It’s a tough day for some at Mozilla, I imagine, with pretty much all Firefox add-ons suddenly being disabled due to an expired intermediate certificate.

I love Firefox. I love having a browser that is not increasingly proprietary (*cough* Chrome *cough*), and so I too was hit by this issue.

Mozilla rolled out a fix using their studies system, and users were told to go to about:studies and it would show up within 24 hours.

My about:studies was a blank white page. Not a blank list of studies with the explanatory text — an entirely blank page. Here’s what it should have looked like:

I delved into the Firefox source code to see if I could track this down.

Running Firefox with the -jsconsole switch revealed errors relating to IndexedDB and the Top Sites component. Initially, I ignored these, but it turns out they were likely symptoms of the same problem.

In the end, I found toolkit/components/normandy/lib/AddonStudies.jsm, which I believe is the backend that the about:studies frontend JavaScript code talks to.

const DB_NAME = "shield";
const STORE_NAME = "addon-studies";
const DB_OPTIONS = {
  version: 1,
};
const STUDY_ENDED_TOPIC = "shield-study-ended";
const log = LogManager.getLogger("addon-studies");


/**
 * Create a new connection to the database.
 */
function openDatabase() {
  return IndexedDB.open(DB_NAME, DB_OPTIONS, db => {
    db.createObjectStore(STORE_NAME, {
      keyPath: "recipeId",
    });
  });
}

So, I knew I was looking at IndexedDB and I needed to locate what was happening with this particular shield database.

This StackOverflow answer was old, but gave me a hint of where to look. In the Firefox profile folder, there is storage/permanent. Inside here, a number of subfolders, including chrome (no, not Chrome — chrome) and other folders relating to devtools.

I noticed that in the chrome folder, I had four files for two different databases. Each database had a .sqlite-wal file and a .sqlite-shm file. This didn’t seem right — these are an index and a write-ahead log, but where is the actual data file? There should be a .sqlite file as well with the actual data for both databases.

So, I deleted these four .sqlite-wal and .sqlite-shm files from my profile (after a backup, of course, and when Firefox was not running).

A restart of Firefox later — several databases were regenerated and reappeared in that folder. Critically, about:studies was no longer blank and displayed as it should have — albeit with no studies yet.

A Fix? A Workaround?

Performing these steps may cause your Firefox profile to be irreparably damaged. This is an advanced and entirely unsupported process. Proceed at your own risk and only with a backup.

Great caution should be exercised here — I don’t know what these chrome IndexedDB databases contain, or should have contained. In any case, I’m pretty sure that the absence of the .sqlite file but the presence of the wal and shm files meant that Firefox was unwilling to delete them and start again for fear of losing something.

However, if you are experiencing the same problem:

• Quit Firefox
• Go to your Firefox profile folder
• Back up your profile
• Inside the profile folder, go to storage/permanent/chrome/idb
• See if you have any .sqlite-shm and .sqlite-wal files without a corresponding .sqlite file
• If so, move the .sqlite-shm and .sqlite-wal files elsewhere on your disk, away from your Firefox profile, and restart Firefox
• See if about:studies is no longer a blank page

I read this BBC News story about mistakenly issued security certificates recently, which allowed the people with those certificates to impersonate any Google websites and intercept traffic to them. It struck me as quite significant that this particular story made it to &#8216mainstream’ tech reporting.

There is a more detailed, and perhaps more accurate, commentary on this attack on Freedom to Tinker. It perhaps may not have been ‘cyber criminals’ as the BBC reported it when I first viewed the story!

Anyway, given the attention to this issue, I thought it a good opportunity to review this kind of attack against SSL/TLS — the security system upon which we all now depend. More importantly, I wanted to show Certificate Patrol, an add-on for Firefox that would allow you to notice a suspicious change to an certificate and thwart this kind of attack.

The weaknesses inherent in having too many organisations that are able to issue security certificates for any domain are becoming more clear. While this kind of attack is extremely rare, at the moment, ‘at the moment’ is a very poor security response! Hopefully, more awareness of these limitations of the internet’s authentication infrastructure can help put pressure on browser vendors, website owners and CAs to make everyone more secure.

Today’s release of Firefox 13 brings with it more imposed functionality changes to the only version of the browser that we can use, because it is is the only one kept current with security updates*.

This time, it is a brand new, Google Chrome-style ’New Tab’ page. I’m sure it is great for lots of people, but personally, I prefer a blank home page and a blank page when I open a new tab.

To restore the old behaviour, and have a blank new tab, browse to about:config. Accept the warning, then search for newtab. Do not change newtabpage.enabled.

Instead, double-click browser.newtab.url and set it to about:blank.

There, that’s how I prefer it again!

* UPDATE: A slight correction — there is a version of Firefox 10.x called Firefox ESR (Extended Support Release) that is kept up-to-date, so that is also an option!

The recent release of Firefox 7 has brought with it several changes. One of these, is that Firefox hides the ‘http://’ prefix in the URL bar by default.

For many people this is fine and probably a positive changes, but geeks like myself may wish to restore the prefix. (I found it especially annoying when I copied a URL from the bar and the text pasted did include the ‘http://’, when the text I copied did not! I don’t like that kind of inconsistency!)

To restore the prefix, browse to about:config. Accept the warning, then search for browser.urlbar.trimURLs. When you find the setting, double-click on it to toggle it to false. The changes should take effect immediately.

That’s better!

UPDATE: This still is fine for 2.0.0.x, but UnPlug does not run properly on Firefox 3 and later, so if you’re on 3.0, this unfortunately will not work.

Firefox extension UnPlug is a very useful tool for extracting embedded video from all sorts of websites.

It can be a bit alien to work out how to use at first though, so I’ve put together a quick video of just over a minute that walks you through the process. It assumes you’ve already got UnPlug installed and loaded into Firefox.

Firefox on the Mac is, well, it doesn’t always fit in quite as well with the Mac as it could – and it feels like that’s always been the case.

Firefox 3 is meant to start changing that, and making Firefox feel like a first class citizen on OS X. Having heard Jacob’s singing praise for the beta’s integration with GTK on Linux, I thought I’d download the Mac build and give it a try.

The first thing you’ll probably notice is real native buttons. Instead of Windows 95-style boxy buttons, native Mac buttons are now used, unless the website specifies specific button colours, in which case those colours and styles are used on the standard boxy buttons (exactly the same as Safari 3 now does).

There’s also a new theme available, called Proto. It doesn’t ship with the beta, but is linked to from the welcome page you get. And this is what it looks like:

» Read the rest of this post…