Extensions screwup affecting older versions of Firefox

[Peter Boulding]

I'm using Firefox 50.1.0 on Win7 pro.

When Mozilla perpetrated the extensions/certificates screwup, it didn't just
hit users of up-to-date Firefox; users of some older versions were affected
as well: in my case the following extensions were disabled:

Adblock Plus 3.03
Classic Theme Restorer 1.7.7
Ghostery 8.0.7.1
Google Search Link Fix 1.6.7

None of the workarounds suggested in this newsgroup worked (the "Allow
Firefox to install and run studies" field doesn't even exist in Firefox 50).

I eventually got Firefox to look and behave as I expect and require by
running a Windows system restore, but unfortunately the extensions page
still shows the above extensions as disabled (they're not), and their
'Options' and 'Disable'/'Enable' buttons have been removed, leaving only
'Remove'.


Questions:

* Can anyone suggest a fix for those who, like me, have chosen to stick with
an earlier version of Firefox?

* Does anyone know whether Mozilla are even going to try to roll out fixes
for the earlier versions they have screwed up?


Note: please do NOT try my patience and waste my time by recommending that I
"upgrade" to the current "more secure" version.

(I'm not sure I want to hear from those justifiably smug users who had the
sense to stop "upgrading" before Mozilla took away the user's right to be
final arbiter when Firefox decided a certificate might be dodgy.)

--
Thanks and regards,
Peter Boulding
[Reminder to self: next month's Firefox market share figures might be, um,
interesting.]

[Chris Ilias]

Mozilla is working on a fix for releases before Firefox 60. I don't know
what form that would be. It may not be a software update, but something
else that replaces the certificate.

Obviously, officially supported versions are the only ones Mozilla is
obligated to work on.

By the way, you should update Firefox. :)

--
<https://ilias.ca/links>
Mailing list/Newsgroup moderator

[Chris Ilias]

On 2019-05-07 10:03 a.m., Chris Ilias wrote:
> On 2019-05-07 7:04 a.m., Peter Boulding wrote:
>>
>> I'm using Firefox 50.1.0 on Win7 pro.
>

> Mozilla is working on a fix for releases before Firefox 60. I don't know
> what form that would be. It may not be a software update, but something
> else that replaces the certificate.
>
> Obviously, officially supported versions are the only ones Mozilla is
> obligated to work on.
>
> By the way, you should update Firefox. :)

There is a fix available for earlier versions in the form of an add-on
that you will need to install.

1. Go to
<https://addons.mozilla.org/en-US/firefox/addon/disabled-add-on-fix-52-56/>
2. Click on [Add to Firefox]

[J. P. Gilliver (John)]

In message
<mailman.58.1557916605...@lists.mozilla.org>, Chris
Ilias <nm...@ilias.ca> writes:
[]

>There is a fix available for earlier versions in the form of an add-on
>that you will need to install.
>
>1. Go to
><https://addons.mozilla.org/en-US/firefox/addon/disabled-add-on-fix-52-5
>6/>
>2. Click on [Add to Firefox]
>

Can this be downloaded as a file, for later execution-installation?

Reason for asking: I understand it is reasonable for Mozilla not to
patch versions further back than a certain one, and indeed I think it is
commendable that this does include the famous version 52 (at least I
assume "52-56" in the URL suggests it does) which allows old-style
add-ons. I am currently using a much earlier version (which seems not to
have suffered from this problem anyway), but may some time want to
upgrade to (say) 52 - but, of course, there'd be no point doing so if it
won't work without the patch.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

"Bother," said Pooh, as Eeyore sneezed the crack all over Owl.

[Sailfish]

My bloviated meandering follows what J. P. Gilliver (John) graced us
with on 5/15/2019 5:29 AM:

> In message
> <mailman.58.1557916605...@lists.mozilla.org>, Chris
> Ilias <nm...@ilias.ca> writes:
> []
>> There is a fix available for earlier versions in the form of an add-on
>> that you will need to install.
>>
>> 1. Go to
>> https://addons.mozilla.org/en-US/firefox/addon/disabled-add-on-fix-52-56/
>> 2. Click on [Add to Firefox]
>>
> Can this be downloaded as a file, for later execution-installation?
>
> Reason for asking: I understand it is reasonable for Mozilla not to
> patch versions further back than a certain one, and indeed I think it is
> commendable that this does include the famous version 52 (at least I
> assume "52-56" in the URL suggests it does) which allows old-style
> add-ons. I am currently using a much earlier version (which seems not to
> have suffered from this problem anyway), but may some time want to
> upgrade to (say) 52 - but, of course, there'd be no point doing so if it
> won't work without the patch.

The actual web page title reads, "Disabled Add-on Fix for Firefox 47 -
56" so it may fix even older versions of Fx.

If you right-click the "Add to Firefox" button, the context menu should
allow you to download the actual XPI file which can be loaded at some
later date.

