Firefox Add-on Notice

[FancyMancy]

All of my add-ons were disabled, due to "not being verified" and trying to reinstall them, or any for that matter, is impossible - "Download failed. Please check your connection.". I am not on here at this very moment because my Internet connection is dead, so I have absolutely no idea how nor why I logged in here and made this topic. :roll:

Firefox Disabled All My Extentions
https://news.ycombinator.com/item?id=19823465

All extensions disabled due to expiration of intermediate signing cert
https://news.ycombinator.com/item?id=19823701

All of my add-ons got disabled and they are all listed under legacy extensions now.
https://www.reddit.com/r/firefox/comments/bkcjoa/all_of_my_addons_got_disabled_and_they_are_all

Addons/extensions broken?
https://www.reddit.com/r/firefox/comments/bk54mu/addonsextensions_broken

Add-on Policy and Process Updates
https://www.reddit.com/r/firefox/comments/bjwz8n/addon_policy_and_process_updates

 

[FancyMancy]

I much prefer Mozilla Firefox, but like everything that is free and good originally, it becomes shit after it gets popular.

I checked the add-ons section and it said the same for all add-ons, and gave the false-option of searching for alternatives. For one particular add-on, I used a generic term and was about to try all 20-or-so on the first page, but after the first one downloaded but then Firefox told me it is corrupt (which I know it is not because I've used it plenty of times before) I gave up. For another add-on which I use only if I need to, I tried installing it but it wouldn't work at all, and other similar ones of the same type didn't, either.

I think it's a broad purge/replacement with possibly a false "security concern" for everything. Effectively, there are zero add-ons now (as far as I can tell), and that won't do.

 

[High Priest Zevios Metathronos]

They say they are going to try to fix this, some certificate they have got expired. This has fucked over millions. They will fix it but they will have big losses of customers from this.

Maybe in the end this is good for some users because with more crowding there comes the incentive to bug this software even further.

Personally it fucked me up as I went to work on astrology and I do not trust to use Chrome to transfer over any chart. I can only imagine other businesses have the same problem over numerous reasons.

 

[High Priest Zevios Metathronos]

Also this will force some addons out, but some addons may be bugged in themselves with keyloggers or stalking.

So these will get big damage from this. Overall this is really catastrophic both for Mozilla and its fan base.

IMO it cannot be a coincidence.

 

[Hoarfrost]

The Waterfox Project is a very good alternative. It's a fork of Firefox that looks and functions exactly like Firefox without any telemetry being sent back to Mozilla or Waterfox. Legacy extensions dropped by Mozilla and any other Firefox addon are supported.

 

[Ol argedco luciftias]

What about add blocker?

 

[Soaring Eagle 666]

All of my add-ons were disabled, due to "not being verified" and trying to reinstall them, or any for that matter, is impossible - "Download failed. Please check your connection.". I am not on here at this very moment because my Internet connection is dead, so I have absolutely no idea how nor why I logged in here and made this topic. :roll:

Firefox Disabled All My Extentions
https://news.ycombinator.com/item?id=19823465

All extensions disabled due to expiration of intermediate signing cert
https://news.ycombinator.com/item?id=19823701

All of my add-ons got disabled and they are all listed under legacy extensions now.
https://www.reddit.com/r/firefox/comments/bkcjoa/all_of_my_addons_got_disabled_and_they_are_all

Addons/extensions broken?
https://www.reddit.com/r/firefox/comments/bk54mu/addonsextensions_broken

Add-on Policy and Process Updates
https://www.reddit.com/r/firefox/comments/bjwz8n/addon_policy_and_process_updates

This happened to me too.
It is easily circumvented by changing "xpinstall.signatures.required" to "false" in the "about:config" page. However, in newer Firefox versions, this override only works in the developer version https://www.mozilla.org/en-US/firefox/developer/.

 

[Adrellis]

Had this flaw today with an odd solution: if you're AdBlocker you like fails, install another one. The one I used was disabled, installed a recently updated one, now I have 2 AdBlock running..

as well as some old addons from a previous installation that didn't originally carry over. how strange.

 

[Ol argedco luciftias]

When they want you to update to newest version for things like this, it almost always makes it work worse. Works great now, I'm not going to agree to an update. Especially with cellphones, they make a new model phone then they send out an "update" to all their older model phones that breaks them so you're forced to get a new one. Been trying to get me to update it for almost 4 years now but it still works perfect and I know the update would break it.

 

[Gearshift]

https://www.engadget.com/2019/05/03/firefox-extension-add-on-cert/

Simply a certificate expired. So a hotfix is coming soon.

 

[Voice of Enki [SG]]

It is possible to use the dev version of firefox and manually change the config, following these instructions:

2: Disabling signature enforcement

In a supported build, enter about:config into the location bar and push enter. Heed the warning and proceed to search for xpinstall.signatures.required and set it to false.

This tells the browser to no longer care if installed extensions are what they say they are. This is a light security risk, and you should re-enable this once the certificate issue is solved.

All your add-ons should automatically re-enable.


