Everything is on fire, but at least it’s not my fault

Mozilla screwed up and failed to renew the code signing certificate used for addons, resulting in mass-disabling virtually all addons for everyone. Yay. Even lightweight themes are affected, somehow, and they’re just glorified PNGs. Exactly one of the addons I have installed survived the armagadd-on, which is literally what Mozilla is naming it internally. Flagfox is in the very long list of the affected. Someone from Mozilla even linked to one of their forums on Twitter and Mozilla’s server was overloaded, so yeah… they’ve got some problems at the moment.

The only thing I can think of to attempt to work around things on my end would be to rush out an update just to resign, in the hopes that they have a new cert online and it’s just old versions that have expired. However, I don’t actually know if that’d help, and due to the sheer scale of the breakage here, I think it’s best I touch nothing for the moment. Everyone’s affected, so Mozilla is going to have to come up with a fix for everyone, one way or another, hopefully ASAP.

Update 1:
Mozilla released Firefox 66.0.4 and 60.6.2 (ESR) updates which should fix the majority of this issue. Please update.
(update instructions; more info from Mozilla)

Update 2:
Mozilla released another pair of updates, now Firefox 66.0.5 and 60.6.3 (ESR), which should fix things more reliably. Apparently some antivirus programs could break things (as they often do) and very old master passwords could cause issues. In any case, it’s fixed again, for realzies this time.

Advertisement

The AMO beta channel has been removed

For anyone who (actually) reads what I post here, just a quick note: Mozilla removed the beta channel from Mozilla Add-ons. (The actual timing was delayed from the date of their post. I’m not sure exactly when the change actually went live.) This means that for all addons which used this feature, they no longer have a simple method to have users test addon pre-releases via AMO. Flagfox 6.0 was my most recent use of this system, and it was invaluable. All users who had installed any beta channel version should automatically be updated to the latest stable channel version. Just to be clear, this applies to every addon Mozilla hosts on AMO, not just Flagfox.

I may do another Flagfox alpha/beta in the future, as I have done multiple times in the past, but it’ll require more time and effort, and will have a little less visibility. If/when I do so, this irregularly used blog is where I’ll announce it.

On an unrelated note: The Flagfox 6.0.x and 5.2.x monthly updates are pending, and as usual will be available at the end of the month. I’ve been considering switching from an end-of-month schedule back to a mid-month schedule, but I’ve simply not actually done so yet. Maybe probably next month.

On Forks

A few people asked me what my opinion is of the various Firefox forks that are becoming more popular after Mozilla screwed up. Rather than write my own explanation, I just found someone else’s blog post from last week that says pretty much the same thing, so I’m just going to point to that instead. I don’t normally read How-To Geek, but this explanation from Chris Hoffman is quite good. TL;DR: Firefox 52 ESR is the better recommendation.

Note that Flagfox does generally run in forks and I am occasionally releasing 5.2.x updates, regardless of if I recommend people use forks or not.

When did Mozilla get this bad?

For the past week I’ve been damn near incapacitated by whatever bacteria took up residence in my body, though the antibiotics seem to have worked. I haven’t been stuck in the bed all the time, but I have been so out-of-it that I had trouble reading something I’d code ten minutes earlier. Anyway, long story short, with Mozilla’s Firefox 57 update, I thought it’d take dozens of hours to rewrite things to get Flagfox working under it, but it’s taking hundreds of hours, and that’s before the lightheadedness. I gauged my estimate based on the last time I rewrote things for a major overhaul on their part (no, not addon SDK; I was able to skip that; the one before that), and wow, we’re not on the same scale here. I’ll get something released eventually, but the illness delay hurt in more ways than one. That’s not why I decided to post something here again, nor why I’m leaving comments on this time.

I have a question: When did Mozilla get this bad? I know when they made the decision to do all of this, but what I’m talking about specifically is what I just discovered today. Apparently, if you’ve got Firefox 57 updated on your primary profile with legacy addons installed (something I obviously avoided), not only are all the “legacy” addons hidden in a separate new menu in the addon manager, but they’ve only got two buttons shown for them: “Remove” and “Find a Replacement”. Click on that rather insulting button, and it takes you directly to what seems to be a human-chosen replacement (seems to look up just by legacy addon’s ID). The designated replacement for Flagfox seems to be Country Flag +, which shows a flag for the given IP with a tooltip with basic info, and when you click on it it shows a big flag and a popup with that basic info shown more pretty, and a vague (especially if in US) Google Map for the location. Oh, and when it points at Oklahoma for every website in the US, it gives you latitude and longitude for the useless map marker. The one thing you can actually do with this thing is click a little button in the lower left of the popup to do a lookup with Alexa for the site info. That’s it. This is a toy; somebody at Mozilla was told to just find a replacement for all addons that didn’t jump through all of their hoops fast enough, and this is what they came up with. Granted, it’s better than picking an alternative that tracks/sends all your browsing data somewhere or asks to download binaries to work better (those were actual existing options). Instead, it’s the toy that shows a flag and a bigger flag, yet somehow is 5 times the file size of Flagfox even though I also managed to include full translations into 36 other languages, including every name of every country on the planet (79 people have worked on these translations, over the years).

