12 ms·

My point of view as a long-time Firefox user that cares about privacy but also knows we live in an imperfect world: It obviously sucks that this happened but I

My point of view as a long-time Firefox user that cares about privacy but also knows we live in an imperfect world: It obviously sucks that this happened but I think they handled it very well. The bug was fixed so quickly that I wouldn't even have realized it had happened if it hadn't been for the thread here on HN. My extensions hadn't even been disabled yet by the time the patch came out. And pushing out the hotfix through studies followed by a new version probably ensured that a large fraction of the "average joe" userbase didn't even realize there was a problem. So obviously there are some improvements to make for the future but I think some of the criticism over the last few days has been a bit harsh. Firefox is still my preferred browser by far.

SECProto 7y ago
> The bug was fixed so quickly that I wouldn't even have realized it had happened if it hadn't been for the thread here on HN Maybe this is a timezone thing, but I was in East Asia, and I had to deal with the internet for close to 36 hrs (android) with no ublock. It was almost enough to look for a new browser (but browsers with adblock on Android are few and far between - so instead I just didn't use the internet as much for a day or two.). Part of that delay was play store being slow to push it, as I recall seeing the binaries somewhere a while sooner.
- yellowapple 7y ago
  One option would've been to use Nightly and set xpinstall.signatures.required = false in about:config. That's exactly what I did.
  - SECProto 7y ago
    I view using nightly to be as much of a barrier to entry that I might as well switch to a totally different browser. If the issue had lasted longer, I would have found (someone on the internet who had found) a solution like that.
    - yellowapple 7y ago
      I use Firefox Nightly as my primary browser on Android. It works fine. You can get it on the Play Store right alongside where you'd get non-Nightly Firefox for Android. I'd hardly call that a "barrier to entry" at all (certainly no more than there would be for, you know, normal Firefox).
      - SECProto 7y ago
        > I'd hardly call that a "barrier to entry" at all Would I have to sign in to sync again to access my bookmarks, logins, etc? Are there ever issues with syncing between phone and computer (nightly to stable) or would I have to change my desktop browser as well? Does anything ever break at all? Even if the answer to these questions is "no", the fact that I'm asking them is the barrier to entry. And if any of the answers are yes, there's no reason to change from stable branch - avoiding one issue to get different one(s) isn't a solution. > certainly no more than there would be for, you know, normal Firefox Yes, indeed, switching to Firefox from Chrome a couple years ago did have a significant barrier to entry
        michaelmrose 7y ago
        You do need to sign in to Firefox sync on each version if you install both as 2 unique applications on Android don't share each other's data. On desktop front there is no problem connecting current and nightly to the same sync account and indeed same profile directly. The sole annoying thing about nightly is that it naturally updates frequently. It's quite stable and gets legitimately useful features faster and let's you disable signing and run locally built add-ons. I use it as my primary browser on Android and Linux.
        yellowapple 7y ago
        > Even if the answer to these questions is "no", the fact that I'm asking them is the barrier to entry. Fair enough. The answers, for the record, are indeed "yes" (but that takes, what, 30 seconds?), "no", and (at least not severely) "no". But apparently even non-Nightly Firefox for Android supports xpinstall.signatures.required = false, which is even less of a barrier to entry, so that's good news, I guess. While I understand Mozilla's reasoning for not wanting a bunch of people to set this and forget about it, it's a bit ridiculous that not once did they mention it aside from a "don't do this thing that we're not going to specify because it's a hack" (of course it's a hack, and it's one that got me up and running again long before there was even a fix via Studies).
- worble 7y ago
  There's a couple of options of Android; you could use the DDG browser[0] or the Privacy Browser[1] (which I know sounds dodgy but seems legit). They don't have 'adblock' exactly but I think they implement a lot of the same lists such as EasyList. [0]https://f-droid.org/en/packages/se.johanhil.duckduckgo/ https://f-droid.org/en/packages/se.johanhil.duckduckgo/ [1]https://f-droid.org/en/packages/com.stoutner.privacybrowser.standard/ https://f-droid.org/en/packages/com.stoutner.privacybrowser....
