Firefox 66.0.4 is out, fixes disabled add-ons | Hacker News Reader

Firefox 66.0.4 is out, fixes disabled add-ons

ftp.mozilla.org

506 pointsakyuu371 comments

Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains:

- why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is)

- what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies program?

- why can't we see any xpi's installed by studies program unless we explicitly go to about:studies?

I don't say chromium is better, but I think we deserve an explanation regarding these points.

This might be a stupid question, but have you asked them through their support or social media channels yet?

I did from twitter, no answer yet. And I think this is an answer owed to all of the users - not just me.

Absolutely, I didn't necessarily want to disagree with you and was just asking.

> why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is)

I came here to mention exactly this. I don't mind the certificate issue (as long as there is a post mortem and they learn something from it).

I was wondering how my addons came back automatically (without me having to upgrade to 66.0.4) and I found out about this studies thing, which I never consented to. I feel violated. And the problem is, what browser am I supposed to use from now on? Lynx? Sigh

ETA: I am (was) a proud Firefox user since it was called Firebird, and changing browsers never crossed my mind before (even if Chrome felt faster some times). At this exact moment, I have zero trust on Mozilla, just like I have zero trust on Google (Chrome). Extremely frustrated and disappointed.

You could just turn off all studies in Firefox. It's a simple option:

https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...

I'm a privacy conscious person so I disabled all spyware that Firefox included. But I went to check, studies was enabled, probably because it was included and enabled by default in the last years and I didn't notice. So how long until Firefox adds something else to have remote code execution rights on my machine?

Studies do send telemetry which is not quite the same as being spyware.

You can actually check what is sent, though there's no option to more finely disable studies requiring, say, cursor, keyboard or tab name monitoring. I haven't seen any such studies though.

The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time.

As for browser code itself, it is open, go read the changelog. If you're extra paranoid, you can build it yourself. Study code is also fully readable.

>Studies do send telemetry which is not quite the same as being spyware.

How is software whose sole purpose is to send my information to a third party not spyware?

>The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time.

JS on any webpage can't do whatever it wants, since it's restrained to the webpage itself. otoh I'm sure this "studies" thing can change my browser configuration (including my certificates, making me vulnerable to MITM) and probably even execute any command with my current user privileges.

They cannot, the studies use JS available to the browser though with internal APIs available. It is potent, but not quite as much as to allow running arbitrary executables outside the browser or usually bypass file system level protection. It can read and write files the user can access. (Which may or may not include /dev on *nix.) It can also exploit your OpenGL driver.

The difference between spyware and telemetry is intent - use of data - and anonymization measures.

If you don't trust the company making the browser with user studies (and their toggle), you probably shouldn't use their build - and you can disable study code completely on compile time.

If Mozilla decided to be evil like a certain Alphabet company, there is nothing to stop them but forking and writing another web browser.

Sounds like you're arguing against a very specific meaning of the term "spyware". One that I'm unfamiliar with. It's not even the historical meaning of the term. I remember when it used to mean any application that "phones home" for any reason whatsoever--when apps ran locally.

It's pretty clear what they are worried about. That's not really arguing in good faith. And "intent" has nothing to do with it--also there is no singular intent from an organisation, if it goes wrong it's just stuff that happened but nobody to point a finger at whose intent it was.

Also, anonymization measures are a joke. It just shows an "intent" to anonymize. But when it turns out that the data is in fact easily de-anonymized somewhere between the browser and the aggregation unit, or in combination with the newest "opt in" monitoring feature, again no fingers to point and your only recourse is better having been safe than sorry.

Sensitivity of data? I'd associate "spyware" with "collects personal information", whereas studies that do not require explicit opt-in are only allowed to collect things on a level of "how many tabs are open", "has the user enabled this feature", and things like web browsing history or data derived from the history are explicitly excluded. If you don't trust Mozilla to hold that standard, then yes, you probably shouldn't use their product.

(Which apparently played part in the Mr Robot idiocy: since it didn't collect any data, it was easy to get it through the process...)

I don't like lots of stuff Mozilla is doing, but I trust them more than the alternatives to actually do what they claim privacy-wise.

That's not enough. Opt-out features are wrong because organizations/companies know that most people won't pay attention or not fully appreciate the dangers of it.

What would you propose?

Opt-in. Firefox is all about informed choice, it seems people want them to stick to it.

They can just flip the option or create a version of studies called "enquiries" or force a new addon that you can't remove in the next update .. 3 years ago you'd think Mozilla wouldn't ever imagine doing things like that.

3 years ago, they were in the middle of deploying the current studies system.

I think it's actually 5 years ago, perhaps when the major management changes happened. My mistake.

I did. The problem is:

- I had never heard of "Studies" before; which leads to

- I never agreed to be a part of Studies in the first place.

The docs says it must be opted in, so supposedly I have to give consent to it. I don't remember doing so. For all my life, I've always rejected any survey, opt-in request and similar stuff. I do admit there is a small, unlikely chance that I did opt-in. Maybe I misclicked it? Maybe I thought I was rejecting when I was actually agreeing to? Maybe someone else was using my computer and opted-in?

If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant. But I can't remember the prompt at all, and I would never consciously opt-in, hence the feeling of betrayal.

For the record: I now know what Studies are. I acknowledge that companies need to run A/B experiments in order to enhance their products. I just don't want to be opted-in by default.

> If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant.

No need to apologize. It's not really an opt-in if you are certain you would never opt in if you were aware of it, and somehow you accidentally "opted in" anyway.

I'm in the same boat, I would never opt in to any of this stuff. Now I had my "studies" setting turned off, so that's good. But when I looked at about:studies, it seems as though it had been on at some point in time (because it lists a plugin that it used for a study, or something). So I suppose that I actually opted out of this studies thing at some point, meaning it had been turned on without my consent either.

> what browser am I supposed to use from now on?

There's actually quite a few. This Wikipedia list [0] might not be the best curation, but it carries my point, somewhat. For example, I've really enjoyed the power-user browsers, like surf, luakit or uzbl.

I know you were expressing the fact that we're stuck between Firefox and Chromium, because they're the only browsers able to keep up with the rapidly moving web stack and provide a fluid user experience at the same time. My point is if you're willing to compromise on that, you actually have other choices.

Oh I do hope to see the day when there's a variety of browsers, all equally compatible with the day's web. Doesn't seem like we're moving in that direction though.

Personally, I tolerate Firefox, because I want some of the extensions, namely Dark Reader and ublock. Dark Reader doesn't really have alternatives, as far as I know, and I find that network level blocking isn't effective or ergonomic enough to replace something like ublock origin. If I solved these two problems, I'd jump ship to surf immediately.

Just to finish my rant; the other day I was experimenting with text browsers for rendering simple sites like thefreedictionary or HN. Their ability to do that is quite abysmal. I think that says a bit about the state of web's accessibility.

[0] https://en.wikipedia.org/wiki/List_of_web_browsers

> keep up with the rapidly moving web stack

Yeah, exactly. I mean, not even EdgeHTML could keep up!

> surf, luakit or uzbl.

Thanks for the suggestions. I had never heard of any of those three, but they look awesome! The only extension I need is Vixen (or any Vimperator-like addon), and they all seem to be keyboard-first. The only browsers I had used before were Lynx and w3m, which were way too hardcore for me. I'll give a shot with luakit. Seems to be an ideal middle ground between functionality and privacy.

>I don't mind the certificate issue

For me, it's the other way around.

They should have forseen the certificate issues and never implemented the system as it is, i.e. disabling addons that have been installed with a valid cert. At most there should be a warning. Addons are losing their configuration because of this and we have yet to see how they fix old FF versions. All of this indicates a total lack of foresight.

However, I see the value in having studies enabled and being able to test features and fixes with certain hardware configurations. Almost every software does it, because it's very useful. Maybe Mozilla, being an advocate for privacy, should be more transparent about it though.

I've switchted to qutebrowser, but not sure if it will fit your needs.

> And the problem is, what browser am I supposed to use from now on? Lynx? Sigh

You can try Firefox from your distribution's repositories. eg. Debian disables this sort of things.

>what browser am I supposed to use from now on? Lynx?

w3m is a pretty fun terminal based browser with modern enhancements

It is interesting the quantity of studies they push to their opted-in normandy students.

