5 ms·

It wasn't supposed to be visible on the addons page

by bwat49 9y ago

mark-r 9y ago
I don't think that makes it better. Knowing that there's a way to get an addon installed invisibly is going to be more justification for paranoia.
- bwat49 9y ago
  You can disable these studies under Options | Privacy and Security
  - _red 9y ago
    I hate the fact that Firefox increasingly makes me jump through all sorts of hoops to find all the hidden options to turn off their various spyware attempts. Its the Win10 of browsers...
    - teddyfrozevelt 9y ago
      Going through your browser settings really is quite the hoop.
      - _red 9y ago
        Yeah, its so intuitive for the average person to type: about:config in address bar and scroll through hundreds of oddly named parameters to turn off spyware. Comments like yours are illustrative of a certain mindset. When you encounter the complexity of domains you are not intimately familiar with (court system, law, finance, etc), and those complexities are designed specifically to make it hard for you to protect yourself, I'm sure you are just as understanding as you are now.
        deleted 9y ago
        [deleted]
        bwat49 9y ago
        You're being hyperbolic, you don't need to go into about:config. It's right in the main browser settings, under the Privacy and Security section where one would expect settings like this to be
        JadeNB 9y ago
        > It's right in the main browser settings, under the Privacy and Security section where one would expect settings like this to be If you asked me "where would you go to change settings to prevent the browser from violating your privacy and infringing on your security?", then, yes, I would go to "Privacy and Security". If, however, you asked me "what would you expect to find under 'Privacy and Security'?", my answer would be that that's where I would go to protect myself from malicious websites, not from malicious browsers. (I know that 'malicious' is quite, and almost certainly too, strong here, but the point is that I think, and am explicitly encouraged to think, of Mozilla as being on my side against the sites I visit, and I don't think it's natural to expect that I will start thinking of how I need to protect myself from Mozilla to use their products in the way that I, rather than they, intend.)
        bigbugbag 9y ago
        If what you say is true, please point me to where I can find the following privacy settings in the main preferences: network.websocket.enabled network.IDN_show_punycode dom.event.clipboardevents.enabled dom.storage.enabled dom.indexedDB.enabled dom.battery.enabled dom.enable_user_timing dom.enable_resource_timing dom.netinfo.enabled layout.css.visited_links_enabled browser.safebrowsing.phishing.enabled browser.safebrowsing.downloads.remote.enabled browser.safebrowsing.malware.enabled browser.send_pings beacon.enabled privacy.donottrackheader.enabled privacy.trackingprotection.enabled dom.enable_performance datareporting.healthreport.service.enabled datareporting.healthreport.uploadEnabled toolkit.telemetry.enabled toolkit.telemetry.unified media.peerconnection.enabled media.peerconnection.ice.default_address_only media.peerconnection.ice.no_host media.eme.enabled media.gmp-eme-adobe.enabled webgl.disabled geo.enabled camera.control.face_detection.enabled device.sensors.enabled security.tls.unrestricted_rc4_fallback security.tls.insecure_fallback_hosts.use_static_list security.ssl.require_safe_negotiation security.ssl.treat_unsafe_negotiation_as_broken