I got an email or two reaching out from Mozilla on the topic of porting, months ago and again last month, but I got no indication of the scale of things here. I knew this was going to be annoying and piss a lot of people off, but I didn’t suspect every person I talk to to say they hate Firefox 57, before talking about addons. I didn’t expect Mozilla to change their addons site to hide reviews by default, or decide all I’ve been doing for 10 years was making a thing to show a pretty picture of a flag and promote that as my replacement like I’ve died.

I used to be an active triager for Firefox bugs on Mozilla’s Bugzilla. The stats is has for me are: 470 bugs filed, 3084 bugs commented on, 4011 bugs poked (no clue what this specifically means), and 1079 bugs where I changed the status to resolved (fixed, verified, invalid, but for some reason the stat doesn’t show duplicate marking). There was a time when I was actively investigating crash reports as they were reported to Bugzilla, and I even wrote an entire addon to help with things by trying to auto-diagnose crash reports that got a few thousand users (but that addon has long since been obsolete and discontinued). I haven’t gotten involved with bugs or support requests in a few years now, so I’ve been apparently out of the loop when it comes to the way Mozilla deals with people. I knew enough that when I filed a bug about the bug in Firefox that was causing script cache problems breaking Flagfox 5.x (and probably some other addons) in the months prior to Firefox 57, I wasn’t completely astounded when they immediately WONTFIXed it, but I was take-aback by the lack of even trying to investigate if maybe it affected them and not just addons that were going to be unsupported by Firefox soon.

So, here we are. We’ve gone from Mozilla accepting my latest update to Flagfox 5.2.x on November 9, and then 5 days later on November 14, Firefox 57 gets released and I’m dead to them. Look, I’m not going to act like the fact that I haven’t been able to get a compatible version out yet is all their fault, but I didn’t realize they’d end up being, well, mean about it. Maybe from their perspective the “real” deadline to rewrite was passed once they started putting that “legacy” label on things everywhere (don’t even remember when I first noticed that). I decided to pick a month to spend free time rewriting things, but apparently it was implicit that I should’ve started 3 months prior and devoted every waking hour to not only rewriting things from scratch, but fixing Mozilla’s problems in these APIs.

I knew Mozilla had some severe problems high up ever since the Eich CEO fiasco that everyone other than them could see coming a mile away, and I know that some of the stuff that they do that ticks people off is due to sheer lack of resources and personnel to work on things, but I feel like something changed somewhere that I just didn’t see. I don’t ask rhetorical questions; does anyone know what changed and when that got them to this point? Or, were they always on this path and just never had a way to step out of it? They somehow managed to release the new Firefox Quantum to everyone and the first thing my mother said when she got the update is that she hated it, as it got rid of her bookmarks button and search bar, and changed her homepage to that new tab page that has ads in it, and has those weird spaces in the toolbar around the address bar (who thought that was a good idea? probably someone with a way bigger screen resolution). She basically thought it was unusable until I got to it to change the settings to something she could live with. I’m accustomed to clusterfucks in the tech world, but I’m only now beginning to realize how badly things have gotten.

Bottom line of this rambling: I used to think I was part of the Mozilla community. I have a Firefox logo mug I won for a guesstimate on when Bugzilla would hit some bug number milestone (I think the contest was discontinued after it hit a million). I’ve got multiple Firefox T-shirts that I have never worn that Mozilla kept sending me for various reasons. However, at this point, I now consider myself just a person who writes an addon that will hopefully work in Firefox again in the not-too-distant future. I’m just another user of Firefox and Thunderbird, and I’m apparently just as confused as everyone else as to what happened.

Posting status info to AMO is a pain

The Flagfox 6.0 update to support Firefox 57 (prior post here) is still slowly being worked on, though it’s going much slower now due to bad luck and timing, as I’ve gotten rather sick. It’s not that serious; I’m not dying, or anything, but I’m coughing horribly, sleeping badly, and am a bit lightheaded in addition to just feeling like crap. (The person I caught this from is still sick, as well, so I don’t know when this will be out of my system.) This is not conducive to programming well, let alone quickly, in an alien API, often having to deal with some really stupid junk that I’ll be reporting to Mozilla via bug reports after all this is done. Again, just to reiterate, I am the only Flagfox developer and this is a hobby project.

