Earlier today, I was merrily browsing the net using Firefox, when all of a sudden, the browser
restarted, and when it launched again, I saw a yellow warning message that my add-ons have been
disabled because they could not be verified. Adblock Plus, Noscript and Greasemonkey had simply
vanished. W00t.
A quick search confirmed my suspicion: a wider problem with Firefox, globally. Apparently, a
certificate used to sign add-ons in order to verify their validity had expired, which made the browser
unable to check add-ons, resulting in the foobar that I and millions of other Firefox users had just
experienced. Well, let me show you what you can do to mitigate this issue. After me.
Problem
Without going too much into technical details, the problem is a really
unnecessary issue with the add-on
signing procedure. A certificate had expired. Or rather, the people in charge forgot to renew it. As an
example, think an HTTPS website. You would see a warning from a browser if the site’s certificate was
to expire, whether it’s legit or not. So browsers warn you not to go there, because the identity of the
site cannot be validated. With Firefox, the issue is bigger. Firefox will disable add-ons that cannot
be validated. Since people actually use add-ons, this means their actual usability and productivity
will be harmed.
A while back, Mozilla implemented the add-ons signing as a “security” feature, designed to protect
users from “malicious” add-ons. Ironically, this very mechanism turned out to be the biggest problem
rather than an arbitrary extension that someone would choose to install in some theoretical security
scenario.
Solution
There are two things you need to do here. First, if you have a backup of your Firefox profile, the
fix is so much faster and easier. I will discuss this shortly. Second, you need to make sure this does
not happen again, so you need to stop Firefox from checking the add-ons.
Mozilla are working on a
permanent
solution, but ironically, for a second time in a day, they chose Studies to deploy a fix rather
than fix the problem on their side. Personally, I’ve long disabled Studies, because I don’t feel like
being used for experiments, I don’t like the sideloading of features, and I do not consent to sharing
any tracking data (Firefox or otherwise).
So you need to open
about:config and then search for
xpinstall.signatures.required. Change this to false by double-clicking on
this line. Restart Firefox. When Mozilla issues a permanent fix, you can toggle this back to the
default setting.
Once you re-launch the browser, the next step is to restore your browser to its expected state. If
your add-ons have not been disabled, you will see the following state in the add-ons list:
“add-on name” could not be verified for use in Firefox. Proceed with
caution. This means the validation still does not work, but your fix allows you to continue
using the browser normally with all your add-ons.
Restore profile – backups
Now, if you were hit by this problem, you will need to make your browser work as before. Typically,
this means reinstalling or reactivating all the add-ons. This can be a hassle. Which is why I want to
emphasize the supreme importance of
backups. Not just data but
application settings, too. They are critical. If
there’s one thing that should be top notch in your environment, it’s backups (with verifiable
restores), because everything can be replaced except your unique information. When the problems occur
– and
they WILL occur – you can quickly resolve them, and go
back to having pain-free fun.
I keep a nightly backup of the important Firefox profiles on my productivity and semi-productivity
machines. So when this bug came to be, the solution was to open the backup location and copy the
profile over from the night before, losing virtually nothing in the process. It took me less than a
minute to restore my browser state.
Conclusion
Several people emailed me, asking me if this issue made me switch. No. Firefox is still the least
annoying browser of them all by a long margin. And to be fair, this is not the first instance of
software going potty globally. Remember when a major search engine warned every site was malicious
because someone made a typo in a list somewhere? Or when a major OS vendors pull an update because it
was messing up people’s data?
If anything, this issue reflects poor professionalism on behalf of those maintaining the browser
infrastructure and highlights the security zeal that has ruined the Internet. Nothing in the new
methods makes people safer, it just harms the productivity and fun. For that matter, Firefox did what
it was supposed to do, it blocked add-ons that did not adhere to the security settings. This should not
spur you to change your browser, because we all need a strong underdog to balance out the mediocrity
that’s gripping the Internet. Trust me on this one, may I be your prophet, if Firefox disappears for
good, you will wish the Internet was never invented. Anyway, you have the fix, and don’t forget the
backups. We’re done. Enjoy your webs.