  - SECProto 7y ago
    Thanks for those! I usually browse on desktop, so hadn't looked into other browsers, but I'll keep these alternative browsers in mind (and comment history) in case a situation comes up again. The only other instance where I considered switching was the whole forced Mr. Robot addon debacle a year or two back.
  - billysielu 7y ago
    or Brave
- dingo_bat 7y ago
  If you have a Samsung you can use disconnect pro. It works well.
- axaxs 7y ago
  You should give Brave a shot. Seriously, every time I open Chrome on my phone on accident, I'm horrified at what the internet has become..
  - SECProto 7y ago
    Why? I use firefox+uBlock on my phone, and don't have chrome installed on any devices.
    - axaxs 7y ago
      Because, at least on Android, it's an order of magnitude faster. No extensions needed. I do look forward to Fenix, it's -very- nice, but not stable enough for me to drive it just yet.
      - SECProto 7y ago
        Fenix sounds neat, I hadn't heard of it. Thanks. I have no issues whatsoever with the speed of Firefox on mobile. I also prefer to support a non-chromium browser.
steve19 7y ago
It was a couple of days before the Android fix was released. For many users this was a multiday affair. Some lost data (containers). You were lucky you extentions were not disabled before the fix, but for many people this was a major problem.
- dave5104 7y ago
  I unfortunately lost my container data (luckily I only have a couple set up). To get the fix though, I had to opt in to the Firefox studies. Apparently I had opted out at some point in the past.
  - preinheimer 7y ago
    Probably when they stealth installed an extension to promote Mr. Robot without telling you.
    - dave5104 7y ago
      I'm a relatively recent Firefox user (within the past few months), so that was far before I switched over.
    - BuckRogers 7y ago
      I caught that before it was posted in the news, and it really disturbed me to see it. "MY REALITY IS DIFFERENT THAN YOURS" or whatever it said. What's that about, talk about unprofessional. That and removing Live Bookmarks really degraded my trust, this weird Pocket thing (seems like a feature, not a product, and one that should've been built from scratch to maximize uniqueness), and I've been using Firefox and only Firefox since 2002. They're definitely losing me over time, it's the community that saves Firefox. Mozilla enables that but shouldn't really get credit for it. Currently testing out "Edgium" though, and I can already say it's the one browser that could pull me away.
  - driverdan 7y ago
    Opt back out if you haven't already.
Twirrim 7y ago
I find it hard to marry up "Firefox user that cares about privacy" with being happy about the study mechanism. Don't you, from a privacy perspective, find it more than a little disturbing that the study mechanism has so much access to internal APIs in Firefox that it can install certificates without your involvement? That seems like a crazy security risk, let alone privacy risk. It's built in and enabled _by default_ in Firefox.
- bpfrh 7y ago
  As far as I understood the installed certificate still has to be signed by a root certificate? So wouldn't it also be valid if served by any other party? Why studies need access to internal apis is a good question, i had studies enabled and the only ones i saw switched a setting...
- sjwright 7y ago
  It’s funny how the mind works. We tend to accept the far greater risk of allowing automated software updates (either in-app or blindly trusting your package manager e.g. apt-get upgrade) but the Firefox Studies mechanism which does a minuscule, strict subset of what any automatic update can do is somehow a “crazy security risk”.
  - swebs 7y ago
    I chose to run apt-get to install packages. I have never opted-in to, nor even known about, how Firefox was running "studies" on me before this event. It's like finding out the TV you bought last year has a hidden camera and it's been recording you the whole time.
    - sjwright 7y ago
      It's not really fair to call it "studies" in quotations. It's better described as software micro-updates which can be progressively deployed in case the change has a regression. They do little more than enable/disable features already shipped in the binary you're running. In my own browser, if I go to about:studies, I have two Studies running. One is the hotfix for the add-on signing issue. The other is: prefflip-push-performance-1491171 • Active This study sets dom.push.alwaysConnect to false. If you equate that to a camera hidden in your TV, you might want to consider giving up whatever drugs you're on.
