19 ms·

Most of us are on flights today, hence the slow response, but I want to clarify two things: 1. The study is not "still active and ongoing." It was pulled yeste

Most of us are on flights today, hence the slow response, but I want to clarify two things: 1. The study is not "still active and ongoing." It was pulled yesterday after the backlash, though that may take up to 24 hours to propagate: https://gizmodo.com/after-blowback-firefox-will-move-mr-robot-extension-t-1821354314 https://gizmodo.com/after-blowback-firefox-will-move-mr-robo... 2. Even when "enabled" in the add-on manager, the add-on was completely inert unless a user also manually dove into about:config and specifically enabled a flag related to the add-on. Without taking that deliberate action, it didn't do anything but watch that flag. No headers, no word inversions, etc. If you'd like to verify my claims, the source lives at https://github.com/mozilla/addon-wr https://github.com/mozilla/addon-wr, and initialization is controlled by addon/bootstrap.js. This doesn't excuse our actions, but I hope it adds some context.

leeoniya 9y ago
i have a question: why do any of this? yahoo and google pay hundreds of millions, is this not sufficient? have any of these gimmicks actually helped gain users? it's likely that only Quantum - a purely technical improvement (plus marketing dollars) - made any dent in your user share. it's almost like mozilla keeps expanding into all the shady corners to use up its budget so it can have a bigger budget next year. many users use firefox for ideological reasons, even when Chrome is/was technically superior. and these reasons are disintegrating at a ludicrous speed. you are throwing away the very users that helped you grow. we are telling you this here, directly and in plain language. much of the same group uses firefox because they can make it work exactly how they want with exactly 0 surprises. some of this died with the web extension addon transition, but it's at least justifiable from a technical & security perspective. every time you force-feed what should be a visible and removable extension, i have less and less control over my browser and less incentive to to use or recommend it. it's heartbreaking, really. whoever is pushing forward on all this farcical marketing spin and bundling stunts needs to be shown the door, asap. call ads "ads", not "experience enhancements". it is not okay. you guys need to stop this before you lose your most dedicated users that have stuck with you through thick and thin. having been on firefox/nightly for over 10 years, deploying firefox on thousands of PCs, reporting many bugs, and making donations to mozilla, i am this close to saying "fuck it" and taking my friends, relatives and coworkers with me. i'm gonna be one user that costs you 2000 more. please get this to whoever needs to hear it [and gives enough fucks to actually do something].
- callahad 9y ago
  The core idea (deploy an easter egg via an add-on) seems pretty reasonable. Looking Glass is a really cool idea for users who want it. But pushing it out broadly, even in an inert state, was not good. I can assure you that there's an active internal discussion to that effect. I'm hopeful that we'll learn from this.
  - Simon_says 9y ago
    > The core idea (deploy an easter egg via an add-on) seems pretty reasonable It's fine if you believe this, but it means I'm not using your browser. I switched to Safari today.
    - targafarian 9y ago
      I interpret this as you switching from an browser by a relatively small organization that has certainly made some mistakes but is backing down with a relatively small amount of user feedback to one by a much larger organization that has less motivation to acquiesce to users' desires and less motivation to respect users' privacy. Also, as others pointed out, this sentence you quote (probably) isn't as bad as your interpretation (I think I interpreted as you did, too, on first read). If you want an easter egg in your browser, and you install an add-on to get it, what's bad about that? The interpretation that "add-on" means "installed by default by Mozilla" seems off compared to what was said elsewhere here (though as it happens, this add-on was installed by default, hence the interpretation that this was okay... but read on, and clearly callahad is saying that it wasn't okay to install by default). I think the statement is poorly worded, but with the larger context, I'll give Mozilla a chance here... or else I'll use a browser that I think is more privacy conscious and that is more likely to listen to its users, not a browser that I think is less privacy conscious and less likely to listen to its users.
  - lagadu 9y ago
    > The core idea (deploy an easter egg via an add-on) seems pretty reasonable. Yes, deploying an easter egg via an add-on is pretty reasonable, hell if it's out of the way enough even in the core browser. But Mozilla didn't deploy an easter egg: they deployed an advertisement.
philipwhiuk 9y ago
"study"
- callahad 9y ago
  It's just our internal jargon, nothing nefarious intended. Things shipped over Shield are called "studies," A/B tests in the installer are called "funnelcakes," etc.
  - Svenskunganka 9y ago
    Are you saying that you're communicating the word "studies" in place of "advertisement" when the Shield option is presented to users during installation of Firefox?
    - throwanem 9y ago
      This is the first time that channel has been so misused. I participated for a long while, and stopped some months ago only because the studies I was getting weren't useful to me and tended to impair my experience, rather than because of any issue of trustworthiness. I certainly am less likely to reenable the shield channel now than previously, but I also don't see the sense in making more out of this than the already eminently sufficient debacle that it is.
  - deleted 9y ago
    [deleted]
- nebulous1 9y ago
  While I agree, in this case I think he's just using the phrase from the end of the blog post.
ifdefdebug 9y ago
This looks like an authoritative answer from a Mozilla coworker, and it's totally incompatible with the message and tone of the linked article "Firefox is on a slippery slope" which makes it sound like the extension was on by default. So who is telling the truth? The one thing I know is that I am writing from a Firefox right now and don't see headers, inversions etc. at all. The examples given in the article should have all been inverted, right?
- mulmen 9y ago
