It scared the hell out of me! Are these guys losing their minds?
It was reported as a bug and the response thus far is indeed underwhelming for such a severe issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1424977
And this is the company we are supposed to trust? Because right now I feel like I trust Google more, and that's a lot to say.
> What's happening? Are you a fan of Mr Robot? Are you trying to solve one of the many puzzles that the Mr Robot team has built? You’re on the right track. Firefox and Mr Robot have collaborated on a shared experience to further your immersion into the Mr Robot universe, also known as an Alternate Reality Game (ARG). The effects you’re seeing are a part of this shared experience.[0]
EDIT: looking at this[1] comment, perhaps it's not a promo?
[0]: https://support.mozilla.org/en-US/kb/lookingglass [1]: https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...
https://www.reddit.com/r/firefox/comments/7jvm2t/this_lookin...
> No changes will be made to Firefox unless you have opted in to this Alternate Reality Game.
Also, from the same page for those that appreciate irony:
> One of the 10 guiding principles of Mozilla's mission is that individuals' security and privacy on the internet are fundamental and must not be treated as optional. The more people know about what information they are sharing online, the more they can protect their privacy.
Will they stop doing it? Of course not. I can't recall any time that this company has changed course in response to outcry.
The Mr. Robot series centers around the theme of online privacy and security. One of the 10 guiding principles of Mozilla's mission is that individuals' security and privacy on the internet are fundamental and must not be treated as optional. The more people know about what information they are sharing online, the more they can protect their privacy.
...which you've done by installing a fishy-looking addon without our permission and making us less likely to trust you?
Well-done, Mozilla.
The Extension actually does nothing, but invert (make them upside down) a few words on specific sites.
It's an experiment called "PUG ARG" to check whether page contents sniffing works. Its page doesn't reference any Bugzilla issue or Wiki page, while https://wiki.mozilla.org/Firefox/Shield/Shield_Studies/Queue doesn't list it.
The source code references https://support.mozilla.org/kb/lookingglass, which (as of now) only says "test - 12817".
The add-on tests whether specific words can be detected on sites; the current list has nice picks like "revolution" and "privacy". Of course, this is only a test, but in the future Firefox might look for specific terms in the pages you load and do specific things based on them.
The other thing it's doing is to send an extra header to three specific sites: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894.... I suppose the words and the domain are a reference to the Mr. Robot series.
The add-on describes itself as an "Augmented Reality Game Experience" and was made by a certain "PUG Experience Group": https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894....
Of course, Shield Studies are supposed to be a way of making "more informed product decisions based on actual user needs".
https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...
Sure `alert("FFFUUU WHY U NO WORK");` keeps you entertained for 5 minutes while you debug a problem but when that accidentally gets to prod...
Why are these turned on automatically? Plus, I turned mine off, and now they're back on again, with this looking junk installed.
What the heck Mozilla? What happened to caring about the users? We definitely can't trust Mozilla anymore.
I've been very loyal to mozilla over all these years but this really is not ok. If they keep doing shit like this I'll switch to a fork.
I think Mozilla should look into getting him back before they all end up losing their jobs.
The support thread links to https://support.mozilla.org/en-US/kb/lookingglass.
That page says, in a clearly delineated box,
> No changes will be made to Firefox unless you have opted in to this Alternate Reality Game.
PLEASE EXPLAIN THIS INCONSISTENCY.
Mozilla really needs to be more transparent about this kind of stuff.
That can't possibly be true. I had it installed, and I'm on my work machine using Firefox Developer Edition. I didn't opt in to any ARG.
Comments like yours are illustrative of a certain mindset. When you encounter the complexity of domains you are not intimately familiar with (court system, law, finance, etc), and those complexities are designed specifically to make it hard for you to protect yourself, I'm sure you are just as understanding as you are now.
The whole idea of slipping paid advertorial content into what are billed as "research" kind of gives the lie to this whole thing and is why I never turn these on in any product. Which is also why it's now "opt-out" by default, and why it will eventually not be an option at all. It's all for our own good, you see.
I know that you only need to need to turn off "install and run studies", but this has now cost Mozilla all telemetry data from me, and I encourage everyone to do the same.
That doesn't make it OK, but it would make me look at them with suspicion instead of hostility.
> Participation in an individual study is opt-in
Though I do see some people now claiming the addon got installed without them opting in. Probably a bug of some kind.
Tax-exempt non-profit (especially charity) status is very much about both how money is made and how it is distributed/spent.
Anyways, I've taken the opportunity to opt-out of Firefox.
> Participation in an individual study is opt-in
Source: https://wiki.mozilla.org/Firefox/Shield/Shield_Studies
If that didn't happen in this case, then I suspect it's probably a bug.
Of course not.
Mozilla can install extensions if you have "shield studies" enabled. They use extensions it to run UI studies and things like that. I think you have to opt-in to each study individually if you want to be part of it. Enabling the studies in your settings only means "notify me when there's a new study I can participate in".
See https://support.mozilla.org/en-US/kb/shield and https://wiki.mozilla.org/Firefox/Shield/Shield_Studies
Now they have partnered with Mr Robot to use the same feature to offer some sort of "Alternate Reality Game".
I merely challenge the notion that a nonprofit -- which proudly tumpets its benevolence and non-profitness -- should get a free pass for covertly installing advertising arrangements, just because they need to "make money".
Their charter and marketing is all about defending the internet from the companies doing shady things to make money, so they can't have their cake and eat it.
* https://news.ycombinator.com/item?id=15921134
This is a link to the GitHub issue:
* https://github.com/gregglind/addon-wr/issues/36
There are several scary things about this:
- Unknown Mozilla developers can distribute addons to users without their permission
- Mozilla developers can distribute addons to users without their knowledge
- Mozilla developers themselves don't realise the consequences of doing this
- Experiments are not explicitly enabled by users
- Opening the addons window reverts configuration changes which disable experiments
- The only way to properly disable this requires fairly arcane knowledge Firefox preferences (lockpref(), which I'd never heard of until today)
I guess that sounds slightly better than "Firefox and Universal Cable Productions".. oh wait..
At least it's an authentic immersion into the world of dubious computer ethics.
That's not a misconception I share. I understand Mozilla can and should make money to further its mission.
But unlike a for-profit, making money isn't the mission of Mozilla. So needing to make money can't be used as a justification for doing naughty things against the public good.
Wrong, as far as I see: Looking in my about:config, I see
app.shield.optoutstudies.enabled=true
browser.onboarding.shieldstudy.enabled=true
That means that the user must actively take steps to disable them, if he knows that they exist and where he can disable them.
Every time the user creates a new profile, and most probably also when he "refreshes" an old one, he has by default the studies allowed.
It's even worse in other aspects: through the UI the "Allow Firefox to install and run studies" can be unchecked but it doesn't change the value of "experiments.enabled" to false in about:config.
Apparently the "experiments" allow Mozilla to install the "experimental" extensions to any user, without him knowing. And these extensions are invisible in the GUI! Even if the user goes to the about:config and sets extensions.ui.experiment.hidden to false, it will be automatically set to true again.
That's a very important point to grasp, as I hear a lot of voices nowadays claiming that the modern security model (read walled gardens of all kinds) is the universal panacea.
Just the opposite, it brings a false sense of security making you more vulnerable. It also tends to inhibit a healthy and free market competition when a lot of potentially good software suppliers are gated off from the walled gardens from the start.
No, I had Firefox test pilot with `Video Min` addon, I was not prompted about he `Looking Glass` I removed all addons from Mozilla and their test pilot yesterday. There is only one thing that keeps me away from moving to Brave browser https://github.com/brave/browser-laptop/issues/3101
I hope they fix it soon so I can drop Firefox and their "mission". This is second time my Firefox got infected by Mozilla and their addons. A month ago my PC at work got infected with "Firefox Pioneer" https://news.ycombinator.com/item?id=15648179
Firefox Pioneer is literally a spy and tracking addon:
>Pioneer is an opt-in program that allows collection of richer data from Firefox.
I did not install it.
To put it another way - if I discovered a rootkit sitting in the ~/Downloads directory on my Mac, that would be a problem. If the entity that surreptitiously placed it there said that I shouldn't worry about it because it hadn't been run, I wouldn't be inclined to trust them.
Do Mozilla have no QC, or is it purposeful?
All these "but it's only an add-on [we foisted on you]", should just be a bullet point on the upgrade screen "we'd like it if you used this".
This is Microsoft level "customer" control, where they just ignore any chance the customer doesn't want something changing and go ahead, it's being treated now as Mozilla's browser not the users.
You are trying to muddy the waters here. Even if I were to accept your (wrong) explanations, they still don't jive with the image Mozilla is trying to project.
> Excited to share the launch of @mozilla @firefox Tiles program, the first of our user-enhancing programs
How hard is it to fork Firefox with all this stuff hardcoded off?
I've used FF since before it was FF, and I've installeded it on umpteen other people's computers; strongly advocating for it. Since they sacked that guy for not conforming to a specific liberal ideology they seem to have gone batshit crazy ... what happened? Was he their main privacy advocate or something?
I deliberately kept that enabled initially but if they're going to use it for Adware..
In contrast, if you do trust the data source, why is a walled garden model of security worse than alternatives?
The opposite is true: ads must be paid for, which makes products and services more expensive.
Ads are a convoluted, inefficient form of wealth redistribution; whether that's "good" or "bad" depends on the specific circumstances.
For example, we might (simplistically) say it's "good" when we receive something paid for by ad revenue, but the burden of paying for (e.g. by price increases) and being subjected to those ads is carried by others. For example, if we tune in to a radio station, listen to a song, and tune out before some ad for a product we don't use.
