17 ms·

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the add-on does nothing until the user opts-in on studies.

pmlnr 9y ago
> it doesn't really matter since the code is coming from Mozilla For now, yes. Until someone finds a way to push a "study" through which is not from someone "trusted". > If someone distrusts their add-ons, why trust their browser at all? Well, trust is rather simple to break, and this - remote installing things - was not part of my original trust I put in Firefox 1.0. I know things change. This is not one I tolerate, and you are right: I will not trust a browser after a step like this. Besides the trust, it's unexpected data. Probably don't effect many on big data plans, and is probably a tiny extension this time, but it's still data I have not asked for.
skymt 9y ago
Speaking for myself here, but I'm not concerned that Mozilla might push malware into Firefox installations. I'm concerned about the lack of judgement in pushing an extension with a vague, scary-sounding name and description simply for a cross-marketing tie-in, and I'm worried that it could have damaged the trust ordinary users have in Firefox.
- pmlnr 9y ago
  > I'm not concerned that Mozilla might push malware into Firefox installations Nobody is concerned about that, in my opinion. I'm concerned someone will push malware through Mozilla into Firefox installations. Pushing addon installs should not be possible at all.
  - kibibu 9y ago
    I'm concerned about Mozilla pushing software written by the Mr Robot marketing department.
    - y_u_no_rust 9y ago
      Is the plugin opensource, where can we vet it? I can't find it on github or anything like I can with the other plugins I use
      - callahad 9y ago
        The source lives at https://github.com/gregglind/addon-wr/ https://github.com/gregglind/addon-wr/
        Ajedi32 9y ago
        Looking over [the contributors list][1], looks like the plugin was written entirely by Mozilla employees. So, no "Mr Robot marketing department", as some commenters here have been speculating. [1]: https://github.com/gregglind/addon-wr/graphs/contributors https://github.com/gregglind/addon-wr/graphs/contributors
        acqq 9y ago
        It's technicality. The description is still: "Looking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience." It doesn't matter who technically coded it. "Mr Robot marketing department" was obviously deciding about its existence, behavior and content -- if that description is true. But looking at the source of the extension, I find the following URLs inside: https://www.red-wheelbarrow.com/forkids/ https://www.red-wheelbarrow.com/forkids/ https://red-wheelbarrow-stage.apps.nbcuni.com/forkids/activitysheet/ https://red-wheelbarrow-stage.apps.nbcuni.com/forkids/activi... So it seems it is some marketing, the question is which company now, and do they change?
- jotux 9y ago
  I'm worried my work Security/IT department will see it, freak out, and blanket ban Firefox on all machines for 6 months.
  - 45h34jh53k4j 9y ago
    your work security team loves mr robot, it will be fine...
    - chris_wot 9y ago
      No, it really will not. My workplace saw that OpenOffice had a security issue, and banned it AND LibreOffice. Nothing I can do about it. Can’t argue. Trust is very, very easily lost and incredibly hard to regain. And it can hit innocent third parties. It’s very, very wrong to do anything that could destroy trust.
      - franga2000 9y ago
        Have they seen the shit that's been found in Microsoft Office? It seemed like there was a new RCE every week for while.
        chris_wot 9y ago
        I didn’t say it was logical.
  - bigbugbag 9y ago
    If this does not happen at your workplace, it will certainly happen at some other workplace around the world.
- WhitneyLand 9y ago
  I don’t see the harm in a good organization contributing lot of value to this world having a little fun. Some of the comments are mentioning IT managers banning firefox, those will be the same IT managers doing all the other pennywise/pound foolish things that make you try not to work on their team in the first place. Maybe it’s actually good to put something scary sounding in there to raise awareness. It could help people understand that scary phrases are not the most common sign of foul play. When the real hackers come for you, they usually dont look scary at all.
  - pavel_lishin 9y ago
    > I don’t see the harm in a good organization contributing lot of value to this world having a little fun. One potential downside is that now people might not pay close attention to the installed addons. "Oh, must be some Mozilla thing", as GoldenDwarf quietly consumes user CPU cycles to mine cryptocurrency for someone else.
    - flamedoge 9y ago
      This calls for.... anti mining extension. like adblock, miningblock.
      - deleted 9y ago
        [deleted]
  - ryanisnan 9y ago
    I don't look to my browser's implementation to "have a little fun". This is a foolish decision on Mozilla's part.
    - WhitneyLand 9y ago