Good luck

--
Sailfish
Rare Mozilla Stuff: http://tinyurl.com/z86x3sg

[Big Al]

On 5/15/19 8:29 AM, J. P. Gilliver (John) wrote:
> Can this be downloaded as a file, for later execution-installation?

I can't find that add-on, get a error on that link but there is this
https://addons.mozilla.org/en-US/firefox/addon/disabled-add-on-fix-52-56/

It really says 47-56 not 52-56.

If you right click the add button and save link as, you can save the XPI
for reload any time from add-ons page via the gear icon and 'load from
file'.

Al

[Sailfish]

My bloviated meandering follows what Sailfish graced us with on
5/15/2019 7:20 AM:

I tested it on my Fx52.9ESR release as follows:

1. Brought up about:config and restored 'xpinstall.signatures.required'
to default 'true' value (this was a workaround).
2. Restarted Fx and confirmed that it again blocked my add-on.
3. Brought up the Add-ons page and Drag&Drop'd the previously downloaded
XPI file onto it to install it.
4. Restarted Fx and confirmed that it unblocked my add-on.

[PietB]

Sailfish wrote:
>> Chris Ilias wrote:
>>> https://addons.mozilla.org/en-US/firefox/addon/disabled-add-on-fix-52-56/

>
> The actual web page title reads, "Disabled Add-on Fix for Firefox 47 -
> 56" so it may fix even older versions of Fx.

Once installed, the add-on's description says "Works back to 47".

-p

[J. P. Gilliver (John)]

In message
<mailman.65.1557930858...@lists.mozilla.org>, Sailfish

<NIXCAPS...@NIXCAPSunforgettable.com> writes:
>My bloviated meandering follows what Sailfish graced us with on
>5/15/2019 7:20 AM:
>> My bloviated meandering follows what J. P. Gilliver (John) graced us
>>with on 5/15/2019 5:29 AM:
>>> In message
>>><mailman.58.1557916605...@lists.mozilla.org>, Chris
>>>Ilias <nm...@ilias.ca> writes:
>>> []
>>>> There is a fix available for earlier versions in the form of an
>>>>add-on that you will need to install.
>>>>
>>>> 1. Go to
>>>>https://addons.mozilla.org/en-US/firefox/addon/disabled-add-on-fix-52
>>>>

>>>> 2. Click on [Add to Firefox]
>>>>
>>> Can this be downloaded as a file, for later execution-installation?

[]

>> The actual web page title reads, "Disabled Add-on Fix for Firefox 47
>>- 56" so it may fix even older versions of Fx.
>> If you right-click the "Add to Firefox" button, the context menu
>>should allow you to download the actual XPI file which can be loaded
>>at some later date.
>> Good luck

Thanks, Big Al and Sailfish for that ...

>>
>I tested it on my Fx52.9ESR release as follows:
>
>1. Brought up about:config and restored 'xpinstall.signatures.required'
>to default 'true' value (this was a workaround).
>2. Restarted Fx and confirmed that it again blocked my add-on.
>3. Brought up the Add-ons page and Drag&Drop'd the previously
>downloaded XPI file onto it to install it.
>4. Restarted Fx and confirmed that it unblocked my add-on.
>

.... and Sailfish for trying it out! That's beyond the call of duty!

Unfortunately, when I went there, the page told me the patch wasn't
compatible with my old Firefox. And when I hover over the Add to Firefox
button, I get a no-entry sign. Nevertheless, I tried right-clicking -
and was able to download something. It is called
disabled_add_on_fix_for_firefox_52_56-1.1.4.xpi, and is 11,436 bytes -
is that what the one you downloaded was/is called?

--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

We're done for the night. I'm off for a cup of tea and some crystal meth.
Only joking. I've had quite enough tea for one day.
- Victoria Coren Mitchell, quoted in RT 2017/10/7013

[Peter Boulding]

On Wed, 15 May 2019 06:36:40 -0400, Chris Ilias <nm...@ilias.ca> wrote in
<mailman.58.1557916605...@lists.mozilla.org>:

>There is a fix available for earlier versions in the form of an add-on
>that you will need to install.
>
>1. Go to
><https://addons.mozilla.org/en-US/firefox/addon/disabled-add-on-fix-52-56/>
>2. Click on [Add to Firefox]

Well, that seems to have worked OK for me. <Big sigh of relief> Many thanks
for the heads-up, Chris.

--
Regards, Peter Boulding
pjbn...@UNSPAMpboulding.co.uk (to e-mail, remove "UNSPAM")
Fractal Music: http://www.soundclick.com/bands/default.cfm?bandID=794240&content=music

[Sailfish]

My bloviated meandering follows what J. P. Gilliver (John) graced us

with on 5/15/2019 11:48 AM:

Yes.