We could say it's "bad" when the opposite happens, for example if we pay higher fees for shopping on Amazon, which then get spent on advertising Prime Video which we don't use.
Could not think of anything worse a web browser could do.
Do they change political arguments on pages in the future to see how I react in a user study?
Signed Mr. Guinea Pig
Sounds like taking a shower without getting wet. I see you silently dropped the Pocket thing, then?
It's nonetheless not obvious to me why you were downvoted; I don't know if someone else was annoyed at your definition of "new" or whether there were other dubious claims in your comment. Perhaps privacy advocates are just too exhausted and cranky to explain themselves again.
It's possible: https://blog.mozilla.org/blog/2017/08/08/mozilla-information...
True, and that's why I never stopped and recommending Firefox since I first installed Phoenix. That said, they're already installing and enabling Cliqz by default (for some users), and that's no bug. So it's not absurd that people might assume this isn't either. Reputation is hard to gain and easy to lose.
Windows 10 sends telemetry by default? Microsoft is literally Satan incarnate! BURN THEM AT THE STAKE!!!
Firefox installs crapware addons without user permissions and signs them up to participate in "studies"? Shhhhh...it probably only an innocent bug, nothing to see here, move along now.
Everytime I turn this off, and restart FF it's on again.
58.0b11
It looks like Firefox auto-installs the studies though if you've enabled the feature. But it only activates the individual extensions for the studies once you've opted in to participate.
The extensions themselves need to be approved by a bunch of people at mozilla (at least for the normal studies). So I guess nothing bad can happen until you click "participate" or whatever they call it.
Still, I would also consider the notification itself to be an ad. This was obviously a bad idea and I don't want anyone to think I'm defending it. I guess they've chosen to abuse their shield studies for this because it's the only way for them to send notifications to the browser, but that's no excuse. I have the studies disabled anyway but now I'm not even going to consider ever turning them on.
1. I notice it yesterday, only because Avast was showing I have a low trust level Add-On installed in Firefox.
2. I googled it, and the first results was from Mozilla, showing it was part of their studies and experiment.
3. That was Ok, because I trust Mozilla, although somewhere in the back of my mind I thought every studies were supposed to be opt-in, since I have a few Add On installed in the week and I dont restart my browser, I thought i might have clicked it by mistake.
4. Now I am reading this through, I am more then worried. If I am reading the online comment correctly, Mozilla installed an Add On without user permission, enabled, collected data, and not for their own UX studies but a third party.
And to make the matter worst, that Add-On is now gone. It disappeared in my Add on Screen now I just check. Call me old fashion but that is not how i view privacy.
Like I said before, Mozilla's management and culture has a tendency of self destruction and messing things up right after they start being good. Still this is turning around much quicker then I thought.
If you must know why, I don't want promos for particular web properties in my browser. I find Pocket to be annoying conceptually (a service to help you carry around all the things you didn't and won't read—eww, no, no thank you), and I don't want to look at it every day. I don't want to have to Google to figure out how to disable it. I don't want my browser to come with nonsense I need to disable.
> You mean the single button that does literally nothing until and unless you click on it?
This must be the kind of mentality that leads people at FF to do silly things like mentioned on this thread, or having "just one button" for their acquired web property. That's the opposite of how great product minds think. Great product people think "how can I REMOVE this button?" Not "how can I get away with having it?"
Whereas studies collect usage data.
I've uninstalled Firefox and will be removing it from all of my computers. I had just started slowly migrating back to it with the performance enhancements in the latest update, but honestly I don't think I can get past a breach of trust at this level.
From what I've heard (I work for Mozilla), this is promo for Firefox. As I just wrote elsewhere in this thread: I believe the idea is that Mr. Robot fans use Firefox to participate in the ARG, not that Firefox users suddenly start watching Mr. Robot. So if anything I'd expect that Mozilla pays Mr. Robot for this.
Often these days I disable every "Help us with information" box, both on close/commercial software and even open source software. I mean I'd like the help the community, but I really no longer like submitting any type of tracking information or even debugging information. Everyone is already clamoring for my data, and I guess it's more of a mentality of I don't want to give it away for free. They already get so much for free.
I'll still file a bug report on bugzillas and compile stack traces on faults. But I want to do it myself, explicitly.
I can tolerate bugs, much more than I can tolerate sneaky app behavior. But I hope the statement about explicit opt-in will be repeated, and this will be explained.
At first I thought it must have been users that explicitly had opted in, but with so many users claiming they haven’t, it seems unlikely.
The next possibility is that preview versions have things opt-out instead of opt in (because in preview versions you need more data from users - typical for closed alphas etc) - but then this should be very clearly explained on download/install.
Fuck this shit, in the past months we had CliqZ https://news.ycombinator.com/item?id=15421708, we had Mozilla adding new telemetry, we had Mozilla force-enable toolkit.telemetry.enabled, we had Mozilla say that, if you download Nightly, that is considered opt-in to tracking, we had Mozilla put Google Analytics into the Addons menu (because it’s loaded from addons.mozilla.org: https://github.com/mozilla/addons-frontend/issues/2785 ), and we had Mozilla say that, if we don’t trust Google, we shouldn’t use Firefox.
Fuck this.
The main question is what behavior is being introduced. I haven't researched deeply, but apparently the add-on does nothing until the user opts-in on studies.
Except for:
Google Analytics being used on the Firefox Addons menu – solved by adding, in grey text on grey background, a tiny "Privacy Policy" link: https://github.com/mozilla/addons-frontend/issues/2785
Automatically sending URLs visited of random German Firefox users to a German company (CliqZ) owned by a publishing, advertisement and tracking company (Burda): https://news.ycombinator.com/item?id=15421708
Mozilla forcefully enabling toolkit.telemetry.enabled in Nightly and Developer versions, and, upon being asked, saying that "below the download link is a text telling you that by downloading these, you opt-in to telemetry".
Benefit of the doubt is over, it’s time to get the pitchforks out.
Firefox gets most of its donations from corporate sponsors. That's why the default search and switched back and fourth between Yahoo and Google; it's all about the amount of money they contribute for that. I'm not sure, but Pocket might be another example.
User contributions are actually pretty low. They don't go out and request them though like NPR or Wikipedia.
Downloading these builds is considered opt-in into telemetry, and toolkit.telemetry.enabled is hardcoded to enabled, the opt-out checkbox literally does nothing, I was told. And about:config confirmed this.
For now, yes. Until someone finds a way to push a "study" through which is not from someone "trusted".
> If someone distrusts their add-ons, why trust their browser at all?
Well, trust is rather simple to break, and this - remote installing things - was not part of my original trust I put in Firefox 1.0. I know things change. This is not one I tolerate, and you are right: I will not trust a browser after a step like this.
Besides the trust, it's unexpected data. Probably don't effect many on big data plans, and is probably a tiny extension this time, but it's still data I have not asked for.
Would be good UI to a.) disable the control b.) add a comment.
I want plain-text ads that provide just as much revenue to web sites but without obnoxious experiences and fat downloads.
Some people cry "free speech violation" but they can endorse a candidate, they just need to give up their tax privileges. This is why the ACLU is split into two parts. One you can donate to and get tax dedications for, but the other is their lobbying arm, and therefore cannot allow tax deductions for their donors.
Both are first-party. The difference seems to be that the dinosaur game keeps you entertained, where as this hopes to promote awareness of privacy/security.
https://twitter.com/dherman76/status/433320156496789504
> Excited to share the launch of @mozilla @firefox Tiles program, the first of our user-enhancing programs
The problem there wasn't just the idea of putting ads in the browser, it was also the way in which they tried to present it as a useful addition just like every other ad company tries to defend ads
It adds some css to a list of words:
https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894...
Sorry, but I'm uninstalling firefox. They have broken the basic trust I have in them as a user to not push arbitrary code to my machine against my interests.
Nobody is concerned about that, in my opinion. I'm concerned someone will push malware through Mozilla into Firefox installations. Pushing addon installs should not be possible at all.
Google does track a lot of my data but they provide useful services in exchange, and in addition they make it pretty easy to see what data they have on me. Also Google's data is its competitive advantage so our interest in protecting my data from 3rd parties is aligned.
In short, Google tracks me sure, but they're pretty transparent about it. I do think some of the things Google does with Chrome and it's market position is less than stellar so I'm still exploring other options. If you have any suggestions I'd be happy to hear them.
I have the pug experience study active and I don't recall the browser asking about it.
From the studies about page linked from about:studies...
"When a study is available, you will automatically be enrolled if you meet the criteria. There will be occasions where we might prompt you for participation first."
Just saw also that if you opt-in for the "Allow Firefox Developer Edition to send technical and interaction data to Mozilla" then it automatically checks the studies checkbox for you. I would wonder if I checked the allow sharing at some point in the past, or during installation, with no mention of the studies option. So it was presumed to opt me into the studies automatically.
I ended up going back to Vivaldi.
Why can't they just make a web browser that's... just a web browser? Chrome has never had buttons to email pages with gmail, record videos onto YouTube, share pages on G+ etc.
https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894...
(It defaults to "false.")
I haven't figured out how that setting is exposed yet. Maybe they expect people to go to about:config and change it? Is there video footage suggesting that in the TV show?
https://github.com/gregglind/addon-wr/blob/104-rename-less-v...
According to the Wiki page I linked in my previous comment, global settings shouldn't even matter in this case; since each SHIELD study must be opted into on an individual basis. (Or at least, that's how it's _supposed_ to work.)
Edit: Looks like the wiki was updated to state that some studies can be opt-out rather than opt-in. This also seems in-line with the documentation for SHIELD, which has a section on opt-out studies: https://normandy.readthedocs.io/en/latest/user/actions/opt-o...