      poor argument. ostensibly the only reason to separate business from pleasure is out of practical concerns. without stating practical concerns there’s no way consider the validity of your comment. who knows, you may totally change my mind, but as it stands it makes it difficult to disagree or agree with you.
- code_duck 9y ago
  Hopefully this helped people who were scared by it learn how to analyze add-ons for trustworthiness.
- TylerH 9y ago
  What's scary about "Looking Glass"? It's not named something like "PrivacyRemover" or "SpamEmailer" or anything.
  - bigbugbag 9y ago
    What was wrong about apple automatically adding a U2 album to itunes library ? Same here for looking glass, we do not want corporations to be in control of our stuff. Mozilla showing that they have built the capacity to auto install addons into your browser is quite the issue, you can rest assured that some are already working on ways to abuse this. That they have done it as a promotional marketing trick and not or something useful or serious sends the wrong kind of message on top of it.
TAForObvReasons 9y ago
If this were the first incident, and they quickly backtracked on it, then maybe we can give them a pass. But this isn't the first case of somewhat shady behavior. Remember the "user-enhancing" sponsored tiles a few years ago? https://twitter.com/dherman76/status/433320156496789504 https://twitter.com/dherman76/status/433320156496789504 > Excited to share the launch of @mozilla @firefox Tiles program, the first of our user-enhancing programs The problem there wasn't just the idea of putting ads in the browser, it was also the way in which they tried to present it as a useful addition just like every other ad company tries to defend ads
- callahad 9y ago
  That tweet sounds like doublespeak, but Directory Tiles really did have some genuinely good ideas mixed in with the bad. I don't know how far we got with it, but one of the ideas was to serve a generic bundle of ads, and then select which ones to display locally, based on an entirely private, client-side analysis of the browser's history. Now, that probably shouldn't have been on the new tab page, and probably not in Firefox at all, but if ads are going to be the way we fund the Internet, then that sounded like the best possible outcome: better targeting without remote tracking. Heck, even Brave ran with the idea for a while: https://brave.com/about-ad-replacement/ https://brave.com/about-ad-replacement/
  - revelation 9y ago
    You think because your code is running native you can spy on me better for ad purposes, and that's a feature? That is just tone-deaf.
    - smacktoward 9y ago
      The whole point is that they weren't spying on you. The observations of your behavior were made entirely client-side, in your browser, and never passed back to Mozilla or anybody else. Defining that as "spying" strikes me as a big reach. It's no more spying than (say) Windows observing what programs you use most and adding shortcuts to them in your Start menu. Software adapting itself to fit the user better is a good thing, as long as it's done in a way that respects the user's privacy, which keeping the data 100% local absolutely does.
y0ghur7_xxx 9y ago
> I haven't researched deeply, but apparently the add-on does nothing until the user opts-in on studies. It adds some css to a list of words: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b089405ca96fc68b999d2b624ef4/addon/webextension/background.js https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894...
- ryukafalz 9y ago
  The extension only starts up if the config option "extensions.pug.lookingglass" is set to "true" though: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b089405ca96fc68b999d2b624ef4/addon/bootstrap.js#L22 https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894... (It defaults to "false.")
  - revelation 9y ago
    We already have a mechanism for disabling or enabling addons, it's not installing them in the first place. Why on earth would we put it to addons to self-police them.
    - ryukafalz 9y ago
      It's behind a preference flag because it's installed automatically, and Mozilla's the only one who can do that. That's also why there's a lengthy approval process before such an addon can be pushed out: https://mozilla.github.io/shield-studies-docs/study-process/ https://mozilla.github.io/shield-studies-docs/study-process/
      - revelation 9y ago
        You can just not install (and enable) addons automatically. Those addons should only be delivered to users who have 1) opted into the study process and 2) opted into the study in the first place.
- lozenge 9y ago
  Only if the preference extensions.pug.lookingglass is changed from the default of false. I haven't figured out how that setting is exposed yet. Maybe they expect people to go to about:config and change it? Is there video footage suggesting that in the TV show? https://github.com/gregglind/addon-wr/blob/104-rename-less-vagueness/TESTPLAN.md https://github.com/gregglind/addon-wr/blob/104-rename-less-v...
vorpalhex 9y ago
