Quote:

The last week has not been great for Mozilla. Last Friday, reports started to come in from around the world that installed add-ons would not verify anymore and were disabled as a consequence. Users could not download and install add-ons from Mozilla AMO anymore either.

Latest figures show that about 60% of Firefox users install add-ons in the browser; any issue affecting 60% of the user base, especially when it comes to personal choices made by those users, is as critical as it gets.

Mozilla fixed the issue quickly for most users. Quickly still meant that some users had to wait days for their add-ons to work again while others, especially those on older unsupported releases, will still have to wait a bit longer before patches are provided.

Mozilla apologized on the official blog of the organization today. The company acknowledges that it failed and that it is sorry about what has happened. The organization used the Shield service to deliver fixes to users quickly. Since it required the enabling of Telemetry in the browser, it meant that data would be recorded.

Mozilla announced in the post that all Telemetry and Studies data collected between May 5th and May 11th will be deleted.

Quote:In order to respect our users’ potential intentions as much as possible, based on our current set up, we will be deleting all of our source Telemetry and Studies data for our entire user population collected between 2019-05-04T11:00:00Z and 2019-05-11T11:00:00Z.

Mozilla CTO Eric Rescorla published a technical analysis of the issue on the Mozilla Hacks blog. He provides insights into Firefox's add-on signing functionality.

The root certificate is used to sign a new intermediate certificate, and the intermediate certificate is used to sign end-entity certificates which in turn sign individual add-ons.