Oh man, this is a disaster. Unless they get an update to fix this out immediately (like, before most people notice), I think this is going to do significant damage to Firefox. They're already...
Oh man, this is a disaster. Unless they get an update to fix this out immediately (like, before most people notice), I think this is going to do significant damage to Firefox. They're already having trouble clinging to a small percentage of browser share, and effectively encouraging people to switch to get their extensions back is really not going to help.
The number of users in /r/Firefox is shooting up constantly (and that's not usually a very active subreddit), so there are clearly a lot of people trying to figure out what's going wrong, and less-technical (and less-patient) people will probably just install Chrome instead of searching around and troubleshooting.
Edit: it's been acknowledged on GitHub, so I'm sure they're doing whatever they can now, probably scrambling to push an update faster than ever before?
Yeah, significant irreparable damage. This reminds me of one of these cases where large companies say "every minute this is broken we lose a million dollars". Obviously this case isn't measured in...
Yeah, significant irreparable damage. This reminds me of one of these cases where large companies say "every minute this is broken we lose a million dollars".
Obviously this case isn't measured in dollars, it's hard to put a price tag on the importance of Firefox still being a major player on the web though ...
I don't mean to be overly critical here, but come on, what's your source for "irreparable" damage? Do you remember when AWS nearly completely went down for an entire day when an employee...
I don't mean to be overly critical here, but come on, what's your source for "irreparable" damage? Do you remember when AWS nearly completely went down for an entire day when an employee fat-fingered a command? That was a "millions of dollars a minute" event too. What irreparable damage did that cause?
In many cases, the browser market is very similar to the cloud computing market. High stakes, multi-provider.
If people are willing to switch from a browser run by a company which demonstrates ineptness to one run by a company which demonstrates malice—all over a superficial issue people won't see as a big demarcating event in the history of the web in a year or two—then that's on them.
For some weird reason people seem to overreact when it comes to Firefox. I think lots of people got their hopes pinned on it or something. And it is very important that Firefox grows in order to...
For some weird reason people seem to overreact when it comes to Firefox. I think lots of people got their hopes pinned on it or something. And it is very important that Firefox grows in order to keep a Google/Blink/Webkit web ecosystem monopoly at bay, but it seems like every time Firefox has a hiccup there's droves of people calling it The End of the Free Web. This is slightly bigger than a hiccup, I'll admit, but still.
Yeah. I'm carefully trying not to discount the fact that I might be missing something that more tech-savvy people would care about, but I've yet to see any convincing explanations as to why...
Yeah. I'm carefully trying not to discount the fact that I might be missing something that more tech-savvy people would care about, but I've yet to see any convincing explanations as to why browser extensions being disabled for a few hours is THE END OF FIREFOX.
Yeah, they screwed up, but people are acting like the sky is falling.
Let’s be honest, on the whole, tech nerds, of which Firefox has a large base of—and including myself in this category—are an overly dramatic bunch, and for how smart a lot of them are, they’re...
Exemplary
Let’s be honest, on the whole, tech nerds, of which Firefox has a large base of—and including myself in this category—are an overly dramatic bunch, and for how smart a lot of them are, they’re also very narrow-minded and stubborn. If you take away a tech-nerd’s ability to access the internet in the way they prefer, their first reaction will be to throw their toys out of the cot, rather than the much simpler solution of just going outside and doing something else for a short while.
That’s reason number one. How dare you disrupt my browsing experience for 12 hours?!
The next is a realization that they don’t have complete control over their system (something they never had anyway), and somehow a signing certificate is an example of Mozilla’s paranoia and controlling authoritarianism, which of course, a large bunch of people don’t like.
Notwithstanding that signing certs are basically used everywhere and have been for years as an indication of exchange of trust.
If S3 is unusable, even for a full day, companies don't suddenly switch their entire stack to GCP. They find temporary workarounds. Especially since, downtime aside, those companies have...
If S3 is unusable, even for a full day, companies don't suddenly switch their entire stack to GCP. They find temporary workarounds. Especially since, downtime aside, those companies have contractual reasons to believe this is a one-time thing that will be quickly repaired.
If Firefox is unusable for some reason, people install and use a different browser. A significant portion of those users will stick to Chrome. They're not going to try to figure out whether or not it's a temporary issue, whether or not it's them or the browser or their computer or whatever. They'll just… switch.