This is being added to the browser, outside the realm of security updates, through what is supposed to be a UX improvement program, for commercial purposes. It's written by a commercial company that produces advertisement content. It's not clear this code is audited. Sorry, but I'm uninstalling firefox. They have broken the basic trust I have in them as a user to not push arbitrary code to my machine against my interests.
- benbenolson 9y ago
  What browser are you going to use instead?
  - rnhmjoj 9y ago
    If you like Firefox but don't trust Mozilla anymore there are plenty of forks to choose from: Waterfox, Pale Moon, Basilisk, GNU IceCat. Personally I build Firefox from source and maintain a set of patches largely based on these: https://aur.archlinux.org/packages/firefox-esr-privacy/ https://aur.archlinux.org/packages/firefox-esr-privacy/
    - Grollicus 9y ago
      I think about doing this as well but heard a lot of bad things about the firefox build process. How long does it take to build for you?
      - rnhmjoj 9y ago
        They are probably true. Using an i5 @4.3GHz it takes 2.5/3 hours to build. To test changes you must set up a compiler cache or it's going to take forever.
        notanote 9y ago
        That seems a little slow. I compile nightly for my own use and it takes around 20 minutes on a haswell i5, using tmpfs for the build directory.
xg15 9y ago
> If someone distrusts their add-ons, why trust their browser at all? "Well, I'm your bank. You already gave me authority to reinvest all your savings. Why are you mad now that I invested everything into bitcoin futures?" What exactly does "trust" mean? We might have given mozilla such a widespread access exactly because we trust them not to abuse it. Stuff like this undermine that trust.
- deleted 9y ago
  [deleted]
- fragmede 9y ago
  Maybe not be the best analogy since that is exactly what banks do with your money while it's parked in your savings account - invest it in whatever they feel like. Probably not Bitcoin futures because the bank manager doesn't want to, but there's nothing stopping them from doing exactly that.
  - xg15 9y ago
    No, the bitcoin futures were my point. Of course they can re-invest in principle but the trust is tgat they won't invest them into something that is an obvious risk. And no, they can't: In many countries there are regulations forbidding high-risk investments with regular savings accounts for exactly that reason.
- ryukafalz 9y ago
  How is this extension an abuse of that trust?
- jasonkostempski 9y ago
  Before, we didn't need to trust them, because we didn't have to. We had all the code, we could verify the code we can read is the code in the binary we use via checksums. Now the code contains the ability to go fetch arbitrary code behind our backs and run it against our will. Firefox is now malware and it's a real damn shame.
  - 9y ago
SwH85 9y ago
What it bugs me is not that Mozilla pushed and extension into my/their browser but the behavior of the extension itself. It literally broke some pages, disrupting my use experience more than it was supposed to do (or at least I hope it was not intended). Peoples who complain about Mozilla pushing this just failed to check the basic browser options and should blame themselves instead. Anyway Mozilla seem to have rised quite a lot of attention about the secuirity and the privacy of their own browser with this stunt, so... it was a success, I guess?
CmdrKrool 9y ago
To some extent, the line between code in the browser core and code in an add-on coming from Mozilla is arbitrary. However, it's a line that Mozilla themselves have drawn. We've been trained to be vigilant when choosing and installing add-ons, to read the list of permissions the add-on is asking for and judge whether we want to take the risk. The implicit messaging to users has been that if you let through a bad add-on that degrades the browser in some way, it's your fault. (Indeed, we're supposed to sympathise with Mozilla when 'badly-written' add-ons slow down the browser and make Mozilla look bad.) Mozilla have presented "add-ons" as a line where users are supposed to be responsible for what to "trust", over and above the choice to install the browser in the first place. They can expect those users to be watching that line carefully. (Incidentally, I would still dislike this functionality - moreso even - if it was in the browser core.)
kryptiskt 9y ago
The major problem is that they installed an add-on without properly communicating what it was. A somewhat smaller problem but still a big problem is that was an utterly frivolous add-on that shouldn't have been pushed to people who didn't explicitly want it. But the biggest problem is that Mozilla seems to have trouble understanding why any of those two would be a problem, I want my browser vendor to be serious and not play silly games that can so easily backfire. Yeah, add-ons from Mozilla merits the same trust as the browser. But this cuts both ways, this stuff undermines my and probably more people's trust in the browser.
