241–250 of 955 posts
Earlier quoted context omitted.
Another option is using a Web Server/Reverse Proxy that supports Let's Encrypt automatically, like Caddy [1]. I believe Apache HTTPD has partial support [2], too. [1] https://caddyserver.com [2] https://httpd.apache.org/docs/2.4/mod/mod_md.html
Apache HTTPD looks interesting, so using which we renew LetsEncrypt cert without using certbot?
I like the alias name assigned to it: armagadd-on-2.0 Temporary work around till the cert gets fixed: set "xpinstall.signatures.required" to false
Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now. Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(
> Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :( Try turning it off. I got rid of ublock after arstechnica complained about a lot of their users blocking ads years ago and it honestly isn't that bad. Every once in a while I do back out of a page for maxing out one of my cpu cores but otherwise, nothing ever bad happens. With ads: either it takes me half…
If ads weren't doubling as tracking beacons and the occasional malicious drive by download, that certainly would be an option.
On a slightly different note, is there some curated collection of serious incidents like this somewhere? Something we could refer to when discussing possible pitfalls?
Earlier quoted context omitted.
Why does someone need to be fired? Does some blood spilled really make it better? Have some compassion.
I'm generally not a fan of firing people for making mistakes. This one is so monumental it may require it though. This breaks most FF installations.
Thanks :)
Earlier quoted context omitted.
We scan our codebase for anything that looks like a cert and send emails when it gets close. Might not have helped here if it was an intermediate owned by a CA. There but for the grace of God go I.
Why do you have certificates in your code to begin with?
You don't ship the signing keys with the certs, as that would be bad. ;)
Earlier quoted context omitted.
Discovery of all the certs is what I think is the harder problem.
I agree. What can be done to prevent developers from adding a certificate dependency without monitoring during the move-fast-and-break-things days of early development, which then sits for X years as developers come and go, and nobody notices until it fails?
Earlier quoted context omitted.
Its also more secure. Long lived certs risk the possibility that someone who used to own the domain got a certificate on it and it still works after the domain is resold. Once you automate it there is no downside to short lived certs.
If only there were a way to revoke certificates. Like, some kind of list.
Very few things check revocation, unfortunately - it puts an extra hop on the fast path of connecting to a server. OCSP stapling is pretty much the only thing a browser would care about - having the server fetch a signed OCSP response that is good for a limited period of time (say, hours), and send that along with the certificate during negotiation.
Or, you could just have the server fetch a certificate thats good for a limited period of time.
They don't use cryptographic timestamps with their signatures ? The certificate might now be invalid, but the signatures were done at a time when it was valid...
The problem is that "time" is fungible and can be forged. The date on a signature doesn't really mean anything.
This is a goddamned disaster. I'm just thankful that I use an offline password manager, but even still ... I like FF, don't get me wrong, but this is going to absolutely fucking destroy user trust in Mozilla. This kind of incompetence, on a browser scale , is breathtaking.
Seems like an over-reaction. "Destroy user trust in Mozilla?" Really? Because your extensions got disabled for a day?
Sadly, I have to agree that this feels like a big blow to user trust.
User trust is not really just about respect or values; it definitely also includes things like performance and reliability. The average user, right now feeling powerless, might even feel anger towards Mozilla for this - after all, they already downloaded the extension, why would they all just stop working behind their backs? They don't understand what CAs are or why certificates expire. People don't frankly care what place your heart is in when they are angry about something. Perhaps people are being dramatic, but that's normal. People are pretty darn dramatic about Chrome, too.
Meanwhile... I use Firefox everywhere, and I've lost my password manager, adblocking, security-related extensions, etc. all in one go, and the only solutions I'm aware of involve disabling extension signing. Gotta admit, even though I will probably continue using Firefox after this, that it certainly is a bummer.