Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical Details on the Recent Firefox Add-On Outage

hacks.mozilla.org

Post reply on HN
Print view View original

161–170 of 279 posts

Re: Technical Details on the Recent Firefox Add-On Outage

#161

Post by SECProto »

kgwxd wrote: post #139
SECProto wrote: post #92

Earlier quoted context omitted.

I view using nightly to be as much of a barrier to entry that I might as well switch to a totally different browser. If the issue had lasted longer, I would have found (someone on the internet who had found) a solution like that.

On Android, you already had the xpinstall.signatures.required option without having to install nightly. Linux too. Took me maybe 30 second to fix all my devices.

This is the first I heard of that solution, and we're what, 5 or 6 days from the issue? I read a number of Reddit posts and the Mozilla blog post and I don't recall seeing this mentioned.

Edit: on second thought, maybe I saw this solution (with or without the mention of nightly) and skipped over it as the Mozilla blog post on May 4th said "There are a number of work-arounds being discussed in the community. These are not recommended as they may conflict with fixes we are deploying."

Re: Technical Details on the Recent Firefox Add-On Outage

#162

Post by kwccoin »

Do they follow basic PKI best practice. Do they actually know (not after the fact) the certification path validation algorithm. It shall be auto.

Is Firefox use the normal PKI authentication mechanism. Their reaction is like this is a surprise and even signing intermediate cert as the first step and instead of talking about bypass or hack the whole PKI trust chain.

Based on some of the comments here, I think one has to understand that it is not just timestamp and validity. The checking of PKI is per transaction and on a continuous basis. It is NOT just based on signing but also based on CRL (cert. revocation list) which is also key.

I read the blog a few time. I feel frightened not enlightened. It seems they are not on the ball. A minor mistake (forget to renewal cert. like O2 (not sure but heard same issue)) gave a lot of lights on issues.

Do they have CPS even ... :-) or :-(((

Re: Technical Details on the Recent Firefox Add-On Outage

#163

Post by lysp »

floatingatoll wrote: post #158
throw7 wrote: post #126

i lost all my custom multi-account containers after getting a version that has the cert fixes (firefox is still broken on fedora; i had to download the testing version today to get it back working). either today's engineers are sub-standard or the foxes rule the henhouse.

If you disable the addon, restart Firefox, and enable the addon, do your custom containers get erased again?

It's my understand that they'd be deleted.

Current bug for issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1549204

This was discovered after the expiring caused a similar process to kill data.

Re: Technical Details on the Recent Firefox Add-On Outage

#164

Post by yellowapple »

kgwxd wrote: post #139
SECProto wrote: post #92

Earlier quoted context omitted.

I view using nightly to be as much of a barrier to entry that I might as well switch to a totally different browser. If the issue had lasted longer, I would have found (someone on the internet who had found) a solution like that.

On Android, you already had the xpinstall.signatures.required option without having to install nightly. Linux too. Took me maybe 30 second to fix all my devices.

Huh, never knew that. I wonder if that's because it's harder for Android apps to edit the settings of other Android apps (unless they have root access, but that's much more rare on Android than, say, Windows or Linux or macOS)?

Mozilla's official Linux builds disallow xpinstall.signature.required = false (last I checked), but the unbranded builds (as well as builds provided by at least some repos) do indeed allow signature bypassing.

Re: Technical Details on the Recent Firefox Add-On Outage

#165

Post by c0vfefe »

tedunangst wrote: post #93
Someone1234 wrote: post #74

Earlier quoted context omitted.

What are you after? This clearly says they screwed up and that internal procedures need to be changed so it cannot recur. If this was in fact an oversight/accident, what other kind of explanation can they give? > This was due to an error on our end: we let one of the certificates used to sign add-ons expire And: > We clearly need to adjust our processes both to make this and similar incidents it less likely to happen…

Well, they could tell us what the previous process was. Was the cert renewer on vacation, or was the wrong date entered on the calendar, or? How was it supposed to work? I think a lot of people are curious about that.

It's understandable to be curious about that, I am myself. But I don't think they owe us that. It might be sensitive information, anyway.

Re: Technical Details on the Recent Firefox Add-On Outage

#166

Post by michaelmrose »

SECProto wrote: post #129
yellowapple wrote: post #119

Earlier quoted context omitted.