- john_moscow 9y ago
  Being serious is quickly becoming a lost art. I don't know if the majority of the userbase really enjoys it, but I can't wait till the current fashion of treating your users like 3-year-olds blows through.
  - sincerely 9y ago
    agreed. nothing is more frustrating to me than when my windows computer delivers an error message with a “ :( “
- UmmNope 9y ago
  The major problem was building a feature into the product that allowed for pushing add-ons without users knowledge much less active consent in the first place, there is no benign use for this kind of functionality.
  - lenzm 9y ago
    You could use add-ons to manage optional functionality a la Atom. Users can enable and disable add-ons to customize their browser and some come enabled by default. If you were migrating to this method of customization it would absolutely make sense to push an enabled add-on that replaces functionality you took out of the main app.
    - 9y ago
deleted 9y ago
[deleted]
geofft 9y ago
> In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? An appropriate response here would be to decide that you no longer trust their browser at all. It's hard to quantify trust exactly. I'm fine with trusting the partly-closed-source Google Chrome build, including the proprietary Chromecast, Hangouts, etc., plugins, because I believe that the people writing them are generally reasonable. I don't have a good formal proof that they're generally reasonable people, and I never will - that's why it's trust. If they start installing marketing gimmicks, certainly they have the technical ability to do that, but I will lose my trust that they're reasonable people. Here's an analogy: I trust a small number of my friends with keys to my apartment because I think they'll make reasonable use of that access. If they decide to show up at 3 AM with a keg and three tubas without telling (let alone asking) in advance, I technically have no grounds to complain that they abused their access - but I'll certainly not be calling them friends any more.
- whatshisface 9y ago
  >I technically have no grounds to complain that they abused their access. I would argue that since they knew you were giving them access on the assumption that they would not do things like that, you would have grounds to complain. Similarly, I installed Firefox on the understanding that it would not phone home with opt-out telemetry, advertise third party products, or syntergise with acquired properties. Mozilla has, in the past few months, done all three. I like Firefox, though, so I'd rather kick the tubas out of Mozilla than go kick them off my individual installation. Does the public have any power over Mozilla's governance?
  - bigbugbag 9y ago
    Just switch to waterfox, you'll get the best of firefox and none of the mozilla nonsense. This is what I did after finally getting fed up with mozilla not caring about user and just doing as they please to try to get more revenue and marketshare.
- nine_k 9y ago
tinus_hn 9y ago
Then why not install it when the user opts in? Installing this kind of crap automatically is sleazy.
katastic 9y ago
>If someone distrusts their add-ons, why trust their browser at all? You mean like when they set the default search to Bing?
dredmorbius 9y ago
Dumping odd stuff that's not clearly from Mozilla and is poorly explained, without warning, is a fast road to lost trust. I'm using Firefox 57 heavily (typing this in it), and actually really like it for a change. This after years and years and years and years of wanting to like Firefox but finding it completely and absolutely unusable due to performance issues. (Chrome has been ... faster, but insanely aggravating in all sorts of ways, including utter and complete contempt from Google and the Chrome devs for users. The frustrations are rapidly mounting.) Mozilla have just cost themselves some portion of their advanced user test base through abuse of trust. I really wish they'd not do that.
bigbugbag 9y ago
You're assuming people trust firefox or mozilla. I do not trust mozilla, they've repeatedly proven they cannot be trusted. I do not trust firefox, because a piece of software is open source software does not mean it should be trusted.
smsm42 9y ago
Somebody trusted their browser, because never before they attempted such things as installing code that has nothing to do with the browser and is an advertisement gimmick. I am genuinely astonished that somebody up the corporate tree at Mozilla thought this is a good idea. I mean, I get the appeal of getting the money and doing the cool IRL tie-in to the show, but that's not just how you do it. If I am a fan of a particular actor, I don't expect him/her to suddenly be in my bedroom when I come home one day. I would prefer to invite them first (if I am so inclined). The trust here is specifically trusting them not to do such things. Which now has been violated. And the fact that CMO says anything else than "Man, did we screw up! We're so sorry, would never happen again!" is deeply sad and concerning.