  > The one thing I know is that I am writing from a Firefox right now and don't see headers, inversions etc. at all. The examples given in the article should have all been inverted, right? "It involved sideloading a sketchy browser extension which will invert text that matches a list of Mr. Robot-related keywords like “fsociety”, “robot”, “undo”, and “fuck”, and does a number of other things like adding an HTTP header to certain sites you visit." Only if HN is on the list of "certain sites". It's also irrelevant because the extension offers me no value so Mozilla was not acting in my best interest.
  - ifdefdebug 9y ago
    OK, so I got that wrong with the "certain sites". But still, the fact that the extension was not active unless you mess around in about:config is a crucial fact, which should not have been omitted in an highly critical article, specially if they use words like "Mozilla, you fucked up bad, and you still haven’t apologised. The study is still active and ongoing". I feel misinformed by that article, to say the less.
  - fanon 9y ago
    > Only if HN is on the list of "certain sites". If that is the case (I'm not saying it's not, just that I don't know)... why did the extension even need to exist? Presumably "certain sites" are partner sites participating in the promotion. If they are participating and (I assume) they control their own content, why didn't they just invert those words or whatever else they wanted to do with the content when they served it? I'm very confused about why this needed to roll out as a browser extension at all.
mulmen 9y ago
Thank you for your response but I don't trust you. I don't believe your characterization of how this extension works is correct. That is a huge problem, it means I do not trust Mozilla. What's being done to make sure this never happens again? How could something like this happen after the Pocket fiasco?
- callahad 9y ago
  You don't have to trust me, that's why I linked to the source. Check out L21-24 in bootstrap.js. You can verify that this is the same code as your own local copy of the add-on by visiting about:debugging, clicking "enable add-on debugging," and hitting "Debug" under the Looking Glass add-on. Here's a press release confirming that we're pulling the add-on: https://gizmodo.com/after-blowback-firefox-will-move-mr-robot-extension-t-1821354314 https://gizmodo.com/after-blowback-firefox-will-move-mr-robo... I'm an engineer in Developer Relations. I'm not in management, I wasn't in the decision chain for this. I'm not here to defend that decision. I'm just here to try to explain, factually, the technical aspects of what happened, and to then reflect your sentiments internally.
  - mulmen 9y ago
    I appreciate you taking the time and the work you do. Let me state the obvious for your management: violating user trust is unacceptable. I expect Mozilla to be user-centric but I can no longer take that for granted. This is a very dangerous action because it's not something that can be taken back. The addon can be removed but it shows very poor judgement on the part of Mozilla leadership and now I have to doubt all future motives.
    - callahad 9y ago
      I can assure you that such a sentiment has been expressed, and that the discussion is still active.
      - beart 9y ago
        Can you provide more information on what is being discussed and what conclusions are being reached? From an outsider, it seems pretty cut-and-dry that this was a mistake and it should never happen again. If that premise is accepted, there really isn't much room for discussion. In the words of Tom Hanks - "I am not a smart man", so can you provide more insight into what is being discussed?
cflewis 9y ago
I am not a Firefox user[1], but the thing I am finding it difficult to understand about this brewhaha is: 1. Aside from how it reaches the users machine, is the extension on or off when it gets installed invisibly? 2. If it's off, why push it at all? If the user is expected to give consent at some point down the line for it to be on, why not just have the user actually install the extension at the time of consent, rather than prefetching? [1] work gives me a Chrome OS laptop, and I find the lock-in of sync-ing bookmarks and things pretty real.
- callahad 9y ago
  > Is the extension on or off when it gets installed invisibly? You could argue technicalities for either, but semantically, it's off by default. The add-on is implemented as an "embedded webextension" which is wholly contained by an outer "bootstrapped add-on." The bootstrapped add-on controls whether or not the embedded webextension gets initialized, and that's all it does. The bootstrapped add-on is literally just this one file: https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac... The outer shell is on by default. The embedded webextension is only initialized by the bootstrapped add-on if the user manually flips the "extensions.pug.lookingglass" preference in about:config. That preference is off by default. > why not just have the user actually install the extension at the time of consent, rather than prefetching? That's what we're moving to by pulling the add-on from Firefox and posting it on AMO.
  - zanedb 9y ago
    > That's what we're moving to by pulling the add-on from Firefox and posting it on AMO. Why was this not done in the first place?
    - callahad 9y ago
      I'm not personally aware of the answer to that question, but I expect it will be covered in a postmortem in the coming days.
PhasmaFelis 9y ago
> Even when "enabled" in the add-on manager, the add-on was completely inert unless a user also manually dove into about:config and specifically enabled a flag related to the add-on. Without taking that deliberate action, it didn't do anything but watch that flag. No headers, no word inversions, etc. Wow. So is Drew DeVault lying, or confused? Was there a bug that turned it on for him? This is odd.
- callahad 9y ago
  Embedded WebExtensions are a bit weird, since they're kind of a hybrid of our legacy and modern add-on APIs, so I'd just bet on confusion. This is the only code that runs when the add-on is enabled: https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac... Lines 22 and 39 determine if the inner WebExtension starts up.
- throwanem 9y ago
  "Confused" is the correct answer. So was I, or I'd have called that out and asked that it be corrected in prepublication review - and it would have been. As I apologize for the error, I'd also mention that the principle of charity is a thing for a reason. One may very usefully cite errors in published articles and request their correction without also suggesting their presence may be an attempt at deliberate deception. Certainly such things do occur, but we need not assume them, even provisionally, in the absence of any evidence that the error is anything other than an honest mistake. Such behavior when made a norm debases our discourse; such behavior when indulged even occasionally risks its normalization. I think the quality of discourse on Hacker News merits preservation and enhancement, rather than debasement. But perhaps you disagree.