Take a look at https://normandy.cdn.mozilla.net/api/v1/recipe/

Looking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience

Mozilla wants to know more about knowledge and opinions of news on the Web.

Etc.

There are also links to what seems to be internal documentation.

It shocked me the interest and the infrastructure they have just for collecting information. This is not just a couple of developers trying to figure out what feature is used and/or studying bugs.

Chromium is definitely worse.

While these deserve an explanation, you should not wait to move.

Chrome is spyware that does web browsing. It's parent company also shows ads, all the time.

Chrome's auto update not only allows them to silently update or change your browser, it allows them to silently install other software on your computer.

Firefox is a browser. It can auto-update in a way that may be questionable, but it also has a lot of cranky devs looking over their shoulder to call them out years later because Mr. Robot may have been able to show them an ad. FF deserves to be called out on their mistakes, and need offer an explanation. But perspective!

Why would you not move now?

I've been reading lot of comments like the parent lately. Thanks for voicing my thoughts.

I want the ethics of Firefox and the speed / user experience (eg. select & move multiple tabs) of Chrome, so I moved to Brave. It's a Chromium fork that's a bit more Firefoxy -- made by Brendan Eich, former Mozilla CEO and inventor of JS, (eg has the "Switch to Open Tab" feature I love from FF), although there's some cryptocurrency stuff thrown in that I'm not a fan of, but so far it feels like a net positive over both FF and Chrome.

It's very privacy oriented, to such a degree that it actually breaks a lot of websites (but you can disable the shields easy).

If you haven't read this one yet, here's one data point on Brave doing something unethical (blocking ads and collecting payments on behalf of websites without consent/agreement). [1] Tangentially, I'm writing this comment using Brave.

[1]: https://news.ycombinator.com/item?id=18734999

Sadly, I'd also like more competition in the browser technology space; with Edge switching to Chromium, and Safari's years of neglect, it's not looking too good.

Chromium is not Chrome. It does not have auto-update. Surprisingly this gives more control by default than with Firefox.

But Chromium still has most, if not all, the Google integration.

There are forks that try to strip Google from it, but it is a mistake to assume that Chromium is somehow better than Chrome.

Firefox by default sends all your searches to Google, and uses Google search suggestions (so sends all typed in text to Google).

What other integrations, specifically please, does Chromium have with Google?

Aside: do Google serve the Firefox Newtab adverts, perhaps that "feature" was added for the extra money Firefox are getting from Google?

The Newtab adverts are not served by Google IIRC and they are only matched with you data locally in your browser, you get a lot of them from Mozilla and locally on your machine they get targeted so you aren't tracked online (If my memory of the article on it is correct)

Is this still true of the default search engine is set to something other than Google? What are the relevant config keys?

Many things.

1. It uses Google DNS internally, bypassing system DNS.

2. First-run analytics to Google, new tab page analytics to Google.

3. Various built-in google services that phone home: Google Host Detector, Google URL Tracker, Google Cloud Messaging, Google Hotwording, Google Safe Browsing, WiveDine DRM, Google AutoFill, etc.

4. Update checks for all these components (the browser does not have update, but the rest does).

5. Countless accesses to Google, such as geo-location to find nearest Google server, ping probes for connectivity, etc. For a list of domains that are accessed by Chromium, see this regex used by the ungoogled-chromium project: https://github.com/Eloston/ungoogled-chromium/blob/30969fddf...

More info at https://github.com/Eloston/ungoogled-chromium/tree/30969fddf....

I see no problem with neither Chrome nor Firefox defaulting to Google search and suggestions, as that is easily configurable for normal users. All of the above, however, is not.

Cool, thanks. Do you happen to know if Brave has these issues too?

It doesn't - like ungoogled-chromium, Brave have replaced references to any Google endpoints with placeholders that don't resolve to anything.

> and uses Google search suggestions (so sends all typed in text to Google)

This is not true. Firefox explicitly asks you the first time you start typing a search in the location bar whether to allow search suggestions. It is opt-in.

Firefox also allows you to keep the location/search bar separate so that you can have search suggestions without sending every URL you type to Google.

I find it very disturbing that the very dangerous issue with Chrome and its family is not discussed here, which is the erosion of web standards.

tl;dr : Choosing anything based on Chromium is giving the death sentence to the Web "democracy"

Moving to a Chromium based browser is letting more and more market share to a browser engine whose roadmap is fully determined by Google. The issue trackers of Chromium or Android projects clearly shows how much Google values its users'feedback about their most wanted features : Not At All. These days it seems they are starting to feel the same about open standards... At first with WHATWG getting in the yard of W3C they tried to get more influence on the redaction of standards, now they don't even bother since they can force anything they want in a "de facto standard" as they are doing with AMP.

The next step is to obliterate any standardized feature they don't like. It can seems to be a frivolous issue but they are doing this right now to SVG-in-OpenType, a standard that is currently implemented in all major browsers except Chromium family (yes even Edge see https://www.colorfonts.wtf/#section4 but the switch to Chromium will probably end it). Here is what Google responds to the numerous people aking them to implement it : https://bugs.chromium.org/p/chromium/issues/detail?id=306078... Apparently a feature even the -probably small- team of Edge developers managed to implement is too complicated for Google chrome engineers ?!? This will get more and more frequent as long they have more than 80% of browser marketshares.

So if you switch to ANY Chromium based browser, even if it's for privacy reasons, PLEASE keep in mind that you are working for the destruction of the web "democracy".

It is disheartening how we seem to learn so little from history, even recent one. It seems like yesterday that the web managed to come out from under the stranglehold of IE and now the wheel turns yet again. This time it may be even harder to break the monopoly since billions of ordinary web surfers have little to no idea of these issues and default to Chrome because it is pre-installed and has almost become synonymous for a browser.

Google still pay for Firefox; about $2 per user. So, Chrome and Firefox are funded by the same people. In fact Google upped the money they're paying despite FF's falling users share, what are they getting for their money - I doubt they're giving it out of charity.

It's like price differentiation, I feel. FF is for people who want to avoid Google, but Google are paying to get privacy-infringement lite. Who knows what else besides being default search provider, and getting every search you type in through search suggestions, they're getting for their money?

>cranky devs looking over their shoulder to call them out years later because Mr. Robot may have been able to show them an ad //

Way to underplay things. Do Chrome change their UI (ie chrome) to ad advertising? Do they force add-ons on people that are unremovable in order to advertise a product? And then update, re-placing the advert into users chrome who've removed it? Do they blank out users home-screen settings in order to add advertising? (I think they did do that one?)

Chrome may be spyware, but default so is FF. And Mozilla have shown they're more than happy to mess around with their users browsers for advertising/promotions.

Aside: how is Chromium worse? Waterfox is looking like a good option.

Chromium has a working exploit (AFAIK it still is not patched) that allows third-party code to masquerade as first-party code. Unless you run a special addon[1], you are vulnerable to this.

The fact that I still can't find that it's patched now tells me nothing good about the health of the ecosystem and who it is meant to serve. That should be all the reason you need to switch to Firefox, which admittedly also has huge warts but to my mind ones that aren't quite so egregious.

[1] https://chrome.google.com/webstore/detail/ublock-origin-extr...

Wow this is... scary and you say it is still not patched? Thank you.

You make it sound like it's a third-party RCE; but it's a cookie bypass, so it's tracking -- that's serious still [and the implementation sounds illegal to me].

The companies Instart Manager (used by cnet, tomshardware, etc., see link) and Upmanager that are doing this workaround of ublock -- are they not able to attack other browsers, only Chromium? I guess one benefit of being the biggest advertising company is that people don't want to mess with Google's stuff in case they suffer financial repercussions.

https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO...

> workaround of ublock

This has nothing to do with ublock origin specifically, ublock origin's author just happens to have a band-aid for this exploit. Assuming I don't misunderstand what is happening, any other blocking plugin is vulnerable as well.

> people don't want to mess with Google's stuff

I don't understand what you're saying. Chromium is vulnerable and by extension, so is Chrome.

Edit:

> You make it sound like it's a third-party RCE

I don't think I am. I said third-party code looks like first-party code, that is precisely what is happening.

>third-party code

It's third-party cookies, look like first-party cookies, isn't it? Whilst they are "code", that's misleading because it's not being executed; which is what makes it sound like an RCE.

