All extensions disabled due to expiration of intermediate signing cert • Hacker News Board

Re: All extensions disabled due to expiration of intermediate signing cert

#851

Post by DamienBourg » Sat, May 04, 2019, 7:56 PM UTC

gpm wrote: post #838

DamienBourg wrote: post #836

Earlier quoted context omitted.

Thks, it worked, I installed the fix. But do I have to uninstall the .xpi after? And how? Also, my addons are back, but I still have the error message (see screenshot: http://i.imgur.com/t1wb316.png ) Also do I still have to allow the "allow firefow to install and run studies"? Thks.

I don't see any reason that you need to uninstall the .xpi, but you might as well. See here (hoping someone replies there with a better method of uninstalling, my method is a bad hack) https://news.ycombinator.com/item?id=19827428 You don't need to allow firefox to install and run studies, that's just a way of letting firefox automatically install this xpi. Did that error message only appear after you installed the .…

"If it appeared when the addons were initially disabled it's not an issue at all, it's just that nothing closed it.

Yes, it appeared when the addons were initially disabled.

Re: All extensions disabled due to expiration of intermediate signing cert

#852

Post by the8472 » Sat, May 04, 2019, 7:57 PM UTC

lordlimecat wrote: post #819

the8472 wrote: post #645

Earlier quoted context omitted.

Because (stable) users are dumb, are easily manipulated and can't be trusted. Thus the mothership has to be in control for the greater good. They also argue that enduser computers are already effectively "compromised" from a mozilla perspective because adware runs installers with admin privs and thus could insert things into the program folders. Thus anything the user can do adware could do too and therefore they can…

This sounds like a threat model and mitigation developed by a college intern. How, exactly, is a user land application going to protect itself from modification by a computer admin? I think DRM, anti-virus, and os vendors everywhere would love an answer to this. This threat model completely fails to account for live patching, trusted cert root modification, dll hooking, etc. Either the Mozilla security folks are inco…

Here's the official reason in case you don't trust my grim representation of it: https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte...

Re: All extensions disabled due to expiration of intermediate signing cert

#853

Post by afiori » Sat, May 04, 2019, 8:10 PM UTC

hedora wrote: post #746

taneq wrote: post #686

Earlier quoted context omitted.

> So I could effectively get rewarded, for always keeping a security hole open. That's the way it always works, isn't it? Security and convenience are opposing concerns.

Good security designs increase convenience (eg ssh, touch id, single sign on). The three goals of computer security are integrity, confidentiality and availability. All three of those expand the usefulness of the system to the end user.

But the point here is not about integrity, confidentiality, or availability. It is about whether you trust Mozilla, and how much trustworthy they are.

A configuration where Mozilla cannot push remote updates is neither more secure nor less secure. Mozilla is often under fire for not allowing a privacy conscious, minimal trust use case.

Re: All extensions disabled due to expiration of intermediate signing cert

#854

Post by mrgriffin » Sat, May 04, 2019, 8:24 PM UTC

gpm wrote: post #728

igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Thanks for this! My NixOs build of Firefox was apparently built without support for studies, but your link worked fine.

Re: All extensions disabled due to expiration of intermediate signing cert

#855

Post by [deleted] » Sat, May 04, 2019, 8:31 PM UTC

gpm wrote: post #571

nanis wrote: post #563

Earlier quoted context omitted.

> The UI knob is > Options -> Privacy & Security > Allow Firefox to install and run studies That is not true. I've had that disabled forever Despite that, when I went into about:config, app.normandy.enabled was set to true, and app.normandy.user_id was defined. So, overnight Firefox decides it won't let me use uBlock Origin any more and now I find out all my browsing history has been logged to Firefox servers. All of…

I'm nearly certain Normandy does not log all of your browsing history for what it's worth. I agree Mozilla approach to stuff like this is... less than ideal.

