News for hackers. Stuff that matters.

A comment on All extensions disabled due to expiration of intermediate signing cert. Parent comment

Re:All extensions disabled due to expiration of intermediate... by phyzome on Saturday May 04, 2019 @09:11AM (#19826206)
Easy: There's a difference between static, shipped code and a capability to modify software at a distance (which could even by hijacked by an attacker who infiltrates Mozilla's infrastructure.)
[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by calcifer on Saturday May 04, 2019 @10:45AM (#19826756)
If your threat model includes the hijacking of Mozilla's infrastructure, I assume you read and verify the entirety of the Firefox source with every new version before using it, right?
[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by phyzome on Sunday May 05, 2019 @11:08PM (#19836545)
Obviously not?

But there are trustworthy people working with and integrating that code, there's a good chance they'll notice a hinky commit, and they're very close to having completely reproducible builds—which means that there can be verification that the shipped binary matches the inspected source.

https://gregoryszorc.com/blog/2018/06/20/deterministic-firef...

[ Parent | on HN ]