"Huh, adblock no longer working on Firefox. I guess I'm using Chrome now."
If S3 were down for the duration it takes a company to switch their stack to GCE, yeah, there would be zero recovery from that. But yes, apples and oranges; you're the one who brought it up.
As @Diff is saying this isn't some hiccup. They might be thinking about the various marketing faux-pas Mozilla has committed. No, this is a huge blow to the Firefox userbase; and in the tech circles (where Mozilla has a stronger advantage than elsewhere), this massively hurts their credibility.
It's not "the end of the free web". I'm not even saying it's the end of firefox. I'm just saying this is a hit that Firefox will not recover from any time soon (because, let's face it, it's not like Firefox is on its way up either way).
Sure feels like the only reason people are making a big deal out of it is because people are making a big deal out of it. Firefox addons broke for a few hours when most of the western hemisphere...
Sure feels like the only reason people are making a big deal out of it is because people are making a big deal out of it.
Firefox addons broke for a few hours when most of the western hemisphere was asleep. On the technical side, yes, it's slightly bigger than a hiccup. For the tech-illiterate majority, it's at most "Huh, the ads are back" before bed followed up by "ah nevermind, they're gone again" the next morning.
To Amazon, I bet it hurt a lot. Many companies that were thinking of switching to cloud-based infrastructure may have lost their nerve. It's hard to measure something like that (versus conversions...
That was a "millions of dollars a minute" event too. What irreparable damage did that cause?
To Amazon, I bet it hurt a lot. Many companies that were thinking of switching to cloud-based infrastructure may have lost their nerve. It's hard to measure something like that (versus conversions to another browser), but that doesn't mean it didn't have a big effect.
i have seven firefox tabs open, and i am terrified of even trying to fiddle with them now because of this, lol. what a fucking disaster. kinda makes me glad that i only half-use firefox for things...
i have seven firefox tabs open, and i am terrified of even trying to fiddle with them now because of this, lol. what a fucking disaster. kinda makes me glad that i only half-use firefox for things like twitter, and most of my browsing is still done in chrome!
It's a personal opinion, sure, but just as you see many important reasons to use Chrome (?), a lot of people have genuine concerns and even fears about the security & access were giving...
It's a personal opinion, sure, but just as you see many important reasons to use Chrome (?), a lot of people have genuine concerns and even fears about the security & access were giving megacorporates to our lives. Google, has single-handedly, through a monopoly in search, managed to arrive at a monopoly in internet browser market share. And which governments across the globe have had an issue with this? Which have raised antitrust issues? None.
That's fucking scary.
That should scare people. The ineptness with failing to renew a signing certificate—to which I will add, I believe the majority of people are overreacting to—pales in comparison to the disaster we're enabling by letting the internet become increasingly centralised on what is effectively a stack of technologies run & controlled by FAANG-like companies.
People that throwing Firefox away over this issue are displaying the exact same technological-equivalent of immaturity that Bernie-to-Trump-but-never-Hillary supporters demonstrated back in 2016.
none of which have pertinence to my personal opinion. i have heard literally every screed in the book, dude. you're not about to convince me any more than those did. i simply don't give a fuck...
It's a personal opinion, sure, but just as you see many important reasons to use Chrome (?), a lot of people have genuine concerns and even fears about the security & access were giving megacorporates to our lives. Google, has single-handedly, through a monopoly in search, managed to arrive at a monopoly in internet browser market share. And which governments across the globe have had an issue with this? Which have raised antitrust issues? None.
none of which have pertinence to my personal opinion. i have heard literally every screed in the book, dude. you're not about to convince me any more than those did. i simply don't give a fuck about chrome being google's personal plaything and them having basically a monopoly on browsers anymore (nor do i give a fuck about the increasingly un-diverse state of browsers or the increasingly centralized state of the internet) because all of those battles were lost years ago. the only way that anything will ever change in the future is through either entropy (which is unlikely, as chrome is still increasing its market share), or actual legislative and political action. it's not going to be because i, a singular person, suddenly swear off chrome.
I find both Chrome and Firefox to be awesome browsers. It's incredible the advances Firefox have made with Rust, and that Chrome made with V8 and its multi-processor architecture. Both layout...
