8 ms·

I read at https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disabled-or-fail-to-install/39047/13 https://discourse.mozilla.org/t/certifica

I read at https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disabled-or-fail-to-install/39047/13 https://discourse.mozilla.org/t/certificate-issue-causing-ad... >12:50 p.m. UTC / 03:50 a.m. PDT: We rolled-out a fix for release, beta and nightly users. The fix will be automatically applied in the background within the next few hours, you don’t need to take active steps. >In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Preferences -> Privacy & Security -> Allow Firefox to install and run studies. >You can disable studies again after your add-ons have been re-enabled. >We are working on a general fix that doesn’t need to rely on this and will keep you updated. I refuse to enable studies, even temporarily. This comes very close after the IE6 conspiracy revelation, where ends justifies the means. Please provide a link to the certificate file, and step by step instructions for installing it, without enabling and conflating with mozilla studies...

DangerousPie 8y ago
> This comes very close after the IE6 conspiracy revelation, where ends justifies the means. What?!
- DoctorOetker 8y ago
  you probably missed this story: https://news.ycombinator.com/item?id=19798678 https://news.ycombinator.com/item?id=19798678
  - DangerousPie 8y ago
    I actually did read that story but I don't understand what that has to do with anything being discussed here. Yes, Youtube put up a banner asking IE6 users to move to a more modern browser 10 years ago. How is that in any way related to Firefox pushing a hotfix in 2019 to fix a certificate issue? Are you worried there is a big evil conspiracy to use this mechanism to uninstall Internet Explorer from peoples' computers?!
    - flizzers 8y ago
      Okay, so, youtube targets a small subset of users, and changes their experience capriciously, and to suit their own purposes. Firefox, it turns out, has a built-in telemetry system that defaults to enable exactly the same behavior: changing your system, to suit their desires. You’re words “a big evil conspiracy to use this mechanism to uninstall Internet Explorer from peoples' computer” are misleading. No one would propose that the intent is an attack on Microsoft applications. Rather, the intent is to blindfold users on a whim, should a Firefox component prove inconvenient to the providers of Firefox. Ostensibly, in the event that some add-on or extension threatens the bottom line for major backers of Firefox’s funding.
      - dralley 8y ago
        > Firefox, it turns out, has a built-in telemetry system that defaults to enable exactly the same behavior: changing your system, to suit their desires. An example of the typical use of this system: say Mozilla wants to enable video hardware acceleration in Firefox but they don't know if bugs in video drivers or in Firefox will make crashing more frequent. So they enable hardware acceleration for 1% of users instead of 100% and compare the reported crash rate between the two to determine if it's ready to be pushed out universally.
        betterunix2 8y ago
        At some point in the next five-ten years we will see this "feature" abused. Maybe Mozilla will use it to "soften" commonly used ad blockers to enable "acceptable" ads for Firefox users. Maybe Mozilla will be hacked by some government that wants to enable MITM attacks against its citizens, and Normandy will make that happen. Or maybe Mozilla will just cooperate with the government trying to do so. You say it is "typically" used for benevolent purposes, but why should we trust Mozilla? Mozilla does not have a stellar history with this sort of thing and in my experience they do not take security as seriously as they should if we are to trust them with such a feature.
        Certhas 8y ago
Vinnl 8y ago
The last sentence you quoted literally said that they will provide you with the option to fix this without needing to enable studies.
- DoctorOetker 8y ago
  correct, and I am emphasizing and pointing out my choice to wait such that others can make the same informed choice if they so wish. (I would have wanted to read my comment if someone else had written it, so by the golden rule I make the comment I wish I had read)
XORcat 8y ago
JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_signature_hotfix.json https://xor.cat/assets/other/random/2019-05-04/normandy_sign... hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... From the looks, it installs the above plugin, and changes `app.update.lastUpdateTime.xpi-signature-verification` to `1556945257` I can't get it to work in ESR 60 though. Getting file not found on "resource://gre/modules/addons/XPIDatabase.jsm" edit: The linked XPI definitely seems to add the new certificate, whatever mechanism used to reverify the signatures just doesn't seem to work in 60. edit2: Restarting Firefox appears to have forced the reverify... Possibly a flag that I twiddled with though, hard to be sure. Either way, the above should help people get everything running again without having to enable studies/normandy.
- rndgermandude 8y ago
  Yes, this is broken on ESR, but only somewhat broken. The hotfix extension does two things: 1) Install a new certificate for "CN=signingca1.addons.mozilla.org/emailAddress=foxsec@mozilla.com", effectively replacing the old certificate that expired. This should work. 2) Then it tries to import the internal "resource://gre/modules/addons/XPIDatabase.jsm" module and calls XPIDatabase.verifySignatures(). This does not work on ESR, as "XPIDatabase.jsm" is a new-ish thing that isn't present in ESR yet. In ESR the function is still in "resource://gre/modules/addons/XPIProvider.jsm" (XPIProvider.verifySignatures()). Thankfully, the non-existing module is imported using ChromeUtils.defineModuleGetter, which only lazily loads the module on first of the imported property, so after the certificate-adding code has run.
- gpm 8y ago
  Hey, if you just click on that storage.googleapis.com link it installs the hotfix directly without having to enable normandy ;)
  - option_greek 8y ago
    This should be sticky comment somewhere on the top of the comments. It bought all the addons back for me.

