All extensions disabled due to expiration of intermediate signing cert • Hacker News Board

Re: All extensions disabled due to expiration of intermediate signing cert

#441

Post by omnimus » Sat, May 04, 2019, 8:18 AM UTC

jchw wrote: post #271

sjwright wrote: post #263

Earlier quoted context omitted.

> this feels like a big blow to user trust. And yet every other major browser vendor has punched their users with far worse catastrophes of privacy, security, ripping away features, breaking features, and general shitheaddedness. Switching browsers because of this incident is like ordering a burger at your favourite restaurant and one time it comes out without the meat patty, so in protest you switch to a crappy alte…

I'm going to skip the analogies and just say this: If tomorrow this is still broken and I have a choice between installing Chromium, and installing Nightly + disabling security features, It's going to be a tough dilemma for me personally. I'm glad you have software/vendors you feel you can trust. I definitely don't feel that way about most software anymore. I do think you are being a bit hyperbolic regarding other br…

Well when you are google employee and you are testing code in firefox... you already have chrome and chromium installed.

I think what is a real tough dillema is being sad about nonfunctioning adblocker while working for the biggest internet ads company.

So are you working in chrome marketing department?

Re: All extensions disabled due to expiration of intermediate signing cert

#442

Post by former_mozzer » Sat, May 04, 2019, 8:18 AM UTC

dajonker wrote: post #430

former_mozzer wrote: post #405

There have been major organizational problems at Mozilla for a long time that precipitated this. Many of us saw something like this coming, saw gaps and unclear responsibilities, reported these gaps and confusions up the chain, and were reprimanded and financially penalized for asking the tough questions. The questions were never answered, and we all quit, were fired, or lost motivation as a result. This is a tech pr…

You basically just described any sufficiently large organization. Complaining is not helping anyone in these situations, the only thing you can do to change things is to go ahead and try to change things. Reporting things up the chain hardly ever works because the chain is too busy with their own issues and politics. You have to make it worth their while.

Mozilla is an organization of 1000 employees. Executives act like it’s 100,000 employees.

Re: All extensions disabled due to expiration of intermediate signing cert

#443

Post by kjdui » Sat, May 04, 2019, 8:18 AM UTC

former_mozzer wrote: post #405

There have been major organizational problems at Mozilla for a long time that precipitated this. Many of us saw something like this coming, saw gaps and unclear responsibilities, reported these gaps and confusions up the chain, and were reprimanded and financially penalized for asking the tough questions. The questions were never answered, and we all quit, were fired, or lost motivation as a result. This is a tech pr…

Seems like quite the accusation no? I mean I hate Mozilla as much as the next guy but any kind of proof, even if it's a Twitter thread from some Mozillian, would be nice.

Re: All extensions disabled due to expiration of intermediate signing cert

#444

Post by BuckRogers » Sat, May 04, 2019, 8:18 AM UTC

marcosdumay wrote: post #220

Complexicate wrote: post #58

Earlier quoted context omitted.

"...how does an organization ensure the task still gets done?" With something almost stupidly simple and low-tech: checklists. (I'm reading "The Checklist Manifesto" right now, and the points it makes seem to fit perfectly with everything you mention.)

An year is enough time for everybody that knows about the checklist to leave.

We resolved this issue at my last company with sufficiently large mailing groups for cert renewal reminders. Once you get to 12 people on a mailing list, with new employees being added all the time, it's hard to miss. Usually a manager on that list is pinging people about it. There is the chance of the tragedy of the commons occurring, but I never saw it.

Once you do this, the only checklist that matters are procedural checklists to add a new client or new cert to the renewal notification list. When you use a standard group email for all cert purchases, that one becomes tough to miss.

In my 7 years of being involved, we never missed a cert renewal with this process for ~300 client sites with multiple or wildcard certs.

Re: All extensions disabled due to expiration of intermediate signing cert

#445

Post by mirimir » Sat, May 04, 2019, 8:20 AM UTC

mirimir wrote: post #207

Chirael wrote: post #143

Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now. Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(

That was predictable.

