19 ms·

Update: Looking Glass Add-On

393 points by runesoerensen 9y ago

haZard_OS 9y ago
I'm glad that Mozilla has responded in this way. My disappointment remains, however. I am one of those not affected at all by the Looking Glass extension but still, my trust is Mozilla (which has been eroding as of late) has suffered greatly. I am giving Mozilla exactly one more chance before uninstalling FF on ever device I have. In the meantime, I will no longer volunteer for ANY data collection. Last chance, Mozilla.
- orf 9y ago
  But.... why? And what browser on gods earth are you going to switch to that has the same respect for privacy as Firefox (excluding poorly maintained FF forks). It's a blip, one you where not affected by at all and in the scheme of things not major compared to other vendors. But hey, boo mozilla uninstall everything and use lynx/curl!
  - cuckcuckspruce 9y ago
    Mozilla as an organization and Firefox displayed their reckless disregard for my privacy. It would be foolish to dismiss it as just a blip. If Mozilla cared about people trusting them with their privacy then they shouldn't have evicerated that trust by installing an extension (even switched off) behind their back. They did this with Looking Glass, they did this with Pocket, and they did this with non-free WebRTC support. Three strikes and you're out!
    - TheDong 9y ago
      None of those violated your privacy by any reasonable definition. Those three things did not provide any additional information about you to any third party (unless you opted in to using pocket). WebRTC did violate your fundamental freedoms as defined by the FSF, but that's not a privacy violation. Please explain how your privacy was actually meaningfully violated.
    - orf 9y ago
      Ok, so are you going to be using Edge or Chrome, and which of those respects your privacy more than Firefox. No organisation is perfect and you have a right to be angry, but you're being a bit extreme IMO. It's much more nuanced than three strikes and you're out, and it's a shame to reduce it to that level.
    - icebraining 9y ago
      What's the non-free WebRTC support? I missed that.
- detaro 9y ago
  So what are you moving to if they fail your challenge? (I've asked myself this question, and apart from "try something exotic like Qutebrowser, prepared to move back if it doesn't work out" I don't see a better alternative personally)
detaro 9y ago
A bit clearer than the initial empty press statements, but I guess we'll have to wait for the detailed post-mortems and changes to see how far their understanding for the various concerns goes. Not much detail here.
lookingcrass 9y ago
I hate that Mozilla constantly updates FF and everytime it's like a round of russian roulette with regard to installed addons. Mozilla decided it's no longer compatible? BOOM! GONE FOREVER! Oh, you relied on that one? Welp..
j_s 9y ago
I read some other news story on this today. Is there an actual apology yet? And if not, does it matter? In my mind, no apology is better than a 'sorry you were upset' non-apology, but there are apologies that manage to seem genuine as well. As I write this I am reminded of the show 'The Orville's "apology tour"... I don't necessarily think an apology is needed or helpful. Always interested in examples of corporate PR, whether negative, neutral-ish, or positive. Edit: obviously I don't care enough(?) about the specifics of this instance... Hopefully it's also obvious that I appreciate the chance to evaluate the community's response to a favored company. Mozilla seems to be allowed quite a bit of leeway.
- r3bl 9y ago
  If you actually read the article, I'm pretty sure you'll find the words "we're sorry" in there.
  - nnethercote 9y ago
    Twice!
  - j_s 9y ago
    Thanks. Do you have time to expand on why this counts as a genuine apology to you (or not?). Interesting to me that all it takes to count as an apology to some is the words 'we're sorry'. I hope to find similar discussion(s) where an HN user practiced his hobby of rewriting corporate apologies. Also nice to have another example where initial response can be completely tone deaf with little consequence.
