3 ms·

Even if the add-on is "enabled," it's doesn't initialize itself unless a specific about:config value is also manually flipped: https://github.com/mozilla/addon-

Even if the add-on is "enabled," it's doesn't initialize itself unless a specific about:config value is also manually flipped: https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js#L21-L24 https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac... And, for good measure, here's an official quote confirming that we're pulling the add-on from Firefox: https://gizmodo.com/after-blowback-firefox-will-move-mr-robot-extension-t-1821354314 https://gizmodo.com/after-blowback-firefox-will-move-mr-robo...

deleted 9y ago
[deleted]
betterunix2 9y ago
It would be easier to forgive if this was the first time Mozilla pulled this sort of thing. Instead, we see Mozilla making this same kind of mistake -- i.e. trying to turn what is otherwise a great browser into some kind of "platform" for things that do not actually serve users -- over and over again. It's great that it was pulled, but what about removing the ability to silently install add-ons? Give up the power to make this mistake in the future if you want forgiveness.
- devcpp 9y ago
  Absolutely. The whole ordeal reminds me awfully of Ajit Pai's tone as he kills net neutrality, sounding as if everything was fine until net neutrality came along. Although different, this too brushes off this one instance as a mistake, and entirely disregards the rest of the article, not even trying to address or explain the rest of Mozilla's recent borderline malicious behavior. A serious fork is long overdue, if only it didn't take a corporation as big as Mozilla to undo their bad deeds.
  - callahad 9y ago
    I'm just one DevRel engineer on a layover; I'm not the right person to answer those broader questions. Not trying to be dismissive, just trying to engage in the areas where I'm most able.
    - betterunix2 9y ago
      Do you have an insight into whether or not Mozilla will issue an update that removes the ability to push add-ons in this fashion?
  - Dylan16807 9y ago
    Bah. This was something that looked spooky but ran exactly zero payload by itself. It implies failed processes inside mozilla, but nothing malicious. I still want a justification of the cliqz thing, sure, but I don't demand it in relation to this.
nperez 9y ago
I'm glad it doesn't do anything, but if I saw this in my extensions list, I would think it was malware. That does have an impact. I could have spent hours with my hair on fire trying to figure out how my system was compromised, and I wouldn't be surprised if others have. I'd expect better from an org that has to deal with security issues all the time.
krisives 9y ago
> callahad 4 hours ago [-] Even if the add-on is "enabled," it's doesn't initialize itself unless a specific about:config value is also manually flipped Attack surface 101 / reason nobody else does this
- Sylos 9y ago
  How is this a particular attack surface? Changing an about:config value requires quite a bit of effort from an attacker and enabling this extension would not actually pose a security risk either. There's plenty of better about:config values to be changing, too.

deleted 9y ago

[deleted]

betterunix2 9y ago

It would be easier to forgive if this was the first time Mozilla pulled this sort of thing. Instead, we see Mozilla making this same kind of mistake -- i.e. trying to turn what is otherwise a great browser into some kind of "platform" for things that do not actually serve users -- over and over again. It's great that it was pulled, but what about removing the ability to silently install add-ons? Give up the power to make this mistake in the future if you want forgiveness.

devcpp 9y ago
Absolutely. The whole ordeal reminds me awfully of Ajit Pai's tone as he kills net neutrality, sounding as if everything was fine until net neutrality came along. Although different, this too brushes off this one instance as a mistake, and entirely disregards the rest of the article, not even trying to address or explain the rest of Mozilla's recent borderline malicious behavior. A serious fork is long overdue, if only it didn't take a corporation as big as Mozilla to undo their bad deeds.
- callahad 9y ago
  I'm just one DevRel engineer on a layover; I'm not the right person to answer those broader questions. Not trying to be dismissive, just trying to engage in the areas where I'm most able.
  - betterunix2 9y ago
    Do you have an insight into whether or not Mozilla will issue an update that removes the ability to push add-ons in this fashion?
- Dylan16807 9y ago
  Bah. This was something that looked spooky but ran exactly zero payload by itself. It implies failed processes inside mozilla, but nothing malicious. I still want a justification of the cliqz thing, sure, but I don't demand it in relation to this.

nperez 9y ago

I'm glad it doesn't do anything, but if I saw this in my extensions list, I would think it was malware. That does have an impact. I could have spent hours with my hair on fire trying to figure out how my system was compromised, and I wouldn't be surprised if others have. I'd expect better from an org that has to deal with security issues all the time.

krisives 9y ago

> callahad 4 hours ago [-] Even if the add-on is "enabled," it's doesn't initialize itself unless a specific about:config value is also manually flipped Attack surface 101 / reason nobody else does this

Sylos 9y ago
How is this a particular attack surface? Changing an about:config value requires quite a bit of effort from an attacker and enabling this extension would not actually pose a security risk either. There's plenty of better about:config values to be changing, too.