Technical Details on the Recent Firefox Add-On Outage

Post by sciurus » Fri, May 10, 2019, 2:11 AM UTC

brokenmachine wrote: post #160

y-satellite wrote: post #154

Earlier quoted context omitted.

In this day and age you're living on borrowed time using an old version of a web browser. This state of affairs has its good and bad, but your modern-day browser vendors don't typically maintain branches of old versions to make security and bug fixes (especially when they change things for security reasons, as with this case of old-style addons being removed). If you're going to insist on using an old unsupported ver…

Well I've just been educated on a new mechanism by which things can be remotely broken.

Post by sciurus » Fri, May 10, 2019, 2:17 AM UTC

Faark wrote: post #114

sciurus wrote: post #69

Earlier quoted context omitted.

I think this is covered in the blog post, but I'll take another stab at explaining it from my perspective: Republishing was one of the options we were investigating early on. However, the problem is that it only fixes things once you check for and install the updated version signed with the new certificate. Firefox would still have disabled your installed version that had an expired certificate. Firefox checks for ad…

Thanks for your response. An update being deactivated doesn't trigger an update check for said addon? Well, complexity of a graceful update attempt for a not loadable addon probably outweighs the benefit of such rare cases. But the main reason I had a hard time with you guys discarding this path is probably addon stats like [0]. The spike in downloads made me think it could have helped at least some users. But on sec…

Post by driverdan » Fri, May 10, 2019, 2:20 AM UTC

dave5104 wrote: post #70

steve19 wrote: post #66

Earlier quoted context omitted.

It was a couple of days before the Android fix was released. For many users this was a multiday affair. Some lost data (containers). You were lucky you extentions were not disabled before the fix, but for many people this was a major problem.

I unfortunately lost my container data (luckily I only have a couple set up). To get the fix though, I had to opt in to the Firefox studies. Apparently I had opted out at some point in the past.

Post by mook » Fri, May 10, 2019, 2:24 AM UTC

toyg wrote: post #97

> users should be able to opt-in to updates (including hot-fixes) but opt out of everything else Finally some good news. This is what I suggested in one of the previous threads: there should be a delivery channel for important updates, and a channel for experiments/telemetry/whatnot. Some other HNer said it was an unrealistic expectation "because manpower". Guess what, it isn't. This is how things should always be.

Post by dingo_bat » Fri, May 10, 2019, 2:26 AM UTC

carmate383 wrote: post #150

Hate on Google / Chrome / Proprietary / Lock-In / Whatever buzzword (tm) you want, but this would _never_ happen in Chrome. And it's the reason why Firefox will die to Chrome. BRING ON THE IN-DENIAL DOWNVOTES.