News for hackers. Stuff that matters.

A comment on All extensions disabled due to expiration of intermediate signing cert. Parent comment

Re:All extensions disabled due to expiration of intermediate... by lvh on Saturday May 04, 2019 @12:27PM (#19827424)
What do you think the median size of a Firefox release is, what do you think the resources (let’s call it US dollars FMV) are to audit that, and what do you think the resources Debian has to devote to it?

Clearly more eyes are good, but... In between “Wild West WebExtensions” and “Mozilla backdoors my Firefox and it gets used for nefarious purposes” and “delays in browser updates increase exploitation windows”, I know which threat models I’m buying.

[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by anfilt on Sunday May 05, 2019 @12:01AM (#19831081)
I agree an unpatched vuneribility is probably more risky. However this feature can change settings the user explicitly sets. The bigger issue is it does not give me any indication the settings have been changed.
[ Parent | on HN ]