I would assume the delay in assigning P1 is really just a result of assigning P1 not being as high priority as fixing the damn problem.

So we can come to the obvious conclusion about Mozilla, then? No good "engineering" managers? Miss one reprioritization and you're out! This is what sane people think?

If you want to complain about knee-jerk overreactions, I think you might want to look in the mirror first.

Because people were staying up until the wee hours of the morning working on fixing it instead of toggling priorities in Bugzilla. This was treated as a five-alarm fire.

Saying "we were too busy fixing to communicate" is actually a really bad sign, because it's not just about what you are communicating to the outside world, but also, for example, about making sure people that need to be brought in are getting consistent information.

The question is about why someone didn't set the priority setting in the internal Bugzilla sooner. There are a couple of reasons for this. First, that's not really what priority is for: priority is so that engineers on major projects like WebRender know what is most important to work on. It's not an effective tool for emergency responses. P1 doesn't summon on-call people. Second, everyone who was able to get it fixed was already on it. Bugzilla priorities don't make people who wouldn't otherwise be aware aware.

Unlike that of Mozilla, your issue tracker at Google for outages is private and internal-only. One of the many reasons it is private is so that people who don't know the organization's operational processes don't come in and start making incorrect assumptions based on what they find there. I think it's laudable that Mozilla works in the open so much, but comments like this one are some of the downsides of doing so.

I'm sorry if i offended you. Really. I don't really think it's that uncharitable, but hey, offending you wasn't my intent, and if you were, that is what matters.

For what it is worth: your response to the parent took them to task for even attempting to state something: "Because people were staying up until the wee hours of the morning working on fixing it instead of toggling priorities in Bugzilla. This was treated as a five-alarm fire."

This is a pretty rude response (which should never be happening regardless of what they wrote), and if you intended to convey that you had incident managers handling it and they didn't get around to it yet, you did not.

"Unlike that of Mozilla, your issue tracker at Google for outages is private and internal-only. "

I'm really unsure why you decided to add a completely irrelevant and unnecessary attack like this.

Honestly, it just makes me think less of you and makes me sad. You are usually a very sane and even keeled person. I'm sure you were not having a good time, but i still don't think this was okay.

" One of the many reasons it is private is so that people who don't know the organization's operational processes don't come in and start making incorrect assumptions based on what they find there."

Which is incredibly ironic, since it is not in fact as private as you seem to believe . Your own assumption here is completely and totally incorrect.

Maybe before you decide to add completely irrelevant and unnecessary attacks, at least verify they are correct?

" I think it's laudable that Mozilla works in the open so much, but comments like this one are some of the downsides of doing so."

You seem to have taken my comment incredibly personally, and your response seems very far out of proportion.

If you want to have a discussion, you're gonna have to tone this down a few notches.

FWIW: Right now most of your comments in this story read incredibly defensive (and i'm not just talking about this one)

I would stop and give it a rest. It is not projecting a good image.

Of course, that's just my perspective.

Really hope tomorrow is a better day for you.

However, I bet it’s likely they have procedures and policies for work that first involve signaling like for example the priority level.

I’d be willing to bet lots of things surrounding this issue weren’t handled in a by the book manner. So if you are always going to wing it, why have a book (or a public priority level system) at all?

Second, because we care about solving problems, not being bureaucrats.

The non-bureaucratic thing to do, as has been pointed out many times of course, would be to give users the power to override the cert signing check as an advanced option.

"The book" is something that needs to change and improve like anything else. Sometimes, that means you'll still need to wing it and add that thing to the book later.

I don't think it bothers me personally but it's funny you said that. Presumably you mean a "'no-alarm fire' because who has time to set off an alarm when there's a fire to fight"?!

https://en.wikipedia.org/wiki/Multiple-alarm_fire

The 5th level or a five-alarm fire, is the top level where you're basically talking all hands on deck.

Still seems like an ironic choice, applies equally to the people saying it was DEFCON1. I'm pretty sure the military actually have displays indicating the status, but again that's based mainly on movies.

Random user: What the fuck is a tree and why is the priority of this not higher yet?

Not to be too glib, but any random user who is technically literate enough to know where to seek out Firefox's issue tracker and how to find the issue in question, and who has such a thorough understanding of issue trackers that they understand that such a thing as a priority field exists, is also going to be savvy enough to read the very first comment, and will be well aware of what it means, and will, one hopes, be rational enough to understand that the flurry of activity indicated by the issue in question is more important than a passing field in the bugzilla database.

If anyone expects Mozilla to take power users seriously, then we need to focus our criticism on the things that aren't just imagined trivialites. It makes me frustrated that the people who irrationally fly off the handle at the slightest perceived provocation are also the ones who implicitly encourage Mozilla to write off power users as more trouble than we're worth (and after ten years of watching these incessant whining non-comments on HN, I don't blame them anymore).

I understand why an add-on update or new installation would be prevented from succeeding by a certificate expiration. But why would a certificate expiration prevent an already-installed from running? Any already-installed add-ons were previously validated at installation time and should (IMO) run as-is. It seems unnecessary to continuously check the status of an add-on's certificate if it has not been changed. Am I missing something?

I had to go thorugh profile/extensions.json and set appDisabled to false to make my extensions enableable again.

See profile/blocklist-addons.json

Not sure how not renewing a certificate and letting everything get disabled is useful. It's only useful if cert key leaks.

No, they do not need to. They decided that they want to. Remember that there was a time before certificate signing.

And now the decision to be able protect those who install crapware is also harming those who never had those issues.

It's exceedingly poor ethics.

I look forward to joining your class-action lawsuit.

Besides that, this sort of "but we hid something in the t&c-s so now we can shit on you" is the sort of thing I expect from over commercialised companies, not from what was once a paragon of the FOSS community.

FWIW class-actions don't exist in UK.

Revocation is, I think, the actual reason.

[1] GitHub mirror to not stress their infra: https://github.com/mozilla/gecko-dev/commit/1d1260c7615f1d9a...