Hacker News Reader

Comment by brokenmachine | Hacker News Reader

I had a totally different experience.

I'm still running FF 56.0.2 because I can't live without Tab Mix Plus.

The official line was to wait for the update but about:studies never came up with anything even after 24 hours of waiting and everyone was saying it was fixed but it wasn't for me, I presume because nobody cares about the refugees stuck on pre-add-on breaking versions.

So it was completely broken until I finally found a reddit thread that described how to use the developer console to manually import the certificate extracted from the fix.

That worked, but it enabled all my add-ons, even ones that were previously disabled.

Bloody irritating. I didn't even know that it was possible to break things remotely like this.

View on HN

You realize, I hope, that 56.0.2 is riddled with security holes at this point? I get the attachment to old addons, but 129 CVEs (including multiple severe memory corruption bugs) affect that version now. It's not really reasonable to expect Mozilla to keep maintaining it.

I don't expect them to maintain it, but I do expect them not to break it for no reason.

Also they could have mentioned in their post that their fix did not do anything for older versions, instead of specifically telling everyone to just keep waiting.

xpinstall.signatures.required = false didn't fix it.

I'll be very happy to update when there's a version that has a good tab manager. I'm on the latest version at home and it regularly loses whole windows full of tabs, even though it is set to restore my session on startup. And there's no way to manually save sessions. It's hopeless.

In this day and age you're living on borrowed time using an old version of a web browser. This state of affairs has its good and bad, but your modern-day browser vendors don't typically maintain branches of old versions to make security and bug fixes (especially when they change things for security reasons, as with this case of old-style addons being removed). If you're going to insist on using an old unsupported version you have to accept the risk of things eventually breaking and the inconvenience of workarounds like the one you described.

Well I've just been educated on a new mechanism by which things can be remotely broken.

Just to be clear: supported version or not, this sucks, and I hope we'll have a fix for you.

I wanted to point out this wasn't remotely broken, however. Even if you had no internet connection, your addons would have stopped working when the certificate expired.

(Disclosure: I work for Mozilla)

Well that's reassuring! :-)

I've fixed it now anyway, in the way I specifically read that I wasn't meant to do.

Maybe you guys could inform us unsupported old version users what we should do instead of waiting for an update that can't come?

It's ok, thanks for your post. I know stuff is complicated and shit happens.

I'm much more disappointed that the latest Firefox doesn't have a working session manager than I am about this mixup. IMO that should be a core browser function.

In case it still helps you or someone else: A fix for Firefox 52 through 56 is available now at https://addons.mozilla.org/en-US/firefox/addon/disabled-add-...

(Disclosure: I work for Mozilla)

Great. Thank you.

Would you mind please telling whoever you need to that we need automatic session saving/restoring to work properly, and then lots of people like me will happily update.

Hey sciurus,

I just wanted to chime in way down deep in this comment chain because my thought only makes sense in the context of your comment right here.

I think there may be a special mode of operation of Firefox that may need to be considered here.

You said, "Even if you had no internet connection, your addons would have stopped working when the certificate expired."

This seems like an unfortunate design flaw to me. Consider a Firefox, kitted out with specific set of add-ons setup to the user's liking. Then, the network that Firefox is located on becomes permanently cutoff from the internet and can no longer make contact with the Mozilla mother ship. Maybe it's running in a VM, or maybe it's running in a country with an oppressive regime. I can think of many scenarios where a Firefox would be cutoff.

I think it is a reasonable expectation that the marooned Firefox should continue to run indefinitely without failure. Perhaps the user could be occasionally (monthly, yearly) flagged with warnings that the mother ship could not be contacted, but other than that, nothing should fail.

Please consider this and share it with your teams when the post mortem is discussed.

Thanks! I'm a loyal user since before Firefox.

> I think it is a reasonable expectation that the marooned Firefox should continue to run indefinitely without failure.

I personally agree this is a worthwhile goal. The blog post talks about "tracking the status of everything in Firefox that is a potential time bomb and making sure that we don’t find ourselves in a situation where one goes off unexpectedly." I expect once that is done we'll be positioned to evaluate if and how we could support this.

(Disclosure: I work for Mozilla)

Great! I think you understand me fully. Appreciate the willingness to explore such a strange but interesting freedom-related use case.

What did you expect to happen? You're using an online service connected to signing authorities. Of course it can be remotely broken at any time, that's how the internet works, it's all remote.

> What did you expect to happen?

Not this? I didn't think things would break with updates disabled.

Like I said, now I've been educated on a new mechanism for things to break.

He's using a product. A product. Having it attached to on-line service is not a feature.

I think part of the reason this fiasco stirs up so much emotions is because normal people, including tech professionals, still expect the browser to behave like a product, not a service. And products aren't supposed to randomly break like that, they aren't supposed to ship with a time bomb attached.

I too am a Tab Mix Plus fan. I was using an ESR version to try to maintain better security while still using my favourite add-on. Now seemingly not possible. I am quite prepared to put up with security vulnerabilities for my personal use of browsers. I use sandboxing/ firewalls / VM's to protect myself. Not happy that an older version of Firefox was broken. I don't expect a company to maintain older versions forever, I do expect them to not deliberately or accidentally break them.

Give me back my Tab Mix Plus!

Reply on news.ycombinator.com