131–140 of 955 posts
> diox commented 2 hours ago
> I'm locking this like I did in #851 because no new information is being added. We're aware and we're working on it.
I mean, two hours? WTF.
First they force code signing on everyone without a way to disable it then they break it. This is an extreme level of incompetence I didn't expect from Mozilla. They'd better have the best post mortum ever, possibly with someone being fired.
Oh relax. A cert expired. An intermediate cert at that... This has probably happened to every major cloud provider and countless companies at least once. Certs are hard . Should Mozilla have had monitoring on their cert expiration? Yes. Will they after this? Probably. Is any one person ever at fault for something like this? No. Firefox is an open source project. You're welcome to contribute and make things better.
Looks like all extensions have been disabled for all Firefox users. I think this fail-closed behavior is more of a security issue than the one it is trying to solve. All of my security add-ons - Privacy Badger, NoScript, Decentraleyes, and many more were disabled. Even worse, it happened without notice to the user. One moment I was browsing the internet (just barely) secured by these add-ons, and the next moment, all…
If it failed open, anyone unlucky enough to update their extensions could end up having a malicious version installed. It also would have taken longer to notice.
Can someone explain exactly what went wrong? I don't think I quite understand, but 7/9 of my extensions have been disabled.
First they force code signing on everyone without a way to disable it then they break it. This is an extreme level of incompetence I didn't expect from Mozilla. They'd better have the best post mortum ever, possibly with someone being fired.
Honestly that's one of the most successful things you can expect out of a failure of this magnitude.
There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false. However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition. To fix this on MacOS I did the following: 1. Downloaded and installed Firefox Nightly 2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/fir…
If they can't get this right, what hope is there of browser security?
I like the alias name assigned to it: armagadd-on-2.0 Temporary work around till the cert gets fixed: set "xpinstall.signatures.required" to false
Still, it's no worse a calamity than most everyone else presents to the world from time to time. I shall stick to my Firefox, partly influenced by the complete absense of any viable alternative out there.
By the way: Writing this a few hours after midnight, May the fourth, local time. Every single one of my 33 Firefox addons is active and working just fine. Wating to see. Breaking out my Waterfox, just in case.
[Edit: May fifth -> fourth]
Earlier quoted context omitted.
You can find lots of programs like this one to monitor certs: https://pypi.org/project/check-tls-certs/ I run one daily from cron and have it email me a report with the days to expiration for the certs I’m responsible for, even for certs that auto renew. I don’t filter the email. Daily is not too frequent for it to go to my inbox, but frequent enough that I’ll notice if it doesn’t mail me. YMMV.
Discovery of all the certs is what I think is the harder problem.