Anyway, it’s time for me to post another explanation of a problem caused by a recent stupid Mozilla decision:

If you’re wondering why I hadn’t put up any Firefox 57 support status update message on Flagfox’s page on the Mozilla Add-ons site until today, it’s because doing so is shockingly difficult, especially as of Mozilla’s latest revision of the website. (it’s crap in a variety of ways, but this one is particularly annoying) Previously, there was a “Developer’s Comments” section in addition to the “Add-on Description” section (currently labeled “About this extension”) where I could put updates like this, though at some point they started hiding it by default, which was annoying. Now it’s gone completely. I still seem to have it available to configure in my settings, but it doesn’t actually show on the page, even with all the stupid dead-space below the mostly hidden by default description (again, there’s a lot of dumb in their recent site refresh). My guess is some Mozilla web developer thought it was pointlessly redundant, however it’s most definitely not. Updating the addon description requires editing each and every one of the dozens of Flagfox description translations into many of the various languages supported by Flagfox. Updating the developer’s comments, on the other hand, was simple; there was only English, shown to everyone (if you can’t read it, that’s a problem, but at least it’s there and you can see it, and maybe attempt automatic translation, potentially using Google Translate via the built in Flagfox action…). There is no mass-edit/change/upload feature for Mozilla Add-on’s listing data, though it has of course been requested by many addon developers over many years. (unless there’s some secret way to do it they’ve added at some point and not told anyone about) As a result, the simple logistics of me putting a message on that site that can actually be read by more than a quarter or so of the Flagfox userbase required me to slowly go through the menu of listed translations and delete each description (there isn’t even a delete button; I have to click “edit”, then select all, then hit delete, then save), one by one, until just the English one remains for me to edit and show to all. This is stupid, but sadly, the least stupid thing I’ve had to deal with during this transition to Firefox 57.

Current software requires current software

A few years ago I got rambling obscenity laden hate mail because Flagfox didn’t support a version of Firefox that ran on Windows 98SE anymore. There is a select group of people out there that don’t grasp that software running in software running in software would depend on other updates in its updates. No, sorry, I cannot support an operating system older than people capable of hacking it.

In order to get Flagfox updating without Firefox restarts (as well as fix some other issues) I need to support a minimum of Firefox 17. This is two Mozilla Extended Support Releases back; the current ESR is Firefox 24.

Around 2013, Mozilla stopped supporting Windows 2000 and Mac OS X 10.5. (see here for OS support table) At some point the line has to be drawn, and that’s where it ended up. Firefox 17+ just isn’t going to run on OSes that old. Honestly, supporting an operating system for 13 years is kind of astonishing if you think about it. They really do give massive leeway here, but it can’t be forever.

Mozilla also dropped support for old versions of Windows XP around the same time, however these users can simply update to Windows XP SP3 which is likely to be supported for quite some time. Windows 2003 is in a similar situation; update to at least SP1. You should be able to use the normal Windows Update system to do this.

What to do with old computers?

First, the lecture: If you are running an operating system that is no longer supported with security updates you are a danger to yourself and others. If this is your fault, you will not get sympathy from me. Yes, you might be forced to buy a new computer or upgrade your OS yourself, but that’s better than adding to the population of hacked machines used for criminal activities. If it’s not your fault because the computer in question is a company computer, it’s time to gather your coworkers to petition your employer about unsafe working conditions. (computer/network maintenance negligence is not a joke)

If you do have control over the computer in question it’s probably time to upgrade. You generally have the option of installing a newer version of Windows / Mac OS X, installing Linux (e.g. Ubuntu), or buying a new computer. This is just a generic tech support recommendation, however. Do not email me asking for help updating your computer.

If you are running Mac OS X 10.5 on PowerPC hardware, you unfortunately have fewer options. There is a fork of Firefox ESR for PPC called TenFourFox that might be an option for you. (I cannot stress how much emphasis I put on the word “might” here) If you get this working, please contact me as I would really like to know how well this works for you. Updating your OS is not an option as Apple abandoned this old CPU architecture shortly after your hardware was made and they don’t provide new OS versions for it anymore. Linux also might be an option for you. Sadly, with Apple, they really just want you to buy a new computer.

Please don’t send me angry emails about how horrible it is that your old box doesn’t work with anything new anymore. We live in an era of rapid technological advancement and you’re just going to have to deal with the simple fact that new stuff will depend on new stuff in order to work.

To answer the obvious question, no, I will not be putting out branch updates for the old 4.2.x version either. I’m not entirely against this concept, however the Mozilla Add-ons site/system doesn’t really support this in any practical way.