I find both Chrome and Firefox to be awesome browsers. It's incredible the advances Firefox have made with Rust, and that Chrome made with V8 and its multi-processor architecture. Both layout engines are also extremely sophisticated.
Really, I don't see any need for tribalism between them. That just hurts the conversation in my view. Use the browser that offers the strengths that you value most.
If it hasn't happened already you probably don't have the affected plugins (all but around 160), are behind in updates or are using the extended-support version.
If it hasn't happened already you probably don't have the affected plugins (all but around 160), are behind in updates or are using the extended-support version.
Firefox are scrabbling to stay out of the relegation zone and they just scored a massive own goal. They really can't afford to hemorrhage users. Browser monoculture is critical right now - it's...
Firefox are scrabbling to stay out of the relegation zone and they just scored a massive own goal. They really can't afford to hemorrhage users. Browser monoculture is critical right now - it's reached the point where lazy developers won't bother to even test their apps outside of WebKit. Having such a massive proportion of the world's software be reliant on one massive monolith is a disaster waiting to happen, but it's seeming more and more inevitable with each passing day.
It looks like this might be (close to) over! - Eric Rescorla (:ekr), Comment 57, OP
It looks like this might be (close to) over!
Update: We have rolled out a partial fix for this issue. We generated a new intermediate certificate with the same name/key but an updated validity window and pushed it out to users via Normandy (this should be most users). Users who have Normandy on should see their add-ons start working over the next few hours. We are continuing to work on packaging up the new certificate for users who have Normandy disabled.
Comments contain this incredibly useful link. https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi If you don't feel...
If you don't feel like enabling Studies (or if your distros forcefully disables it), just click this link to install the same hotfix Studies tries to. Tested working on my Android phone. Been 2 minutes and nobody's died yet, and my extensions returned to normal instantly.
Hmm, I have the developer edition already. I can set xpinstall.signatures.required to false, but then what? It still won't allow me to re-enable all the plugins it considers "legacy" now. Even...
Hmm, I have the developer edition already. I can set xpinstall.signatures.required to false, but then what? It still won't allow me to re-enable all the plugins it considers "legacy" now. Even when I go to their addons page and try it to reinstall them it says "Download failed. Please check your connection."
This seems very problematic for Firefox. They've been having a lot of PR issues for their more tech-oriented users, and this is even more extreme. If they don't manage to fix this very quickly,...
This seems very problematic for Firefox. They've been having a lot of PR issues for their more tech-oriented users, and this is even more extreme. If they don't manage to fix this very quickly, they'll start losing users.
It's a pretty bad self-own, considering their marketing push. I hadn't used Chromium for a good while and I immediately went and downloaded it. Who knows how many people did/will do the same and...
It's a pretty bad self-own, considering their marketing push. I hadn't used Chromium for a good while and I immediately went and downloaded it. Who knows how many people did/will do the same and not switch back?
It affects Tor Browser as well. One would say Tor Browser would be not depend on a single organization. I don't quite understand why an expiring certificate is necessary for extensions. If they...
It affects Tor Browser as well. One would say Tor Browser would be not depend on a single organization. I don't quite understand why an expiring certificate is necessary for extensions. If they need verification if it wasn't mitm'ed, why not just check if it's from mozilla and not care about the expiration date.
SwiftOnSecurity posted a small explanatory thread on the why of it. Certification was one of the few ways they could have done this, short of locking down the entire ecosystem and only having...
SwiftOnSecurity posted a small explanatory thread on the why of it. Certification was one of the few ways they could have done this, short of locking down the entire ecosystem and only having Mozilla build extensions.
Don't restart your browser. That's what did it for me. Although a lot of users on /r/firefox are claiming they restarted it and it hasn't happened to them yet either. So it may be that they have...
Don't restart your browser. That's what did it for me. Although a lot of users on /r/firefox are claiming they restarted it and it hasn't happened to them yet either. So it may be that they have already partially solved it (probably by renewing the cert) and have prevented it from happening to anyone new loading up firefox, but they are now just trying to find a way to undo the damage to those who it did effect.
wow, I was reading this just now, being happy I didn't restart the browser today. Then without the page or the browser being refreshed, I got the message that one or more add-ons cannot be...
wow, I was reading this just now, being happy I didn't restart the browser today. Then without the page or the browser being refreshed, I got the message that one or more add-ons cannot be verified and have been disabled.
