←back to thread

All extensions disabled due to expiration of intermediate signing cert

(bugzilla.mozilla.org)
1318 points xvector | 3 comments | 04 May 19 01:31 UTC | HN request time: 0.001s | source
Show context
weavejester ◴[04 May 19 02:21 UTC] No.19823928[source]▶
There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false.

However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition.

To fix this on MacOS I did the following:

1. Downloaded and installed Firefox Nightly

2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/firefox-bin --profilemanager

3. Changed the profile to "default" so my normal Firefox profile would be used

4. Started up Firefox Nightly, opened about:config, then set xpinstall.signatures.required to false

Not sure if it's a good idea to use my default profile in Nightly. It might be a wiser idea to copy it instead.

replies(14): >>19824011 #>>19824101 #>>19824109 #>>19824183 #>>19824225 #>>19824268 #>>19824299 #>>19824700 #>>19824983 #>>19825109 #>>19825195 #>>19825237 #>>19825421 #>>19826226 #
SilasX ◴[04 May 19 13:16 UTC] No.19826226[source]▶
Firefox stopped respecting the signature-required setting in the mainline version in 2016. I know because I got burned by it and made a Hitler parody.

https://youtube.com/watch?v=taGARf8K5J8

And frankly, this an extra absurdity on top of that. If you’re going to require signatures for all extensions, regardless of user preference, shouldn’t you be keeping an eye on the signing process?

replies(1): >>19826267 #
chappi42 ◴[04 May 19 13:23 UTC] No.19826267[source]▶
Why does Mozilla do this? Same with removing the option to not update. Why not let users choose (in the case of update maybe with an about config setting)?
replies(2): >>19826306 #>>19826489 #
1. TazeTSchnitzel ◴[04 May 19 14:02 UTC] No.19826489{3}[source]▶
Because they don't want trojans to hijack the browser. If the user can change the signing preference, any application can.
replies(2): >>19826706 #>>19828315 #
2. SilasX ◴[04 May 19 14:37 UTC] No.19826706[source]▶
Yes, the sibling comment and thread already brought that up.
3. lordlimecat ◴[04 May 19 18:36 UTC] No.19828315[source]▶
It is not possible for a user land application to prevent root processes from hijacking / modifying it. Such protection requires the protecting mechanism to run at a higher level of trust / security ring than the attacker.