PSA: All Firefox extensions are getting disabled, one by one

[Sam Varshavchik]

Just an FYI for everyone. After wondering why all my extensions suddenly  
migrated to the bit bucket in sky, after some digging, searching, browsing,  
and tweeting, it's a known issue:

https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be- 
disabled-or-fail-to-install/39047

Basically, an "all your extensions are belong to us" situation.

[Andre Robatino]

Also being tracked here: https://bugzilla.mozilla.org/show_bug.cgi?id=1548973
Warning: Bugs are being marked as dupes of that bug every few minutes, so might be better to just bookmark the bug instead of following it.

[Andre Robatino]

Most of my extensions have been disabled. However, the three that I have installed as Fedora packages (mozilla-https-everywhere, mozilla-ublock-origin, mozilla-noscript) are still enabled.

[Andre Robatino]

Overnight, my extensions were all re-enabled without my doing anything. The mitigation announced on the blog apparently worked.

[Heinz Diehl]

On 04.05.2019, Sam Varshavchik wrote:
> Basically, an "all your extensions are belong to us" situation.

You can enter about:config and set "xpinstall.signatures.required" to
"false" until the problem is fixed.

[Sam Varshavchik]

Heinz Diehl writes:
> On 04.05.2019, Sam Varshavchik wrote:
> > Basically, an "all your extensions are belong to us" situation.
>
> You can enter about:config and set "xpinstall.signatures.required" to
> "false" until the problem is fixed.

I am surprised that it actually worked. From what I read, I thought that  
this option gets ignored in the version of Firefox that all the hoi-polloi  
use, and it's enabled only in the dev/nightly Firefox builds.

[Sam Varshavchik]

Sam Varshavchik writes:
> I am surprised that it actually worked. From what I read, I thought that  
> this option gets ignored in the version of Firefox that all the hoi-polloi  
> use, and it's enabled only in the dev/nightly Firefox builds.

This just went up: https://blog.mozilla.org/addons/2019/05/04/update- 
regarding-add-ons-in-firefox/

The key part is:

"[we] will share a more substantial update in the coming days."

That sounds to me like this will require a new release.

[Geoffrey Leach]

On Sat, 04 May 2019 10:08:57 -0400
Sam Varshavchik  wrote:
> Heinz Diehl writes:
> > On 04.05.2019, Sam Varshavchik wrote:
> > > Basically, an "all your extensions are belong to us" situation.
> >
> > You can enter about:config and set "xpinstall.signatures.required"
> > to "false" until the problem is fixed.
>
> I am surprised that it actually worked. From what I read, I thought
> that this option gets ignored in the version of Firefox that all the
> hoi-polloi use, and it's enabled only in the dev/nightly Firefox
> builds.

Worked for me! Thanks,Sam!

[François Patte]

Le 04/05/2019 à 13:07, Heinz Diehl a écrit :
> On 04.05.2019, Sam Varshavchik wrote:
> > Basically, an "all your extensions are belong to us" situation.
>
> You can enter about:config and set "xpinstall.signatures.required" to
> "false" until the problem is fixed.

This does not work with français language pack

[Ulf Volmer]

On 05.05.19 12:27, François Patte wrote:
> Le 04/05/2019 à 13:07, Heinz Diehl a écrit :
> > On 04.05.2019, Sam Varshavchik wrote:
> > > Basically, an "all your extensions are belong to us" situation.
> >
> > You can enter about:config and set "xpinstall.signatures.required" to
> > "false" until the problem is fixed.
>
> This does not work with français language pack

For language packs you need set

extensions.langpacks.signatures.required

to false.

Best regards
Ulf

[Polly The Parrot]

‘am on win 7x64 & win 10 x64 dual boot... going on distrowatch, I tested al moust everything… so I can be user and don’t wanna know what OS is… whit some Linux whit predifaine Firefox and plug in-s I’ learn to install addons so when is done firefox work perfect as long as OS is instaled… and I try for fun nightly firefox 64 bit and up to date clean x64 firefox... I know this is fedora/redhat… just to tell is not Linux - “exlusive – well this is emberresing  “

Sent from Mailhttps://go.microsoft.com/fwlink/?LinkId=550986 for Windows 10

From: Ulf Volmer
Sent: Sunday, May 5, 2019 12:50 PM
To: [e-mail]
Subject: Re: PSA: All Firefox extensions are getting disabled, one by one

On 05.05.19 12:27, François Patte wrote:
> Le 04/05/2019 à 13:07, Heinz Diehl a écrit :
> > On 04.05.2019, Sam Varshavchik wrote:
> > > Basically, an "all your extensions are belong to us" situation.
> >
> > You can enter about:config and set "xpinstall.signatures.required" to
> > "false" until the problem is fixed.
>
> This does not work with français language pack

For language packs you need set

extensions.langpacks.signatures.required

to false.

