11 ms·
Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and p
by rmbryan 7y ago
Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.
- brador 7y agoWhat is Normandy?
- megous 7y agohttps://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout
- chinathrow 7y agoSo is that a backdoor into my prefs? How can I check if Normandy is active on my installation?
- verdandi 7y agoType about:config in the address bar and search for 'app.normandy.enabled' flag.
- DoctorOetker 7y agohere the flag is true but the extensions are still unsupported
- Yoric 7y agoIt may take a little time for the partial fix to be distributed.
- inferiorhuman 7y agoWell that's interesting. I see Normandy enabled, but if I go to the "Privacy and Security" section of the preferences page I see all the data collection and use stuff disabled. There's no obvious way to disable the Normandy back door. Oh well, at least we don't have another season of Mr Robot spam to look forward to.
- deleted 7y ago[deleted]
- AsyncAwait 7y ago> There's no obvious way to disable the Normandy back door. ??? It's a publicly documented feature with a publicly documented way to disable it.
- brynjolf 7y agoWith an obscure name and no correlation to all the other spying and backdoor ING Mozilla are doing. Is this really the best option tog etaprivacy focused browser? I think this is all very worrying.
- awful_waffle 7y agoCan you elaborate on what 'other spying' Mozilla does? Do you mean their telemetry?
- brynjolf 7y agoSpying was the wrong word. But yes, the telemetry. The google analytics that are hidden on the extensions page, that only listen to the Do not track, but not the turn off telemetry checkbox. Sadly it just doesn't seem to stop.
- fjsolwmv 7y agoIt's named after a world famous beachhead of an invasion. The name isn't that obscure for a feature that invades the userbase with a takeover.
- yabatopia 7y agoNot so in Firefox for Android. No normandy to find.
- megous 7y agoSomething with a public wiki page describing what it does exactly is hardly a backdoor. Also here's the code for the server: https://github.com/mozilla/normandy https://github.com/mozilla/normandy
- tssva 7y agoThe wiki entry evidently doesn't describe what it does because according to the wiki entry it allows for the enabling and disabling of preferences. The updating of a certificate is beyond what is described in the wiki. Mozilla should follow up with a post describing exactly how Normandy works and the full capabilities it gives them.
- megous 7y agoSo search elsewhere if you want more info. All code is available.
- tssva 7y agoUsers shouldn't have to search and then be able to understand the code found for such a feature. When a remote capability such as this exists it is Mozilla's responsibility to document how the feature works and the exact capabilities it gives them. Instead of doing so they have produced a wiki entry which appears to falsely describe the capabilities of this remote feature by stating it is used to change default preference values.
- deleted 7y ago[deleted]
- xvector 7y agoThanks. This must be terribly stressful to you.
- tripzilch 7y agoMeanwhile, having to browse the web without an adblocker has been nothing but relaxing for everybody else.
- conanbatt 7y agoThere is a before and after with adblockers. Its a real pity they are the worst privacy-vioolating tools ever.
- feanaro 7y ago> Its a real pity they are the worst privacy-vioolating tools ever. What do you mean?
- conanbatt 7y agoThey read your entire page content, they have access to all your information.
- feanaro 7y agoBut there are free software ad blockers like uBlock Origin.
- conanbatt 7y agoif uBlock got compromised as an extension even for 1 day, the amount and value of data uBlock can collect will make anyone very very rich. It's on the level of saving passwords as texts in terms of privacy.
- 7y ago
- LaurentD2 7y agoMeanwhile, as the "partial fix" is deployed, here is what I think fixed the issue for me: in the Preferences, under "Privacy & Security", check "Allow Firefox to install and run studies" (then wait for the current hotfixes to appear in about:studies then restart the browser).
- user17843 7y agoThanks! Do you know how many active users were affected by this certificate error and subsequent addon disabling? I guess most users were spared due to the timing and short duration of the error.
- IceWreck 7y agoTheir system runs a check every 24 hours. So a lot of users were affected. They've rolled out a partial fix via their Normandy thingy, and according to them it will fix the issue for most people over the next couple of hours.