  - Dylan16807 9y ago
    > Certainly such things do occur, but we need not assume them, even provisionally, in the absence of any evidence that the error is anything other than an honest mistake. Personally, I do not see "lying, confused, or bug? this is odd" as an accusation of lying.
spoondan 9y ago
Thank you for the missing context. Would you (or someone else in the know) please clarify what additional user data (if any) the default-enabled bootstrap add-on caused to be collected when the extensions.pug.lookingglass preference was disabled? I did some searching, but it's unclear to me whether SHIELD studies automatically cause any additional data to be collected and to whom that might go. I think the support site[1] could do a lot better addressing that topic. For example, it mentions (but does not link to) the default data collection policy. Does the fact that this study didn't pop an opt-in UI definitively mean that whatever additional user data might be collected was all within Mozilla's privacy policy? The support site says that opt-in step, "will happen when a particular study needs to collect data that is not covered by default data collection policy." Does this apply when the study is just a bootstrap, and the actual extension is pref-enabled? Lastly, I appreciate that you've being candid in sharing your personal feelings about the inappropriateness of pushing this extension. I'd like Mozilla to go one step further and comment on whether an extension of this nature is even appropriate to consider for a SHIELD study. Based on my reading of the feature's design and history (starting at the wiki[2] and branching out from there), as well as the aforementioned user-facing documentation, I believe SHIELD is intended for user research into features/ideas intended to be shipped to all Firefox users. I didn't find definitive guidelines on what constitutes an appropriate study for this program (if aren't publicly available, that's something Mozilla might want to address in the wake of this controversy), but I would disqualify Looking Glass in at least four different ways: * Fleeting - whatever appeal it has to its target audience has a short shelf-life * Frivolous - it has no utility and doesn't substantially improve any aspect of the user experience * Hyper-targeted - it's only for Mr Robot fans * Advertising-related - this adds an extra level of privacy concern for users User research is a delicate matter requiring a lot of care to balance collection with privacy. To enroll (or stay enrolled) in these programs, users must be confident that they aren't trading too much privacy and are getting tangible benefits in return. Looking Glass fails the privacy confidence test for being advertising. It fails the tangible benefit test for being fleeting, frivolous, and hyper-targeted. SHIELD isn't some convenient way to push features. It's a user research tool. Studies ought to have the gravity that the term implies. Mozilla hasn't just failed to respect user's concern over their privacy, it has also undercut its own user research efforts. [1] https://support.mozilla.org/en-US/kb/shield https://support.mozilla.org/en-US/kb/shield [2] https://wiki.mozilla.org/Firefox/Shield https://wiki.mozilla.org/Firefox/Shield [3] https://support.mozilla.org/en-US/kb/lookingglass https://support.mozilla.org/en-US/kb/lookingglass
deleted 9y ago
[deleted]
ddevault 9y ago
Thank you for your comment. I'm sorry I hadn't seen this earlier; I stopped reading the HN thread a while ago. I have added this to my article: >It has been clarified that an about:config flag must be set for this addon’s behavior to be visible. This improves the situation considerably, but I do not think it exenorates Mozilla and I stand firm behind most of my points. The study has also been rolled back by Mozilla, and Mozilla has issued statements [0] to the media [1] justifying the study (no apology has been issued). [0] https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-into-firefox-1821332254 https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-... [1] https://gizmodo.com/after-blowback-firefox-will-move-mr-robot-extension-t-1821354314 https://gizmodo.com/after-blowback-firefox-will-move-mr-robo...
- bluefox 9y ago
  It doesn't improve the situation at all, which is that Mozilla has the capability to silently install addons in a default setting.
- endemic 9y ago
  > no apology has been issued This is my problem, right here. To err is human, but I would expect a level of contriteness, rather than doubling down on the "nothing to see here" attitude.
  - deleted 9y ago
    [deleted]
frik 9y ago
> Most of us are on flights today Yeah, someone mentioned Mozilla plays rich, and fly-in all employees every 6 months. And someone found a good time window to post the article, when the corporation drones were offline, and had no time to flag the HN news to avoid a backlashe. Mozilla acts like a unicorn startup, not like a non-profit org at all! All these unwanted DRM support, missing WebSQL support, unwanted Hello, Pocket, Easter-Egg addons that can barely be removed with lot of work are alienating your user base, and it's completely Mozilla's fault.
- scrollaway 9y ago
  Jesus man, have some respect for other humans, and some leniency where it's warranted. It's possible to be critical of Mozilla and still be courteous. (Also see: my own criticism of Mozilla in this thread)
  - Endy 9y ago
    Please tell me why anyone should bother being respectful of or lenient towards those who won't show the same decent behavior? They're messing with the tools people use to work. That alone earns them utter and complete disrespect. They've done this in a way that leaves them conspicuously unable to reply - they deserve no leniency for this.
    - scrollaway 9y ago
      > Please tell me why anyone should bother being respectful of or lenient towards those who won't show the same decent behavior? First of all, Mozilla isn't being rude, they're being foolish. But to answer that question in general, the goal is to fix things, not make them generally shit, so one side has to show decency at least. Furthermore, even if you believe they're as bad as you say, that does not give everyone carte blanche to be awful.
