3 ms·

And their telemetry needs are superior to the actual privacy at stake here? And they are now providing an updated version of Firefox that merely flip-flops on t

And their telemetry needs are superior to the actual privacy at stake here? And they are now providing an updated version of Firefox that merely flip-flops on the protection, instead of providing a message "hey, you're being intercepted"? I'm not naive, but I still think it's only to prudent to point out how ridiculous this sounds. In any case, it seems like Mozilla needs a bit of Skype-magic for their update process. Relying on the very thing you are patching with every minor version seems silly regardless.

pfg 11y ago
"Breaking" the browser for a large number of users will only lead to one thing: Users switching to a browser that still supports SHA-1 certs issued after Jan 1st, 2016. No privacy improvement there either. Additionally, there are many valid use-cases for replacing certificates, e.g. corporate proxies. They should just stop using outdated hashing algorithms for those certs. It's not Mozilla's place to decide whether that use-case is valid or not. SHA-1 was never fully disabled; it's just that certificates using SHA-1 issued after that date weren't accepted anymore. Telemetry is important to understand the ramifications of this issue. This change is likely to be reverted once Mozilla understands the implications. Take a look at the discussion on Mozilla's mailing list for more insight into their thinking[1]. [1]: https://groups.google.com/forum/#!topic/mozilla.dev.platform/ZNKxYgIk_Sg https://groups.google.com/forum/#!topic/mozilla.dev.platform...
rcthompson 11y ago
I think the idea is to first revert to a state where people behind this MITM boxes can receive updates to firefox, and then decide how to handle things from there.