On Sat, 4 May 2019 22:53:14 +0100 Dave Howorth wrote:

On Sat, 4 May 2019 22:27:18 +0200 "Carlos E. R." wrote:

...

On 04/05/2019 21.58, Dave Howorth wrote:

...

Help!

...

...

Does anybody know what has occurred or can suggest the best means to investigate further?

Firefox disabled all add-ons because a certificate expired https://www.engadget.com/2019/05/03/firefox-extension-add-on-cert/

The event occurred as the clock rolled over on UTC (Coordinated Universal Time, aka GMT or Greenwich Mean Time), and impacted users quickly narrowed it down to "expiration of intermediate signing cert" -- as it's described on Mozilla's bug tracker.

https://bugzilla.mozilla.org/show_bug.cgi?id=1548973

Thanks Carlos, and Brendan. I've now seen the Last Webkit Update thread.

I'm relieved that it's not some malware. But I'm puzzled about why it occurred on my machine so long after the problem is supposed to have arisen. Also about why it occurred since as I said, I run updates manually. Does FF have some secret private update mechanism?

Hmm, according to https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firef... "Clarified that the Studies fix applies only to Desktop users of Firefox distributed by Mozilla. Firefox ESR, Firefox for Android, and some versions of Firefox included with Linux distributions will require separate updates. (May 4, 12:03 EST)" So it sounds like we might need an update via openSUSE updates? (note that the option to allow Studies is not even enabled on my system, since I've configured it to not send data to mozilla) Also note that as I mentioned, I'm not applying most openSUSE updates at present (don't ask) so I would prefer that openSUSE send me a specific notice that the fix to this breaking bug is available if possible (and send my regards to the stupid people at mozilla for the hassle!) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 05/04/2019 06:00 PM, Fraser_Bell wrote:

...

Workaround: open a tab with about:config and set the parameter xpinstall.signatures.required to false

restart the browser, and reverse the setting once the fix is in place...

Cheers Axel

I have only just found that, so have not yet tried it.

It works fine. I found that in the original thread blaming webkit. (you can always just double-click the setting to undo it :) -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 05/04/2019 07:28 PM, Carlos E. R. wrote:

Because it is not an update. It is a certificate in the chain of trust for addons that expired, a fact you can avoid by turning your clock back for days. Otherwise, at the exact minute the certificate expired, all the addons were automatically disabled. At least on restart of firefox, maybe even if you don't.

My firefox is running fine, and I have a new addon I did not add myself:

hotfix-update-xpi-intermediate 1.0.2

This is a hotfix that updates an intermediate certificate used for signing add-ons. It is one of the mechanisms used to fix bug 1548973.

Apparently that is why an UPDATE will be needed for Firefox ESR. I don't believe ESR will receive the certificate fix automatically. That is why Mozilla included the language dnh quoted. -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 05/05/2019 08:23, Basil Chupin wrote:

My FF, version 60.6.1esr, is functioning just fine now (since about 4 hours ago or so) -- all Addons functioning as before. This on Leap 15.0.

Not fixed yet with my 60.6.1esr on Leap 42.3. I tried restarting FF but all my add-ons still appear under 'Unsupported'. As a side-note, this experience is giving me a horrifying insight into the 'real web' that I'm thankfully missing these last few years. My uBlock Origin does such a good job of blocking the hideous cacophony of garbage ads, I'm still surprised at just how ghastly websites are by default. It's not only visually disturbing, all these ads quickly cause the fan on my ageing Core Duo laptop to whisk up into full throttle. It may well only be uBlock Origin that's enabling me to keep a 2007-era machine fully functioning and usable. gumb -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 05/05/2019 01:23 AM, Basil Chupin wrote:

On 5/5/19 3:18 pm, David C. Rankin wrote:

...

On 05/04/2019 07:28 PM, Carlos E. R. wrote:

...

Because it is not an update. It is a certificate in the chain of trust for addons that expired, a fact you can avoid by turning your clock back for days. Otherwise, at the exact minute the certificate expired, all the addons were automatically disabled. At least on restart of firefox, maybe even if you don't.

My firefox is running fine, and I have a new addon I did not add myself:

hotfix-update-xpi-intermediate 1.0.2

This is a hotfix that updates an intermediate certificate used for signing add-ons. It is one of the mechanisms used to fix bug 1548973.

Apparently that is why an UPDATE will be needed for Firefox ESR. I don't believe ESR will receive the certificate fix automatically. That is why Mozilla included the language dnh quoted.

My FF, version 60.6.1esr, is functioning just fine now (since about 4 hours ago or so) -- all Addons functioning as before. This on Leap 15.0.

You must be lucky BC, my is still borked. Only way to use is to set xpinstall.signatures.required false Here is what I see: http://paste.opensuse.org/64587694 If I set xpinstall.signatures.required true all of my addons are automatically disabled :( -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 05/05/2019 08:59 PM, Robert T Hardy wrote:

On Sunday, May 5, 2019 1:23:48 AM CDT Basil Chupin wrote:

...