ekianjo 7y ago
Handled it very well? That must be the worst hyperbole I have ever seen in a while. It broke extensions suddenly for millions of users. If you went on Firefox.com there was absolutely no news about it. Completely awful lack of communication. You had to find a minuscule banner on the "find a fix" page in order to hear about the problem. Add to that that the recommended fix was to activate the backdoor of Firefox, thats just a horror story from beginning to the end. And no admission of guilt anywhere.
- Vinnl 7y ago
  > And no admission of guilt anywhere. > We strive to make Firefox a great experience. Last weekend we failed, and we’re sorry. (...) We let you down https://blog.mozilla.org/blog/2019/05/09/what-we-do-when-things-go-wrong/ https://blog.mozilla.org/blog/2019/05/09/what-we-do-when-thi...
brokenmachine 7y ago
I had a totally different experience. I'm still running FF 56.0.2 because I can't live without Tab Mix Plus. The official line was to wait for the update but about:studies never came up with anything even after 24 hours of waiting and everyone was saying it was fixed but it wasn't for me, I presume because nobody cares about the refugees stuck on pre-add-on breaking versions. So it was completely broken until I finally found a reddit thread that described how to use the developer console to manually import the certificate extracted from the fix. That worked, but it enabled all my add-ons, even ones that were previously disabled. Bloody irritating. I didn't even know that it was possible to break things remotely like this.
- y-satellite 7y ago
  You realize, I hope, that 56.0.2 is riddled with security holes at this point? I get the attachment to old addons, but 129 CVEs (including multiple severe memory corruption bugs) affect that version now. It's not really reasonable to expect Mozilla to keep maintaining it.
  - brokenmachine 7y ago
    I don't expect them to maintain it, but I do expect them not to break it for no reason. Also they could have mentioned in their post that their fix did not do anything for older versions, instead of specifically telling everyone to just keep waiting. xpinstall.signatures.required = false didn't fix it. I'll be very happy to update when there's a version that has a good tab manager. I'm on the latest version at home and it regularly loses whole windows full of tabs, even though it is set to restore my session on startup. And there's no way to manually save sessions. It's hopeless.
    - y-satellite 7y ago
      In this day and age you're living on borrowed time using an old version of a web browser. This state of affairs has its good and bad, but your modern-day browser vendors don't typically maintain branches of old versions to make security and bug fixes (especially when they change things for security reasons, as with this case of old-style addons being removed). If you're going to insist on using an old unsupported version you have to accept the risk of things eventually breaking and the inconvenience of workarounds like the one you described.
mook 7y ago
> My point of view as a long-time Firefox user that cares about privacy but also knows we live in an imperfect world: It obviously sucks that this happened but I think they handled it very well. I think they handled it terribly… or rather, they handled the same event three years ago terribly. There's a reason this is called armagadd-on 2.0… that cert had expired once already, the previous fix didn't work. I think last time they actually had a week of lead time, too.
ihalip 7y ago
They still haven't explained WHY this happened. I know it's easy to overlook a certificate's expiration date, but they should have known about this possible issue when they generated that certificate in the first place.
SilasX 7y ago
They were able to push out a fix so fast because they repurposed the "sure, do some studies on my usage" to enable arbitrary changes to the browser that are under the control of the marketing team. And a lot of people were "opted in", thinking they had opted out. That is 100% not reassuring. Remember Looking Glass? https://news.ycombinator.com/item?id=15956325 https://news.ycombinator.com/item?id=15956325 Well, the marketing team has the power to tweak how ads are handled, silently, with no update action from the user. Out of the frying pan, into the fire.
josefresco 7y ago
To contrast, I noticed my extensions were disabled first thing in the morning, and if I had not seen the thread(s) on HN I would have spent maybe a few hours trying to fix.

