Folks, I’m seeing a lot of people recommend setting xpinstall.signatures.required to false to fix the Firefox extensions issue.
⚠️ DO NOT DO THIS! ⚠️
It disables signature checking on extensions which means that you open yourself up to malicious extensions if you install any new ones or if you have auto updates on.
Or go the officially recommended (but less private) route: https://mastodon.ar.al/@aral/102039553570119536
@aral At the very bottom, I actually list that as a fix 😅 I do make sure to tell users to set it to true again after a day or two.
@amolith I think that will do more harm than good. Even tech savvy folks could forget.
@aral That's a good point
@aral I removed it 👍
@amolith Merci :)
Or if the maintainers are too slow: https://bugzilla.mozilla.org/show_bug.cgi?id=1548973#c60
@narF I run 66.0.3, which was released in april. The download site does not feature any newer version than that. Are you sure this way works?
@amenthes To be honest, I didn't do anything. Two days ago, all my extensions disappeared. Then yesterday they all came back. I did nothing, not even relaunching Firefox. I assumed it was an automatic update.
@narF The update now turned up. 66.0.4 is fine. Maybe different language versions take a little longer to be rolled out.
Early in the day they create a quick fix: https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/
If you're blocking for security, try uMatrix. For that, it's even better than uBO imo
@aral I take it this doesn't work for ESR yet?
@aral @amolith @carcinopithecus@xOr.be #incidentMozilla #vieprivee #firefox firefox-esr: Debian disabled 'studies' probably for security/privacy reasons. Enable it if you wish using about:config. Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928415 Excellent comment there by Bill Allombert: ***"The fact that this bug allows Mozilla to disable remotely security extensions like noscript is a major security issue."*** xpinstall.signatures.required = false (and disable addon auto-updates) looks safer than allowing studies.
@aral There's reasons any some poeple recommend it.
Downloading something to install on your system from a mass surveillance company's server IS NOT acceptable. Letting Mozilla collect a shitload of data, AND store it on Google servers, ijust to update an expired intermediate certificate is NOT acceptable either.
Not to mention the fact Debian's build has been compiled without "Studies" support, meaning the latter "solution" won't work on Debian.
@aral And surfing naked on 2019's polluted shitty "web" ID not acceptable either.
On the other hand, even though it's a dirty workaroud, disabling signature check temporarily MIGHT be accepted *only if you know* what your doing:
- You have disabled auto updates for addons
- You make sure you don't install any update or new extension.
- And of course, you don't forget to to enable it again once you have a fix available/installed.
This is my personal Mastodon.