Or did my brief scan pick up the wrong idea?

> Or did my brief scan pick up the wrong idea?

I believe so. To quote: "The purpose of Instart Logic technology is to disguise 3rd-party requests as 1st-party requests"

The net result of this is also that third-party javascript will get loaded as if it is first-party. Third-party content will look like first-party content in it's entirety. This subverts any potential security features that rely on being able to distinguish a first party from a third party.

Edit: As an example you can read https://www.w3.org/Security/wiki/Same_Origin_Policy

Thanks for persisting in your explanation.

I switched to FF a couple of months ago, and was not opted in to Studies automatically. I'm based in Norway though so maybe GDPR had something to say. I had to opt-in to Studies to fix the certificate issue.

"To provide this fix on short notice, we are using the Studies system. This system is enabled by default, and no action is needed unless Studies have been disabled. [..] It may take up to six hours for the Study to be applied to Firefox. To check if the fix has been applied, you can enter “about:studies” in the location bar... "

https://blog.mozilla.org/addons/2019/05/04/update-regarding-...

Consider running Icecat. It's most convenient to use it by installing a fully libre distribution such as Parabola or Guix System. Distributions which respect the FSDG don't just exclude proprietary software, but actually take software like Firefox which is 99% libre, and chucks out the last 1% of junk, improving many defaults. You're unlikely to have ethical qualms with such an Icecat.

https://www.gnu.org/software/gnuzilla/ You can see how it's made here: https://git.savannah.gnu.org/cgit/gnuzilla.git/tree/makeicec...

Note that it looks like it disables sync, but that should still work, and you can add whatever addons you like.

Chrome has studies too, called field trials. https://blog.chromium.org/2012/05/changes-to-field-trials-in...

No release for android yet, at least not on [1], where I am getting the apk files from. As of now, latest release uploaded there is 66.0.2 from March.

[1]: https://archive.mozilla.org/pub/mobile/releases/

EDIT it's up: https://archive.mozilla.org/pub/mobile/releases/66.0.4/

Well, at least you didn't get hit with 66.0.3.

My addons were disabled on 66.0.2.

What did 66.0.3 break?

66.0.3 didn't break anything, but it was the last version to ship with certs that expired on Friday.

Have been polling https://download.mozilla.org/?product=fennec-latest&os=andro...

Still getting 66.0.2... :-/ And yes, my addons were disabled on 66.0.2.

Gives 66.0.4 now

xpinstall.signatures.required = false worked for me on android

Yeah, this also worked for me on Android. Not sure why the downvotes.

It works on the main branch now too, so quickfix or not try to update from the play store asap (or whatever repo you use)

Probably because this workaround consists in deactivating add-on security.

Because it's not working right now..

Worked on my 2 android devices. Did not work on windows desktop. That needed the nightly or probably this build.

Referring to plugin security.

And what's the problem with not having that? Does it suddenly make my installed extensions insecure?

I (somewhat) get it for the standard windows user who gives admin rights to everything, but I think this crowd is a bit more aware of what they install.

I haven't installed an add-on in years.

Then you're not affected. What's the matter?

That means: the installation is a while old, installation security is not useful now because the add-ons were installed ages ago, but using them is.

Precisely.

No, it does not. David, this is just wrong. Existing add-ons do not become suddenly insecure.

What it does is allow you to install add-ons not signed by mozilla. Essentially the same thing as installing software not originating from the iOS and/or Mac AppStore, or the Ubuntu/Fedora/etc distro repositories, or the Windows Store, or the Play Store.

The signing stuff might protect some less tech-savvy users from installing "You need this codec to play this porn video" malware add-ons, same as the other walled gardens I listed do too (tho most I listed have still a door in the wall that you can unlock and open yourself, unlike Firefox Desktop).

But that's it. It is a "seal of approval" scheme saying that mozilla reviewers decided something is secure enough and has an OK quality (and wasn't forced to remove by US laws/authorities courts yet), implemented using DRM. It reduces the chances that users will install something malicious by accident/incompetence.

If users still run their add-ons from AMO, then there is no difference. Unless a bad actor can either MITM AMO connections or compromise the AMO servers. At which point the users has a lot more problems already than potentially malicious browser add-ons.

Last I checked Firefox still gives at least a warning + confirmation dialog if you try to install an unsigned / improperly signed extension with xpinstall.signatures.required = false, no?

You're better off waiting a few more hours that disabling important security features.

Disabling all add-ons doesn't help security either.

So far I have neither an update on ubuntu-desktop nor on android (with default package managers) so without this option I'm supposed to use the internet without adblock & umatrix? lol no thx

Disabling noscript is a bigger security issue.

It only got disabled if you installed the version from addons.mozilla.org and not the noscript.net.

Some sort of pinning mechanism would be nice though without having to rely on manual installs and signing.

It's a trade-off, you could end up with a version having a gaping security hole.

The only "security" it provided was to prevent people from installing add-ons that Mozilla didn't approve of, ostensibly ones it thinks are malicious, and I'd bet that on Android (which has its own app isolation features anyway) that's even less of a problem.

Not exactly. You can install add-ons from outside of Mozilla add-ons site. The extra certificate is more of Mozilla's seal of approval.

This is why quite a few of my add-ons were not disabled - they were installed with trust from another site and this intermediate certificate was never in chain.

You could even manually sign these add-ons you trust with custom imported CA key for your personal or corporare vetting.

Given that all my extensions are privacy and/or adblocking features -- that seems unlikely. I can re-activate it when the Mozilla fixes the issue.

We've lived without the walled garden for more than 10 years, I'm sure we can manage a few more days.

My add-ons are more important security features, that are needed right now, whereas the signing thing only protects when you install a new add-on from an unreliable source. (EDIT: it actually only applies for add-ons installed from the Mozilla add-on store website ... silly me for trusting that place)

Come to think of it, why did my add-ons get disabled, given that they already had been checked against the signing key when they got installed? Why is this (literally, it seems) being checked constantly instead of only when something about the add-ons changes?

This did NOT work for me with the Windows version.

Had to install that .xpi from the previous HN thread on the subject.

When will it appear in the Play store?

I was already a bit mad at them for removing RSS support and claiming their proprietary service that's built in is an alternative, now their proprietary service keeps working (presumably, I didn't use it but it's not an addon so I doubt it's signed the same way) and I can't use the RSS addon.

I know this was a mistake, but I can't help but be mad that their proprietary built in stuff effectively gets a free pass and special treatment and meanwhile I can't use RSS and all my containers were deleted (those didn't come back after the study was pushed either).

I use containers too. I didn't loose any data after I enabled dev mode and added the extension back. Perhaps you removed the existing extension first and lost data that way?

It's odd - on my laptops, my multi-container settings were preserved, but I opened firefox on my desktop last night and they had vanished. I did not remove any add-ons myself.

Same here.

Only difference is that I restarted the desktop Firefox and also enabled Shield studies to get the temporary fix. On the laptop I just upgraded to 66.0.4 and only then restarted it.

I did not disable or remove the extension, my containers were just all gone after the study was pushed and extensions came back.

To the best of my understanding, here's what happens.

* containers.json is reset to default

* if you have any non-default containers, they are lost

* the underlying data is still in IndexDB (??) but isn't connected to the custom containers that were wiped out

* if you're clever and can read the IndexDB (or wherever the data is, it's moved a few times) then you could probably rebuild your containers.json file

Never hear Mozilla claiming anything about a prioprietary service being an alternative to add-ons. The reason for which built-in RSS support was removed is that it was much crappier than the add-ons available.

Doesn't solve your problems, though :/

Pocket was promoted as the replacement for RSS. Pocket is a closed source SaaS product, despite the fact Mozilla now owns it.

Huh? When was it promoted as a replacement, by whom? It’s not even in the same product category/

RSS aggregates updates to websites without needing to check them. Pocket takes an article you have open in your browser right now and saves a local offline copy on your phone. They’re apples and oranges. Apples and orangutangs, even.

https://www.theverge.com/2018/6/13/17446660/mozilla-firefox-...

This sounds a lot like pushing it as an alternative to RSS to me.

That interview with the Pocket CEO never mentions RSS.

(Disclaimer: I work for Mozilla but not on any functionality related to this)

How odd to construe an attention-grabbing headline for Mozilla's official party line. As another comment said, RSS isn't mentioned once — actually, it is, but it's an advertisement for the Verge's own RSS feed.

