Most active commenters
  • driverdan(4)

←back to thread

1318 points xvector | 28 comments | | HN request time: 1.263s | source | bottom
1. driverdan ◴[] No.19823850[source]
First they force code signing on everyone without a way to disable it then they break it. This is an extreme level of incompetence I didn't expect from Mozilla.

They'd better have the best post mortum ever, possibly with someone being fired.

replies(9): >>19823853 #>>19823924 #>>19823927 #>>19823983 #>>19823993 #>>19824074 #>>19824096 #>>19824180 #>>19824307 #
2. cjbprime ◴[] No.19823853[source]
> They'd better have the best post mortum ever, possibly with someone being fired.

Arguably these two goals are incompatible. :)

replies(1): >>19823880 #
3. AnIdiotOnTheNet ◴[] No.19823880[source]
People are generally not inclined to be truthful about their mistakes if they expect to be punished for them. Its how problems keep getting covered up until they become catastrophes.
replies(1): >>19824125 #
4. steve19 ◴[] No.19823924[source]
Why does someone need to be fired? Does some blood spilled really make it better? Have some compassion.
replies(2): >>19823982 #>>19824132 #
5. wbl ◴[] No.19823927[source]
There is exactly one person who isn't going to do that again.
6. driverdan ◴[] No.19823982[source]
I'm generally not a fan of firing people for making mistakes. This one is so monumental it may require it though. This breaks most FF installations.
replies(3): >>19824003 #>>19824156 #>>19824456 #
7. swiley ◴[] No.19823983[source]
I was with you up until you said someone should be fired.

The fundamental problem here is the system (code signing.) It's a political thing with security being the excuse. They want control of a platform for business reasons.

8. naikrovek ◴[] No.19823993[source]
Come on, people make mistakes. Things fall through cracks. Shit happens, etc.

No one needs to be fired for a single instance of a particular mistake. If this happened multiple times, then I would be on board with firing someone.

replies(1): >>19824328 #
9. steve19 ◴[] No.19824003{3}[source]
You didn't answer my question. What does firing achieve? You fire a person who learnt their lesson and will never make the mistake again? And then hire someone new?

Or you fire the scapegoat because of a broken system that allowed one person to make a mistake?

replies(2): >>19824134 #>>19824498 #
10. weavejester ◴[] No.19824074[source]
A mistake of this magnitude cannot be the fault of an individual, because if it was, then the organization lacked adequate safeguards.

What I'd like to see is a post-mortem, followed by an explanation of how they'll prevent the mistake from being made again in future.

replies(2): >>19824138 #>>19824617 #
11. cheeze ◴[] No.19824096[source]
Oh relax. A cert expired. An intermediate cert at that...

This has probably happened to every major cloud provider and countless companies at least once. Certs are hard.

Should Mozilla have had monitoring on their cert expiration? Yes. Will they after this? Probably. Is any one person ever at fault for something like this? No.

Firefox is an open source project. You're welcome to contribute and make things better.

replies(3): >>19824119 #>>19824175 #>>19824304 #
12. hnaccy ◴[] No.19824119[source]
>Firefox is an open source project. You're welcome to contribute and make things better.

Well no because they won't accept a patch that lets us plebs turn off the signed extension requirement.

replies(1): >>19824199 #
13. dev_dull ◴[] No.19824125{3}[source]
I guess it depends on if it was an honest mistake or gross negligence. I don’t think people should be fired for mistakes. I also don’t think everyone should be trusted with important tasks.
14. Silhouette ◴[] No.19824132[source]
Why does someone need to be fired?

That might seem rather extreme, but the fact that this situation was even possible was a consequence of a series of bad decisions over an extended period of time about the required behaviour of new versions of Firefox, combined with technical failures that betray fundamental weaknesses in the whole system design. Whoever was ultimately responsible for those failings demonstrably isn't competent to run something of this importance and should probably either implement immediate and dramatic changes to the relevant policies and technical details or consider their position. Anything less is surely going to damage trust, which is something Firefox can ill afford when it's already in danger of being reduced to a niche product rather than a mainstream browser.

15. driverdan ◴[] No.19824134{4}[source]
If this mistake was due to incompetence then the person should be fired. Incompetence shouldn't be tolerated.

But we're outsiders looking in and don't know what's going on at this point. That's why I used the qualifier "possibly." It's quite possibly it wasn't incompetence.

replies(1): >>19824661 #
16. driverdan ◴[] No.19824138[source]
I hope you're correct.
17. eli ◴[] No.19824156{3}[source]
Couldn’t disagree more. Do you want to fix the conditions that led to the problem? Or do you view a post mortem as a punitive process?
18. ◴[] No.19824175[source]
19. xena ◴[] No.19824180[source]
Alternatively, that person (if they exist) has gotten the best lesson in institutional certificate hygiene rules money can buy. They got their mistake potentially added to hundreds of companies playbooks so it can be caught.

Honestly that's one of the most successful things you can expect out of a failure of this magnitude.

20. lvh ◴[] No.19824199{3}[source]
The Developer edition allows that just fine.
21. yjftsjthsd-h ◴[] No.19824304[source]
> Oh relax. A cert expired. An intermediate cert at that...

Everyone's extensions broke. Including security ones. Including the ones bundled into the TOR browser. And end-users can't fix it. Because Mozilla decided that it was too dangerous to let users choose what extensions to run for themselves. This is an excellent moment to be upset.

replies(1): >>19824766 #
22. vladus2000 ◴[] No.19824307[source]
Hopefully management being fired. This reeks of management not letting the technical team automate something or other bad decision making that lead to this. If one person was in charge of it and they messed it up, that is as much the fault of whomever gave that important task to only one person as the person making the mistake. I don't want the low-level person punished, I want the one who put them in the place to be able to make such a bad mistake without any sort of redundancy or contingency plan.
23. hu3 ◴[] No.19824328[source]
Mistakes of this magnitude are always singular and particular. Hopefully.
24. mrep ◴[] No.19824456{3}[source]
Can you link to your linkedin profile so we all know who to dox next time you make a mistake? If you have a twitter, please add that as twitter works even better for mobs.

Thanks :)

25. luckylion ◴[] No.19824498{4}[source]
> You fire a person who learnt their lesson and will never make the mistake again?

That's true, sort of. How often do you let people make huge mistakes before you decide that maybe they are just not apt for the position that they've been promoted to and Peter was right? Once? Twice? And unlimited amount, as long as it's never the exact same mistake?

26. tomschlick ◴[] No.19824617[source]
> how they'll prevent the mistake from being made again in future

This could have been prevented by someone putting the expiration date on the team shared calendar with a 60 day alert.

27. floatingatoll ◴[] No.19824661{5}[source]
“quite possible”
28. __david__ ◴[] No.19824766{3}[source]
Being upset is ok! I'm not particularly happy that I can't just override the certificate check on stable. But demanding someone get fired is just pointlessly punitive.