Holy crap... so it's still happening and doesn't require a restart of the browser in order to occur? This is so much worse than I initially thought. And it's also been over 5 hours and still no...
Holy crap... so it's still happening and doesn't require a restart of the browser in order to occur? This is so much worse than I initially thought. And it's also been over 5 hours and still no fix yet either. WTF?
Yeah, no restart needed. Good thing is that I had another browser configured perfectly (Opera), so the switch is seamless for me while I wait for the storm to pass.
Yeah, no restart needed. Good thing is that I had another browser configured perfectly (Opera), so the switch is seamless for me while I wait for the storm to pass.
Literally minutes after telling a friend that at some point my browser will phone home and disable all addons I open this thread and get the fatal yellow message.
Literally minutes after telling a friend that at some point my browser will phone home and disable all addons I open this thread and get the fatal yellow message.
Seems to vary. Both my laptop and desktop are still functional. Although my desktop now has a "THIS ADDON CANNOT BE VERIFIED" label plastered on every one in the addons page. My phone addons...
Seems to vary. Both my laptop and desktop are still functional. Although my desktop now has a "THIS ADDON CANNOT BE VERIFIED" label plastered on every one in the addons page. My phone addons appear to still be functional, they still work and still have menu entries, but there are no longer any addons listed in the addons page.
There's a config key that determines how long until the next check is done, so it won't be the same time for everyone. I think the default is once a day so I guess they just haven't passed the...
That's what did it for me. Although a lot of users on /r/firefox are claiming they restarted it and it hasn't happened to them yet either.
There's a config key that determines how long until the next check is done, so it won't be the same time for everyone. I think the default is once a day so I guess they just haven't passed the timeout threshold yet.
Mine is till OK for now. If they get disabled I'll install and migrate my profile to Nightly and set the xpinstall.signatures.required key fto false until it's fixed.
Tangentially related, but stuff like this is exactly why I am upset that Microsoft does not intend to publish Edge's old engine. We can't afford having just one alternative.
Tangentially related, but stuff like this is exactly why I am upset that Microsoft does not intend to publish Edge's old engine. We can't afford having just one alternative.
While that's true for users, one problem is that web developers want to focus compatibility on as few browsers as possible. Understandable, seeing as it creates more work to support more browsers.
While that's true for users, one problem is that web developers want to focus compatibility on as few browsers as possible. Understandable, seeing as it creates more work to support more browsers.
Here's a temporary fix for Firefox stable. Run it from the JS console while on a settings page. You will need to re-run this in 24 hours assuming Mozilla hasn't somehow fixed this by then.
Here's a temporary fix for Firefox stable. Run it from the JS console while on a settings page. You will need to re-run this in 24 hours assuming Mozilla hasn't somehow fixed this by then.
You can also go to about:debugging, click "load temporary addon" and navigate to your Firefox profile extensions directory (e.g. Win10 =...
You can also go to about:debugging, click "load temporary addon" and navigate to your Firefox profile extensions directory (e.g. Win10 = %AppData%\Roaming\Mozilla\Firefox\Profiles\<profileID>.default\extensions) and select the addon xpi file you want to re-enable. I just did that for Tree Tabs and Ubock (which I can't live without). They will disappear again if you restart your browser though.
What a mess. I feel for them. I can't live without Tree Tabs and uBlock Origin. I hope Void Linux repositories does not have this version when i come home on Sunday.
What a mess. I feel for them.
I can't live without Tree Tabs and uBlock Origin.
I hope Void Linux repositories does not have this version when i come home on Sunday.
I have no idea how they did the fix. I was using firefox and then the next minute my tree tabs came back. This is extra puzzling because I use linux and do not get my updates from mozilla directly.
I have no idea how they did the fix. I was using firefox and then the next minute my tree tabs came back. This is extra puzzling because I use linux and do not get my updates from mozilla directly.
Good thing they got people to disable studies with their Mr. Robot stunt. I have to turn on a tracker in order to get my tracker-blocking extensions to work...
Good thing they got people to disable studies with their Mr. Robot stunt.
I have to turn on a tracker in order to get my tracker-blocking extensions to work...
It's literally listed under "Firefox Data Collection and Use". Anyone who knows what they are doing would have everything in that section turned off, especially after the Mr. Robot thing.
