Most active commenters
  • DoctorOetker(7)
  • Certhas(3)

←back to thread

1318 points xvector | 34 comments | | HN request time: 0.001s | source | bottom
Show context
rmbryan ◴[] No.19825581[source]
Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.
replies(20): >>19825596 #>>19825603 #>>19825612 #>>19825623 #>>19825631 #>>19825665 #>>19825705 #>>19825721 #>>19825744 #>>19825813 #>>19825905 #>>19825998 #>>19826421 #>>19826769 #>>19826772 #>>19826878 #>>19827050 #>>19829585 #>>19831941 #>>19840386 #
1. DoctorOetker ◴[] No.19825705[source]
I read at https://discourse.mozilla.org/t/certificate-issue-causing-ad...

>12:50 p.m. UTC / 03:50 a.m. PDT: We rolled-out a fix for release, beta and nightly users. The fix will be automatically applied in the background within the next few hours, you don’t need to take active steps.

>In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Preferences -> Privacy & Security -> Allow Firefox to install and run studies.

>You can disable studies again after your add-ons have been re-enabled.

>We are working on a general fix that doesn’t need to rely on this and will keep you updated.

I refuse to enable studies, even temporarily. This comes very close after the IE6 conspiracy revelation, where ends justifies the means.

Please provide a link to the certificate file, and step by step instructions for installing it, without enabling and conflating with mozilla studies...

replies(3): >>19825894 #>>19825895 #>>19825921 #
2. DangerousPie ◴[] No.19825894[source]
> This comes very close after the IE6 conspiracy revelation, where ends justifies the means.

What?!

replies(1): >>19825924 #
3. Vinnl ◴[] No.19825895[source]
The last sentence you quoted literally said that they will provide you with the option to fix this without needing to enable studies.
replies(1): >>19825933 #
4. XORcat ◴[] No.19825921[source]
JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_sign...

hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

From the looks, it installs the above plugin, and changes `app.update.lastUpdateTime.xpi-signature-verification` to `1556945257`

I can't get it to work in ESR 60 though. Getting file not found on "resource://gre/modules/addons/XPIDatabase.jsm"

edit: The linked XPI definitely seems to add the new certificate, whatever mechanism used to reverify the signatures just doesn't seem to work in 60.

edit2: Restarting Firefox appears to have forced the reverify... Possibly a flag that I twiddled with though, hard to be sure. Either way, the above should help people get everything running again without having to enable studies/normandy.

replies(5): >>19826115 #>>19826755 #>>19827210 #>>19827215 #>>19827221 #
5. DoctorOetker ◴[] No.19825924[source]
you probably missed this story: https://news.ycombinator.com/item?id=19798678
replies(1): >>19825949 #
6. DoctorOetker ◴[] No.19825933[source]
correct, and I am emphasizing and pointing out my choice to wait such that others can make the same informed choice if they so wish.

(I would have wanted to read my comment if someone else had written it, so by the golden rule I make the comment I wish I had read)

7. DangerousPie ◴[] No.19825949{3}[source]
I actually did read that story but I don't understand what that has to do with anything being discussed here.

Yes, Youtube put up a banner asking IE6 users to move to a more modern browser 10 years ago. How is that in any way related to Firefox pushing a hotfix in 2019 to fix a certificate issue? Are you worried there is a big evil conspiracy to use this mechanism to uninstall Internet Explorer from peoples' computers?!

replies(1): >>19826040 #
8. flizzers ◴[] No.19826040{4}[source]
Okay, so, youtube targets a small subset of users, and changes their experience capriciously, and to suit their own purposes.

Firefox, it turns out, has a built-in telemetry system that defaults to enable exactly the same behavior: changing your system, to suit their desires.

You’re words “a big evil conspiracy to use this mechanism to uninstall Internet Explorer from peoples' computer” are misleading. No one would propose that the intent is an attack on Microsoft applications. Rather, the intent is to blindfold users on a whim, should a Firefox component prove inconvenient to the providers of Firefox. Ostensibly, in the event that some add-on or extension threatens the bottom line for major backers of Firefox’s funding.

replies(2): >>19826374 #>>19826429 #
9. rndgermandude ◴[] No.19826115[source]
Yes, this is broken on ESR, but only somewhat broken.

The hotfix extension does two things:

1) Install a new certificate for "CN=signingca1.addons.mozilla.org/emailAddress=foxsec@mozilla.com", effectively replacing the old certificate that expired. This should work.

2) Then it tries to import the internal "resource://gre/modules/addons/XPIDatabase.jsm" module and calls XPIDatabase.verifySignatures().

This does not work on ESR, as "XPIDatabase.jsm" is a new-ish thing that isn't present in ESR yet. In ESR the function is still in "resource://gre/modules/addons/XPIProvider.jsm" (XPIProvider.verifySignatures()). Thankfully, the non-existing module is imported using ChromeUtils.defineModuleGetter, which only lazily loads the module on first of the imported property, so after the certificate-adding code has run.