    - 2g67vupsoknn 9y ago
      You might find this thread[1] of interest. All you have to do is drop the word "sorry", it doesn't matter if the apology actually addressed any of the concerns that were raised. FB was sorry for being "unclear". Mozilla is sorry for "the confusion" and for "letting down members of [the] community". The headlines will read "[Company] apologizes for [event that triggered criticism]" and everyone will carry on as if the apology directly addressed that event. The lawyers and shareholders will breathe a sigh of relief, and the matter will soon be forgotten. [1] https://news.ycombinator.com/item?id=15449954 https://news.ycombinator.com/item?id=15449954
dmitrygr 9y ago
A pretty typical "sorry we got caught" post.
- Ded7xSEoPKYNsDd 9y ago
  They never tried to hide this - they actually thought they were building some cute easter egg, without thinking about how people would react to a phishy-looking add-on getting installed in their browser without consent or notice.
  - dmitrygr 9y ago
    And they still haven't said "we are sorry, this was 100% wrong. we 100% promise to never again do this"
- dajt 9y ago
  Yeah, that was a pathetic self-justifying post. "Sorry, won't do it again." would have been better. Losing their next bonus would be better still.
j_koreth 9y ago
Still heavily disappointed with Mozilla I this case, especially due to the previous outrage with Pocket.
- justinclift 9y ago
  > due to the previous outrage with Pocket. Which they still haven't fixed. That's still forced on everyone regardless. :(
  - fabrice_d 9y ago
    Mozilla bought Pocket. It would be extremely surprising if they turned their back on shipping it by default. However it's so easy to disable that this is a non issue.
    - justinclift 9y ago
      Maybe a non-issue for you. Less so for others it seems. :)
    - digi_owl 9y ago
      Meaning that someone in management didn't think to reconsider but instead doubled down on the established path. Frankly that ship is out hunting some kind of white whale, and it is best people get out before it is too late.
cddotdotslash 9y ago
The amount of negative press this received nearly cancels out all the positive news from Quantum's release barely a month ago. It's such a shame that the years of hard work and effort on the dev teams are being overshadowed by such a ridiculous marketing mistake. For a browser that is one of the last big proponents of a privacy-centered, user-first web, these kinds of mistakes can't happen... period. Now it's nearly back to the starting line on re-gaining user trust again.
- GunlogAlm 9y ago
  > The amount of negative press this received nearly cancels out all the positive news from Quantum's release barely a month ago. Which is silly, IMO. What did this addon actually do, besides be installed without user consent? If this article is correct, the addon was installed automatically but was not 'activated'. Seems like a fuss over nothing, to me, but somebody correct me if I have the details wrong.
  - DonHopkins 9y ago
    The point is that Mozilla prides themselves on transparency, but the name of the config option was "extensions.pug.lookingglass" -- meaningless buzz words with no reference to Mr. Robot -- and the description was just "MY REALITY IS DIFFERENT THAN YOURS" -- an enigmatic Alice in Wonderland quote. It's actively trying to be opaque. That's the opposite of transparency. Curious adventurous people install the test build because they want to try out new features and extensions. Those are the users who are most likely to know about and use "about:config". The config option and description of the plugin are mysterious and enigmatic, which tempts your curiosity into turning it on to see what it does, because you presumably trust that Mozilla wouldn't distribute just any old extension that didn't have a purpose other than scanning and modifying the content of every web page, inserting dynamic content adjacent to keywords, and advertising a TV show.
    - Yoric 9y ago
      To be fair, this was part of a hint in a scavenger hunt, so being opaque is pretty much required in that context. Did it actually display an ad? I didn't see anything such on my Firefox.
martin_andrino 9y ago
I just hope this makes the outraged people quiet for a while. This is a clear apology and Mozilla seems to have learned the lesson. Let’s now show some love and support for this powerful open-source organization.
- whalesalad 9y ago
  Ok, Mozilla Employee with the fresh account.
  - dang 9y ago
    This breaks the HN guideline against accusing other users. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and don't do this again.
- cuckcuckspruce 9y ago
  Apology does not mean instant forgiveness nor does it mean do-over. It's a sad day when I now have more trust in Apple and Safari than I do in Mozilla and Firefox.
  - tiles 9y ago
    Not to say you should doubt the Safari team, but I remember the auto-push of U2 albums to users without an opt-in being comically similar.