pmlnr 9y ago

> it doesn't really matter since the code is coming from Mozilla For now, yes. Until someone finds a way to push a "study" through which is not from someone "trusted". > If someone distrusts their add-ons, why trust their browser at all? Well, trust is rather simple to break, and this - remote installing things - was not part of my original trust I put in Firefox 1.0. I know things change. This is not one I tolerate, and you are right: I will not trust a browser after a step like this. Besides the trust, it's unexpected data. Probably don't effect many on big data plans, and is probably a tiny extension this time, but it's still data I have not asked for.

skymt 9y ago

Speaking for myself here, but I'm not concerned that Mozilla might push malware into Firefox installations. I'm concerned about the lack of judgement in pushing an extension with a vague, scary-sounding name and description simply for a cross-marketing tie-in, and I'm worried that it could have damaged the trust ordinary users have in Firefox.

pmlnr 9y ago
> I'm not concerned that Mozilla might push malware into Firefox installations Nobody is concerned about that, in my opinion. I'm concerned someone will push malware through Mozilla into Firefox installations. Pushing addon installs should not be possible at all.
- kibibu 9y ago
  I'm concerned about Mozilla pushing software written by the Mr Robot marketing department.
  - y_u_no_rust 9y ago
    Is the plugin opensource, where can we vet it? I can't find it on github or anything like I can with the other plugins I use
    - callahad 9y ago
      The source lives at https://github.com/gregglind/addon-wr/ https://github.com/gregglind/addon-wr/
      - Ajedi32 9y ago
        Looking over [the contributors list][1], looks like the plugin was written entirely by Mozilla employees. So, no "Mr Robot marketing department", as some commenters here have been speculating. [1]: https://github.com/gregglind/addon-wr/graphs/contributors https://github.com/gregglind/addon-wr/graphs/contributors
        acqq 9y ago
        It's technicality. The description is still: "Looking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience." It doesn't matter who technically coded it. "Mr Robot marketing department" was obviously deciding about its existence, behavior and content -- if that description is true. But looking at the source of the extension, I find the following URLs inside: https://www.red-wheelbarrow.com/forkids/ https://www.red-wheelbarrow.com/forkids/ https://red-wheelbarrow-stage.apps.nbcuni.com/forkids/activitysheet/ https://red-wheelbarrow-stage.apps.nbcuni.com/forkids/activi... So it seems it is some marketing, the question is which company now, and do they change?
jotux 9y ago
I'm worried my work Security/IT department will see it, freak out, and blanket ban Firefox on all machines for 6 months.
- 45h34jh53k4j 9y ago
  your work security team loves mr robot, it will be fine...
  - chris_wot 9y ago
    No, it really will not. My workplace saw that OpenOffice had a security issue, and banned it AND LibreOffice. Nothing I can do about it. Can’t argue. Trust is very, very easily lost and incredibly hard to regain. And it can hit innocent third parties. It’s very, very wrong to do anything that could destroy trust.
    - franga2000 9y ago
      Have they seen the shit that's been found in Microsoft Office? It seemed like there was a new RCE every week for while.
      - chris_wot 9y ago
        I didn’t say it was logical.
- bigbugbag 9y ago
  If this does not happen at your workplace, it will certainly happen at some other workplace around the world.
WhitneyLand 9y ago
I don’t see the harm in a good organization contributing lot of value to this world having a little fun. Some of the comments are mentioning IT managers banning firefox, those will be the same IT managers doing all the other pennywise/pound foolish things that make you try not to work on their team in the first place. Maybe it’s actually good to put something scary sounding in there to raise awareness. It could help people understand that scary phrases are not the most common sign of foul play. When the real hackers come for you, they usually dont look scary at all.
- pavel_lishin 9y ago
  > I don’t see the harm in a good organization contributing lot of value to this world having a little fun. One potential downside is that now people might not pay close attention to the installed addons. "Oh, must be some Mozilla thing", as GoldenDwarf quietly consumes user CPU cycles to mine cryptocurrency for someone else.
  - flamedoge 9y ago
    This calls for.... anti mining extension. like adblock, miningblock.
    - deleted 9y ago
      [deleted]
- ryanisnan 9y ago
  I don't look to my browser's implementation to "have a little fun". This is a foolish decision on Mozilla's part.
  - WhitneyLand 9y ago
    poor argument. ostensibly the only reason to separate business from pleasure is out of practical concerns. without stating practical concerns there’s no way consider the validity of your comment. who knows, you may totally change my mind, but as it stands it makes it difficult to disagree or agree with you.
code_duck 9y ago
Hopefully this helped people who were scared by it learn how to analyze add-ons for trustworthiness.
TylerH 9y ago
What's scary about "Looking Glass"? It's not named something like "PrivacyRemover" or "SpamEmailer" or anything.
- bigbugbag 9y ago
  What was wrong about apple automatically adding a U2 album to itunes library ? Same here for looking glass, we do not want corporations to be in control of our stuff. Mozilla showing that they have built the capacity to auto install addons into your browser is quite the issue, you can rest assured that some are already working on ways to abuse this. That they have done it as a promotional marketing trick and not or something useful or serious sends the wrong kind of message on top of it.