10. dralley ◴[] No.19826374{5}[source]
> Firefox, it turns out, has a built-in telemetry system that defaults to enable exactly the same behavior: changing your system, to suit their desires.

An example of the typical use of this system: say Mozilla wants to enable video hardware acceleration in Firefox but they don't know if bugs in video drivers or in Firefox will make crashing more frequent. So they enable hardware acceleration for 1% of users instead of 100% and compare the reported crash rate between the two to determine if it's ready to be pushed out universally.

replies(1): >>19826539 #
11. Filligree ◴[] No.19826429{5}[source]
> Okay, so, youtube targets a small subset of users, and changes their experience capriciously, and to suit their own purposes.

They added a dismissable banner. That falls far short of "changing their experience", in my mind.

12. betterunix2 ◴[] No.19826539{6}[source]
At some point in the next five-ten years we will see this "feature" abused. Maybe Mozilla will use it to "soften" commonly used ad blockers to enable "acceptable" ads for Firefox users. Maybe Mozilla will be hacked by some government that wants to enable MITM attacks against its citizens, and Normandy will make that happen. Or maybe Mozilla will just cooperate with the government trying to do so.

You say it is "typically" used for benevolent purposes, but why should we trust Mozilla? Mozilla does not have a stellar history with this sort of thing and in my experience they do not take security as seriously as they should if we are to trust them with such a feature.

replies(1): >>19826883 #
13. gpm ◴[] No.19826755[source]
Hey, if you just click on that storage.googleapis.com link it installs the hotfix directly without having to enable normandy ;)
replies(6): >>19826795 #>>19826847 #>>19826887 #>>19827014 #>>19827736 #>>19828312 #
14. option_greek ◴[] No.19826795{3}[source]
This should be sticky comment somewhere on the top of the comments. It bought all the addons back for me.
15. jwalton ◴[] No.19826847{3}[source]
It does, but it didn't fix anything for me. All my extensions are still gone. :(
replies(1): >>19826864 #
16. gpm ◴[] No.19826864{4}[source]
You might have to reinstall them unfortunately, on the system I figured that out on Firefox had decided to uninstall them (I think because I had to update the browser from the ancient version the user was using first).
17. Certhas ◴[] No.19826883{7}[source]
The level of paranoia throughout this thread is truly through the roof.....

Mozilla has had several "PR nightmare" decisions that a vocal set of users didn't like, and sometimes were genuinely ill advised/bad/shitty. But as far as I can see they do not have a bad track record when it comes to security/privacy. Do you have any examples of actual serious security/privacy fuck ups by Mozilla/Firefox? I mean that stood up to scrutiny beyond the sensationalist headlines?

Their defaults might not be your defaults, but they are even working on bringing Tor into mainstream Firefox. None of this means they are above criticism of course, but... context!

The sum total of their actions points towards an organisation that has some internal problems but that is genuinely pursuing privacy and an open web as a goal for as many users as possible.

replies(4): >>19827247 #>>19828663 #>>19830148 #>>19830341 #
18. ◴[] No.19826887{3}[source]
19. classichasclass ◴[] No.19827014{3}[source]
Just tried on Android. Hooray!
replies(1): >>19827192 #
20. mateus1 ◴[] No.19827192{4}[source]
Clicking the URL was the only way I was able to get the hotfix on Firefox mobile for Android
21. 1over137 ◴[] No.19827210[source]
So not only does this 'normandy' thing exist, but it goes to a google server? So much for using Firefox to keep google out of my life. :(
replies(1): >>19827771 #
22. johnnycab ◴[] No.19827215[source]
>hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

This fixed it for me. Thanks. W10/FF 66.0.3

23. DoctorOetker ◴[] No.19827221[source]
Thanks for the sleuthing, but who does this repository belong to? I'd like to apply it but only if mozilla provides such instruction on their issue page, I don't know who the actual owner of /moz-fx-normandy-prod-addons/ is...

https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

Can mozilla please verify, confirm authenticity, and list this instruction on their issue page?

replies(1): >>19830574 #
24. DoctorOetker ◴[] No.19827247{8}[source]
> Do you have any examples of actual serious security/privacy fuck ups by Mozilla/Firefox?

Sadly I don't, but others argue they have top notch standard security practices like automated alerts etc. regarding certificate renewals...

