Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical Details on the Recent Firefox Add-On Outage

hacks.mozilla.org

Post reply on HN
Print view View original

151–160 of 279 posts

Re: Technical Details on the Recent Firefox Add-On Outage

#151

Post by [deleted] »

temac wrote: post #109
eps wrote: post #60

Earlier quoted context omitted.

Every major CA runs a trusted timestamping service. Mozilla doesn't need to maintain their own timestamping infrastructure, they could delegate to one of the CAs, probably based on some sort of formal agreement with them. Though the way things stand, all CAs have no problem timestamping sigs made with certs that are from other CAs, so perhaps even no explicit agreement is required.

The checker just has to have roots tracing to timestamping CAs. I really don't understand why Mozilla designed their system like they did. Code signing is well known and probably even done for the Windows installer of Firefox, why did they just not duplicate the model? Checking expiration vs current time makes absolutely no sense for code signing, esp. at runtime (it could kind-of sort-of make a little bit of sense a…

[deleted]

Re: Technical Details on the Recent Firefox Add-On Outage

#153

Post by tedunangst »

bpfrh wrote: post #124
tedunangst wrote: post #93

Earlier quoted context omitted.

Well, they could tell us what the previous process was. Was the cert renewer on vacation, or was the wrong date entered on the calendar, or? How was it supposed to work? I think a lot of people are curious about that.

They said they will make a formal post-mortem investigation as well as make a post about what they will change. I think the information will be contained in one of the two posts?

Sure? But someone basically said there's nothing more to be learned or discussed.

Re: Technical Details on the Recent Firefox Add-On Outage

#154

Post by y-satellite »

brokenmachine wrote: post #147
y-satellite wrote: post #142

Earlier quoted context omitted.

You realize, I hope, that 56.0.2 is riddled with security holes at this point? I get the attachment to old addons, but 129 CVEs (including multiple severe memory corruption bugs) affect that version now. It's not really reasonable to expect Mozilla to keep maintaining it.

I don't expect them to maintain it, but I do expect them not to break it for no reason. Also they could have mentioned in their post that their fix did not do anything for older versions, instead of specifically telling everyone to just keep waiting. xpinstall.signatures.required = false didn't fix it. I'll be very happy to update when there's a version that has a good tab manager. I'm on the latest version at home a…

In this day and age you're living on borrowed time using an old version of a web browser. This state of affairs has its good and bad, but your modern-day browser vendors don't typically maintain branches of old versions to make security and bug fixes (especially when they change things for security reasons, as with this case of old-style addons being removed). If you're going to insist on using an old unsupported version you have to accept the risk of things eventually breaking and the inconvenience of workarounds like the one you described.

Re: Technical Details on the Recent Firefox Add-On Outage

#156

Post by brokenmachine »

Silhouette wrote: post #132
callahad wrote: post #100

Earlier quoted context omitted.

We do not take an editorial stance on add-on content with regard to signing, but we do have the ability to block add-ons that are malicious or which violate user privacy and security. We hope those choices will be few and far between, and that our users will agree with them. Our Add-on Policy is discussed further at https://blog.mozilla.org/addons/2019/05/02/add-on-policy-and...

FWIW, I was genuinely shocked that this could happen, and it has severely damaged my trust in Firefox. I am extremely wary, having been bitten more than once, about software that automatically updates itself or is otherwise subject to remote interference. I don't run Windows 10. I don't use Chrome for anything important. I avoid subscription-based or activation-required software as much as possible. And in Firefox, I…

Hear hear. Very well written. I too was shocked that this was possible.

Re: Technical Details on the Recent Firefox Add-On Outage

#157

Post by dingo_bat »

SECProto wrote: post #64
DangerousPie wrote: post #51

My point of view as a long-time Firefox user that cares about privacy but also knows we live in an imperfect world: It obviously sucks that this happened but I think they handled it very well. The bug was fixed so quickly that I wouldn't even have realized it had happened if it hadn't been for the thread here on HN. My extensions hadn't even been disabled yet by the time the patch came out. And pushing out the hotfix…

> The bug was fixed so quickly that I wouldn't even have realized it had happened if it hadn't been for the thread here on HN Maybe this is a timezone thing, but I was in East Asia, and I had to deal with the internet for close to 36 hrs (android) with no ublock. It was almost enough to look for a new browser (but browsers with adblock on Android are few and far between - so instead I just didn't use the internet as…

If you have a Samsung you can use disconnect pro. It works well.

Re: Technical Details on the Recent Firefox Add-On Outage

#158

Post by floatingatoll »

throw7 wrote: post #126

i lost all my custom multi-account containers after getting a version that has the cert fixes (firefox is still broken on fedora; i had to download the testing version today to get it back working). either today's engineers are sub-standard or the foxes rule the henhouse.

If you disable the addon, restart Firefox, and enable the addon, do your custom containers get erased again?

Re: Technical Details on the Recent Firefox Add-On Outage

#159

Post by brokenmachine »

silversconfused wrote: post #122
ghostly_s wrote: post #73

If anyone's wondering if this answers the Actual Question of why the cert was allowed to expired, don't waste your time, it doesn't. I guess implicitly that's a "social detail"?

I really don't get why everyone thought putting dead-man-switches ON EVERYTHING was a good idea. Boils my blood thinking about it. So wasteful. Such disrespect for the future. But hey, security. Can't argue with that!

Subscription culture and endless updates/rewrites. For Sisyphus, nothing is ever complete.

Re: Technical Details on the Recent Firefox Add-On Outage

#160

Post by brokenmachine »

y-satellite wrote: post #154
brokenmachine wrote: post #147

Earlier quoted context omitted.

I don't expect them to maintain it, but I do expect them not to break it for no reason. Also they could have mentioned in their post that their fix did not do anything for older versions, instead of specifically telling everyone to just keep waiting. xpinstall.signatures.required = false didn't fix it. I'll be very happy to update when there's a version that has a good tab manager. I'm on the latest version at home a…

In this day and age you're living on borrowed time using an old version of a web browser. This state of affairs has its good and bad, but your modern-day browser vendors don't typically maintain branches of old versions to make security and bug fixes (especially when they change things for security reasons, as with this case of old-style addons being removed). If you're going to insist on using an old unsupported ver…

Well I've just been educated on a new mechanism by which things can be remotely broken.
Post reply on HN