You’re being obtuse. At no point does that mention RSS nor describe anything like RSS at all.

If I was not being generous, I’d think you were being intentionally obtuse to justify a preconceived opinion.

But whatever. I work on that very product.

Here (see "other alternatives"): https://support.mozilla.org/en-US/kb/feed-reader-replacement...

I can't find the link right now (I could swear I commented on the article here, but maybe I'm grepping for the wrong things in my comments), but in one of the blog posts where they announced removing RSS they advertised Pocket as the alternative that was still built in. Their RSS support was pretty terrible, but even so this sort of attitude was infuriating already, and now to see it have a leg up because they get to own the platform and the app just puts me over the edge. Not to mention that I have to dig through like three levels of settings to disable the damn thing and remove it from their stupid cluttered home screen every time something happens to my settings in the mobile version (which is alarmingly often).

I like Mozilla as a company, but I desperately wish there was an alternative sometimes. Anyways, sorry for the rant, I'm done (for now).

Found at least one place, though I don't think this was the post I was thinking of, pretty sure that was a blog (see "other alternatives"): https://support.mozilla.org/en-US/kb/feed-reader-replacement...

LiveMarks really is a fantastic addon to bring back Live Bookmarks functionality. That said, I've always been a fan of native browsers for their inherent advantages. Never felt the desire to use anything else, unless it has significant usability improvements. Phoenix/Firefox was always that browser for me. I usually suggest people use their native browser (Edge/Safari), and if they want an upgrade, to go to Firefox. With all of these recent debacles, it would be hard for me to not suggest the new Chromium-based Edge to Windows users and crossplatform.

About time. Embarrassing bug. The only reason i didn't permanently swap browser is because of the lack of alternatives since none has the functionality I apply through the addons.

Personally, I've switched to waterfox -which is a fork of an older firefox branch, and it supports addons (at least the ones I use).

I'm pretty happy with it, and I'm strongly considering staying with it even after firefox is fixed.

You'll be several revisions' worth of security patches behind. For an application that is usually one's main means of accessing the rest of the internet, that would be a deal-breaker for me.

But even more security bugs behind.

[citation needed]

Possibly, but I'll take the actively-developed codebase with the eyes of security experts all over it over one with no manpower.

In this case, I was more insecure being subjected to advertising networks (and the malware carried on them) because of Firefox's mistake which meant I wasn't able to load ublock origin. I'm also not sure how many of those "security patches" are intended to make my browsing experience safer, or simply meant to implement bizarre policies that might blow up in my face at any time (as this certificate issue has).

It's a trade off.

I assume (and hope) Firefox will eventually get their act together so I can go back to using it, but if not at least I don't have to jump ship to chrome.

It's a bad trade off. Every security related bug Firefox fixes is a how to guide for ruining waterfox users day for anywhere from weeks to years.

This will grow increasingly challenging if the code bases diverge in order to keep old school add-ons working given that waterfox has virtually no man power.

One solution would be to have a dedicated computer which is considered compromised from the start. Don't store importent stuff there, don't do money related activities etc. This way you have a convenient browser for 99% of the time - without stupid restrictions and Mozilla control.

In case of infection, restore from image.

edit: replaced spyware with control.

This is a highly impractical way to live life just to make some stand. It's cutting one's nose to spite one's face.

There are other actively maintained browsers with plenty of eyes on them and manpower behind them, many with vibrant plugin ecosystems, just use one of those.

This "bizarre policy" was software signing, which is in fact a security feature.

I don't understand what "getting their act together" means here, when you're posting it on an announcement that the problem has already been fixed. Should Firefox proactively remove all security features that risk ever posing some modicum of inconvenience to users? Because that would be... all of them.

Firefox could allow people to sign their own add-ons. Let's not pretend that the terms "software signing" and "walled garden" are synonymous.

Okay. Now malware addons are signed, and nothing has been accomplished.

In this scenario, malware add-ons would be signed only for that particular Firefox installation.

Essentially, I am arguing that Firefox should let you create your own signing key pair (which would be valid only on that single Firefox installation) and sign any add-on using it.

It's a large enough hoop that most users would not jump over it, not least because they would not know what they're doing, but it would be there for those who need it and relinquish the central point of failure that is the AMO.

The current situation is basically the Secure Boot fiasco all over again.

>I was more insecure being subjected to advertising networks

>2019

>not running your own ad network blocking DNS

Why even bother?

I've been using Waterfox on Windows for awhile along with the new Firefox, but now I am going to replace the Firefox install with Brave. Best of both worlds.

I switched to Chrome before this after Firefox started randomly requiring me to close it out and re-open when switching wifi hotspots too often, and connecting/disconnecting from VPN too often and this was on multiple laptops and fairly recently.

I haven't Switched yet but I fired up my Vivaldi install and have been impressed. A lot of little annoyances that I got used to with the new extension restrictions aren't there because the functionality is built in (like mouse gestures and tabs on left).

I first started using Firefox as my default when I unzipped a version of Phoenix off a CD which came with a computer magazine.

I installed Vivaldi, and moved shortly back to Firefox. The two things that did it:

1. I accidentally saved the wrong password to a site. When I went to fix it, it said I needed to login to my Google account to change my stored password.

Wait, wat?! You are sending my passwords to Google, unencrypted, without telling me?! Thai is not acceptable, aside from - What else are you sending?

1b. I see that it saves non password fields without my asking me to save them, and sending that to Google as well. Hmmmmm.

2. It has twice crashed and lost all my open tabs (yes, I have a tendency to keep many open tabs).

Also, for all I know, they are selling my bank account login. Research into the history of Vivaldi (semi fork of Opera) and its dev team left me unsatisfied who they are and that I can trust them.

It probably sends less data to Google than Chrome (which gets every single page, its contents, how long it was open, etc. but is hardly a contender if you want a browser and not just spyware.

Vivaldi doesn't save passwords using Google. Did you perhaps click on a help link that sent you to a Google support page for Chrome?

I see that if you click the password icon the address bar and click the "Manage passwords" button it opens the default password settings page inherited from Chromium (vivaldi://settings/passwords) which includes a link to a support page for Google Chrome (https://support.google.com/chrome/?p=settings_password), but not all the information on that page is applicable to Vivaldi. In particular, Vivaldi doesn't use Google but rather its own account system for browser sync (which is optional, same as Firefox and Chrome).

That appears to be a bug, since that legacy Chromium password settings page isn't Vivaldi's normal password settings page (vivaldi://settings/privacy/). But it doesn't seem malicious.

Incidentally, the built-in password manager in Vivaldi (as well as in Chrome and other browsers based on Chromium) doesn't let you manually edit an existing password, whether or not you use an account to sync them. You can only update an entry by signing into a site with a new password and confirming the password change if the browser detects it, or deleting the old entry and saving a new one. A limitation compared to Firefox's password manager, though I do appreciate the native ability to generate random passwords in Chromium-based browsers. I hope Firefox and Chrome copy each other in those regards.

I haven't experienced any crashes with Vivaldi, though I don't use it as much as other browsers such as Firefox so perhaps I've just been luckier.

Vivaldi's background seems clear enough: https://en.wikipedia.org/wiki/Vivaldi_(web_browser)

It was founded by Norwegian developers who left the original Opera (either due to switch from the old Opera browser to the new interface, or because the company was sold to Chinese investors). I do wish they were more open with the source code, but anyone who was comfortable with using the original Opera back in the day should be okay with Vivaldi. More so than the current Opera, I think, which I still see many people using due to brand recognition I assume.

I switched to the Dev build[1] with 'xpinstall.signatures.required = false', and now that it's fixed I don't know if I'll go back. There seems to be a bunch of new features in Dev that I assume will arrive in Firefox eventually, but everything else being equal, I think I'll stick with it.

I'll probably turn 'xpinstall.signatures.required' back to true though.

[1] https://www.mozilla.org/en-US/firefox/developer/

Mine says Developer edition beta 16 Version 67.0b16 (64-bit) Last updated = 03May2019.

do I need to make this change? is it in the about:config ? 'xpinstall.signatures.required = false

Yeah, so if you set 'xpinstall.signatures.required = false' in the about:config it'll let you use your extensions, but this is just a workaround.