If it is downloaded and listed without opt-in, but only actually invoked after opt-in, then I’ll call it acceptable (not great, but not terrible either)
They may be transparent about the fact that they're tracking you, but not about what they're tracking or when they're tracking it. And there's no way for you to find out because the vast majority of their software is not open source.
Do you have any evidence of this?
Assuming their normal processes for SHIELD studies were followed, a _lot_ of different people have to review the plugin before it gets approved: https://wiki.mozilla.org/Firefox/Shield/Shield_Studies#Who_A...
Edit: Also, the contributors list on the plugin's GitHub repo lists exclusively Mozilla employees: https://github.com/gregglind/addon-wr/graphs/contributors
Well maybe Safari, not because Apple wouldn't, but because they just don't care enough about ad revenue.
Chrome: They leech everything they can get away with, granted it goes only to Google, but you know it's just to feed their never-ending ad-revenue goal.
MS: They bypassed IE only ads, and went on to build ads into the entire OS.
1. Can you explain what you mean by "unknown Mozilla developers?" Unknown to whom?
2. Can you provide more detail on what specific configuration changes are reverted when opening the add-ons window? That sounds like a fairly serious bug.
3. What is the specific "this" you're trying to "properly disable?" You shouldn't have to dive into things like lockpref.
Mozilla (and other browser vendors) have the ability to push updates to their browsers outside of the normal release cadence. In many cases, these updates are distributed as add-ons, as they're cleanly separated from the rest of the browser internals, but that's just an implementation detail. If you visit about:support in Firefox, you should see a table of "Firefox Features," which are exactly that. Their source lives at: https://hg.mozilla.org/mozilla-unified/file/tip/browser/exte...
For example, we used a system add-on to control the gradual roll-out of multiprocess Firefox, and the New Tab page is also implemented as an add-on called "activity-stream."
"Well, I'm your bank. You already gave me authority to reinvest all your savings. Why are you mad now that I invested everything into bitcoin futures?"
What exactly does "trust" mean? We might have given mozilla such a widespread access exactly because we trust them not to abuse it. Stuff like this undermine that trust.
[1]: https://github.com/gregglind/addon-wr/graphs/contributors
This is clearly an abuse of a development/testing/telemetry tool to deliver an advertisement.
Trust is hard to win and easily lost.
I think for most people this is the stickiest point. Other commenters have said things along the lines of, "well if you trust their browser you should be able to trust their add-ons" and I do, mostly, trust their add-on here... but I really don't like how it slipped into my Add-Ons without telling me. For every other Add-On I have to click an explicit blue button, so I know what's in and what's out.
In today's landscape, Add-Ons have massive potential as security threats. For instance, would a savvy user who is security-aware (most users on HN, I assume) install an Add-On like Gmail Checker Plus[0]? Without digging in, it's hard to be 100% certain what this Add-On is and isn't doing with my Gmail content (I have no reason to assume anything nefarious, it's just an example). My browser Add-Ons should be off-limits to any sort of tampering without my permission, as well should be my bookmarks and auto-fill info. If I broke into your house and changed your bedsheets, you'd rightly be creeped out... nothing was stolen, new bedsheets don't affect you in any significant way, but it's still wrong and weird and hurts trust.
0. https://addons.mozilla.org/en-US/firefox/addon/checker-plus-...
>hey look, a voice of reason!
Where's official statement saying it's a bug and it will be disabled ASAP? All I see is Mozilla workers here trying to justity the "bug".
Mozilla has injected malicious-looking advertisement executable software into my process without my permission and then lied about it. I have no idea what this software is, what it does, or whether it is proprietary or free. I opted into nothing.
This is a huge, huge mistake by Mozilla.
But oh boy, do they have a talent for always doing benign and harmless things that look bad at first glance. It's almost like they want to turn away typical messaging board users.
By that definition, this would be unallowed modification of the computer of the user, and fall under the various hacking acts.
The more interesting thing is that this has also been rolled out to german government computers, which mostly used to use Firefox, but due to previous troubles with CliqZ and the Google Analytics in the addon menus, have already moved on to other browsers.
In a previous discussion, a Mozilla employee gave me as official statement that if I don’t trust Google, I shouldn’t use Firefox.
If I have to trust Google anyway, I can at least use the better browser.
Disclaimer: Until today, I’ve defended Mozilla in all such discussions, and kept the same PoV that you have presented here, but I just can’t do that anymore, when Mozilla is now just as evil as Google.
The addon itself does not advertise for Mr. Robot, Mr. Robot advertises for this addon.
I don't know how far we got with it, but one of the ideas was to serve a generic bundle of ads, and then select which ones to display locally, based on an entirely private, client-side analysis of the browser's history. Now, that probably shouldn't have been on the new tab page, and probably not in Firefox at all, but if ads are going to be the way we fund the Internet, then that sounded like the best possible outcome: better targeting without remote tracking. Heck, even Brave ran with the idea for a while: https://brave.com/about-ad-replacement/
mozilla is rapidly burning through over a decade of hard-earned trust and goodwill. i install firefox on other people's machines. i'm not a good user to piss off.
am i gonna have to wait for servo to mature and make an unmozillad servo? what a sad reality that would be.
this is not the browser we were looking for.
"Looking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience."
It doesn't matter who technically coded it. "Mr Robot marketing department" was obviously deciding about its existence, behavior and content -- if that description is true.
But looking at the source of the extension, I find the following URLs inside:
https://www.red-wheelbarrow.com/forkids/
https://red-wheelbarrow-stage.apps.nbcuni.com/forkids/activi...
So it seems it is some marketing, the question is which company now, and do they change?
Personally I build Firefox from source and maintain a set of patches largely based on these: https://aur.archlinux.org/packages/firefox-esr-privacy/
And no, they can't: In many countries there are regulations forbidding high-risk investments with regular savings accounts for exactly that reason.
Mozilla have presented "add-ons" as a line where users are supposed to be responsible for what to "trust", over and above the choice to install the browser in the first place. They can expect those users to be watching that line carefully.
(Incidentally, I would still dislike this functionality - moreso even - if it was in the browser core.)
Yeah, add-ons from Mozilla merits the same trust as the browser. But this cuts both ways, this stuff undermines my and probably more people's trust in the browser.
https://normandy.readthedocs.io/en/latest/user/actions/opt-o...
"opt-out-study: Install a Study Add-on Without Prompting
The opt-out-study action installs an add-on, typically one that implements a feature experiment by changing Firefox and measuring how it affects the user."
They are obviously the topic of:
app.shield.optoutstudies.enabled=true
That I mentioned.
I see a lot of commenters trying to excuse them. The problem is, people allowed the "studies" because Mozilla claimed that they are "measuring" whatever "to make Firefox better." They never told anybody that they are selling the "studies" functionality which silently installs ("opt-out" not opt in!) to the advertisers.
I don't know how anybody can defend such an approach.
I wasn't involved in its development, so I can't speak to its origin or the decision to use Shield for distribution, but I can gather feedback and answer technical questions about Firefox and the add-on.
If you're able to consistently reproduce the issue, please let me know.
How is that not what automatic updates are?
An appropriate response here would be to decide that you no longer trust their browser at all.
It's hard to quantify trust exactly. I'm fine with trusting the partly-closed-source Google Chrome build, including the proprietary Chromecast, Hangouts, etc., plugins, because I believe that the people writing them are generally reasonable. I don't have a good formal proof that they're generally reasonable people, and I never will - that's why it's trust. If they start installing marketing gimmicks, certainly they have the technical ability to do that, but I will lose my trust that they're reasonable people.
Here's an analogy: I trust a small number of my friends with keys to my apartment because I think they'll make reasonable use of that access. If they decide to show up at 3 AM with a keg and three tubas without telling (let alone asking) in advance, I technically have no grounds to complain that they abused their access - but I'll certainly not be calling them friends any more.
I would argue that since they knew you were giving them access on the assumption that they would not do things like that, you would have grounds to complain. Similarly, I installed Firefox on the understanding that it would not phone home with opt-out telemetry, advertise third party products, or syntergise with acquired properties. Mozilla has, in the past few months, done all three.
I like Firefox, though, so I'd rather kick the tubas out of Mozilla than go kick them off my individual installation. Does the public have any power over Mozilla's governance?
> Can you explain what you mean by "unknown Mozilla developers?" Unknown to whom?
Unknown in the sense that this extension wasn't documented at all, there was no Bugzilla issue for it and it's not clear whether it was properly vetted by QA. Whether you argue that this kind of silent push updates is good or bad, I think they aren't tested as well as in-browser functionality. This is a necessary consequence of "let's try it and revert if something breaks or people complain".
More so, a rolled back Shield study will be invisible to the users, so any problems will be impossible to debug. This is made worse by the fact that most, if not all Shield studies are opt-out, so the user won't be notified.
> Can you provide more detail on what specific configuration changes are reverted when opening the add-ons window? That sounds like a fairly serious bug. > What is the specific "this" you're trying to "properly disable?" You shouldn't have to dive into things like lockpref.
People have reported that extensions.ui.experiment.hidden reverts after viewing the add-ons list. I haven't tried it myself, but you can find details in that Reddit thread.
Others have noticed that the Shield studies checkbox sometimes (possibly on version bumps) reverts to enabled. I can't overstate how bad this is; it's basically cheating the users' trust. Lately, Mozilla has been doing some pretty nasty things for an organization that takes pride in caring about the privacy of its users.
Are you aware of the complaints regarding Windows telemetry? Edge, for example, sends full browsing history to Microsoft by default. Should Mozilla follow suit? Because that's exactly what Pioneer does and, while it's not opt-out yet, Firefox advertises enabling it.
As for the rest of the system add-ons, they're either poorly documented (if they are at all), poorly named ("Presentation"), or seem concerning from a privacy point of view (e.g. Activity Stream, Follow-on Search Telemetry, Photon onboarding, Presentation, Web Compat Reporter).
