4 ms·

So you think Mozilla is enjoying this right now? And that this is going to help the perception and market share of Firefox? Hypothetically, lets say they took

So you think Mozilla is enjoying this right now? And that this is going to help the perception and market share of Firefox? Hypothetically, lets say they took the opposite approach, and only checked the certificate date on installation. What would have happened? There would have been a brief period of time where people couldn't install extensions, it would have been fixed in a few hours, and this story would probably have like 20 upvotes and fallen off the front page in like 10 minutes, if it ever got there in the first place. Now let's briefly look at what's actually taking place: a bunch of people's browsers broke. It broke in scary ways for some people that were using extensions for privacy; IE, their security might have been compromised by this decision by Mozilla. Mozilla is probably going to lose users over this. Their reputation is damaged. Not only that, but now people are evaluating other decisions that Mozilla has made separately from this in an unfavorable light (Studies and Normandy, specifically). The computing industry loses out on this too: we're all better off for chrome having a viable open source competitor. We should want Mozilla to do well, whether you use their browser or not. Which outcome do you think Mozilla engineers would be preferring today?

Fnoord 8y ago
You are putting words in my mouth, please stop that. Instead of disabling this historically working feature which normally works great against hostile attacks such as MITM and malware this problem would've been avoided by a simple cron script which runs daily, and checks for expired certificates used within the infrastructure (both interaly used and externally used). The main competitor you mention, Google Chrome, is a terrible privacy hazard. This situation does not change that.
- overgard 8y ago
  I'm not putting words in your mouth, you literally said this is a "Good Thing (tm)", because of hypothetical security reasons. Whereas I'm literally saying that this actually broke real privacy extensions, broke peoples software, and badly damaged their reputation. As to your argument about security: doing the check on install instead of all the time, as I suggest is preferable, still protects against MITM and malware. The only argument for expiring software based on a calendar is that it might be a security risk if it's out of date. But first off, that is highly dependent on what the extension actually does. Also clearly we can see it's also a security risk to turn off privacy extensions without warning based on an arbitrary signing certificate.
  - Fnoord 8y ago
    Things might change after install. Its a Good Thing (tm) to periodically recheck, or check revocations. > > I'm not putting words in your mouth [..] Yes, you did: > "So you think [..]"
    - overgard 8y ago
      > Yes, you did: >> "So you think [..]" Um, I ended that sentence with a question mark. Implying a question. But you conveniently left that out of your quote, so amusingly now you're putting words in my mouth. (Although who cares? I don't!) Maybe I should have phrased it "So do you think" but it would have essentially been the same sentence and typing on my ipad is annoying. I was asking you if you thought this was a good thing for Mozilla. Which you dodged to turn this into a debate about proper etiquette instead of answering the question directly. It was a leading question, sure, but I was making a point.
      - Fnoord 8y ago
        What about the first part I wrote? Do you find CRL a useful feature in CAs/WoTs?
owl57 8y ago
Not only that, but now people are evaluating other decisions that Mozilla has made separately from this in an unfavorable light (Studies and Normandy, specifically). Sounds like a good thing. Probably sounds like a good thing to some of the engineers at Mozilla. The computing industry loses out on this too: we're all better off for chrome having a viable open source competitor. I want a free competitor, not an open source one. And this is the most prominent example of that somewhat subtle distinction: Firefox is open source, but with all these backdoors it's no longer free, neither in spirit nor in practice. P.S. On the other hand, it's probably indeed better to have at least two serious competing browsers, even if they are both non-free.
- overgard 8y ago
  I do agree; although, it would have been nice for this discussion to come up without things breaking like this.

Fnoord 8y ago

You are putting words in my mouth, please stop that. Instead of disabling this historically working feature which normally works great against hostile attacks such as MITM and malware this problem would've been avoided by a simple cron script which runs daily, and checks for expired certificates used within the infrastructure (both interaly used and externally used). The main competitor you mention, Google Chrome, is a terrible privacy hazard. This situation does not change that.

overgard 8y ago
I'm not putting words in your mouth, you literally said this is a "Good Thing (tm)", because of hypothetical security reasons. Whereas I'm literally saying that this actually broke real privacy extensions, broke peoples software, and badly damaged their reputation. As to your argument about security: doing the check on install instead of all the time, as I suggest is preferable, still protects against MITM and malware. The only argument for expiring software based on a calendar is that it might be a security risk if it's out of date. But first off, that is highly dependent on what the extension actually does. Also clearly we can see it's also a security risk to turn off privacy extensions without warning based on an arbitrary signing certificate.
- Fnoord 8y ago
  Things might change after install. Its a Good Thing (tm) to periodically recheck, or check revocations. > > I'm not putting words in your mouth [..] Yes, you did: > "So you think [..]"
  - overgard 8y ago
    > Yes, you did: >> "So you think [..]" Um, I ended that sentence with a question mark. Implying a question. But you conveniently left that out of your quote, so amusingly now you're putting words in my mouth. (Although who cares? I don't!) Maybe I should have phrased it "So do you think" but it would have essentially been the same sentence and typing on my ipad is annoying. I was asking you if you thought this was a good thing for Mozilla. Which you dodged to turn this into a debate about proper etiquette instead of answering the question directly. It was a leading question, sure, but I was making a point.
    - Fnoord 8y ago
      What about the first part I wrote? Do you find CRL a useful feature in CAs/WoTs?

owl57 8y ago

Not only that, but now people are evaluating other decisions that Mozilla has made separately from this in an unfavorable light (Studies and Normandy, specifically). Sounds like a good thing. Probably sounds like a good thing to some of the engineers at Mozilla. The computing industry loses out on this too: we're all better off for chrome having a viable open source competitor. I want a free competitor, not an open source one. And this is the most prominent example of that somewhat subtle distinction: Firefox is open source, but with all these backdoors it's no longer free, neither in spirit nor in practice. P.S. On the other hand, it's probably indeed better to have at least two serious competing browsers, even if they are both non-free.

overgard 8y ago
I do agree; although, it would have been nice for this discussion to come up without things breaking like this.