4 ms·

That's an absurd tactic I've not seen since last time I used Firefox.

by hipadev23 3y ago

yoavm 3y ago
you're completely free to run firefox from 5 years ago and it will not refuse to run.
- cookiengineer 3y ago
  No, you are not. Mozilla bricked SSL certificates that are mandatory for everything, including Browser Extensions. There is a flag for about:config to unbrick it. Problem is though, that this lasts less than a second because of the remote settings service running in a loop. If you block that services domain with a host firewall (like opensnitch), Firefox will do an endless for loop using 100% CPU load trying to request the shavar and other services domains. So, effectively, you cannot run an old Firefox version, and especially not a version that uses the old bundled mozilla certificate (which is all provided download variants). That's what the previous commenter was (likely) referring to.
  - yoavm 3y ago
    Just for the fun I went to https://ftp.mozilla.org/pub/firefox/releases/53.0/linux-x86_64/en-US/ https://ftp.mozilla.org/pub/firefox/releases/53.0/linux-x86_... and downloaded Firefox 53 from 2017. Font are ugly but it loaded HN just fine.
    - cookiengineer 3y ago
      > you're completely free to run firefox from 5 years ago > Firefox 53 from 2017 not the same. I was talking about post-quantum Firefox releases, which added the mentioned dependencies on Mozilla's SSL certificate. (The grandparent's comment was also about post-quantum, obviously)
      - yoavm 3y ago
        The grandparent post is about some malicious tactic used by Mozilla to prevent you from using old Firefox releases. I think it's pretty clear that there isn't such intent - if there was, the very least Mozilla would have done is preventing you from downloading old versions from their own servers. Having a few specific releases that broke over time doesn't mean anyone is trying to stop you from using an older version of Firefox. It's basically called software.
        cookiengineer 3y ago
        > Having a few specific releases that broke over time doesn't mean anyone is trying to stop you from using an older version of Firefox. Snakeoil certificates in Enterprise licensing might disagree with this statement, which in my opinion is pretty identical to Mozilla's approach to have control over "who is allowed to use when" of their software. It's also not a few specific releases over time, it's all releases after Browser Extension signatures were introduced as being mandatory, which made the rest of the Browser rely heavily on their certificate management servers. I'm not saying it's malicious intent, what I am saying is that this could've been implemented in a much better manner, which wouldn't rely on a centralized certificate signing service.
        btreecat 3y ago
        Yeah they don't _have to require SSL_ but I think we can agree that is a worse thing given the benefits of securing extensions and validation of the server hosting them

That's an absurd tactic I've not seen since last time I used Firefox.

yoavm 3y ago

you're completely free to run firefox from 5 years ago and it will not refuse to run.

cookiengineer 3y ago
No, you are not. Mozilla bricked SSL certificates that are mandatory for everything, including Browser Extensions. There is a flag for about:config to unbrick it. Problem is though, that this lasts less than a second because of the remote settings service running in a loop. If you block that services domain with a host firewall (like opensnitch), Firefox will do an endless for loop using 100% CPU load trying to request the shavar and other services domains. So, effectively, you cannot run an old Firefox version, and especially not a version that uses the old bundled mozilla certificate (which is all provided download variants). That's what the previous commenter was (likely) referring to.
- yoavm 3y ago
  Just for the fun I went to https://ftp.mozilla.org/pub/firefox/releases/53.0/linux-x86_64/en-US/ https://ftp.mozilla.org/pub/firefox/releases/53.0/linux-x86_... and downloaded Firefox 53 from 2017. Font are ugly but it loaded HN just fine.
  - cookiengineer 3y ago
    > you're completely free to run firefox from 5 years ago > Firefox 53 from 2017 not the same. I was talking about post-quantum Firefox releases, which added the mentioned dependencies on Mozilla's SSL certificate. (The grandparent's comment was also about post-quantum, obviously)
    - yoavm 3y ago
      The grandparent post is about some malicious tactic used by Mozilla to prevent you from using old Firefox releases. I think it's pretty clear that there isn't such intent - if there was, the very least Mozilla would have done is preventing you from downloading old versions from their own servers. Having a few specific releases that broke over time doesn't mean anyone is trying to stop you from using an older version of Firefox. It's basically called software.
      - cookiengineer 3y ago
        > Having a few specific releases that broke over time doesn't mean anyone is trying to stop you from using an older version of Firefox. Snakeoil certificates in Enterprise licensing might disagree with this statement, which in my opinion is pretty identical to Mozilla's approach to have control over "who is allowed to use when" of their software. It's also not a few specific releases over time, it's all releases after Browser Extension signatures were introduced as being mandatory, which made the rest of the Browser rely heavily on their certificate management servers. I'm not saying it's malicious intent, what I am saying is that this could've been implemented in a much better manner, which wouldn't rely on a centralized certificate signing service.
        btreecat 3y ago
        Yeah they don't _have to require SSL_ but I think we can agree that is a worse thing given the benefits of securing extensions and validation of the server hosting them