- dageshi 7y agoIs it weird that this problem only happened to me (add ons all being disabled) roughly 10 minutes ago? I was browsing fine this morning for maybe four hours and now all my plugins/addons are gone.
- lawl 7y agoThe check is done every 24 hours and it seems for you these 24 hours were over roughly 10 minutes ago.
- db48x 7y agoNo, because the browser only checks for updates to your addons every day or so, not every five seconds.
- jwildeboer 7y agoNo. That’s not weird. The validity check runs once a day.
- inferiorhuman 7y agopushed it out to users via Normandy (this should be most users) Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? What about a UI knob to disable it?
- bo1024 7y agoAgree with this concern.
- daleharvey 7y ago> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout > What about a UI knob to disable it? app.normandy.enabled
- inferiorhuman 7y agoapp.normandy.enabled That is not what I meant by a UI knob, and I sure hope you knew that. By UI knob I mean something easily discoverable and self-explanatory. Rooting around a gated (with a mighty strong warning, I should add) config section for something called "normandy" is not intuitive, and it's not self-explanatory. And I sure hope that by disclosed to users I did not mean some Hitchhiker's Guide-esque disclaimer on a wiki page. Something as (potentially) insidious as a preferences backdoor should absolutely be disclosed to users with the same level of visibility as the stories nonsense. Perhaps "normandy" is entirely harmless, but you guys lost a metric fuckton of credibility by using your backdoors to spam people[1]. Playing coy does nothing to improve your credibility or reputation. 1: https://www.theregister.co.uk/2017/12/18/mozilla_mr_robot_firefox_promotion/ https://www.theregister.co.uk/2017/12/18/mozilla_mr_robot_fi...
- dbrgn 7y agoI'm sorry to break it to you, but a fuckton is not actually part of the metric system...
- DoctorOetker 7y agoI read at https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disabled-or-fail-to-install/39047/13 https://discourse.mozilla.org/t/certificate-issue-causing-ad... >12:50 p.m. UTC / 03:50 a.m. PDT: We rolled-out a fix for release, beta and nightly users. The fix will be automatically applied in the background within the next few hours, you don’t need to take active steps. >In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Preferences -> Privacy & Security -> Allow Firefox to install and run studies. >You can disable studies again after your add-ons have been re-enabled. >We are working on a general fix that doesn’t need to rely on this and will keep you updated. I refuse to enable studies, even temporarily. This comes very close after the IE6 conspiracy revelation, where ends justifies the means. Please provide a link to the certificate file, and step by step instructions for installing it, without enabling and conflating with mozilla studies...
- DangerousPie 7y ago> This comes very close after the IE6 conspiracy revelation, where ends justifies the means. What?!
- DoctorOetker 7y agoyou probably missed this story: https://news.ycombinator.com/item?id=19798678 https://news.ycombinator.com/item?id=19798678
- DangerousPie 7y agoI actually did read that story but I don't understand what that has to do with anything being discussed here. Yes, Youtube put up a banner asking IE6 users to move to a more modern browser 10 years ago. How is that in any way related to Firefox pushing a hotfix in 2019 to fix a certificate issue? Are you worried there is a big evil conspiracy to use this mechanism to uninstall Internet Explorer from peoples' computers?!
- 7y ago
- VMG 7y agosome info on the mozilla.org landing page would be useful
- Krasnol 7y agohttps://ftp.mozilla.org/pub/firefox/candidates/66.0.4-candidates/build1/ https://ftp.mozilla.org/pub/firefox/candidates/66.0.4-candid...
- tinus_hn 7y agoI don’t like you editing my preferences. How can I switch to this new certificate manually?
- alskdj21 7y agoI've deleted my extensions thinking it was the extensions' issue. I'm trying to download again but it's telling me I don't have internet connection. Any work-arounds?
- Kaladin 7y agohttps://www.reddit.com/r/firefox/comments/bkcjoa/all_of_my_addons_got_disabled_and_they_are_all/emggvbx/ https://www.reddit.com/r/firefox/comments/bkcjoa/all_of_my_a...
