Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

821–830 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#821

Post by Alphos2000 »

gpm wrote: post #807
Alphos2000 wrote: post #804

Earlier quoted context omitted.

Nothing happens for me once installed in firefox 55.0.3 32bits. Can't activate my addons.

That's a really old version of firefox, probably an API has changed with my workaround. I know of an API change that means the official hotfix won't work (whether you install it my bootleg way or the official studies way). My recommendation is to upgrade your firefox version.

The reason I don't want to upgrade is because I don't want to lose all my legacy addons, a lot of them dissapeared and there are no alternatives. I can't understand how Mozilla can break my browser remotely and force me tu upgrade to a more restricted browser...

Re: All extensions disabled due to expiration of intermediate signing cert

#822

Post by devcpp »

gpm wrote: post #704
XORcat wrote: post #592

Earlier quoted context omitted.

JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_sign... hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... From the looks, it installs the above plugin, and changes `app.update.lastUpdateTime.xpi-signature-verification` to `1556945257` I can't get it to work in ESR 60 though. Getting file not found on…

Hey, if you just click on that storage.googleapis.com link it installs the hotfix directly without having to enable normandy ;)

I just installed some random googleapis link. This is so stupid, and very disappointing from Mozilla.

Re: All extensions disabled due to expiration of intermediate signing cert

#823

Post by lordlimecat »

TazeTSchnitzel wrote: post #670
johnsea wrote: post #640

Earlier quoted context omitted.

Why does Mozilla do this? Same with removing the option to not update. Why not let users choose (in the case of update maybe with an about config setting)?

Because they don't want trojans to hijack the browser. If the user can change the signing preference, any application can.

It is not possible for a user land application to prevent root processes from hijacking / modifying it. Such protection requires the protecting mechanism to run at a higher level of trust / security ring than the attacker.

Re: All extensions disabled due to expiration of intermediate signing cert

#824

Post by gpm »

firefoxbetauser wrote: post #820
gpm wrote: post #728

Earlier quoted context omitted.

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

hmm, should it be installable by default, not only on the about:debugging page?

It was for me, literally just had to click on the link, and then "Ok" on the "do you want to install this" dialogue that popped up. Not sure if firefox beta would be different.

Re: All extensions disabled due to expiration of intermediate signing cert

#825

Post by ihoonte »

gpm wrote: post #812
ihoonte wrote: post #809

Earlier quoted context omitted.

Ah okay yeah I set it to true, default was false. Error is connection failure (same error as for the add-ons)

Not sure what would be causing a connection failure. I just verified that the link is still up for me, and obviously you have an internet connection if you're replying to me. You're not behind a firewall that might be blocking it are you? E.g. being in China?

No, not in China, no firewall. Thanks for reaching out & your suggestions though!

Re: All extensions disabled due to expiration of intermediate signing cert

#826

Post by devcpp »

megous wrote: post #703
greendestiny_re wrote: post #622

Earlier quoted context omitted.

All code is available – as a tar.xzipped archive of Firefox source code containing over 150k files and measuring over 1GB in size when unpacked.

grep -iR normandy I expect code related to normandy to be ~1k LOC in size and probably written in JS. I haven't checked though, because I don't really care today.

And you shouldn't have to care. No one should. The very fact that this exists and that we are expected to trust it is very disappointing.

Re: All extensions disabled due to expiration of intermediate signing cert

#827

Post by gpm »

Alphos2000 wrote: post #821
gpm wrote: post #807

Earlier quoted context omitted.

That's a really old version of firefox, probably an API has changed with my workaround. I know of an API change that means the official hotfix won't work (whether you install it my bootleg way or the official studies way). My recommendation is to upgrade your firefox version.

The reason I don't want to upgrade is because I don't want to lose all my legacy addons, a lot of them dissapeared and there are no alternatives. I can't understand how Mozilla can break my browser remotely and force me tu upgrade to a more restricted browser...

Mozilla didn't really "break your browser remotely", it's more like there was a time bomb included that just went off.

If you try hard enough you can probably fix your browser, unpack the .xpi (it's just a zip), look at the source in experiments/skeleton, and try to figure out how to run something similar in the browser console.

But I really can't recommend doing this, I appreciate it's painful, but what you're running right now is massively insecure, there are published exploits. You're just asking for viruses by interacting with the internet using something that old.

Re: All extensions disabled due to expiration of intermediate signing cert

#828

Post by gpm »

ipatmos wrote: post #782
gpm wrote: post #227

To re-enable all disabled non-system addons you can do the following. I am not responsible if this fucks up your install: Open the browser console by hitting ctrl-shift-j Copy and paste the following code, hit enter. Until mozilla fixes the problem you will need to redo this once every 24 hours: // Re-enable *all* extensions async function set_addons_as_signed() { Components.utils.import("resource://gre/modules/addon…

I used this code and it worked. However, I just received Mozilla fix. Do I need to now delete this code from the browser console?

No, the mozilla fix should have wiped out everything this did.

Edit: I.e. you're good to go.

Re: All extensions disabled due to expiration of intermediate signing cert

#829

Post by ConeBone »

gpm wrote: post #728
igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Thank you for sharing this. It worked fine.

Couple of questions, where does this fix appear? I can't see it under addons or studies.

Will we be able to uninstall once a proper general fix has been released?

Re: All extensions disabled due to expiration of intermediate signing cert

#830

Post by arrivance »

gpm wrote: post #812
ihoonte wrote: post #809

Earlier quoted context omitted.

Ah okay yeah I set it to true, default was false. Error is connection failure (same error as for the add-ons)

Not sure what would be causing a connection failure. I just verified that the link is still up for me, and obviously you have an internet connection if you're replying to me. You're not behind a firewall that might be blocking it are you? E.g. being in China?

I can report a connection failure while being on a unrestricted connection (University internet in the UK).
Post reply on HN