Maybe this is a timezone thing, but I was in East Asia, and I had to deal with the internet for close to 36 hrs (android) with no ublock. It was almost enough to look for a new browser (but browsers with adblock on Android are few and far between - so instead I just didn't use the internet as much for a day or two.). Part of that delay was play store being slow to push it, as I recall seeing the binaries somewhere a while sooner.

[0]https://f-droid.org/en/packages/se.johanhil.duckduckgo/

[1]https://f-droid.org/en/packages/com.stoutner.privacybrowser....

Mozilla's official Linux builds disallow xpinstall.signature.required = false (last I checked), but the unbranded builds (as well as builds provided by at least some repos) do indeed allow signature bypassing.

Edit: on second thought, maybe I saw this solution (with or without the mention of nightly) and skipped over it as the Mozilla blog post on May 4th said "There are a number of work-arounds being discussed in the community. These are not recommended as they may conflict with fixes we are deploying."

Would I have to sign in to sync again to access my bookmarks, logins, etc? Are there ever issues with syncing between phone and computer (nightly to stable) or would I have to change my desktop browser as well? Does anything ever break at all?

Even if the answer to these questions is "no", the fact that I'm asking them is the barrier to entry. And if any of the answers are yes, there's no reason to change from stable branch - avoiding one issue to get different one(s) isn't a solution.

> certainly no more than there would be for, you know, normal Firefox

Yes, indeed, switching to Firefox from Chrome a couple years ago did have a significant barrier to entry

On desktop front there is no problem connecting current and nightly to the same sync account and indeed same profile directly.

The sole annoying thing about nightly is that it naturally updates frequently. It's quite stable and gets legitimately useful features faster and let's you disable signing and run locally built add-ons. I use it as my primary browser on Android and Linux.

Fair enough. The answers, for the record, are indeed "yes" (but that takes, what, 30 seconds?), "no", and (at least not severely) "no".

But apparently even non-Nightly Firefox for Android supports xpinstall.signatures.required = false, which is even less of a barrier to entry, so that's good news, I guess. While I understand Mozilla's reasoning for not wanting a bunch of people to set this and forget about it, it's a bit ridiculous that not once did they mention it aside from a "don't do this thing that we're not going to specify because it's a hack" (of course it's a hack, and it's one that got me up and running again long before there was even a fix via Studies).

Yeah, the last two would have been the broader deal breakers. The first one is just an issue for me personally - I don't know my sync password. I have it written down at home, but I'm not there right now.

I have no issues whatsoever with the speed of Firefox on mobile. I also prefer to support a non-chromium browser.

Don't you, from a privacy perspective, find it more than a little disturbing that the study mechanism has so much access to internal APIs in Firefox that it can install certificates without your involvement?

That seems like a crazy security risk, let alone privacy risk. It's built in and enabled _by default_ in Firefox.

Seriously, look at how studies operates. If you're using firefox, go to about:studies and see for yourself.

> look at how studies operates

It works on the background and without asking you anything. Is that correct?

> If you're using firefox, go to about:studies and see for yourself.

It says "You have not participated in any studies." - probably because I have them disabled.

In my own browser, if I go to about:studies, I have two Studies running. One is the hotfix for the add-on signing issue. The other is:

  prefflip-push-performance-1491171 • Active
  This study sets dom.push.alwaysConnect to false.

(Disclosure: I work for Mozilla)

The Studies mechanism occurs silently, running private code, without specific user action, and with "extensive access to Firefox internal APIs".

At the end of the day the question is whether you can trust Mozilla. I trust them more than most entities, including many that push changes through apt-get.

I would love to see a link to the code related to various Studies. So far I've not been able to find any. All you seem to get told is the name of any studies you're in, and only if you go over to about:studies and go looking.

This is not to say I don't trust Mozilla. I do. I trust them far more than I do Google / Chrome. It's hard not to see Studies as a privacy nightmare, though, and the level of power it has is disturbing.

When the study involves an addon, I think the bug will link to its code.

(Disclosure: I work for Mozilla)

The other thing is that it's not like there are many other options for me. The only mainstream browsers I could realistically use are Chrome, Firefox and Edge. Out of those I think Firefox probably cares the most about my privacy.

If you don't trust them at least a little bit, you shouldn't be using their software full stop.

You were lucky you extentions were not disabled before the fix, but for many people this was a major problem.