For anyone curious, Presentation seems to be an implementation of a proposed Web API that allows browsers to find and talk to devices in their neighbourhood. Does that include location/proximity beacons like this old proposal https://hacks.mozilla.org/2013/06/the-proximity-api/ ? Do users really want Firefox to tell advertisers where they're shopping? That's the same kind of "experience improvement" that the spyware of yore used to bring.
Why should Pocket be an add-on with superpowers? There was quite a bit of backlash over it a while ago, but Mozilla didn't budge, and some employees actually spread misinformation (not to say "lied"). And actually none of my system add-ons seems to be providing any important functionality (if you disregard the new tab page, for which I haven't seen yet a privacy policy). Looking at Shield studies ( https://www.jeffersonscher.com/sumo/shield.php ), it's even worse: most are surveys, advertisements, asking the user to enable Pioneer (i.e. send full browsing history to Mozilla).
No, it doesn't show PDFs or videos, but does that belong in the browser anyway?
It's disheartening when the update is a marketing tie-in.
If you're looking for a browser with first-class vim compatibility qutebrowser is outstanding.
I've also found palemoon to be a perfectly boring/stable/functional variant of firefox without all the drastic/breaking changes (vim plugins work quite well also)
Defining that as "spying" strikes me as a big reach. It's no more spying than (say) Windows observing what programs you use most and adding shortcuts to them in your Start menu. Software adapting itself to fit the user better is a good thing, as long as it's done in a way that respects the user's privacy, which keeping the data 100% local absolutely does.
Me, I keep it underground (qutebrowser at the moment) but I'm constantly in search of something better
1. Mozilla obtained specific legal / contractual protections around any data that we store in GA, as covered in this adjacent thread: https://news.ycombinator.com/item?id=15932224.
2. We did briefly run an experiment with Cliqz, but that integration was only ever offered to <1% of new, German-language installations of Firefox. I still need to read up on the technical details of that experiment, but it's misleading to claim that Firefox in general has any interaction with Cliqz.
3. As a Mozilla employee myself, I'd be very interested in a citation for that statement re: Google.
When it got popular, smart people started bending it to make being a dick possible, which is how we got the Web of today. I don't doubt the same would have happened to Gopher, if it had been the one to get popular.
Its startup is controlled by the addon/bootstrap.js file. Per line 22, it's completely inert unless the user manually toggles `extensions.pug.lookingglass` in about:config: https://github.com/gregglind/addon-wr/blob/59659431fd2a75c33...
Which requires that users trust Google.
The reason I use Mozilla products is exclusively because I do not trust Google. If Mozilla requires that I trust Google to keep my data safe (which Mozilla transmitted to them), then I have no reason to use Mozilla products.
> 2. We did briefly run an experiment with Cliqz, but that integration was only ever offered to <1% of new, German-language installations of Firefox. I still need to read up on the technical details of that experiment, but it's misleading to claim that Firefox in general has any interaction with Cliqz.
Mozilla also invested into CliqZ, and a family member of mine was affected by the experiment – I live in Germany.
https://news.ycombinator.com/newsguidelines.html
Edit: we've had to warn you a lot. Continuing to break the guidelines ends in bannage, so please clean up your act.
I've never quite understood what each Mozilla does, but AIUI, the Firefox development is all done by Mozilla Corp and the nonprofit does stuff like make those cute videos about how Firefox is going to save the world and make us all smiley and multiethnic.
I've talked to a number of Mozilla employees, and they also seem confused about the relationship between the corp and the foundation.
An art director and copywriter sat in a room together over two days and came up with lots of different ideas to generate PR for Mr. Robot. They presented the ideas to a creative director, who went through the work and picked the one he felt was most suitable. They presented it to the client, who supported the idea.
There would have been some line of communication from the creative agency, whoever owns Mr Robot, a media/PR agency and Mozilla. The idea was bought by the client, had the agency liaise with media/PR, got in touch with Mozilla with an undisclosed donation and the add-on was coded.
Mozilla's job is to find ways to push the web forward in ways that respect humans, and ads are, well, how the web mostly gets funded. So it's entirely within bounds for them to try to figure out ways to make ads work without invading people's privacy.
I've never quite understood how exactly does this financial arrangement work and I would be grateful to anyone who could explain this to me.
no, it is not, because i signed up for nightly a decade ago when mozilla still had my trust and admiration. i signed up to help mozilla find bugs before they hit end users. i signed up for new web platform features and bug fixes. i signed up to see the perf and ui improvements.
what i get force-fed now is an additional mystery platter of ad experiments, privacy erosion, forced third-party integration, random auto-addons and who knows what else at this point - they can literally push anything behind my back. the absence of all of these things is the exact reason i have stuck with firefox. i guess this relationship is not meant to last.
as another comment says in this thread, it's literally the "Windows 10 of browsers". Want faster perf and more security? Just sign up for the next version with more ads, less privacy and random third party services we auto-push to you. I know Chrome does this too, which doesnt make it ok for mozilla - it just leaves me with 0 options. if i had other viable options, i would leave quietly and never post this comment.
https://mozilla.github.io/shield-studies-docs/study-process/
You mean like the TOS and EULA you agree to when you install the browser? That would qualify as "expected by the user" and "explained in plain text" both.
2) Users are justifiably concerned.
3) Mozilla explains that the add-on is actually anodyne; the developers responsible were having fun with an opt-in research service.
4) Some users try to justify their initial overreaction by painting Firefox as mysterious, dangerous entity, fabulating conspiracy theories about one of the most forthright and open OSS companies in the world.
Really, guys. If Mozilla was hellbent on invading your privacy, do you really think they would proudly entitle their tracker "Looking Glass". Or would they call it debugservice_1223?
Then some marketing people both in and outside of Mozilla push something that is probably not passing the same strict reviews.
It points to the organizational problem in Mozilla.
Re: "not sure": don't worry, some people do this not for the content but for the author, some lack reading comprehension and some just press the wrong button. Just vote yourself, and if you reply, say that you agree, don't mention the word you mentioned.
I happen to like text-only browsers for viewing HTML (e.g HTML tables), tcpclients like netcat for making TCP connections, and my own software for generating HTTP requests. Almost all websites work[FN1], with zero "loading time" as one may experience when using "modern" browsers to do these tasks. I can easily get the content I want (text, with option to download images, PDF, video, etc.) and skip the stuff I dont want. No autoloading of resources. I choose what I want.
Surprisingly, the web is actually getting more, not less text-friendly. Today I can often get text encapsulated in JSON, Markdown, etc. instead of wrapped in HTML, making parsing even easier.
There is heaps of Javascript written by others available on the web today but as a user I have little interest in running it. I would rather write my own.
FN1. "work" means I get the body the page that contains the content.
This isn't about what the addon itself does or does not do, it's the principle of force-pushing unwanted content without prior affirmative consent.
This would apply even if the addon was just a stub that didn't have any executable code in it. In this case, it's worse: an ad.
If any software developer would truely respect users, he would offer updates as seperate packages, where users can opt out of non-security ones- and those updates humanity votes with there feet against, vannish into the bin of useless software.
The extension is for shield study, when you install Firefox for the first time it asks if you want to take part in it (it is enabled by default though)
Hence, as you said, the only way is to trust Google here, without much ability to verify.
In my view, that sandbox is a trusted area between the browser and the user.
Mozilla has the privilege accorded to it as the developer of the browser, to modify the addon sandbox so long as they don't infringe on my interests, e.g., security, stability, privacy, speed.
For example, Chrome automatically disable extensions that ask for too many new permissions upon update. Chrome will also make it difficult to add extensions that are not listed on the chrome store.
If we remove the right for browser developers to install, uninstall and alter add-ons, then we're essentially forcing them to modify the browser instead, which is overkill for the add-on in question.
At the end of the day, if you can't trust the developers of your browser, then you should install another one and disable add-ons entirely.
3.5 falls into 4.
The irony is that Mr. Robot is owned by Universal, a subsidiary of Comcast. So much for that commitment to net neutrality.
I agree that it seems like a crappy extension, and people should be upset about things being preloaded to their browser.
But there's a point here to be made, that if you're concerned about privacy at all today, you need to look at the settings of any software after you install it. It doesn't matter how much previous trust you have for the developers. This should just be default behavior so that any surprise is met immediately, and not after any damage it could perform has been done.
Some of the comments are mentioning IT managers banning firefox, those will be the same IT managers doing all the other pennywise/pound foolish things that make you try not to work on their team in the first place.
Maybe it’s actually good to put something scary sounding in there to raise awareness. It could help people understand that scary phrases are not the most common sign of foul play. When the real hackers come for you, they usually dont look scary at all.
One potential downside is that now people might not pay close attention to the installed addons. "Oh, must be some Mozilla thing", as GoldenDwarf quietly consumes user CPU cycles to mine cryptocurrency for someone else.
Security updates were and still are configurable to be installed after prompting, also when they are installed automatically I am notified that this has happened. There is also an implicit trust in the vendor that only security-related functionality should be changed in a security update.
[0] - https://dxr.mozilla.org/mozilla-central/source/browser/exten...
"In related news, unknown website developers can distribute programs and run them in your browser. Additionally, it's been determined that browsers sometimes download changed versions of themselves without your permission. Worst of all, we've determined that sometimes the program you download and run yourself on your computer does stuff it didn't say it would do!"
In all seriousness, I understand this is an important issue, and needs to be addressed, but we've obviously gotten to the point as a society recently where no news can't be played up for hype by pundits and commentators for their own benefit (and probably without realizing they are doing it in a lot of cases).