25. reader_1000 ◴[] No.19827736{3}[source]
Unrelated to cert problem: Yes, clicking on the link installs the plugin, but it is suprising to see that firefox claims that it is the news.ycombinator.com, not storage.googleapis.com, that wants to install plugin. Could it be a security issue since if an attacker somehow manages the post/inject a link for a malicious plugin in a credible site, firefox will claim that plugin is from that site?
replies(1): >>19827781 #
26. DoctorOetker ◴[] No.19827771{3}[source]
that's an interesting question: when we install add-ons or extensions, are these hosted on google servers? I'd rather not have google know what versions of which add-ons I am running...
27. DoctorOetker ◴[] No.19827781{4}[source]
oh wow! that's really bad
28. devcpp ◴[] No.19828312{3}[source]
I just installed some random googleapis link. This is so stupid, and very disappointing from Mozilla.
29. rue ◴[] No.19828663{8}[source]
…This one?

This one isn’t very privacy-friendly or open. And that raises all the previous questions again. Should they maybe have learned something about clandestinely fucking with people’s systems?

30. bscphil ◴[] No.19830148{8}[source]
> But as far as I can see they do not have a bad track record when it comes to security/privacy. Do you have any examples of actual serious security/privacy fuck ups by Mozilla/Firefox?

I mean, they are currently shipping real actual ads on the new tab page that aren't blocked by ad blockers - and possibly can't be (there are limits to what WebExtensions can modify on Firefox internal pages). Sure, maybe your parent comment was exaggerating a little bit, but what if Mozilla instead starts inserting "privacy-friendly" "recommendations" into webpages in order to "enhance users' browsing experiences"? That doesn't sound at all far-fetched for the Mozilla we know today.

replies(1): >>19833905 #
31. XORcat ◴[] No.19830574{3}[source]
I would have the same question if I didn't see the response come back from https://normandy.cdn.mozilla.net/ myself.

I encourage you to go through the whole Normandy process yourself in a test environment, and even better (if possible), check out the code to see whether it looks legit or benign.

I'm happy, because I went through and checked it out myself without needing to enable Normandy on my actual Firefox, but ultimately, it will be great when Moz can get instructions for manually applying the fix out.

32. Certhas ◴[] No.19833905{9}[source]
Besides your claim not being true AFAIK tell [1](there are no ads on my new tab page, and as far as I can tell there was no incident of paid for content showing up on peoples new tab), how exactly would shipping ads be a privacy/security violation?

This is exactly the sensationalist misrepresentation I was talking about. You don't like what they are doing, fine. Misrepresenting it as something that it's not is not fine.

Besides: Mozilla is funded in large parts by having Google as the default search provider. This means they are funded by Google selling ads. Them starting up new revenue streams and getting away from that funding model would be a pro privacy step.

[1] If you are referring to something else that I missed, feel free to enlighten me.

replies(1): >>19837233 #
33. bscphil ◴[] No.19837233{10}[source]
Maybe you've opted out of studies or otherwise disabled Pocket? That's how they're bundling much of this new stuff in.

See: https://help.getpocket.com/article/1142-firefox-new-tab-reco... especially the part that says "From time to time, the occasional sponsored story may appear as a recommendation from Pocket. These stories will always be clearly marked, and you have control over whether they’re shown on your new tab page."

All so-called recommendations I've seen have been spammy, the sort of stuff you see linked as "other articles you may enjoy" when you disable your ad blocker on bad sites. Regardless, this directly contradicts your claim that there haven't been incidents of sponsored content on the new tab page: this is explicitly what is happening according to Pocket's own website. Mozilla themselves explicitly said they are introducing sponsored stories to the new tab page: https://blog.mozilla.org/futurereleases/2018/01/24/update-on...

I think there's a world of difference between making a search engine that sells ads the default, and selling ads yourself and inserting them into the browser's chrome. Among other issues, if I help someone install an ad blocker, that ad blocker will block ads on Google, but will not block ads in the browser chrome.

So, given this and other recent behavior by Mozilla, I have to say I don't think seeing "related stories" inserted into the browser chrome for certain web pages is at all far fetched. That should worry us.

replies(1): >>19837418 #
34. Certhas ◴[] No.19837418{11}[source]
I thought you were referring to the snippets.

I actually don't see the pocket recommendations on my desktop (maybe the Linux Mint build has them disabled by default), but they are there on mobile. There is a UI setting to disable them of course. It's explained right on the page that you link to.

More importantly, that page also explains that no data gets sent to Mozilla or pocket or anyone else for these ads to show up.

So again, no privacy violation here. I also think it's an extreme leap from "they show this in the new tab page which they design and control" to "they could start showing it overlayed on other peoples content".

I think they got some decisions very wrong. Among them not implementing a way to allow people to override signing of addons, which people did warn about. Having signatures enforced as a strong default is certainly good and right, but if they had included a "right click on addon, use without signature (WARNING THIS IS SKETCHY REAL ADDONS DON'T ASK YOU TO DO THIS)" option this signing issue would have been relatively mild.

But their track record on privacy/security simply isn't as bad as people make it out to be.