It's literally listed under "Firefox Data Collection and Use". Anyone who knows what they are doing would have everything in that section turned off, especially after the Mr. Robot thing.
So many "Firefox is doomed", "irreparable damage has been done" comments in the heat of the moment. Yet, everything seems fine right now. :) Hopefully this is a lesson to a lot of people to temper...
So many "Firefox is doomed", "irreparable damage has been done" comments in the heat of the moment. Yet, everything seems fine right now. :)
Hopefully this is a lesson to a lot of people to temper their views & commentary during times of outrage. Because in all likelihood, what your complaining about probably isn't that important at all, and will be forgotten as the sands of time blow past.
To be fair, we don't know how much damage was done and how many people migrated away from Firefox as a result of this. And like it or not, agree with it or not, this sort of major fuck up does...
To be fair, we don't know how much damage was done and how many people migrated away from Firefox as a result of this. And like it or not, agree with it or not, this sort of major fuck up does damage Mozilla/Firefox's reputation. Not irreparably and it's not the end of the world by any means, but damage was done, and pretending otherwise is just as bad as the chicken-little overreacting IMO.
Yes, I agree with you absolutely. This is my point. People that were saying damage was "irreparable" or Firefox was literally doomed were completely overreacting. I'm not swinging the other...
Yes, I agree with you absolutely. This is my point. People that were saying damage was "irreparable" or Firefox was literally doomed were completely overreacting. I'm not swinging the other direction, I'm pointing out how silly those extremist arguments sound right now.
probably not, because it would be the dumbest, shittiest PR stunt of all time since it fucks the functionality of firefox for some people and makes browsing the internet borderline unusable or...
probably not, because it would be the dumbest, shittiest PR stunt of all time since it fucks the functionality of firefox for some people and makes browsing the internet borderline unusable or otherwise unsafe for a lot of people. there are more than a few organizations whose workflow is predicated on things like firefox addons, and an awful lot of people use things like noscript or an adblocker or things like stylish to craft their experience that are now having their ability to use the internet basically impeded if they still use firefox.
Thanks. I'm fortunate enough to have nothing to do with our add-on code or the PKI that supports it. The best thing I can do for now is stay the fuck out of the way of those who are spending every...
Thanks. I'm fortunate enough to have nothing to do with our add-on code or the PKI that supports it. The best thing I can do for now is stay the fuck out of the way of those who are spending every waking hour this weekend busting their asses to fix this.
There will be plenty of time for a post mortem once the issues are resolved, but right now the focus is 100% on putting out the fires.
Oh man, this is a disaster. Unless they get an update to fix this out immediately (like, before most people notice), I think this is going to do significant damage to Firefox. They're already having trouble clinging to a small percentage of browser share, and effectively encouraging people to switch to get their extensions back is really not going to help.
The number of users in /r/Firefox is shooting up constantly (and that's not usually a very active subreddit), so there are clearly a lot of people trying to figure out what's going wrong, and less-technical (and less-patient) people will probably just install Chrome instead of searching around and troubleshooting.
Edit: it's been acknowledged on GitHub, so I'm sure they're doing whatever they can now, probably scrambling to push an update faster than ever before?
Yeah, significant irreparable damage. This reminds me of one of these cases where large companies say "every minute this is broken we lose a million dollars".
Obviously this case isn't measured in dollars, it's hard to put a price tag on the importance of Firefox still being a major player on the web though ...
I don't mean to be overly critical here, but come on, what's your source for "irreparable" damage? Do you remember when AWS nearly completely went down for an entire day when an employee fat-fingered a command? That was a "millions of dollars a minute" event too. What irreparable damage did that cause?
In many cases, the browser market is very similar to the cloud computing market. High stakes, multi-provider.
If people are willing to switch from a browser run by a company which demonstrates ineptness to one run by a company which demonstrates malice—all over a superficial issue people won't see as a big demarcating event in the history of the web in a year or two—then that's on them.
For some weird reason people seem to overreact when it comes to Firefox. I think lots of people got their hopes pinned on it or something. And it is very important that Firefox grows in order to keep a Google/Blink/Webkit web ecosystem monopoly at bay, but it seems like every time Firefox has a hiccup there's droves of people calling it The End of the Free Web. This is slightly bigger than a hiccup, I'll admit, but still.
