what did I do wrong? (It's all Greek to me)
Apparently beta and nightly need to change `Components.utils.import` to `ChromeUtils.import`.
But anyways, don't use this now, use the semi-official fix of clicking on this link and letting it install: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...
This is the fix Mozilla has published to be installed via shield studies, but skipping the shield studies part. You can be sure it's not malicious because it is signed by Mozilla... and if your browser installed unsigned extensions you wouldn't be looking for this solution in the first place.
Mozilla was warned beforehand about this, this problem was completely avoidable which is upsetting. I've been a fan of this browser for years but this is the 2nd time this has happened to add-ons that I can recall and to be blunt it's unacceptable.
It makes absolutely no sense that add-ons the user installs can be disabled like this without user consent, whether the add-ons in question are considered safe or not. Take into account how easy it is to migrate all of your bookmarks/etc. to another browser and this is clearly bad practice by Mozilla. It's one thing if we had a way to bypass this through Firefox directly but they chose not to include a bypass for situations such as this. It wouldn't be so bad if it wasn't for the fact that this is affecting all add-ons, adblockers/dark mode/greasemonkey/everything.
"Date expiration on code signing cert should only prevent new signatures from being considered valid -- it should not even prevent installation of old software. The fact that an expired cert disabled software is the most retarded thing I've seen this decade on any web browser." <This quote nails it on the head, this whole situation is bull.
To see all add-ons and theme disappear before my eyes with no explanation was pretty disconcerting and leads me to say that I totally disagree with Mozilla (or anyone else) having that kind of control. Bad policy (which it is) aside, though, someone dropped the ball big-time. I'm still astonished this was even allowed to happen, bad policy or not.
The .xpi has already fixed the problem permanently (I think). You can just leave it, or if you want you can uninstall it now just as a matter of cleanliness. I'm linking to this comment about how to uninstall because I'm not satisfied with my solution and I'm hoping someone will contribute a better one: https://news.ycombinator.com/item?id=19827428
You can see the addon in about:support, but it doesn't give you a way to uninstall it, just see that it is installed.
you can uninstall it from about:studies
Couple of questions, where does this fix appear? I can't see it under addons or studies.
Will we be able to uninstall once a proper general fix has been released?
Thank you, 10/10 would prefer it never happens again
This reddit post might help you https://www.reddit.com/r/firefox/comments/bkspmk/addons_fix_...
I don't feel right responding without saying this, so even though you might have heard it before:
Using Windows XP and firefox 52 is in my humble estimation crazy. You're asking for viruses. I'd strongly recommend installing linux on your machine and using that instead.
Linux Mint Xfce 32 bit might manage to run on your system, but your pushing up against the minimum requirements for doing so. If it does run well enough it is IMHO the easiest distro for a new user to use.
If you find it doesn't, Debian with (again) xfce should run just fine. Debian isn't exactly scary to install, but it's scarier than mint for a new user.
I can't promise full support, but if you need a pointer in the right direction while installing linux, feel free to email me at morenzg@google's mail service here.com (since I'm unlikely to see any replies here).
You don't need to allow firefox to install and run studies, that's just a way of letting firefox automatically install this xpi.
Did that error message only appear after you installed the .xpi fix? If so it's mildly worrisome, but probably not worth spending time figuring out what it's about if all your addons are back. If it appeared when the addons were initially disabled it's not an issue at all, it's just that nothing closed it.
In that case I am wondering why Mozila didn't provide a direct link...it would have been faster. Maybe there is another reason to ask us to run studies...wondering.
Yes, it appeared when the addons were initially disabled.
"""WebExtensions: failed to add new intermediate certificate:"""
What error do you get on the link though? That link is a better fix.
You're not behind a firewall that might be blocking it are you? E.g. being in China?
If you installed the xpi you shouldn't need to do anything in the browser console, and your addons should have come back. Obviously the latter didn't happen.
Chances are a connection failure in the browser console is unrelated, the browser console is basically constantly spewing error messages, you should just ignore them unless they are in response to something you did.
All I can really suggest over the internet is to try reinstalling your addons - that might work - in which case I would assume they just got uninstalled somehow. If it doesn't I'm not sure what to suggest, and I can't realistically debug something too complex over HN comments. You might just have to wait for mozilla to publish an update to the browser that fixes this properly.
I do want to emphasize that I'm just some dude on the internet being helpful by the way, not associated with Mozilla or anything.
Edit: Just saw this error message you also posted: """WebExtensions: failed to add new intermediate certificate:"""
That sounds like an issue that happened when installing the .xpi? Did it give any other related debugging information?
FF shows the fix add-on as being installed with the standard pop-up notifications in the menu bar. However, in the browser console, I only see the error msgs that I've listed in my other posts.
