Conversation

Bryan Steele

@canadianbryan

May 4, 2019

🙃

Quote Tweet

Mozilla Add-ons

@mozamo

May 4, 2019

We’re investigating an issue with a certificate which may cause your @firefox extensions to stop work working or fail to install. Our team is actively working to fix the issue and we’ll post more information shortly.

Show this thread

Bryan Steele

@canadianbryan

May 4, 2019

Crazy, it's looking more like users will need both a Firefox update and re-install all extensions/addons. Yikes.

Replying to

Quote Tweet

They're now claiming they have a fix that won't trash your addons. twitter.com/firefox/status

Show this thread

Replying to

I'm curious if that's a new point release, or some kind of out-of- band update. I some something concerning on their discourse forum suggesting that users need to re-enable the "Studies" system. I don't run Firefox anymore, but honestly the way they're handling this.. 🤦‍♀️

Replying to

and

They used the studies system to deploy a fix for this. It seems like they can deploy fairly arbitrary changes and code via the studies system. It's essentially an out-of-band update mechanism. I assume it's not part of Firefox on Android since it's against Play Store policy.

Replying to

and

Google doesn't actually bother enforcing those policies in practice, but they do forbid out-of-band updates / extensions to the code other than code running in an isolated virtual machine. So, for example, browser extensions are allowed, but only if they're properly sandboxed.

Replying to

and

Something that can bypass signing requirements (even if those requirements were wrong, as in this case) doesn't sound "properly sandboxed".

Replying to

and

Yeah, I don't think they implement the feature for Android, and I think this is probably the reason for it. uBlock Origin is still working in a Firefox install that I have primarily for testing web compatibility on mobile, but their signature check is apparently once per 24h.

3:03 PM · May 4, 2019Twitter Web Client

Replying to

and

So it might just not have broken yet because it hasn't been open until just now, and the signature check hasn't happened yet. Actually, as I was writing this tweet, the signature check happened and it disabled uBlock Origin. I don't think they can push out a hot fix for Android.