just done it again.

Re: Technical Details on the Recent Firefox Add-On Outage

#49

Post by ziddoap »

shawnz wrote: post #33
ziddoap wrote: post #14

Earlier quoted context omitted.

Understood, and I explained a bit more of my thoughts in another comment. I understand I'm being a bit pedantic. But, as a user who is pretty concerned with a CA having a certificate issue of this scale, which affected this many people, I don't care about the authors respectful intent to their colleagues. Tell them in person, in an internal memo, whatever. It's simply not a lesson learned.

Likewise, I'm sure he cares more about keeping good working relationships with his colleagues than about what the reader thinks of his choice of paragraph order. A manager who makes his team feel insulted is not conducive to producing better software (which is presumably what you care most about here).

How is laying out, in a technical fashion, what went wrong and the lessons learned insulting his colleagues? I'm very curious.

Just because someone made a mistake, and that mistake is acknowledged, doesn't mean they are insulting them.

Also, how come it can't be done in an internal memo, email, party, pay bonus, raises, etc.?

Re: Technical Details on the Recent Firefox Add-On Outage

#50

Post by clucas »

chrisseaton wrote: post #48
clucas wrote: post #46

Earlier quoted context omitted.

The SHIELD policies they promulgated after that incident has to do with studies. This was not a study. This was an emergency band-aid to help as many users as possible get their browsers back to the way they (the users) chose to make them work by re-enabling their add-ons, using the fastest avenue available. This was a user-friendly move, and while it's unfortunate that it was necessary in the first place, your criti…

> This was not a study. I don’t get it. Distributing something that was not a study as a study was what upset people last time. So they promised not to do it again. And they have just done it again.

Perhaps people were upset last time because it was for commercial purposes, rather than as an emergency fix to help people to get their browser working.
Post reply on HN