Hypothetically, lets say they took the opposite approach, and only checked the certificate date on installation. What would have happened? There would have been a brief period of time where people couldn't install extensions, it would have been fixed in a few hours, and this story would probably have like 20 upvotes and fallen off the front page in like 10 minutes, if it ever got there in the first place.
Now let's briefly look at what's actually taking place: a bunch of people's browsers broke. It broke in scary ways for some people that were using extensions for privacy; IE, their security might have been compromised by this decision by Mozilla. Mozilla is probably going to lose users over this. Their reputation is damaged. Not only that, but now people are evaluating other decisions that Mozilla has made separately from this in an unfavorable light (Studies and Normandy, specifically). The computing industry loses out on this too: we're all better off for chrome having a viable open source competitor. We should want Mozilla to do well, whether you use their browser or not.
Which outcome do you think Mozilla engineers would be preferring today?
Sounds like a good thing. Probably sounds like a good thing to some of the engineers at Mozilla.
The computing industry loses out on this too: we're all better off for chrome having a viable open source competitor.
I want a free competitor, not an open source one. And this is the most prominent example of that somewhat subtle distinction: Firefox is open source, but with all these backdoors it's no longer free, neither in spirit nor in practice.
P.S. On the other hand, it's probably indeed better to have at least two serious competing browsers, even if they are both non-free.
Instead of disabling this historically working feature which normally works great against hostile attacks such as MITM and malware this problem would've been avoided by a simple cron script which runs daily, and checks for expired certificates used within the infrastructure (both interaly used and externally used).
The main competitor you mention, Google Chrome, is a terrible privacy hazard. This situation does not change that.
As to your argument about security: doing the check on install instead of all the time, as I suggest is preferable, still protects against MITM and malware. The only argument for expiring software based on a calendar is that it might be a security risk if it's out of date. But first off, that is highly dependent on what the extension actually does. Also clearly we can see it's also a security risk to turn off privacy extensions without warning based on an arbitrary signing certificate.
> > I'm not putting words in your mouth [..]
Yes, you did:
> "So you think [..]"
No.
All it proves is that certificates expire (which is a Good Thing (tm)). If you depend on online certificates to verify content, something like this can theoretically happen.