[PietB]

Chris Ilias wrote:

> Chris Ilias wrote:
>> By the way, you should update Firefox. :)
>
> There is a fix available for earlier versions in the form of an add-on
> that you will need to install.

> <https://addons.mozilla.org/en-US/firefox/addon/disabled-add-on-fix-52-56/>

After installing the add-on and setting xpinstall.signatures.required to
true again, things were indeed back to normal. Then I wondered if it was
really a permanent fix or a fix applied on every startup of FF. I first
disabled the add-on; FF still behaved. Then I deleted the add-on, and FF
still behaved.

Did someone say "you should update Firefox"? :-)

-p

[J. P. Gilliver (John)]

In message
<mailman.76.1557988948...@lists.mozilla.org>, Sailfish

<NIXCAPS...@NIXCAPSunforgettable.com> writes:
>My bloviated meandering follows what J. P. Gilliver (John) graced us
>with on 5/15/2019 11:48 AM:

[]

>>> My bloviated meandering follows what Sailfish graced us with on
>>>5/15/2019 7:20 AM:

[]

>>>>> In message
>>>>><mailman.58.1557916605...@lists.mozilla.org>,
>>>>>Chris Ilias <nm...@ilias.ca> writes:
>>>>> []
>>>>>> There is a fix available for earlier versions in the form of an
>>>>>>add-on that you will need to install.
>>>>>>
>>>>>> 1. Go to
>>>>>>https://addons.mozilla.org/en-US/firefox/addon/disabled-add-on-fix-52

[]

>>>> If you right-click the "Add to Firefox" button, the context menu
>>>>should allow you to download the actual XPI file which can be

[]

>> Unfortunately, when I went there, the page told me the patch wasn't
>>compatible with my old Firefox. And when I hover over the Add to
>>Firefox button, I get a no-entry sign. Nevertheless, I tried
>>right-clicking - and was able to download something. It is called
>>disabled_add_on_fix_for_firefox_52_56-1.1.4.xpi, and is 11,436 bytes -
>>is that what the one you downloaded was/is called?
>
>Yes.
>

Thanks. I've already stored away the full 52 (ESR IIRR) install, and now
have this patch too, so can "up"grade to 52 sometime if I so wish.

--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

And every day in Britain, 33 properties are sold for around that price [a
million pounds or so]. - Jane Rackham, RT 2015/4/11-17

[J. P. Gilliver (John)]

In message
<mailman.87.1557998754...@lists.mozilla.org>, PietB

Has anyone investigated whether the add-on does more than just changing
the setting others have mentioned - and if so, what?

>
>Did someone say "you should update Firefox"? :-)
>
>-p
>

(-:

[Sailfish]

My bloviated meandering follows what PietB graced us with on 5/16/2019
2:25 AM:

That piqued my interest so I did a little sleuthing by cracking open the
XPI file to see what I could find.

The actual guts of the fix is contained in a META-INF directory and
appears to be encoded and most likely encrypted so there's not much to
discern from that. However, the description text in the install.rdf file
seems to suggest that what it does is add/inject an intermediate cert
within the Fx installation cert files:

<em:description>Inject intermediate certificate to fix bug 1548973.
Works back to 47.</em:description>

This would explain why removing the add-on afterward doesn't un-fix
solution, i.e., it becomes part of the installation. My guess (untested)
is that if one uninstalls the affected Fx and then re-installs it from
the Fx Releases site, the add-on breakage would re-occur.

2 pence worth

[WaltS48]

I will.

<https://www.mozilla.org/en-US/security/known-vulnerabilities/>

--
OS: Ubuntu Linux 18.04LTS - Gnome Desktop
https://www.thunderbird.net/en-US/get-involved/

[Chris Ilias]

On 2019-05-16 7:31 a.m., J. P. Gilliver (John) wrote:
> In message
> <mailman.87.1557998754...@lists.mozilla.org>, PietB
> <www.godfatherof.nl/@opt-in.invalid> writes:
>> Chris Ilias wrote:
>>> Chris Ilias wrote:
>>>> By the way, you should update Firefox. :)
>>>
>>> There is a fix available for earlier versions in the form of an add-on
>>> that you will need to install.
>>> <https://addons.mozilla.org/en-US/firefox/addon/disabled-add-on-fix-52-56/>
>>>
>>
>> After installing the add-on and setting xpinstall.signatures.required to
>> true again, things were indeed back to normal. Then I wondered if it was
>> really a permanent fix or a fix applied on every startup of FF. I first
>> disabled the add-on; FF still behaved. Then I deleted the add-on, and FF
>> still behaved.
>
> Has anyone investigated whether the add-on does more than just changing
> the setting others have mentioned - and if so, what?

The add-on does not change the xpinstall.signatures.required or any
other preference. Mozilla has never recommended that. As I've said
before, it's not reliable, and it's unsafe.

The add-on injects the certificate.