{"id":15259,"date":"2019-05-06T12:30:03","date_gmt":"2019-05-06T20:30:03","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2019\/05\/06\/news-9008\/"},"modified":"2019-05-06T12:30:03","modified_gmt":"2019-05-06T20:30:03","slug":"news-9008","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2019\/05\/06\/news-9008\/","title":{"rendered":"Mozilla issues fix after it lets cert expire and Firefox add-ons go belly-up"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/images.techhive.com\/images\/article\/2016\/05\/pcw-firefox-primary-100662826-primary.idge.jpg\"\/><\/p>\n<p><strong>Credit to Author: Gregg Keizer| Date: Mon, 06 May 2019 12:21:00 -0700<\/strong><\/p>\n<p>Mozilla over the weekend scrambled to come up with a fix for a bug that crippled most Firefox add-ons.<\/p>\n<p>Engineers issued an update for the desktop browser Sunday afternoon that addressed the issue. That update followed a Saturday hotfix released via a little-known component that lets Mozilla feed pre-release code to Firefox users and then collect data from the browser.<\/p>\n<p>The problem was traced to the certificate used by Mozilla to digitally sign Firefox extensions. When the organization neglected to renew the certificate, Firefox assumed the add-ons could not be trusted &#8211; that they were, in other words, illegitimate at best, potentially malicious at worst &#8211; and then disabled any already installed. Add-ons could not be added to the browser for the same reason.<\/p>\n<p>Mozilla acknowledged the screw-up Saturday. &#8220;We&#8217;re investigating an issue with a certificate which may cause your @firefox extensions to stop work working or fail to install,&#8221; the company&#8217;s <a href=\"https:\/\/twitter.com\/mozamo\/status\/1124484255159971840\" rel=\"noopener nofollow\" target=\"_blank\">Add-ons Twitter account<\/a> stated.<\/p>\n<p>Some users were livid. &#8220;How much longer? This is nuts,&#8221; ranted <i>aa_lique<\/i> in a <a href=\"https:\/\/discourse.mozilla.org\/t\/thread-add-ons-not-working-due-to-certificate-expiration\/38968\/208\" rel=\"noopener nofollow\" target=\"_blank\">message to a support thread<\/a>. &#8220;Nothing is working now.&#8221; Others threatened to dump Firefox or said they&#8217;d already switched to a rival.<\/p>\n<p>A few took it in stride and asked others to calm down. &#8220;Your lives will not be permanently ruined &#8230; don&#8217;t go hyperventilating,&#8221; advised <a href=\"https:\/\/discourse.mozilla.org\/t\/thread-add-ons-not-working-due-to-certificate-expiration\/38968\/202\" rel=\"noopener nofollow\" target=\"_blank\"><i>scruffy1<\/i><\/a>. &#8220;Breathe in, breathe out; it will be better soon.&#8221;<\/p>\n<p>Mozilla crafted a temporary fix for the desktop versions of Firefox and pushed the patch to the browser using the <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/shield?as=u&amp;utm_source=inproduct\" rel=\"noopener nofollow\" target=\"_blank\">Studies system<\/a>. Mozilla uses Studies to push test code, sometimes for new features, to a subsection of the Firefox user base; the organization has also used Studies to collect data on users&#8217; reactions to sponsored content.<\/p>\n<p>The highlighted &#8220;study&#8221; was actually a hotfix pushed to Firefox starting on Saturday to address the crippled add-ons debacle. Mozilla issued a browser update on Sunday.<\/p>\n<p>Studies is switched on by default, something that likely surprised most users. To change Studies&#8217; settings, users should call up Firefox&#8217;s Preferences, select &#8220;Privacy &amp; Security&#8221; from the pane on the left, scroll to the &#8220;Firefox Data Collection and Use&#8221; section, then check or uncheck the box labeled &#8220;Allow Firefox to install and run studies.&#8221;<\/p>\n<p>(To view the completed studies and those underway, users can type <i>about:studies<\/i> in the address bar and press Enter\/Return.)<\/p>\n<p>Mozilla used Studies to deploy the hotfix as soon as possible rather than make users wait for a full browser update. Some reported that they didn&#8217;t receive the hotfix or that it had not enabled Firefox&#8217;s add-ons.