      - linkmotif 9y ago
        It is.
      - mynewtb 9y ago
        How are you supposed to do turn the defaults to a reasonable level of privacy without launching Firefox once though?
        takeda 9y ago
        I remember it was asking if I want participate in studies when I installed FF for the first time.
    - bigbugbag 9y ago
      There's an extension for that called privacy settings[1] it exposes all the settings in one easy place. I also recommend waterfox instead of firefox. [1]: https://addons.mozilla.org/en-US/firefox/addon/privacy-settings/ https://addons.mozilla.org/en-US/firefox/addon/privacy-setti... [2]: https://www.waterfoxproject.org/ https://www.waterfoxproject.org/
  - falava 9y ago
    You should opt in, not opt out
  - arprocter 9y ago
    Preferences/Options -> Privacy and Security -> Allow Firefox to install and run studies
- dahart 9y ago
  There almost certainly is not a way to invisibly install add-ons, unless you are part of Mozilla, and, you know, making Firefox. If paranoia is your thing, it might be worth considering that Mozilla can do anything it wants inside Firefox core, all of it is "invisible" to you.
  - bo1024 9y ago
    Yes and a big part of this entire issue is users deciding whether we can trust Mozilla with that power or not.
    - Sylos 9y ago
      And he's saying that this occurence should have no effect on this decision, not in any rational mind.
  - kuschku 9y ago
    And this is the point where even the most Mozilla-supporting users move away. For me, this is it, I’m going to Chromium. Fuck this shit, in the past months we had CliqZ https://news.ycombinator.com/item?id=15421708 https://news.ycombinator.com/item?id=15421708, we had Mozilla adding new telemetry, we had Mozilla force-enable toolkit.telemetry.enabled, we had Mozilla say that, if you download Nightly, that is considered opt-in to tracking, we had Mozilla put Google Analytics into the Addons menu (because it’s loaded from addons.mozilla.org: https://github.com/mozilla/addons-frontend/issues/2785 https://github.com/mozilla/addons-frontend/issues/2785 ), and we had Mozilla say that, if we don’t trust Google, we shouldn’t use Firefox. Fuck this.
    - Danihan 9y ago
      Great points, thanks for compiling these.. I was using firefox because I don't trust google. ;(
    - programd 9y ago
      Regarding telemetry, take a look at the settings in about:config. There are several toolkit.telemetry.Ping settings which are set to true by default. In the spirit of charity I'm going to assume that those phone home pings - on startup, shutdown, update - are not enabled unless telemetry is enabled. But I have not checked...
zzzeek 9y ago
that would be worse
- Sylos 9y ago
  How exactly? Whether they push out code to you by just changing the binary or by installing an extension makes no difference. In fact, pushing it out as an extension, means they actually have less control over your browser, because are bound to the restrictions that extensions have. Every browser vendor has this control over you when you use their browser. Some have even more, because they don't even need to tell you about it when they're closed-source.