    - dang 9y ago
      Because you owe better to this community than to be brutally dismissive of others. If you want to post in a rage, please do so elsewhere; on HN commenters need a minimum level of self-control, quite independently of how wrong anybody else is. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
deleted 9y ago
[deleted]
mrrobot9000 9y ago
Thank you for your response. I wanted to add to what I'm sure is a chorus of commentary that your team is currently dealing with. But I don't know if this specific point has been made. Your team has just ruined a huge amount of trust by not appropriately reviewing and documenting this feature. This goodwill is the most important capital Mozilla has. Your team is continuing to make this situation worse by not posting any official response on Mozilla's communication channels, and by arbitrarily censoring incoming comments. It would be appropriate for all members of your team to question the processes that led to this, and drive structural changes to ensure this never happens again. This includes the continued inaction of Mozilla's communications team.
- Manishearth 9y ago
  I'm unsure if this was actually callahad's team doing this. But regardless, basically the entire company is on flights right now, and it's the weekend after an intensive all-company event, and everyone is tired, and it's the freaking weekend. Wait a bit. (Also, the Gizmodo article is an official response, as is https://support.mozilla.org/en-US/kb/lookingglass https://support.mozilla.org/en-US/kb/lookingglass. There will probably be more, idk.)
  - kashyapc 9y ago
    You maybe "unsure", but for an outsider reading Callahad's response, it looks like so. Besides, it's meant to be read as: "one of your teams". Also, your all-company event maybe "intensive", but it doesn't matter one whit. Why? When your corporation's actions are raising a damn ugly stink ruining Mozilla's good will, you're better off paying immediate attention even if it's the "freaking weekend". It's elementary common sense.
    - Manishearth 9y ago
      Given the responses to emails folks have sent internally, they are paying immediate attention, they just haven't gotten to the point of making public statements aside from the Gizmodo article.
  - 9y ago
jrochkind1 9y ago
I don't understand what makes this a "study". What were you studying?
- Manishearth 9y ago
  "study" is just an internal term for the method of deploying addons that way; they're called "Shield Studies" and usually are for A/B testing. This wasn't an actual study, he's just using the internal term for that kind of addon.
quesnel 9y ago
It seems that Mozilla didn't get paid to implement this extension and force it through channels reserved for usability studies: "We didn't make any money off of this; it was intended as an easter egg in Firefox for fans of the show." https://www.metafilter.com/171227/Your-Reality-Is-Driven-By-Marketing#7265127 https://www.metafilter.com/171227/Your-Reality-Is-Driven-By-... "Mozilla wasn't paid for the Mr. Robot tie-in, Kaykas-Wolff [Jascha Kaykas-Wolff, Mozilla's chief marketing officer] said. "We've enjoyed a growing partnership with the show and the show's audience," he said." https://www.cnet.com/au/news/mozilla-backpedals-after-mr-robot-firefox-misstep/ https://www.cnet.com/au/news/mozilla-backpedals-after-mr-rob... It doesn't matter if the extension was not activated on installation because the check for the extensions.pug.lookingglass on line 22 https://github.com/mozilla/addon-wr/blob/master/addon/bootstrap.js#L22 https://github.com/mozilla/addon-wr/blob/master/addon/bootst... can easily be gone in the next version of the extension. Not getting paid for this ad is even worse in my opinion. Mr. Robot is produced by Universal Cable Productions, which is part of NBCUniversal, which in turn is owned by Comcast. Your marketing people are probably laughing behind your back, they got the dork developers to implement this ad for free, be proud of it and even defend it in online forums. As they say: "The intent is to provide players with a sense of pride and accomplishment for unlocking different heroes." https://www.reddit.com/r/StarWarsBattlefront/comments/7cff0b/seriously_i_paid_80_to_have_vader_locked/dppum98/ https://www.reddit.com/r/StarWarsBattlefront/comments/7cff0b... Your marketing people got to play with the big boys in mass media and are now owned some favors. Think about that for a minute.
- swistak84 9y ago
  So let me get this straight. Mozilla did a free advertisement for Comcast owned TV Series Mr. Robot? What The Proverbial F?
fuckyouzilla 9y ago
I hope you get fired. I hope mozilla either switches its course into the right direction or goes bankrupt and stops existing.
jftuga 9y ago
Uninstall Firefox: https://support.mozilla.org/en-US/kb/uninstall-firefox-from-your-computer https://support.mozilla.org/en-US/kb/uninstall-firefox-from-...
ben0x539 9y ago
hey just want to chime in to say thanks for adding the context. do you know where i can read up on the decision being made to deploy this extension thru the shield thing?
- deleted 9y ago
  [deleted]
TAForObvReasons 9y ago
> It was pulled yesterday after the backlash The fact that it took a backlash to pull something that Mozilla engineers built and deployed is the worrisome element that the post and many people discussed. > This event tells us that “Firefox studies” into a backdoor for advertisements, and I will never trust it again. But it doesn’t matter - you’re going to re-enable it on the next update. You know what that means? I will never trust Firefox again. That's the real problem. There's already a strong negative taste after incidents like https://twitter.com/dherman76/status/433320156496789504 https://twitter.com/dherman76/status/433320156496789504 > Excited to share the launch of @mozilla @firefox Tiles program, the first of our user-enhancing programs The default assumption that Mozilla is "one of the good guys" may have been there years ago, but in 2017 after many stumbles people are calling Mozilla's actions into question. The impression Mozilla's actions left upon 'sir_cmpwn wasn't based on an overnight reaction -- it was years of questionable actions. Trust is incredibly hard to earn, but very easy to lose
pascalxus 9y ago
I can see how you wanted to give people something fun, and I think firefox's heart is in the right place. But, Browsers are not games. It's a critical piece of software, like the operating system on an airplane. You wouldn't put an easter egg in an airline's operating system, would you?

