{"id":33377,"date":"2019-10-31T21:52:15","date_gmt":"2019-10-31T18:52:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/tehnicheskie-podrobnosti-nedavnego-otklyucheniya-dopolnenij-v-firefox\/"},"modified":"2019-10-31T21:52:15","modified_gmt":"2019-10-31T18:52:15","slug":"tehnicheskie-podrobnosti-nedavnego-otklyucheniya-dopolnenij-v-firefox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/tehnicheskie-podrobnosti-nedavnego-otklyucheniya-dopolnenij-v-firefox","title":{"rendered":"Technick\u00e9 podrobnosti ned\u00e1vn\u00e9ho vypnut\u00ed dopl\u0148k\u016f ve Firefoxu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Pozn\u00e1mka p\u0159ekladatele: pro pohodl\u00ed \u010dten\u00e1\u0159\u016f jsou data uvedena ve moskevsk\u00e9m \u010dase<\/i><\/p>\n<p>Ned\u00e1vno jsme prop\u00e1sli okam\u017eik vypr\u0161en\u00ed platnosti jednoho z certifik\u00e1t\u016f, kter\u00e9 byly pou\u017eity k podepisov\u00e1n\u00ed dopl\u0148k\u016f. To vedlo k deaktivaci dopl\u0148k\u016f u u\u017eivatel\u016f. Te\u010f, kdy\u017e je v\u011bt\u0161ina probl\u00e9mu opravena, bych cht\u011bl sd\u00edlet detaily ud\u00e1losti a vykonanou pr\u00e1ci.\n<\/p>\n<p><b>Pozad\u00ed: dopl\u0148ky a podpisy<\/b><\/p>\n<p><noindex>I kdy\u017e mnoho lid\u00ed pou\u017e\u00edv\u00e1 prohl\u00ed\u017ee\u010d &#171;z krabice&#187;, Firefox podporuje roz\u0161\u00ed\u0159en\u00ed zvan\u00e1 &#171;p\u0159\u00edslu\u0161enstv\u00ed&#187;. S jejich pomoc\u00ed si u\u017eivatel\u00e9 do prohl\u00ed\u017ee\u010de p\u0159id\u00e1vaj\u00ed r\u016fzn\u00e9 funkce. Existuje v\u00edce ne\u017e 15 000 p\u0159\u00edslu\u0161enstv\u00ed: od <a rel=\"nofollow\" href=\"https:\/\/addons.mozilla.org\/en-US\/firefox\/addon\/ublock-origin\/\">blokov\u00e1n\u00ed reklam<\/a> do <a rel=\"nofollow\" href=\"https:\/\/addons.mozilla.org\/en-US\/firefox\/addon\/tree-style-tab\/\">spr\u00e1vy stovek karet<\/a>.<\/noindex><\/p>\n<p>Nainstalovan\u00e9 dopl\u0148ky mus\u00ed m\u00edt <a rel=\"nofollow\" href=\"https:\/\/blog.mozilla.org\/addons\/2015\/02\/10\/extension-signing-safer-experience\/\">digit\u00e1ln\u00ed podpis<\/a>, kter\u00fd chr\u00e1n\u00ed u\u017eivatele p\u0159ed \u0161kodliv\u00fdmi dopl\u0148ky, a vy\u017eaduje minim\u00e1ln\u00ed kontrolu dopl\u0148k\u016f zam\u011bstnanci Mozilly. Toto po\u017eadavek jsme zavedli v roce 2015, proto\u017ee jsme \u010delili <a rel=\"nofollow\" href=\"https:\/\/blog.mozilla.org\/addons\/2015\/04\/15\/the-case-for-extension-signing\/\">v\u00e1\u017en\u00fdm probl\u00e9m\u016fm<\/a> se \u0161kodliv\u00fdmi dopl\u0148ky.<\/p>\n<p>Jak to funguje: ka\u017ed\u00e1 kopie Firefoxu obsahuje &#171;ko\u0159enov\u00fd certifik\u00e1t&#187;. Kl\u00ed\u010d tohoto &#171;ko\u0159ene&#187; se uchov\u00e1v\u00e1 v <a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Hardware_security_module\">modulu hardwarov\u00e9 ochrany (HSM)<\/a>, bez p\u0159\u00edstupu k s\u00edti. Ka\u017ed\u00fdch n\u011bkolik let je t\u00edmto kl\u00ed\u010dem podeps\u00e1n nov\u00fd &#171;mezi\u010dl\u00e1nek certifik\u00e1tu&#187;, kter\u00fd se pou\u017e\u00edv\u00e1 p\u0159i podepisov\u00e1n\u00ed p\u0159\u00edslu\u0161enstv\u00ed. Kdy\u017e v\u00fdvoj\u00e1\u0159 po\u0161le p\u0159\u00edslu\u0161enstv\u00ed, vytvo\u0159\u00edme do\u010dasn\u00fd &#171;koncov\u00fd certifik\u00e1t&#187; a podep\u00ed\u0161eme ho pomoc\u00ed mezi\u010dl\u00e1nkov\u00e9ho certifik\u00e1tu. Pak se koncov\u00fdm certifik\u00e1tem podepisuje samotn\u00e9 p\u0159\u00edslu\u0161enstv\u00ed. Schematicky <a rel=\"nofollow\" href=\"https:\/\/hacks.mozilla.org\/files\/2019\/05\/Add-on-blog-post-visual-May-7-2019-768x859.png\">to vypad\u00e1 takto<\/a>.