TAForObvReasons 9y ago

If this were the first incident, and they quickly backtracked on it, then maybe we can give them a pass. But this isn't the first case of somewhat shady behavior. Remember the "user-enhancing" sponsored tiles a few years ago? https://twitter.com/dherman76/status/433320156496789504 https://twitter.com/dherman76/status/433320156496789504 > Excited to share the launch of @mozilla @firefox Tiles program, the first of our user-enhancing programs The problem there wasn't just the idea of putting ads in the browser, it was also the way in which they tried to present it as a useful addition just like every other ad company tries to defend ads

callahad 9y ago
That tweet sounds like doublespeak, but Directory Tiles really did have some genuinely good ideas mixed in with the bad. I don't know how far we got with it, but one of the ideas was to serve a generic bundle of ads, and then select which ones to display locally, based on an entirely private, client-side analysis of the browser's history. Now, that probably shouldn't have been on the new tab page, and probably not in Firefox at all, but if ads are going to be the way we fund the Internet, then that sounded like the best possible outcome: better targeting without remote tracking. Heck, even Brave ran with the idea for a while: https://brave.com/about-ad-replacement/ https://brave.com/about-ad-replacement/
- revelation 9y ago
  You think because your code is running native you can spy on me better for ad purposes, and that's a feature? That is just tone-deaf.
  - smacktoward 9y ago
    The whole point is that they weren't spying on you. The observations of your behavior were made entirely client-side, in your browser, and never passed back to Mozilla or anybody else. Defining that as "spying" strikes me as a big reach. It's no more spying than (say) Windows observing what programs you use most and adding shortcuts to them in your Start menu. Software adapting itself to fit the user better is a good thing, as long as it's done in a way that respects the user's privacy, which keeping the data 100% local absolutely does.

y0ghur7_xxx 9y ago

> I haven't researched deeply, but apparently the add-on does nothing until the user opts-in on studies. It adds some css to a list of words: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b089405ca96fc68b999d2b624ef4/addon/webextension/background.js https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894...

ryukafalz 9y ago
The extension only starts up if the config option "extensions.pug.lookingglass" is set to "true" though: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b089405ca96fc68b999d2b624ef4/addon/bootstrap.js#L22 https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894... (It defaults to "false.")
- revelation 9y ago
  We already have a mechanism for disabling or enabling addons, it's not installing them in the first place. Why on earth would we put it to addons to self-police them.
  - ryukafalz 9y ago
    It's behind a preference flag because it's installed automatically, and Mozilla's the only one who can do that. That's also why there's a lengthy approval process before such an addon can be pushed out: https://mozilla.github.io/shield-studies-docs/study-process/ https://mozilla.github.io/shield-studies-docs/study-process/
    - revelation 9y ago
      You can just not install (and enable) addons automatically. Those addons should only be delivered to users who have 1) opted into the study process and 2) opted into the study in the first place.
lozenge 9y ago
Only if the preference extensions.pug.lookingglass is changed from the default of false. I haven't figured out how that setting is exposed yet. Maybe they expect people to go to about:config and change it? Is there video footage suggesting that in the TV show? https://github.com/gregglind/addon-wr/blob/104-rename-less-vagueness/TESTPLAN.md https://github.com/gregglind/addon-wr/blob/104-rename-less-v...