Yeah. I'm carefully trying not to discount the fact that I might be missing something that more tech-savvy people would care about, but I've yet to see any convincing explanations as to why browser extensions being disabled for a few hours is THE END OF FIREFOX.
Yeah, they screwed up, but people are acting like the sky is falling.
Let’s be honest, on the whole, tech nerds, of which Firefox has a large base of—and including myself in this category—are an overly dramatic bunch, and for how smart a lot of them are, they’re also very narrow-minded and stubborn. If you take away a tech-nerd’s ability to access the internet in the way they prefer, their first reaction will be to throw their toys out of the cot, rather than the much simpler solution of just going outside and doing something else for a short while.
That’s reason number one. How dare you disrupt my browsing experience for 12 hours?!
The next is a realization that they don’t have complete control over their system (something they never had anyway), and somehow a signing certificate is an example of Mozilla’s paranoia and controlling authoritarianism, which of course, a large bunch of people don’t like.
Notwithstanding that signing certs are basically used everywhere and have been for years as an indication of exchange of trust.
If S3 is unusable, even for a full day, companies don't suddenly switch their entire stack to GCP. They find temporary workarounds. Especially since, downtime aside, those companies have contractual reasons to believe this is a one-time thing that will be quickly repaired.
If Firefox is unusable for some reason, people install and use a different browser. A significant portion of those users will stick to Chrome. They're not going to try to figure out whether or not it's a temporary issue, whether or not it's them or the browser or their computer or whatever. They'll just… switch.
"Huh, adblock no longer working on Firefox. I guess I'm using Chrome now."
If S3 were down for the duration it takes a company to switch their stack to GCE, yeah, there would be zero recovery from that. But yes, apples and oranges; you're the one who brought it up.
As @Diff is saying this isn't some hiccup. They might be thinking about the various marketing faux-pas Mozilla has committed. No, this is a huge blow to the Firefox userbase; and in the tech circles (where Mozilla has a stronger advantage than elsewhere), this massively hurts their credibility.
It's not "the end of the free web". I'm not even saying it's the end of firefox. I'm just saying this is a hit that Firefox will not recover from any time soon (because, let's face it, it's not like Firefox is on its way up either way).
Sure feels like the only reason people are making a big deal out of it is because people are making a big deal out of it.
Firefox addons broke for a few hours when most of the western hemisphere was asleep. On the technical side, yes, it's slightly bigger than a hiccup. For the tech-illiterate majority, it's at most "Huh, the ads are back" before bed followed up by "ah nevermind, they're gone again" the next morning.
It didn't do as much damage because there's not much in the way of competition to AWS.
Whereas here, there's chrome.
To Amazon, I bet it hurt a lot. Many companies that were thinking of switching to cloud-based infrastructure may have lost their nerve. It's hard to measure something like that (versus conversions to another browser), but that doesn't mean it didn't have a big effect.
i have seven firefox tabs open, and i am terrified of even trying to fiddle with them now because of this, lol. what a fucking disaster. kinda makes me glad that i only half-use firefox for things like twitter, and most of my browsing is still done in chrome!
I really wouldn't be "glad" at any point to use Chrome, irrespective of Firefox's (non)-functionality.
cool, that's your personal opinion. i don't particularly care for firefox and never have.
It's a personal opinion, sure, but just as you see many important reasons to use Chrome (?), a lot of people have genuine concerns and even fears about the security & access were giving megacorporates to our lives. Google, has single-handedly, through a monopoly in search, managed to arrive at a monopoly in internet browser market share. And which governments across the globe have had an issue with this? Which have raised antitrust issues? None.
That's fucking scary.
That should scare people. The ineptness with failing to renew a signing certificate—to which I will add, I believe the majority of people are overreacting to—pales in comparison to the disaster we're enabling by letting the internet become increasingly centralised on what is effectively a stack of technologies run & controlled by FAANG-like companies.
People that throwing Firefox away over this issue are displaying the exact same technological-equivalent of immaturity that Bernie-to-Trump-but-never-Hillary supporters demonstrated back in 2016.
none of which have pertinence to my personal opinion. i have heard literally every screed in the book, dude. you're not about to convince me any more than those did. i simply don't give a fuck about chrome being google's personal plaything and them having basically a monopoly on browsers anymore (nor do i give a fuck about the increasingly un-diverse state of browsers or the increasingly centralized state of the internet) because all of those battles were lost years ago. the only way that anything will ever change in the future is through either entropy (which is unlikely, as chrome is still increasing its market share), or actual legislative and political action. it's not going to be because i, a singular person, suddenly swear off chrome.