<\/p>\n<p>M\u011bjte na pam\u011bti: ka\u017ed\u00fd certifik\u00e1t m\u00e1 &#171;subjekt&#187; (komu je certifik\u00e1t vyd\u00e1n) a &#171;vydavatele&#187; (kdo certifik\u00e1t vydal). V p\u0159\u00edpad\u011b ko\u0159enov\u00e9ho certifik\u00e1tu &#171;subjekt&#187; = &#171;vydavatel&#187;, ale u jin\u00fdch certifik\u00e1t\u016f je vydavatelem certifik\u00e1tu subjekt nad\u0159azen\u00e9ho certifik\u00e1tu, kter\u00fdm byl ten certifik\u00e1t podeps\u00e1n.<\/p>\n<p>D\u016fle\u017eit\u00fd bod: ka\u017ed\u00fd dopln\u011bk je podeps\u00e1n unik\u00e1tn\u00edm koncov\u00fdm certifik\u00e1tem, ale t\u00e9m\u011b\u0159 v\u017edy jsou tyto koncov\u00e9 certifik\u00e1ty podeps\u00e1ny stejn\u00fdm mezi certifik\u00e1tem.<\/p>\n<p><i>Pozn\u00e1mka autora: v\u00fdjimka se t\u00fdk\u00e1 velmi star\u00fdch dopl\u0148k\u016f. Tehdy se pou\u017e\u00edvaly r\u016fzn\u00e9 mezi certifik\u00e1ty.<\/i><\/p>\n<p>Tento mezit\u00edmn\u00ed certifik\u00e1t zp\u016fsobil probl\u00e9my: ka\u017ed\u00fd certifik\u00e1t je platn\u00fd po ur\u010ditou dobu. P\u0159ed nebo po tomto obdob\u00ed certifik\u00e1t nen\u00ed platn\u00fd a prohl\u00ed\u017ee\u010d nebude pou\u017e\u00edvat roz\u0161\u00ed\u0159en\u00ed podepsan\u00e1 t\u00edmto certifik\u00e1tem. Bohu\u017eel, platnost mezit\u00edmn\u00edho certifik\u00e1tu vypr\u0161ela 4. kv\u011btna v 4 hodiny r\u00e1no.<\/p>\n<p>N\u00e1sledky se neprojevily hned. Firefox kontroluje podpisy nainstalovan\u00fdch roz\u0161\u00ed\u0159en\u00ed nikoliv neust\u00e1le, ale zhruba jednou za 24 hodin, p\u0159i\u010dem\u017e \u010das kontroly je individu\u00e1ln\u00ed pro ka\u017ed\u00e9ho u\u017eivatele. V\u00fdsledkem je, \u017ee n\u011bkte\u0159\u00ed lid\u00e9 \u010delili probl\u00e9m\u016fm okam\u017eit\u011b, jin\u00ed mnohem pozd\u011bji. O probl\u00e9mu jsme se dozv\u011bd\u011bli poprv\u00e9 p\u0159ibli\u017en\u011b v okam\u017eiku, kdy vypr\u0161ela platnost certifik\u00e1tu, a okam\u017eit\u011b jsme za\u010dali hledat \u0159e\u0161en\u00ed.<\/p>\n<p>\n<b>Sni\u017eujeme \u0161kody<\/b><\/p>\n<p>Jakmile jsme pochopili, co se stalo, pokusili jsme se zabr\u00e1nit zhor\u0161en\u00ed situace.<\/p>\n<p>Za prv\u00e9, p\u0159estali jsme p\u0159ij\u00edmat a podepisovat nov\u00e1 roz\u0161\u00ed\u0159en\u00ed. Nen\u00ed smysl pou\u017e\u00edvat k tomu pro\u0161l\u00fd certifik\u00e1t. Kdy\u017e se ohl\u00e9dnu zp\u011bt, \u0159ekl bych, \u017ee by mo\u017en\u00e1 bylo lep\u0161\u00ed nechat v\u0161e tak, jak to je. Nyn\u00ed bylo p\u0159ij\u00edm\u00e1n\u00ed roz\u0161\u00ed\u0159en\u00ed obnoven\u00e9.<\/p>\n<p>Za druh\u00e9, okam\u017eit\u011b jsme rozeslali opravu, kter\u00e1 zabr\u00e1nila ka\u017edodenn\u00ed kontrole podpis\u016f. T\u00edmto jsme zachr\u00e1nili u\u017eivatele, u kter\u00fdch prohl\u00ed\u017ee\u010d v posledn\u00edch 24 hodin\u00e1ch je\u0161t\u011b nestihl zkontrolovat roz\u0161\u00ed\u0159en\u00ed. Tato oprava je nyn\u00ed sta\u017eena, proto\u017ee ji ji\u017e nen\u00ed pot\u0159eba.