[deleted]

Re: All extensions disabled due to expiration of intermediate signing cert

#856

Post by scottcruss » Sat, May 04, 2019, 8:34 PM UTC

Temporary fix without enabling feedback to Mozilla.

Open the address about:config in the Tor Browser address bar At the top of the page, search for xpinstall.signatures.required Set the xpinstall.signatures.requiredentry to false by double clicking it

Note: This workaround should only be used temporarily, as it disables a security feature. Please remember to set the xpinstall.signatures.requiredentry back to true again once the Tor Browser security update is applied.

Re: All extensions disabled due to expiration of intermediate signing cert

#857

Post by jcoffland » Sat, May 04, 2019, 8:39 PM UTC

gpm wrote: post #728

igivanov wrote: post #724

Earlier quoted context omitted.

TypeError: Components.utils is undefined[Learn More] what did I do wrong? (It's all Greek to me)

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Installing hotfix-update-xpi-intermediate@mozilla.com-1.0.2-signed.xpi on firefox-esr 60.6.1esr-1 in Debian did not work for me.

Re: All extensions disabled due to expiration of intermediate signing cert

#858

Post by xvector » Sat, May 04, 2019, 8:52 PM UTC

tripzilch wrote: post #532

xvector wrote: post #523

Earlier quoted context omitted.

Thanks. This must be terribly stressful to you.

Meanwhile, having to browse the web without an adblocker has been nothing but relaxing for everybody else.

Sorry, the stress someone on the Firefox team must be experiencing would easily be magnitudes beyond what we are.

Re: All extensions disabled due to expiration of intermediate signing cert

#859

Post by gpm » Sat, May 04, 2019, 8:52 PM UTC

jcoffland wrote: post #857

gpm wrote: post #728

Earlier quoted context omitted.

What version of firefox are you running? Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`. But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. Y…

Installing hotfix-update-xpi-intermediate@mozilla.com-1.0.2-signed.xpi on firefox-esr 60.6.1esr-1 in Debian did not work for me.

I think restarting firefox after installing it should make it work with esr.

Re: All extensions disabled due to expiration of intermediate signing cert

#860

Post by BlackPlatypus » Sat, May 04, 2019, 9:22 PM UTC

gpm wrote: post #227

To re-enable all disabled non-system addons you can do the following. I am not responsible if this fucks up your install: Open the browser console by hitting ctrl-shift-j Copy and paste the following code, hit enter. Until mozilla fixes the problem you will need to redo this once every 24 hours: // Re-enable *all* extensions async function set_addons_as_signed() { Components.utils.import("resource://gre/modules/addon…

This does not work for FF versions older than v57.

I use v56.0.2 because that was the last time we actually got to customize the browser (yes, boo me for using an old version).

So I dug around a little (okay, a lot) and worked out a solution for v Version for FF v

  // For FF ...?
  async function set_addons_as_signed() {
      Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm");
      Components.utils.import("resource://gre/modules/AddonManager.jsm");
      let XPIDatabase = this.XPIInternal.XPIDatabase;
      
      let addons = await XPIDatabase.getAddonList(a => true);
  
      for (let addon of addons) {
          // The add-on might have vanished, we'll catch that on the next startup
          if (!addon._sourceBundle.exists())
              continue;
  
          if( addon.signedState != AddonManager.SIGNEDSTATE_UNKNOWN )
              continue;
  
          addon.signedState = AddonManager.SIGNEDSTATE_NOT_REQUIRED;
          AddonManagerPrivate.callAddonListeners("onPropertyChanged",
                                                  addon.wrapper,
                                                  ["signedState"]);
  
          await XPIProvider.updateAddonDisabledState(addon);
  
      }
      XPIDatabase.saveChanges();
  }
  
  set_addons_as_signed();

Please let me know which versions are compatible, and where it breaks down!
Don't forget to enable devtools.chrome.enabled in about:config and use the actual browser console, not the web console

Permalink View on HN Reply on HN Top