SECProto 7y ago

> The bug was fixed so quickly that I wouldn't even have realized it had happened if it hadn't been for the thread here on HN Maybe this is a timezone thing, but I was in East Asia, and I had to deal with the internet for close to 36 hrs (android) with no ublock. It was almost enough to look for a new browser (but browsers with adblock on Android are few and far between - so instead I just didn't use the internet as much for a day or two.). Part of that delay was play store being slow to push it, as I recall seeing the binaries somewhere a while sooner.

yellowapple 7y ago
One option would've been to use Nightly and set xpinstall.signatures.required = false in about:config. That's exactly what I did.
- SECProto 7y ago
  I view using nightly to be as much of a barrier to entry that I might as well switch to a totally different browser. If the issue had lasted longer, I would have found (someone on the internet who had found) a solution like that.
  - yellowapple 7y ago
    I use Firefox Nightly as my primary browser on Android. It works fine. You can get it on the Play Store right alongside where you'd get non-Nightly Firefox for Android. I'd hardly call that a "barrier to entry" at all (certainly no more than there would be for, you know, normal Firefox).
    - SECProto 7y ago
      > I'd hardly call that a "barrier to entry" at all Would I have to sign in to sync again to access my bookmarks, logins, etc? Are there ever issues with syncing between phone and computer (nightly to stable) or would I have to change my desktop browser as well? Does anything ever break at all? Even if the answer to these questions is "no", the fact that I'm asking them is the barrier to entry. And if any of the answers are yes, there's no reason to change from stable branch - avoiding one issue to get different one(s) isn't a solution. > certainly no more than there would be for, you know, normal Firefox Yes, indeed, switching to Firefox from Chrome a couple years ago did have a significant barrier to entry
      - michaelmrose 7y ago
        You do need to sign in to Firefox sync on each version if you install both as 2 unique applications on Android don't share each other's data. On desktop front there is no problem connecting current and nightly to the same sync account and indeed same profile directly. The sole annoying thing about nightly is that it naturally updates frequently. It's quite stable and gets legitimately useful features faster and let's you disable signing and run locally built add-ons. I use it as my primary browser on Android and Linux.
      - yellowapple 7y ago
        > Even if the answer to these questions is "no", the fact that I'm asking them is the barrier to entry. Fair enough. The answers, for the record, are indeed "yes" (but that takes, what, 30 seconds?), "no", and (at least not severely) "no". But apparently even non-Nightly Firefox for Android supports xpinstall.signatures.required = false, which is even less of a barrier to entry, so that's good news, I guess. While I understand Mozilla's reasoning for not wanting a bunch of people to set this and forget about it, it's a bit ridiculous that not once did they mention it aside from a "don't do this thing that we're not going to specify because it's a hack" (of course it's a hack, and it's one that got me up and running again long before there was even a fix via Studies).
worble 7y ago
There's a couple of options of Android; you could use the DDG browser[0] or the Privacy Browser[1] (which I know sounds dodgy but seems legit). They don't have 'adblock' exactly but I think they implement a lot of the same lists such as EasyList. [0]https://f-droid.org/en/packages/se.johanhil.duckduckgo/ https://f-droid.org/en/packages/se.johanhil.duckduckgo/ [1]https://f-droid.org/en/packages/com.stoutner.privacybrowser.standard/ https://f-droid.org/en/packages/com.stoutner.privacybrowser....
- SECProto 7y ago
  Thanks for those! I usually browse on desktop, so hadn't looked into other browsers, but I'll keep these alternative browsers in mind (and comment history) in case a situation comes up again. The only other instance where I considered switching was the whole forced Mr. Robot addon debacle a year or two back.
- billysielu 7y ago
  or Brave
dingo_bat 7y ago
If you have a Samsung you can use disconnect pro. It works well.
axaxs 7y ago
You should give Brave a shot. Seriously, every time I open Chrome on my phone on accident, I'm horrified at what the internet has become..
- SECProto 7y ago
  Why? I use firefox+uBlock on my phone, and don't have chrome installed on any devices.
  - axaxs 7y ago
    Because, at least on Android, it's an order of magnitude faster. No extensions needed. I do look forward to Fenix, it's -very- nice, but not stable enough for me to drive it just yet.
    - SECProto 7y ago
      Fenix sounds neat, I hadn't heard of it. Thanks. I have no issues whatsoever with the speed of Firefox on mobile. I also prefer to support a non-chromium browser.

steve19 7y ago

It was a couple of days before the Android fix was released. For many users this was a multiday affair. Some lost data (containers). You were lucky you extentions were not disabled before the fix, but for many people this was a major problem.

dave5104 7y ago
I unfortunately lost my container data (luckily I only have a couple set up). To get the fix though, I had to opt in to the Firefox studies. Apparently I had opted out at some point in the past.
- preinheimer 7y ago
  Probably when they stealth installed an extension to promote Mr. Robot without telling you.
  - dave5104 7y ago
    I'm a relatively recent Firefox user (within the past few months), so that was far before I switched over.
  - BuckRogers 7y ago
    I caught that before it was posted in the news, and it really disturbed me to see it. "MY REALITY IS DIFFERENT THAN YOURS" or whatever it said. What's that about, talk about unprofessional. That and removing Live Bookmarks really degraded my trust, this weird Pocket thing (seems like a feature, not a product, and one that should've been built from scratch to maximize uniqueness), and I've been using Firefox and only Firefox since 2002. They're definitely losing me over time, it's the community that saves Firefox. Mozilla enables that but shouldn't really get credit for it. Currently testing out "Edgium" though, and I can already say it's the one browser that could pull me away.
- driverdan 7y ago
  Opt back out if you haven't already.

Twirrim 7y ago

I find it hard to marry up "Firefox user that cares about privacy" with being happy about the study mechanism. Don't you, from a privacy perspective, find it more than a little disturbing that the study mechanism has so much access to internal APIs in Firefox that it can install certificates without your involvement? That seems like a crazy security risk, let alone privacy risk. It's built in and enabled _by default_ in Firefox.

