4 ms·

hmm, i don't seem to have been affected by this bug somehow (my extensions are all still working). i turn off as much phoning home as i can (including turning s

hmm, i don't seem to have been affected by this bug somehow (my extensions are all still working). i turn off as much phoning home as i can (including turning studies off) and block connections to *.services.mozilla.com any idea why i might not be affected? it may help others who might want to retain control of their firefox browser (chromium-based browsers being non-sequiturs).

kermitismyhero 8y ago
It was the same for me. Firefox 66.0.3 on Xubuntu 19.04. I also turn off a lot of phone-home behaviour. And I never had any problems with extensions getting disabled. I have no idea why I wasn't affected. But frankly, "not being affected" isn't good enough for me. Even if I dodged this bullet I might not dodge the next. I'm looking for an alternative browser. Falkon has been interesting so far. It's a little bare-bones in many ways, but at least it's immunue to any future Mozilla screwups.
- Gene_Parmesan 8y ago
  One screwup is enough for you to jump ship? Or have there been others? (I'm genuinely curious, not trying to be aggressive.) I personally don't think all this talk of "Bye-bye firefox" is quite fair (I'm referring to a number of comments on this page, not yours specifically). In my opinion (you may disagree), Mozilla is one of our best and strongest allies in the fight for a fair internet. Their values matter because they still have the user base to back them up. If all of us technical-minded folk jump ship to smaller, boutique browsers at every bug and gaffe, leading to a sort of browser balkanization, then Firefox loses its strength and those smaller browsers aren't impactful enough to be able to resist Chrome/Chromium. But, maybe your choice of browser is purely utilitarian, and that's totally fine of course.
  - chappi42 8y ago
    It's not one screw up. I love the sync functionality and Rust/Syncro is great. But on the other side it feels like 'they' take constantly power functionality away while the shallow and shiny homepage claims: "More power to you". But maybe I'm just still sour because of the Eich ousting?
  - kermitismyhero 8y ago
    Oh, it's not just this screwup. I've had growing misgivings about the way Mozilla has handled Firefox's path for years now. Most of my grievances have to do with refusing to provide tools to enable users to kill off idiotic and/or evil decisions on the part of website developers. For example: No ability to restrict websites' overrides of keyboard shortcuts as long as Javascript is enabled. In a similar vein, the scourge of scrolljacking. Every time some web developer thinks that my scrolling down a few notches with my mouse wheel equals "that user wants to scroll precisely one whole page down in slow motion!", my blood pressure spikes. The Mr. Robot thing. (I came very close to abandoning ship after THAT one.) The unsettling creepy nature of Pocket, Snippets, and studies. The stubborn refusal to put easy-to-use media autoplay controls in the normal preferences. This whole "killing off almost everyone's extensions" debacle. And now this Normandy thing that's just been publicized, which allows Mozilla to quietly override user preferences. Even if they have the best of intentions in its use, can they be trusted to competently and wisely wield that power? I just don't trust Mozilla's intentions or competence anymore. So I'm jumping ship. And frankly, I'm starting to develop a real dislike of the web in general. I used to regard Mozilla as the group that provided a great way to access all the cool sites built by talented developers. More and more I'm starting to see Firefox as a necessary evil alternative to Chrome, and the average web developer as a soulless cog in the wheel of the "fuck your privacy, user, we've got advertising we need to ram down your throat and personal data to slurp up en masse!" advertising industry.
AsyncAwait 8y ago
The check only runs once a day.
Vinnl 8y ago
I turn on mostly all phone home functionality in Firefox, and also wasn't affected. Apparently the certificate check is only executed once every 24h, so I guess our checks only occurred after a fix was already pushed.
- clairity 8y ago
  yes, but i also don't have the fix, since i turned off studies. i'm guessing the cert check was blocked. what url does the check attempt to connect to?
  - gpm 8y ago
    Cert check doesn't need to connect to any url to fail. It's just the cert's only expired 20 hours ago, so this issue is currently only affecting approximately 83% of users who happen to be checking at a time of day that has already passed, over the next 4 hours that will go up to 100% (ignoring users who receive a fix before it breaks).
    - clairity 8y ago
      ah, good point. i didn't think through beforehand how this should have worked.
      - clairity 8y ago
        i passed my `app.update.lastUpdateTime.xpi-signature-verification` time and still had no issues with addons failing, so i dug into it a bit. turns out i had `xpinstall.signatures.required` set to `false`, which i'd done to get an older extension working in the past (and subsequently forgot to set it back to `true` later). so i don't think my install of firefox has been checking addon signatures for a while now, which is why my addons remained functional (with other security implications of course). i didn't immediately find where the cert was stored (to check it's expiration date) however.
zhong-j-yu 8y ago
I got hit by the bug just 10 minutes ago.