???
I.e. something like
- I open the browser console
- I click the .xpi link
- The following appears in the browser console immediately after clicking the link:
WebExtensions: new intermediate certificate added api.js:15
WebExtensions: signatures re-verified api.js:23
- If I try to install an addon from addons.mozilla.org I get <this message about the addon signature verification failing> in the browser console.
So,
I click the link. I click "Add", and Mozilla says addon could not be downloaded due to connection failure. Nothing appears in browser console.
Downloading an addon gives me "Download failed. Please check your connection." on the Addons site. In console, I get:
Events to handle the installation initialized. BigInteger.js:27
[GA: OFF] sendEvent {"hitType":"event","eventCategory":"AMO Addon Installs Download Failed","eventAction":"addon","eventLabel":"uBlock Origin"} BigInteger.js:27
Error:
Edit: That studies image looks like it has already been installed, which is weird if your extensions aren't back...
As for the studies image, that's only half of the fix according to the blog post [1], mine is only verification-timestamp, not signing-intermediate-bug.
[1]: https://blog.mozilla.org/addons/2019/05/04/update-regarding-...
You're right about the image, that's weird, I can't think of any reason why the verification-timestamp one would be necessary.
When I turn on Studies, and do about:studies, I see:
"What's this? Firefox may install and run studies from time to time. Learn more"
Is this what I'm supposed to be seeing?
If I was you I would ignore Mozilla's advice to do it their way and do what I suggested above, of just clicking on the .xpi link and disabling shield studies. It will act immediately, which will give you a better idea of whether or not it will actually work with 58.0.2. I'm not sure it will (I suspect it won't in fact).
They'd rather that the people who are having issues with it just wait for a new build than waste engineering time. Probably rightly so.
Win 10 FF 66.0.3 64-bit (Studies checked by default anyway). In Australia.
I know of an API change that means the official hotfix won't work (whether you install it my bootleg way or the official studies way).
My recommendation is to upgrade your firefox version.
If you try hard enough you can probably fix your browser, unpack the .xpi (it's just a zip), look at the source in experiments/skeleton, and try to figure out how to run something similar in the browser console.
But I really can't recommend doing this, I appreciate it's painful, but what you're running right now is massively insecure, there are published exploits. You're just asking for viruses by interacting with the internet using something that old.
Is there a way to fix this that works on older versions. Updating the browser isn't an option because I've legacy addons running that I can't work without.
Have you tried reinstalling the addons? I know it's less than ideal, but on one of my installs firefox had decided to uninstall the addons after disabling them (I think because it updated firefox version after disabling them). If it did that I don't think there is any way to get them back short of reinstalling.
Reinstalling seems to work, but there are certain extensions that have data I do not want to lose. For example, if I reinstall ubock origin, I will lose all of my dynamic filtering rules.
But no guarantees. Do you have reason to believe the addons are still installed?
As a side note, the value for that setting got reset after I restarted firefox.
Also, I uninstalled the fix by simply removing the extension in about:addons. Is this the correct way to do it?
That value resetting is expected, it's the time when Firefox thinks it last checked signatures, it resetting just means this convinced it to recheck as intended.
Go to "about:config" (in the url bar), search for and enable devtools.chrome.enabled, then hit ctrl-shift-j (or you can open it from Menu -> Web Developer -> Browser Console).
TypeError: setting is undefined[Learn More] ExtensionPreferencesManager.jsm:90:7 No matching message handler for the given recipient. MessageChannel.jsm:924 1556983316679 addons.xpi-utils WARN Add-on [email protected] is not correctly signed.
Edit: another weirdness: i decided to take a look at a different computer (unrelated to this one, at work via remote desktop) which is running exactly the same FF and Windows and all add-on are enabled. it's on 24x7; i didn't do anything to it.
Assuming you meant without installing it in firefox, I don't quite know. You're going to need to find mozilla's public keys somewhere (maybe just extract them from firefox), unpack the xpi (it's just a zip file with a different extension) and find the signature contained within, and then figure out how to verify it.
I know of an API change that means the official hotfix won't work.
My recommendation is to upgrade your firefox version.
This should really be one of the official ways to apply the patch instead of only telling users "it can take up to 6 hours for the fix to be installed" after enabling Shield studies. I can only imagine what kind of havoc this creates in businesses using Firefox working weekends.
This is not the case anymore that I have vouched for it. But, all of the comments you make in the future, and (I'm guessing here) a lot of the comments you have made, cannot be seen by normal visitors, and are greyed out and delisted to people with 'showdead' enabled.
In your case, a lot of your comments are good and make fair points, I think (I only did a quick scan down your comments page). It might be worth for you to contact `dang` or one of the other administrators to see if they would remove the shadow-ban in your case.