[deleted]
All extensions disabled due to expiration of intermediate signing cert
161–170 of 955 posts
Re: All extensions disabled due to expiration of intermediate signing cert
#162Earlier quoted context omitted.
Discovery of all the certs is what I think is the harder problem.
I agree. What can be done to prevent developers from adding a certificate dependency without monitoring during the move-fast-and-break-things days of early development, which then sits for X years as developers come and go, and nobody notices until it fails?
>What can be done to prevent developers from adding a certificate dependency
Discipline? Experience? PIP?
Re: All extensions disabled due to expiration of intermediate signing cert
#163I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…
> I’ll still keep using Firefox since I recognize the importance of browser diversity
Also, Chrome is not immune to "crashes for everyone at the same time" bugs. Like that time when the start of daylight saving time made it crash for a full day (a quick search tells me it probably was https://bugs.chromium.org/p/chromium/issues/detail?id=287821).
Re: All extensions disabled due to expiration of intermediate signing cert
#164This is a goddamned disaster. I'm just thankful that I use an offline password manager, but even still ... I like FF, don't get me wrong, but this is going to absolutely fucking destroy user trust in Mozilla. This kind of incompetence, on a browser scale , is breathtaking.
Seems like an over-reaction. "Destroy user trust in Mozilla?" Really? Because your extensions got disabled for a day?
Users will drop a product for the slightest reason. For instance, one of our users recently left a negative review. Paraphrasing, "Logging in is difficult".
We check our warning system (set up to detect suspicious logins, incidentally also catches any users who've been locked out because they forgot their password), and his last login attempt took a total of two tries.
Re: All extensions disabled due to expiration of intermediate signing cert
#165Earlier quoted context omitted.
I’ve been in software development and operations for 25 years. I still don’t want to have to understand everything I ever touch, even if I could.
I'm not understanding the relationship. Of course users aren't going to understand all the underpinnings of how software works. I do think that in the future, it will be imperative for everyone to have some level of technological literacy above what is currently the average. And I'd like to work to get to that point, instead of taking all the tools away because they're too dangerous. Also, sensible defaults are good!…
[deleted]
Re: All extensions disabled due to expiration of intermediate signing cert
#166My extensions are still running. I even restarted Firefox a few moments ago. So it’s not everyone?
My extensions are also still running. Comments on the bugzilla bug restricted so adding details here and figuring that if this is useful someone can forward it to the right people $ date Fri May 3 22:45:22 EDT 2019 $ date --utc Sat May 4 02:41:47 UTC 2019 $ firefox --version # Installed from arch repositories Mozilla Firefox 66.0.3 about:config xpi.signatures.required true app.update.lastUpdateTime.xpi-signature-veri…
Copying a potential workaround here from my lobste.rs comment, not really tested obviously
If it hasn’t broken yet for you, I think (but I’m not very much not sure) setting that preference to 1556940100 should keep it working until 24 hours from now. And if you keep updating that value every 23 hours to the output of date '+%s' until it is fixed via a firefox update it should keep working forever.
I think you need to restart the browser as well after updating the preference for the above idea to work.
Re: All extensions disabled due to expiration of intermediate signing cert
#167I'm not familiar with Firefox extensions (and have pretty much stayed away from the stuff ever since they started making it "mandatory"...) but shouldn't the expiration only mean new signatures won't be valid, yet signatures made before expiration should remain so? At least that's how I understand things like Windows' driver signing works (when that was first introduced, I was quite scared that it would mean perfectl…
In short, yes, they should have implemented timestamping for their code signatures like most other code signing systems do.
Without timestamping the expired cert always would have caused problems, even if it was replaced early and correctly: Every add-on would still need to be signed again with the new replacement certificate and shipped to all users. It's not as easy as just replacing the certificate on some server.
Well, this is still what has to happen: replace the certificate, ship that new certificate[1], re-sign every add-on, ship every add-on to every user.
Now, in order to ship new versions of the add-ons, you probably will have to bump the add-on version numbers as well. Which can have further unintended consequences.
[1] Incorrect, see blow; it is my understanding that the certificate in question is baked into the browser itself, with no way to push updates just for the certificate remotely other than shipping an entire new Firefox build. Well 6 new builds: esr, stable, dev, beta, nightly, unbranded. Gonna be a fun night for a lot of mozilla folks... Well, a night is not gonna be enough...
I might be wrong tho, and misunderstood something.
EDIT I was wrong (https://news.ycombinator.com/item?id=19824520), the expired cert is not baked into the browser, just into the add-on package files. No need for new Firefox binaries, after all. Still, they have to resign all add-ons and ship new versions.
Re: All extensions disabled due to expiration of intermediate signing cert
#168[deleted]
Re: All extensions disabled due to expiration of intermediate signing cert
#169Earlier quoted context omitted.
> Still, this type of oversight seems all too common even in large companies. (...) Has anyone developed a tool designed specifically to avoid certificate expiry disasters? LetsEncrypt renewal is supposed to be automated. [1] I know of a company that hosted blogs for thousands of customers. They used LetsEncrypt, but the CTO considered automatic renewals a possible security risk, so they did it manually. Problem is,…
So did they conclude it wasn’t a security concern or did they conclude the security risk was worth the uptime?
When pressed, they admitted it was just "gut feeling". The team audited a couple ACME clients and couldn't find anything to justify not automating.
Re: All extensions disabled due to expiration of intermediate signing cert
#170Earlier quoted context omitted.
"don't run privileged code from people you don't trust." Is both critically important to understand for anyone using a network connected computer and not at all complicated. If we're going to be authoritarian I would rather ban anyone who doesn't understand that from connecting to the internet then have a broken walled garden.
> "don't run privileged code from people you don't trust." Is both critically important to understand for anyone using a network connected computer and not at all complicated. That is absolutely complicated for the vast majority of the world's internet users. No one else is my family would understand what the hell "privileged code" means and shouldn't have to.
The statement can be simplified down to "don't run programs downloaded from random websites which ask for your admin password."
Adjust the qualifier at the end depending on your platform. On Windows, it might be apps that present a UAC dialogue—or maybe just remove the qualifier, since Windows doesn't do much sandboxing by default.