Best regards
Ulf
_______________________________________________
users mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
I

[Jack Craig]

problem at firefox factory, breakage is already returning to normal for
me...

On Sun, May 5, 2019 at 4:11 AM Polly The Parrot <
[e-mail]> wrote:
> ‘am on win 7x64 & win 10 x64 dual boot... going on distrowatch, I tested
> al moust everything… so I can be user and don’t wanna know what OS is… whit
> some Linux whit predifaine Firefox and plug in-s I’ learn to install addons
> so when is done firefox work perfect as long as OS is instaled… and I try
> for fun nightly firefox 64 bit and up to date clean x64 firefox... I know
> this is fedora/redhat… just to tell is not Linux - “exlusive – well this is
> emberresing  “
>
> Sent from Mail https://go.microsoft.com/fwlink/?LinkId=550986 for
> Windows 10
>
> *From: *Ulf Volmer 
> *Sent: *Sunday, May 5, 2019 12:50 PM
> *To: *[e-mail]
> *Subject: *Re: PSA: All Firefox extensions are getting disabled, one by
> one
>
> On 05.05.19 12:27, François Patte wrote:
> > Le 04/05/2019 à 13:07, Heinz Diehl a écrit :
> > > On 04.05.2019, Sam Varshavchik wrote:
> > > > Basically, an "all your extensions are belong to us" situation.
> > >
> > > You can enter about:config and set "xpinstall.signatures.required" to
> > > "false" until the problem is fixed.
> >
> > This does not work with français language pack
>
> For language packs you need set
>
> extensions.langpacks.signatures.required
>
> to false.
>
> Best regards
> Ulf
> _______________________________________________
> users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>
> I
> _______________________________________________
> users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]

[Eddie G. O'Connor Jr.]

I'm just going to stop using it until this blows over. Thank goodness 
for the Open Source community! They've got more browsers available than 
any other platform! I think I'll give Epiphany (GNome Web) another go, 
I'm not big on multi-media stuff, so I'm not in desperate need of codecs 
and what not, and for the times I DO need to play a video on 
YouTube?...I can always use Vivaldi. Hopefully this issue resolves 
itself. If not? I can wait!....LoL!

EGO II

On 5/5/19 2:30 PM, Jack Craig wrote:
> problem at firefox factory, breakage is already returning to normal 
> for me...
>
> On Sun, May 5, 2019 at 4:11 AM Polly The Parrot 
> <[e-mail] > 
> wrote:
> ‘am on win 7x64 & win 10 x64 dual boot... going on distrowatch, I
> tested al moust everything… so I can be user and don’t wanna know
> what OS is… whit some Linux whit predifaine Firefox and plug in-s
> I’ learn to install addons so when is done firefox work perfect as
> long as OS is instaled… and I try for fun nightly firefox 64 bit
> and up to date clean x64 firefox... I know this is fedora/redhat…
> just to tell is not Linux - “exlusive – well this is emberresing  “
>
> Sent from Mail <https://go.microsoft.com/fwlink/?LinkId=550986>
> for Windows 10
>
> *From: *Ulf Volmer <mailto:[e-mail]>
> *Sent: *Sunday, May 5, 2019 12:50 PM
> *To: *[e-mail]
> <mailto:[e-mail]>
> *Subject: *Re: PSA: All Firefox extensions are getting disabled,
> one by one
>
> On 05.05.19 12:27, François Patte wrote:
> > Le 04/05/2019 à 13:07, Heinz Diehl a écrit :
> >> On 04.05.2019, Sam Varshavchik wrote:
> >>
> >>> Basically, an "all your extensions are belong to us" situation.
> >>
> >> You can enter about:config and set
> "xpinstall.signatures.required" to
> >> "false" until the problem is fixed.
> >
> > This does not work with français language pack
>
> For language packs you need set
>
> extensions.langpacks.signatures.required
>
> to false.
>
> Best regards
> Ulf
> _______________________________________________
> users mailing list -- [e-mail]
> <mailto:[e-mail]>
> To unsubscribe send an email to
> [e-mail]
> <mailto:[e-mail]>
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> <https://fedoraproject.org/wiki/Mailing_list_guidelines>
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>
> I
>
> _______________________________________________
> users mailing list -- [e-mail]
> <mailto:[e-mail]>
> To unsubscribe send an email to
> [e-mail]
> <mailto:[e-mail]>
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>
>
> users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]