However as it says there this does have a slight decurity risk, but if you know you can trust all the extensions you have installed then there is no risk to it. The certificates are supposed to block sketchy addons and spyware/malware and other malicious addons, but with this fuck up all certificates expired and thus all addons are flagged and unable to be installed unless you use dev mode and disable that line.


I found this link though: https://news.ycombinator.com/item?id=19823701

It gives detail about an automatic update that was done secretly through a backdoor by firefox which is supposed to give a temporary fix to this issue, through an update they refer to as Normandy. I am not an IT expert by any means, but I found this interesting. I checked the config of firefox dev mode and noticed this Normany app was automatically enabled and had been installed without any notice to me, even though I have the option enabled to let firefox ask me permission when installing any update.

I have no idea what it does, and disabling it didn't affect my browser at all, but the name is extremely suspicious and I don't think this is something trust worthy, as the name Normandy really is too specific and too suspect in my opinion, we all know what happened on Normandy after all...

I thought I'd share this for the more tech/IT savvy members we have here who might be interested in this or understand this better.

 

[Zammel]

To me, it didn't happen, strange. However to protect you, use duck, duck go as a search engine (not google, it will track you). Opera, how is it considered? Good, Bad?

 

[Voice of Enki [SG]]

Do you all think it is safe to use firefox dev mode/dev version, or the other version they have, firefox nightly, to which this fix can be applied as well?

I'm also suspicious about this as a lot of users are now jumping over to these other versions of firefox in order to enable this fix, while taking forever to find a fix for this problem.

Do any of you have good alternate browsers to recommend? Firefox was my go to as it seemed an excellent product, but this "bug" and the way it is being handled by firefox, the lack of communication from them anywhere and the sneaky backdoor "fixes" are all really suspect.

 

[Jack]

Disabled addons ? Yesterday I was browsing and my Firefox fucking stopped and the computer hanged until I manually shut it down. Then I opened the Firefox and found all addons gone. I'm like wtf just happened. I also found the symbols of the MS office apps had somehow changed. I did a virus scan after updating my malwarebytes and its like fucking 28 virus.renamer's. I removed all of it and my computer sped up. The app symbols of MS office that were changed are still the same though. This might have been some kind of information salvaging ,privacy stealing attack. I don't know. I'm going to use tor browser from now on.

 

[High Priest Zevios Metathronos]

Do you all think it is safe to use firefox dev mode/dev version, or the other version they have, firefox nightly, to which this fix can be applied as well?

I'm also suspicious about this as a lot of users are now jumping over to these other versions of firefox in order to enable this fix, while taking forever to find a fix for this problem.

Do any of you have good alternate browsers to recommend? Firefox was my go to as it seemed an excellent product, but this "bug" and the way it is being handled by firefox, the lack of communication from them anywhere and the sneaky backdoor "fixes" are all really suspect.

Nightly and Developer sent backlogged data to Mozilla on a constant basis. If you are on this and they have everything you do, this is legal and they have a right since they let you know of it.

On the other browser which is the main they can only do this from the backdoor and not directly.

 

[FancyMancy]

Disabled addons ? Yesterday I was browsing and my Firefox fucking stopped and the computer hanged until I manually shut it down. Then I opened the Firefox and found all addons gone. I'm like wtf just happened. I also found the symbols of the MS office apps had somehow changed. I did a virus scan after updating my malwarebytes and its like fucking 28 virus.renamer's. I removed all of it and my computer sped up. The app symbols of MS office that were changed are still the same though. This might have been some kind of information salvaging ,privacy stealing attack. I don't know. I'm going to use tor browser from now on.

If you enter Tor using a malicious (read: hacker or government agency or vigilante) Entry Node, then they have your IP Address. If you enter using a malicious Entry Node and exit (back to the regular Internet) using a malicious Exit Node, then these 2 nodes, which you go through, can be correlated with the traffic. You could use a proxy/VPN, but you have to be absolutely certain that they are safe to use, don't keep logs and don't keep your ID. Tor isn't as amazing as people think anymore. Not to mention - using Tor, and any proxy/VPN, would mean, according to some, that you have something to hide, but with Tor it's more suspicious as to why you'd be using it.

 

[Apprentice]

This is a link I found and the information there helped me restore my addons.

https://www.reddit.com/r/firefox/comments/bkhzjy/temp_fix_for_the_armagaddon_20_for_regular/

 

[Voice of Enki [SG]]

Everyone, please do be aware that this mozilla fuckup also broke Tor browser.

Tor runs on Firefox, and as a result all the plugins that Tor uses to keep your identity secret and protect your privacy are also broken now, you are no longer anonymous when using Tor browser at this time!

I’m still not sure about a good alternative browser but at the moment I suppose Opera could do, but it feels like it is only a matter of time before they too fall into this pit.

 

[Voice of Enki [SG]]

Nightly and Developer sent backlogged data to Mozilla on a constant basis. If you are on this and they have everything you do, this is legal and they have a right since they let you know of it.

On the other browser which is the main they can only do this from the backdoor and not directly.

Thank you Cobra for your reply, I didn’t know about that, but should have expected that.