My FF, version 60.6.1esr, is functioning just fine now (since about 4 hours ago or so) -- all Addons functioning as before. This on Leap 15.0.

Same version here, addons disabled and hotfix installed when I first checked after hearing about the problem. I waited several hours, then finally restarted Firefox and all was back to normal.

Youtube also started working for me again, after I killed FF and restarted it. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Sunday, May 5, 2019 10:43:36 PM CDT Patrick Shanahan wrote:

has been discussed frequently over the last several days.

For values of several including "one". Some people followed instructions to enable "studies" and found that sufficient. Some people probably had "studies" on and never noticed a problem. Leap 15.0 users had to enable "studies", and then depart from the instructions and restart Firefox at possibly some later time. That became clear to me less than 12 hours ago. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 05/06/2019 02:08 AM, Robert T Hardy wrote:

Leap 15.0 users had to enable "studies", and then depart from the instructions and restart Firefox at possibly some later time. That became clear to me less than 12 hours ago.

Same with 42.3 or the hotfix-update-xpi-intermediate would not install (or didn't appear to). I enabled studies, restarted and clicking on studies now shows the hotfix as a study. First time I ever heard of them. My policy is to lock down all bi-directional traffic except allowing submission of crash-reports. Seems we need to look further into studies. Glad this fiasco is over. KDE3 Konqueror is no substitute as a web-browser :p Great file-manager, but terrible browser.... -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Mon, May 06, 2019 at 05:23:38PM +0200, Oleksii Vilchanskyi wrote:

On 5/6/19 9:50 AM, David C. Rankin wrote:

...

On 05/06/2019 02:08 AM, Robert T Hardy wrote:

...

Leap 15.0 users had to enable "studies", and then depart from the instructions and restart Firefox at possibly some later time. That became clear to me less than 12 hours ago.

Same with 42.3 or the hotfix-update-xpi-intermediate would not install (or didn't appear to). I enabled studies, restarted and clicking on studies now shows the hotfix as a study. First time I ever heard of them. My policy is to lock down all bi-directional traffic except allowing submission of crash-reports. Seems we need to look further into studies. Glad this fiasco is over. KDE3 Konqueror is no substitute as a web-browser :p Great file-manager, but terrible browser....

There was a big discussion about the "studies" and "normandy" few days ago [0]. Seems like they are enabled by default for many people, which suggests Mozilla has learned nothing since the Mr. Robot incident. [1] [2] Well, I guess it's time to move on.

[0]: https://news.ycombinator.com/item?id=19823701 [1]: https://news.ycombinator.com/item?id=15931730 [2]: https://news.ycombinator.com/item?id=15940144

FWIW, openSUSE Leap 42.3 and 15.0 fixed Firefox packages were released. Ciao, Marcus -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 05/05/2019 13:54, Carlos E. R. wrote:

On 05/05/2019 07.18, David C. Rankin wrote:

...

On 05/04/2019 07:28 PM, Carlos E. R. wrote:

...

Because it is not an update. It is a certificate in the chain of trust for addons that expired, a fact you can avoid by turning your clock back for days. Otherwise, at the exact minute the certificate expired, all the addons were automatically disabled. At least on restart of firefox, maybe even if you don't.

My firefox is running fine, and I have a new addon I did not add myself:

hotfix-update-xpi-intermediate 1.0.2

This is a hotfix that updates an intermediate certificate used for signing add-ons. It is one of the mechanisms used to fix bug 1548973.

Apparently that is why an UPDATE will be needed for Firefox ESR. I don't believe ESR will receive the certificate fix automatically. That is why Mozilla included the language dnh quoted.

I don't know where the certificate is physically.

In my case, I have "studies enabled". I had forgotten about it. In preferences, "firefox data collection and use", I had enabled "Allow Firefox to install and run studies". It is this which allowed them to install on my FF, without me restarting FF or doing anything, this:

hotfix-update-xpi-intermediate 1.0.2

This is a hotfix that updates an intermediate certificate used for signing add-ons. It is one of the mechanisms used to fix bug 1548973.

which solves the issue for now.

Just to advise others who may be waiting and wondering what's happening, on my FF 60.6.1esr installation on Leap 42.3, upon seeing the message about the problem under my Add-Ons and then following the link to the temporary fix, having re-enabled the browser to run Studies (and in turn the parent option 'Allow Firefox to send technical and interaction data to Mozilla', necessary in order to enable the former) nothing actually happened until I restarted the browser. I then found the hotfix in my add-ons, but the add-ons were still listed as unsupported and disabled. The information in the hotfix suggested having to wait up to 6 hours, so I gave it at least half of that time, but nothing appeared to happen automatically, so I restarted a second time, and straight away, the add-ons were back and things back to normal. So you may need to do two restarts. gumb -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org