vorpalhex 9y ago

This is being added to the browser, outside the realm of security updates, through what is supposed to be a UX improvement program, for commercial purposes. It's written by a commercial company that produces advertisement content. It's not clear this code is audited. Sorry, but I'm uninstalling firefox. They have broken the basic trust I have in them as a user to not push arbitrary code to my machine against my interests.

benbenolson 9y ago
What browser are you going to use instead?
- rnhmjoj 9y ago
  If you like Firefox but don't trust Mozilla anymore there are plenty of forks to choose from: Waterfox, Pale Moon, Basilisk, GNU IceCat. Personally I build Firefox from source and maintain a set of patches largely based on these: https://aur.archlinux.org/packages/firefox-esr-privacy/ https://aur.archlinux.org/packages/firefox-esr-privacy/
  - Grollicus 9y ago
    I think about doing this as well but heard a lot of bad things about the firefox build process. How long does it take to build for you?
    - rnhmjoj 9y ago
      They are probably true. Using an i5 @4.3GHz it takes 2.5/3 hours to build. To test changes you must set up a compiler cache or it's going to take forever.
      - notanote 9y ago
        That seems a little slow. I compile nightly for my own use and it takes around 20 minutes on a haswell i5, using tmpfs for the build directory.

xg15 9y ago

> If someone distrusts their add-ons, why trust their browser at all? "Well, I'm your bank. You already gave me authority to reinvest all your savings. Why are you mad now that I invested everything into bitcoin futures?" What exactly does "trust" mean? We might have given mozilla such a widespread access exactly because we trust them not to abuse it. Stuff like this undermine that trust.

deleted 9y ago
[deleted]
fragmede 9y ago
Maybe not be the best analogy since that is exactly what banks do with your money while it's parked in your savings account - invest it in whatever they feel like. Probably not Bitcoin futures because the bank manager doesn't want to, but there's nothing stopping them from doing exactly that.
- xg15 9y ago
  No, the bitcoin futures were my point. Of course they can re-invest in principle but the trust is tgat they won't invest them into something that is an obvious risk. And no, they can't: In many countries there are regulations forbidding high-risk investments with regular savings accounts for exactly that reason.
ryukafalz 9y ago
How is this extension an abuse of that trust?
jasonkostempski 9y ago
Before, we didn't need to trust them, because we didn't have to. We had all the code, we could verify the code we can read is the code in the binary we use via checksums. Now the code contains the ability to go fetch arbitrary code behind our backs and run it against our will. Firefox is now malware and it's a real damn shame.
- 9y ago

SwH85 9y ago

What it bugs me is not that Mozilla pushed and extension into my/their browser but the behavior of the extension itself. It literally broke some pages, disrupting my use experience more than it was supposed to do (or at least I hope it was not intended). Peoples who complain about Mozilla pushing this just failed to check the basic browser options and should blame themselves instead. Anyway Mozilla seem to have rised quite a lot of attention about the secuirity and the privacy of their own browser with this stunt, so... it was a success, I guess?

CmdrKrool 9y ago

To some extent, the line between code in the browser core and code in an add-on coming from Mozilla is arbitrary. However, it's a line that Mozilla themselves have drawn. We've been trained to be vigilant when choosing and installing add-ons, to read the list of permissions the add-on is asking for and judge whether we want to take the risk. The implicit messaging to users has been that if you let through a bad add-on that degrades the browser in some way, it's your fault. (Indeed, we're supposed to sympathise with Mozilla when 'badly-written' add-ons slow down the browser and make Mozilla look bad.) Mozilla have presented "add-ons" as a line where users are supposed to be responsible for what to "trust", over and above the choice to install the browser in the first place. They can expect those users to be watching that line carefully. (Incidentally, I would still dislike this functionality - moreso even - if it was in the browser core.)

kryptiskt 9y ago

The major problem is that they installed an add-on without properly communicating what it was. A somewhat smaller problem but still a big problem is that was an utterly frivolous add-on that shouldn't have been pushed to people who didn't explicitly want it. But the biggest problem is that Mozilla seems to have trouble understanding why any of those two would be a problem, I want my browser vendor to be serious and not play silly games that can so easily backfire. Yeah, add-ons from Mozilla merits the same trust as the browser. But this cuts both ways, this stuff undermines my and probably more people's trust in the browser.

