Well, this is infuriating. I hate that my browser just became essentially useless to me because someone at Mozilla messed something up. Anyone know if there’s a way to opt out of the extension verification stuff?

This issue also disables NoScript in Tor Browser.

Update: There will be a dot release shortly, but only so we affect less people. If you don’t take or get the dot release, you’ll still be able to see and verify the new certificate (updated through kinto, for remote settings updates).

More updates will happen in https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disabled-or-fail-to-install/39047

The post mortem for this should be a good read. But first, let’s hope there’s a resolution soon, because this is a highly disruptive issue for Firefox users and could lead to users abandoning Firefox over. It’s also a rough situation for the unfortunate Mozilla employees who have to deal with this going into the weekend.

FWIW one of the Firefox security team members who would be on my short list for “person in charge of renewing this certificate” is currently in the middle of a multi-week vacation. This is pure speculation on my part, but I wouldn’t be surprised if a contributing cause to this incident were that the renewal reminder emails for this certificate were going to the inbox of someone not checking their email while on vacation. But I suspect there wasn’t a single point of failure here because the people who manage these certificates at Mozilla are typically very on top of their game and are some of the best security people I’ve interacted with. I’m quite surprised this occurred and suspect there are multiple contributing causes. We’ll just have to wait for the post mortem to see.

Should be fixed now.

I was able to get them back by disabling xpinstall.signatures.required. It might require a nightly version to actually work? Of course, you’d want to turn it back on once it’s fixed…

To re-enable all disabled non-system addons you can do the following. I am not responsible if this fucks up your install:

Open the browser console by hitting ctrl-shift-j

Copy and paste the following code, hit enter. Until mozilla fixes the problem you will need to redo this once every 24 hours:

// Re-enable *all* extensions

async function set_addons_as_signed() {
    Components.utils.import("resource://gre/modules/addons/XPIDatabase.jsm");
    Components.utils.import("resource://gre/modules/AddonManager.jsm");
    let addons = await XPIDatabase.getAddonList(a => true);

    for (let addon of addons) {
        // The add-on might have vanished, we'll catch that on the next startup
        if (!addon._sourceBundle.exists())
            continue;

        if( addon.signedState != AddonManager.SIGNEDSTATE_UNKNOWN )
            continue;

        addon.signedState = AddonManager.SIGNEDSTATE_NOT_REQUIRED;
        AddonManagerPrivate.callAddonListeners("onPropertyChanged",
                                                addon.wrapper,
                                                ["signedState"]);

        await XPIDatabase.updateAddonDisabledState(addon);

    }
    XPIDatabase.saveChanges();
}

set_addons_as_signed();

Edit: Cleaned up code slightly

Here’s the Lobsters story on the introduction of extension signing.

So, as noted on HN this isn’t affecting everyone yet.

Actually, I’m surprised it’s affecting so many people. It looks to me like extensions signatures are only checked once every 24 hours (source), and assuming a random distribution of when it checks it should only be broken for 13% of installs so far. But from the comments I’m seeing it sounds like it’s much greater.

I’m wondering if people would be willing to post the value of app.update.lastUpdateTime.xpi-signature-verification from their about:configs, which should show when the timer last fired for you. I’m curious if there is some weird distribution. (I’m not involved with fixing the problem or anything though, this is just for my own curiosity).

Edit: And if it hasn’t broken yet for you, I think (but I’m not very much not sure) setting that preference to 1556940100 should keep it working until 24 hours from now. And if you keep updating that value every 23 hours to the output of date '+%s' until it is fixed via a firefox update it should keep working forever.

Edit2: I think you need to restart the browser as well after updating the preference for the above idea to work.

Haha, it’s funny, I build Firefox with export MOZ_REQUIRE_SIGNING=0 so I wasn’t affected.

I really dislike this. I hate feeling like I’m not in control of my computer. How can this even be possible? It’s completely anti-user.

And Chrom(ium), of course, probably isn’t any better. While the WWW is getting better and better, it’s also getting worse and worse.

As a former Firefox extension developer (Firefox 2.0 to 56.0.1), I’m not surprised at any of this. Since Firefox 56, it has been nearly impossible to satisfy all of the requirements for building and deploying add-ons for that browser. I finally gave up in 2016. They brought all of this upon themselves.

I was just thinking “This feels like a signing cert just expired or something…”

Firefox Mobile too apparently.

There is an update published at https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/

The TLDR is they are using the “studies” mechanism to auto-push an update, provided you opt in to “studies” until it is done.

This relates to my opinions about encrypted HTTP, which is that it shouldn’t be mandatory.

If you have a well-designed system that only works with encryption, then sure, but this idea of using the same mistaken systems as the WWW clearly doesn’t work well.

I’ve never seen a Tor Hidden Service fail because of something expiring.

Much of this nonsense about encrypting everything, without reason and excuse, is to protect advertisements from being modified.

That this hit Tor Browser and disabled NoScript is damning, but I already disable JavaScript in about:config and I’m not even using a version of Firefox this new, anyway.

I can’t tell if my opinion of Mozilla is lower or if it can’t get lower.

I think it’s pretty obvious that signatures should be checked at installation time, not daily.

Then this never would have happened.

Edit: more importantly, extension-signing is an anti-feature. Mozilla have no business determining what extensions I, the user of their software, choose to install on my machine.

Man, I’m running the ESR version from Debian’s repositories for the exact reason I don’t want new software to interfer with my work, and now exactly that happened.

Apart from that, this bug feels like losing control. My first impression before I understood there’s a certificate expired was that Mozilla can remote-disable AddOns as they wish, yielding the obvious question what else they can do remotely to your browser. This is a bug. But what happens if someone hacks his way into Mozilla’s servers?

sounds like they might have to push an update for every firefox install out there (including corporate ones) so this is probably going to take a while to be fully resolved.

a few threads on tor-talk: https://lists.torproject.org/pipermail/tor-talk/2019-May/thread.html

Did this effect people with auto updates? I’m getting whatever ubuntu is pushing in their updates so I haven’t been effected, hopefully won’t be.