<\/p>\n<p>\n<b>Paraleln\u00ed provoz<\/b><\/p>\n<p>Teoreticky vypad\u00e1 \u0159e\u0161en\u00ed probl\u00e9mu jednodu\u0161e: vytvo\u0159it nov\u00fd platn\u00fd mezit\u00edmn\u00ed certifik\u00e1t a podepsat ka\u017ed\u00e9 roz\u0161\u00ed\u0159en\u00ed znovu. Bohu\u017eel, to nebude fungovat:\n<\/p>\n<ul>\n<li>nem\u016f\u017eeme rychle podepsat 15 tis\u00edc roz\u0161\u00ed\u0159en\u00ed najednou, syst\u00e9m nen\u00ed na takovou z\u00e1t\u011b\u017e p\u0159ipraven\n<\/li>\n<li>po podeps\u00e1n\u00ed roz\u0161\u00ed\u0159en\u00ed je nutn\u00e9 doru\u010dit aktualizovan\u00e9 verze u\u017eivatel\u016fm. V\u011bt\u0161ina roz\u0161\u00ed\u0159en\u00ed se instalov\u00e1na ze server\u016f Mozilla, tak\u017ee Firefox najde aktualizace v n\u00e1sleduj\u00edc\u00edch dnech, ale n\u011bkte\u0159\u00ed v\u00fdvoj\u00e1\u0159i rozes\u00edlaj\u00ed podepsan\u00e1 roz\u0161\u00ed\u0159en\u00ed prost\u0159ednictv\u00edm alternativn\u00edch kan\u00e1l\u016f, a u\u017eivatel\u00e9 by tak museli tyto roz\u0161\u00ed\u0159en\u00ed aktualizovat ru\u010dn\u011b<\/li>\n<\/ul>\n<p>M\u00edsto toho jsme se pokusili vyvinout takovou opravu, kter\u00e1 by dos\u00e1hla ke v\u0161em u\u017eivatel\u016fm, ani\u017e by vy\u017eadovala (nebo t\u00e9m\u011b\u0159 nevy\u017eadovala) jejich akce.<\/p>\n<p>Pom\u011brn\u011b rychle jsme se dostali k dv\u011bma hlavn\u00edm strategi\u00edm, kter\u00e9 jsme pou\u017e\u00edvali sou\u010dasn\u011b:\n<\/p>\n<ul>\n<li>Aktualizovat Firefox, aby se zm\u011bnila doba platnosti certifik\u00e1tu. To zp\u016fsob\u00ed, \u017ee st\u00e1vaj\u00edc\u00ed dopl\u0148ky budou op\u011bt fungovat, ale bude vy\u017eadovat vyd\u00e1n\u00ed a dod\u00e1n\u00ed nov\u00e9 verze Firefoxu.\n<\/li>\n<li>Vytvo\u0159it platn\u00fd certifik\u00e1t a somehow p\u0159esv\u011bd\u010dit Firefox, aby ho p\u0159ijal m\u00edsto st\u00e1vaj\u00edc\u00edho, jeho\u017e platnost vypr\u0161ela.<\/li>\n<\/ul>\n<p>Rozhodli jsme se nejprve pou\u017e\u00edt prvn\u00ed mo\u017enost, kter\u00e1 se zd\u00e1la b\u00fdt docela funk\u010dn\u00ed. Na konci dne jsme vydali i druh\u00e9 opraven\u00ed (nov\u00fd certifik\u00e1t), o kter\u00e9m si pov\u00edme pozd\u011bji.<\/p>\n<p>\n<b>V\u00fdm\u011bna certifik\u00e1tu<\/b><\/p>\n<p>Jak jsem zm\u00ednil v\u00fd\u0161e, bylo zapot\u0159eb\u00ed:\n<\/p>\n<ul>\n<li>vytvo\u0159it nov\u00fd platn\u00fd certifik\u00e1t\n<\/li>\n<li>nainstalovat ho vzd\u00e1len\u011b do Firefoxu\n<\/li>\n<\/ul>\n<p>Abychom pochopili, pro\u010d to bude fungovat, pod\u00edvejme se podrobn\u011bji na proces ov\u011b\u0159ov\u00e1n\u00ed dopl\u0148ku. Samotn\u00fd dopln\u011bk se dod\u00e1v\u00e1 jako souborov\u00fd bal\u00ed\u010dek, v\u010detn\u011b \u0159et\u011bzce certifik\u00e1t\u016f, kter\u00e9 se pou\u017e\u00edvaj\u00ed k podepisov\u00e1n\u00ed. V d\u016fsledku toho m\u016f\u017ee b\u00fdt dopln\u011bk ov\u011b\u0159en, pokud je prohl\u00ed\u017ee\u010di zn\u00e1m ko\u0159enov\u00fd certifik\u00e1t, kter\u00fd je zabudov\u00e1n do Firefoxu b\u011bhem sestaven\u00ed. Jak u\u017e v\u00edme, mezilehl\u00fd certifik\u00e1t je v\u0161ak pro\u0161l\u00fd, tak\u017ee ov\u011b\u0159en\u00ed dopl\u0148ku nen\u00ed mo\u017en\u00e9.<\/p>\n<p>Kdy\u017e se Firefox pokou\u0161\u00ed ov\u011b\u0159it dopln\u011bk, neomezuje se pouze na pou\u017e\u00edv\u00e1n\u00ed certifik\u00e1t\u016f obsa\u017een\u00fdch uvnit\u0159 samotn\u00e9ho dopl\u0148ku. M\u00edsto toho se prohl\u00ed\u017ee\u010d pokus\u00ed vytvo\u0159it platn\u00fd \u0159et\u011bzec certifik\u00e1t\u016f, za\u010d\u00ednaj\u00edc\u00ed kone\u010dn\u00fdm certifik\u00e1tem, a pokra\u010duje, dokud se nedostane k ko\u0159enu. Na prvn\u00ed \u00farovni za\u010d\u00edn\u00e1me s kone\u010dn\u00fdm certifik\u00e1tem a pot\u00e9 nalezneme certifik\u00e1t, jeho\u017e subjekt je vydavatelem kone\u010dn\u00e9ho certifik\u00e1tu (tj. mezilehl\u00fd certifik\u00e1t). Tento mezilehl\u00fd certifik\u00e1t se obvykle dod\u00e1v\u00e1 s dopl\u0148kem, ale m\u016f\u017ee j\u00edm b\u00fdt tak\u00e9 jak\u00fdkoli certifik\u00e1t ze skladu prohl\u00ed\u017ee\u010de. Pokud budeme moci vzd\u00e1len\u011b p\u0159idat do skladu certifik\u00e1t\u016f nov\u00fd platn\u00fd certifik\u00e1t, Firefox se ho pokus\u00ed pou\u017e\u00edt. <a rel=\"nofollow\" href=\"https:\/\/hacks.mozilla.org\/files\/2019\/05\/Add-on-blog-post-visual-2-May-7-2019.png\">Situace p\u0159ed a po instalaci nov\u00e9ho certifik\u00e1tu<\/a>.<\/p>\n<p>Po nainstalov\u00e1n\u00ed nov\u00e9ho certifik\u00e1tu bude m\u00edt Firefox dv\u011b mo\u017enosti p\u0159i kontrole \u0159et\u011bzce certifik\u00e1t\u016f: pou\u017e\u00edt star\u00fd neplatn\u00fd certifik\u00e1t (kter\u00fd nebude fungovat), nebo nov\u00fd platn\u00fd (kter\u00fd bude fungovat). Je d\u016fle\u017eit\u00e9, \u017ee nov\u00fd certifik\u00e1t obsahuje stejn\u00e9 jm\u00e9no subjektu a ve\u0159ejn\u00fd kl\u00ed\u010d jako star\u00fd certifik\u00e1t, tak\u017ee jeho podpis na koncov\u00e9m certifik\u00e1tu bude platn\u00fd. Firefox je dost chytr\u00fd na to, aby zkusil ob\u011b mo\u017enosti, dokud nenajde tu funk\u010dn\u00ed, tak\u017ee dopl\u0148ky budou op\u011bt ov\u011b\u0159en\u00e9. V\u0161imn\u011bte si, \u017ee to je stejn\u00e1 logika, kterou pou\u017e\u00edv\u00e1me pro ov\u011b\u0159ov\u00e1n\u00ed certifik\u00e1t\u016f TLS.<\/p>\n<p><i>Pozn\u00e1mka autora: \u010dten\u00e1\u0159i obezn\u00e1men\u00ed s WebPKI si v\u0161imnou, \u017ee p\u0159esn\u011b takto funguj\u00ed k\u0159\u00ed\u017eov\u00e9 certifik\u00e1ty.<\/i><\/p>\n<p>Nejpozoruhodn\u011bj\u0161\u00ed na tomto \u0159e\u0161en\u00ed je, \u017ee nevy\u017eaduje p\u0159e podeps\u00e1n\u00ed st\u00e1vaj\u00edc\u00edch dopl\u0148k\u016f. Jakmile prohl\u00ed\u017ee\u010d obdr\u017e\u00ed nov\u00fd certifik\u00e1t, v\u0161echny dopl\u0148ky op\u011bt za\u010dnou fungovat. Z\u016fst\u00e1v\u00e1 slo\u017eitost s doru\u010den\u00edm nov\u00e9ho certifik\u00e1tu u\u017eivatel\u016fm (automaticky a vzd\u00e1len\u011b), a tak\u00e9 p\u0159esv\u011bd\u010dit Firefox, aby znovu zkontroloval zak\u00e1zan\u00e9 dopl\u0148ky.<\/p>\n<p>\n<b>Normandy a syst\u00e9m v\u00fdzkumu<\/b><\/p>\n<p>Ironi\u00ed je, \u017ee tento probl\u00e9m \u0159e\u0161\u00ed speci\u00e1ln\u00ed p\u0159\u00edslu\u0161enstv\u00ed zvan\u00e9 &#171;syst\u00e9mov\u00e9&#187;. Pro pot\u0159eby v\u00fdzkumu jsme vyvinuli syst\u00e9m zvan\u00fd Normandy, kter\u00fd doru\u010duje v\u00fdzkumy u\u017eivatel\u016fm. Tyto v\u00fdzkumy se automaticky prov\u00e1d\u011bj\u00ed v prohl\u00ed\u017ee\u010di a maj\u00ed roz\u0161\u00ed\u0159en\u00fd p\u0159\u00edstup k intern\u00edm API rozhran\u00edm Firefoxu. V\u00fdzkumy mohou p\u0159id\u00e1vat nov\u00e9 certifik\u00e1ty do \u00falo\u017ei\u0161t\u011b certifik\u00e1t\u016f.<\/p>\n<p><i>Pozn\u00e1mka autora: nep\u0159id\u00e1v\u00e1me certifik\u00e1t s \u017e\u00e1dn\u00fdmi zvl\u00e1\u0161tn\u00edmi privilegii; je podeps\u00e1n ko\u0159enov\u00fdm certifik\u00e1tem, tak\u017ee mu Firefox d\u016fv\u011b\u0159uje. Jen ho p\u0159id\u00e1v\u00e1me do poolu certifik\u00e1t\u016f, kter\u00e9 m\u016f\u017ee prohl\u00ed\u017ee\u010d pou\u017e\u00edt.