5 ms·

I am not a Firefox user[1], but the thing I am finding it difficult to understand about this brewhaha is: 1. Aside from how it reaches the users machine, is th

I am not a Firefox user[1], but the thing I am finding it difficult to understand about this brewhaha is: 1. Aside from how it reaches the users machine, is the extension on or off when it gets installed invisibly? 2. If it's off, why push it at all? If the user is expected to give consent at some point down the line for it to be on, why not just have the user actually install the extension at the time of consent, rather than prefetching? [1] work gives me a Chrome OS laptop, and I find the lock-in of sync-ing bookmarks and things pretty real.

callahad 9y ago
> Is the extension on or off when it gets installed invisibly? You could argue technicalities for either, but semantically, it's off by default. The add-on is implemented as an "embedded webextension" which is wholly contained by an outer "bootstrapped add-on." The bootstrapped add-on controls whether or not the embedded webextension gets initialized, and that's all it does. The bootstrapped add-on is literally just this one file: https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac... The outer shell is on by default. The embedded webextension is only initialized by the bootstrapped add-on if the user manually flips the "extensions.pug.lookingglass" preference in about:config. That preference is off by default. > why not just have the user actually install the extension at the time of consent, rather than prefetching? That's what we're moving to by pulling the add-on from Firefox and posting it on AMO.
- zanedb 9y ago
  > That's what we're moving to by pulling the add-on from Firefox and posting it on AMO. Why was this not done in the first place?
  - callahad 9y ago
    I'm not personally aware of the answer to that question, but I expect it will be covered in a postmortem in the coming days.
    - amenod 9y ago
      I am anxiously waiting for the postmortem. As others have written, this is not a first such incident that goes against (perceived) core values of Mozilla. Either you need to pull your act together and change the process that leads to such decisions or you need to come clean (and admit that you are selling out your users for profit, the way Google does). Well, you can also ignore the situation and public will understand that you chose the latter... If you do decide to come clean, it would help a lot if you gave assurances about what you have learned and how you will change the process so that this doesn't happen again. Trust is difficult to gain and easy to lose. I must say I am sorry to see all this happening though. I have always hated Chrome (a bit less than IE, but for other reasons) and am (still) your loyal user. I even enabled telemetrics recently (which means _a lot_ - there is no other piece of software that gets this willingly from me) - needless to say, they are turned off again. We'll see how the postmortem turns out.
      - deleted 9y ago
        [deleted]
- agumonkey 9y ago
  Gentle question: was it a candid easter egg ? I feel a bit distanced about the whole situation. The issues I've seen are: - getting money from secret extension - potential security risk - bad will from mozilla the name shield studies feels a bit scary, a CIA paranoia tone but anyway.. I believe that's the era that is tense and what seems to be an easter egg as you say, ends up as a brutally negative thing.
- gregknicholson 9y ago
  I just want to say thank you for engaging here! Mozilla fucking up like this still feels like a friend fucking up. It's frustrating and disappointing precisely because I expect Mozilla to be better than this.
  - Drdrdrq 9y ago
    Err... No. The first time around (Pocket), yes. The second time (changing my explicitly set default search engine) - maybe. But this? Bundling ads with my browser? Not acknowledging it is a problem? No.
    - Fnoord 9y ago
      Don't forget the Cliqz debacle. And that in privacy oriented Germany. I'm in Berlin right now, and they don't appear to use a NFC card for public transport. In contrast to NL and UK they're still using tickets here.
- krisives 9y ago
  > You could argue technicalities for either, but semantically, it's off by default. That’s a very dangerous type of justification there, not one I expected someone at Mozilla to get that wrong.
  - SquareWheel 9y ago
    He's being more generous than he needs to be. It is off by default.
- watwut 9y ago
  So basically, much ado about nothing. I am glad you engaged, thank you. People are too quick to overreact these days.
  - jodrellblank 9y ago
    People are too quick to overreact these days. - it's as much fun a burst of dopamine and involvement as any gamified mobile game. And it's not like we have any massive problems to unite against (that we can actually feel like we can help with).
- jftuga 9y ago
  Uninstall Firefox: https://support.mozilla.org/en-US/kb/uninstall-firefox-from-your-computer https://support.mozilla.org/en-US/kb/uninstall-firefox-from-...

