Firefox bug: 66.0.3 disables all extensions

classic Classic list List threaded Threaded
10 messages Options
Reply | Threaded
Open this post in threaded view
|

Firefox bug: 66.0.3 disables all extensions

acampbell
After upgrading Firefox today to 66.0.3  in -current, all my add-ons
were inactivated. A quick search showed that this is a widespread
problem, apparently due to a bug in FF. I was able to fix it
temporarily by means of a suggestion on ghacks.net to change

xpinstall.signatures.required

in about.config to "false".

Presumably it will be fixed soon upstream.


--
Anthony Campbell http://www.acampbell.uk

Reply | Threaded
Open this post in threaded view
|

Re: Firefox bug: 66.0.3 disables all extensions

Stefan Pietsch
On 04.05.19 20:01, Anthony Campbell wrote:

> After upgrading Firefox today to 66.0.3  in -current, all my add-ons
> were inactivated. A quick search showed that this is a widespread
> problem, apparently due to a bug in FF. I was able to fix it
> temporarily by means of a suggestion on ghacks.net to change
>
> xpinstall.signatures.required
>
> in about.config to "false".
>
> Presumably it will be fixed soon upstream.

More information can be found here:

https://bugzilla.mozilla.org/show_bug.cgi?id=1548973
https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/

Citing the blog:

There are a number of work-arounds being discussed in the community.
These are not recommended as they may conflict with fixes we are deploying.

Reply | Threaded
Open this post in threaded view
|

Re: Firefox bug: 66.0.3 disables all extensions

Juan Francisco Cantero Hurtado
In reply to this post by acampbell
On Sat, May 04, 2019 at 07:01:55PM +0100, Anthony Campbell wrote:

> After upgrading Firefox today to 66.0.3  in -current, all my add-ons
> were inactivated. A quick search showed that this is a widespread
> problem, apparently due to a bug in FF. I was able to fix it
> temporarily by means of a suggestion on ghacks.net to change
>
> xpinstall.signatures.required
>
> in about.config to "false".
>
> Presumably it will be fixed soon upstream.

Disabling signature checks is almost always a bad idea.

Open this url with firefox and install the extension.

https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi


--
Juan Francisco Cantero Hurtado http://juanfra.info

Reply | Threaded
Open this post in threaded view
|

Re: Firefox bug: 66.0.3 disables all extensions

acampbell
In reply to this post by Stefan Pietsch
On 04 May 2019, Stefan Pietsch wrote:

> On 04.05.19 20:01, Anthony Campbell wrote:
> > After upgrading Firefox today to 66.0.3  in -current, all my add-ons
> > were inactivated. A quick search showed that this is a widespread
> > problem, apparently due to a bug in FF. I was able to fix it
> > temporarily by means of a suggestion on ghacks.net to change
> >
> > xpinstall.signatures.required
> >
> > in about.config to "false".
> >
> > Presumably it will be fixed soon upstream.
>
> More information can be found here:
>
> https://bugzilla.mozilla.org/show_bug.cgi?id=1548973
> https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/
>
> Citing the blog:
>
> There are a number of work-arounds being discussed in the community.
> These are not recommended as they may conflict with fixes we are deploying.
>
>

The second link offers a solution:


       
        To provide this fix on short notice, we are using the Studies
        system. This system is enabled by default, and no action is
        needed unless Studies have been disabled. Firefox users can
        check if they have Studies enabled by going to:

        Firefox Options/Preferences -> Privacy & Security -> Allow
        Firefox to install and run studies (scroll down to find the
        setting)

This can't be done on my FF - it's greyed out and cannot be enabled.

--
Anthony Campbell http://www.acampbell.uk

Reply | Threaded
Open this post in threaded view
|

Re: Firefox bug: 66.0.3 disables all extensions

acampbell
In reply to this post by Juan Francisco Cantero Hurtado
On 04 May 2019, Juan Francisco Cantero Hurtado wrote:

> On Sat, May 04, 2019 at 07:01:55PM +0100, Anthony Campbell wrote:
> > After upgrading Firefox today to 66.0.3  in -current, all my add-ons
> > were inactivated. A quick search showed that this is a widespread
> > problem, apparently due to a bug in FF. I was able to fix it
> > temporarily by means of a suggestion on ghacks.net to change
> >
> > xpinstall.signatures.required
> >
> > in about.config to "false".
> >
> > Presumably it will be fixed soon upstream.
>
> Disabling signature checks is almost always a bad idea.
>
> Open this url with firefox and install the extension.
>
> https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi
>
>

Thanks; that certainly fixes the problem though I'm not clear how it
does so or who is supplying the extension, which is a bit worrying.
And it's not showing up in the list of extensions. Is any further
information available?

