23 ms·

Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

757 points by shak77 9y ago

shak77 9y ago
This is what it looks like: https://imgur.com/a/mriUw https://imgur.com/a/mriUw It scared the hell out of me! Are these guys losing their minds? It was reported as a bug and the response thus far is indeed underwhelming for such a severe issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1424977 https://bugzilla.mozilla.org/show_bug.cgi?id=1424977
- grawprog 9y ago
  >Are these guys losing their minds? Yes
  - shak77 9y ago
    I don't know what the hell is going on with Mozilla. Ever tried to install Firefox on Android? The new tab page is full of ads by default! And this is the company we are supposed to trust? Because right now I feel like I trust Google more, and that's a lot to say.
    - jhiska 9y ago
      We can't argue with your feelings.
      - shak77 9y ago
        Then these pages should not be full of feelings: https://www.mozilla.org/en-US/ https://www.mozilla.org/en-US/ https://www.mozilla.org/en-US/internet-health/ https://www.mozilla.org/en-US/internet-health/
        positivecomment 9y ago
        Could you please be more clear? I disabled all my extensions and still don't see anything there that is based on feelings?
        keb_ 9y ago
        I think they are feeling betrayed by Mozilla, and that they are saying language like "We all love the web" and "Internet for people" inspires feelings.
        jhiska 9y ago
        You could have asked me what I meant.
    - _e 9y ago
      To solve this "problem" on android, check this xposed framework module: http://repo.xposed.info/module/de.defim.apk.unbelovedhosts http://repo.xposed.info/module/de.defim.apk.unbelovedhosts
    - teekert 9y ago
      Adds are annoying yes, but they are only bad for your privacy if they track and profile you. Adds allow for free stuff and they can be done the right way. Granted this is becoming more and more rare so I understand your standard association of adds with distrust. The adds you refer to are non tracking (please tell me if I'm wrong though) and will slowly be replaced by sites you visit (often).
      - Karunamon 9y ago
        Ads abuse the user's time, attention, and privacy. Minus the tracking, that's still two factors of abuse rather than three.
        teekert 9y ago
        How do they abuse your privacy without tracking? Of course if they didn't abuse your time and attention they wouldn't make sense. But someone has to be paying Firefox's development, and it is not you. I'll take that last part back if you contribute to Mozilla. Hey, maybe it's an idea for a donation: make a 5$ Firefox without adds. I'd pay. To bad part goes to Google that way.
        makecheck 9y ago
        The irony is that people pay, just not to the right place. Every unnecessarily-bloated download tears through data plans and costs people money to their ISP that never makes it to the provider. I want plain-text ads that provide just as much revenue to web sites but without obnoxious experiences and fat downloads.
        palunon 9y ago
        > Every unnecessarily-bloated download tears through data plans and costs people money to their ISP Only in third internet world countries like the US... Elsewhere, we don't have limited data plans.
        9y ago
    - grawprog 9y ago
      No. Firefox was too big for my old phone and I switched to palemoon when firefox stopped allowing unsigned plugins on my desktop. I've been using habit browser on my phone. I don't really trust it at all so I give it minimal permissions and try not to do any browsing on my phone I don't expect to be tracked or monitored. It's fast and customizable and has a built in adblocker so I've been fairly happy with it. I've tried a lot of different mobile browsers. I haven't really found any I liked. They all kinda suck in one way or another. I was really hoping something from F-Droid would be appealing to use but they were all disappointing. The state of mobile browsers in general is kind of abysmal.
- bwat49 9y ago
  It wasn't supposed to be visible on the addons page
  - mark-r 9y ago
    I don't think that makes it better. Knowing that there's a way to get an addon installed invisibly is going to be more justification for paranoia.
    - bwat49 9y ago
      You can disable these studies under Options | Privacy and Security
      - _red 9y ago
        I hate the fact that Firefox increasingly makes me jump through all sorts of hoops to find all the hidden options to turn off their various spyware attempts. Its the Win10 of browsers...
        teddyfrozevelt 9y ago
        Going through your browser settings really is quite the hoop.
        _red 9y ago
        Yeah, its so intuitive for the average person to type: about:config in address bar and scroll through hundreds of oddly named parameters to turn off spyware. Comments like yours are illustrative of a certain mindset. When you encounter the complexity of domains you are not intimately familiar with (court system, law, finance, etc), and those complexities are designed specifically to make it hard for you to protect yourself, I'm sure you are just as understanding as you are now.
        deleted 9y ago
        [deleted]
proaralyst 9y ago
Looks like it's a promo for Mr Robot, which is really not ok. > What's happening? Are you a fan of Mr Robot? Are you trying to solve one of the many puzzles that the Mr Robot team has built? You’re on the right track. Firefox and Mr Robot have collaborated on a shared experience to further your immersion into the Mr Robot universe, also known as an Alternate Reality Game (ARG). The effects you’re seeing are a part of this shared experience.[0] EDIT: looking at this[1] comment, perhaps it's not a promo? [0]: https://support.mozilla.org/en-US/kb/lookingglass https://support.mozilla.org/en-US/kb/lookingglass [1]: https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_looking_glass/dr6fiaz/ https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...
- dpwm 9y ago
  From the page: > No changes will be made to Firefox unless you have opted in to this Alternate Reality Game. Also, from the same page for those that appreciate irony: > One of the 10 guiding principles of Mozilla's mission is that individuals' security and privacy on the internet are fundamental and must not be treated as optional. The more people know about what information they are sharing online, the more they can protect their privacy.
  - majewsky 9y ago
    > No changes will be made to Firefox unless you have opted in to this Alternate Reality Game. How does it not occur to them that this is a clear lie?
    - pbhjpbhj 9y ago
      Because the previous ads for Pocket and Telefonica were effective and they don't care?
    - gvx 9y ago
      I hardly think it's a lie. My browser contains no trace of anything related to Looking Glass, even though I'm opted into Shield Studies. It seems to affect some people but not others. Definitely something that should be fixed in the core mechanism of how these things are downloaded by your browser if there are cases where it can happen without user intervention, but it doesn't seem to be intentional to download extensions without the user's consent.
positivecomment 9y ago
Out of literally all the software vendors I know, including the one I'm working for, Mozilla is the one I'd have least expected to allow such a thing. I'm very surprised (Negatively, needless to say)
- GenericsMotors 9y ago
  Mozilla has been a dumpster fire for quite a while now.
  - RyanZAG 9y ago
    Mozilla has been going downhill very fast since Brendan Eich was removed as CEO. There was some controversy at the time and it made sense why he was removed, but it seems clear now that Mozilla took the wrong choice in removing him as it seems he was keeping the ship on course. Now it is floundering from numerous sides. I think Mozilla should look into getting him back before they all end up losing their jobs.
- Simon_says 9y ago
  I would have said the same thing until they integrated the W3C Encrypted Media Extensions. It's clear they lost their way some time ago.
  - icebraining 9y ago
    Why? They allowed proprietary extensions (e.g. Flash) from the start. I don't like it, but I don't see how it represents a loss of their way. Mozilla was never GNU.
    - Simon_says 9y ago
      Big difference between an extension and being integrated into the browser. It's directly analogous to the difference between your OS being closed source and your OS being able to run closed source programs. The former is a liability; the latter is an ability that you grant to users to use the system the way they want.
Santosh83 9y ago
There is more information on this Reddit post: https://www.reddit.com/r/firefox/comments/7jvm2t/this_looking_glassmr_robot_sht_really_psses_me_off/ https://www.reddit.com/r/firefox/comments/7jvm2t/this_lookin...
- Ajedi32 9y ago
  The original thread from 2 days ago: https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_looking_glass/ https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...
Karunamon 9y ago
Better yet, it appears that these "studies" (read: Mozilla pushing addons to your browser without notification or permission) are default opt-out. Will they stop doing it? Of course not. I can't recall any time that this company has changed course in response to outcry.
- mjw1007 9y ago
  I can: when they renamed firebird to firefox.
  - throwanem 9y ago
    Was that outcry? I thought it was that or get sued. Been a while, though, so maybe I misrecollect.
simlevesque 9y ago
Mozilla can't stop doing crap like this. I love the engineering behind it and thr tech but I don't want any of your shenanigans. This makes me affraid to update.
603security 9y ago
Developers have a million other ways to be cute and clever.
AdmiralAsshat 9y ago
https://support.mozilla.org/en-US/kb/lookingglass https://support.mozilla.org/en-US/kb/lookingglass The Mr. Robot series centers around the theme of online privacy and security. One of the 10 guiding principles of Mozilla's mission is that individuals' security and privacy on the internet are fundamental and must not be treated as optional. The more people know about what information they are sharing online, the more they can protect their privacy. ...which you've done by installing a fishy-looking addon without our permission and making us less likely to trust you? Well-done, Mozilla.
- theossuary 9y ago
  If you clicked on the link about shield studies you'd see it says they're opt in, did you not getting prompted about it?
  - yborg 9y ago
    Apparently it's getting loaded anyway for some people that say they had "Studies" disabled and/or "Studies" itself became re-enabled. The whole idea of slipping paid advertorial content into what are billed as "research" kind of gives the lie to this whole thing and is why I never turn these on in any product. Which is also why it's now "opt-out" by default, and why it will eventually not be an option at all. It's all for our own good, you see.
    - Ajedi32 9y ago
      You don't just need "Studies" enabled, you also need to explicitly opt-in to each specific study on an individual basis: > Participation in an individual study is opt-in Source: https://wiki.mozilla.org/Firefox/Shield/Shield_Studies https://wiki.mozilla.org/Firefox/Shield/Shield_Studies If that didn't happen in this case, then I suspect it's probably a bug.
      - dpwm 9y ago
        I can confirm this most certainly did not happen in my case and, from other comments, there seem to be a number of us who did not opt in to this "study."
y0ghur7_xxx 9y ago
This happened to me yesterday, so I looked for it. The Extension actually does nothing, but invert (make them upside down) a few words on specific sites. It's an experiment called "PUG ARG" to check whether page contents sniffing works. Its page doesn't reference any Bugzilla issue or Wiki page, while https://wiki.mozilla.org/Firefox/Shield/Shield_Studies/Queue https://wiki.mozilla.org/Firefox/Shield/Shield_Studies/Queue doesn't list it. The source code references https://support.mozilla.org/kb/lookingglass https://support.mozilla.org/kb/lookingglass, which (as of now) only says "test - 12817". The add-on tests whether specific words can be detected on sites; the current list has nice picks like "revolution" and "privacy". Of course, this is only a test, but in the future Firefox might look for specific terms in the pages you load and do specific things based on them. The other thing it's doing is to send an extra header to three specific sites: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b089405ca96fc68b999d2b624ef4/addon/webextension/background.js#L52 https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894.... I suppose the words and the domain are a reference to the Mr. Robot series. The add-on describes itself as an "Augmented Reality Game Experience" and was made by a certain "PUG Experience Group": https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b089405ca96fc68b999d2b624ef4/package.json https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894.... Of course, Shield Studies are supposed to be a way of making "more informed product decisions based on actual user needs". https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_looking_glass/ https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...