kermitismyhero 8y ago

It was the same for me. Firefox 66.0.3 on Xubuntu 19.04. I also turn off a lot of phone-home behaviour. And I never had any problems with extensions getting disabled. I have no idea why I wasn't affected. But frankly, "not being affected" isn't good enough for me. Even if I dodged this bullet I might not dodge the next. I'm looking for an alternative browser. Falkon has been interesting so far. It's a little bare-bones in many ways, but at least it's immunue to any future Mozilla screwups.

Gene_Parmesan 8y ago
One screwup is enough for you to jump ship? Or have there been others? (I'm genuinely curious, not trying to be aggressive.) I personally don't think all this talk of "Bye-bye firefox" is quite fair (I'm referring to a number of comments on this page, not yours specifically). In my opinion (you may disagree), Mozilla is one of our best and strongest allies in the fight for a fair internet. Their values matter because they still have the user base to back them up. If all of us technical-minded folk jump ship to smaller, boutique browsers at every bug and gaffe, leading to a sort of browser balkanization, then Firefox loses its strength and those smaller browsers aren't impactful enough to be able to resist Chrome/Chromium. But, maybe your choice of browser is purely utilitarian, and that's totally fine of course.
- chappi42 8y ago
  It's not one screw up. I love the sync functionality and Rust/Syncro is great. But on the other side it feels like 'they' take constantly power functionality away while the shallow and shiny homepage claims: "More power to you". But maybe I'm just still sour because of the Eich ousting?
- kermitismyhero 8y ago
  Oh, it's not just this screwup. I've had growing misgivings about the way Mozilla has handled Firefox's path for years now. Most of my grievances have to do with refusing to provide tools to enable users to kill off idiotic and/or evil decisions on the part of website developers. For example: No ability to restrict websites' overrides of keyboard shortcuts as long as Javascript is enabled. In a similar vein, the scourge of scrolljacking. Every time some web developer thinks that my scrolling down a few notches with my mouse wheel equals "that user wants to scroll precisely one whole page down in slow motion!", my blood pressure spikes. The Mr. Robot thing. (I came very close to abandoning ship after THAT one.) The unsettling creepy nature of Pocket, Snippets, and studies. The stubborn refusal to put easy-to-use media autoplay controls in the normal preferences. This whole "killing off almost everyone's extensions" debacle. And now this Normandy thing that's just been publicized, which allows Mozilla to quietly override user preferences. Even if they have the best of intentions in its use, can they be trusted to competently and wisely wield that power? I just don't trust Mozilla's intentions or competence anymore. So I'm jumping ship. And frankly, I'm starting to develop a real dislike of the web in general. I used to regard Mozilla as the group that provided a great way to access all the cool sites built by talented developers. More and more I'm starting to see Firefox as a necessary evil alternative to Chrome, and the average web developer as a soulless cog in the wheel of the "fuck your privacy, user, we've got advertising we need to ram down your throat and personal data to slurp up en masse!" advertising industry.

AsyncAwait 8y ago

The check only runs once a day.

Vinnl 8y ago

I turn on mostly all phone home functionality in Firefox, and also wasn't affected. Apparently the certificate check is only executed once every 24h, so I guess our checks only occurred after a fix was already pushed.

clairity 8y ago
yes, but i also don't have the fix, since i turned off studies. i'm guessing the cert check was blocked. what url does the check attempt to connect to?
- gpm 8y ago
  Cert check doesn't need to connect to any url to fail. It's just the cert's only expired 20 hours ago, so this issue is currently only affecting approximately 83% of users who happen to be checking at a time of day that has already passed, over the next 4 hours that will go up to 100% (ignoring users who receive a fix before it breaks).
  - clairity 8y ago
    ah, good point. i didn't think through beforehand how this should have worked.
    - clairity 8y ago
      i passed my `app.update.lastUpdateTime.xpi-signature-verification` time and still had no issues with addons failing, so i dug into it a bit. turns out i had `xpinstall.signatures.required` set to `false`, which i'd done to get an older extension working in the past (and subsequently forgot to set it back to `true` later). so i don't think my install of firefox has been checking addon signatures for a while now, which is why my addons remained functional (with other security implications of course). i didn't immediately find where the cert was stored (to check it's expiration date) however.

zhong-j-yu 8y ago

I got hit by the bug just 10 minutes ago.