Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

811–820 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#811

Post by guido_vongraum »

lawl wrote: post #557
daleharvey wrote: post #545

Earlier quoted context omitted.

> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout > What about a UI knob to disable it? app.normandy.enabled

The UI knob is Options -> Privacy & Security > Allow Firefox to install and run studies They're using the studies system to push this hotfix faster for those that have it enabled. Edit: Source: See: https://discourse.mozilla.org/t/certificate-issue-causing-ad... > In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Pre…

>The UI knob is > Options -> Privacy & Security > Allow Firefox to install and run studies

Well it's a half-assed knob then, because it was unchecked and still I had app.normandy.enabled = true somehow.

Re: All extensions disabled due to expiration of intermediate signing cert

#812

Post by gpm »

ihoonte wrote: post #809
gpm wrote: post #805

Earlier quoted context omitted.

When I say "enabled" I mean set to a value of "true" (instead of "false"), "modified" is a different column. What error do you get on the link though? That link is a better fix.

Ah okay yeah I set it to true, default was false. Error is connection failure (same error as for the add-ons)

Not sure what would be causing a connection failure. I just verified that the link is still up for me, and obviously you have an internet connection if you're replying to me.

You're not behind a firewall that might be blocking it are you? E.g. being in China?

Re: All extensions disabled due to expiration of intermediate signing cert

#813

Post by ihoonte »

ihoonte wrote: post #809
gpm wrote: post #805

Earlier quoted context omitted.

When I say "enabled" I mean set to a value of "true" (instead of "false"), "modified" is a different column. What error do you get on the link though? That link is a better fix.

Ah okay yeah I set it to true, default was false. Error is connection failure (same error as for the add-ons)

I'm not a developer though, so it's not super urgent. Just felt like figuring it out.

Re: All extensions disabled due to expiration of intermediate signing cert

#814

Post by neiman »

lvh wrote: post #753
neiman wrote: post #749

Earlier quoted context omitted.

Unless the entity that pushes the updates become malicious, then they're a security hole.

How do you audit Firefox updates? Because if the answer is “I don’t”, Mozilla already controls the most important piece of userspace code on your computer. And if the answer is “I don’t install them”, then everyone with a few grand to spare already controls the most important piece of userspace code on your computer.

I audit software updates by looking at developers announcements and community discussions (in social media, forums etc) before installing updates.

Then, even if developers keys and computers are compromised, I would notice something is wrong.

* No, of course that I don't always do that. I even don't often do that. But I did do that in the past, and I'd like to have the option to do that.

Re: All extensions disabled due to expiration of intermediate signing cert

#815

Post by lordlimecat »

megous wrote: post #590
tssva wrote: post #569

Earlier quoted context omitted.

The wiki entry evidently doesn't describe what it does because according to the wiki entry it allows for the enabling and disabling of preferences. The updating of a certificate is beyond what is described in the wiki. Mozilla should follow up with a post describing exactly how Normandy works and the full capabilities it gives them.

So search elsewhere if you want more info. All code is available.

Open source software can't have a backdoor because the code is available to review.

Got it.

Re: All extensions disabled due to expiration of intermediate signing cert

#816

Post by dooop »

gpm wrote: post #812
ihoonte wrote: post #809

Earlier quoted context omitted.

Ah okay yeah I set it to true, default was false. Error is connection failure (same error as for the add-ons)

Not sure what would be causing a connection failure. I just verified that the link is still up for me, and obviously you have an internet connection if you're replying to me. You're not behind a firewall that might be blocking it are you? E.g. being in China?

66.0.3 64 - Win10

FF shows the fix add-on as being installed with the standard pop-up notifications in the menu bar. However, in the browser console, I only see the error msgs that I've listed in my other posts.

???

Re: All extensions disabled due to expiration of intermediate signing cert

#817

Post by userbinator »

floatingatoll wrote: post #283
userbinator wrote: post #258

Earlier quoted context omitted.

I wonder how long until the "security vultures" come upon this workaround and stop it from working... would be ironic if that happened sooner than the expired cert getting fixed.

Seems unlikely. If you’re willing and able to run code like the above, sourced from a random comment on the Internet, there’s no amount of security vulture that’s going to protect you from skillfully making your Internet experience unsafe for yourself.

It doesn't stop them from trying, however, and severely damaging the experience of users who do know what they're doing. They even invented the term "self-XSS" and contributed to the decline of JS "bookmarklets".

Re: All extensions disabled due to expiration of intermediate signing cert

#818

Post by gpm »

gpm wrote: post #812
ihoonte wrote: post #809

Earlier quoted context omitted.

Ah okay yeah I set it to true, default was false. Error is connection failure (same error as for the add-ons)

Not sure what would be causing a connection failure. I just verified that the link is still up for me, and obviously you have an internet connection if you're replying to me. You're not behind a firewall that might be blocking it are you? E.g. being in China?

Hey doop, replying to you here since your post is showing up as dead so I can't reply to it.

If you installed the xpi you shouldn't need to do anything in the browser console, and your addons should have come back. Obviously the latter didn't happen.

Chances are a connection failure in the browser console is unrelated, the browser console is basically constantly spewing error messages, you should just ignore them unless they are in response to something you did.

All I can really suggest over the internet is to try reinstalling your addons - that might work - in which case I would assume they just got uninstalled somehow. If it doesn't I'm not sure what to suggest, and I can't realistically debug something too complex over HN comments. You might just have to wait for mozilla to publish an update to the browser that fixes this properly.

I do want to emphasize that I'm just some dude on the internet being helpful by the way, not associated with Mozilla or anything.

Edit: Just saw this error message you also posted: """WebExtensions: failed to add new intermediate certificate:"""

That sounds like an issue that happened when installing the .xpi? Did it give any other related debugging information?

Re: All extensions disabled due to expiration of intermediate signing cert

#819

Post by lordlimecat »

the8472 wrote: post #645
johnsea wrote: post #640

Earlier quoted context omitted.

Why does Mozilla do this? Same with removing the option to not update. Why not let users choose (in the case of update maybe with an about config setting)?

Because (stable) users are dumb, are easily manipulated and can't be trusted. Thus the mothership has to be in control for the greater good. They also argue that enduser computers are already effectively "compromised" from a mozilla perspective because adware runs installers with admin privs and thus could insert things into the program folders. Thus anything the user can do adware could do too and therefore they can…

This sounds like a threat model and mitigation developed by a college intern.

How, exactly, is a user land application going to protect itself from modification by a computer admin? I think DRM, anti-virus, and os vendors everywhere would love an answer to this.

This threat model completely fails to account for live patching, trusted cert root modification, dll hooking, etc. Either the Mozilla security folks are incompetent / winging it, or this isn't the real reason.

Re: All extensions disabled due to expiration of intermediate signing cert

#820

Post by firefoxbetauser »

gpm wrote: post #728
igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

hmm, should it be installable by default, not only on the about:debugging page?
Post reply on HN