- deleted 9y ago
  [deleted]
- _Codemonkeyism 9y ago
  Wow, FF is sniffing the content and changing words. Could not think of anything worse a web browser could do. Do they change political arguments on pages in the future to see how I react in a user study? Signed Mr. Guinea Pig
  - shak77 9y ago
    >Do they change political arguments on pages in the future to see how I react in a user study? It's possible: https://blog.mozilla.org/blog/2017/08/08/mozilla-information-trust-initiative-building-movement-fight-misinformation-online/ https://blog.mozilla.org/blog/2017/08/08/mozilla-information...
edibleEnergy 9y ago
Somewhat tangential to this particular issue, but this is a good lesson for developers in why you should be dry and explicit in your writing. Sure `alert("FFFUUU WHY U NO WORK");` keeps you entertained for 5 minutes while you debug a problem but when that accidentally gets to prod...
- napsterbr 9y ago
  I see you, but your example outlines a problem with the process/workflow, not with the developer.
  - scott_karana 9y ago
    GP meant the style of writing English, not code. Funny messages almost always end up causing problems at the end of the day.
kotrunga 9y ago
Go to settings, look in Firefox Data Collection and Use. Why are these turned on automatically? Plus, I turned mine off, and now they're back on again, with this looking junk installed. What the heck Mozilla? What happened to caring about the users? We definitely can't trust Mozilla anymore.
- nikanj 9y ago
  Firefox has a tendency of resetting it's settings. I think the UI calls it "Refresh", but it's basically yet-another-nagbar that we all know and hate.
linkmotif 9y ago
Didn’t I see something on here recently about Mozilla increasing its revenue significantly? [0] ;) [0] https://news.ycombinator.com/item?id=15880565 https://news.ycombinator.com/item?id=15880565
cJ0th 9y ago
Ffs .. I've just checked my addons b/c of the headline and sure enough it has been installed against my will. I've been very loyal to mozilla over all these years but this really is not ok. If they keep doing shit like this I'll switch to a fork.
ChrisSD 9y ago
I'm using FF57 and did not get this addon. Was I just lucky?
- esseti 9y ago
  same. is it just US stuff?
  - majewsky 9y ago
    I'm in Germany and it was installed here.
- 0xFFFE 9y ago
  Running 57.0.1, and I don't see it either.
- eref 9y ago
  Same with 57.0 on macOS 10.12. Edit: I have FF Studies disabled under about:preferences#privacy. I guess that is the reason why it is not installed on my machine.
- jasonlotito 9y ago
  Running FF58. I don't have it either. I also don't agree to stuff unknowingly. It's clearly spelled out in the settings under privacy that you can agree to this stuff. Nothing I've seen suggests this isn't happening. People are saying things but no one is backing up any accusations with any proof yet.
exikyut 9y ago
HOLD THE PHONE The support thread links to https://support.mozilla.org/en-US/kb/lookingglass https://support.mozilla.org/en-US/kb/lookingglass. That page says, in a clearly delineated box, > No changes will be made to Firefox unless you have opted in to this Alternate Reality Game. PLEASE EXPLAIN THIS INCONSISTENCY.
- LyndsySimon 9y ago
  Hopefully, it's a bug, and that addon wasn't intended to be installed (much less active) universally like it is. That doesn't make it OK, but it would make me look at them with suspicion instead of hostility.
  - gr3yh47 9y ago
    >Hopefully, it's a bug, and that addon wasn't intended to be installed (much less active) universally like it is. hey look, a voice of reason! seriously. Mozilla is a company that has a long track record of dedication to openness and the free and open internet this isnt Google, facebook, etc let's all take a step back and give them a little benefit of the doubt here, until we get some facts on what happened. for everyone else... WANT TO JOIN THE MOB? I'VE GOT YOU COVERED! COME ON DOWN TO GR3YH47'S PITCHFORK EMPORIUM! I GOT 'EM ALL! SETTING UP SHOP IN HACKERNEWS MEANS BIG SALES! CHEAP TRADITIONAL FORKS! ON SALE! Traditional ---E Left Handed 3--- Fancy ---{ DEFECTIVE CLEARANCE ARE EVEN LOWER! ---F ---L ---e NEW IN STOCK. DIRECTLY FROM LICHTENSTEIN. EUROPEAN MODELS! ---€ ---£ *some assembly required
    - nickpeterson 9y ago
      Don't forget torches, you have to burn down the evil castle or else they'll just hide until everyone leaves.
    - icebraining 9y ago
      Mozilla is a company that has a long track record of dedication to openness and the free and open internet True, and that's why I never stopped and recommending Firefox since I first installed Phoenix. That said, they're already installing and enabling Cliqz by default (for some users), and that's no bug. So it's not absurd that people might assume this isn't either. Reputation is hard to gain and easy to lose.
jerianasmith 9y ago
Having issues with your extra? Beginning with Firefox 57 (in discharge), just additional items manufactured utilizing WebExtensions APIs, the new innovation for Firefox expansions will work.
majewsky 9y ago
In the Preferences, scroll down to "Data Collection and Use", and disable everything. I know that you only need to need to turn off "install and run studies", but this has now cost Mozilla all telemetry data from me, and I encourage everyone to do the same.
- bronson 9y ago
  It's not easy to keep them turned off. Browser upgrades seem to silently re-enable things.
  - akerro 9y ago
    What platform are you on?
- sundarurfriend 9y ago
  I've switched to Waterfox, because of things like this (including the Cliqz issues). I'm all for Mozilla making money and trying things, the problem is the way in which they do it. They fail to respect the users enough to communicate things, and have not been behaving like a user-friendly transparent company for some time now. I was a big enough fan to regularly donate and urge friends to do the same, but something has gone wrong inside the company.
  - majewsky 9y ago
    I heard about Waterfox, but support for legacy extensions is a huge warning sign. I don't want to be stuck on FF56 technology forever.
- nawitus 9y ago
  Why can't I see the "install and run studies" option? Is it because I'm using Finnish language Firefox?
Sir_Cmpwn 9y ago
What the fuck Mozilla? You can't just sideload extensions that are literally ads. There is no universe in which this is even a little bit okay. http://qutebrowser.org/ http://qutebrowser.org/
- pecg 9y ago
  And this is exactly what I'm going to do, switch to a simple browser, in my personal computers. If they programmed firefox to be capable of doing thinks like this, then definitely I cannot trust them anymore.
linkmotif 9y ago
I checked out FF for the zillionth time the other week after the Quantum release hoping to love it, but the deep Pocket integration was just too offputting. Turning it off requires some Googling. There were other irritating commercial things too. It’s a shame. FF is probably the most important open source project in the world and it’s a shame they do stuff like this. I’m still on Chrome :(
- sp332 9y ago
  Firefox bought Pocket. So it's a first-party feature.
  - throwaway2048 9y ago
    I cant help but feel mozilla bought pocket because they wanted to justify the included adware nature of it as a first and foremost priority, after all the supposed logic of including it was all about reducing costs for mozilla..
- calcifer 9y ago
  > but the deep Pocket integration was just too offputting You mean the single button that does literally nothing until and unless you click on it?
  - linkmotif 9y ago
    Yep, that button was really annoying. And the Pocket thing on the home screen, too. And the fact that I had to Google to figure out how to disable it. If you must know why, I don't want promos for particular web properties in my browser. I find Pocket to be annoying conceptually (a service to help you carry around all the things you didn't and won't read—eww, no, no thank you), and I don't want to look at it every day. I don't want to have to Google to figure out how to disable it. I don't want my browser to come with nonsense I need to disable. > You mean the single button that does literally nothing until and unless you click on it? This must be the kind of mentality that leads people at FF to do silly things like mentioned on this thread, or having "just one button" for their acquired web property. That's the opposite of how great product minds think. Great product people think "how can I REMOVE this button?" Not "how can I get away with having it?"
deleted 9y ago
[deleted]
sumanthvepa 9y ago
I've been seeing the YouTube logo inverted recently. I wonder if this has something to do with it. If so. I'm done with Firefox. I've used it since it was Netscape in 1996. Enough is enough.
- nicolaslem 9y ago
  This has nothing to do with Firefox, it was Youtube promoting its Youtube Rewind: https://en.wikipedia.org/wiki/YouTube_Rewind https://en.wikipedia.org/wiki/YouTube_Rewind
deleted 9y ago
[deleted]
pgl 9y ago
Previously: * https://news.ycombinator.com/item?id=15921134 https://news.ycombinator.com/item?id=15921134 This is a link to the GitHub issue: * https://github.com/gregglind/addon-wr/issues/36 https://github.com/gregglind/addon-wr/issues/36 There are several scary things about this: - Unknown Mozilla developers can distribute addons to users without their permission - Mozilla developers can distribute addons to users without their knowledge - Mozilla developers themselves don't realise the consequences of doing this - Experiments are not explicitly enabled by users - Opening the addons window reverts configuration changes which disable experiments - The only way to properly disable this requires fairly arcane knowledge Firefox preferences (lockpref(), which I'd never heard of until today)
- callahad 9y ago
  Just coming up to speed, apologies for the potentially obvious questions. 1. Can you explain what you mean by "unknown Mozilla developers?" Unknown to whom? 2. Can you provide more detail on what specific configuration changes are reverted when opening the add-ons window? That sounds like a fairly serious bug. 3. What is the specific "this" you're trying to "properly disable?" You shouldn't have to dive into things like lockpref. Mozilla (and other browser vendors) have the ability to push updates to their browsers outside of the normal release cadence. In many cases, these updates are distributed as add-ons, as they're cleanly separated from the rest of the browser internals, but that's just an implementation detail. If you visit about:support in Firefox, you should see a table of "Firefox Features," which are exactly that. Their source lives at: https://hg.mozilla.org/mozilla-unified/file/tip/browser/extensions https://hg.mozilla.org/mozilla-unified/file/tip/browser/exte... For example, we used a system add-on to control the gradual roll-out of multiprocess Firefox, and the New Tab page is also implemented as an add-on called "activity-stream."
  - GrayShade 9y ago