[Sam Varshavchik]

Ulf Volmer writes:
> On 05.05.19 12:27, François Patte wrote:
> > Le 04/05/2019 à 13:07, Heinz Diehl a écrit :
> > > On 04.05.2019, Sam Varshavchik wrote:
> > > > Basically, an "all your extensions are belong to us" situation.
> > >
> > > You can enter about:config and set "xpinstall.signatures.required" to
> > > "false" until the problem is fixed.
> >
> > This does not work with français language pack
>
> For language packs you need set
>
> extensions.langpacks.signatures.required
>
> to false.

Important: set yourself a calendar reminder, oh, a week from now to turn  
both options back on. I'm just guessing that this dumpster fire will get  
sorted out before then, and you want to reenable it.

I'll bet there's going to be a huge crowd that forgets to turn this off. So,  
this episode will result in a some portion of Firefox's install base not  
checking signatures. A very attractive attack vector for drive-by malware  
infestation.

[Andras Simon]

2019-05-05 15:48 GMT+02:00, Sam Varshavchik :
> Important: set yourself a calendar reminder, oh, a week from now to turn
> both options back on. I'm just guessing that this dumpster fire will get
> sorted out before then, and you want to reenable it.

The first link you sent

https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disa...

has a workaround that  doesn't have this drawback:

Firefox Preferences -> Privacy & Security -> Allow Firefox to install
and run studies.
Undo this after restarting FF.

YMMV, but it worked for me.

[stan]

On Sun, 5 May 2019 12:27:26 +0200
François Patte  wrote:
> Le 04/05/2019 à 13:07, Heinz Diehl a écrit :
> > On 04.05.2019, Sam Varshavchik wrote:
> > > Basically, an "all your extensions are belong to us" situation.
> >
> > You can enter about:config and set "xpinstall.signatures.required"
> > to "false" until the problem is fixed.
>
> This does not work with français language pack

You already received an answer, so this is just an additional option.
The latest nightly downloadable from the mozilla.org site as a tar.bz2
file does not have this issue.  It allows install of extensions.  And
it keeps a separate namespace for nightly, so it won't impact existing
configuration of other firefox versions.  Possibly a workaround until
the fix is in.

https://www.mozilla.org/en-US/firefox/channel/desktop/

Three choices, I used the nightly one for nightly, future firefox 68.

[ToddAndMargo]

On 5/3/19 8:22 PM, Sam Varshavchik wrote:
> Just an FYI for everyone. After wondering why all my extensions suddenly 
> migrated to the bit bucket in sky, after some digging, searching, 
> browsing, and tweeting, it's a known issue:
>
> https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disa...
>
> Basically, an "all your extensions are belong to us" situation.

Whilst we all (im)patiently wait for Firefox to rush out
a patch, install Brave from http://brave.com.  It is very
fast and has built in ad blocking.  On first run it will
give you a shot at importing all your settings from a
browser of your choice (pick Firefox).

[Rikke Giles]

There was a fix, admittedly requiring 'studies', not very long after the 
problem was discovered.  And now (dated 5 May) there's an updated 
version of Firefox - 66.0.4. We still have to wait for the Fedora repos 
to take it up, but I expect that's coming soon.

https://www.mozilla.org/en-US/firefox/66.0.4/releasenotes/

Rikke -- long time Fedora user (from Redhat 4.2 or so in the 1990's) and 
lurker

On 5/5/19 10:13 PM, ToddAndMargo via users wrote:
> On 5/3/19 8:22 PM, Sam Varshavchik wrote:
> > Just an FYI for everyone. After wondering why all my extensions 
> > suddenly migrated to the bit bucket in sky, after some digging, 
> > searching, browsing, and tweeting, it's a known issue:
> >
> > https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disa...
> >
> > Basically, an "all your extensions are belong to us" situation.
>
> Whilst we all (im)patiently wait for Firefox to rush out
> a patch, install Brave from http://brave.com.%C2%A0 It is very
> fast and has built in ad blocking.  On first run it will
> give you a shot at importing all your settings from a
> browser of your choice (pick Firefox).
>
> users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: 
> https://lists.fedoraproject.org/archives/list/[e-mail]

[sixpack13]

you were all heared:

https://koji.fedoraproject.org/koji/buildinfo?buildID=1263621