<\/i><\/p>\n<p>Tedy \u0159e\u0161en\u00ed spo\u010d\u00edv\u00e1 v tom, \u017ee vytv\u00e1\u0159\u00edme v\u00fdzkum:\n<\/p>\n<ul>\n<li>kter\u00fd nainstaluje u\u017eivatel\u016fm n\u00e1mi vytvo\u0159en\u00fd nov\u00fd certifik\u00e1t\n<\/li>\n<li>kter\u00fd p\u0159inutil prohl\u00ed\u017ee\u010d znovu zkontrolovat zak\u00e1zan\u00e9 dopl\u0148ky, aby znovu fungovaly\n<\/li>\n<\/ul>\n<p>&#171;Ale po\u010dkej&#187;, &#8212; \u0159eknete vy, &#171;p\u0159\u00edslu\u0161enstv\u00ed p\u0159ece nefunguj\u00ed, jak spustit syst\u00e9mov\u00e9 p\u0159\u00edslu\u0161enstv\u00ed?&#187;. Podep\u00ed\u0161eme ho nov\u00fdm certifik\u00e1tem!<\/p>\n<p>\n<b>Skr\u00fdv\u00e1me to v\u0161e dohromady\u2026 pro\u010d to trv\u00e1 tak dlouho?<\/b><\/p>\n<p>Tak\u017ee pl\u00e1n: vydat nov\u00fd certifik\u00e1t na v\u00fdm\u011bnu za star\u00fd, vytvo\u0159it syst\u00e9mov\u00fd dopln\u011bk a nainstalovat ho u\u017eivatel\u016fm prost\u0159ednictv\u00edm Normandy. Probl\u00e9my, jak jsem ji\u017e zm\u00ednil, za\u010daly 4. kv\u011btna v 4:00, a u\u017e v 12:44 t\u00e9ho\u017e dne, m\u00e9n\u011b ne\u017e za 9 hodin, jsme poslali opravu do Normandy. Je\u0161t\u011b dal\u0161\u00edch 6-12 hodin trvalo, ne\u017e se dostala ke v\u0161em u\u017eivatel\u016fm. To u\u017e nen\u00ed \u0161patn\u00e9, ale u\u017eivatel\u00e9 na Twitteru se ptaj\u00ed, pro\u010d jsme nemohli jednat rychleji.<\/p>\n<p>Za prv\u00e9, trvalo to n\u011bjakou dobu, ne\u017e byl vyd\u00e1n nov\u00fd mezicertifik\u00e1t. Jak jsem ji\u017e zm\u00ednil v\u00fd\u0161e, kl\u00ed\u010d k root certifik\u00e1tu je uchov\u00e1v\u00e1n offline v hardwarov\u00e9m bezpe\u010dnostn\u00edm modulu. To je dobr\u00e9 z hlediska bezpe\u010dnosti, proto\u017ee root se pou\u017e\u00edv\u00e1 velmi z\u0159\u00eddka a m\u011bl by b\u00fdt dob\u0159e chr\u00e1n\u011bn, ale je to pon\u011bkud nepohodln\u00e9, kdy\u017e je pot\u0159eba urgentn\u011b podepsat nov\u00fd certifik\u00e1t. Jeden z na\u0161ich in\u017een\u00fdr\u016f musel jet do \u00falo\u017ei\u0161t\u011b HSM. Pot\u00e9 n\u00e1sledovaly ne\u00fasp\u011b\u0161n\u00e9 pokusy o vyd\u00e1n\u00ed spr\u00e1vn\u00e9ho certifik\u00e1tu, a ka\u017ed\u00fd pokus st\u00e1l jedno a\u017e dv\u011b hodiny str\u00e1ven\u00e9 testov\u00e1n\u00edm.<\/p>\n<p>Za druh\u00e9, n\u011bjak\u00fd \u010das zabralo v\u00fdvoj syst\u00e9mov\u00e9ho dopl\u0148ku. Koncep\u010dn\u011b to je velmi jednoduch\u00e9, ale i jednoduch\u00e9 programy vy\u017eaduj\u00ed pozornost. Cht\u011bli jsme se ujistit, \u017ee situaci nezhor\u0161\u00edme. V\u011bdeck\u00fd v\u00fdzkum je t\u0159eba otestovat p\u0159ed odesl\u00e1n\u00edm u\u017eivatel\u016fm. Krom\u011b toho mus\u00ed b\u00fdt dopln\u011bk podeps\u00e1n, ale n\u00e1\u0161 syst\u00e9m pro podepisov\u00e1n\u00ed dopl\u0148k\u016f byl vypnut, a museli jsme hledat alternativn\u00ed cestu.<\/p>\n<p>Nakonec, po p\u0159\u00edprav\u011b v\u00fdzkumu k odesl\u00e1n\u00ed, bylo pot\u0159eba n\u011bjak\u00fd \u010das na nasazen\u00ed. Prohl\u00ed\u017ee\u010d kontroluje aktualizace Normandy ka\u017ed\u00fdch 6 hodin. Ne v\u0161echny po\u010d\u00edta\u010de jsou neust\u00e1le zapnut\u00e9 a p\u0159ipojen\u00e9 k internetu, tak\u017ee je t\u0159eba n\u011bjak\u00fd \u010das, ne\u017e se oprava roz\u0161\u00ed\u0159\u00ed mezi u\u017eivateli.