I use Firefox Nightly as my primary browser on Android. It works fine. You can get it on the Play Store right alongside where you'd get non-Nightly Firefox for Android. I'd hardly call that a "barrier to entry" at all (certainly no more than there would be for, you know, normal Firefox).

> I'd hardly call that a "barrier to entry" at all Would I have to sign in to sync again to access my bookmarks, logins, etc? Are there ever issues with syncing between phone and computer (nightly to stable) or would I have to change my desktop browser as well? Does anything ever break at all? Even if the answer to these questions is "no", the fact that I'm asking them is the barrier to entry. And if any of the answe…

You do need to sign in to Firefox sync on each version if you install both as 2 unique applications on Android don't share each other's data.

On desktop front there is no problem connecting current and nightly to the same sync account and indeed same profile directly.

The sole annoying thing about nightly is that it naturally updates frequently. It's quite stable and gets legitimately useful features faster and let's you disable signing and run locally built add-ons. I use it as my primary browser on Android and Linux.

Re: Technical Details on the Recent Firefox Add-On Outage

#167

Post by yellowapple »

SECProto wrote: post #129
yellowapple wrote: post #119

Earlier quoted context omitted.

I use Firefox Nightly as my primary browser on Android. It works fine. You can get it on the Play Store right alongside where you'd get non-Nightly Firefox for Android. I'd hardly call that a "barrier to entry" at all (certainly no more than there would be for, you know, normal Firefox).

> I'd hardly call that a "barrier to entry" at all Would I have to sign in to sync again to access my bookmarks, logins, etc? Are there ever issues with syncing between phone and computer (nightly to stable) or would I have to change my desktop browser as well? Does anything ever break at all? Even if the answer to these questions is "no", the fact that I'm asking them is the barrier to entry. And if any of the answe…

> Even if the answer to these questions is "no", the fact that I'm asking them is the barrier to entry.

Fair enough. The answers, for the record, are indeed "yes" (but that takes, what, 30 seconds?), "no", and (at least not severely) "no".

But apparently even non-Nightly Firefox for Android supports xpinstall.signatures.required = false, which is even less of a barrier to entry, so that's good news, I guess. While I understand Mozilla's reasoning for not wanting a bunch of people to set this and forget about it, it's a bit ridiculous that not once did they mention it aside from a "don't do this thing that we're not going to specify because it's a hack" (of course it's a hack, and it's one that got me up and running again long before there was even a fix via Studies).

Re: Technical Details on the Recent Firefox Add-On Outage

#168

Post by cyphar »

drtillberg wrote: post #148
Someone1234 wrote: post #75

Earlier quoted context omitted.

Agreed. My initial reaction when Let's Encrypt had you re-issue every 90 days was negative, but I was wrong. Very wrong. A 90 day re-issue forces you to have working re-issue infrastructure and procedures, and therefore you're less likely to get stung by an accidental expiration. Long expirations are a trap, a very easy trap to fall into.

Why not update long-duration keys every 90 days? That way you're never close to expiration, ever, best of both worlds.

Because if you make it optional then nobody does it (except you) and then you're back to square one. By mandating a 90-day expiry, LetsEncrypt forced people to automate the process -- and everyone is on the same page.

It should be noted that most LetsEncrypt tools will renew a certificate when it is 30 days from expiry, so if you run the renew script every week (or day) you're also never close to expiry.

Re: Technical Details on the Recent Firefox Add-On Outage

#169

Post by hcs »

kbrosnan wrote: post #120
drtillberg wrote: post #101

The Firefox update required an administrative login in my windows system at work, which I don't have have. Normal updates haven't required that. So far I've just left it broken and it keeps prompting me for an administrative login on launch. The article doesn't explain why elevated privileges are required to apply the update.

Does the current user have rights to write to the Firefox install location? If not then elevation is required to overwrite the files.

The current user may not need to have those rights if the maintenance service is installed, which allows the updater to run with higher privileges. I don't know of any reason why the recent updates would be any different, though. There may be an unrelated issue that broke "silent" updates for drtillberg.

(I work on the Firefox updater and am a Mozilla employee)

Post reply on HN