5 ms·

Looks like all extensions have been disabled for all Firefox users. I think this fail-closed behavior is more of a security issue than the one it is trying to

Looks like all extensions have been disabled for all Firefox users. I think this fail-closed behavior is more of a security issue than the one it is trying to solve. All of my security add-ons - Privacy Badger, NoScript, Decentraleyes, and many more were disabled. Even worse, it happened without notice to the user. One moment I was browsing the internet (just barely) secured by these add-ons, and the next moment, all of them disappeared (without warning) and I only noticed when I saw my password manager was missing.

dontbenebby 8y ago
Mine still work. I tried to set my clock to two days ago to avoid it and promptly got errors on every HTTPS site I visited. Damned if you do, damned if you don't :/
stevenwliao 8y ago
If it failed open, anyone unlucky enough to update their extensions could end up having a malicious version installed. It also would have taken longer to notice.
- tedunangst 8y ago
  Updating with an expired cert doesn't automatically result in compromise.
  - Thorrez 8y ago
    Yes, but what's the point of cert expiration? Is it safe to have certs that never expire? I believe there is a security benefit to expiration. Expiration is useless if it's never enforced. Probably the correct behavior is to have some sort of semi-annoying popup when it expires, and then only a week later do the full blocking. You need to strike the right balance of making it annoying enough that it can't be ignored by everyone (otherwise you just have the exact same problem, just delayed a week) and that fear of it happening is a sufficient motivator to stop people lazily relying on the grace period, but also not too annoying that it makes a lot of people quit. You also want to avoid permission fatigue.
- Causality1 8y ago
  So why not just disable extension updates instead of disabling the extensions themselves?
  - anfilt 8y ago
    because that would make too much sense.
  - ssadler 8y ago
    Presumably because how would it differentiate between a legit "already installed" extension with a signature that cannot be verified, and an extension installed by malware that also cannot be verified?
    - Causality1 8y ago
      Personally I despise the idea of the software already on my pc being dependent on signatures stored on a remote server. I installed it and Mozilla can fuck right off. It's my responsibility to police what software is on my computer, not theirs.
      - cesarb 8y ago
        According to https://news.ycombinator.com/item?id=19824520 https://news.ycombinator.com/item?id=19824520 the signatures are on the extensions themselves, not on a remote server.
    - Thorrez 8y ago
      Browsers can only protect against malicious websites and malicious extensions. They can't protect against malware. Even without any cert problems, malware on your machine can modify the browser executable/process to insert whatever code it wants. With this reduced threat model, it's easy to simply keep existing pre-installed extensions available, and disable updates. Your only problem is if a pre-installed extension is malicious or has a vulnerability, it will remain.
    - josteink 8y ago
- xvector 8y ago
  This disables NoScript on Tor Browser. That's much worse than the slim chance of a malicious extension being installed.
- swalladge 8y ago
  It should fail 'locked'. continue to allow installed addons to work, notify the user of issue, disable any updates without explicit request by the user.
meruru 8y ago
A warning yellow bar appeared for me below the URL bar.
deleted 8y ago
[deleted]
vladus2000 8y ago
It wasn't quite all for me, it left 3 of the 20ish I have installed.
jillesvangurp 8y ago
It's a great argument against centrally controlled walled gardens. Basically breaking or compromising a single certificate has a widespread impact. Even Tor browser is impacted. For most of us this is a temporary inconvenience but there are people whose personal security depends on some of the extensions that just stopped working. On a positive note, it's been a while since I browsed without a lot of extensions. Ads are still annoying and I noticed some extensions apparently had more of a performance impact than you'd hope.

dontbenebby 8y ago

Mine still work. I tried to set my clock to two days ago to avoid it and promptly got errors on every HTTPS site I visited. Damned if you do, damned if you don't :/

stevenwliao 8y ago

If it failed open, anyone unlucky enough to update their extensions could end up having a malicious version installed. It also would have taken longer to notice.

tedunangst 8y ago
Updating with an expired cert doesn't automatically result in compromise.
- Thorrez 8y ago
  Yes, but what's the point of cert expiration? Is it safe to have certs that never expire? I believe there is a security benefit to expiration. Expiration is useless if it's never enforced. Probably the correct behavior is to have some sort of semi-annoying popup when it expires, and then only a week later do the full blocking. You need to strike the right balance of making it annoying enough that it can't be ignored by everyone (otherwise you just have the exact same problem, just delayed a week) and that fear of it happening is a sufficient motivator to stop people lazily relying on the grace period, but also not too annoying that it makes a lot of people quit. You also want to avoid permission fatigue.
Causality1 8y ago
So why not just disable extension updates instead of disabling the extensions themselves?
- anfilt 8y ago
  because that would make too much sense.
- ssadler 8y ago
  Presumably because how would it differentiate between a legit "already installed" extension with a signature that cannot be verified, and an extension installed by malware that also cannot be verified?
  - Causality1 8y ago
    Personally I despise the idea of the software already on my pc being dependent on signatures stored on a remote server. I installed it and Mozilla can fuck right off. It's my responsibility to police what software is on my computer, not theirs.
    - cesarb 8y ago
      According to https://news.ycombinator.com/item?id=19824520 https://news.ycombinator.com/item?id=19824520 the signatures are on the extensions themselves, not on a remote server.
  - Thorrez 8y ago
    Browsers can only protect against malicious websites and malicious extensions. They can't protect against malware. Even without any cert problems, malware on your machine can modify the browser executable/process to insert whatever code it wants. With this reduced threat model, it's easy to simply keep existing pre-installed extensions available, and disable updates. Your only problem is if a pre-installed extension is malicious or has a vulnerability, it will remain.
  - josteink 8y ago
xvector 8y ago
This disables NoScript on Tor Browser. That's much worse than the slim chance of a malicious extension being installed.
swalladge 8y ago
It should fail 'locked'. continue to allow installed addons to work, notify the user of issue, disable any updates without explicit request by the user.

meruru 8y ago

A warning yellow bar appeared for me below the URL bar.

deleted 8y ago

[deleted]

vladus2000 8y ago

It wasn't quite all for me, it left 3 of the 20ish I have installed.

jillesvangurp 8y ago

It's a great argument against centrally controlled walled gardens. Basically breaking or compromising a single certificate has a widespread impact. Even Tor browser is impacted. For most of us this is a temporary inconvenience but there are people whose personal security depends on some of the extensions that just stopped working. On a positive note, it's been a while since I browsed without a lot of extensions. Ads are still annoying and I noticed some extensions apparently had more of a performance impact than you'd hope.