The whole way this is being presented (by many here, not to pick on the parent) as a new chunk of the sky falling is what I find really troublesome. No, chicken littles, the sky isn't falling, but there is some interesting shit going on up there that deserves a look.
I fail to see how getting half the people frothing at the mouth and the other half downplaying it just to try to keep some sanity in the discussion helps for a good outcome.
https://pbs.twimg.com/media/DDsLeqvV0AE1k-2.jpg
The hypocrisy is amazing.
Even though the add-on itself was innocuous, the context around its scope, delivery, and presentation were not what they should have been.
My main complaints are that it's not more useful, though with some tweaks, I've made it just that.
https://www.reddit.com/r/dredmorbius/comments/5x2sfx/pocket_...
It needs more help than just CSS, but that's a start.
Truthfully, this is why I use Safari. Apple makes money by selling me devices and services, Mozilla and Google are both driven by ad revenue. Even good actors within these companies are working within a framework where the customer is the product.
.. also Safari saves like 15% on battery.
The comment about the visibility of the add-on (Bugzilla, QA process, documentation, etc.) is well taken, as are those regarding the naming of system add-ons, Pioneer, etc.
I've got an intercontinental flight coming up soon, and I'll do some grepping around to try to understand the prefs mentioned. If someone else beats me to it and posts a specific set of steps to reproduce a pref flip on those, I'd appreciate it.
This looks like "let's give litte Perry and these marketing departments something to play, whatever, it's just an extension, who cares." So little Perry writes a description of the extension "MY REALITY IS JUST DIFFERENT FROM YOURS", the extension gets silently pushed to all the US users(!) (Firefox has support for that) who freak out, and the first response from somebody involved with that was "it was not supposed to be seen." You see, it was planned to keep the extension also "invisible" to the users -- Firefox has support that too! The extension was obviously not formally reviewed or formally tested, if the "invisibility" was the goal. Of course, it being "invisible" wouldn't be better. It's a misuse of the whole mechanism, compared to what Mozilla explained to the users. The mechanism was supposed to allow making "studies" from the behavior of the users who agree to take part in them. Instead, it was an attempt to a "viral ad" that was delivered to the whole Firefox using US population. There are multiple wrong decisions in this story.
Now I hope Mozilla does get the idea that the users do care.
https://techcrunch.com/2017/12/15/mozillas-mr-robot-promo-ba...
https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-...
Also AFAIK the second link has the first official response of any kind? "A representative told Gizmodo the company is looking into the issue."
I'm using Firefox 57 heavily (typing this in it), and actually really like it for a change. This after years and years and years and years of wanting to like Firefox but finding it completely and absolutely unusable due to performance issues.
(Chrome has been ... faster, but insanely aggravating in all sorts of ways, including utter and complete contempt from Google and the Chrome devs for users. The frustrations are rapidly mounting.)
Mozilla have just cost themselves some portion of their advanced user test base through abuse of trust. I really wish they'd not do that.
If you asked me "where would you go to change settings to prevent the browser from violating your privacy and infringing on your security?", then, yes, I would go to "Privacy and Security". If, however, you asked me "what would you expect to find under 'Privacy and Security'?", my answer would be that that's where I would go to protect myself from malicious websites, not from malicious browsers.
(I know that 'malicious' is quite, and almost certainly too, strong here, but the point is that I think, and am explicitly encouraged to think, of Mozilla as being on my side against the sites I visit, and I don't think it's natural to expect that I will start thinking of how I need to protect myself from Mozilla to use their products in the way that I, rather than they, intend.)
“Firefox worked with the Mr. Robot team to create a custom experience that would surprise and delight fans of the show and our users. It’s especially important to call out that this collaboration does not compromise our principles or values regarding privacy. The experience does not collect or share any data,” Jascha Kaykas-Wolff, chief marketing officer of Mozilla, said in a statement to Gizmodo. “The experience was kept under wraps to be introduced at the conclusion of the season of Mr. Robot. We gave Mr. Robot fans a unique mystery to solve to deepen their connection and engagement with the show and is only available in Firefox.”
This is horrible. They pushed out this crap under false pretenses as a study and obfuscated it. Don't talk the ethics talk if you're not prepared to do the ethics walk.
2) you freak out. Who is this guy? I didn't invite anyone last night!
3) The guy turns around and it's just your mate Chad. He didn't mean any harm, just wanted to watch TV and hang out.
4) This is not on, Chad is a psycho.
Intentions don't really matter: they've just demonstrated a scary and invasive capability without any warning. Minimizing it doesn't help.
We have people comparing the installation of a near-stub browser add-on by the browser vendor, to full-on home invasions.
The language was a mistake and should have not been pushed out, or maybe even written to begin with. Mozilla ought to remember how skittish their userbase can be.
Nothing I can do about it. Can’t argue. Trust is very, very easily lost and incredibly hard to regain. And it can hit innocent third parties. It’s very, very wrong to do anything that could destroy trust.
I do not trust mozilla, they've repeatedly proven they cannot be trusted. I do not trust firefox, because a piece of software is open source software does not mean it should be trusted.
Firefox is bleeding market share and has been for a while. Despite this, revenue and profit is at an all time high for mozilla which is weird as the revenue comes from sending theirs users to google for being profiled and exposed to ads. Meanwhile long time users lose faith and trust in mozilla and firefox.
Not exactly the best time to be caught having "a little fun" move showing that they will sneakily install stuff in your browser without asking.
Then again mozilla is "making far-reaching and very short-sighted decisions in a vacuum."[1]
[1]:http://forums-test.mozillazine.org/viewtopic.php?p=14736466#...
Same here for looking glass, we do not want corporations to be in control of our stuff. Mozilla showing that they have built the capacity to auto install addons into your browser is quite the issue, you can rest assured that some are already working on ways to abuse this.
That they have done it as a promotional marketing trick and not or something useful or serious sends the wrong kind of message on top of it.
I would not want it to have this kind of power as the security patches and critical updates are provided by the kind people managing the distro repositories, and if it could update itself it would remove the third party patches required because mozilla has been refusing for 15 years to integrate correctly in my desktop environment but did integrate in the main competitor.
Chrome 54.98%
Safari 14.79%
UC Browser 7.98%
Firefox 6.09%
Internet Explorer 3.88%
Opera 3.79%
At that point, it’s probably better to just stop feature development and do nothing but security patches, which of course will lead to stagnation and which will also lead to fragmentation as many more incompatible releases of the same software will be out in use.
This will make it even harder for developers to adapt new technologies. Imagine how bad the already messy caniuse.com would look when every single browser version would be supported forever and could be individually configured feature by feature.
Especially as people somewhat versed in technology (I think it’s safe to call HN audience that), I think there is advantage in going with the flow and adapting to new releases and UI paradigms.
Otherwise we'd still be running on DOS and us developers would still have to support it.
Relevant XKCD: https://xkcd.com/1172/
For exemple australis and classic theme restorer.
Serving ads is never a good idea, and no, ads are not the way we fund the Internet, commercial ads is what is destroying the WWW and the Internet.
https://www.theatlantic.com/technology/archive/2014/08/adver...
https://thenextweb.com/eu/2017/06/09/pirate-bay-founder-weve...
even so to briefly chase your point, do you believe they are doing net good, and some things are looking more positive, like the servo work? my only point is that criticism works on a relative scale. i agree there are things they could do better, but i still prefer they exist.
who knows, you may totally change my mind, but as it stands it makes it difficult to disagree or agree with you.
Exactly.
> "The experience does not collect or share any data," Jascha Kaykas-Wolff, chief marketing officer of Mozilla, said
Looking in the sources of the extension, it adds additional HTML header to every HTML request to https://www.red-wheelbarrow.com/forkids/ pages. The activity of the users there could of course be tracked and the data dependent on the extension being active collected. Good try Mr. marketing officer of Mozilla delivering Mr. Robot ad using the mechanism for the "studies."
> "Firefox worked with the Mr. Robot team to create a custom experience that would surprise and delight fans of the show and our users."
Obviously fail. Surprise, yes. Delight? No.
[1]: http://weboob.org/
Having fun at whose expense, though? Widely deployed platforms used for extremely sensitive, personal materials shouldn't be subjected to "for fun experiments". That's the height of unprofessionalism.
What if the add-on had a bug, or an unintended side effect? Come on.
Also, data caps mean people will use less data, meaning using less bandwidth, meaning ISPs will have less of an incentive to upgrade their already ancient infrastructure. It would be giving them more money to use less of what they provide.
I opted into FF telemetry and "studies" with the understanding that some extra data would be collected and experimental features or specialized debugging tools might get pushed to my browser (like the last "study" I saw for collecting JS errors).
This addon is none of those things. It is an advertisement. Call it an "alternate reality game" if you like, but it's an advertisement for a television show. It has nothing to do with making FireFox a better browser.
Using the Shield Studies program to deploy extensions and advertisements that have nothing to do with the original stated purpose is an abuse of the tool and a breach of trust.
That's all aside from the fact that there's been numerous reports of people receiving the addon who never opted in to Shield Studies in the first place.
No they can't, despite mozilla removing the option to prevent this, I have an extension preventing website to run code in my browser without my permission. it happens to be one of the most popular firefox extension: noscript. (also umatrix and request policy).
No the browsers do not download changed version of themselves, they do not have the administrative permissions required to install programs on my box. I get my update from the official distro repository on my terms.
I do not download and run programs, they come from the distro repository. This is a matter of trusting the package maintainers but up until now this has served many people well.
It seems you guessed wrong and it does not work the same for everybody, some of us have chosen to take the extra step required for this kind of misadventure to be unlikely.
Even if it's ostensibly about ideals I might agree with, this was a very poor decision and a breach of trust.