When a fix is fully rolled out (which should include Developer edition), then you won't need that (and probably should re-enable signature checking).

thanks . I have toggled that in about:config and extensions are back to working. internally, what does this toggle turn off?

It is actually much much faster than Firefox "standard". Might stick with it too!

This is what I run and that fix worked. Are they planning on patching the dev build anytime soon? Doesn't look like there is an update for it. At least one can turn that stupid feature off until there is.

Did this issue cause all add-on data to be wiped? After updating to 66.0.4, all of the containers I'd created with the multi-account containers add-on were gone and replaced with what appeared to be a default set of containers. I spent a lot of time setting that up—is there no way to get it all back if I don't have some sort of manual backup? And if not, what files do I need to manually back up to make sure I don't lose my data next time?

Edit: To be clear, at no point did I delete the add-ons I had installed.

My Add-ons kept their settings as far as I can tell, but maybe there's something special about the container logic...

Yes, the "Firefox Multi-Account Containers" was unfortunately reset for me too.

Mine seems fine. My currently open tabs are still in their containers, and when I open a new tab, my list of choices is still intact.

Containers are notoriously finicky datawise.

I generally keep good backups of the non standard ~/.mozilla folder to compensate.

I think it was issue 339 on GitHub. They basically explain they won't add it to sync data because there is no containers on mobile.

https://github.com/mozilla/multi-account-containers/issues/3...

I could never understand why they were not synced. Its so incredibly frustrating, and the official reason does not help.

I simply don't understand Mozilla anymore. The power users are also the unpaid evangelists/marketers. They seem determined to alienate this demographic while iOS'ifying Firefox for a general audience. Which is great and all until they realize they don't have a marketing budget to complete with Google and MSFT.

> I think it was issue 339 on GitHub. They basically explain they won't add it to sync data because there is no containers on mobile.

Makes you wonder how on earth their data sync is working with regards to mobile. Surely if it doesn't have the components to leverage the data it just wouldn't read it..?

Its possible to implement the concern was that people would leak their cookies into the default container.

They should be essentially syncing but not syncing any non default container data into mobile.

Basically they had some work to do on the server end I think.

I too lost my multi-containers and assignments. I was just reading this (2017) discussion: https://github.com/mozilla/multi-account-containers/issues/3... and noticed mention of file 'containers.json', which I found in my current Firefox profile. It contains the descriptions of the containers I created since yesterday (for the 3rd time).

So it looks as though a manual backup of that (or the whole profile, knowing its in there) at least will end that chore.

But you still lose the Container -> websites associations. The same page recommends: "An effective way of exporting and importing containers safely is using ffcontainers."

The page for that syncer is here: https://github.com/pierlauro/ffcontainers ... but it's on hiatus at this moment.

containers.json wasn't enough in my experience. Still went through some kind of reset due to the way the plugin initializes.

ffcontainers looks promising but couldn't get it to work (spaces in my path..) probably needs a bit of a clean up.

From the release notes (https://www.mozilla.org/en-US/firefox/66.0.4/releasenotes/) :

> If add-ons that use Containers functionality (such as Multi-Account Containers and Facebook Container) were disabled as part of this problem, any lost site data or custom configurations for those add-ons will not be recovered by this release. Users may need to set them up and login again in about:addons (Bug 1549204).

> Themes may not be re-enabled. Users may need to re-enable them in about:addons (Bug 1549022).

> Home page or search settings customized by an add-on may be reset to defaults. Users may need to customize them again in about:preferences or about:addons

I don't know if there is a way to manually recover the settings you lost. It might be a good idea to check the related links in the release notes for more info.

I found that the changes I made to container names and colors were reset, but my hostname assignments remained. I guess those were two different datasets and only one was reset.

This is the biggest reason I'm still using Firefox. Containers have totally changed my workflow, much preferred over Chrome profiles.

I wish they added more colour and icon support, there's open cases for it but they're not prioritised. If only I was a good enough developer..

Is a more robust way around this to use a trusted timestamping service?

This is the way code-signing on Windows works, and allows you to prove that code was signed by a valid certificate while it was in its validity date - so even once the certificate expires, the code will still run as long as the cryptographic timestamping signature is valid.

What about older versions? Does this mean that older versions of firefox can never be used with addons (even matching older versions) anymore?

Good question. Looks like they do have a release for 60 (the current ESR):

https://archive.mozilla.org/pub/firefox/releases/60.6.2esr/

Just export the key from a current version and import it into the old version. Worked for me.

How do you do this?

From an updated Firefox navigate to

Preferences -> Privacy & Security -> Security -> Certificates -> View Certificates

Now find:

  Mozilla Corporation
    signingca1.addons.mozilla.org

Select signingca1.addons.mozilla.org and then choose export. This is what you would import into the older version of Firefox.

BTW that certificate list if fairly long, has no scrollbar and no search box. That's a bad UI.

Is there a way to report this without spending hours to register at Bugzilla and file a proper bug report?

Not sure why you don't have a scrollbar. On my version of Firefox (Firefox Developer Edition 67-0b16) the certificate list does have a scroll bar and can be navigated using the mousewheel. Can't speak for stable Firefox since I don't use that version.

No, not that I am aware of. In my own experience it actually took me longer to find alternative ways of bringing awareness to a bug I was having than it did to signup to Bugzilla and report it there.

Which older versions, specifically?

I don't have any particular in mind, but also future versions when they are old: will every version of firefox have a certificate that expires at some point in it?

A fix for the ESR is coming, are there any other supported old versions of firefox out there?

If you're using an unsupported version, then it's probably safe to assume you won't get a fix.

This is pretty bad for Firefox. I wonder how much people straight up & left for Chrome as a result of it.

It will be possible to roughly deduct this from the following statistics during the next days/weeks:

https://addons.mozilla.org/en-us/firefox/addon/adblock-plus/...

https://data.firefox.com

Note that these statistics would, presumably, exclude all users who disable telemetry in Firefox. Since many of those outraged at the interruption to addons seem to overlap frequently with those who object to and disable telemetry and studies on principle, their departure over this incident could well have no impact whatsoever on the metrics you linked above.

It must be a nightmare for the Firefox team to have a minority group of quick-to-anger users that refuse to allow themselves to be taken into account by usage metrics, refuse to allow their browser to participate in studies, and then object loudly when decisions are made that discount them.

I doubt this. There are extension update pings, and my guess is that the number of users is deducted from the update pings, but I could be wrong.

“How dare Firefox check for updates from a remote server” is a real thing that’s been said in support of many “privacy” guides that disable all Firefox and addons autoupdates, so I wouldn’t bet the farm either way.

Yea but there is valid reasons for controlling random network access with an iron fist. It's not usual user behaviour but it's one of Firefoxes many niche audiences. Alienating them will just fragment the base. Also remember these vocal niches bring in a lot of family and friends as well.

Who's fault is that, at the end of the day?

Mozilla didn't have to structure their addon system in such a way that their (in)actions could disable the addons of every Firefox user on the planet.

Mozilla did not have to abuse the studies mechanism (also on by default) to ship a workaround.

Mozilla did not have to disable the option that would let me work around this problem by myself (which is going to cause me no end of fun when I get into work tomorrow). If the Firefox team thinks their development concessions are a pain in the ass, try being directly accountable for the repercussions, in the "I will be fired if I don't fix this", not the "I will be talked mean about on the internet if I don't fix this" senses.

Mozilla didn't have to bundle junk like Pocket and the now-scuppered Hello, both of which could have just as easily been addons suggested on first run.

Mozilla didn't have to push promotional addons (the Mr Robot thing) without my express prior consent.

I grow exceedingly weary of this narrative that Firefox is above all reproach and criticism because they produce a web browser.

How about this instead; if Mozilla wishes for its users to respect them, they can start by respecting their users. That means no opt-out telemetry period, no paternalism about what I can and cannot install, or what options I can change, and so forth.

I am beyond sick of this shit. I would love nothing more than a true third option for browsers right now. Firefox hates its users, Chrome sees them as cattle - what's left? I have to use one of the two and take ridiculous steps to cover my own interests, because neither of these companies have them in mind.

"Opt-out telemetry" creates precisely the scenario I describe, where the users who care most are least visible to Mozilla, at which point their needs would go unconsidered; no one knows they exist, how many of them there are, or why they're opting out. This remains true regardless of why, which negates your entire list of issues, replacing them with a simple question that is very difficult to answer:

How could Mozilla respect the needs of users who opt-out of Mozilla knowing they, and their needs, exist at all?

