Isn’t the issue that they’ve forgotten to renew a SSL certificate? Why not just renew it?
It’s not an SSL certificate. It’s a certificate that’s used by the browser to validate the signature of an installed extension. It’s baked into the release.
Update Regarding Add-Ons in Firefox
61–70 of 504 posts
Re: Update Regarding Add-Ons in Firefox
#62At this point, I have to figure Mozilla has been infiltrated by saboteurs. It’s maliciousness masquerading as incompetance. The inverse of Hanlon’s Razor, to be sure.
Re: Update Regarding Add-Ons in Firefox
#63Earlier quoted context omitted.
This is true. However it is signed by moz and looking at the source it seems safe enough (the cert is legit). It's just a normal wrapper with the following code added: // first inject the new cert try { let intermediate = "MIIHLTCCBRWgAwIBAgIDEAAIMA0GCSqGSIb3DQEBDAUAMH0xCzAJBgNVBAYTAlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3ppbGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTEfMB0GA1UEAxMWcm9vdC1jYS1wc…
Out of interest, what's special about this add-on that allows it to install intermediate certificates like this vs. an add-on that any random dev could write?
It's installed as a study addon, only Mozilla could install these.
Re: Update Regarding Add-Ons in Firefox
#64Isn’t the issue that they’ve forgotten to renew a SSL certificate? Why not just renew it?
[deleted]
Re: Update Regarding Add-Ons in Firefox
#65Earlier quoted context omitted.
Servo was a silly pointless separate browser once
I'm not sure I would call it "pointless", they've merged and are merging a lot of the code they used servo to experiment with into firefox. Of everything mozilla has done recently, Servo is one of the things I'm most positive about.
I'm sure your parent comment was being sarcastic. The quotes were missing.
Re: Update Regarding Add-Ons in Firefox
#66I hate to say all these things because I use Firefox all the time, but...the communication around the add-ons issue has been poorly handled by Mozilla. I only learned of the problem by visiting HN. But what of the thousands of other users who don't visit HN? If you visit the Mozilla homepage, there is nothing to acknowledge the problem (at least at the time of writing this message). Let's try the Support page. Where…
The way I see it, people might have gotten used to software break from time to time. Once software breaks it is reasonable to expect it to get fix in a couple days when it is updated. At least this was probably the experience for the majority of users, those that noticed the issue.
The sad reality is Mozilla has been losing mindshare to Chrome for a long time and this will rapidly accelerate it. People don't expect things to break. They expect things to work, and when things break they get angry.
I love Firefox. It's my daily driver. It will continue to be. But this is a huge fuck-up and they're probably going to pay big in usership because of it.
Re: Update Regarding Add-Ons in Firefox
#67I have a bunch of privacy-enhancing addons installed, which have now all been disabled. If I hadn't read HN this morning, I wouldn't even have known why. Until now, I had no idea that it was even possible to remotely disable my addons.
And now Mozilla are saying that the "fix" is to allow them to install & run "studies" on my machine? What are they smoking? I'm having a hard time trusting a company that randomly & remotely disabled all my addons, regardless of the cause.
Re: Update Regarding Add-Ons in Firefox
#68Earlier quoted context omitted.
I still hold that the multithreaded performance benefit was nowhere near worth wiping away so many of hours of developer time and ripping so many good extensions out of users' hands with no replacement for so much of the lost functionality.
As a regular user, it was worth it. Firefox was honestly pretty shit on (at least on Windows) pre-e10s. Before, I had to kill firefox every few days because CPU usage would climb for no reason. Since then, the only restarts I do are for updates. As a browser, it works much better, and as an extension developer as well, I'm glad I can write one extension that works in most browsers now. Yeah, it sucks they removed the…
xpinstall.signatures.required in about:config is the switch you are asking for. Though, it does not allow one time checks at install, but a choice of regular checks, or no checks at all.
Re: Update Regarding Add-Ons in Firefox
#69Earlier quoted context omitted.
This is true. However it is signed by moz and looking at the source it seems safe enough (the cert is legit). It's just a normal wrapper with the following code added: // first inject the new cert try { let intermediate = "MIIHLTCCBRWgAwIBAgIDEAAIMA0GCSqGSIb3DQEBDAUAMH0xCzAJBgNVBAYTAlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3ppbGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTEfMB0GA1UEAxMWcm9vdC1jYS1wc…
Out of interest, what's special about this add-on that allows it to install intermediate certificates like this vs. an add-on that any random dev could write?
In the manifest it has a special "experiment_apis":
"experiment_apis": {
"skeleton": {
"schema": "experiments/skeleton/schema.json",
"parent": {
"scopes": [
"addon_parent"
],
"script": "experiments/skeleton/api.js",
"paths": [
[
"experiments",
"skeleton"
]
]
}
}
}
Re: Update Regarding Add-Ons in Firefox
#70Earlier quoted context omitted.
Out of interest, what's special about this add-on that allows it to install intermediate certificates like this vs. an add-on that any random dev could write?
It's installed as a study addon, only Mozilla could install these.
> It's installed as a study addon, only Mozilla could install these.
And that gives it access to use `Cc`/Components.classes?