    I'll try to answer in the parent's place, since I've been watching this issue. > Can you explain what you mean by "unknown Mozilla developers?" Unknown to whom? Unknown in the sense that this extension wasn't documented at all, there was no Bugzilla issue for it and it's not clear whether it was properly vetted by QA. Whether you argue that this kind of silent push updates is good or bad, I think they aren't tested as well as in-browser functionality. This is a necessary consequence of "let's try it and revert if something breaks or people complain". More so, a rolled back Shield study will be invisible to the users, so any problems will be impossible to debug. This is made worse by the fact that most, if not all Shield studies are opt-out, so the user won't be notified. > Can you provide more detail on what specific configuration changes are reverted when opening the add-ons window? That sounds like a fairly serious bug. > What is the specific "this" you're trying to "properly disable?" You shouldn't have to dive into things like lockpref. People have reported that extensions.ui.experiment.hidden reverts after viewing the add-ons list. I haven't tried it myself, but you can find details in that Reddit thread. Others have noticed that the Shield studies checkbox sometimes (possibly on version bumps) reverts to enabled. I can't overstate how bad this is; it's basically cheating the users' trust. Lately, Mozilla has been doing some pretty nasty things for an organization that takes pride in caring about the privacy of its users. Are you aware of the complaints regarding Windows telemetry? Edge, for example, sends full browsing history to Microsoft by default. Should Mozilla follow suit? Because that's exactly what Pioneer does and, while it's not opt-out yet, Firefox advertises enabling it. As for the rest of the system add-ons, they're either poorly documented (if they are at all), poorly named ("Presentation"), or seem concerning from a privacy point of view (e.g. Activity Stream, Follow-on Search Telemetry, Photon onboarding, Presentation, Web Compat Reporter). For anyone curious, Presentation seems to be an implementation of a proposed Web API that allows browsers to find and talk to devices in their neighbourhood. Does that include location/proximity beacons like this old proposal https://hacks.mozilla.org/2013/06/the-proximity-api/ https://hacks.mozilla.org/2013/06/the-proximity-api/ ? Do users really want Firefox to tell advertisers where they're shopping? That's the same kind of "experience improvement" that the spyware of yore used to bring. Why should Pocket be an add-on with superpowers? There was quite a bit of backlash over it a while ago, but Mozilla didn't budge, and some employees actually spread misinformation (not to say "lied"). And actually none of my system add-ons seems to be providing any important functionality (if you disregard the new tab page, for which I haven't seen yet a privacy policy). Looking at Shield studies ( https://www.jeffersonscher.com/sumo/shield.php https://www.jeffersonscher.com/sumo/shield.php ), it's even worse: most are surveys, advertisements, asking the user to enable Pioneer (i.e. send full browsing history to Mozilla).
_Codemonkeyism 9y ago
One step ahead (Quantum), two steps back.
zeep 9y ago
I use Firefox 58 beta developer edition in the USA and this extension didn't install automatically... Maybe the government need to start sponsoring Mozilla so that they stop doing things like this.
garganzol 9y ago
Mozilla Firefox installer is signed by a code-signing certificate. But at the very end it means nearly nothing: if the developer cannot be trusted, no amounts of certificates, green bars, smart screens, stores and walled gardens can fix that. That's a very important point to grasp, as I hear a lot of voices nowadays claiming that the modern security model (read walled gardens of all kinds) is the universal panacea. Just the opposite, it brings a false sense of security making you more vulnerable. It also tends to inhibit a healthy and free market competition when a lot of potentially good software suppliers are gated off from the walled gardens from the start.
- fixermark 9y ago
  In general though, what is the alternative to trusting the source and distributor of a piece of content? As you've noted, if you can't trust the developer, the walled garden is irrelelvant... But if you can't trust the data source, isn't basically everything about the medium irrelevant? In contrast, if you do trust the data source, why is a walled garden model of security worse than alternatives?
deleted 9y ago
[deleted]
CoolGuySteve 9y ago
This is the second spyware extension in recent memory. How hard is it to fork Firefox with all this stuff hardcoded off?
- wila 9y ago
  waterfox? or perhaps pale moon are what you are after?
mcintyre1994 9y ago
Menu > Options > Privacy & Security > untick Allow Firefox to install and run studies I deliberately kept that enabled initially but if they're going to use it for Adware..
- pythonaut_16 9y ago
  If you're still using Firefox after this it's probably safest and best just to disable everything under Firefox Data Collection and Use
pmlnr 9y ago
FF 57 installed from Debian unstable repository has "Data reporting is disabled for this build configuration" - which disabled, in theory, the shield "studies" as well. I don't know who made this decision at Debian, but thank you.
- chippy 9y ago
  I wonder if the Ubuntu stable ones have this too?
  - trendia 9y ago
    Ubuntu once sent everything typed in the search bar to Amazon, so...
  - YtvwlD 9y ago
    Ubuntu stable seems to have disabled this as well.
_Codemonkeyism 9y ago
Anyone know how I can turn off Firefox sending technical details and interactions? Everytime I turn this off, and restart FF it's on again. 58.0b11
- kuschku 9y ago
  If you are on a Nightly or Developer build, you can not turn it off, I asked on Mozilla’s IRC. Downloading these builds is considered opt-in into telemetry, and toolkit.telemetry.enabled is hardcoded to enabled, the opt-out checkbox literally does nothing, I was told. And about:config confirmed this.
  - _Codemonkeyism 9y ago
    Thanks for the insight. Would be good UI to a.) disable the control b.) add a comment.
  - djsumdog 9y ago
    Wow ... that's .. disturbing
  - detaro 9y ago
    Okay, having a checkbox that does nothing is really bad. The fact that the privacy policy only just says something like "this policy might not apply to non-release builds", without actually having a policy for those also is more than questionable.
sjroot 9y ago
I just checked my installation of Firefox and this addon was present as well. The developers involved (Greg Lind et al) should acknowledge this and apologize.
- Danihan 9y ago
  Same, why is this in my addons..? I really don't understand what they were thinking.
Sytten 9y ago
And this is one of the reasons I stopped my yearly donation to the Mozilla foundation even if I love the new FF. If they need money so badly they should push their donation campaign and keep their products clean instead of pushing some shady alliances with big corporations.
igravious 9y ago
Between broken font handling and this Looking Glass thing whatever it is Firefox 57 (Quantum) has been less than stellar.
ksec 9y ago
I just wanted to add a few things. 1. I notice it yesterday, only because Avast was showing I have a low trust level Add-On installed in Firefox. 2. I googled it, and the first results was from Mozilla, showing it was part of their studies and experiment. 3. That was Ok, because I trust Mozilla, although somewhere in the back of my mind I thought every studies were supposed to be opt-in, since I have a few Add On installed in the week and I dont restart my browser, I thought i might have clicked it by mistake. 4. Now I am reading this through, I am more then worried. If I am reading the online comment correctly, Mozilla installed an Add On without user permission, enabled, collected data, and not for their own UX studies but a third party. And to make the matter worst, that Add-On is now gone. It disappeared in my Add on Screen now I just check. Call me old fashion but that is not how i view privacy. Like I said before, Mozilla's management and culture has a tendency of self destruction and messing things up right after they start being good. Still this is turning around much quicker then I thought.
- dao- 9y ago
  It seems to have disappeared from about:addons because the "study" has ended. In about:studies I see: > pug-experience > Complete • My reality is different than yours
- franga2000 9y ago
  I cant find any indication that Mozilla was collecting any data from this addon, either for themselves or for anyone else. The only way anyone would even be affected by it is by going to one of 3 hard-coded websites owned by the network behind Mr. Robot (a show known for putting easter eggs all over the web) and hovering over some text. It's definitely a dick move, but it isn't spyware as some people are saying, just a very poorly executed promotion.
deleted 9y ago
[deleted]
pythonaut_16 9y ago
Just checked and saw the Looking Glass add-on installed on my work laptop. I've uninstalled Firefox and will be removing it from all of my computers. I had just started slowly migrating back to it with the performance enhancements in the latest update, but honestly I don't think I can get past a breach of trust at this level.
- MikkoFinell 9y ago
  Are you switching to Chrome, the browser that sends your every keystroke back to HQ?
  - pythonaut_16 9y ago
    Google does a lot of things but they've never betrayed my trust by installing an extension in conjunction with a third party without telling me. Google does track a lot of my data but they provide useful services in exchange, and in addition they make it pretty easy to see what data they have on me. Also Google's data is its competitive advantage so our interest in protecting my data from 3rd parties is aligned. In short, Google tracks me sure, but they're pretty transparent about it. I do think some of the things Google does with Chrome and it's market position is less than stellar so I'm still exploring other options. If you have any suggestions I'd be happy to hear them.
    - MikkoFinell 9y ago
      Thanks, thats the funniest thing I've read all week.
      - issaria 9y ago
        You missed the joke.
    - fiala__ 9y ago
      > but they're pretty transparent about it They may be transparent about the fact that they're tracking you, but not about what they're tracking or when they're tracking it. And there's no way for you to find out because the vast majority of their software is not open source.
alkonaut 9y ago
If they state as an explicit principle that no addons/studies are actually enabled unless the user opted in, then I’m going to give them the benefit of the doubt that if that happened to users that did not opt in, it was a terrible mistake (I.e a bug). I can tolerate bugs, much more than I can tolerate sneaky app behavior. But I hope the statement about explicit opt-in will be repeated, and this will be explained. At first I thought it must have been users that explicitly had opted in, but with so many users claiming they haven’t, it seems unlikely. The next possibility is that preview versions have things opt-out instead of opt in (because in preview versions you need more data from users - typical for closed alphas etc) - but then this should be very clearly explained on download/install.
- nogridbag 9y ago
  Just installed Firefox a week ago on OS X. Just checked and I have Looking Glass installed. I'm usually very careful when installing software about things like this. I don't recall ever opting in to anything (including error reporting). So my guess is it's a default you have to disable in settings.
- alkonaut 9y ago
  I haven’t understood whether this thing is completely inert or actually does anything without opt in. If it is downloaded and listed without opt-in, but only actually invoked after opt-in, then I’ll call it acceptable (not great, but not terrible either)
  - callahad 9y ago
    The source is at https://github.com/gregglind/addon-wr/ https://github.com/gregglind/addon-wr/ Its startup is controlled by the addon/bootstrap.js file. Per line 22, it's completely inert unless the user manually toggles `extensions.pug.lookingglass` in about:config: https://github.com/gregglind/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js#L22-L24 https://github.com/gregglind/addon-wr/blob/59659431fd2a75c33...
randomString1 9y ago
Once again saved by https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js
kamranjon 9y ago
I actually discovered this because my browser would not stop running at 100% cpu utilization about 3 days ago, not doing anything, just sitting at Google.com with one tab open. It freaked me out because I couldn't find any documentation on the extension. Once removed Firefox was running fine again. I guess I'm relieved to know it wasn't some malware or something more sketchy, but I am wondering what it was doing pegging my cpu at 100% whenever my browser was open...
- callahad 9y ago
  Whatever you experienced is very unlikely to be caused by this add-on. The add-on only initializes if you manually dig into about:config and enable `extensions.pug.lookingglass`. Otherwise, it just starts up once at browser launch, checks that preference, and shuts itself down. (https://github.com/gregglind/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js#L22-L24 https://github.com/gregglind/addon-wr/blob/59659431fd2a75c33...) If you're able to consistently reproduce the issue, please let me know.
blauditore 9y ago
Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the add-on does nothing until the user opts-in on studies.
- pmlnr 9y ago
  > it doesn't really matter since the code is coming from Mozilla For now, yes. Until someone finds a way to push a "study" through which is not from someone "trusted". > If someone distrusts their add-ons, why trust their browser at all? Well, trust is rather simple to break, and this - remote installing things - was not part of my original trust I put in Firefox 1.0. I know things change. This is not one I tolerate, and you are right: I will not trust a browser after a step like this. Besides the trust, it's unexpected data. Probably don't effect many on big data plans, and is probably a tiny extension this time, but it's still data I have not asked for.