How could any creator of anything?

If you can't identify who your users are, you can't ask them questions, and you can't tell if they're "vocal 0.001%" or "vocal 40%" of your userbase — then what consideration could you give, as a software developer, for their needs?

You can refuse to change, and simply always offer the one thing you offer, and accept that you're the best option for a minority of users over time. You can continue developing to your own needs, and let them stay or go as they see fit. You can try to read the tea leaves of internet forum posts, but that comes with a huge penalty to significance. You can try new things and try to tell from the howls of outrage whether it's a wording error or a direction error or simply "change is bad, I hate you all".

Opting out is not free. Opting out comes at a price to you. Your needs will be less likely to be considered, and your solutions may change in ways that are not to your liking. You have every right to opt out, but is the price of that acceptable to you?

ps. If you can solve how to let users of something influence its creator in a fair and just manner, such that all users have equal influence, while opting out of being known to that creator to exist at all, you will be a billionaire within five years.

In the old days, and today in every other industry but tech, if you want to understand your customers you survey them, do focus groups and listen to unsolicited feedback.

>If you can't identify who your users are, you can't ask them questions, and you can't tell if they're "vocal 0.001%" or "vocal 40%" of your userbase — then what consideration could you give, as a software developer, for their needs?

I'd ask for feedback, and when that feedback is given freely, even when unsolicited, I'd take it on board and act accordingly. I would ask if people want to participate in "telemetry" and "studies", not assume they do without affirmative prior consent.

Mozilla is breathtakingly bad at this. They're about as responsive to feedback as GNOME/Freedesktop.

I most certainly would not put spyware in the product and turn it on without asking first. I'd most certainly never get myself into a situation where an oversight can simultaneously break every copy of my software ever deployed.

This idea that you require all copies of your software to phone home to make effective development decisions is bunk. We got along just fine without that garbage for decades.

> "Opt-out telemetry" creates precisely the scenario I describe, where ... no one knows ... why they're opting out.

Telemetry doesn't tell you why users do anything. They would have to ask, which doesn't require telemetry. There used to be a form for submitting feedback.

> How could Mozilla respect the needs of users who opt-out of Mozilla knowing they, and their needs, exist at all?

Because of the values and principles that Mozilla used to share with its users, the principles that underpinned the first implemenation of Firefox Sync and were completely abandoned in the current implementation.

I trusted Mozilla because they didn't require our trust. They understood this principle and designed their systems in accordance with it.

> How could Mozilla respect the needs of users who opt-out of Mozilla knowing they, and their needs, exist at all?

How about surveys or well, common sense?

I'm a tech oriented person who cares about privacy. I want software that is lightweight, configurable, with sensible defaults. For any features besides the basic functionality (in this case: browsing the web), I don't want to opt-out, I want to opt-in.

Privacy oriented means for me that the software I use doesn't send one bit of data that isn't necessary for its basic functionality. I use a "dumb phone" because of this. I never understood how anybody can think telemetry and privacy can co-exist.

I want a Firefox without Pocket, Send, Screenshot Tools, Sync, Clickz, any cloud based service. I only want a fast, lightweight browser that doesn't send any unnecessary data anywhere without me explicitly configuring it. That's a sensible default for me, really. Software used to be like that.

I'd also like to configure when my software looks for updates. My Linux distro let's me do that.

And it would be awesome if all other functionality (like Send/Sync/Pocket, etc.) is available via optional plugins, or in another "full-featured" version of Firefox. The deluxe edition or whatever.

I believe I'm not alone with these ideas about software. In discussions about Firefox these things always come up. There are github projects [1,2] with 1600 and 1200 stars about hardening Firefox. People care about privacy. It's not hard to find this part of the userbase.

The idea that you can't create software for your users without telemetry, is what leads Mozilla to disregard their privacy oriented users in the first place. It's depressing.

And even if I allowed telemetry on my system Mozilla wouldn't learn anything about what I wrote here. It's useless.

1: https://github.com/pyllyukko/user.js/ 2: https://github.com/ghacksuserjs/ghacks-user.js

A brief search of "site:blog.mozilla.org inurl:2019 survey" shows a bunch of results, and even more for inurl:2018. Have you signed up to receive unsolicited email from Mozilla in any venue? If you've opted-out, then you may be experiencing observer bias.

>no one knows they exist, how many of them there are, or why they're opting out //

They're burning half-a-billion a year of Google's money, they can afford to have an intern run filters to capture stories on HN, reddit, slashdot, ... amalgamate the main points and make them available as part of the user feedback.

Presumably many of the devs at Mozilla have been using it for the last 15 years too and also value a privacy-centric advertising-lite web.

So you're going to complain about the software breaking and also complain about them pushing a hotfix for it?

This whole situation isn't ideal but it's absurd to me that people are upset about hotfixes for a bug that they found extremely inconvenient. Do you like the bug or not? The option to turn off the system they used for hotfixes is right there in the privacy settings and they even show you what it's currently being used for (and what it was used for in the past). Like it or not, as far as I know every major browser (maybe not Safari?) is doing the exact same thing except they're less transparent about it.

I have literally no idea how to identify what experiments and rollout flags are quietly turned on for my install of Chrome and not for other people because it's not documented anywhere. At least in Firefox the option is right there and so is info on what the option does.

"No opt-out telemetry" is a great idea that doesn't function in the real world. If you ship online-connected software with 1m+ users that doesn't have a way to deploy hotfixes or a killswitch for dangerous features or basic telemetry, that is incredible negligence because all it takes is a single bug or a single unanticipated act by a third party and you're DDoSing someone or causing other kinds of mayhem. I'm quite serious. This is why most vendors operating at Mozilla's scale have the same set of tools at their disposal, even if they don't tell you about it. You cannot deploy large-scale connected software in the real world without doing this. It's one thing to go 'Word shouldn't have any telemetry' (okay, sure) and another to go 'this app that connects to thousands of servers, is left open all the time, and runs remote code should not have any telemetry or automatic update mechanism'. The latter is naive on the level of 'just don't write any bugs and your software won't need updates'.

So you're going to complain about the software breaking and also complain about them pushing a hotfix for it?

The right way to do this is to push a new release, which they've done. The absolutely wrong way to do this is to silently push a fix through a back door that's open by default and rightly shouldn't exist in the first place.

Yes, you can do things more efficiently when you ignore the rules and subvert reasonable expectations. Generally though, society takes a dim view of this.

>If you ship online-connected software with 1m+ users that doesn't have a way to deploy hotfixes ..

That way is checking for updates, and then asking me if I want to install them. Most software does this and it works fine. There are no privacy implications for hitting an API for a number and checking locally if it's higher than a number I have. All clean, all above-board.

That way is emphatically NOT playing like a sneak and making changes silently and remotely without asking me about it first. I don't care what you think your good reason is, you don't have the ethical/moral right to make changes on my property without that affirmative consent.

If Mozilla has you that angry, I can't imagine what you must go through every time you interact with any other company. Your points are not completely invalid (most of them anyway) but you might want to rethink where you spend your time ranting in some fury, encouraging people to move away from the only open browser with any sort of market share in favor of our new monopolist. Firefox is not beyond criticism but I think they get plenty of it already for all the good they do compared to everyone else, and a mad fury like this might be better spent contributing to the project.

Mozilla does not "hate" its users. This comment is way too emotional and dogmatic. Firefox is not above reproach but the presentation of your message leaves a lot to be desired.

So why do they ignore their feedback at every step? Why do they continue taking anti-user moves seemingly at every opportunity when there's a choice?

If what we see here is how you think Mozilla treats its users well, I'd hate to see what it would take to get you to agree they treat them badly.

I see nothing but naked contempt. YMMV.

What if what you see as “anti-user moves” turned out to be directly beneficial to a thousand times as many people as a few that agree with you?

If you see all instances of someone disagreeing with your ethical and logical judgements as naked contempt, then you will never be able to perceive anyone’s true motivations, in order to argue your case more persuasively and find out whether they understand your views.

Outrage has jumped the shark. Everyone disagrees about everything, which is hard enough to address without declaring “naked contempt” any time a choice is made that isn’t in your favor.