 

--
Anthony Campbell http://www.acampbell.uk

Reply | Threaded
Open this post in threaded view
|

Re: Firefox bug: 66.0.3 disables all extensions

Juan Francisco Cantero Hurtado
On Sun, May 05, 2019 at 08:57:11AM +0100, Anthony Campbell wrote:

> On 04 May 2019, Juan Francisco Cantero Hurtado wrote:
> > On Sat, May 04, 2019 at 07:01:55PM +0100, Anthony Campbell wrote:
> > > After upgrading Firefox today to 66.0.3  in -current, all my add-ons
> > > were inactivated. A quick search showed that this is a widespread
> > > problem, apparently due to a bug in FF. I was able to fix it
> > > temporarily by means of a suggestion on ghacks.net to change
> > >
> > > xpinstall.signatures.required
> > >
> > > in about.config to "false".
> > >
> > > Presumably it will be fixed soon upstream.
> >
> > Disabling signature checks is almost always a bad idea.
> >
> > Open this url with firefox and install the extension.
> >
> > https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi
> >
> >
>
> Thanks; that certainly fixes the problem though I'm not clear how it
> does so or who is supplying the extension, which is a bit worrying.
> And it's not showing up in the list of extensions. Is any further
> information available?

That's the same extension installed by Firefox when you enable Studies.
The extension is signed by Mozilla. On Android, I can see the extension
in "Addons" with a button to uninstall it. The desktop version hides it
and doesn't have the option to uninstall.

We have Studies disabled on OpenBSD because Mozilla did a bad use of the
feature in the past. Search "firefox studies mrrobot". With Studies
enabled, they can change anything in your browser remotely without
notifying you.


--
Juan Francisco Cantero Hurtado http://juanfra.info

Reply | Threaded
Open this post in threaded view
|

Re: Firefox bug: 66.0.3 disables all extensions

ropers
In reply to this post by acampbell
On 05/05/2019, Anthony Campbell <[hidden email]> wrote:

>
> The second link offers a solution:
>
>
> To provide this fix on short notice, we are using the Studies
> system. This system is enabled by default, and no action is
> needed unless Studies have been disabled. Firefox users can
> check if they have Studies enabled by going to:
>
> Firefox Options/Preferences -> Privacy & Security -> Allow
> Firefox to install and run studies (scroll down to find the
> setting)
>
> This can't be done on my FF - it's greyed out and cannot be enabled.

I think it's fundamentally wrong to tie even temporary security fixes
or workarounds to people opting in to, or not opting out of mechanisms
people may have very good reasons not to opt in to. It's basically
putting a gun to their heads saying, "Consent -- or else!"
That's especially true if a supposed stopgap measure leads to a sense
of decreased urgency for a real solution.

Reply | Threaded
Open this post in threaded view
|

Re: Firefox bug: 66.0.3 disables all extensions

Dumitru Moldovan-2
In reply to this post by Juan Francisco Cantero Hurtado
On Sat, May 04, 2019 at 10:13:39PM +0200, Juan Francisco Cantero Hurtado wrote:

>On Sat, May 04, 2019 at 07:01:55PM +0100, Anthony Campbell wrote:
>> After upgrading Firefox today to 66.0.3  in -current, all my add-ons
>> were inactivated. A quick search showed that this is a widespread
>> problem, apparently due to a bug in FF. I was able to fix it
>> temporarily by means of a suggestion on ghacks.net to change
>>
>> xpinstall.signatures.required
>>
>> in about.config to "false".
>>
>> Presumably it will be fixed soon upstream.
>
>Disabling signature checks is almost always a bad idea.
>
>Open this url with firefox and install the extension.
>
>https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi


Installing random extensions from the big bad Internet is almost always
a bad idea.  :-D

This issue was fixed upstream in Firefox 66.0.4.  Use Landry Breuil's
repo to keep Firefox updated in -stable or -release.  More at
https://undeadly.org/cgi?action=article&sid=20170425173917.

