3 ms·

let's not pretend this is some isolated incident. see: rest of this thread and many threads before it. EDIT: > The core idea (deploy an easter egg via an add

let's not pretend this is some isolated incident. see: rest of this thread and many threads before it. EDIT: > The core idea (deploy an easter egg via an add-on) seems pretty reasonable. no, no it doesn't. especially not when done silently, without confirmation and modifies headers and content on pages i visit. in what alternate universe is this "reasonable"? "reasonable" would be to push it to a tile on the new tab page. EDIT 2: Mr Robot is the exact type of sensationalized shit i want to keep out of my tools.

callahad 9y ago
I won't dispute that history; just trying to add context to this one and agree that it's disappointing. As to your edit, I absolutely agree. That's what I meant when I said pushing the add-on was not good. I was only suggesting that an add-on is a reasonable place to implement an easter egg, since it's separate from the core browser code. Distributing that add-on is a different matter, and I personally disagree with what happened there.
- acqq 9y ago
  > I was only suggesting that an add-on is a reasonable place to implement an easter egg, since it's separate from the core browser code. It was not a common add-on but an ad disguised as a "study." The question is still: why? Why did that marketing team need that treatment instead of giving to the interested users a link to the normal add on? What was the actually planned scenario? Was it planned that that "study" (the studies are apparently officially "a way of making more informed product decisions based on actual user needs") uses some functionality not available to the normal add-ons? Was it that the normal add-ons wouldn't have access to the API that the "study" would use but that is forbidden to the normal add-ons since v57?
  - acqq 9y ago
    Indeed, that was not a normal extension: "The addon is actually deployed as an embedded WebExtension, which is subtly different. It has a 40-line legacy XUL/XPCOM bootstrapper controlling whether the WebExtension part of it runs. The legacy code actually could upload your hard drive and isn't bound by any of the WebExtension restrictions. We know it doesn't do anything harmful, but it could have done so. The WebExtension itself also has <all_urls> and webRequest permissions, granting it the ability to sniff the content and headers of every page." (Source: https://www.reddit.com/r/talesfromtechsupport/comments/7k7wum/when_all_online_tests_are_invalidated_blame_mr/drcohn5/ https://www.reddit.com/r/talesfromtechsupport/comments/7k7wu... ) The question is still: what was the goal?
suby 9y ago
I would also take issue with calling it an easter egg. It wasn't an easter egg. It was an advertisement. That they silently installed on people's computers without their notification or knowledge. That's not okay.
- monob 9y ago
  Honest question: Pretty much every site on the internet does that. Why are we spending 500 replies and all this developer time on an issue that if done by, say google on their home page, would be considered at best a fun little doodle at worst business as usual?
  - BoysenberryPi 9y ago
    I feel like this is way overblown but I think the logic here is that Mozilla claims to be an ally of privacy and internet freedom. While Google obviously, does not.
    - Drdrdrq 9y ago
      It is not overblown. Many of us powerusers / influencers stood by Firefox because of privacy. Latest failures have damaged my trust considerably. To add insult to injury I don't see an apology or anything similar from Mozilla (or callahad here on hn) that would show me they understand the extent of this issue - how badly they f* up on how many occasions. It's ironic, right when browser can finally stand next to Chrome in terms of performance...
      - tzahola 9y ago
        Maybe you can’t have chrome-like performance without chrome-like privacy ¯\_(ツ)_/¯
        Endy 9y ago
        Then people need to learn to slow down and back off - my privacy is a major part of my time's value. I will gladly spend a few half-seconds longer to be more private and more secure on an XUL-based browser rather than ever use an insecure WebExtensions-backed multi-process mess that accesses the Web without my consent or control.
Dylan16807 9y ago
> modifies headers and content No, it doesn't do that until you explicitly activate it. The "pretty reasonable" core idea is just having that flag available in about:config or on the addons website or similar.

callahad 9y ago

I won't dispute that history; just trying to add context to this one and agree that it's disappointing. As to your edit, I absolutely agree. That's what I meant when I said pushing the add-on was not good. I was only suggesting that an add-on is a reasonable place to implement an easter egg, since it's separate from the core browser code. Distributing that add-on is a different matter, and I personally disagree with what happened there.

acqq 9y ago
> I was only suggesting that an add-on is a reasonable place to implement an easter egg, since it's separate from the core browser code. It was not a common add-on but an ad disguised as a "study." The question is still: why? Why did that marketing team need that treatment instead of giving to the interested users a link to the normal add on? What was the actually planned scenario? Was it planned that that "study" (the studies are apparently officially "a way of making more informed product decisions based on actual user needs") uses some functionality not available to the normal add-ons? Was it that the normal add-ons wouldn't have access to the API that the "study" would use but that is forbidden to the normal add-ons since v57?
- acqq 9y ago
  Indeed, that was not a normal extension: "The addon is actually deployed as an embedded WebExtension, which is subtly different. It has a 40-line legacy XUL/XPCOM bootstrapper controlling whether the WebExtension part of it runs. The legacy code actually could upload your hard drive and isn't bound by any of the WebExtension restrictions. We know it doesn't do anything harmful, but it could have done so. The WebExtension itself also has <all_urls> and webRequest permissions, granting it the ability to sniff the content and headers of every page." (Source: https://www.reddit.com/r/talesfromtechsupport/comments/7k7wum/when_all_online_tests_are_invalidated_blame_mr/drcohn5/ https://www.reddit.com/r/talesfromtechsupport/comments/7k7wu... ) The question is still: what was the goal?

suby 9y ago

I would also take issue with calling it an easter egg. It wasn't an easter egg. It was an advertisement. That they silently installed on people's computers without their notification or knowledge. That's not okay.

monob 9y ago
Honest question: Pretty much every site on the internet does that. Why are we spending 500 replies and all this developer time on an issue that if done by, say google on their home page, would be considered at best a fun little doodle at worst business as usual?
- BoysenberryPi 9y ago
  I feel like this is way overblown but I think the logic here is that Mozilla claims to be an ally of privacy and internet freedom. While Google obviously, does not.
  - Drdrdrq 9y ago
    It is not overblown. Many of us powerusers / influencers stood by Firefox because of privacy. Latest failures have damaged my trust considerably. To add insult to injury I don't see an apology or anything similar from Mozilla (or callahad here on hn) that would show me they understand the extent of this issue - how badly they f* up on how many occasions. It's ironic, right when browser can finally stand next to Chrome in terms of performance...
    - tzahola 9y ago
      Maybe you can’t have chrome-like performance without chrome-like privacy ¯\_(ツ)_/¯
      - Endy 9y ago
        Then people need to learn to slow down and back off - my privacy is a major part of my time's value. I will gladly spend a few half-seconds longer to be more private and more secure on an XUL-based browser rather than ever use an insecure WebExtensions-backed multi-process mess that accesses the Web without my consent or control.

Dylan16807 9y ago

> modifies headers and content No, it doesn't do that until you explicitly activate it. The "pretty reasonable" core idea is just having that flag available in about:config or on the addons website or similar.