To get the fix though, I had to opt in to the Firefox studies. Apparently I had opted out at some point in the past.

Currently testing out "Edgium" though, and I can already say it's the one browser that could pull me away.

But it did take a few days for the Android fix to be released on Google Play, so it was more annoying than on the desktop.

Add to that that the recommended fix was to activate the backdoor of Firefox, thats just a horror story from beginning to the end.

And no admission of guilt anywhere.

> We strive to make Firefox a great experience. Last weekend we failed, and we’re sorry. (...) We let you down

https://blog.mozilla.org/blog/2019/05/09/what-we-do-when-thi...

I think they handled it terribly… or rather, they handled the same event three years ago terribly. There's a reason this is called armagadd-on 2.0… that cert had expired once already, the previous fix didn't work. I think last time they actually had a week of lead time, too.

That is 100% not reassuring. Remember Looking Glass?

https://news.ycombinator.com/item?id=15956325

Well, the marketing team has the power to tweak how ads are handled, silently, with no update action from the user.

Out of the frying pan, into the fire.

I'm still running FF 56.0.2 because I can't live without Tab Mix Plus.

The official line was to wait for the update but about:studies never came up with anything even after 24 hours of waiting and everyone was saying it was fixed but it wasn't for me, I presume because nobody cares about the refugees stuck on pre-add-on breaking versions.

So it was completely broken until I finally found a reddit thread that described how to use the developer console to manually import the certificate extracted from the fix.

That worked, but it enabled all my add-ons, even ones that were previously disabled.

Bloody irritating. I didn't even know that it was possible to break things remotely like this.

Also they could have mentioned in their post that their fix did not do anything for older versions, instead of specifically telling everyone to just keep waiting.

xpinstall.signatures.required = false didn't fix it.

I'll be very happy to update when there's a version that has a good tab manager. I'm on the latest version at home and it regularly loses whole windows full of tabs, even though it is set to restore my session on startup. And there's no way to manually save sessions. It's hopeless.

I wanted to point out this wasn't remotely broken, however. Even if you had no internet connection, your addons would have stopped working when the certificate expired.

(Disclosure: I work for Mozilla)

I just wanted to chime in way down deep in this comment chain because my thought only makes sense in the context of your comment right here.

I think there may be a special mode of operation of Firefox that may need to be considered here.

You said, "Even if you had no internet connection, your addons would have stopped working when the certificate expired."

This seems like an unfortunate design flaw to me. Consider a Firefox, kitted out with specific set of add-ons setup to the user's liking. Then, the network that Firefox is located on becomes permanently cutoff from the internet and can no longer make contact with the Mozilla mother ship. Maybe it's running in a VM, or maybe it's running in a country with an oppressive regime. I can think of many scenarios where a Firefox would be cutoff.

I think it is a reasonable expectation that the marooned Firefox should continue to run indefinitely without failure. Perhaps the user could be occasionally (monthly, yearly) flagged with warnings that the mother ship could not be contacted, but other than that, nothing should fail.

Please consider this and share it with your teams when the post mortem is discussed.

Thanks! I'm a loyal user since before Firefox.

I personally agree this is a worthwhile goal. The blog post talks about "tracking the status of everything in Firefox that is a potential time bomb and making sure that we don’t find ourselves in a situation where one goes off unexpectedly." I expect once that is done we'll be positioned to evaluate if and how we could support this.

(Disclosure: I work for Mozilla)

I've fixed it now anyway, in the way I specifically read that I wasn't meant to do.

Maybe you guys could inform us unsupported old version users what we should do instead of waiting for an update that can't come?

It's ok, thanks for your post. I know stuff is complicated and shit happens.

I'm much more disappointed that the latest Firefox doesn't have a working session manager than I am about this mixup. IMO that should be a core browser function.

(Disclosure: I work for Mozilla)

Would you mind please telling whoever you need to that we need automatic session saving/restoring to work properly, and then lots of people like me will happily update.

I think part of the reason this fiasco stirs up so much emotions is because normal people, including tech professionals, still expect the browser to behave like a product, not a service. And products aren't supposed to randomly break like that, they aren't supposed to ship with a time bomb attached.

Not this? I didn't think things would break with updates disabled.

Like I said, now I've been educated on a new mechanism for things to break.

Give me back my Tab Mix Plus!