- skymt 9y ago
  Speaking for myself here, but I'm not concerned that Mozilla might push malware into Firefox installations. I'm concerned about the lack of judgement in pushing an extension with a vague, scary-sounding name and description simply for a cross-marketing tie-in, and I'm worried that it could have damaged the trust ordinary users have in Firefox.
  - pmlnr 9y ago
    > I'm not concerned that Mozilla might push malware into Firefox installations Nobody is concerned about that, in my opinion. I'm concerned someone will push malware through Mozilla into Firefox installations. Pushing addon installs should not be possible at all.
    - kibibu 9y ago
MikkoFinell 9y ago
Canceled my monthly donation because of this.
- dymk 9y ago
  I deleted my Facebook because of this and I'm much happier as a result.
confounded 9y ago
While I agree that releasing this as an undocumented extension was a poor PR move, in practical terms, I don’t see how this is any more insidious than the ‘no internet’ dinosaur jumping game built in to chrome. Both are first-party. The difference seems to be that the dinosaur game keeps you entertained, where as this hopes to promote awareness of privacy/security.
- mynewtb 9y ago
  The dinosaur was not placed there by a movie studio to promote a random.movie.
  - confounded 9y ago
    Neither was the Looking Glass extension.
    - trendia 9y ago
      It is related to Mr Robot
- SpliffnCola 9y ago
  >"I don’t see how this is any more insidious than the ‘no internet’ dinosaur jumping game built in to chrome." You don't see the difference between a built-in game (included in the installation of Chrome) vs. Mozilla pushing an add-on to a Firefox installation using a channel meant for helping to improve the browser?
  - Sylos 9y ago
    Mozilla could have just as well pushed this as part of the binary via auto-update.
natch 9y ago
The cringe-worthy construction "different than" which should be "different from" makes this episode even worse.
deleted 9y ago
[deleted]
UmmNope 9y ago
Mozilla takes in about half a billion dollars per year, has anyone considered the consideration for which this money is being paid ?
- callahad 9y ago
  That's FUD. Mozilla is a 501(c)3 non-profit, and our audited financial statements and IRS Form 990 can be found at https://www.mozilla.org/en-US/foundation/annualreport/ https://www.mozilla.org/en-US/foundation/annualreport/
  - jordigh 9y ago
    Mozilla is... both. There's the Mozilla Foundation which is a nonprofit and the Mozilla Corporation which is very much not. I've never quite understood what each Mozilla does, but AIUI, the Firefox development is all done by Mozilla Corp and the nonprofit does stuff like make those cute videos about how Firefox is going to save the world and make us all smiley and multiethnic. I've talked to a number of Mozilla employees, and they also seem confused about the relationship between the corp and the foundation.
    - callahad 9y ago
      The Mozilla Corporation ("MoCo"), which develops Firefox, is a wholly owned subsidiary of the non-profit Mozilla Foundation ("MoFo"). Each has its own board of directors, but the Corporation exists to serve the public benefit goals of the non-profit. The link above has a decent overview, and if you're especially curious, bylaws and articles of incorporation for each are at https://www.mozilla.org/en-US/foundation/about/ https://www.mozilla.org/en-US/foundation/about/.
    - Sylos 9y ago
      The Mozilla Corporation is 100% owned by the non-profit Mozilla Foundation, so any earnings that the Corporation makes, they either have to reinvest, put it to the side to reinvest it later or pay it out to the Foundation, where it's again in non-profit hands (i.e. forced to invest into their specified mission). The only way that the Corporation could do shenanigans, is by paying their employees higher wages than would be necessary to hold them or is considered reasonable for the job that they do. It was set up, because there's limits to how much money a non-profit is allowed to put to the side, which would have limited Mozilla's strategic flexibility.
arunc 9y ago
This is disappointing rather. When Mozilla spent $$ in advertising Firefox Quantum in the internet media articles, they could have mentioned this at least somewhere in them.
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
Tomte 9y ago
I like Mozilla a lot. And this extension doesn't really bother me, since it's benign. But oh boy, do they have a talent for always doing benign and harmless things that look bad at first glance. It's almost like they want to turn away typical messaging board users.
seanalltogether 9y ago
As of about 5:30 GMT it looks like the addon was automatically removed from my browser. I know I saw it a couple hours ago.
r1b 9y ago
Doesn't bother me at all - I am fully acclimated to the idea that the browser and other applications do run arbitrary A/B test and other code all the time.
gaius_baltar 9y ago
I haven't noticed this extension sending data to outside services. Did somebody find if/where it does that? If it is sending personal or browsing-related data out, we can flood the servers with garbage.
jordigh 9y ago
So, a lot of people in this thread are saying that Mozilla is a non-profit. There are in fact two Mozillas. One is the Mozilla Foundation, which is the non-profit. They are not involved with Firefox development, as I understand it. The Mozilla Corporation, which I think is owned by the non-profit, does the development. I think the foundation just does cute videos and outreach and other things not directly related to writing software. I also understand that if you donate money to the Mozilla foundation, the money would not make it to Mozilla corp and thus would not pay for the salary of any Firefox hacker. I've never quite understood how exactly does this financial arrangement work and I would be grateful to anyone who could explain this to me.
- CommieBobDole 9y ago
  It's the other way around - the foundation owns the corporation. https://en.wikipedia.org/wiki/Mozilla_Corporation https://en.wikipedia.org/wiki/Mozilla_Corporation
hitekker 9y ago
1) Mozilla uses weird, spooky language in an add-on. 2) Users are justifiably concerned. 3) Mozilla explains that the add-on is actually anodyne; the developers responsible were having fun with an opt-in research service. 4) Some users try to justify their initial overreaction by painting Firefox as mysterious, dangerous entity, fabulating conspiracy theories about one of the most forthright and open OSS companies in the world. Really, guys. If Mozilla was hellbent on invading your privacy, do you really think they would proudly entitle their tracker "Looking Glass". Or would they call it debugservice_1223?
- Karunamon 9y ago
  3.5) Most users insist that this isn't okay, that addon installations should be approved by the owner of the computer. This isn't about what the addon itself does or does not do, it's the principle of force-pushing unwanted content without prior affirmative consent. This would apply even if the addon was just a stub that didn't have any executable code in it. In this case, it's worse: an ad.
  - takeda 9y ago
    When you install Firefox it asks whether you want to take part in these studies. You can also change the setting at any time in preferences (about:preferences#privacy section).
  - hitekker 9y ago
    I would agree with you, if the add-on in question was not developed, shipped, and offered by the people who made the browser, of which the add-on sandbox is a part. In my view, that sandbox is a trusted area between the browser and the user. Mozilla has the privilege accorded to it as the developer of the browser, to modify the addon sandbox so long as they don't infringe on my interests, e.g., security, stability, privacy, speed. For example, Chrome automatically disable extensions that ask for too many new permissions upon update. Chrome will also make it difficult to add extensions that are not listed on the chrome store. If we remove the right for browser developers to install, uninstall and alter add-ons, then we're essentially forcing them to modify the browser instead, which is overkill for the add-on in question. At the end of the day, if you can't trust the developers of your browser, then you should install another one and disable add-ons entirely. 3.5 falls into 4.
herogreen 9y ago
What I really do not understand is why this game thing was installed automatically given that websites can ask the user to install an extension when they land on a webpage. A popup that is part of Firefox shows up and asks the user if he really wants to install it.
megamindbrian2 9y ago
They should rename Firefox to Fiasco.
heroprotagonist 9y ago
I don't remember if this is opt-in or not, but I do not have it in my Firefox. Maybe I just removed it myself immediately after first install, when I went through to update all of the privacy and other browser settings. I agree that it seems like a crappy extension, and people should be upset about things being preloaded to their browser. But there's a point here to be made, that if you're concerned about privacy at all today, you need to look at the settings of any software after you install it. It doesn't matter how much previous trust you have for the developers. This should just be default behavior so that any surprise is met immediately, and not after any damage it could perform has been done.
zb3 9y ago
The best way to disable these things is to go to about:config, search and delete/replace all mozilla urls. For this particular case, the api url is probably in "extensions.shield-recipe-client.api_url" [0] [0] - https://dxr.mozilla.org/mozilla-central/source/browser/extensions/shield-recipe-client/bootstrap.js https://dxr.mozilla.org/mozilla-central/source/browser/exten...
fishywang 9y ago
Is the "Unknown" part in the title really unknown, or just Mozilla trying to protect its developer(s) from pitchforks? If it's really "unknown", then that's the really concerning part.
bitmapbrother 9y ago
Big Browser is watching. Browse freely with Firefox. https://pbs.twimg.com/media/DDsLeqvV0AE1k-2.jpg https://pbs.twimg.com/media/DDsLeqvV0AE1k-2.jpg The hypocrisy is amazing.
rrdharan 9y ago
TechCrunch and Gizmodo just picked up the story: https://techcrunch.com/2017/12/15/mozillas-mr-robot-promo-backfires-after-it-installs-firefox-extension-without-permission/ https://techcrunch.com/2017/12/15/mozillas-mr-robot-promo-ba... https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-into-firefox-1821332254 https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-... Also AFAIK the second link has the first official response of any kind? "A representative told Gizmodo the company is looking into the issue."
FrozenVoid 9y ago
I switched to waterfox for quite awhile. I've lost trust in mozilla when they bundled "Pocket" and people then didn't think much of it. When you lose ability to control the browser its no longer a fair game. Bundling addons, changing settings, ads and "enhancements" no one asked for, all eroded trust. Not to mention its aping Chrome more and more each version. We need more firefox forks, not less. Chrome has dozens, because the privacy threat from google is obvious: firefox hdoesn't have that much forks,because its trusted by distro makers to be safe(but its not, as mozilla just proved). People are upset when this implicit assumption that Firefox is the only browser(among modern graphical browsers) you can trust is actually false.
mshenfield 9y ago
From the wikipedia article. linked in the ticket > Shield Studies are available on all channels. Individual studies can be opt-out or opt-in and any and all data being collected will be declared openly. After confirming willingness to participation, a self expiring add-on will be installed on the user's machine. Mozilla is only installing an experimental feature ass an add-on if they opt in.
jstewartmobile 9y ago
Posted here a few days ago about how Mozilla being for-profit joined at the hip with a non-profit seems kind of shady, and got dogpiled for it. Then they do this as a tie-in for Mr. Robot. Vindication!
sharno 9y ago
It's a PR disaster from Mozilla. I was once a Mozilla rep and I'm ashamed of this. Studies like these should always be turned off by default and the user can opt in voluntarily. But launching Firefox and digging into the preferences to find that I'm enrolled into some studies by default is unethical for me. Sadly, I'll have to switch to Brave or some other privacy concerned browser until I see an official statement and action from Mozilla. I'm sure the management there have something to do with all of this.