The only fix that exists currently is based on enabling studies in Firefox which when enabled basically allows Firefox to install whatever plugins or addons or updates it wants at any time, giving the user less control and Mozilla more, and to enable this you must turn on the option to send back data to Firefox, giving them access to everything and totally infringing your privacy.

Then there is still this Normandy hotfix, which is also what this studies adding they released for this is pushed through to users..

A “proper” fix is supposed to come out on Monday, which is also supposed to work for older versions of Firefox, but there is no word on what it will do and what it wil look like. I highly doubt this fix will be as transparent as it should be and could very well have a lot of unnecessary stuff in it to allow them to gather more data and give users less privacy.

 

[FancyMancy]

Everyone, please do be aware that this mozilla fuckup also broke Tor browser.

Tor runs on Firefox, and as a result all the plugins that Tor uses to keep your identity secret and protect your privacy are also broken now, you are no longer anonymous when using Tor browser at this time!

I’m still not sure about a good alternative browser but at the moment I suppose Opera could do, but it feels like it is only a matter of time before they too fall into this pit.

I thought the Torbrowser was forked from Firefox, but the add-ons might still work on both. I suppose I just assumed the Tor Project forked it, rather than worked on top of Mozilla Firefox directly.

Like when if America had have voted to kill Internet privacy the Pirate Bay said they'd create a second Internet, I wonder if they might create (or have already) a new browser.

 

[FancyMancy]

This is a link I found and the information there helped me restore my addons.

https://www.reddit.com/r/firefox/comments/bkhzjy/temp_fix_for_the_armagaddon_20_for_regular/

I'm too sceptical. If Mozilla has killed it at their end, then I am not confident that anything would be safe to use now. It's like using Tor Browser but keeping javascript enabled - it defeats the object. Similarly to DNS leaks (where your real IP Address can be seen, despite the use of VPNs), I wouldn't put it past now-dirty Mozilla to do something like that with the add-ons, which contacts the Mozilla servers.

"It's the end of an era."

 

[Askell]

I'm using Pale Moon right now, which is a pretty good alternative to Firefox.
http://www.palemoon.org/

Others on other sites have recommended Waterfox and IceCat as other alternatives.

 

[Apprentice]

"It's the end of an era."

Was there any era at all? I mean, having been around computers like forever, I know a thing or two. Regarding the things I don't know, well, the old adage "hope for the best, plan for the worst" has served me well. There is no such thing as anonymity on the Internet.
I remember not very long time ago some people had doubts about Tor project. There really is no guarantee that such projects are not run by sewer agencies. I myself never delved into Tor.

 

[FancyMancy]

"It's the end of an era."

Was there any era at all? I mean, having been around computers like forever, I know a thing or two. Regarding the things I don't know, well, the old adage "hope for the best, plan for the worst" has served me well. There is no such thing as anonymity on the Internet.
I remember not very long time ago some people had doubts about Tor project. There really is no guarantee that such projects are not run by sewer agencies. I myself never delved into Tor.

Well, I suppose. It was perhaps the best browser out there for a while, until it became too popular.

As for Tor - the US Navy, if I'm not mistaken, created it, and then it became public, and the US government both funds to keep it secure and also funds to break into it (or at least, the last I heard).

 

[Cigam]

I had helped a few others with this issue and this was what I found out:

There are 2 ways you can fix the issues with legacy addons being disabled in Firefox 66:

1: Enable the Firefox Studies, but they can be disabled again after the fix is in place:
Firefox Options/Preferences -> Privacy & Security -> Allow Firefox to install and run studies (scroll down to find the setting) However, it may take up to six hours for the Study to be applied to Firefox:
https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/#workarounds

2: Fix without turning Studies on, but applying the fix that is included in the Studies which can be installed from the page that supplies the link:
https://news.ycombinator.com/item?id=19826903
or the link itself, but you may have to download the file if you do it from the below link, instead of the one from above:
https://storage.googleapis.com/[email protected]

After that it may show the plugins not having any of the settings that you have made or adjusted. Just restart firefox again and it should restore all or at least most of the settings you had.

If there are still disabled plugins, then it will have to wait for a future fix and release.

 

[High Priest Zevios Metathronos]

This is a link I found and the information there helped me restore my addons.

https://www.reddit.com/r/firefox/comments/bkhzjy/temp_fix_for_the_armagaddon_20_for_regular/

I'm too sceptical. If Mozilla has killed it at their end, then I am not confident that anything would be safe to use now. It's like using Tor Browser but keeping javascript enabled - it defeats the object. Similarly to DNS leaks (where your real IP Address can be seen, despite the use of VPNs), I wouldn't put it past now-dirty Mozilla to do something like that with the add-ons, which contacts the Mozilla servers.

"It's the end of an era."

The fact they can cause a remote shutdown destroyed my trust in them, insofar that how can one be sure they cannot selectively and remotely close down your addons or whatever?

Addons were supposed to be this local and stored thing running locally. What is next, remote shutdown of selected capabilities?

Let's say you use a password manager, indeed this reeks of how they can mine and remote control or plainly steal the passwords.

The addons themselves asked for strange permissions but this is just too far.