<\/p>\n<p>\n<b>Kone\u010dn\u00e9 kroky<\/b><\/p>\n<p>V\u00fdzkum by m\u011bl vy\u0159e\u0161it probl\u00e9m u v\u011bt\u0161iny u\u017eivatel\u016f, ale nen\u00ed dostupn\u00fd pro v\u0161echny. N\u011bkte\u0159\u00ed u\u017eivatel\u00e9 vy\u017eaduj\u00ed zvl\u00e1\u0161tn\u00ed p\u0159\u00edstup:\n<\/p>\n<ul>\n<li>u\u017eivatel\u00e9, kte\u0159\u00ed vypnuli v\u00fdzkumy nebo telemetrii\n<\/li>\n<li>u\u017eivatel\u00e9 Android verze (Fennec), kde v\u00fdzkumy nejsou v\u016fbec podporov\u00e1ny\n<\/li>\n<li>u\u017eivatel\u00e9 vlastn\u00edch sestaven\u00ed Firefox ESR na firemn\u00edch po\u010d\u00edta\u010d\u00edch, kde nen\u00ed mo\u017en\u00e9 povolit telemetrii\n<\/li>\n<li>u\u017eivatel\u00e9, kte\u0159\u00ed pou\u017e\u00edvaj\u00ed proxy MitM, proto\u017ee n\u00e1\u0161 syst\u00e9m instalace dopl\u0148k\u016f pou\u017e\u00edv\u00e1 v\u00e1z\u00e1n\u00ed kl\u00ed\u010d\u016f (key pinning), kter\u00e9 nefunguje s takov\u00fdmi proxy\n<\/li>\n<li>u\u017eivatel\u00e9 zastaral\u00fdch verz\u00ed Firefoxu, kter\u00e9 nepodporuj\u00ed v\u00fdzkum\n<\/li>\n<\/ul>\n<p>Nem\u00e1me co d\u011blat s posledn\u00ed kategori\u00ed u\u017eivatel\u016f \u2014 ti by se m\u011bli ur\u010dit\u011b aktualizovat na novou verzi Firefoxu, proto\u017ee zastaral\u00e9 verze maj\u00ed v\u00e1\u017en\u00e9 neopraven\u00e9 zranitelnosti. V\u00edme, \u017ee n\u011bkte\u0159\u00ed lid\u00e9 z\u016fst\u00e1vaj\u00ed na star\u00fdch verz\u00edch Firefoxu, proto\u017ee cht\u011bj\u00ed spou\u0161t\u011bt star\u00e9 dopl\u0148ky, ale mnoho star\u00fdch dopl\u0148k\u016f ji\u017e bylo p\u0159eportov\u00e1no do nov\u011bj\u0161\u00edch verz\u00ed prohl\u00ed\u017ee\u010de. Pro ostatn\u00ed u\u017eivatele jsme vyvinuli patch, kter\u00fd nainstaluje nov\u00fd certifik\u00e1t. Byl vyd\u00e1n jako oprava chyb (<i>pozn\u00e1mka p\u0159ekladatele: Firefox 66.0.5<\/i>), tak\u017ee lid\u00e9 jej dostanou \u2014 pravd\u011bpodobn\u011b ji\u017e dostali \u2014 prost\u0159ednictv\u00edm b\u011b\u017en\u00e9ho kan\u00e1lu aktualizace. Pokud pou\u017e\u00edv\u00e1te vlastn\u00ed sestaven\u00ed Firefox ESR, obra\u0165te se na sv\u00e9ho spr\u00e1vce.<\/p>\n<p>Ch\u00e1peme, \u017ee to v\u0161echno nen\u00ed ide\u00e1ln\u00ed. V n\u011bkter\u00fdch p\u0159\u00edpadech u\u017eivatel\u00e9 ztratili data dopl\u0148k\u016f (nap\u0159\u00edklad data dopl\u0148ku <a rel=\"nofollow\" href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1549204\">Multi-Account Containers<\/a>).<\/p>\n<p>Tento vedlej\u0161\u00ed efekt se nepoda\u0159ilo p\u0159edej\u00edt, ale domn\u00edv\u00e1me se, \u017ee jsme kr\u00e1tkodob\u011b vybrali nejlep\u0161\u00ed \u0159e\u0161en\u00ed pro v\u011bt\u0161inu u\u017eivatel\u016f. V dlouhodob\u00e9m horizontu budeme hledat dal\u0161\u00ed, sofistikovan\u011bj\u0161\u00ed architektonick\u00e9 p\u0159\u00edstupy.<\/p>\n<p>\n<b>Lekce<\/b><\/p>\n<p>Za prv\u00e9, n\u00e1\u0161 t\u00fdm odvedl \u00fa\u017easnou pr\u00e1ci, kdy\u017e vytvo\u0159il a odeslal opravu za m\u00e9n\u011b ne\u017e 12 hodin po zji\u0161t\u011bn\u00ed probl\u00e9mu. Jako osoba, kter\u00e1 byla p\u0159\u00edtomn\u00e1 na sch\u016fz\u00edch, mohu \u0159\u00edct, \u017ee lid\u00e9 v t\u00e9to obt\u00ed\u017en\u00e9 situaci pracovali velmi tvrd\u011b a m\u00e1lo \u010dasu bylo ztraceno.<\/p>\n<p>O\u010dividn\u011b se to v\u016fbec nem\u011blo st\u00e1t. Ur\u010dit\u011b je t\u0159eba upravit na\u0161e procesy, aby se sn\u00ed\u017eila pravd\u011bpodobnost podobn\u00fdch incident\u016f a usnadnilo se napravov\u00e1n\u00ed n\u00e1sledk\u016f.<\/p>\n<p>P\u0159\u00ed\u0161t\u00ed t\u00fdden publikujeme ofici\u00e1ln\u00ed post-mortem a seznam zm\u011bn, kter\u00e9 pl\u00e1nujeme prov\u00e9st. Zat\u00edm se pod\u011bl\u00edm o sv\u00e9 my\u0161lenky. Za prv\u00e9, m\u011bl by existovat lep\u0161\u00ed zp\u016fsob, jak sledovat stav toho, co je potenci\u00e1ln\u00ed \u010dasovan\u00e1 bomba. Mus\u00edme si b\u00fdt jisti, \u017ee se nedostaneme do situace, kdy se jedna z nich n\u00e1hle spust\u00ed. Je\u0161t\u011b pracujeme na podrobnostech, ale minim\u00e1ln\u011b je t\u0159eba prov\u00e9st evidenci v\u0161ech t\u011bchto v\u011bc\u00ed.