<\/p>\n<p>Sunday afternoon, Mozilla shipped a Firefox update &#8211; <a href=\"https:\/\/www.mozilla.org\/en-US\/firefox\/66.0.4\/releasenotes\/?utm_source=firefox-browser&amp;utm_medium=firefox-browser&amp;utm_campaign=whatsnew\" rel=\"noopener nofollow\" target=\"_blank\">66.0.4<\/a> &#8211; that corrected the certificate chaining error and put things right. &#8220;There are remaining issues that we are actively working to resolve, but we wanted to get this fix out before Monday to lessen the impact of disabled add-ons before the start of the week,&#8221; wrote Kev Needham, a product manager on the add-ons team, in a <a href=\"https:\/\/blog.mozilla.org\/addons\/2019\/05\/04\/update-regarding-add-ons-in-firefox\/\" rel=\"noopener nofollow\" target=\"_blank\">post to a company blog<\/a>. The &#8220;remaining issues&#8221; Needham mentioned included themes that may need to be enabled manually and some add-ons that must be reinstalled.<\/p>\n<p>Also updated: Firefox on Android and <a href=\"https:\/\/www.mozilla.org\/en-US\/firefox\/60.6.2\/releasenotes\/\" rel=\"noopener nofollow\" target=\"_blank\">Firefox ESR<\/a> (Extended Support Release), the enterprise-grade version that stays feature-static for a year or more.<\/p>\n<p>Although Mozilla acted quickly &#8211; the Firefox update was available about 48 hours after reports began flooding social media &#8211; the certificate gaffe may trigger desertions. Firefox, whose user share languished over much of the past year in the single digits, doesn&#8217;t have room for error. Mozilla&#8217;s browser last month had less than a sixth of the share of Google&#8217;s Chrome and only 70% of Microsoft&#8217;s two browsers, Internet Explorer and Edge.<\/p>\n<p><a href=\"https:\/\/www.computerworld.com\/article\/3393446\/mozilla-issues-fix-after-it-lets-cert-expire-and-firefox-add-ons-go-belly-up.html#tk.rss_security\" target=\"bwo\" >http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/images.techhive.com\/images\/article\/2016\/05\/pcw-firefox-primary-100662826-primary.idge.jpg\"\/><\/p>\n<p><strong>Credit to Author: Gregg Keizer| Date: Mon, 06 May 2019 12:21:00 -0700<\/strong><\/p>\n<article>\n<section class=\"page\">\n<p>Mozilla over the weekend scrambled to come up with a fix for a bug that crippled most Firefox add-ons.<\/p>\n<p>Engineers issued an update for the desktop browser Sunday afternoon that addressed the issue. That update followed a Saturday hotfix released via a little-known component that lets Mozilla feed pre-release code to Firefox users and then collect data from the browser.<\/p>\n<aside class=\"fakesidebar\"><strong>[ Further reading: <a href=\"https:\/\/www.computerworld.com\/article\/3219733\/web-browsers\/the-14-best-firefox-add-ons.html\">14 must-have Firefox add-ons<\/a> ]<\/strong><\/aside>\n<p>The problem was traced to the certificate used by Mozilla to digitally sign Firefox extensions. When the organization neglected to renew the certificate, Firefox assumed the add-ons could not be trusted &#8211; that they were, in other words, illegitimate at best, potentially malicious at worst &#8211; and then disabled any already installed. Add-ons could not be added to the browser for the same reason.<\/p>\n<p class=\"jumpTag\"><a href=\"\/article\/3393446\/mozilla-issues-fix-after-it-lets-cert-expire-and-firefox-add-ons-go-belly-up.html#jump\">To read this article in full, please click here<\/a><\/p>\n<\/section>\n<\/article>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[12014,714],"class_list":["post-15259","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-browsers","tag-security"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/15259","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=15259"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/15259\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=15259"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=15259"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=15259"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}