@gregglind re-add 'fuck' to the word list
gregglind committed 3 days ago
It has been praised for its technical accuracy, basically the show warns us about exactly what mozilla did as this could be exploited to hack into computers.
Actually they do not. their revenue is at an all time high despite the market share reaching an all time low.
https://www.cnet.com/news/mozilla-revenue-jump-fuels-its-fir... https://www.computerworld.com/article/3240008/web-browsers/m... https://www.ghacks.net/2017/12/02/mozillas-revenue-increased...
You've conflated third party javascript with javascript in general. You can turn off javascript entirely, but unless you do so, that website is generally able to ship javascript to you as included scripts from the same domain or in a script section or inline with attribute handlers.
> No the browsers do not download changed version of themselves, they do not have the administrative permissions required to install programs on my box. I get my update from the official distro repository on my terms.
Yes, they very often do. Currently, they generally ask if you want to restart using the new version and give you that choice, but they are often downloading newer versions of themselves ahead of time to speed up this process.
Whether they have permissions depends entirely how you installed the application. If it wasn't installed globally, user permissions are all that is needed.
> I do not download and run programs, they come from the distro repository. This is a matter of trusting the package maintainers but up until now this has served many people well.
Good! I hope you've also never ever piped wget output to a shell for some application's quick installer. I also hope you've never installed any programming language module through that language's package manager and not your distro's package system, because those are notoriously bad at making sure there's not holes through which bad stuff can happen either.
Regardless, it's possible that the package you downloaded, no matter the source, can do something other than stated.
> It seems you guessed wrong and it does not work the same for everybody, some of us have chosen to take the extra step required for this kind of misadventure to be unlikely.
Actually, I don't think I guessed wrong because I wasn't guessing anything, and I never said it works the same for everybody. I believe, since I was careful to qualify my statements, that each is easily proven correct, and I've done so.
The whole partnership with google to put its search engine as default is about enabling google to profile firefox users and shows them ads.
I'm not sure mozilla even gets a significant amount of donations compared to their commercial contracts.
+1 for mentioning Otter though - those guys are doing amazing work
And money it makes, in the hundred of millions, for serving its users to the worst known worldwide privacy offender, collecting and profiling user to sell advertising.
The "good" non profit charity foundation is governing the "evil" for profit corporation giving away users to the worst opponent of the mission of the charity. Quite a contradiction in this.
The world doesn't need another browser that sacrifices principles for market share. Chrome, IE, and Safari are perfectly good browsers for that. What I wanted was a browser (and software in general) that promotes security, privacy, open standards, and open source. You can accuse me of misinterpreting the situation, but that's what I thought Firefox was 10 years ago. It's not what Firefox is today. It's turned into just another organization that's optimizing for the continuation of the organization over it's own founding principles.
They actually called it telemetry, but IIRC in the early firefox version it was a proprietary extension (I don't remember the name) which spurred the gnu iceweasel into existence to provide the browser without the proprietary spying extension.
I worked at Mozilla for about four years (2011-2015), on MDN. It's built as a wiki, with wiki features open to everyone. The code is all open source and on GitHub. Its issues and tasks and roadmap are tracked in a public bug tracker. We operated in a public IRC channel. We didn't have to do that. We could have just built something targeted to only be used by the technical writing staff at Mozilla, and never bothered to open it up or make the code available or make it transparent about who wrote articles and when. In fact, it's much more work to do all the things we did (and not just in terms of implementing features, but also in terms of dealing with spammers and trolls and other malicious people who wouldn't have had access in a less open system), but we did it anyway because Mozilla is a radically open and transparent organization. But... in four years, not many people from outside Mozilla ever joined in and got involved with actually contributing (either code or articles or edits to articles or housekeeping or suggesting/arguing for ideas of how to improve MDN).
And I've been doing open source for much longer than that, and I see exactly the same pattern: a handful of folks do all that work, and go to the trouble of being open and transparent and providing ways for people to see what's going on and get involved... but people don't.
And then those same people willingly install the software and use it every single day, and complain that they were never consulted, or never got a chance to review, or never got to provide input. You had chances to look at the source code, to see what was being checked in, to read the referenced Bugzilla bugs on commits, to leave comments on them, to submit alternative ideas. You didn't. You did install Firefox, though (assuming your claim is correct that this was installed on your computer). By installing the software while not participating in the process, you absolutely gave your "review" of it, and your "review" was "just make a browser for me for free and don't bug me about how".
Now, if you want to be involved, go start watching Bugzilla and the Mozilla project wiki pages, and CC yourself on stuff and join mailing lists. Because it's Mozilla. You can do that. If you don't want to do that, or you don't think it's worth your time to do that, then don't do it. But don't then come charging onto HN to complain that nobody consulted you. People practically got on their hands and knees and begged you to join in the process of making Firefox and other open source software, and you decided not to.
Actually talking of good/bad dichotomy is inappropriate here, automatic updates are a tool that can be useful and comes with benefits and downsides. Firefox automatic updates is among the first things I disable when I install firefox because it caused me more issues than it solved.
Starting firefox to discover it has auto-updated itself and had broken half the extensions you rely on to make the browser usable is not nice, specially when there are no option to undo the update other than removing and reinstalling.
But when the autoupdate installed a new firefox that simply broke audio in the browser and now forces you to install something you've been actively avoiding or that is not available in this specific distro is something else.
I have a working update hygiene I'd rather deal with updates myself, thanks.
> I, for one, would rather trust the goodness of Mozilla's intentions than Google's or Microsoft's.
Me too, but when a company bases his reputation on a certain platform ("we will not spy on you, your privacy is important") and then stuff like this happens (and it's not the first time, not even this year), it shakes one's belief in their trustworthiness.
Features
Disabled Encrypted Media Extensions (EME)
Disabled Web Runtime (deprecated as of 2015)
Removed Pocket
Removed Telemetry
Removed data collection
Removed startup profiling
Allow running of all 64-Bit NPAPI plugins
Allow running of unsigned extensions
Removal of Sponsored Tiles on New Tab Page
Addition of Duplicate Tab option
Locale selector in about:preferences > General
I also recommend waterfox instead of firefox.
[1]: https://addons.mozilla.org/en-US/firefox/addon/privacy-setti... [2]: https://www.waterfoxproject.org/
network.websocket.enabled
network.IDN_show_punycode
dom.event.clipboardevents.enabled
dom.storage.enabled
dom.indexedDB.enabled
dom.battery.enabled
dom.enable_user_timing
dom.enable_resource_timing
dom.netinfo.enabled
layout.css.visited_links_enabled
browser.safebrowsing.phishing.enabled
browser.safebrowsing.downloads.remote.enabled
browser.safebrowsing.malware.enabled
browser.send_pings
beacon.enabled
privacy.donottrackheader.enabled
privacy.trackingprotection.enabled
dom.enable_performance
datareporting.healthreport.service.enabled
datareporting.healthreport.uploadEnabled
toolkit.telemetry.enabled
toolkit.telemetry.unified
media.peerconnection.enabled
media.peerconnection.ice.default_address_only
media.peerconnection.ice.no_host
media.eme.enabled
media.gmp-eme-adobe.enabled
webgl.disabled
geo.enabled
camera.control.face_detection.enabled
device.sensors.enabled
security.tls.unrestricted_rc4_fallback
security.tls.insecure_fallback_hosts.use_static_list
security.ssl.require_safe_negotiation
security.ssl.treat_unsafe_negotiation_as_brokenI'm asking because debian and backports are doig exactly that: separating security patches from the rest, not for a browser but for a whole OS and every applications including firefox.
also this xkcd is not relevant. the point here is that mozilla has quite a history of breaking userspace earning them the reputation of "making far-reaching and very short-sighted decisions in a vacuum."[1]
[1]: http://forums-test.mozillazine.org/viewtopic.php?p=14736466#...
The whole thing is still suspicious: it was delivered to everybody whereas if it was supposed to be used only by the users who are aware of it, as now Mozilla tries to spin it, i.e. only to those who decided to "play the game", then the hidden install, especially to every user, was unnecessary as the normal extensions to Firefox are easily installed by the user, a click or two are enough:
https://addons.mozilla.org/en-US/firefox/addon/tabby-cat-fri...
https://andreasgal.files.wordpress.com/2017/05/alldevices-e1...
That all versions of firefox combined barely do better than obsolete unsupported browser that the manufacturer actively try to remove from the market is not a good sign.
If you are the good guy then your enemy is the bad guy but from the bad guy point of view he is the good guy and you are the bad guy.
No one is ever the bad guy in the movie of her own life.
servo, or whatever else they could come up with will never reach a net good for me as I need ALSA support and the extensions mozilla has dropped to make firefox useful to me.
I would rather have them disappear so there is room for something better to exist in its place. Right now there are occupying space and prevents an alternative to emerge.
The sad part of this is that by accumulating blunders, near sighted and far reaching decisions, with their attitude of not caring about user feedback or user freedom of choice they managed to turned me, a long time supporter (since netscape times) that has based part of my business on their browser, against them and wishing they would go away. This is quite a feat in itself. I'm not sure there is another entity that managed to alienate me that much, not even canonical or gnome.
https://research.mozilla.org/mixed-reality/
I'd charitably call it "Augmented Memory", but it's definitely not "Augmented Reality".
And I'd hardly call it a game, just a parasitic advertising gimmick that slows and bloats the browser. It just injects a bunch of JavaScript code, DOM elements and CSS effects into every tab.
There's really no game there, and it's pretentious to call it an "Alternate Reality Game", which is defined as "intense player involvement with a story that takes place in real time and evolves according to players' responses":
https://en.wikipedia.org/wiki/Alternate_reality_game
This extension just wraps all occurrences of a set of keywords (now including "fuck") in a span with some css animations and a tooltip that links to their web page.
https://github.com/gregglind/addon-wr/commit/da464ac8f1c3b08...