It wasn't supposed to be visible on the addons page

by bwat49 9y ago

It wasn't supposed to be visible on the addons page

I don't think that makes it better. Knowing that there's a way to get an addon installed invisibly is going to be more justification for paranoia.

bwat49 9y ago
You can disable these studies under Options | Privacy and Security
- _red 9y ago
  I hate the fact that Firefox increasingly makes me jump through all sorts of hoops to find all the hidden options to turn off their various spyware attempts. Its the Win10 of browsers...
  - teddyfrozevelt 9y ago
    Going through your browser settings really is quite the hoop.
    - _red 9y ago
      Yeah, its so intuitive for the average person to type: about:config in address bar and scroll through hundreds of oddly named parameters to turn off spyware. Comments like yours are illustrative of a certain mindset. When you encounter the complexity of domains you are not intimately familiar with (court system, law, finance, etc), and those complexities are designed specifically to make it hard for you to protect yourself, I'm sure you are just as understanding as you are now.
      - deleted 9y ago
        [deleted]
      - bwat49 9y ago
        You're being hyperbolic, you don't need to go into about:config. It's right in the main browser settings, under the Privacy and Security section where one would expect settings like this to be
        JadeNB 9y ago
        > It's right in the main browser settings, under the Privacy and Security section where one would expect settings like this to be If you asked me "where would you go to change settings to prevent the browser from violating your privacy and infringing on your security?", then, yes, I would go to "Privacy and Security". If, however, you asked me "what would you expect to find under 'Privacy and Security'?", my answer would be that that's where I would go to protect myself from malicious websites, not from malicious browsers. (I know that 'malicious' is quite, and almost certainly too, strong here, but the point is that I think, and am explicitly encouraged to think, of Mozilla as being on my side against the sites I visit, and I don't think it's natural to expect that I will start thinking of how I need to protect myself from Mozilla to use their products in the way that I, rather than they, intend.)
        bigbugbag 9y ago
        If what you say is true, please point me to where I can find the following privacy settings in the main preferences: network.websocket.enabled network.IDN_show_punycode dom.event.clipboardevents.enabled dom.storage.enabled dom.indexedDB.enabled dom.battery.enabled dom.enable_user_timing dom.enable_resource_timing dom.netinfo.enabled layout.css.visited_links_enabled browser.safebrowsing.phishing.enabled browser.safebrowsing.downloads.remote.enabled browser.safebrowsing.malware.enabled browser.send_pings beacon.enabled privacy.donottrackheader.enabled privacy.trackingprotection.enabled dom.enable_performance datareporting.healthreport.service.enabled datareporting.healthreport.uploadEnabled toolkit.telemetry.enabled toolkit.telemetry.unified media.peerconnection.enabled media.peerconnection.ice.default_address_only media.peerconnection.ice.no_host media.eme.enabled media.gmp-eme-adobe.enabled webgl.disabled geo.enabled camera.control.face_detection.enabled device.sensors.enabled security.tls.unrestricted_rc4_fallback security.tls.insecure_fallback_hosts.use_static_list security.ssl.require_safe_negotiation security.ssl.treat_unsafe_negotiation_as_broken
    - linkmotif 9y ago
      It is.
    - mynewtb 9y ago
      How are you supposed to do turn the defaults to a reasonable level of privacy without launching Firefox once though?
      - takeda 9y ago
        I remember it was asking if I want participate in studies when I installed FF for the first time.
  - bigbugbag 9y ago
    There's an extension for that called privacy settings[1] it exposes all the settings in one easy place. I also recommend waterfox instead of firefox. [1]: https://addons.mozilla.org/en-US/firefox/addon/privacy-settings/ https://addons.mozilla.org/en-US/firefox/addon/privacy-setti... [2]: https://www.waterfoxproject.org/ https://www.waterfoxproject.org/
- falava 9y ago
  You should opt in, not opt out
- arprocter 9y ago
  Preferences/Options -> Privacy and Security -> Allow Firefox to install and run studies
dahart 9y ago
There almost certainly is not a way to invisibly install add-ons, unless you are part of Mozilla, and, you know, making Firefox. If paranoia is your thing, it might be worth considering that Mozilla can do anything it wants inside Firefox core, all of it is "invisible" to you.
- bo1024 9y ago
  Yes and a big part of this entire issue is users deciding whether we can trust Mozilla with that power or not.
  - Sylos 9y ago
    And he's saying that this occurence should have no effect on this decision, not in any rational mind.
- kuschku 9y ago
  And this is the point where even the most Mozilla-supporting users move away. For me, this is it, I’m going to Chromium. Fuck this shit, in the past months we had CliqZ https://news.ycombinator.com/item?id=15421708 https://news.ycombinator.com/item?id=15421708, we had Mozilla adding new telemetry, we had Mozilla force-enable toolkit.telemetry.enabled, we had Mozilla say that, if you download Nightly, that is considered opt-in to tracking, we had Mozilla put Google Analytics into the Addons menu (because it’s loaded from addons.mozilla.org: https://github.com/mozilla/addons-frontend/issues/2785 https://github.com/mozilla/addons-frontend/issues/2785 ), and we had Mozilla say that, if we don’t trust Google, we shouldn’t use Firefox. Fuck this.
  - Danihan 9y ago
    Great points, thanks for compiling these.. I was using firefox because I don't trust google. ;(
  - programd 9y ago
    Regarding telemetry, take a look at the settings in about:config. There are several toolkit.telemetry.Ping settings which are set to true by default. In the spirit of charity I'm going to assume that those phone home pings - on startup, shutdown, update - are not enabled unless telemetry is enabled. But I have not checked...

zzzeek 9y ago

that would be worse

Sylos 9y ago
How exactly? Whether they push out code to you by just changing the binary or by installing an extension makes no difference. In fact, pushing it out as an extension, means they actually have less control over your browser, because are bound to the restrictions that extensions have. Every browser vendor has this control over you when you use their browser. Some have even more, because they don't even need to tell you about it when they're closed-source.