Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical Details on the Recent Firefox Add-On Outage

hacks.mozilla.org

Post reply on HN
Print view View original

111–120 of 279 posts

Re: Technical Details on the Recent Firefox Add-On Outage

#111

Post by TazeTSchnitzel »

Wowfunhappy wrote: post #83
callahad wrote: post #58

Earlier quoted context omitted.

That's covered at https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte... , which is linked from ekr's post. I encourage you to read the rationale as a whole, but the specific question you're asking is addressed here: > Many developers have asked why we can’t make this a runtime option or preference. There is nowhere we could store that choice on the user’s machine that these greyware apps couldn’t change and…

Does Windows et al really not provide a mechinism for saving privileged settings in a tamper-resistant way? I frankly find that hard to believe. How does other software solve this problem? There are of course always workarounds on an open platform like Windows/Mac/Linux, but the threshold isn’t “impossible”, it’s just “as difficult as injecting into the browser’s code.” Edit: For example, what if the config file cont…

macOS's System Integrity Protection, aka rootless, means that, yes, macOS has a way to store settings that even root can't normally touch, though I suspect only Apple can make proper use of that right now.

But Windows? A sadder story, I think.

Re: Technical Details on the Recent Firefox Add-On Outage

#112

Post by cheeze »

jsjohnst wrote: post #110

What I don’t see mentioned anywhere is why the heck was this a last minute scramble? Don’t they know when their certificates are going to expire!?

Probably not. They probably know when most of their certs schedule but likely weren't monitoring this intermediate code signing cert (which is different than a TLS/webserver leaf/intermediate cert).

It seems super simple to do, but in practice IMO is harder than it seems. Most major cloud providers have been hit by at least one cert expiry causing an outage in the past year... Hell, likely in the past month.

This doesn't surprise me at all, certs are hard.

Re: Technical Details on the Recent Firefox Add-On Outage

#113

Post by temac »

Wowfunhappy wrote: post #83
callahad wrote: post #58

Earlier quoted context omitted.

That's covered at https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte... , which is linked from ekr's post. I encourage you to read the rationale as a whole, but the specific question you're asking is addressed here: > Many developers have asked why we can’t make this a runtime option or preference. There is nowhere we could store that choice on the user’s machine that these greyware apps couldn’t change and…

Does Windows et al really not provide a mechinism for saving privileged settings in a tamper-resistant way? I frankly find that hard to believe. How does other software solve this problem? There are of course always workarounds on an open platform like Windows/Mac/Linux, but the threshold isn’t “impossible”, it’s just “as difficult as injecting into the browser’s code.” Edit: For example, what if the config file cont…

Windows starts to have something but it is only available in last versions of Windows 10, probably not enabled by default, and the model might not be exactly what is needed anyway.

I don't even remember what it is supposed to protect against precisely -- and MS does not do a lot of communication about it. They maybe don't officially consider it a security boundary (same as UAC). Mozilla seems to be concerned about attackers having admin privileges (but that are still shy of just plainly hacking the Firefox binary or something crazy like that): quite hard to defend against that... and if you can, that means the user actually has lost some control over its own computer, which is a situation which has its own issues.

Re: Technical Details on the Recent Firefox Add-On Outage

#114

Post by Faark »

sciurus wrote: post #69
Faark wrote: post #52

> In theory, fixing a problem like this looks simple: make a new, valid certificate and republish every add-on with that certificate. Unfortunately, [..] I'd expect addon usage to follow a pareto distribution. Thus resigning the most important ones would have helped a lot of users. Why didn't they start going this route anyway? Not enough manpower for this to not diverted resources from the other more important fixes…

I think this is covered in the blog post, but I'll take another stab at explaining it from my perspective: Republishing was one of the options we were investigating early on. However, the problem is that it only fixes things once you check for and install the updated version signed with the new certificate. Firefox would still have disabled your installed version that had an expired certificate. Firefox checks for ad…

Thanks for your response.

An update being deactivated doesn't trigger an update check for said addon? Well, complexity of a graceful update attempt for a not loadable addon probably outweighs the benefit of such rare cases.

But the main reason I had a hard time with you guys discarding this path is probably addon stats like [0]. The spike in downloads made me think it could have helped at least some users. But on second thought, it might also have been caused by extensions getting re-enabled post fix. 2m downloads at 4m DAU makes me guess this was caused by something automatic.

