Folks, I’m seeing a lot of people recommend setting xpinstall.signatures.required to false to fix the Firefox extensions issue.
⚠️ DO NOT DO THIS! ⚠️
It disables signature checking on extensions which means that you open yourself up to malicious extensions if you install any new ones or if you have auto updates on.
Either follow the instructions here https://nixnet.xyz/ by @firstname.lastname@example.org
Or go the officially recommended (but less private) route: https://mastodon.ar.al/@aral/102039553570119536
@narF @email@example.com @firstname.lastname@example.org Ah, cool. Thanks for the heads up.
Or if the maintainers are too slow: https://bugzilla.mozilla.org/show_bug.cgi?id=1548973#c60
@narF I run 66.0.3, which was released in april. The download site does not feature any newer version than that. Are you sure this way works?
@amenthes To be honest, I didn't do anything. Two days ago, all my extensions disappeared. Then yesterday they all came back. I did nothing, not even relaunching Firefox. I assumed it was an automatic update.
@narF The update now turned up. 66.0.4 is fine. Maybe different language versions take a little longer to be rolled out.
@blacklight447 @email@example.com *smh* :)
Early in the day they create a quick fix: https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/
@rosjackson @firstname.lastname@example.org ABP actually makes their money from allowing trackers by companies like Google that give them millions of dollars to not be blocked. I’d highly recommend that you get uBlock Origin if you’re using Firefox.
@aral I take it this doesn't work for ESR yet?
@aral @amolith @carcinopithecus@xOr.be #incidentMozilla #vieprivee #firefox firefox-esr: Debian disabled 'studies' probably for security/privacy reasons. Enable it if you wish using about:config. Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928415 Excellent comment there by Bill Allombert: ***"The fact that this bug allows Mozilla to disable remotely security extensions like noscript is a major security issue."*** xpinstall.signatures.required = false (and disable addon auto-updates) looks safer than allowing studies.
@aral There's reasons any some poeple recommend it.
Downloading something to install on your system from a mass surveillance company's server IS NOT acceptable. Letting Mozilla collect a shitload of data, AND store it on Google servers, ijust to update an expired intermediate certificate is NOT acceptable either.
Not to mention the fact Debian's build has been compiled without "Studies" support, meaning the latter "solution" won't work on Debian.
@aral And surfing naked on 2019's polluted shitty "web" ID not acceptable either.
On the other hand, even though it's a dirty workaroud, disabling signature check temporarily MIGHT be accepted *only if you know* what your doing:
- You have disabled auto updates for addons
- You make sure you don't install any update or new extension.
- And of course, you don't forget to to enable it again once you have a fix available/installed.
The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!