Final result from pkg_add should be:

    firefox-66.0.2->66.0.4: ok

Reply | Threaded
Open this post in threaded view
|

Re: Firefox bug: 66.0.3 disables all extensions

Juan Francisco Cantero Hurtado
On Mon, May 06, 2019 at 11:54:04AM +0300, Dumitru Moldovan wrote:

> On Sat, May 04, 2019 at 10:13:39PM +0200, Juan Francisco Cantero Hurtado wrote:
> > On Sat, May 04, 2019 at 07:01:55PM +0100, Anthony Campbell wrote:
> > > After upgrading Firefox today to 66.0.3  in -current, all my add-ons
> > > were inactivated. A quick search showed that this is a widespread
> > > problem, apparently due to a bug in FF. I was able to fix it
> > > temporarily by means of a suggestion on ghacks.net to change
> > >
> > > xpinstall.signatures.required
> > >
> > > in about.config to "false".
> > >
> > > Presumably it will be fixed soon upstream.
> >
> > Disabling signature checks is almost always a bad idea.
> >
> > Open this url with firefox and install the extension.
> >
> > https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi
>
>
> Installing random extensions from the big bad Internet is almost always
> a bad idea.  :-D

The extension is signed by Mozilla. Just in case someone doesn't know,
the xpi extensions are just zip files. If you're worried about what
you're installing, unzip the file and check the content. The changes are
in the file "experiments/skeleton/api.js".


>
> This issue was fixed upstream in Firefox 66.0.4.  Use Landry Breuil's
> repo to keep Firefox updated in -stable or -release.  More at
> https://undeadly.org/cgi?action=article&sid=20170425173917.
>
> Final result from pkg_add should be:
>
>    firefox-66.0.2->66.0.4: ok
>

--
Juan Francisco Cantero Hurtado http://juanfra.info

Reply | Threaded
Open this post in threaded view
|

Re: Firefox bug: 66.0.3 disables all extensions

R0me0 ***
They already fixed it a couple of hours after the issue.


Em seg, 6 de mai de 2019 às 11:45, Juan Francisco Cantero Hurtado <
[hidden email]> escreveu:

> On Mon, May 06, 2019 at 11:54:04AM +0300, Dumitru Moldovan wrote:
> > On Sat, May 04, 2019 at 10:13:39PM +0200, Juan Francisco Cantero Hurtado
> wrote:
> > > On Sat, May 04, 2019 at 07:01:55PM +0100, Anthony Campbell wrote:
> > > > After upgrading Firefox today to 66.0.3  in -current, all my add-ons
> > > > were inactivated. A quick search showed that this is a widespread
> > > > problem, apparently due to a bug in FF. I was able to fix it
> > > > temporarily by means of a suggestion on ghacks.net to change
> > > >
> > > > xpinstall.signatures.required
> > > >
> > > > in about.config to "false".
> > > >
> > > > Presumably it will be fixed soon upstream.
> > >
> > > Disabling signature checks is almost always a bad idea.
> > >
> > > Open this url with firefox and install the extension.
> > >
> > >
> https://storage.googleapis.com/moz-fx-normandy-prod-addons/extensions/hotfix-update-xpi-intermediate%40mozilla.com-1.0.2-signed.xpi
> >
> >
> > Installing random extensions from the big bad Internet is almost always
> > a bad idea.  :-D
>
> The extension is signed by Mozilla. Just in case someone doesn't know,
> the xpi extensions are just zip files. If you're worried about what
> you're installing, unzip the file and check the content. The changes are
> in the file "experiments/skeleton/api.js".
>
>
> >
> > This issue was fixed upstream in Firefox 66.0.4.  Use Landry Breuil's
> > repo to keep Firefox updated in -stable or -release.  More at
> > https://undeadly.org/cgi?action=article&sid=20170425173917.
> >
> > Final result from pkg_add should be:
> >
> >    firefox-66.0.2->66.0.4: ok
> >
>
> --
> Juan Francisco Cantero Hurtado http://juanfra.info
>
>