[y-satellite]

You realize, I hope, that 56.0.2 is riddled with security holes at this point? I get the attachment to old addons, but 129 CVEs (including multiple severe memory corruption bugs) affect that version now. It's not really reasonable to expect Mozilla to keep maintaining it.

[brokenmachine]

I don't expect them to maintain it, but I do expect them not to break it for no reason.

Also they could have mentioned in their post that their fix did not do anything for older versions, instead of specifically telling everyone to just keep waiting.

xpinstall.signatures.required = false didn't fix it.

I'll be very happy to update when there's a version that has a good tab manager. I'm on the latest version at home and it regularly loses whole windows full of tabs, even though it is set to restore my session on startup. And there's no way to manually save sessions. It's hopeless.

[y-satellite]

In this day and age you're living on borrowed time using an old version of a web browser. This state of affairs has its good and bad, but your modern-day browser vendors don't typically maintain branches of old versions to make security and bug fixes (especially when they change things for security reasons, as with this case of old-style addons being removed). If you're going to insist on using an old unsupported version you have to accept the risk of things eventually breaking and the inconvenience of workarounds like the one you described.

[brokenmachine]

Well I've just been educated on a new mechanism by which things can be remotely broken.

[sciurus]

Just to be clear: supported version or not, this sucks, and I hope we'll have a fix for you.

I wanted to point out this wasn't remotely broken, however. Even if you had no internet connection, your addons would have stopped working when the certificate expired.

(Disclosure: I work for Mozilla)

[EdSharkey]

Hey sciurus,

I just wanted to chime in way down deep in this comment chain because my thought only makes sense in the context of your comment right here.

I think there may be a special mode of operation of Firefox that may need to be considered here.

You said, "Even if you had no internet connection, your addons would have stopped working when the certificate expired."

This seems like an unfortunate design flaw to me. Consider a Firefox, kitted out with specific set of add-ons setup to the user's liking. Then, the network that Firefox is located on becomes permanently cutoff from the internet and can no longer make contact with the Mozilla mother ship. Maybe it's running in a VM, or maybe it's running in a country with an oppressive regime. I can think of many scenarios where a Firefox would be cutoff.

I think it is a reasonable expectation that the marooned Firefox should continue to run indefinitely without failure. Perhaps the user could be occasionally (monthly, yearly) flagged with warnings that the mother ship could not be contacted, but other than that, nothing should fail.

Please consider this and share it with your teams when the post mortem is discussed.

Thanks! I'm a loyal user since before Firefox.

[sciurus]

> I think it is a reasonable expectation that the marooned Firefox should continue to run indefinitely without failure.

I personally agree this is a worthwhile goal. The blog post talks about "tracking the status of everything in Firefox that is a potential time bomb and making sure that we don’t find ourselves in a situation where one goes off unexpectedly." I expect once that is done we'll be positioned to evaluate if and how we could support this.

(Disclosure: I work for Mozilla)

[brokenmachine]

Well that's reassuring! :-)

I've fixed it now anyway, in the way I specifically read that I wasn't meant to do.

Maybe you guys could inform us unsupported old version users what we should do instead of waiting for an update that can't come?

It's ok, thanks for your post. I know stuff is complicated and shit happens.

I'm much more disappointed that the latest Firefox doesn't have a working session manager than I am about this mixup. IMO that should be a core browser function.

[sciurus]

In case it still helps you or someone else: A fix for Firefox 52 through 56 is available now at https://addons.mozilla.org/en-US/firefox/addon/disabled-add-...

(Disclosure: I work for Mozilla)

[phist_mcgee]

What did you expect to happen? You're using an online service connected to signing authorities. Of course it can be remotely broken at any time, that's how the internet works, it's all remote.

[TeMPOraL]

He's using a product. A product. Having it attached to on-line service is not a feature.

I think part of the reason this fiasco stirs up so much emotions is because normal people, including tech professionals, still expect the browser to behave like a product, not a service. And products aren't supposed to randomly break like that, they aren't supposed to ship with a time bomb attached.

[brokenmachine]

> What did you expect to happen?

Not this? I didn't think things would break with updates disabled.

Like I said, now I've been educated on a new mechanism for things to break.