[0] https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...

Re: Technical Details on the Recent Firefox Add-On Outage

#115

Post by callahad »

yellowapple wrote: post #96
tedunangst wrote: post #34

> For the other groups we are developing a patch to Firefox that will install the new certificate once people update. This was released as a “dot release” so people will get it — and probably have already — through the ordinary update channel. If you have a downstream build, you’ll need to wait for your build maintainer to update. Why not link to the xpi that can be installed now?

> Why not link to the xpi that can be installed now? This is the crux of my remaining frustration with how Mozilla handled this issue. That XPI should've been front-and-center in all the articles that detailed the fix. And yet, instead of something like... "If you have Studies enabled, a fix should apply automatically. If it hasn't yet, or if you have Studies turned off (or are using a version which does not support…

> The notion that this was a deliberate ploy to get more people to turn on Studies is surely conspiracy-theorist mumbo-jumbo, but nonsense like this makes me wonder.

This is not the case. Please see my response downthread: https://news.ycombinator.com/item?id=19872490

Re: Technical Details on the Recent Firefox Add-On Outage

#116

Post by silversconfused »

djsumdog wrote: post #107
silversconfused wrote: post #13

For anyone who misses the old days when a browser only did what you told it to, here is a solution: GNU icecat is a nice firefox esr fork with the mozilla call-home bits all turned off by default. It's very pleasant to use.

It doesn't have the new Quantum rendering engine though, right?

I'm pretty sure it does. https://en.wikipedia.org/wiki/Quantum_(Mozilla) says quantum shipped in 57.

Re: Technical Details on the Recent Firefox Add-On Outage

#117

Post by yellowapple »

callahad wrote: post #115
yellowapple wrote: post #96

Earlier quoted context omitted.

> Why not link to the xpi that can be installed now? This is the crux of my remaining frustration with how Mozilla handled this issue. That XPI should've been front-and-center in all the articles that detailed the fix. And yet, instead of something like... "If you have Studies enabled, a fix should apply automatically. If it hasn't yet, or if you have Studies turned off (or are using a version which does not support…

> The notion that this was a deliberate ploy to get more people to turn on Studies is surely conspiracy-theorist mumbo-jumbo, but nonsense like this makes me wonder. This is not the case. Please see my response downthread: https://news.ycombinator.com/item?id=19872490

I know full well it's not actually the case, but that doesn't make it not feel like it could be the case. It feels scummy, and I'd expect Mozilla to be above that scumminess.

Like, just link to the XPI. Not that hard. The unexplained reluctance to do so is suspicious.

Re: Technical Details on the Recent Firefox Add-On Outage

#118

Post by dave5104 »

preinheimer wrote: post #77
dave5104 wrote: post #70

Earlier quoted context omitted.

I unfortunately lost my container data (luckily I only have a couple set up). To get the fix though, I had to opt in to the Firefox studies. Apparently I had opted out at some point in the past.

Probably when they stealth installed an extension to promote Mr. Robot without telling you.

I'm a relatively recent Firefox user (within the past few months), so that was far before I switched over.

Re: Technical Details on the Recent Firefox Add-On Outage

#119

Post by yellowapple »

SECProto wrote: post #92
yellowapple wrote: post #85

Earlier quoted context omitted.

One option would've been to use Nightly and set xpinstall.signatures.required = false in about:config. That's exactly what I did.

I view using nightly to be as much of a barrier to entry that I might as well switch to a totally different browser. If the issue had lasted longer, I would have found (someone on the internet who had found) a solution like that.

I use Firefox Nightly as my primary browser on Android. It works fine. You can get it on the Play Store right alongside where you'd get non-Nightly Firefox for Android. I'd hardly call that a "barrier to entry" at all (certainly no more than there would be for, you know, normal Firefox).

Re: Technical Details on the Recent Firefox Add-On Outage

#120

Post by kbrosnan »

drtillberg wrote: post #101

The Firefox update required an administrative login in my windows system at work, which I don't have have. Normal updates haven't required that. So far I've just left it broken and it keeps prompting me for an administrative login on launch. The article doesn't explain why elevated privileges are required to apply the update.

Does the current user have rights to write to the Firefox install location? If not then elevation is required to overwrite the files.
Post reply on HN