You seem to be taking personal offence to my commentary, so I'll be discontinuing any discussion here.
I find both Chrome and Firefox to be awesome browsers. It's incredible the advances Firefox have made with Rust, and that Chrome made with V8 and its multi-processor architecture. Both layout engines are also extremely sophisticated.
Really, I don't see any need for tribalism between them. That just hurts the conversation in my view. Use the browser that offers the strengths that you value most.
If it hasn't happened already you probably don't have the affected plugins (all but around 160), are behind in updates or are using the extended-support version.
I downloaded Chromium immediately. I may be spoiled, but the web is almost unusable for me without a few extensions.
Firefox are scrabbling to stay out of the relegation zone and they just scored a massive own goal. They really can't afford to hemorrhage users. Browser monoculture is critical right now - it's reached the point where lazy developers won't bother to even test their apps outside of WebKit. Having such a massive proportion of the world's software be reliant on one massive monolith is a disaster waiting to happen, but it's seeming more and more inevitable with each passing day.
It looks like this might be (close to) over!
- Eric Rescorla (:ekr), Comment 57, OP
Here's the official blog post about the fix: https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/
Comments contain this incredibly useful link.
https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi
If you don't feel like enabling Studies (or if your distros forcefully disables it), just click this link to install the same hotfix Studies tries to. Tested working on my Android phone. Been 2 minutes and nobody's died yet, and my extensions returned to normal instantly.
Updates are being posted by the Mozilla Addons team here: https://twitter.com/mozamo
/r/Firefox has possible workaround but it's a PITA:
https://www.reddit.com/r/firefox/comments/bkfjts/if_you_want_your_addons_back_install_ff_nightly/
edit: Another possible fix that doesn't require switching to Nightly, only rolling back your clock and reinstalling all the addons... so still a PITA but slightly less so:
https://www.reddit.com/r/firefox/comments/bkgenm/stepbystep_guide_to_fix_your_extensions/
edit2: Some easier temporary fixes posted below:
https://tildes.net/~tech/d1f/firefox_bug_all_extensions_disabled_due_to_expiration_of_intermediate_signing_cert#comment-35wd
Hmm, I have the developer edition already. I can set
xpinstall.signatures.requiredto false, but then what? It still won't allow me to re-enable all the plugins it considers "legacy" now. Even when I go to their addons page and try it to reinstall them it says "Download failed. Please check your connection."Yeah, it didn't work for me either.
This seems very problematic for Firefox. They've been having a lot of PR issues for their more tech-oriented users, and this is even more extreme. If they don't manage to fix this very quickly, they'll start losing users.
Its fixed now.
It seems partial fixes have rolled out, but not yet complete fixes.
It's a pretty bad self-own, considering their marketing push. I hadn't used Chromium for a good while and I immediately went and downloaded it. Who knows how many people did/will do the same and not switch back?
This is a catastrophic failure and insane bad publicity for Firefox's image.
It affects Tor Browser as well. One would say Tor Browser would be not depend on a single organization. I don't quite understand why an expiring certificate is necessary for extensions. If they need verification if it wasn't mitm'ed, why not just check if it's from mozilla and not care about the expiration date.
SwiftOnSecurity posted a small explanatory thread on the why of it. Certification was one of the few ways they could have done this, short of locking down the entire ecosystem and only having Mozilla build extensions.
All my extensions are working fine :/
Don't restart your browser. That's what did it for me. Although a lot of users on /r/firefox are claiming they restarted it and it hasn't happened to them yet either. So it may be that they have already partially solved it (probably by renewing the cert) and have prevented it from happening to anyone new loading up firefox, but they are now just trying to find a way to undo the damage to those who it did effect.
wow, I was reading this just now, being happy I didn't restart the browser today. Then without the page or the browser being refreshed, I got the message that
one or more add-ons cannot be verified and have been disabled.Holy crap... so it's still happening and doesn't require a restart of the browser in order to occur? This is so much worse than I initially thought. And it's also been over 5 hours and still no fix yet either. WTF?
