Hacker News Reader

Comment by baalimago | Hacker News Reader

About time. Embarrassing bug. The only reason i didn't permanently swap browser is because of the lack of alternatives since none has the functionality I apply through the addons.

View on HN

I switched to the Dev build[1] with 'xpinstall.signatures.required = false', and now that it's fixed I don't know if I'll go back. There seems to be a bunch of new features in Dev that I assume will arrive in Firefox eventually, but everything else being equal, I think I'll stick with it.

I'll probably turn 'xpinstall.signatures.required' back to true though.

[1] https://www.mozilla.org/en-US/firefox/developer/

Mine says Developer edition beta 16 Version 67.0b16 (64-bit) Last updated = 03May2019.

do I need to make this change? is it in the about:config ? 'xpinstall.signatures.required = false

Yeah, so if you set 'xpinstall.signatures.required = false' in the about:config it'll let you use your extensions, but this is just a workaround.

When a fix is fully rolled out (which should include Developer edition), then you won't need that (and probably should re-enable signature checking).

thanks . I have toggled that in about:config and extensions are back to working. internally, what does this toggle turn off?

It is actually much much faster than Firefox "standard". Might stick with it too!

This is what I run and that fix worked. Are they planning on patching the dev build anytime soon? Doesn't look like there is an update for it. At least one can turn that stupid feature off until there is.

I haven't Switched yet but I fired up my Vivaldi install and have been impressed. A lot of little annoyances that I got used to with the new extension restrictions aren't there because the functionality is built in (like mouse gestures and tabs on left).

I first started using Firefox as my default when I unzipped a version of Phoenix off a CD which came with a computer magazine.

I installed Vivaldi, and moved shortly back to Firefox. The two things that did it:

1. I accidentally saved the wrong password to a site. When I went to fix it, it said I needed to login to my Google account to change my stored password.

Wait, wat?! You are sending my passwords to Google, unencrypted, without telling me?! Thai is not acceptable, aside from - What else are you sending?

1b. I see that it saves non password fields without my asking me to save them, and sending that to Google as well. Hmmmmm.

2. It has twice crashed and lost all my open tabs (yes, I have a tendency to keep many open tabs).

Also, for all I know, they are selling my bank account login. Research into the history of Vivaldi (semi fork of Opera) and its dev team left me unsatisfied who they are and that I can trust them.

It probably sends less data to Google than Chrome (which gets every single page, its contents, how long it was open, etc. but is hardly a contender if you want a browser and not just spyware.

Vivaldi doesn't save passwords using Google. Did you perhaps click on a help link that sent you to a Google support page for Chrome?

I see that if you click the password icon the address bar and click the "Manage passwords" button it opens the default password settings page inherited from Chromium (vivaldi://settings/passwords) which includes a link to a support page for Google Chrome (https://support.google.com/chrome/?p=settings_password), but not all the information on that page is applicable to Vivaldi. In particular, Vivaldi doesn't use Google but rather its own account system for browser sync (which is optional, same as Firefox and Chrome).

That appears to be a bug, since that legacy Chromium password settings page isn't Vivaldi's normal password settings page (vivaldi://settings/privacy/). But it doesn't seem malicious.

Incidentally, the built-in password manager in Vivaldi (as well as in Chrome and other browsers based on Chromium) doesn't let you manually edit an existing password, whether or not you use an account to sync them. You can only update an entry by signing into a site with a new password and confirming the password change if the browser detects it, or deleting the old entry and saving a new one. A limitation compared to Firefox's password manager, though I do appreciate the native ability to generate random passwords in Chromium-based browsers. I hope Firefox and Chrome copy each other in those regards.

I haven't experienced any crashes with Vivaldi, though I don't use it as much as other browsers such as Firefox so perhaps I've just been luckier.

Vivaldi's background seems clear enough: https://en.wikipedia.org/wiki/Vivaldi_(web_browser)

It was founded by Norwegian developers who left the original Opera (either due to switch from the old Opera browser to the new interface, or because the company was sold to Chinese investors). I do wish they were more open with the source code, but anyone who was comfortable with using the original Opera back in the day should be okay with Vivaldi. More so than the current Opera, I think, which I still see many people using due to brand recognition I assume.

Personally, I've switched to waterfox -which is a fork of an older firefox branch, and it supports addons (at least the ones I use).

I'm pretty happy with it, and I'm strongly considering staying with it even after firefox is fixed.

You'll be several revisions' worth of security patches behind. For an application that is usually one's main means of accessing the rest of the internet, that would be a deal-breaker for me.

But even more security bugs behind.

[citation needed]

Possibly, but I'll take the actively-developed codebase with the eyes of security experts all over it over one with no manpower.

In this case, I was more insecure being subjected to advertising networks (and the malware carried on them) because of Firefox's mistake which meant I wasn't able to load ublock origin. I'm also not sure how many of those "security patches" are intended to make my browsing experience safer, or simply meant to implement bizarre policies that might blow up in my face at any time (as this certificate issue has).

It's a trade off.

I assume (and hope) Firefox will eventually get their act together so I can go back to using it, but if not at least I don't have to jump ship to chrome.

It's a bad trade off. Every security related bug Firefox fixes is a how to guide for ruining waterfox users day for anywhere from weeks to years.

This will grow increasingly challenging if the code bases diverge in order to keep old school add-ons working given that waterfox has virtually no man power.

One solution would be to have a dedicated computer which is considered compromised from the start. Don't store importent stuff there, don't do money related activities etc. This way you have a convenient browser for 99% of the time - without stupid restrictions and Mozilla control.

In case of infection, restore from image.

edit: replaced spyware with control.

This is a highly impractical way to live life just to make some stand. It's cutting one's nose to spite one's face.

There are other actively maintained browsers with plenty of eyes on them and manpower behind them, many with vibrant plugin ecosystems, just use one of those.

This "bizarre policy" was software signing, which is in fact a security feature.

I don't understand what "getting their act together" means here, when you're posting it on an announcement that the problem has already been fixed. Should Firefox proactively remove all security features that risk ever posing some modicum of inconvenience to users? Because that would be... all of them.

Firefox could allow people to sign their own add-ons. Let's not pretend that the terms "software signing" and "walled garden" are synonymous.

Okay. Now malware addons are signed, and nothing has been accomplished.

In this scenario, malware add-ons would be signed only for that particular Firefox installation.

Essentially, I am arguing that Firefox should let you create your own signing key pair (which would be valid only on that single Firefox installation) and sign any add-on using it.

It's a large enough hoop that most users would not jump over it, not least because they would not know what they're doing, but it would be there for those who need it and relinquish the central point of failure that is the AMO.

The current situation is basically the Secure Boot fiasco all over again.

>I was more insecure being subjected to advertising networks

>2019

>not running your own ad network blocking DNS

Why even bother?

I've been using Waterfox on Windows for awhile along with the new Firefox, but now I am going to replace the Firefox install with Brave. Best of both worlds.

I switched to Chrome before this after Firefox started randomly requiring me to close it out and re-open when switching wifi hotspots too often, and connecting/disconnecting from VPN too often and this was on multiple laptops and fairly recently.

Reply on news.ycombinator.com