leeoniya 9y ago

i have a question: why do any of this? yahoo and google pay hundreds of millions, is this not sufficient? have any of these gimmicks actually helped gain users? it's likely that only Quantum - a purely technical improvement (plus marketing dollars) - made any dent in your user share. it's almost like mozilla keeps expanding into all the shady corners to use up its budget so it can have a bigger budget next year. many users use firefox for ideological reasons, even when Chrome is/was technically superior. and these reasons are disintegrating at a ludicrous speed. you are throwing away the very users that helped you grow. we are telling you this here, directly and in plain language. much of the same group uses firefox because they can make it work exactly how they want with exactly 0 surprises. some of this died with the web extension addon transition, but it's at least justifiable from a technical & security perspective. every time you force-feed what should be a visible and removable extension, i have less and less control over my browser and less incentive to to use or recommend it. it's heartbreaking, really. whoever is pushing forward on all this farcical marketing spin and bundling stunts needs to be shown the door, asap. call ads "ads", not "experience enhancements". it is not okay. you guys need to stop this before you lose your most dedicated users that have stuck with you through thick and thin. having been on firefox/nightly for over 10 years, deploying firefox on thousands of PCs, reporting many bugs, and making donations to mozilla, i am this close to saying "fuck it" and taking my friends, relatives and coworkers with me. i'm gonna be one user that costs you 2000 more. please get this to whoever needs to hear it [and gives enough fucks to actually do something].

callahad 9y ago
The core idea (deploy an easter egg via an add-on) seems pretty reasonable. Looking Glass is a really cool idea for users who want it. But pushing it out broadly, even in an inert state, was not good. I can assure you that there's an active internal discussion to that effect. I'm hopeful that we'll learn from this.
- Simon_says 9y ago
  > The core idea (deploy an easter egg via an add-on) seems pretty reasonable It's fine if you believe this, but it means I'm not using your browser. I switched to Safari today.
  - targafarian 9y ago
    I interpret this as you switching from an browser by a relatively small organization that has certainly made some mistakes but is backing down with a relatively small amount of user feedback to one by a much larger organization that has less motivation to acquiesce to users' desires and less motivation to respect users' privacy. Also, as others pointed out, this sentence you quote (probably) isn't as bad as your interpretation (I think I interpreted as you did, too, on first read). If you want an easter egg in your browser, and you install an add-on to get it, what's bad about that? The interpretation that "add-on" means "installed by default by Mozilla" seems off compared to what was said elsewhere here (though as it happens, this add-on was installed by default, hence the interpretation that this was okay... but read on, and clearly callahad is saying that it wasn't okay to install by default). I think the statement is poorly worded, but with the larger context, I'll give Mozilla a chance here... or else I'll use a browser that I think is more privacy conscious and that is more likely to listen to its users, not a browser that I think is less privacy conscious and less likely to listen to its users.
- lagadu 9y ago
  > The core idea (deploy an easter egg via an add-on) seems pretty reasonable. Yes, deploying an easter egg via an add-on is pretty reasonable, hell if it's out of the way enough even in the core browser. But Mozilla didn't deploy an easter egg: they deployed an advertisement.

philipwhiuk 9y ago

"study"

callahad 9y ago
It's just our internal jargon, nothing nefarious intended. Things shipped over Shield are called "studies," A/B tests in the installer are called "funnelcakes," etc.
- Svenskunganka 9y ago
  Are you saying that you're communicating the word "studies" in place of "advertisement" when the Shield option is presented to users during installation of Firefox?
  - throwanem 9y ago
    This is the first time that channel has been so misused. I participated for a long while, and stopped some months ago only because the studies I was getting weren't useful to me and tended to impair my experience, rather than because of any issue of trustworthiness. I certainly am less likely to reenable the shield channel now than previously, but I also don't see the sense in making more out of this than the already eminently sufficient debacle that it is.
- deleted 9y ago
  [deleted]
nebulous1 9y ago
While I agree, in this case I think he's just using the phrase from the end of the blog post.

ifdefdebug 9y ago

This looks like an authoritative answer from a Mozilla coworker, and it's totally incompatible with the message and tone of the linked article "Firefox is on a slippery slope" which makes it sound like the extension was on by default. So who is telling the truth? The one thing I know is that I am writing from a Firefox right now and don't see headers, inversions etc. at all. The examples given in the article should have all been inverted, right?