- neilv 7y agoI've been through all of Firefox `about:config` a few times in the past, fixing preferences to, e.g., try to disable umpteen different services that leak info or create potential vulnerabilities gratuitously, but this is the first I recall hearing of Normandy. Apparently I missed `app.normandy.enabled`, because I think I would've remembered a name with connotations of a bloody massive surprise attack. Incidentally, `app.normandy.enabled` defaults to `true` in the `firefox-esr` Debian Stable package. Which seems wrong for an ESR. For personal use (not development), I run 3 browsers (for features/configurations and an extra bit of compartmentalization): Tor Browser for most things, Firefox ESR with privacy tweaks for the small number of things that require login, and Chromium without much privacy tweaks for the rare occasion that a crucial site refuses to work with my TB or FF setup. Today's crucial cert administration oops, plus learning of yet another very questionable remote capability/vector, plus the questionable preferences-changing being enabled even for ESR... is making me even less comfortable with the Web browser standards "big moat" barrier to entry situation. I know Mozilla has some very forthright people, but I'd really like to see a conspicuous and pervasive focus on privacy&security, throughout the organization, which, at this point, would shake up a lot of things. Then, with the high ground established unambiguously, I'd like to see actively reversing some of the past surveillance&brochure tendencies in some standards. And also see some more creative approaches to what a browser can be, despite a hostile and exploitive environment. Or maybe Brave turns out to be a better vehicle for that, but I still want to believe in Mozilla.
- robolange 7y agoI too use Debian's Firefox ESR. I noticed the "Allow Firefox to install and run studies" option in Privacy & Security Preferences a long time ago. It was unchecked and greyed out (i.e., unclickable), and a label below it says "Data reporting is disabled for this build configuration", so I gave it no further thought. This morning I woke up and launched Firefox, noticed this headline, and then noticed my extensions were still running. I looked in about:config and lo and behold, app.normandy.enabled=default [true]. I'll be filing a bug with debian to disable this in the build configuration. Edit: There are some questions about whether Normandy is really enabled in Debian Firefox ESR even if the about:config setting defaults to true. I've filed a bug report, and I'm sure once a Debian maintainer has a chance to look at it we'll find out the answer. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928433 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928433 Edit2: It should go without saying, but please do not spam this bug report with "me too" and its ilk.
- yabatopia 7y agoHow do you enable Normandy on Firefox For Android? There's no Normandy in the about:config. This is such a gigantic mess, even for a very loyal Firefox user it's to swallow.
- jillesvangurp 7y agoIt seems to have worked. My extensions reappeared.
- deleted 7y ago[deleted]
- jwalton 7y agoI got the update through studies (I can see it in about:studies), but it didn't fix anything for me.
- tempodox 7y agoI still get “Download failed. Please check your connection” when attempting to re-download the add-on you took away without asking me. That thing was pretty much the only reason I used Firefox at all.
- guido_vongraum 7y agoWhat bothers me is the fact that everyone seems to be accepting the usage of these newspeakish romantically sounding euphemisms that are completely opaque about the purpose of things they stand for. "Normandy"... What is this - a place, a sort of champagne, a hotel or the internal name of some freaking area51 document?.. Like, "In order to disable Normandy, uncheck Vaduz, Monterrey, Vologda and select Newcastle in the Xinjang drop-down menu - we'll ship Bronx with next update".
- guido_vongraum 7y agoWhat bothers me is the fact that everyone seems to be accepting the usage of these newspeakish romantically sounding euphemisms that are completely opaque about the purpose of things they stand for. "Normandy"... What is this - a place, a sort of champagne, a hotel or the internal name of some freaking area51 document?.. Like, "In order to disable Normandy, uncheck Vaduz, Monterrey, Vologda and select Newcastle in the Xinjang drop-down menu - we'll ship Bronx with next update". P.S. Keep flagging, I'll repost, no problem.
- hanif184 7y agoHelp my business account
- hanif184 7y agoPayment method messenger all app link stor all removed link