261–270 of 279 posts
Earlier quoted context omitted.
You should give Brave a shot. Seriously, every time I open Chrome on my phone on accident, I'm horrified at what the internet has become..
Why? I use firefox+uBlock on my phone, and don't have chrome installed on any devices.
Earlier quoted context omitted.
> I find the argument that it's impossible to make this configurable because malware could then circumvent it very weak. If we're talking about that level of interference, anyone with access to the Firefox executable could in theory replace it, and given the open source nature of the Firefox codebase this wouldn't be particularly difficult technically for anyone willing to go to such lengths in the first place. As me…
In reality the issue of Fortune 500 companies attacking users and hacking their computers should be addressed legally too. Are Mozilla currently helping any organisations to sue these companies? Is there more detailed evidence provided on this somewhere? Like which companies and exactly what they did?
Earlier quoted context omitted.
> I find the argument that it's impossible to make this configurable because malware could then circumvent it very weak. If we're talking about that level of interference, anyone with access to the Firefox executable could in theory replace it, and given the open source nature of the Firefox codebase this wouldn't be particularly difficult technically for anyone willing to go to such lengths in the first place. As me…
I think that would be categorised as an option "that these greyware apps [could] change and plausibly claim they were acting on behalf of the user’s “choice” not to opt-out of the light grey checkbox on page 43 of their EULA". Sorry, but I don't really see how. We've been using click-to-play safeguards on embedded content for years, and they have proved highly effective at stopping abusive or outright malicious conte…
But other software on the user's computer wasn't trying to work around those safeguards. That's the main attack vector, as I understand it.
> That malicious sites are actively compromising user privacy is also not a risk, it is a certainty.
Absolutely, and as far as I'm aware that's also something that Mozilla's actively taking measures against.
> That addons to block unwanted content have stopped malware from exploiting browser vulnerabilities and infecting user systems is also not a risk, it is a certainty.
Sure, in hindsight it is, but I wouldn't have predicted a week ago that it was about to happen, and as far as Mozilla is able to predict future occurrences they are taking measures against it as well.
Earlier quoted context omitted.
Why? I use firefox+uBlock on my phone, and don't have chrome installed on any devices.
Because, at least on Android, it's an order of magnitude faster. No extensions needed. I do look forward to Fenix, it's -very- nice, but not stable enough for me to drive it just yet.
I have no issues whatsoever with the speed of Firefox on mobile. I also prefer to support a non-chromium browser.
Earlier quoted context omitted.
Only one certificate was used for all add-ons, its expiration disabled all signed. No “certain add-ons” it was “all.”
Per the article, there is a separate "end-entity" certificate for each add-on. They were all signed by the same "intermediate" CA, however.
And the expiration of that "intermediate" obviously should have not made already accepted add-ons stop working, in this specific use-case. It's not about establishing a new trusted communication channel for a new content, it's not about disabling some specific add-on.
Thinking logically, that was not the role of that immediate certificate.
So the behavior was clearly designed wrong, because completely wrong analogy was used -- that of creating a connection, where expired intermediate certificate should prevent the new connection, which could an transfer a new attack if not verified. Here the verification already happened, and the "ban" of a specific set of add-ons was also clearly not a case.
Additionally it seems the handling of the update of the expired intermediate was not the topic of the design at all.
Looks like a good read. I haven't finished reading it yet, but there's something I still don't get ... Windows and macOS both have a signing infrastructure for apps. The rules of that infrastructure dictate only that apps must have been signed by a valid certificate at the time they were signed. That way old app downloads don't need to be periodically re-signed just to account for expiring certificates. I can downloa…
One small note on your mention of MacOS, and I don't know if this has been fixed. A couple of years ago, the certificates expired on some versions of the OS installer, like El Capitan and could no longer be verified. While there's the simple workaround of changing the clock, it did give me pause when trying to get an old Mac upgraded to the latest supported operating system.
Considering Mozilla's certificate failure, Apple's cert failure, and the number of websites I encounter that have forgotten to renew their certificates, it seems like a broken system. Or a really effective form of DRM, I'm not sure which.
Earlier quoted context omitted.
I chose to run apt-get to install packages. I have never opted-in to, nor even known about, how Firefox was running "studies" on me before this event. It's like finding out the TV you bought last year has a hidden camera and it's been recording you the whole time.
It's not really fair to call it "studies" in quotations. It's better described as software micro-updates which can be progressively deployed in case the change has a regression. They do little more than enable/disable features already shipped in the binary you're running. In my own browser, if I go to about:studies, I have two Studies running. One is the hotfix for the add-on signing issue. The other is: prefflip-pus…
(Disclosure: I work for Mozilla)
Earlier quoted context omitted.
That's covered at https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte... , which is linked from ekr's post. I encourage you to read the rationale as a whole, but the specific question you're asking is addressed here: > Many developers have asked why we can’t make this a runtime option or preference. There is nowhere we could store that choice on the user’s machine that these greyware apps couldn’t change and…
>or take the blatant malware step of replacing or altering Firefox Firefox is still considered open source, correct? From what I know, open source software is meant to be altered.
Earlier quoted context omitted.
Unless you run an unbranded builds ( https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... ), or the Developer Edition ( https://www.mozilla.org/en-US/firefox/developer/ ), where setting xpinstall.signatures.required to false still works, then yes, Mozilla can prevent you from using an add-on. More than "going forward", this has been the case for a while now. It's been long enough ago that they disabled tha…
Sadly the unbranded builds do not have updates enabled and the developer edition is basically beta.
0. https://elgan.com/blog/why-mozilla-and-google-are-wrong-to-b...
1. https://discourse.mozilla.org/t/the-removal-of-the-dissenter...