mulmen 9y ago
> The one thing I know is that I am writing from a Firefox right now and don't see headers, inversions etc. at all. The examples given in the article should have all been inverted, right? "It involved sideloading a sketchy browser extension which will invert text that matches a list of Mr. Robot-related keywords like “fsociety”, “robot”, “undo”, and “fuck”, and does a number of other things like adding an HTTP header to certain sites you visit." Only if HN is on the list of "certain sites". It's also irrelevant because the extension offers me no value so Mozilla was not acting in my best interest.
- ifdefdebug 9y ago
  OK, so I got that wrong with the "certain sites". But still, the fact that the extension was not active unless you mess around in about:config is a crucial fact, which should not have been omitted in an highly critical article, specially if they use words like "Mozilla, you fucked up bad, and you still haven’t apologised. The study is still active and ongoing". I feel misinformed by that article, to say the less.
- fanon 9y ago
  > Only if HN is on the list of "certain sites". If that is the case (I'm not saying it's not, just that I don't know)... why did the extension even need to exist? Presumably "certain sites" are partner sites participating in the promotion. If they are participating and (I assume) they control their own content, why didn't they just invert those words or whatever else they wanted to do with the content when they served it? I'm very confused about why this needed to roll out as a browser extension at all.

mulmen 9y ago

Thank you for your response but I don't trust you. I don't believe your characterization of how this extension works is correct. That is a huge problem, it means I do not trust Mozilla. What's being done to make sure this never happens again? How could something like this happen after the Pocket fiasco?

callahad 9y ago
You don't have to trust me, that's why I linked to the source. Check out L21-24 in bootstrap.js. You can verify that this is the same code as your own local copy of the add-on by visiting about:debugging, clicking "enable add-on debugging," and hitting "Debug" under the Looking Glass add-on. Here's a press release confirming that we're pulling the add-on: https://gizmodo.com/after-blowback-firefox-will-move-mr-robot-extension-t-1821354314 https://gizmodo.com/after-blowback-firefox-will-move-mr-robo... I'm an engineer in Developer Relations. I'm not in management, I wasn't in the decision chain for this. I'm not here to defend that decision. I'm just here to try to explain, factually, the technical aspects of what happened, and to then reflect your sentiments internally.
- mulmen 9y ago
  I appreciate you taking the time and the work you do. Let me state the obvious for your management: violating user trust is unacceptable. I expect Mozilla to be user-centric but I can no longer take that for granted. This is a very dangerous action because it's not something that can be taken back. The addon can be removed but it shows very poor judgement on the part of Mozilla leadership and now I have to doubt all future motives.
  - callahad 9y ago
    I can assure you that such a sentiment has been expressed, and that the discussion is still active.
    - beart 9y ago
      Can you provide more information on what is being discussed and what conclusions are being reached? From an outsider, it seems pretty cut-and-dry that this was a mistake and it should never happen again. If that premise is accepted, there really isn't much room for discussion. In the words of Tom Hanks - "I am not a smart man", so can you provide more insight into what is being discussed?

cflewis 9y ago

I am not a Firefox user[1], but the thing I am finding it difficult to understand about this brewhaha is: 1. Aside from how it reaches the users machine, is the extension on or off when it gets installed invisibly? 2. If it's off, why push it at all? If the user is expected to give consent at some point down the line for it to be on, why not just have the user actually install the extension at the time of consent, rather than prefetching? [1] work gives me a Chrome OS laptop, and I find the lock-in of sync-ing bookmarks and things pretty real.

callahad 9y ago
> Is the extension on or off when it gets installed invisibly? You could argue technicalities for either, but semantically, it's off by default. The add-on is implemented as an "embedded webextension" which is wholly contained by an outer "bootstrapped add-on." The bootstrapped add-on controls whether or not the embedded webextension gets initialized, and that's all it does. The bootstrapped add-on is literally just this one file: https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac... The outer shell is on by default. The embedded webextension is only initialized by the bootstrapped add-on if the user manually flips the "extensions.pug.lookingglass" preference in about:config. That preference is off by default. > why not just have the user actually install the extension at the time of consent, rather than prefetching? That's what we're moving to by pulling the add-on from Firefox and posting it on AMO.
- zanedb 9y ago
  > That's what we're moving to by pulling the add-on from Firefox and posting it on AMO. Why was this not done in the first place?
  - callahad 9y ago
    I'm not personally aware of the answer to that question, but I expect it will be covered in a postmortem in the coming days.

PhasmaFelis 9y ago

> Even when "enabled" in the add-on manager, the add-on was completely inert unless a user also manually dove into about:config and specifically enabled a flag related to the add-on. Without taking that deliberate action, it didn't do anything but watch that flag. No headers, no word inversions, etc. Wow. So is Drew DeVault lying, or confused? Was there a bug that turned it on for him? This is odd.

callahad 9y ago
Embedded WebExtensions are a bit weird, since they're kind of a hybrid of our legacy and modern add-on APIs, so I'd just bet on confusion. This is the only code that runs when the add-on is enabled: https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac... Lines 22 and 39 determine if the inner WebExtension starts up.
throwanem 9y ago
"Confused" is the correct answer. So was I, or I'd have called that out and asked that it be corrected in prepublication review - and it would have been. As I apologize for the error, I'd also mention that the principle of charity is a thing for a reason. One may very usefully cite errors in published articles and request their correction without also suggesting their presence may be an attempt at deliberate deception. Certainly such things do occur, but we need not assume them, even provisionally, in the absence of any evidence that the error is anything other than an honest mistake. Such behavior when made a norm debases our discourse; such behavior when indulged even occasionally risks its normalization. I think the quality of discourse on Hacker News merits preservation and enhancement, rather than debasement. But perhaps you disagree.
- Dylan16807 9y ago
  > Certainly such things do occur, but we need not assume them, even provisionally, in the absence of any evidence that the error is anything other than an honest mistake. Personally, I do not see "lying, confused, or bug? this is odd" as an accusation of lying.