757 points by shak77 9y ago

This is what it looks like: https://imgur.com/a/mriUw https://imgur.com/a/mriUw It scared the hell out of me! Are these guys losing their minds? It was reported as a bug and the response thus far is indeed underwhelming for such a severe issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1424977 https://bugzilla.mozilla.org/show_bug.cgi?id=1424977

grawprog 9y ago
>Are these guys losing their minds? Yes
- shak77 9y ago
  I don't know what the hell is going on with Mozilla. Ever tried to install Firefox on Android? The new tab page is full of ads by default! And this is the company we are supposed to trust? Because right now I feel like I trust Google more, and that's a lot to say.
  - jhiska 9y ago
    We can't argue with your feelings.
    - shak77 9y ago
      Then these pages should not be full of feelings: https://www.mozilla.org/en-US/ https://www.mozilla.org/en-US/ https://www.mozilla.org/en-US/internet-health/ https://www.mozilla.org/en-US/internet-health/
      - positivecomment 9y ago
        Could you please be more clear? I disabled all my extensions and still don't see anything there that is based on feelings?
        keb_ 9y ago
        I think they are feeling betrayed by Mozilla, and that they are saying language like "We all love the web" and "Internet for people" inspires feelings.
        jhiska 9y ago
        You could have asked me what I meant.
  - _e 9y ago
    To solve this "problem" on android, check this xposed framework module: http://repo.xposed.info/module/de.defim.apk.unbelovedhosts http://repo.xposed.info/module/de.defim.apk.unbelovedhosts
  - teekert 9y ago
    Adds are annoying yes, but they are only bad for your privacy if they track and profile you. Adds allow for free stuff and they can be done the right way. Granted this is becoming more and more rare so I understand your standard association of adds with distrust. The adds you refer to are non tracking (please tell me if I'm wrong though) and will slowly be replaced by sites you visit (often).
    - Karunamon 9y ago
      Ads abuse the user's time, attention, and privacy. Minus the tracking, that's still two factors of abuse rather than three.
      - teekert 9y ago
        How do they abuse your privacy without tracking? Of course if they didn't abuse your time and attention they wouldn't make sense. But someone has to be paying Firefox's development, and it is not you. I'll take that last part back if you contribute to Mozilla. Hey, maybe it's an idea for a donation: make a 5$ Firefox without adds. I'd pay. To bad part goes to Google that way.
        makecheck 9y ago
        The irony is that people pay, just not to the right place. Every unnecessarily-bloated download tears through data plans and costs people money to their ISP that never makes it to the provider. I want plain-text ads that provide just as much revenue to web sites but without obnoxious experiences and fat downloads.
        palunon 9y ago
        > Every unnecessarily-bloated download tears through data plans and costs people money to their ISP Only in third internet world countries like the US... Elsewhere, we don't have limited data plans.
        9y ago
  - grawprog 9y ago
    No. Firefox was too big for my old phone and I switched to palemoon when firefox stopped allowing unsigned plugins on my desktop. I've been using habit browser on my phone. I don't really trust it at all so I give it minimal permissions and try not to do any browsing on my phone I don't expect to be tracked or monitored. It's fast and customizable and has a built in adblocker so I've been fairly happy with it. I've tried a lot of different mobile browsers. I haven't really found any I liked. They all kinda suck in one way or another. I was really hoping something from F-Droid would be appealing to use but they were all disappointing. The state of mobile browsers in general is kind of abysmal.
bwat49 9y ago
It wasn't supposed to be visible on the addons page
- mark-r 9y ago
  I don't think that makes it better. Knowing that there's a way to get an addon installed invisibly is going to be more justification for paranoia.
  - bwat49 9y ago
    You can disable these studies under Options | Privacy and Security
    - _red 9y ago
      I hate the fact that Firefox increasingly makes me jump through all sorts of hoops to find all the hidden options to turn off their various spyware attempts. Its the Win10 of browsers...
      - teddyfrozevelt 9y ago
        Going through your browser settings really is quite the hoop.
        _red 9y ago
        Yeah, its so intuitive for the average person to type: about:config in address bar and scroll through hundreds of oddly named parameters to turn off spyware. Comments like yours are illustrative of a certain mindset. When you encounter the complexity of domains you are not intimately familiar with (court system, law, finance, etc), and those complexities are designed specifically to make it hard for you to protect yourself, I'm sure you are just as understanding as you are now.
        deleted 9y ago
        [deleted]

proaralyst 9y ago

Looks like it's a promo for Mr Robot, which is really not ok. > What's happening? Are you a fan of Mr Robot? Are you trying to solve one of the many puzzles that the Mr Robot team has built? You’re on the right track. Firefox and Mr Robot have collaborated on a shared experience to further your immersion into the Mr Robot universe, also known as an Alternate Reality Game (ARG). The effects you’re seeing are a part of this shared experience.[0] EDIT: looking at this[1] comment, perhaps it's not a promo? [0]: https://support.mozilla.org/en-US/kb/lookingglass https://support.mozilla.org/en-US/kb/lookingglass [1]: https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_looking_glass/dr6fiaz/ https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...

dpwm 9y ago
From the page: > No changes will be made to Firefox unless you have opted in to this Alternate Reality Game. Also, from the same page for those that appreciate irony: > One of the 10 guiding principles of Mozilla's mission is that individuals' security and privacy on the internet are fundamental and must not be treated as optional. The more people know about what information they are sharing online, the more they can protect their privacy.
- majewsky 9y ago
  > No changes will be made to Firefox unless you have opted in to this Alternate Reality Game. How does it not occur to them that this is a clear lie?
  - pbhjpbhj 9y ago
    Because the previous ads for Pocket and Telefonica were effective and they don't care?
  - gvx 9y ago
    I hardly think it's a lie. My browser contains no trace of anything related to Looking Glass, even though I'm opted into Shield Studies. It seems to affect some people but not others. Definitely something that should be fixed in the core mechanism of how these things are downloaded by your browser if there are cases where it can happen without user intervention, but it doesn't seem to be intentional to download extensions without the user's consent.

positivecomment 9y ago

Out of literally all the software vendors I know, including the one I'm working for, Mozilla is the one I'd have least expected to allow such a thing. I'm very surprised (Negatively, needless to say)

GenericsMotors 9y ago
Mozilla has been a dumpster fire for quite a while now.
- RyanZAG 9y ago
  Mozilla has been going downhill very fast since Brendan Eich was removed as CEO. There was some controversy at the time and it made sense why he was removed, but it seems clear now that Mozilla took the wrong choice in removing him as it seems he was keeping the ship on course. Now it is floundering from numerous sides. I think Mozilla should look into getting him back before they all end up losing their jobs.
Simon_says 9y ago
I would have said the same thing until they integrated the W3C Encrypted Media Extensions. It's clear they lost their way some time ago.
- icebraining 9y ago
  Why? They allowed proprietary extensions (e.g. Flash) from the start. I don't like it, but I don't see how it represents a loss of their way. Mozilla was never GNU.
  - Simon_says 9y ago
    Big difference between an extension and being integrated into the browser. It's directly analogous to the difference between your OS being closed source and your OS being able to run closed source programs. The former is a liability; the latter is an ability that you grant to users to use the system the way they want.

Santosh83 9y ago

There is more information on this Reddit post: https://www.reddit.com/r/firefox/comments/7jvm2t/this_looking_glassmr_robot_sht_really_psses_me_off/ https://www.reddit.com/r/firefox/comments/7jvm2t/this_lookin...

Ajedi32 9y ago
The original thread from 2 days ago: https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_looking_glass/ https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...

Karunamon 9y ago

Better yet, it appears that these "studies" (read: Mozilla pushing addons to your browser without notification or permission) are default opt-out. Will they stop doing it? Of course not. I can't recall any time that this company has changed course in response to outcry.

mjw1007 9y ago
I can: when they renamed firebird to firefox.
- throwanem 9y ago
  Was that outcry? I thought it was that or get sued. Been a while, though, so maybe I misrecollect.

simlevesque 9y ago

Mozilla can't stop doing crap like this. I love the engineering behind it and thr tech but I don't want any of your shenanigans. This makes me affraid to update.

603security 9y ago

Developers have a million other ways to be cute and clever.

AdmiralAsshat 9y ago

https://support.mozilla.org/en-US/kb/lookingglass https://support.mozilla.org/en-US/kb/lookingglass The Mr. Robot series centers around the theme of online privacy and security. One of the 10 guiding principles of Mozilla's mission is that individuals' security and privacy on the internet are fundamental and must not be treated as optional. The more people know about what information they are sharing online, the more they can protect their privacy. ...which you've done by installing a fishy-looking addon without our permission and making us less likely to trust you? Well-done, Mozilla.

theossuary 9y ago
If you clicked on the link about shield studies you'd see it says they're opt in, did you not getting prompted about it?
- yborg 9y ago
  Apparently it's getting loaded anyway for some people that say they had "Studies" disabled and/or "Studies" itself became re-enabled. The whole idea of slipping paid advertorial content into what are billed as "research" kind of gives the lie to this whole thing and is why I never turn these on in any product. Which is also why it's now "opt-out" by default, and why it will eventually not be an option at all. It's all for our own good, you see.
  - Ajedi32 9y ago
    You don't just need "Studies" enabled, you also need to explicitly opt-in to each specific study on an individual basis: > Participation in an individual study is opt-in Source: https://wiki.mozilla.org/Firefox/Shield/Shield_Studies https://wiki.mozilla.org/Firefox/Shield/Shield_Studies If that didn't happen in this case, then I suspect it's probably a bug.
    - dpwm 9y ago
      I can confirm this most certainly did not happen in my case and, from other comments, there seem to be a number of us who did not opt in to this "study."

y0ghur7_xxx 9y ago

This happened to me yesterday, so I looked for it. The Extension actually does nothing, but invert (make them upside down) a few words on specific sites. It's an experiment called "PUG ARG" to check whether page contents sniffing works. Its page doesn't reference any Bugzilla issue or Wiki page, while https://wiki.mozilla.org/Firefox/Shield/Shield_Studies/Queue https://wiki.mozilla.org/Firefox/Shield/Shield_Studies/Queue doesn't list it. The source code references https://support.mozilla.org/kb/lookingglass https://support.mozilla.org/kb/lookingglass, which (as of now) only says "test - 12817". The add-on tests whether specific words can be detected on sites; the current list has nice picks like "revolution" and "privacy". Of course, this is only a test, but in the future Firefox might look for specific terms in the pages you load and do specific things based on them. The other thing it's doing is to send an extra header to three specific sites: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b089405ca96fc68b999d2b624ef4/addon/webextension/background.js#L52 https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894.... I suppose the words and the domain are a reference to the Mr. Robot series. The add-on describes itself as an "Augmented Reality Game Experience" and was made by a certain "PUG Experience Group": https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b089405ca96fc68b999d2b624ef4/package.json https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894.... Of course, Shield Studies are supposed to be a way of making "more informed product decisions based on actual user needs". https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_looking_glass/ https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...