But in terms of memory usage, CPU and battery consumption, it's not that small, either.
It injects a blob of CSS and some JavaScript into every tab, then it does a regular expression search of every text node on each page, filtering out everything but paragraphs, then for each occurrence of a keyword in the text, it creates a new text node to split the current text node, then inserts a new span element between them, containing its own text node, then it creates an additional tooltip element containing six text nodes, five br elements, and one anchor element linking to https://support.mozilla.org/kb/lookingglass , and it also configures css class names to associate all those new nodes it created with the blob of css styling and animations that it injected.
This extension isn't the best example of their technology for Mozilla to be promoting and distributing, if they're really serious about delivering a fast memory efficient browser.
To quote an ex-mozilla employee:
""
Because the Mozilla Foundation is a nonprofit corporation, it has a specific legal purpose for existing spelled out explicitly in its articles of incorporation: "The specific purpose of the Corporation [here meaning the Foundation] is to promote the development of, public access to and adoption of the open source Mozilla web browsing and Internet application software." If Mozilla Foundation were to ignore this mandate, it would jeopardize the nonprofit, tax exempt status of the foundation
""
In this case they are definitely ignoring the mandate, and this should never remotely have happened.
Source of the legalese: https://static.mozilla.com/foundation/documents/mf-articles-...
This was not an automatic update, it was an installation.
You don't see the difference between a built-in game (included in the installation of Chrome) vs. Mozilla pushing an add-on to a Firefox installation using a channel meant for helping to improve the browser?
...why imagine? That's life as a Windows/Linux/Android dev. (Apple is sort of a stand-out because it has vastly fewer installable parts and less versions in the wild such that it's actually possible to test every patch level of every supported version of macOS or iOS at any given time).
But none of that makes push updates right or wrong. The reality is that it's less of a push than it is a pull anyway - in this case the client is asking for updates on an interval, and the server says "yep, there's one for you." The client grabs it and installs it. And it's turned on by default because, for the most part, that's the right thing to do for your users: you'd rather them be on the newest patch level. Hell for IT admins though, which is why it's almost always a feature they can disable at will.
So here's where this case differs: it's an "experiment" that's actually just marketing trash pushed through the "experiments" channel which is also armed by default, rather than a security or product update (which anybody reasonable can argue should be on by default - secure by default is the goal, after all). The only "experiment" in this case is seeing how many users will put up with Mozilla continuing to pimp out Firefox to the highest bidder as a grab for a new revenue stream before they reluctantly switch back to Chrome.
And judging by the backlash on patches like this one, it's not going so well...
The problem is that Mozilla is a good company, that has had a true net positive effect on the world, especially in tech, and continues to do so today with wonderful projects like Rust etc.
If Mozilla were a shitty company, we could all simply dismiss Firefox and get on with our day. But Mozilla is not a shitty company and the fact they keep shooting themselves in the foot like GP said, the fact they are completely out of touch with their userbase, that they cannot see the OBVIOUS problems with this addon even after the Pocket debacle, is ridiculous.
I'm not sure I agree the web is getting more text-friendly.. it is getting more JSON friendly, mostly, but actually visiting web-pages where JS isn't required is becoming increasingly rare. I've yet to find a text/console browser that can actually run JS. (I know there have been some experiments, but none that actually work last I checked)..
> Shield Studies are available on all channels. Individual studies can be opt-out or opt-in and any and all data being collected will be declared openly. After confirming willingness to participation, a self expiring add-on will be installed on the user's machine.
Mozilla is only installing an experimental feature ass an add-on if they opt in.
As for all these browsers, all of them(unless I'm mistaken) are based off of one of the big 3(Chrome, FF, Safari) so you still have to trust the big 3 to run these, for the most part, as they are all single-developer or maybe a very small team, and would be very hard pressed to catch underhanded attempts from any of the big 3 to embed any nastiness.
However, when you decided that the source code I could review would be installed on my computer without my consent, then I do object. It's my computer. It runs things that I choose to run on it, not things your marketing/sales department thinks my computer should run.
Additionally I find your rant about "open source is for all of us to contribute and if you don't shut the fuck up" wholly ridiculous.
But you're not going to do that. Which is your right; it's just hard to complain about not being consulted/not getting to review/etc. when you're talking about a piece of open-source software with public repositories and trackers. Anyone on earth is allowed to see what's going on in there.
I don't watch television, and I don't keep up with any popular modern shows. I had no idea what Mr. Robot was until looking through this thread, and the description text for the addon was, at first glance, suspicious. This was a terrible idea and isn't even remotely analogous to applying security updates automatically. If I have something I specifically installed, fine, I can expect those addons to be updated automatically. I don't expect them to side load something I don't even want. "Delight fans" my ass. You have to be a fan first, and I'm not even sure most people who are fans of Mr. Robot would think this is a particularly good idea.
Funny enough, the only thing I can think of that's even remotely similar to this is the "Hell, Dolly" plugin for WordPress, and that's installed out of the box as part of the distribution.
That said, I still use FF, but I do make sure I keep all the opt-in telemetry and stuff off, since it was one of these settings that "let them" get away with installing the add-on without consent.
Granted the add-on by default didn't do anything unless you enabled it, but still.....
If you now decide you don't want to run that software anymore, that's perfectly fine and is your choice to make. But arguing that you didn't have an opportunity to know what was going on or review code before it landed on your computer, when you installed Firefox by your own choice, when you decided not to take advantage of the radically transparent and open way it's built, is just not going to fly. You had a million and one opportunities to "review" the code you were going to download and run. You just chose to do other things instead. You seem to regret that, but you also seem not to have learned any lesson from it.
This has nothing to do with open source development at Mozilla or anywhere else, it has to do with what Mozilla the organization portrays itself as. If Facebook had pulled something like this, well, I don't think anybody would have been surprised. For Mozilla, I think it's inexcusable, and after the major marketing push on Quantum as 'Chrome without spying!' it's an amazing own goal. I really want Firefox to succeed, and marketing retards at Mozilla are going to sink the whole thing by garnering exactly the kind of publicity they don't need.
IIRC the person that advocated for Chromium (instead of a third-party Firefox rebuild) base it on performance (they were dubious Quantum is actually better, I personally find it fast enough except when loading Facebook), as well as the alternative versions of Firefox not keeping up with the official version. Also, supposedly Chromium (as opposed to Chrome) settings are reasonably privacy-friendly out of the box.
They did recommend installing uBO-Extra in addition to uBlock Origin on top of Chromium, which is revealing -- with Firefox, there is not even a need for uBO-Extra.
My original point (which I didn't elucidate clearly enough) is that this Looking Glass experiment is resulting in unwarranted backlash against Mozilla -- whereas from the standpoint of preserving an open web and protecting user privacy it's actually one of the better players.
Do I need javascript to accomplish any of these tasks? No. I am not interested in graphical web pages. I am interested in retrieving information, images, documents, sound files, video files, etc. I never need javascript to get these files, nor to read, edit or view them.
Simple example: I do not need a webpage full of javascript to view a YouTube video. I only need a video player (compiled without networking code).
Years ago, links added a javascript engine. Later it was removed. There is no point. A script can still consume inordinate amounts of RAM, even when there is no GUI. And for what? What is that javascript doing?
In the distant past, I recall browsers used to hand off media files to other programs, based on Content-Type (see article on MIME posted earlier today). Today, these external programs have been subsumed by the "modern" browser.
Perhaps modern browsers can be useful as offline image viewers, document viewers and media players. As I am in text-mode, the graphical browser is on another computer, connected via crossover cable or LAN. After inspecting their contents in text-mode, I transfer the documents and media files to a fileserver.
The decision to forgo using the so-called modern browser comes down to how important web design is to the user. If the user is interested in how fonts look, how a page of text is arranged, icons, styles, etc. and wants each and every website to look different, then the "modern" browser may be unavoidable. Probably javascript is needed to share in the web designers "vision".
The text-only browser OTOH makes all websites look more or less the same, regular, and if in text mode there is only one font, easy to read, IMO less eye strain on black background. It is perhaps better suited for the user that wants fast information retrieval, reliable, efficient file retrieval and cares little about graphical web design.
Vindication!
If they'd decided to sneak in a Mr Robot-themed easter egg I wouldn't really care. The fact that they decided to use a debugging/telemetry permission to push out a stupid marketing gimmick makes me question the judgement of everyone involved.
Much like some other situations in the political arena over the past 2-3 decades, I don't care that much about what was done but the decision to do it makes me question the judgement of people that I'm supposed to trust to make good decisions.
https://bugzilla.mozilla.org/show_bug.cgi?id=1423003
As you'll see, this bug is marked as private (at least as of writing this comment). So, as a matter of fact, it does not appear that even the most diligent user had the option of reviewing what's going on. So far, it has not even been disclosed who among the Firefox peers signed off on this change; that information appears to be private as well.
Doing someone online searching now, not seeing an explanation for it. There is one other HN post though, also mentioning it in a privacy context, but not further info either. :/
Every browser vendor has this control over you when you use their browser. Some have even more, because they don't even need to tell you about it when they're closed-source.
It's one flag, an entirely non-critical one at that, to either install this add-on hidden or not. It's not a major blunder to forget this once out of a few hundred times and it most definitely does not in any fucking way show that "the merge into production process is lacking a lot".
Absolutely no one would have minded, and there's no reason to either, if this would have been installed hidden.
You need to get the fuck down from those clouds and think about reality. Your comments are getting more ridiculous by the minute.
First of all, Firefox is a huge and complex project notorious for its legacy code and architecture. It's not a project that I would find pleasant to work on without getting paid. The only reason I might start working on it for free was if I wanted a job at Mozilla.