spoondan 9y ago

Thank you for the missing context. Would you (or someone else in the know) please clarify what additional user data (if any) the default-enabled bootstrap add-on caused to be collected when the extensions.pug.lookingglass preference was disabled? I did some searching, but it's unclear to me whether SHIELD studies automatically cause any additional data to be collected and to whom that might go. I think the support site[1] could do a lot better addressing that topic. For example, it mentions (but does not link to) the default data collection policy. Does the fact that this study didn't pop an opt-in UI definitively mean that whatever additional user data might be collected was all within Mozilla's privacy policy? The support site says that opt-in step, "will happen when a particular study needs to collect data that is not covered by default data collection policy." Does this apply when the study is just a bootstrap, and the actual extension is pref-enabled? Lastly, I appreciate that you've being candid in sharing your personal feelings about the inappropriateness of pushing this extension. I'd like Mozilla to go one step further and comment on whether an extension of this nature is even appropriate to consider for a SHIELD study. Based on my reading of the feature's design and history (starting at the wiki[2] and branching out from there), as well as the aforementioned user-facing documentation, I believe SHIELD is intended for user research into features/ideas intended to be shipped to all Firefox users. I didn't find definitive guidelines on what constitutes an appropriate study for this program (if aren't publicly available, that's something Mozilla might want to address in the wake of this controversy), but I would disqualify Looking Glass in at least four different ways: * Fleeting - whatever appeal it has to its target audience has a short shelf-life * Frivolous - it has no utility and doesn't substantially improve any aspect of the user experience * Hyper-targeted - it's only for Mr Robot fans * Advertising-related - this adds an extra level of privacy concern for users User research is a delicate matter requiring a lot of care to balance collection with privacy. To enroll (or stay enrolled) in these programs, users must be confident that they aren't trading too much privacy and are getting tangible benefits in return. Looking Glass fails the privacy confidence test for being advertising. It fails the tangible benefit test for being fleeting, frivolous, and hyper-targeted. SHIELD isn't some convenient way to push features. It's a user research tool. Studies ought to have the gravity that the term implies. Mozilla hasn't just failed to respect user's concern over their privacy, it has also undercut its own user research efforts. [1] https://support.mozilla.org/en-US/kb/shield https://support.mozilla.org/en-US/kb/shield [2] https://wiki.mozilla.org/Firefox/Shield https://wiki.mozilla.org/Firefox/Shield [3] https://support.mozilla.org/en-US/kb/lookingglass https://support.mozilla.org/en-US/kb/lookingglass

deleted 9y ago

[deleted]

ddevault 9y ago

Thank you for your comment. I'm sorry I hadn't seen this earlier; I stopped reading the HN thread a while ago. I have added this to my article: >It has been clarified that an about:config flag must be set for this addon’s behavior to be visible. This improves the situation considerably, but I do not think it exenorates Mozilla and I stand firm behind most of my points. The study has also been rolled back by Mozilla, and Mozilla has issued statements [0] to the media [1] justifying the study (no apology has been issued). [0] https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-into-firefox-1821332254 https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-... [1] https://gizmodo.com/after-blowback-firefox-will-move-mr-robot-extension-t-1821354314 https://gizmodo.com/after-blowback-firefox-will-move-mr-robo...

bluefox 9y ago
It doesn't improve the situation at all, which is that Mozilla has the capability to silently install addons in a default setting.
endemic 9y ago
> no apology has been issued This is my problem, right here. To err is human, but I would expect a level of contriteness, rather than doubling down on the "nothing to see here" attitude.
- deleted 9y ago
  [deleted]

frik 9y ago

> Most of us are on flights today Yeah, someone mentioned Mozilla plays rich, and fly-in all employees every 6 months. And someone found a good time window to post the article, when the corporation drones were offline, and had no time to flag the HN news to avoid a backlashe. Mozilla acts like a unicorn startup, not like a non-profit org at all! All these unwanted DRM support, missing WebSQL support, unwanted Hello, Pocket, Easter-Egg addons that can barely be removed with lot of work are alienating your user base, and it's completely Mozilla's fault.

scrollaway 9y ago
Jesus man, have some respect for other humans, and some leniency where it's warranted. It's possible to be critical of Mozilla and still be courteous. (Also see: my own criticism of Mozilla in this thread)
- Endy 9y ago
  Please tell me why anyone should bother being respectful of or lenient towards those who won't show the same decent behavior? They're messing with the tools people use to work. That alone earns them utter and complete disrespect. They've done this in a way that leaves them conspicuously unable to reply - they deserve no leniency for this.
  - scrollaway 9y ago
    > Please tell me why anyone should bother being respectful of or lenient towards those who won't show the same decent behavior? First of all, Mozilla isn't being rude, they're being foolish. But to answer that question in general, the goal is to fix things, not make them generally shit, so one side has to show decency at least. Furthermore, even if you believe they're as bad as you say, that does not give everyone carte blanche to be awful.
  - dang 9y ago
    Because you owe better to this community than to be brutally dismissive of others. If you want to post in a rage, please do so elsewhere; on HN commenters need a minimum level of self-control, quite independently of how wrong anybody else is. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

deleted 9y ago

[deleted]

mrrobot9000 9y ago

Thank you for your response. I wanted to add to what I'm sure is a chorus of commentary that your team is currently dealing with. But I don't know if this specific point has been made. Your team has just ruined a huge amount of trust by not appropriately reviewing and documenting this feature. This goodwill is the most important capital Mozilla has. Your team is continuing to make this situation worse by not posting any official response on Mozilla's communication channels, and by arbitrarily censoring incoming comments. It would be appropriate for all members of your team to question the processes that led to this, and drive structural changes to ensure this never happens again. This includes the continued inaction of Mozilla's communications team.