deleted 9y ago
[deleted]
_Codemonkeyism 9y ago
Wow, FF is sniffing the content and changing words. Could not think of anything worse a web browser could do. Do they change political arguments on pages in the future to see how I react in a user study? Signed Mr. Guinea Pig
- shak77 9y ago
  >Do they change political arguments on pages in the future to see how I react in a user study? It's possible: https://blog.mozilla.org/blog/2017/08/08/mozilla-information-trust-initiative-building-movement-fight-misinformation-online/ https://blog.mozilla.org/blog/2017/08/08/mozilla-information...

edibleEnergy 9y ago

Somewhat tangential to this particular issue, but this is a good lesson for developers in why you should be dry and explicit in your writing. Sure `alert("FFFUUU WHY U NO WORK");` keeps you entertained for 5 minutes while you debug a problem but when that accidentally gets to prod...

napsterbr 9y ago
I see you, but your example outlines a problem with the process/workflow, not with the developer.
- scott_karana 9y ago
  GP meant the style of writing English, not code. Funny messages almost always end up causing problems at the end of the day.

kotrunga 9y ago

Go to settings, look in Firefox Data Collection and Use. Why are these turned on automatically? Plus, I turned mine off, and now they're back on again, with this looking junk installed. What the heck Mozilla? What happened to caring about the users? We definitely can't trust Mozilla anymore.

nikanj 9y ago
Firefox has a tendency of resetting it's settings. I think the UI calls it "Refresh", but it's basically yet-another-nagbar that we all know and hate.

linkmotif 9y ago

Didn’t I see something on here recently about Mozilla increasing its revenue significantly? [0] ;) [0] https://news.ycombinator.com/item?id=15880565 https://news.ycombinator.com/item?id=15880565

cJ0th 9y ago

Ffs .. I've just checked my addons b/c of the headline and sure enough it has been installed against my will. I've been very loyal to mozilla over all these years but this really is not ok. If they keep doing shit like this I'll switch to a fork.

ChrisSD 9y ago

I'm using FF57 and did not get this addon. Was I just lucky?

esseti 9y ago
same. is it just US stuff?
- majewsky 9y ago
  I'm in Germany and it was installed here.
0xFFFE 9y ago
Running 57.0.1, and I don't see it either.
eref 9y ago
Same with 57.0 on macOS 10.12. Edit: I have FF Studies disabled under about:preferences#privacy. I guess that is the reason why it is not installed on my machine.
jasonlotito 9y ago
Running FF58. I don't have it either. I also don't agree to stuff unknowingly. It's clearly spelled out in the settings under privacy that you can agree to this stuff. Nothing I've seen suggests this isn't happening. People are saying things but no one is backing up any accusations with any proof yet.

exikyut 9y ago

HOLD THE PHONE The support thread links to https://support.mozilla.org/en-US/kb/lookingglass https://support.mozilla.org/en-US/kb/lookingglass. That page says, in a clearly delineated box, > No changes will be made to Firefox unless you have opted in to this Alternate Reality Game. PLEASE EXPLAIN THIS INCONSISTENCY.

LyndsySimon 9y ago
Hopefully, it's a bug, and that addon wasn't intended to be installed (much less active) universally like it is. That doesn't make it OK, but it would make me look at them with suspicion instead of hostility.
- gr3yh47 9y ago
  >Hopefully, it's a bug, and that addon wasn't intended to be installed (much less active) universally like it is. hey look, a voice of reason! seriously. Mozilla is a company that has a long track record of dedication to openness and the free and open internet this isnt Google, facebook, etc let's all take a step back and give them a little benefit of the doubt here, until we get some facts on what happened. for everyone else... WANT TO JOIN THE MOB? I'VE GOT YOU COVERED! COME ON DOWN TO GR3YH47'S PITCHFORK EMPORIUM! I GOT 'EM ALL! SETTING UP SHOP IN HACKERNEWS MEANS BIG SALES! CHEAP TRADITIONAL FORKS! ON SALE! Traditional ---E Left Handed 3--- Fancy ---{ DEFECTIVE CLEARANCE ARE EVEN LOWER! ---F ---L ---e NEW IN STOCK. DIRECTLY FROM LICHTENSTEIN. EUROPEAN MODELS! ---€ ---£ *some assembly required
  - nickpeterson 9y ago
    Don't forget torches, you have to burn down the evil castle or else they'll just hide until everyone leaves.
  - icebraining 9y ago
    Mozilla is a company that has a long track record of dedication to openness and the free and open internet True, and that's why I never stopped and recommending Firefox since I first installed Phoenix. That said, they're already installing and enabling Cliqz by default (for some users), and that's no bug. So it's not absurd that people might assume this isn't either. Reputation is hard to gain and easy to lose.

jerianasmith 9y ago

Having issues with your extra? Beginning with Firefox 57 (in discharge), just additional items manufactured utilizing WebExtensions APIs, the new innovation for Firefox expansions will work.

majewsky 9y ago

In the Preferences, scroll down to "Data Collection and Use", and disable everything. I know that you only need to need to turn off "install and run studies", but this has now cost Mozilla all telemetry data from me, and I encourage everyone to do the same.

bronson 9y ago
It's not easy to keep them turned off. Browser upgrades seem to silently re-enable things.
- akerro 9y ago
  What platform are you on?
sundarurfriend 9y ago
I've switched to Waterfox, because of things like this (including the Cliqz issues). I'm all for Mozilla making money and trying things, the problem is the way in which they do it. They fail to respect the users enough to communicate things, and have not been behaving like a user-friendly transparent company for some time now. I was a big enough fan to regularly donate and urge friends to do the same, but something has gone wrong inside the company.
- majewsky 9y ago
  I heard about Waterfox, but support for legacy extensions is a huge warning sign. I don't want to be stuck on FF56 technology forever.
nawitus 9y ago
Why can't I see the "install and run studies" option? Is it because I'm using Finnish language Firefox?

Sir_Cmpwn 9y ago

What the fuck Mozilla? You can't just sideload extensions that are literally ads. There is no universe in which this is even a little bit okay. http://qutebrowser.org/ http://qutebrowser.org/

pecg 9y ago
And this is exactly what I'm going to do, switch to a simple browser, in my personal computers. If they programmed firefox to be capable of doing thinks like this, then definitely I cannot trust them anymore.

linkmotif 9y ago

I checked out FF for the zillionth time the other week after the Quantum release hoping to love it, but the deep Pocket integration was just too offputting. Turning it off requires some Googling. There were other irritating commercial things too. It’s a shame. FF is probably the most important open source project in the world and it’s a shame they do stuff like this. I’m still on Chrome :(

sp332 9y ago
Firefox bought Pocket. So it's a first-party feature.
- throwaway2048 9y ago
  I cant help but feel mozilla bought pocket because they wanted to justify the included adware nature of it as a first and foremost priority, after all the supposed logic of including it was all about reducing costs for mozilla..
calcifer 9y ago
> but the deep Pocket integration was just too offputting You mean the single button that does literally nothing until and unless you click on it?
- linkmotif 9y ago
  Yep, that button was really annoying. And the Pocket thing on the home screen, too. And the fact that I had to Google to figure out how to disable it. If you must know why, I don't want promos for particular web properties in my browser. I find Pocket to be annoying conceptually (a service to help you carry around all the things you didn't and won't read—eww, no, no thank you), and I don't want to look at it every day. I don't want to have to Google to figure out how to disable it. I don't want my browser to come with nonsense I need to disable. > You mean the single button that does literally nothing until and unless you click on it? This must be the kind of mentality that leads people at FF to do silly things like mentioned on this thread, or having "just one button" for their acquired web property. That's the opposite of how great product minds think. Great product people think "how can I REMOVE this button?" Not "how can I get away with having it?"

deleted 9y ago

[deleted]

sumanthvepa 9y ago

I've been seeing the YouTube logo inverted recently. I wonder if this has something to do with it. If so. I'm done with Firefox. I've used it since it was Netscape in 1996. Enough is enough.

nicolaslem 9y ago
This has nothing to do with Firefox, it was Youtube promoting its Youtube Rewind: https://en.wikipedia.org/wiki/YouTube_Rewind https://en.wikipedia.org/wiki/YouTube_Rewind

deleted 9y ago

[deleted]

pgl 9y ago

Previously: * https://news.ycombinator.com/item?id=15921134 https://news.ycombinator.com/item?id=15921134 This is a link to the GitHub issue: * https://github.com/gregglind/addon-wr/issues/36 https://github.com/gregglind/addon-wr/issues/36 There are several scary things about this: - Unknown Mozilla developers can distribute addons to users without their permission - Mozilla developers can distribute addons to users without their knowledge - Mozilla developers themselves don't realise the consequences of doing this - Experiments are not explicitly enabled by users - Opening the addons window reverts configuration changes which disable experiments - The only way to properly disable this requires fairly arcane knowledge Firefox preferences (lockpref(), which I'd never heard of until today)

