Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

321–330 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#321

Post by __david__ »

yjftsjthsd-h wrote: post #189
cheeze wrote: post #100

Earlier quoted context omitted.

Oh relax. A cert expired. An intermediate cert at that... This has probably happened to every major cloud provider and countless companies at least once. Certs are hard . Should Mozilla have had monitoring on their cert expiration? Yes. Will they after this? Probably. Is any one person ever at fault for something like this? No. Firefox is an open source project. You're welcome to contribute and make things better.

> Oh relax. A cert expired. An intermediate cert at that... Everyone's extensions broke. Including security ones. Including the ones bundled into the TOR browser. And end-users can't fix it. Because Mozilla decided that it was too dangerous to let users choose what extensions to run for themselves. This is an excellent moment to be upset.

Being upset is ok! I'm not particularly happy that I can't just override the certificate check on stable. But demanding someone get fired is just pointlessly punitive.

Re: All extensions disabled due to expiration of intermediate signing cert

#322

Post by n42 »

tass wrote: post #309
n42 wrote: post #226

Earlier quoted context omitted.

Just curious, are you talking about Webflow? Because I had to hunt down and make sure our Let's Encrypt auto renewal was working until I realized the certificate was served by them. They wait until the last 12 hours to renew the certificate. I have no idea what type of rationalization would lead to that decision.

90 days is 4 times a year. 60 is 6 times, 50% more expensive when you’re paying someone to perform the task.

I had the same thought, but I still find that absurd. Say they host 500,000 websites with HTTPS. 1,000,000 renewals they save spread across the year, roughly 2 renewals a minute. That is pennies. A t2.medium could handle that type of load increase

Re: All extensions disabled due to expiration of intermediate signing cert

#323

Post by craftinator »

username223 wrote: post #222
cesarb wrote: post #163

Earlier quoted context omitted.

> I’ll still keep using Firefox since I recognize the importance of browser diversity Also, Chrome is not immune to "crashes for everyone at the same time" bugs. Like that time when the start of daylight saving time made it crash for a full day (a quick search tells me it probably was https://bugs.chromium.org/p/chromium/issues/detail?id=287821 ).

> "crashes for everyone at the same time" bugs What else would you expect for auto-updating software that relies on the internet to work? It's a monoculture attached to a firehose of disease. This is exactly the same as "pushing out a security fix to all users," except it apparently wasn't intentional. You can't have one without the other.

I love "firehose of disease", and will steal it. And I agree that bugs are bugs; every time you add a new capability, you add all the possible bugs that can occur with that capability.

Re: All extensions disabled due to expiration of intermediate signing cert

#324

Post by mirimir »

fnrslvr wrote: post #296

Mozilla doesn't seem to have communicated the issue well. I could imagine a lot of unsavvy users have tried some wild things in an attempt to fix the problem, and maybe made a mess in the process. Doesn't Mozilla have a mechanism for blasting out a message to all Firefox browsers? Also I have a Firefox account, why haven't I been inboxed about this? Otherwise I'm not bothered. I won't be switching as long as this get…

https://twitter.com/mozamo

https://discourse.mozilla.org/t/certificate-issue-causing-ad...

Re: All extensions disabled due to expiration of intermediate signing cert

#325

Post by pritambaral »

Run this in your Browser Console[1] to delay signature checking for a day:

    function set_xpi_sign_time_now() {
        const {Services} =  ChromeUtils.import("resource://gre/modules/Services.jsm");
        const now = (new Date()).getTime() / 1000;
        Services.prefs.setIntPref('app.update.lastUpdateTime.xpi-signature-verification', now);
    }
    
    set_xpi_sign_time_now();
EDIT: Changed `Components.utils.import` to `ChromeUtils.import` because apparently Beta and Nightly versions have removed the former, while the latter was introduced in 60.

This does the equivalent of setting in about:config the time of last signature verification to the current time. By default, Firefox re-checks signatures in 24 hours (or so I read somewhere here). I like the temporary effect of this, compared to the permanent disabling of signature verification suggested elsewhere.

----

1: https://developer.mozilla.org/en-US/docs/Tools/Browser_Conso...

Re: All extensions disabled due to expiration of intermediate signing cert

#326

Post by shstalwart »

userbinator wrote: post #54
ehsankia wrote: post #43

Earlier quoted context omitted.

> Why can't I tell my copy of Firefox to ignore the certificate? Why can't I sign my own extensions? The issue is that if you leave any sort of lever that reduces security, it will be abused by bad actors. This is why browsers are having ever decreasing ways to bypass security and have full access. It is annoying, but at the end of the day, protecting 99.999% of the users trumps what us power users want.

protecting 99.999% of the users It is horribly paternalistic to advocate for keeping users ignorant, unlearning, and --- dare I say it --- easily manipulated. I will refrain from mentioning again that infamous Franklin quote. I am frankly very fucking pissed off by this authoritarian walled-garden trend, and vehemently oppose anyone who helps this industry put the nooses around the necks of others as well as their ow…

Completely agree. Using firefox feels more and more like using an iThing.

Re: All extensions disabled due to expiration of intermediate signing cert

#327

Post by mirimir »

hu3 wrote: post #275
mirimir wrote: post #131

So why is this taking so long to fix? From https://github.com/mozilla/addons/issues/978 > diox commented 2 hours ago > I'm locking this like I did in #851 because no new information is being added. We're aware and we're working on it. I mean, two hours? WTF.

It was Friday night on most parts of the Western hemisphere. I'm guessing it took some time to get the right people back to work and assess the situation.

Yes. I was upset. Sorry. I ought to know to stop when I'm upset.

Re: All extensions disabled due to expiration of intermediate signing cert

#328

Post by nydel »

fnrslvr wrote: post #296

Mozilla doesn't seem to have communicated the issue well. I could imagine a lot of unsavvy users have tried some wild things in an attempt to fix the problem, and maybe made a mess in the process. Doesn't Mozilla have a mechanism for blasting out a message to all Firefox browsers? Also I have a Firefox account, why haven't I been inboxed about this? Otherwise I'm not bothered. I won't be switching as long as this get…

the only extension that failed in a waterfox is tampermonkey which stopped working but did not get removed the way it did in a firefox.

as for a system to push messages to firefox users, is there anything like this in place? a standard? if so could it notify waterfox or icecat etc users at the same time as firefox users?

if there is no specification for this, is there a similar floss project that could be forked and molded into that of which we’re in need?

Re: All extensions disabled due to expiration of intermediate signing cert

#330

Post by craftinator »

andrewflnr wrote: post #237
marcosdumay wrote: post #220

Earlier quoted context omitted.

An year is enough time for everybody that knows about the checklist to leave.

Put "make sure someone else knows all this person's checklists" on the employee exit checklist.

Put the checklist on the home page of the company website!
Post reply on HN