Manishearth 9y ago
I'm unsure if this was actually callahad's team doing this. But regardless, basically the entire company is on flights right now, and it's the weekend after an intensive all-company event, and everyone is tired, and it's the freaking weekend. Wait a bit. (Also, the Gizmodo article is an official response, as is https://support.mozilla.org/en-US/kb/lookingglass https://support.mozilla.org/en-US/kb/lookingglass. There will probably be more, idk.)
- kashyapc 9y ago
  You maybe "unsure", but for an outsider reading Callahad's response, it looks like so. Besides, it's meant to be read as: "one of your teams". Also, your all-company event maybe "intensive", but it doesn't matter one whit. Why? When your corporation's actions are raising a damn ugly stink ruining Mozilla's good will, you're better off paying immediate attention even if it's the "freaking weekend". It's elementary common sense.
  - Manishearth 9y ago
    Given the responses to emails folks have sent internally, they are paying immediate attention, they just haven't gotten to the point of making public statements aside from the Gizmodo article.
- 9y ago

jrochkind1 9y ago

I don't understand what makes this a "study". What were you studying?

Manishearth 9y ago
"study" is just an internal term for the method of deploying addons that way; they're called "Shield Studies" and usually are for A/B testing. This wasn't an actual study, he's just using the internal term for that kind of addon.

quesnel 9y ago

It seems that Mozilla didn't get paid to implement this extension and force it through channels reserved for usability studies: "We didn't make any money off of this; it was intended as an easter egg in Firefox for fans of the show." https://www.metafilter.com/171227/Your-Reality-Is-Driven-By-Marketing#7265127 https://www.metafilter.com/171227/Your-Reality-Is-Driven-By-... "Mozilla wasn't paid for the Mr. Robot tie-in, Kaykas-Wolff [Jascha Kaykas-Wolff, Mozilla's chief marketing officer] said. "We've enjoyed a growing partnership with the show and the show's audience," he said." https://www.cnet.com/au/news/mozilla-backpedals-after-mr-robot-firefox-misstep/ https://www.cnet.com/au/news/mozilla-backpedals-after-mr-rob... It doesn't matter if the extension was not activated on installation because the check for the extensions.pug.lookingglass on line 22 https://github.com/mozilla/addon-wr/blob/master/addon/bootstrap.js#L22 https://github.com/mozilla/addon-wr/blob/master/addon/bootst... can easily be gone in the next version of the extension. Not getting paid for this ad is even worse in my opinion. Mr. Robot is produced by Universal Cable Productions, which is part of NBCUniversal, which in turn is owned by Comcast. Your marketing people are probably laughing behind your back, they got the dork developers to implement this ad for free, be proud of it and even defend it in online forums. As they say: "The intent is to provide players with a sense of pride and accomplishment for unlocking different heroes." https://www.reddit.com/r/StarWarsBattlefront/comments/7cff0b/seriously_i_paid_80_to_have_vader_locked/dppum98/ https://www.reddit.com/r/StarWarsBattlefront/comments/7cff0b... Your marketing people got to play with the big boys in mass media and are now owned some favors. Think about that for a minute.

swistak84 9y ago
So let me get this straight. Mozilla did a free advertisement for Comcast owned TV Series Mr. Robot? What The Proverbial F?

fuckyouzilla 9y ago

I hope you get fired. I hope mozilla either switches its course into the right direction or goes bankrupt and stops existing.

jftuga 9y ago

Uninstall Firefox: https://support.mozilla.org/en-US/kb/uninstall-firefox-from-your-computer https://support.mozilla.org/en-US/kb/uninstall-firefox-from-...

ben0x539 9y ago

hey just want to chime in to say thanks for adding the context. do you know where i can read up on the decision being made to deploy this extension thru the shield thing?

deleted 9y ago
[deleted]

TAForObvReasons 9y ago

> It was pulled yesterday after the backlash The fact that it took a backlash to pull something that Mozilla engineers built and deployed is the worrisome element that the post and many people discussed. > This event tells us that “Firefox studies” into a backdoor for advertisements, and I will never trust it again. But it doesn’t matter - you’re going to re-enable it on the next update. You know what that means? I will never trust Firefox again. That's the real problem. There's already a strong negative taste after incidents like https://twitter.com/dherman76/status/433320156496789504 https://twitter.com/dherman76/status/433320156496789504 > Excited to share the launch of @mozilla @firefox Tiles program, the first of our user-enhancing programs The default assumption that Mozilla is "one of the good guys" may have been there years ago, but in 2017 after many stumbles people are calling Mozilla's actions into question. The impression Mozilla's actions left upon 'sir_cmpwn wasn't based on an overnight reaction -- it was years of questionable actions. Trust is incredibly hard to earn, but very easy to lose

pascalxus 9y ago

I can see how you wanted to give people something fun, and I think firefox's heart is in the right place. But, Browsers are not games. It's a critical piece of software, like the operating system on an airplane. You wouldn't put an easter egg in an airline's operating system, would you?