callahad 9y ago

> Is the extension on or off when it gets installed invisibly? You could argue technicalities for either, but semantically, it's off by default. The add-on is implemented as an "embedded webextension" which is wholly contained by an outer "bootstrapped add-on." The bootstrapped add-on controls whether or not the embedded webextension gets initialized, and that's all it does. The bootstrapped add-on is literally just this one file: https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac... The outer shell is on by default. The embedded webextension is only initialized by the bootstrapped add-on if the user manually flips the "extensions.pug.lookingglass" preference in about:config. That preference is off by default. > why not just have the user actually install the extension at the time of consent, rather than prefetching? That's what we're moving to by pulling the add-on from Firefox and posting it on AMO.

zanedb 9y ago
> That's what we're moving to by pulling the add-on from Firefox and posting it on AMO. Why was this not done in the first place?
- callahad 9y ago
  I'm not personally aware of the answer to that question, but I expect it will be covered in a postmortem in the coming days.
  - amenod 9y ago
    I am anxiously waiting for the postmortem. As others have written, this is not a first such incident that goes against (perceived) core values of Mozilla. Either you need to pull your act together and change the process that leads to such decisions or you need to come clean (and admit that you are selling out your users for profit, the way Google does). Well, you can also ignore the situation and public will understand that you chose the latter... If you do decide to come clean, it would help a lot if you gave assurances about what you have learned and how you will change the process so that this doesn't happen again. Trust is difficult to gain and easy to lose. I must say I am sorry to see all this happening though. I have always hated Chrome (a bit less than IE, but for other reasons) and am (still) your loyal user. I even enabled telemetrics recently (which means _a lot_ - there is no other piece of software that gets this willingly from me) - needless to say, they are turned off again. We'll see how the postmortem turns out.
    - deleted 9y ago
      [deleted]
agumonkey 9y ago
Gentle question: was it a candid easter egg ? I feel a bit distanced about the whole situation. The issues I've seen are: - getting money from secret extension - potential security risk - bad will from mozilla the name shield studies feels a bit scary, a CIA paranoia tone but anyway.. I believe that's the era that is tense and what seems to be an easter egg as you say, ends up as a brutally negative thing.
gregknicholson 9y ago
I just want to say thank you for engaging here! Mozilla fucking up like this still feels like a friend fucking up. It's frustrating and disappointing precisely because I expect Mozilla to be better than this.
- Drdrdrq 9y ago
  Err... No. The first time around (Pocket), yes. The second time (changing my explicitly set default search engine) - maybe. But this? Bundling ads with my browser? Not acknowledging it is a problem? No.
  - Fnoord 9y ago
    Don't forget the Cliqz debacle. And that in privacy oriented Germany. I'm in Berlin right now, and they don't appear to use a NFC card for public transport. In contrast to NL and UK they're still using tickets here.
krisives 9y ago
> You could argue technicalities for either, but semantically, it's off by default. That’s a very dangerous type of justification there, not one I expected someone at Mozilla to get that wrong.
- SquareWheel 9y ago
  He's being more generous than he needs to be. It is off by default.
watwut 9y ago
So basically, much ado about nothing. I am glad you engaged, thank you. People are too quick to overreact these days.
- jodrellblank 9y ago
  People are too quick to overreact these days. - it's as much fun a burst of dopamine and involvement as any gamified mobile game. And it's not like we have any massive problems to unite against (that we can actually feel like we can help with).
jftuga 9y ago
Uninstall Firefox: https://support.mozilla.org/en-US/kb/uninstall-firefox-from-your-computer https://support.mozilla.org/en-US/kb/uninstall-firefox-from-...