callahad 9y ago
Just coming up to speed, apologies for the potentially obvious questions. 1. Can you explain what you mean by "unknown Mozilla developers?" Unknown to whom? 2. Can you provide more detail on what specific configuration changes are reverted when opening the add-ons window? That sounds like a fairly serious bug. 3. What is the specific "this" you're trying to "properly disable?" You shouldn't have to dive into things like lockpref. Mozilla (and other browser vendors) have the ability to push updates to their browsers outside of the normal release cadence. In many cases, these updates are distributed as add-ons, as they're cleanly separated from the rest of the browser internals, but that's just an implementation detail. If you visit about:support in Firefox, you should see a table of "Firefox Features," which are exactly that. Their source lives at: https://hg.mozilla.org/mozilla-unified/file/tip/browser/extensions https://hg.mozilla.org/mozilla-unified/file/tip/browser/exte... For example, we used a system add-on to control the gradual roll-out of multiprocess Firefox, and the New Tab page is also implemented as an add-on called "activity-stream."
- GrayShade 9y ago
  I'll try to answer in the parent's place, since I've been watching this issue. > Can you explain what you mean by "unknown Mozilla developers?" Unknown to whom? Unknown in the sense that this extension wasn't documented at all, there was no Bugzilla issue for it and it's not clear whether it was properly vetted by QA. Whether you argue that this kind of silent push updates is good or bad, I think they aren't tested as well as in-browser functionality. This is a necessary consequence of "let's try it and revert if something breaks or people complain". More so, a rolled back Shield study will be invisible to the users, so any problems will be impossible to debug. This is made worse by the fact that most, if not all Shield studies are opt-out, so the user won't be notified. > Can you provide more detail on what specific configuration changes are reverted when opening the add-ons window? That sounds like a fairly serious bug. > What is the specific "this" you're trying to "properly disable?" You shouldn't have to dive into things like lockpref. People have reported that extensions.ui.experiment.hidden reverts after viewing the add-ons list. I haven't tried it myself, but you can find details in that Reddit thread. Others have noticed that the Shield studies checkbox sometimes (possibly on version bumps) reverts to enabled. I can't overstate how bad this is; it's basically cheating the users' trust. Lately, Mozilla has been doing some pretty nasty things for an organization that takes pride in caring about the privacy of its users. Are you aware of the complaints regarding Windows telemetry? Edge, for example, sends full browsing history to Microsoft by default. Should Mozilla follow suit? Because that's exactly what Pioneer does and, while it's not opt-out yet, Firefox advertises enabling it. As for the rest of the system add-ons, they're either poorly documented (if they are at all), poorly named ("Presentation"), or seem concerning from a privacy point of view (e.g. Activity Stream, Follow-on Search Telemetry, Photon onboarding, Presentation, Web Compat Reporter). For anyone curious, Presentation seems to be an implementation of a proposed Web API that allows browsers to find and talk to devices in their neighbourhood. Does that include location/proximity beacons like this old proposal https://hacks.mozilla.org/2013/06/the-proximity-api/ https://hacks.mozilla.org/2013/06/the-proximity-api/ ? Do users really want Firefox to tell advertisers where they're shopping? That's the same kind of "experience improvement" that the spyware of yore used to bring. Why should Pocket be an add-on with superpowers? There was quite a bit of backlash over it a while ago, but Mozilla didn't budge, and some employees actually spread misinformation (not to say "lied"). And actually none of my system add-ons seems to be providing any important functionality (if you disregard the new tab page, for which I haven't seen yet a privacy policy). Looking at Shield studies ( https://www.jeffersonscher.com/sumo/shield.php https://www.jeffersonscher.com/sumo/shield.php ), it's even worse: most are surveys, advertisements, asking the user to enable Pioneer (i.e. send full browsing history to Mozilla).

_Codemonkeyism 9y ago

One step ahead (Quantum), two steps back.

zeep 9y ago

I use Firefox 58 beta developer edition in the USA and this extension didn't install automatically... Maybe the government need to start sponsoring Mozilla so that they stop doing things like this.

garganzol 9y ago

Mozilla Firefox installer is signed by a code-signing certificate. But at the very end it means nearly nothing: if the developer cannot be trusted, no amounts of certificates, green bars, smart screens, stores and walled gardens can fix that. That's a very important point to grasp, as I hear a lot of voices nowadays claiming that the modern security model (read walled gardens of all kinds) is the universal panacea. Just the opposite, it brings a false sense of security making you more vulnerable. It also tends to inhibit a healthy and free market competition when a lot of potentially good software suppliers are gated off from the walled gardens from the start.

fixermark 9y ago
In general though, what is the alternative to trusting the source and distributor of a piece of content? As you've noted, if you can't trust the developer, the walled garden is irrelelvant... But if you can't trust the data source, isn't basically everything about the medium irrelevant? In contrast, if you do trust the data source, why is a walled garden model of security worse than alternatives?

deleted 9y ago

[deleted]

CoolGuySteve 9y ago

This is the second spyware extension in recent memory. How hard is it to fork Firefox with all this stuff hardcoded off?

wila 9y ago
waterfox? or perhaps pale moon are what you are after?

mcintyre1994 9y ago

Menu > Options > Privacy & Security > untick Allow Firefox to install and run studies I deliberately kept that enabled initially but if they're going to use it for Adware..

pythonaut_16 9y ago
If you're still using Firefox after this it's probably safest and best just to disable everything under Firefox Data Collection and Use

pmlnr 9y ago

FF 57 installed from Debian unstable repository has "Data reporting is disabled for this build configuration" - which disabled, in theory, the shield "studies" as well. I don't know who made this decision at Debian, but thank you.

chippy 9y ago
I wonder if the Ubuntu stable ones have this too?
- trendia 9y ago
  Ubuntu once sent everything typed in the search bar to Amazon, so...
- YtvwlD 9y ago
  Ubuntu stable seems to have disabled this as well.

_Codemonkeyism 9y ago

Anyone know how I can turn off Firefox sending technical details and interactions? Everytime I turn this off, and restart FF it's on again. 58.0b11

kuschku 9y ago
If you are on a Nightly or Developer build, you can not turn it off, I asked on Mozilla’s IRC. Downloading these builds is considered opt-in into telemetry, and toolkit.telemetry.enabled is hardcoded to enabled, the opt-out checkbox literally does nothing, I was told. And about:config confirmed this.
- _Codemonkeyism 9y ago
  Thanks for the insight. Would be good UI to a.) disable the control b.) add a comment.
- djsumdog 9y ago
  Wow ... that's .. disturbing
- detaro 9y ago
  Okay, having a checkbox that does nothing is really bad. The fact that the privacy policy only just says something like "this policy might not apply to non-release builds", without actually having a policy for those also is more than questionable.

sjroot 9y ago

I just checked my installation of Firefox and this addon was present as well. The developers involved (Greg Lind et al) should acknowledge this and apologize.

Danihan 9y ago
Same, why is this in my addons..? I really don't understand what they were thinking.

Sytten 9y ago

And this is one of the reasons I stopped my yearly donation to the Mozilla foundation even if I love the new FF. If they need money so badly they should push their donation campaign and keep their products clean instead of pushing some shady alliances with big corporations.

igravious 9y ago

Between broken font handling and this Looking Glass thing whatever it is Firefox 57 (Quantum) has been less than stellar.

ksec 9y ago

I just wanted to add a few things. 1. I notice it yesterday, only because Avast was showing I have a low trust level Add-On installed in Firefox. 2. I googled it, and the first results was from Mozilla, showing it was part of their studies and experiment. 3. That was Ok, because I trust Mozilla, although somewhere in the back of my mind I thought every studies were supposed to be opt-in, since I have a few Add On installed in the week and I dont restart my browser, I thought i might have clicked it by mistake. 4. Now I am reading this through, I am more then worried. If I am reading the online comment correctly, Mozilla installed an Add On without user permission, enabled, collected data, and not for their own UX studies but a third party. And to make the matter worst, that Add-On is now gone. It disappeared in my Add on Screen now I just check. Call me old fashion but that is not how i view privacy. Like I said before, Mozilla's management and culture has a tendency of self destruction and messing things up right after they start being good. Still this is turning around much quicker then I thought.

dao- 9y ago
It seems to have disappeared from about:addons because the "study" has ended. In about:studies I see: > pug-experience > Complete • My reality is different than yours
franga2000 9y ago
I cant find any indication that Mozilla was collecting any data from this addon, either for themselves or for anyone else. The only way anyone would even be affected by it is by going to one of 3 hard-coded websites owned by the network behind Mr. Robot (a show known for putting easter eggs all over the web) and hovering over some text. It's definitely a dick move, but it isn't spyware as some people are saying, just a very poorly executed promotion.

deleted 9y ago

[deleted]

pythonaut_16 9y ago

Just checked and saw the Looking Glass add-on installed on my work laptop. I've uninstalled Firefox and will be removing it from all of my computers. I had just started slowly migrating back to it with the performance enhancements in the latest update, but honestly I don't think I can get past a breach of trust at this level.

MikkoFinell 9y ago
Are you switching to Chrome, the browser that sends your every keystroke back to HQ?
- pythonaut_16 9y ago
  Google does a lot of things but they've never betrayed my trust by installing an extension in conjunction with a third party without telling me. Google does track a lot of my data but they provide useful services in exchange, and in addition they make it pretty easy to see what data they have on me. Also Google's data is its competitive advantage so our interest in protecting my data from 3rd parties is aligned. In short, Google tracks me sure, but they're pretty transparent about it. I do think some of the things Google does with Chrome and it's market position is less than stellar so I'm still exploring other options. If you have any suggestions I'd be happy to hear them.
  - MikkoFinell 9y ago
    Thanks, thats the funniest thing I've read all week.
    - issaria 9y ago
      You missed the joke.
  - fiala__ 9y ago
    > but they're pretty transparent about it They may be transparent about the fact that they're tracking you, but not about what they're tracking or when they're tracking it. And there's no way for you to find out because the vast majority of their software is not open source.

alkonaut 9y ago

If they state as an explicit principle that no addons/studies are actually enabled unless the user opted in, then I’m going to give them the benefit of the doubt that if that happened to users that did not opt in, it was a terrible mistake (I.e a bug). I can tolerate bugs, much more than I can tolerate sneaky app behavior. But I hope the statement about explicit opt-in will be repeated, and this will be explained. At first I thought it must have been users that explicitly had opted in, but with so many users claiming they haven’t, it seems unlikely. The next possibility is that preview versions have things opt-out instead of opt in (because in preview versions you need more data from users - typical for closed alphas etc) - but then this should be very clearly explained on download/install.

nogridbag 9y ago
Just installed Firefox a week ago on OS X. Just checked and I have Looking Glass installed. I'm usually very careful when installing software about things like this. I don't recall ever opting in to anything (including error reporting). So my guess is it's a default you have to disable in settings.
alkonaut 9y ago
I haven’t understood whether this thing is completely inert or actually does anything without opt in. If it is downloaded and listed without opt-in, but only actually invoked after opt-in, then I’ll call it acceptable (not great, but not terrible either)
- callahad 9y ago
  The source is at https://github.com/gregglind/addon-wr/ https://github.com/gregglind/addon-wr/ Its startup is controlled by the addon/bootstrap.js file. Per line 22, it's completely inert unless the user manually toggles `extensions.pug.lookingglass` in about:config: https://github.com/gregglind/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js#L22-L24 https://github.com/gregglind/addon-wr/blob/59659431fd2a75c33...

randomString1 9y ago

Once again saved by https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js

kamranjon 9y ago

I actually discovered this because my browser would not stop running at 100% cpu utilization about 3 days ago, not doing anything, just sitting at Google.com with one tab open. It freaked me out because I couldn't find any documentation on the extension. Once removed Firefox was running fine again. I guess I'm relieved to know it wasn't some malware or something more sketchy, but I am wondering what it was doing pegging my cpu at 100% whenever my browser was open...

callahad 9y ago
Whatever you experienced is very unlikely to be caused by this add-on. The add-on only initializes if you manually dig into about:config and enable `extensions.pug.lookingglass`. Otherwise, it just starts up once at browser launch, checks that preference, and shuts itself down. (https://github.com/gregglind/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js#L22-L24 https://github.com/gregglind/addon-wr/blob/59659431fd2a75c33...) If you're able to consistently reproduce the issue, please let me know.

blauditore 9y ago

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the add-on does nothing until the user opts-in on studies.