DangerousPie 8y ago

> This comes very close after the IE6 conspiracy revelation, where ends justifies the means. What?!

DoctorOetker 8y ago
you probably missed this story: https://news.ycombinator.com/item?id=19798678 https://news.ycombinator.com/item?id=19798678
- DangerousPie 8y ago
  I actually did read that story but I don't understand what that has to do with anything being discussed here. Yes, Youtube put up a banner asking IE6 users to move to a more modern browser 10 years ago. How is that in any way related to Firefox pushing a hotfix in 2019 to fix a certificate issue? Are you worried there is a big evil conspiracy to use this mechanism to uninstall Internet Explorer from peoples' computers?!
  - flizzers 8y ago
    Okay, so, youtube targets a small subset of users, and changes their experience capriciously, and to suit their own purposes. Firefox, it turns out, has a built-in telemetry system that defaults to enable exactly the same behavior: changing your system, to suit their desires. You’re words “a big evil conspiracy to use this mechanism to uninstall Internet Explorer from peoples' computer” are misleading. No one would propose that the intent is an attack on Microsoft applications. Rather, the intent is to blindfold users on a whim, should a Firefox component prove inconvenient to the providers of Firefox. Ostensibly, in the event that some add-on or extension threatens the bottom line for major backers of Firefox’s funding.
    - dralley 8y ago
      > Firefox, it turns out, has a built-in telemetry system that defaults to enable exactly the same behavior: changing your system, to suit their desires. An example of the typical use of this system: say Mozilla wants to enable video hardware acceleration in Firefox but they don't know if bugs in video drivers or in Firefox will make crashing more frequent. So they enable hardware acceleration for 1% of users instead of 100% and compare the reported crash rate between the two to determine if it's ready to be pushed out universally.
      - betterunix2 8y ago
        At some point in the next five-ten years we will see this "feature" abused. Maybe Mozilla will use it to "soften" commonly used ad blockers to enable "acceptable" ads for Firefox users. Maybe Mozilla will be hacked by some government that wants to enable MITM attacks against its citizens, and Normandy will make that happen. Or maybe Mozilla will just cooperate with the government trying to do so. You say it is "typically" used for benevolent purposes, but why should we trust Mozilla? Mozilla does not have a stellar history with this sort of thing and in my experience they do not take security as seriously as they should if we are to trust them with such a feature.
        Certhas 8y ago

Vinnl 8y ago

The last sentence you quoted literally said that they will provide you with the option to fix this without needing to enable studies.

DoctorOetker 8y ago
correct, and I am emphasizing and pointing out my choice to wait such that others can make the same informed choice if they so wish. (I would have wanted to read my comment if someone else had written it, so by the golden rule I make the comment I wish I had read)

XORcat 8y ago

JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_signature_hotfix.json https://xor.cat/assets/other/random/2019-05-04/normandy_sign... hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... From the looks, it installs the above plugin, and changes `app.update.lastUpdateTime.xpi-signature-verification` to `1556945257` I can't get it to work in ESR 60 though. Getting file not found on "resource://gre/modules/addons/XPIDatabase.jsm" edit: The linked XPI definitely seems to add the new certificate, whatever mechanism used to reverify the signatures just doesn't seem to work in 60. edit2: Restarting Firefox appears to have forced the reverify... Possibly a flag that I twiddled with though, hard to be sure. Either way, the above should help people get everything running again without having to enable studies/normandy.

rndgermandude 8y ago
Yes, this is broken on ESR, but only somewhat broken. The hotfix extension does two things: 1) Install a new certificate for "CN=signingca1.addons.mozilla.org/emailAddress=foxsec@mozilla.com", effectively replacing the old certificate that expired. This should work. 2) Then it tries to import the internal "resource://gre/modules/addons/XPIDatabase.jsm" module and calls XPIDatabase.verifySignatures(). This does not work on ESR, as "XPIDatabase.jsm" is a new-ish thing that isn't present in ESR yet. In ESR the function is still in "resource://gre/modules/addons/XPIProvider.jsm" (XPIProvider.verifySignatures()). Thankfully, the non-existing module is imported using ChromeUtils.defineModuleGetter, which only lazily loads the module on first of the imported property, so after the certificate-adding code has run.
gpm 8y ago
Hey, if you just click on that storage.googleapis.com link it installs the hotfix directly without having to enable normandy ;)
- option_greek 8y ago
  This should be sticky comment somewhere on the top of the comments. It bought all the addons back for me.