bpfrh 7y ago
As far as I understood the installed certificate still has to be signed by a root certificate? So wouldn't it also be valid if served by any other party? Why studies need access to internal apis is a good question, i had studies enabled and the only ones i saw switched a setting...
sjwright 7y ago
It’s funny how the mind works. We tend to accept the far greater risk of allowing automated software updates (either in-app or blindly trusting your package manager e.g. apt-get upgrade) but the Firefox Studies mechanism which does a minuscule, strict subset of what any automatic update can do is somehow a “crazy security risk”.
- swebs 7y ago
  I chose to run apt-get to install packages. I have never opted-in to, nor even known about, how Firefox was running "studies" on me before this event. It's like finding out the TV you bought last year has a hidden camera and it's been recording you the whole time.
  - sjwright 7y ago
    It's not really fair to call it "studies" in quotations. It's better described as software micro-updates which can be progressively deployed in case the change has a regression. They do little more than enable/disable features already shipped in the binary you're running. In my own browser, if I go to about:studies, I have two Studies running. One is the hotfix for the add-on signing issue. The other is: prefflip-push-performance-1491171 • Active This study sets dom.push.alwaysConnect to false. If you equate that to a camera hidden in your TV, you might want to consider giving up whatever drugs you're on.

ekianjo 7y ago

Handled it very well? That must be the worst hyperbole I have ever seen in a while. It broke extensions suddenly for millions of users. If you went on Firefox.com there was absolutely no news about it. Completely awful lack of communication. You had to find a minuscule banner on the "find a fix" page in order to hear about the problem. Add to that that the recommended fix was to activate the backdoor of Firefox, thats just a horror story from beginning to the end. And no admission of guilt anywhere.

Vinnl 7y ago
> And no admission of guilt anywhere. > We strive to make Firefox a great experience. Last weekend we failed, and we’re sorry. (...) We let you down https://blog.mozilla.org/blog/2019/05/09/what-we-do-when-things-go-wrong/ https://blog.mozilla.org/blog/2019/05/09/what-we-do-when-thi...

brokenmachine 7y ago

I had a totally different experience. I'm still running FF 56.0.2 because I can't live without Tab Mix Plus. The official line was to wait for the update but about:studies never came up with anything even after 24 hours of waiting and everyone was saying it was fixed but it wasn't for me, I presume because nobody cares about the refugees stuck on pre-add-on breaking versions. So it was completely broken until I finally found a reddit thread that described how to use the developer console to manually import the certificate extracted from the fix. That worked, but it enabled all my add-ons, even ones that were previously disabled. Bloody irritating. I didn't even know that it was possible to break things remotely like this.

y-satellite 7y ago
You realize, I hope, that 56.0.2 is riddled with security holes at this point? I get the attachment to old addons, but 129 CVEs (including multiple severe memory corruption bugs) affect that version now. It's not really reasonable to expect Mozilla to keep maintaining it.
- brokenmachine 7y ago
  I don't expect them to maintain it, but I do expect them not to break it for no reason. Also they could have mentioned in their post that their fix did not do anything for older versions, instead of specifically telling everyone to just keep waiting. xpinstall.signatures.required = false didn't fix it. I'll be very happy to update when there's a version that has a good tab manager. I'm on the latest version at home and it regularly loses whole windows full of tabs, even though it is set to restore my session on startup. And there's no way to manually save sessions. It's hopeless.
  - y-satellite 7y ago
    In this day and age you're living on borrowed time using an old version of a web browser. This state of affairs has its good and bad, but your modern-day browser vendors don't typically maintain branches of old versions to make security and bug fixes (especially when they change things for security reasons, as with this case of old-style addons being removed). If you're going to insist on using an old unsupported version you have to accept the risk of things eventually breaking and the inconvenience of workarounds like the one you described.

mook 7y ago

> My point of view as a long-time Firefox user that cares about privacy but also knows we live in an imperfect world: It obviously sucks that this happened but I think they handled it very well. I think they handled it terribly… or rather, they handled the same event three years ago terribly. There's a reason this is called armagadd-on 2.0… that cert had expired once already, the previous fix didn't work. I think last time they actually had a week of lead time, too.

ihalip 7y ago

They still haven't explained WHY this happened. I know it's easy to overlook a certificate's expiration date, but they should have known about this possible issue when they generated that certificate in the first place.

SilasX 7y ago

They were able to push out a fix so fast because they repurposed the "sure, do some studies on my usage" to enable arbitrary changes to the browser that are under the control of the marketing team. And a lot of people were "opted in", thinking they had opted out. That is 100% not reassuring. Remember Looking Glass? https://news.ycombinator.com/item?id=15956325 https://news.ycombinator.com/item?id=15956325 Well, the marketing team has the power to tweak how ads are handled, silently, with no update action from the user. Out of the frying pan, into the fire.

josefresco 7y ago

To contrast, I noticed my extensions were disabled first thing in the morning, and if I had not seen the thread(s) on HN I would have spent maybe a few hours trying to fix.