Well, it was. I mean, it's Firefox!

But see https://trac.torproject.org/projects/tor/ticket/30388 for the same temporary fix as at https://news.ycombinator.com/item?id=19823928

Re: All extensions disabled due to expiration of intermediate signing cert

#446

Post by campbellmorgan » Sat, May 04, 2019, 8:20 AM UTC

For anybody using Firefox Android and ublock origin who now sees ads, worth checking out the duckduckgo Android privacy browser. So far, it seems to be working beautifully so something good for me at least has come out of this mess!

Re: All extensions disabled due to expiration of intermediate signing cert

#447

Post by pfeerick » Sat, May 04, 2019, 8:20 AM UTC

pepa65 wrote: post #232

gpm wrote: post #227

To re-enable all disabled non-system addons you can do the following. I am not responsible if this fucks up your install: Open the browser console by hitting ctrl-shift-j Copy and paste the following code, hit enter. Until mozilla fixes the problem you will need to redo this once every 24 hours: // Re-enable *all* extensions async function set_addons_as_signed() { Components.utils.import("resource://gre/modules/addon…

I just set xpinstall.signatures.required to True in about:config and that fixed it after a restart.

I can confirm this on Ubuntu 19.04 with Firefox 66.0.3. Changing xpinstall.signatures.required from the default 'True' to 'False' resulted in addons working again.

Re: All extensions disabled due to expiration of intermediate signing cert

#448

Post by leemailll » Sat, May 04, 2019, 8:22 AM UTC

Rebelgecko wrote: post #383

moho wrote: post #366

Earlier quoted context omitted.

Super useful, thanks. In my case ctrl+shift+j opens a dumb console that only shows messages and doesn't take any input. I had to go to about:addons, hit F12 for the Dev Tools and paste it in the console there. Worked well.

If you go to about:config and set "devtools.chrome.enabled" to true, the cmd-shift-j thing should work

This is the step required for me to allow Browser Console for input

Re: All extensions disabled due to expiration of intermediate signing cert

#449

Post by bondant » Sat, May 04, 2019, 8:22 AM UTC

lucb1e wrote: post #409

If everyone's add-ons are disabled, I wonder why mine are not. My computer has been running over night (coincidentally, first time in years) and my add-ons are intact. Does it take a browser restart? Or might I have a setting that prevents this from happening? My system time is correct. Edit: am on Firefox 66, Linux (Debian Buster/testing), using Firefox from Mozilla directly (not through repositories), and my intern…

Same here, I opened firefox 20 minutes ago and discovered this thread, but all my addons seems to work fine. (FF 66, from debian repo, I'm in EU)

Re: All extensions disabled due to expiration of intermediate signing cert

#450

Post by AmericanChopper » Sat, May 04, 2019, 8:22 AM UTC

rocqua wrote: post #391

AmericanChopper wrote: post #305

Earlier quoted context omitted.

>SSL cert renewal is one of the great unsolved problems in computer science Certificate expiry really only exists to make money for CAs. It doesn’t solve any security problem that CRLs don’t already solve (and solve better). There’s lots of unsolved problems relating to ‘how do you make a reliable PKI’, but cert expiry is really just an unrelated business requirement for CAs.

Cert revocation suffers from a very simple issue. If your check for revocation fails, do you fail open (ie accept the cert) or fail closed (ie reject the cert). For any method, fail closed is user hostile and often a DOS vulnerability whilst fail open is another way for an attacker to use a revoked cert. This is a big issue with on-line methods like OCSP as a MitM using a bad cert can probably block OCSP traffic as w…

All TLS failures fail closed. The idea that if a cert is compromised it will eventually expire sometime within the next five years is a completely laughable security control. Leaking information is a complete non-concern too. Have you heard of certificate transparency logs?

Short lived certs are quite obviously better from a security perspective, but the security difference between a certificate that expires in five years, and one that expires never is irrelevant.