pmlnr 9y ago
> it doesn't really matter since the code is coming from Mozilla For now, yes. Until someone finds a way to push a "study" through which is not from someone "trusted". > If someone distrusts their add-ons, why trust their browser at all? Well, trust is rather simple to break, and this - remote installing things - was not part of my original trust I put in Firefox 1.0. I know things change. This is not one I tolerate, and you are right: I will not trust a browser after a step like this. Besides the trust, it's unexpected data. Probably don't effect many on big data plans, and is probably a tiny extension this time, but it's still data I have not asked for.
skymt 9y ago
Speaking for myself here, but I'm not concerned that Mozilla might push malware into Firefox installations. I'm concerned about the lack of judgement in pushing an extension with a vague, scary-sounding name and description simply for a cross-marketing tie-in, and I'm worried that it could have damaged the trust ordinary users have in Firefox.
- pmlnr 9y ago
  > I'm not concerned that Mozilla might push malware into Firefox installations Nobody is concerned about that, in my opinion. I'm concerned someone will push malware through Mozilla into Firefox installations. Pushing addon installs should not be possible at all.
  - kibibu 9y ago

MikkoFinell 9y ago

Canceled my monthly donation because of this.

dymk 9y ago
I deleted my Facebook because of this and I'm much happier as a result.

confounded 9y ago

While I agree that releasing this as an undocumented extension was a poor PR move, in practical terms, I don’t see how this is any more insidious than the ‘no internet’ dinosaur jumping game built in to chrome. Both are first-party. The difference seems to be that the dinosaur game keeps you entertained, where as this hopes to promote awareness of privacy/security.

mynewtb 9y ago
The dinosaur was not placed there by a movie studio to promote a random.movie.
- confounded 9y ago
  Neither was the Looking Glass extension.
  - trendia 9y ago
    It is related to Mr Robot
SpliffnCola 9y ago
>"I don’t see how this is any more insidious than the ‘no internet’ dinosaur jumping game built in to chrome." You don't see the difference between a built-in game (included in the installation of Chrome) vs. Mozilla pushing an add-on to a Firefox installation using a channel meant for helping to improve the browser?
- Sylos 9y ago
  Mozilla could have just as well pushed this as part of the binary via auto-update.

natch 9y ago

The cringe-worthy construction "different than" which should be "different from" makes this episode even worse.

deleted 9y ago

[deleted]

UmmNope 9y ago

Mozilla takes in about half a billion dollars per year, has anyone considered the consideration for which this money is being paid ?

callahad 9y ago
That's FUD. Mozilla is a 501(c)3 non-profit, and our audited financial statements and IRS Form 990 can be found at https://www.mozilla.org/en-US/foundation/annualreport/ https://www.mozilla.org/en-US/foundation/annualreport/
- jordigh 9y ago
  Mozilla is... both. There's the Mozilla Foundation which is a nonprofit and the Mozilla Corporation which is very much not. I've never quite understood what each Mozilla does, but AIUI, the Firefox development is all done by Mozilla Corp and the nonprofit does stuff like make those cute videos about how Firefox is going to save the world and make us all smiley and multiethnic. I've talked to a number of Mozilla employees, and they also seem confused about the relationship between the corp and the foundation.
  - callahad 9y ago
    The Mozilla Corporation ("MoCo"), which develops Firefox, is a wholly owned subsidiary of the non-profit Mozilla Foundation ("MoFo"). Each has its own board of directors, but the Corporation exists to serve the public benefit goals of the non-profit. The link above has a decent overview, and if you're especially curious, bylaws and articles of incorporation for each are at https://www.mozilla.org/en-US/foundation/about/ https://www.mozilla.org/en-US/foundation/about/.
  - Sylos 9y ago
    The Mozilla Corporation is 100% owned by the non-profit Mozilla Foundation, so any earnings that the Corporation makes, they either have to reinvest, put it to the side to reinvest it later or pay it out to the Foundation, where it's again in non-profit hands (i.e. forced to invest into their specified mission). The only way that the Corporation could do shenanigans, is by paying their employees higher wages than would be necessary to hold them or is considered reasonable for the job that they do. It was set up, because there's limits to how much money a non-profit is allowed to put to the side, which would have limited Mozilla's strategic flexibility.

arunc 9y ago

This is disappointing rather. When Mozilla spent $$ in advertising Firefox Quantum in the internet media articles, they could have mentioned this at least somewhere in them.

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

Tomte 9y ago

I like Mozilla a lot. And this extension doesn't really bother me, since it's benign. But oh boy, do they have a talent for always doing benign and harmless things that look bad at first glance. It's almost like they want to turn away typical messaging board users.

seanalltogether 9y ago

As of about 5:30 GMT it looks like the addon was automatically removed from my browser. I know I saw it a couple hours ago.

r1b 9y ago

Doesn't bother me at all - I am fully acclimated to the idea that the browser and other applications do run arbitrary A/B test and other code all the time.

gaius_baltar 9y ago

I haven't noticed this extension sending data to outside services. Did somebody find if/where it does that? If it is sending personal or browsing-related data out, we can flood the servers with garbage.

jordigh 9y ago

So, a lot of people in this thread are saying that Mozilla is a non-profit. There are in fact two Mozillas. One is the Mozilla Foundation, which is the non-profit. They are not involved with Firefox development, as I understand it. The Mozilla Corporation, which I think is owned by the non-profit, does the development. I think the foundation just does cute videos and outreach and other things not directly related to writing software. I also understand that if you donate money to the Mozilla foundation, the money would not make it to Mozilla corp and thus would not pay for the salary of any Firefox hacker. I've never quite understood how exactly does this financial arrangement work and I would be grateful to anyone who could explain this to me.

CommieBobDole 9y ago
It's the other way around - the foundation owns the corporation. https://en.wikipedia.org/wiki/Mozilla_Corporation https://en.wikipedia.org/wiki/Mozilla_Corporation

hitekker 9y ago

1) Mozilla uses weird, spooky language in an add-on. 2) Users are justifiably concerned. 3) Mozilla explains that the add-on is actually anodyne; the developers responsible were having fun with an opt-in research service. 4) Some users try to justify their initial overreaction by painting Firefox as mysterious, dangerous entity, fabulating conspiracy theories about one of the most forthright and open OSS companies in the world. Really, guys. If Mozilla was hellbent on invading your privacy, do you really think they would proudly entitle their tracker "Looking Glass". Or would they call it debugservice_1223?

Karunamon 9y ago
3.5) Most users insist that this isn't okay, that addon installations should be approved by the owner of the computer. This isn't about what the addon itself does or does not do, it's the principle of force-pushing unwanted content without prior affirmative consent. This would apply even if the addon was just a stub that didn't have any executable code in it. In this case, it's worse: an ad.
- takeda 9y ago
  When you install Firefox it asks whether you want to take part in these studies. You can also change the setting at any time in preferences (about:preferences#privacy section).
- hitekker 9y ago
  I would agree with you, if the add-on in question was not developed, shipped, and offered by the people who made the browser, of which the add-on sandbox is a part. In my view, that sandbox is a trusted area between the browser and the user. Mozilla has the privilege accorded to it as the developer of the browser, to modify the addon sandbox so long as they don't infringe on my interests, e.g., security, stability, privacy, speed. For example, Chrome automatically disable extensions that ask for too many new permissions upon update. Chrome will also make it difficult to add extensions that are not listed on the chrome store. If we remove the right for browser developers to install, uninstall and alter add-ons, then we're essentially forcing them to modify the browser instead, which is overkill for the add-on in question. At the end of the day, if you can't trust the developers of your browser, then you should install another one and disable add-ons entirely. 3.5 falls into 4.

herogreen 9y ago

What I really do not understand is why this game thing was installed automatically given that websites can ask the user to install an extension when they land on a webpage. A popup that is part of Firefox shows up and asks the user if he really wants to install it.

megamindbrian2 9y ago

They should rename Firefox to Fiasco.

heroprotagonist 9y ago

I don't remember if this is opt-in or not, but I do not have it in my Firefox. Maybe I just removed it myself immediately after first install, when I went through to update all of the privacy and other browser settings. I agree that it seems like a crappy extension, and people should be upset about things being preloaded to their browser. But there's a point here to be made, that if you're concerned about privacy at all today, you need to look at the settings of any software after you install it. It doesn't matter how much previous trust you have for the developers. This should just be default behavior so that any surprise is met immediately, and not after any damage it could perform has been done.

zb3 9y ago

The best way to disable these things is to go to about:config, search and delete/replace all mozilla urls. For this particular case, the api url is probably in "extensions.shield-recipe-client.api_url" [0] [0] - https://dxr.mozilla.org/mozilla-central/source/browser/extensions/shield-recipe-client/bootstrap.js https://dxr.mozilla.org/mozilla-central/source/browser/exten...

fishywang 9y ago

Is the "Unknown" part in the title really unknown, or just Mozilla trying to protect its developer(s) from pitchforks? If it's really "unknown", then that's the really concerning part.

bitmapbrother 9y ago

Big Browser is watching. Browse freely with Firefox. https://pbs.twimg.com/media/DDsLeqvV0AE1k-2.jpg https://pbs.twimg.com/media/DDsLeqvV0AE1k-2.jpg The hypocrisy is amazing.

rrdharan 9y ago

TechCrunch and Gizmodo just picked up the story: https://techcrunch.com/2017/12/15/mozillas-mr-robot-promo-backfires-after-it-installs-firefox-extension-without-permission/ https://techcrunch.com/2017/12/15/mozillas-mr-robot-promo-ba... https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-into-firefox-1821332254 https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-... Also AFAIK the second link has the first official response of any kind? "A representative told Gizmodo the company is looking into the issue."

FrozenVoid 9y ago

I switched to waterfox for quite awhile. I've lost trust in mozilla when they bundled "Pocket" and people then didn't think much of it. When you lose ability to control the browser its no longer a fair game. Bundling addons, changing settings, ads and "enhancements" no one asked for, all eroded trust. Not to mention its aping Chrome more and more each version. We need more firefox forks, not less. Chrome has dozens, because the privacy threat from google is obvious: firefox hdoesn't have that much forks,because its trusted by distro makers to be safe(but its not, as mozilla just proved). People are upset when this implicit assumption that Firefox is the only browser(among modern graphical browsers) you can trust is actually false.

mshenfield 9y ago

From the wikipedia article. linked in the ticket > Shield Studies are available on all channels. Individual studies can be opt-out or opt-in and any and all data being collected will be declared openly. After confirming willingness to participation, a self expiring add-on will be installed on the user's machine. Mozilla is only installing an experimental feature ass an add-on if they opt in.

jstewartmobile 9y ago

Posted here a few days ago about how Mozilla being for-profit joined at the hip with a non-profit seems kind of shady, and got dogpiled for it. Then they do this as a tie-in for Mr. Robot. Vindication!

sharno 9y ago

It's a PR disaster from Mozilla. I was once a Mozilla rep and I'm ashamed of this. Studies like these should always be turned off by default and the user can opt in voluntarily. But launching Firefox and digging into the preferences to find that I'm enrolled into some studies by default is unethical for me. Sadly, I'll have to switch to Brave or some other privacy concerned browser until I see an official statement and action from Mozilla. I'm sure the management there have something to do with all of this.