←back to thread

All extensions disabled due to expiration of intermediate signing cert

(bugzilla.mozilla.org)
1318 points xvector | 5 comments | 04 May 19 01:31 UTC | HN request time: 0.976s | source
Show context
rmbryan ◴[04 May 19 10:27 UTC] No.19825581[source]▶
Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.
replies(20): >>19825596 #>>19825603 #>>19825612 #>>19825623 #>>19825631 #>>19825665 #>>19825705 #>>19825721 #>>19825744 #>>19825813 #>>19825905 #>>19825998 #>>19826421 #>>19826769 #>>19826772 #>>19826878 #>>19827050 #>>19829585 #>>19831941 #>>19840386 #
inferiorhuman ◴[04 May 19 10:49 UTC] No.19825665[source]▶
pushed it out to users via Normandy (this should be most users)

Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? What about a UI knob to disable it?

replies(6): >>19825685 #>>19825686 #>>19825716 #>>19825995 #>>19826440 #>>19826786 #
daleharvey ◴[04 May 19 10:56 UTC] No.19825686[source]▶
> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users?

It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout

> What about a UI knob to disable it?

app.normandy.enabled

replies(5): >>19825728 #>>19825732 #>>19825745 #>>19825755 #>>19825842 #
lawl ◴[04 May 19 11:11 UTC] No.19825745[source]▶
The UI knob is

    Options -> Privacy & Security > Allow Firefox to install and run studies
They're using the studies system to push this hotfix faster for those that have it enabled.

Edit: Source:

See: https://discourse.mozilla.org/t/certificate-issue-causing-ad...

> In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Preferences -> Privacy & Security -> Allow Firefox to install and run studies.

Normandy seems to be the internal name for this system: https://github.com/mozilla/normandy

replies(5): >>19825762 #>>19825773 #>>19826186 #>>19826841 #>>19828213 #
1. gpm ◴[04 May 19 11:31 UTC] No.19825820[source]▶
I'm nearly certain Normandy does not log all of your browsing history for what it's worth.

I agree Mozilla approach to stuff like this is... less than ideal.

replies(1): >>19829184 #
2. DangerousPie ◴[04 May 19 12:04 UTC] No.19825922[source]▶
> now I find out all my browsing history has been logged to Firefox servers.

Where are you getting this from?

replies(1): >>19829703 #
3. ◴[04 May 19 20:31 UTC] No.19829184[source]▶
4. nanis ◴[04 May 19 22:10 UTC] No.19829703[source]▶
I am getting it from the simple fact that when I looked at Normandy related settings a unique ID and an API endpoint screamed at me ... Let's assume the explanation given here regarding Normandy's endpoint is legitimate. Why am I assigned a unique ID? How hard is it to make the connection between the fact that for the past N years, despite telemetry and studies being turned off, my browser had been pinging Mozilla with this unique ID. Until proved otherwise, it is safe to assume that this was used to track browsing.
replies(1): >>19853360 #
5. sciurus ◴[07 May 19 20:55 UTC] No.19853360{3}[source]▶
Disclaimer: I work for Mozilla on the operations team responsible for Firefox's backend services, including Normandy.

TL;DR you are not sending us your browsing history.

If telemetry and studies were turned off, your browser wasn't sending us this unique id.

If you had kept them enabled, for normandy telemetry you would have been sending us the data described at https://firefox-source-docs.mozilla.org/toolkit/components/n...

You can read more broadly about what data Firefox sends by default at https://www.mozilla.org/en-US/privacy/firefox/

And learn more about the review process any data collection has to go through at https://wiki.mozilla.org/Firefox/Data_Collection