Second, it seems to me (as an outsider) that the biggest problem with Mozilla is its management. Any work I contribute to the browser will just be a feather in their cap, and they will still be making bad decisions that I can't meaningfully push back on. The solution for me then would be to fork the whole browser (which has already been done multiple times). However now I'm no longer working with Mozilla, I'm basically fighting them. Without paid, experienced engineers familiar with the Firefox codebase (or a PR budget), there's no reason to believe those forks can "win."
Third, Firefox is just so large that I could spend my whole life and have a negligible impact.
Fourth, as an outsider I'd always be "the wingnut who doesn't work at Mozilla." Perhaps if there were several companies sponsoring Firefox development, there would be more of a social place to fit in.
In conclusion, the state of the web today has left me feeling powerless. If I do nothing it's not necessarily because I'm lazy, but because I see nothing to be done.
https://github.com/Monsterovich/firefox-fuckpa
It seems like a lot of addons are being ported to the new apis too. Maybe you are too hasty?
* they can feed Chrome Sync data into their advertising databases.
* it means that they don't have to pay other browser vendors quite so much to make them the default search engine.
* they can take control over webstandards for their other profit-driven purpose.
* they can hinder the blocking of their ads.
Mozilla can't or chooses not to rely on any of these profit schemes, so they need other ways of making money.
The only way that the Corporation could do shenanigans, is by paying their employees higher wages than would be necessary to hold them or is considered reasonable for the job that they do.
It was set up, because there's limits to how much money a non-profit is allowed to put to the side, which would have limited Mozilla's strategic flexibility.
Forking a project, and adding features and removing pulls that you don't want and/or need is kinda the idea behind the whole 'open source' thing.. cause what else would you do with the source code, but compile it.
Speaking of Firefox, a build or two ago, without warning, Firefox deprecated (broke) every add-on. Because [insert-old-architecture-security-justification]. It's not like anybody was doing anything real with a browser anyway.
If your problem is with the actual _release_ version of firefox, that's a completely different complaint, and you have lots of choice in terms of getting the Firefox codebase but without some of the stuff that Mozilla feels is appropriate to put on top. If that's the level of control you want, then there are actually several options for you.
This is not hard. Don't automatically install stuff on your users' computers. You're defending something every other software company has found themselves in trouble for previously. I really don't understand why. The fact that Firefox is open source in no way excuses it.
But so does Mozilla. They're a big enterprise when it suits them, and a scrappy upstart otherwise.
The Mozilla brand is looking mighty shabby. Privacy is the one thing they've consistently pushed, and yet I can't recall any serious innovation or stance they've taken on recent years that actually puts their money where their mouth is.
Private browsing was invented by Chrome. Brave shields you from script bloat. Safari's adding machine learning to that end.
Which leaves Mozilla... pushing adware onto its users. Qué?
It's disingenuous to say that users should be able to intuit how it's all organized and how they can contribute, when something like this clearly only happens because of privileged first party involvement with real revenue attached.
Unless you're suggesting that anyone who wishes to spam a campaign to Firefox users can just get that done by opening up an issue and submitting a patch...?
There are distros, Void Linux (which I am using right now) for one, which ship without pulseaudio (or systemd for that matter) installed by default, thank goodness.
https://www.whatismybrowser.com/detect/what-http-headers-is-...
BTW: the extension we all talk about here has exactly this site that is used for checking the headers hardcoded inside, obviously in order for the developers to test their newly coded functionality with which they add an additional header entry in the request to some specific sites, specifically, the "main target" is a brand (I've given the link earlier on in this thread). It's obviously an advertisement for the US as that "main target" site is only meaningful to the US public. But it's obviously not the whole story.
If your language is not en-US it's worse than what I've understood.
This design decision is behind a large part of the performance improvement in 57.
Yes I'm sad, I lost some of my favourite addons as well. But this move was announced well in advance and it had a serious technical reason behind it.
In a difficult situation, Mozilla made a tough decision that is good in the long run and that benefits all its users. Crying "fork!" over it is so blind it leaves a bad taste in my mouth.
> So if someone forks over 1 change or 10 they are still libre to do it, or is that passe?
It's nonsense. Doesn't mean they can't do it, doesn't mean it's not nonsense. Furthermore, in some situations, forks can be harmful to the overall health of an already fragile ecosystem. They're not free of externalities.
Wrong (unless proven otherwise).
From the Shield Studies FAQ[1]:
> What data do Shield Studies normally collect?
> [...]
> Mechanism:
>
> - at STARTUP, SHUTDOWN, INSTALL, UNINSTALL, - send a `shield-study` packet containing the Unified Telemetry Environment.
As was stated before, users report that they have had this extension pushed to their browser without their prior consent to sending any telemetry data.
"## Observed data
- Possible page view counts on SUMO
- Possible page view counts (with and without the special 'enrolled' header) on Partner pages."
I've also already explained the "special 'enrolled' header."
The turning on was obviously either planned for some special moment, which wasn't the moment of that the extension was actually delivered, or the extension was accidentally delivered in the unfinished state -- doesn't matter, it provably didn't get enough scrutiny, see my other comments here for the details, the damage it actually done is regarding "tracking" less than planned, but regarding annoyance of their users probably more.
False dichotomy. I chose to opt into USER STUDIES because I trusted Mozilla. I use Firefox specifically because I do not want to use a browser from a company that makes its money off of advertising, meaning Chrome. I trusted Mozilla to hold to their word regarding what opting in to user studies meant, and they instead gave me exactly what I didn't want: advertising.
If your solution to this is to completely throw away my trust in Mozilla, replacing it with having to spend an extraordinary amount of time reviewing every wiki change, mailing list post, commit, and bug, then you're being ridiculous and showing extraordinary contempt for users -- especially the many users who aren't programmers. Firefox is supposed to be a browser that respects users, but this case shows that it doesn't.
Finally, I have both donated to Mozilla and helped resolve a bug, so I absolutely have participated in the process.
It also wont get any of the improvements mozilla is in the process of making so it will ultimately be slower and with fewer features.
Its also moronic to have a different update policy per app that is achieved in 35 different UIs.
This is the norm on windows because they were late to the party as far as a central source of software and further managed to make it an unattractive proposition and didn't get much buy in from developers.
Totally aside from the implicit security issue the ui flow is also terrible. Either each of 35 different apps runs their own update checker process in the background wasting your resources and prompting you at annoying times or when you run an app one out of n times it will prompt you to update whereupon you will ultimately have to stop doing whatever you were actually doing and let it update itself and restart.
It is truly amazing that people not only put up with this ridiculous situation but defend this as a feature.
Your system should periodically on a schedule you set update every piece of software you own and never bother you otherwise.
Studies are enabled by default.
I am genuinely astonished that somebody up the corporate tree at Mozilla thought this is a good idea. I mean, I get the appeal of getting the money and doing the cool IRL tie-in to the show, but that's not just how you do it. If I am a fan of a particular actor, I don't expect him/her to suddenly be in my bedroom when I come home one day. I would prefer to invite them first (if I am so inclined).
The trust here is specifically trusting them not to do such things. Which now has been violated. And the fact that CMO says anything else than "Man, did we screw up! We're so sorry, would never happen again!" is deeply sad and concerning.
Posts are being removed from bugzilla and threads being locked. The code itself comes from a random github repo, not affiliated with mozilla/firefox. (https://github.com/gregglind/addon-wr/)
https://bugzilla.mozilla.org/show_bug.cgi?id=1424977
people here were asking why normal process wasn't followed. No answer or links to resources.
another closed discussion here:
https://bugzilla.mozilla.org/show_bug.cgi?id=1425187
and here:
https://bugzilla.mozilla.org/show_bug.cgi?id=1425171
I appreciate your input as someone who knows the process, but this really wasn't followed this time.
edit: they've changed the repo now. so it's redirected to https://github.com/mozilla/addon-wr
So the only way this code would end up on my machine is one of two ways:
1. The Debian Firefox package is pulling code from Mozilla without the maintainer's review (which is definitely possible, given how complex Firefox is and how there's approximately one person packaging updates including timely security updates), which would of itself be seen as a serious problem
2. The Debian maintainer specifically picked up this code as part of the tarball from Mozilla, and shipped it without noticing (also definitely possible!) or decided it was worth including
For what it's worth, I do not have this plugin in about:addons, and Debian unstable hasn't picked up a Firefox update since December 1, so as far as I can tell the system is working properly.
I didn't install and run anything on your computer. I don't work for Mozilla.
And you installed a piece of open-source software whose source code you could have audited at any time, but you chose not to. You delegated the auditing to someone else, and now you're upset at what they chose to do with the power you gave them. You're free to complain that you don't like what they did, and not to trust them in the future, but you don't get to say that you had no chance to give input or to see what would run. You had plenty of opportunities for that and did not do it.
Firefox is not fully open source.
If yes, then why would it be necessary for me to audit anything?
If no, then PLEASE elaborate on why?
I don't think that actually is correct. The Mozilla Foundation is a non-profit, as has already been pointed out above. As such, they specify a mission and then are legally forced to invest all money that they make/get into this mission.
And in their mission statement, they specify that "Individuals’ security and privacy on the Internet are fundamental and must not be treated as optional." (Principle 4 in the Manifesto).
So, they cannot legally do shady stuff. And even if that means nothing else to you, the rule with law violations still is "Innocent until proven otherwise".
This isn't the first time a piece of software, open source or not, has released a new version that did something users didn't expect or were angry about. The sole difference is that, in the case of open source software, you have the chance to review what it will do by looking at its source code prior to running it. The fact that you didn't review it doesn't mean it was impossible to (that would be the case with a proprietary browser like Chrome).
By... paying attention to the source.