Yeah, no restart needed. Good thing is that I had another browser configured perfectly (Opera), so the switch is seamless for me while I wait for the storm to pass.
Literally minutes after telling a friend that at some point my browser will phone home and disable all addons I open this thread and get the fatal yellow message.
Seems to vary. Both my laptop and desktop are still functional. Although my desktop now has a "THIS ADDON CANNOT BE VERIFIED" label plastered on every one in the addons page. My phone addons appear to still be functional, they still work and still have menu entries, but there are no longer any addons listed in the addons page.
There's a config key that determines how long until the next check is done, so it won't be the same time for everyone. I think the default is once a day so I guess they just haven't passed the timeout threshold yet.
Mine is till OK for now. If they get disabled I'll install and migrate my profile to Nightly and set the
xpinstall.signatures.requiredkey fto false until it's fixed.Same for me
The only good news for Firefox is that this occurred on a Friday/weekend.
Well, I HAVE wanted to try the new Edge browser... Bad timing Mozilla...
Tangentially related, but stuff like this is exactly why I am upset that Microsoft does not intend to publish Edge's old engine. We can't afford having just one alternative.
While that's true for users, one problem is that web developers want to focus compatibility on as few browsers as possible. Understandable, seeing as it creates more work to support more browsers.
Here's a temporary fix for Firefox stable. Run it from the JS console while on a settings page. You will need to re-run this in 24 hours assuming Mozilla hasn't somehow fixed this by then.
You can also go to
about:debugging, click "load temporary addon" and navigate to your Firefox profile extensions directory (e.g. Win10 = %AppData%\Roaming\Mozilla\Firefox\Profiles\<profileID>.default\extensions) and select the addon xpi file you want to re-enable. I just did that for Tree Tabs and Ubock (which I can't live without). They will disappear again if you restart your browser though.What a mess. I feel for them.
I can't live without Tree Tabs and uBlock Origin.
I hope Void Linux repositories does not have this version when i come home on Sunday.
I hope it will be solved till sunday.
I have no idea how they did the fix. I was using firefox and then the next minute my tree tabs came back. This is extra puzzling because I use linux and do not get my updates from mozilla directly.
Good thing they got people to disable studies with their Mr. Robot stunt.
I have to turn on a tracker in order to get my tracker-blocking extensions to work...
Calling them trackers might be a tad disingenuous and overdramatic but okay.
It's literally listed under "Firefox Data Collection and Use". Anyone who knows what they are doing would have everything in that section turned off, especially after the Mr. Robot thing.
So many "Firefox is doomed", "irreparable damage has been done" comments in the heat of the moment. Yet, everything seems fine right now. :)
Hopefully this is a lesson to a lot of people to temper their views & commentary during times of outrage. Because in all likelihood, what your complaining about probably isn't that important at all, and will be forgotten as the sands of time blow past.
To be fair, we don't know how much damage was done and how many people migrated away from Firefox as a result of this. And like it or not, agree with it or not, this sort of major fuck up does damage Mozilla/Firefox's reputation. Not irreparably and it's not the end of the world by any means, but damage was done, and pretending otherwise is just as bad as the chicken-little overreacting IMO.
Yes, I agree with you absolutely. This is my point. People that were saying damage was "irreparable" or Firefox was literally doomed were completely overreacting. I'm not swinging the other direction, I'm pointing out how silly those extremist arguments sound right now.
So this is why my ad blocker wasn't working last night. I can't believe how many ads there are on YouTube now. Its unwatchable.
probably not, because it would be the dumbest, shittiest PR stunt of all time since it fucks the functionality of firefox for some people and makes browsing the internet borderline unusable or otherwise unsafe for a lot of people. there are more than a few organizations whose workflow is predicated on things like firefox addons, and an awful lot of people use things like noscript or an adblocker or things like stylish to craft their experience that are now having their ability to use the internet basically impeded if they still use firefox.
No.
Thanks. I'm fortunate enough to have nothing to do with our add-on code or the PKI that supports it. The best thing I can do for now is stay the fuck out of the way of those who are spending every waking hour this weekend busting their asses to fix this.
There will be plenty of time for a post mortem once the issues are resolved, but right now the focus is 100% on putting out the fires.