<\/p>\n<p>Za druh\u00e9, pot\u0159ebujeme mechanismus rychl\u00e9ho doru\u010dov\u00e1n\u00ed aktualizac\u00ed u\u017eivatel\u016fm, i kdy\u017e \u2013 zvl\u00e1\u0161t\u011b kdy\u017e \u2013 v\u0161echno ostatn\u00ed nefunguje. Bylo skv\u011bl\u00e9, \u017ee jsme mohli vyu\u017e\u00edt syst\u00e9m \u201epr\u016fzkum\u016f\u201c, ale to nen\u00ed dokonal\u00fd n\u00e1stroj a m\u00e1 n\u011bkolik ne\u017e\u00e1douc\u00edch vedlej\u0161\u00edch \u00fa\u010dink\u016f. Zejm\u00e9na v\u00edme, \u017ee mnoha u\u017eivatel\u016fm je aktivov\u00e1na automatick\u00e1 aktualizace, ale rad\u011bji by se ne\u00fa\u010dastnili pr\u016fzkum\u016f (mus\u00edm p\u0159iznat, \u017ee je m\u00e1m tak\u00e9 vypnut\u00e9!). Z\u00e1rove\u0148 pot\u0159ebujeme zp\u016fsob, jak pos\u00edlat aktualizace u\u017eivatel\u016fm, ale a\u0165 je intern\u00ed technick\u00e1 realizace jak\u00e1koli, u\u017eivatel\u00e9 by m\u011bli m\u00edt mo\u017enost p\u0159ihl\u00e1sit se k aktualizac\u00edm (v\u010detn\u011b bezpe\u010dnostn\u00edch oprav), ale odhl\u00e1sit se od v\u0161eho ostatn\u00edho. Krom\u011b toho by m\u011bl b\u00fdt kan\u00e1l aktualizac\u00ed mnohem reak\u010dn\u011bj\u0161\u00ed, ne\u017e je tomu nyn\u00ed. Dokonce i 6. kv\u011btna bylo st\u00e1le u\u017eivatel\u016f, kte\u0159\u00ed nevyu\u017eili ani opravu, ani novou verzi. T\u00edmto probl\u00e9mem se ji\u017e zab\u00fdvali, ale to, co se stalo, uk\u00e1zalo, jak je d\u016fle\u017eit\u00e9.<\/p>\n<p>Nakonec se zam\u011b\u0159\u00edme na architekturu bezpe\u010dnosti dopl\u0148k\u016f, abychom se ujistili, \u017ee poskytuje odpov\u00eddaj\u00edc\u00ed \u00farove\u0148 zabezpe\u010den\u00ed s minim\u00e1ln\u00edm rizikem, \u017ee n\u011bco pokaz\u00edme.<\/p>\n<p>P\u0159\u00ed\u0161t\u00ed t\u00fdden se pod\u00edv\u00e1me na v\u00fdsledky podrobn\u011bj\u0161\u00ed anal\u00fdzy toho, co se stalo, a zat\u00edm budu r\u00e1d, kdy\u017e odpov\u00edm na ot\u00e1zky e-mailem: ekr-blog@mozilla.com<\/p>\n<p>Zdroj: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"http:\/\/www.linux.org.ru\/news\/mozilla\/14982826\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430: \u0434\u043b\u044f \u0443\u0434\u043e\u0431\u0441\u0442\u0432\u0430 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u0435\u0439 \u0434\u0430\u0442\u044b \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u044b \u043f\u043e \u043c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043c\u044b \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043c\u043e\u043c\u0435\u043d\u0442 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0422\u0435\u043f\u0435\u0440\u044c, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e \u0431\u043e\u043b\u044c\u0448\u0435\u0439 \u0447\u0430\u0441\u0442\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430, \u044f \u0445\u043e\u0442\u0435\u043b \u0431\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u044f\u0445 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u0438 \u043e \u043f\u0440\u043e\u0434\u0435\u043b\u0430\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u0435. \u041f\u043e\u0434\u043e\u043f\u043b\u0451\u043a\u0430: \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0425\u043e\u0442\u044f \u043c\u043d\u043e\u0433\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-33377","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430: \u0434\u043b\u044f \u0443\u0434\u043e\u0431\u0441\u0442\u0432\u0430 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u0435\u0439 \u0434\u0430\u0442\u044b \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u044b \u043f\u043e \u043c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043c\u044b \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043c\u043e\u043c\u0435\u043d\u0442 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/tehnicheskie-podrobnosti-nedavnego-otklyucheniya-dopolnenij-v-firefox\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u0432 Firefox | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430: \u0434\u043b\u044f \u0443\u0434\u043e\u0431\u0441\u0442\u0432\u0430 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u0435\u0439 \u0434\u0430\u0442\u044b \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u044b \u043f\u043e \u043c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043c\u044b \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043c\u043e\u043c\u0435\u043d\u0442 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/tehnicheskie-podrobnosti-nedavnego-otklyucheniya-dopolnenij-v-firefox\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:52:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:52:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Technick\u00e9 podrobnosti o ned\u00e1vn\u00e9m vypnut\u00ed dopl\u0148k\u016f ve Firefoxu | ProHoster","description":"Pozn. p\u0159ekladatele: pro pohodl\u00ed \u010dten\u00e1\u0159\u016f jsou data uvedena v moskevsk\u00e9m \u010dase. Ned\u00e1vno jsme zme\u0161kali okam\u017eik vypr\u0161en\u00ed platnosti jednoho z certifik\u00e1t\u016f pou\u017e\u00edvan\u00fdch k podepisov\u00e1n\u00ed dopl\u0148k\u016f.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/tehnicheskie-podrobnosti-nedavnego-otklyucheniya-dopolnenij-v-firefox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u0432 Firefox | ProHoster","og:description":"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432\u043e\u0434\u0447\u0438\u043a\u0430: \u0434\u043b\u044f \u0443\u0434\u043e\u0431\u0441\u0442\u0432\u0430 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u0435\u0439 \u0434\u0430\u0442\u044b \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u044b \u043f\u043e \u043c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043c\u044b \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043c\u043e\u043c\u0435\u043d\u0442 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u044f \u0441\u0440\u043e\u043a\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/tehnicheskie-podrobnosti-nedavnego-otklyucheniya-dopolnenij-v-firefox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:52:15+00:00","article:modified_time":"2019-10-31T18:52:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33377","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 14:58:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:46:11","updated":"2026-01-21 14:58:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/33377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=33377"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/33377\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=33377"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=33377"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=33377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}