Their departure where? Considering the group in question I can't imagine them wanting to switch to Chromium or Opera.

Where do you see issues with Brave or Vivaldi?

Uses Blink and therefore dependent on Google for security updates.

I left for Chrome in a way via Brave. Brave is based on Chrome minus being owned by the All-Seeing-Eye Company in Mountainview.

I really like brave, but right now FF is still my main. Brave is still needs some features. The whole syncing bookmarks and wallets thing is really annoying. I'm glad the way they devised is secure, and privacy sensitive, but it's still a pain in the ass.

Doesn't using Chromium solve the same issue, as long as you're not signed in to Google?

Probably many, but don't forget that there are many firefox users that never install a single addon.

Which ironically means that the people most affected by this debacle have the most to lose by switching.

Although that also means that firefox managed to piss off it's most loyal group of users. Again.

Or they just lived with it for a few days. They were probably using FF because the addon doesn’t exist for chrome in the first olace

It was also over the weekend.

All it did was cement how much I despise Chrome's inability to sandbox it's network config.

Yay gotta close down all chrome instances to turn a proxy on and off.

Probably fuck all because chrome still has no add-ons on mobile.

People will bitch for a few days then they'll get over it.

This is a shitty screwup but I'm not about to jump ship over it.

I took the opportunity to check out Vivaldi again. Wow. It's so polished compared to Firefox. The downside is I'm now supporting the Chromium monoculture.

It's about 10-15% on my app but Firefox users are generally super smart so they provide great feedback.

One thing Firefox ROCKS at is that they support extensions/addons on mobile!

Chrome won't add them on mobile because they don't want adblock there.

I was on the reddit thread when it happened - was super confused as I just updated my firefox and it happened at a very similar time frame so I assumed it was from the update

I personally found the issue trivial, my main addon is ublock origin. There was a workaround using about:debugging and installing UBO on there which worked so it's not like the fix was a long process.

Being committed to a single browser, if anyone was using firefox for as long as me, I can't fathom someone leaving their main browser over something like this. I haven't been using it for THAT long but what if Chrome did something like this too? Then they'd move to another browser that's not FF/Chrome?

I too use only two extensions, uBlock Origin and HTTPS Everywhere and the hotfix pushed by Mozilla re-enabled them within half an hour of disabling. I do sympathise with those who apparently lost the settings of certain addons, notably Container based ones. Fortunately I always found the UX of Containers so clunky that I never bothered.

Sticking with Firefox as an open competition to the browser monopoly is critical now more than ever before.

Mozilla fine tuning some of their practices is as critical. These hn threads might give good pointers by concerned, well-meaning users.

> Sticking with Firefox as an open competition to the browser monopoly is critical now more than ever before.

I think this fact cannot be emphasized enough. Or we'll have the 90s monopolized web again: "Optimized for Chrome" - not that there'd be a lack of websites already doing that as of now.

I have been on the tipping edge of switching from FF to another browser for a long time now.

Short-lived bugs such as this one do not annoy me as much as the terrible performance of FF. It is not rare that FF uses 2 cores at full utilization all the time.

I always end up installing a new browser out of anger, but I _always_ come back to FF for its great features that I have become addicted to.

I've switched to Vivaldi on my desktop and Brave on my smartphone. For now. It's been three days and I'm still waiting for an official release with the add-on fix, can't wait forever.

I have to say I was very pleased that the Debian-ESR package a) disables telemetry in the build and b) ESR still allows you to override the extension signing for now...

Lost my containers yet again, I am now on the last straws with Firefox, this whole Normandy thing is not helping the case. Firefox never asked me to opt in!

Link where the release notes will be posted:

https://www.mozilla.org/en-US/firefox/66.0.4/releasenotes/

They're published now.

Right now, the Firefox for Android version is still not available in the Google Play Store.

Surprising no one. The real question is whether the apk is available somewhere so people don't have to wait for our favorite walled garden to mercifully pass the update.

I'm really worried about the average users not knowing what happened here. At least an email should be sent informing about the issue. But I guess many of those average users don't have a single extension installed, no problems for them.

The average user doesn't really need to know. The problem was fixed, there is no action on their part needed and there is no future risk like a data leak.

Why would Mozilla have my/average users email-address?

Firefox Sync?

The fix doesn't seem to work if you've been using Firefox Beta (67.0b16), or if you then install Stable (66.0.4) and sign in to sync - all addons are still marked as "legacy" and not enabled.

However, if you find each one in the store and (re-)install them - they work again and their data is back intact as expected.

Just in case someone misread this like I did, you need to reinstall each add-on. Not FF Beta itself.

Indeed, I meant re-install the addons.

I've always been a fan of native browsers, and have been using Chromium-based Edge[0] as my daily driver at work. While I wasn't one who was impacted by the extensions change, The removal of Live Bookmarks really stung for me, as I've used that feature since 2002.

Container support (with Containerise), a dedicated search bar to use with DDG bangs, and easy 'send tab to device' is what has me holding on today.

But I have to admit that Microsoft's eventual offering is pretty appealing, a Chromium-based browser with the advantages of Chrome's compatibility and Edge's conservative battery sipping. I'm one who has always liked and even preferred Microsoft's products and their integration on as objective of a basis as a human can muster. Even if it's in different aspects, I think they're going to probably have Edge become a package equally appealing to the things I love about Firefox. Edge/Safari are definitely where I'll go if Firefox really starts circling the drain, but having been on FF since it was Phoenix, it'll take more than this debacle.

[0]https://www.microsoftedgeinsider.com/en-us/download/

Our extension sets https://www.givero.com as the default search engine. After the extension got disabled and re-enabled, searches now default to Google.

So this fix is not complete.

Our efforts in getting Firefox users to install our extension has been in vain. "Luckily" we didn't have many users yet but imagine the amount of money this will cost bigger search engines like DDG, Qwant, etc.

Can't you do the switch on the next extension update, for instance?

> but imagine the amount of money this will cost bigger search engines like DDG, Qwant, etc.

People use extensions to change the default search engine in their browsers? I honestly thought only malware does that; regular people use the Settings menu.

Is there a little more background to what is happening here? The link is to an ftp, so I have no idea what is broken, fixed or why it matters.

If your addons are broken, it will fix them. If you don’t use addons or they’re working fine, you can let autoupdate pick it up.

The release notes will be published at this URL:

https://www.mozilla.org/en-US/firefox/66.0.4/releasenotes/

See https://blog.mozilla.org/addons/2019/05/04/update-regarding-...

I'm still on 66.0.3 and the issue resolved itself, I believe, yesterday...

Resolved as in you're opted in to studies?

I never did opt in. SO if it's not the default setting, it must have been off.

They made it default. It's called Normandy.

A place most people associate with the largest amphibious invasion in history seems a curious choice of codeword.

The name fits the feature imo.

That'd mean all Firefox users are Nazis.

Which may or may not be true.

They invaded nazis, so it's all good.

Same. I found some pretty good instructions[1] so all my plugins started working this morning, CET. And you can disable the studies when you're done.

1. https://forums.informaction.com/viewtopic.php?p=100053#p1000...

Please don't lower the value of run_interval_seconds like suggested there. If many people do that it will cause those of us on the ops team for Firefox's backend services some headaches.

I understand the sentiment, but "Please turn on studies and wait for an undefined amount of hours to get the fix" is also causing quite a bit of headache, so especially without a good (publicly given) reason to not tell people to download the studies XPI directly and fix it immediately you might want to overthink the impression that leaves on users.

Mozilla pushed a hotfix yesterday but it only worked on certain builds of Firefox, and only for users which had the user studies setting activated. Today's update should be a more permanent fix.

New version doesn't show up while following the instructions on: <https://support.mozilla.org/en-US/kb/update-firefox-latest-r...

I don't understand why renewing the certificate wouldn't fix the issue ?

How does the 66.0.4 fix the problem exactly ?

It's a signing certificate that is built into the browser to verify add-ons, not a normal TLS certificate that they can just update on a web server.

The change basically just imports the new certificate into the database: https://hg.mozilla.org/releases/mozilla-release/rev/848b1502...

That is not a complete statement of the changes shown. In addition to the unexpired certificate, it takes step to reenable any addons that were disabled by the expiration of the prior certificate.