john_moscow 9y ago
Being serious is quickly becoming a lost art. I don't know if the majority of the userbase really enjoys it, but I can't wait till the current fashion of treating your users like 3-year-olds blows through.
- sincerely 9y ago
  agreed. nothing is more frustrating to me than when my windows computer delivers an error message with a “ :( “
UmmNope 9y ago
The major problem was building a feature into the product that allowed for pushing add-ons without users knowledge much less active consent in the first place, there is no benign use for this kind of functionality.
- lenzm 9y ago
  You could use add-ons to manage optional functionality a la Atom. Users can enable and disable add-ons to customize their browser and some come enabled by default. If you were migrating to this method of customization it would absolutely make sense to push an enabled add-on that replaces functionality you took out of the main app.
  - 9y ago

deleted 9y ago

[deleted]

geofft 9y ago

> In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? An appropriate response here would be to decide that you no longer trust their browser at all. It's hard to quantify trust exactly. I'm fine with trusting the partly-closed-source Google Chrome build, including the proprietary Chromecast, Hangouts, etc., plugins, because I believe that the people writing them are generally reasonable. I don't have a good formal proof that they're generally reasonable people, and I never will - that's why it's trust. If they start installing marketing gimmicks, certainly they have the technical ability to do that, but I will lose my trust that they're reasonable people. Here's an analogy: I trust a small number of my friends with keys to my apartment because I think they'll make reasonable use of that access. If they decide to show up at 3 AM with a keg and three tubas without telling (let alone asking) in advance, I technically have no grounds to complain that they abused their access - but I'll certainly not be calling them friends any more.

whatshisface 9y ago
>I technically have no grounds to complain that they abused their access. I would argue that since they knew you were giving them access on the assumption that they would not do things like that, you would have grounds to complain. Similarly, I installed Firefox on the understanding that it would not phone home with opt-out telemetry, advertise third party products, or syntergise with acquired properties. Mozilla has, in the past few months, done all three. I like Firefox, though, so I'd rather kick the tubas out of Mozilla than go kick them off my individual installation. Does the public have any power over Mozilla's governance?
- bigbugbag 9y ago
  Just switch to waterfox, you'll get the best of firefox and none of the mozilla nonsense. This is what I did after finally getting fed up with mozilla not caring about user and just doing as they please to try to get more revenue and marketshare.
nine_k 9y ago

tinus_hn 9y ago

Then why not install it when the user opts in? Installing this kind of crap automatically is sleazy.

katastic 9y ago

>If someone distrusts their add-ons, why trust their browser at all? You mean like when they set the default search to Bing?

dredmorbius 9y ago

Dumping odd stuff that's not clearly from Mozilla and is poorly explained, without warning, is a fast road to lost trust. I'm using Firefox 57 heavily (typing this in it), and actually really like it for a change. This after years and years and years and years of wanting to like Firefox but finding it completely and absolutely unusable due to performance issues. (Chrome has been ... faster, but insanely aggravating in all sorts of ways, including utter and complete contempt from Google and the Chrome devs for users. The frustrations are rapidly mounting.) Mozilla have just cost themselves some portion of their advanced user test base through abuse of trust. I really wish they'd not do that.

bigbugbag 9y ago

You're assuming people trust firefox or mozilla. I do not trust mozilla, they've repeatedly proven they cannot be trusted. I do not trust firefox, because a piece of software is open source software does not mean it should be trusted.

smsm42 9y ago

Somebody trusted their browser, because never before they attempted such things as installing code that has nothing to do with the browser and is an advertisement gimmick. I am genuinely astonished that somebody up the corporate tree at Mozilla thought this is a good idea. I mean, I get the appeal of getting the money and doing the cool IRL tie-in to the show, but that's not just how you do it. If I am a fan of a particular actor, I don't expect him/her to suddenly be in my bedroom when I come home one day. I would prefer to invite them first (if I am so inclined). The trust here is specifically trusting them not to do such things. Which now has been violated. And the fact that CMO says anything else than "Man, did we screw up! We're so sorry, would never happen again!" is deeply sad and concerning.