> It's a signing certificate that is built into the browser to verify add-ons, not a normal TLS certificate that they can just update on a web server.

Ah, so that's why. Thanks.

What was the signing certificate validity period ?

Two years, iirc.

Don't know about the old one, but the new one from the patch is:

    Not Before: Apr  4 00:00:00 2015 GMT
    Not After : Apr  4 00:00:00 2025 GMT

So are the extensions checked at startup time for disk integrity issues?

My extensions on FF have not stopped working but I hadn't restarted the browser in that interim

Not seeing any updates in `apt`.

This is the Mozilla release. It will take a bit for the Linux distros to get it packaged and into the repos. Even the Firefox install on my windows machine here doesn't see it as an automatic update yet.

Yet the official download on download.mozilla.org is still the old, broken version.

AFAICT still no update out for the android version either

Installing the hotfix package directly worked on Firefox for Android for me.

https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

This is how I fixed it too

I just disbaled the checksignatute flag yesterday and that solved it. It's not like I install add-ons all the time.

The new version is there now.

We need a new Phoenix, I feel.

From Wikipedia:

>They [the original Phoenix devs] believed the commercial requirements of Netscape's sponsorship and developer-driven feature creep compromised the utility of the Mozilla browser.

Probably less important given the type (and number) of users who are on Firefox Nightly, but it's still at "68.0a1 (2019-05-03)" without an update available yet.

Nightly updates are currently frozen until we have a fix for https://bugzilla.mozilla.org/1549075

https://t.co/etOWyG4aqh

Is the TOR browser update out soon?

I've been waiting to see this. Just updated from 65.0 to 66.0.3. My addons are still disabled. Tried to install ublock origin, and it's not letting me. I'm getting a "Download failed. Please check your connection."

This is crazy, and I'm really disappointed with Mozilla. I'd leave firefox right now, but I don't want to contribute to the destruction of one of the last good pieces of software not owned by Google.

> Just updated from 65.0 to 66.0.3

The fix is in 66.0.4.

I noticed that after posting. :o EDIT: "gorhill"... I was seriously just on your GitHub account, like 15 minutes ago. I knew I've seen that username before. Thanks for making uBlock Origin!

I installed Opera yesterday. So far so good. Hope others will chime in with more alternatives

opera is now just the chrome engine. I don't think there's any alternative to chrome but firefox now-a-days, as even microsoft gave in and started using chrome's blink engine.

Safari or any Webkit browser maybe? I don't know how far Blink has diverged from Webkit.

Opera is proprietary and it is unclear what kind of telemetry it has.

GNU icecat is a very nicely modified firefox that respects the users. I highly suggest giving it a try if firefox has been bothering you lately.

studies, normandy, looking glass, forced signing of addons... Mozilla is giving away a lot of good-will lately. Still my favorite browser, but I don't like the general direction. Privacy should always default to true.

I hope for Mozilla to find a source of income that isn't Google, because they did a lot for the web. Let us just hope they don't need to make too many compromises.

Why I still can not install addons after upgrading? On the addon page it shows "only with firefox - get firefox now".

So nothing for those of us still running 56 beause Quantum trashed our extensions (and there are still not equivalent availale)?

Why on earth are you running such a massively outdated browser? You should at least switch to pale moon, basilisk, or another maintained browser. God knows how many vulnerabilities in the wild there are in 56.

I don't think I or anyone else need to justify why they still use the 56 ESR instead of pale moon nor does that have anything to do with the question of whether there will be a fix for this version from Mozilla.

Clearly a few feathers have been ruffled by even broaching the fact that many people still use the 56 version because crtical extensions still have no equivalent under quantum. Snark is not allowed even when asking a relevant question of whether there will be an update. Sad.

There is no 56 ESR; it jumped from 52 to 60.

Web devs might want to use older versions to test their site in them.

Considering that firefox gets upwards 70% of the users onto the latest version within 4 weeks or so of a new release, I don't see the point, doubt chrome is an issue for this as well, only reason I can see to support ancient browsers is if you have intranet web apps that only function is IE6-IE10 and you need to be able to run it there as well

Ever consider that some users cannot afford to upgrade? There's a lot of homeless people around here who only have phones (no laptops), and they are very old. Many run android 2 still. You must support established standards, even old ones, to remain good to all users and avoid prioritizing services for the wealthy.

Otherwise, you're part of the problem.

Is security the new motor powering the upgrade treadmill?

God knows how many vulnerabilities there are in the massively outdated Windows 7, why don't you upgrade to Windows 10...

Windows 7 gets security updates. But I do agree with your general point, fear of vulns pushing you to broken versions feels wrong. I've been on 55 myself (since 56 already broke some stuff) until a month ago, upgraded for security reasons, giving up convenient tab switching with the mouse, mouse gestures in view-source tabs, stable vertical tabs (tree style tabs is not super stable), quick toggles for javascript/css/proxy, etc. :/

Win7 gets security updates until somewhere in 2020. After that point, anyone still using 7 will be better off upgrading to 8/8.1/10.

Firefox 56 is not an ESR. It does not get security patches. From a quick look, there are public CVEs[0] that allow for ROP code execution almost effortlessly.

Security was always one of the big reasons behind keeping browsers up to date (the other reason being propagating new standard faster).

Besides, I wasn’t suggesting updating to latest firefox. I specifically mentioned pale moon and basilisk because they support old style extensions, while hopefully keeping up with the security fixes and other improvements to the engine going in mainline.

[0] https://www.cvedetails.com/vulnerability-list/vendor_id-452/...

https://reddit.com/r/firefox/comments/bkspmk/addons_fix_for_...

Why is it so hard for moz://a to provide something similar as an official workaround? Here is the cert, import it and you are good to go. Instead we have the opt-in to studies and update your browser nonsense and no fix for days.

What about ESR?

ESR has been updated to fix this [1]

[1] https://ftp.mozilla.org/pub/firefox/releases/60.6.2esr/

What about updating also the beta channel, I am using 67.0b16 and I still think I am affected because, not updates since and all the addons are shown as "ALLOWED IN PRIVATE WINDOWS"

installing and running this version did not resolve the issue for me

is there something else I need to do?

Mine says : Firefox Developer Edition 67.0b16 (64-bit). No fix yet there...

thanks for the heads up, now alive!

how about windows xp. still don't work. you going fix it for us please?

windows xp won't let me add new add on to.

I'm very curious - why are you still on XP?

because it easy to use.

It certainly is, but you should consider upgrading to something else. Sooner or later modern browsers won't work on it, and certainly you'll have to upgrade your hardware and newer hardware won't run XP anyway.

Why would anyone want to upgrade from XP? New versions of Windows have no improvements (the only improvement is search in Start Menu), but they cost money, they work slower and require new expensive hardware. They have spyware and updates that cannot be disabled. You pay for the product and then you are used as a free tester of new versions of Windows. Microsoft wants everyone to upgrade to earn more money and to upsell to users new "cloud" features they don't really need. But for me it would be better if MS would drop newer Windows versions and returned to improving XP without increasing resources comsumption, without HTML apps, telemetry and "cloud" features.

This is an example when the interests of users and the manufacturer are opposite. If the user uses an OS for many years and everything works, why upgrade? Looks like a waste of time and money.

Imagine if you bought a car and several years later you are told that you need to upgrade it, because, you know, car factory workers need higher salaries and if you don't buy the new one, then there is no way to pay them.

This explains why MS and independent developers (that drop XP support to help MS) forces users to upgrade. Because it is MS who wants an upgrade, not the user.

I understand your point, but using an very insecure OS connected to the Internet is not a good idea.

Anyone using it today is risking having their data stolen or lost.

> Why would anyone want to upgrade from XP?

Is that a serious question?

Security?

Compatibility with Modern hardware?

If you want to use a car analogy, what you're asking is 'why would anyone want to upgrade from a Model T?

Microsoft could drop newer Windows versions and instead focus on improving Windows XP.

That ship has sailed many years ago.

XP doesn't have any official support from Microsoft, and you'll find most vendors are reaching as stage of deprecating XP support. The OS itself is 5 years out of extended support from Microsoft, and it makes up barely 1% of the market place. You'll be hard pressed to get anyone to care if they've broken their software on it.

Switched to Chrome and Brave.

I wish I could switch to something else, but I still trust Mozilla the most.

Reply on news.ycombinator.com