    - i_s 9y ago
      Pushing unwanted sound files and pushing unwanted executable code are two very different things.
      - digi_owl 9y ago
        In the end they are both symptoms of a tone deaf management that think that their world view is the majority world view...
rebelwebmaster 9y ago
I wonder if "process changes" include actually enforcing the already-existing rules around Shield deployments that were outlined on their wiki.
- SethKinast 9y ago
  I don't really plan on giving them a chance; I went to about:preferences#privacy and removed the permission.
chrisseaton 9y ago
> Over the course of the year Firefox has enjoyed a growing relationship with the Mr. Robot television show This line is just absolutely crazy by itself when you think about it. Why does a browser team have any kind of relationship at all with some TV show? What is going on?
- suby 9y ago
  Did Firefox perhaps get screen time in Mr. Robot?
  - jacquesm 9y ago
    Who cares if it did?
    - suby 9y ago
      It's just bizarre, is all. Especially considering that they claim they did not get paid for Looking Glass.
      - detaro 9y ago
        I assume the idea of the ARG was that it promotes Firefox to viewers of the show as much as the other way around.
        weaksauce 9y ago
        it promotes firefox to viewers of the show about online privacy... the viewers are probably more receptive than most to changing over to a more privacy oriented browser.
  - knaik94 9y ago
    Firefox ads run a lot during the show. And before the show, they have a mini blurb saying "this week sponsored by firefox"
SamReidHughes 9y ago
This was an inactive extension that didn't do anything unless you activated it, right?
- detaro 9y ago
  Yes. (well, technically it started and checked if it is turned on before not starting the part that would have done everything else)
- ovao 9y ago
  Correct.
- cuckcuckspruce 9y ago
  Assuming that they don't have or can't patch in the ability to push extensions hidden and already activated would be naive at this point.
  - detaro 9y ago
    It's documented that Shield studies can be run without prompt for the individual study, no need to assume otherwise. People primarily worried about their privacy should have been worried about the study feature in cases where they'd actually run studies collecting data, not here.
- dsl 9y ago
  Pushed out silently as part of a mechanism designed to beta-test new browser features. Per their own documentation the extension is supposed to target 1-2% of the install base and pop up asking permission to continue. This is basically Microsoft using Windows Update to install a desktop icon promoting the latest season of The Voice. https://wiki.mozilla.org/Firefox/Shield/Shield_Studies https://wiki.mozilla.org/Firefox/Shield/Shield_Studies
  - Veedrac 9y ago
    > This is basically Microsoft using Windows Update to install a desktop icon promoting the latest season of The Voice. Mozilla have said that this test was meant to be invisible, so whilst this is an accurate analogy of the end result, it's also an accidental one.
chrismartin 9y ago
We really need a fork of Firefox with all the garbage removed, including the ability for Mozilla's marketroids to push things at us remotely. (Also "telemetry", DRM, Pocket, spam on the new tab page, etc.) A browser should just be a tool which answers to the user. I want my browser to be like a pair of pliers or a bicycle, neither of which have relationships with television shows. I think Iceweasel was essentially this, until the Debian project abandoned the effort.
- jimktrains2 9y ago
  Don't iceweasle and friends do that?
- TheDong 9y ago
  > removed .. telemetry We want our browsers to work. Without telemetry, they simply won't be able to find and solve bugs and crashes effectively. Without crash reporting and other basic telemetry, it's basically impossible to know how prevalent certain bugs and configurations... which is of the utmost important for making a browser which actually works.
  - chrismartin 9y ago
    > Without telemetry, they simply won't be able to find and solve bugs and crashes effectively. Users can be prompted to report bugs with some facility to provide telemetry (e.g. after a crash), but the browser must ask permission first. On-by-default telemetry is tantamount to malware exfiltrating information about your computing activity to a third party.
    - pcwalton 9y ago
      > e.g. after a crash Not "e.g. after a crash", "only after a crash". That's about the only kind of telemetry you can get on a "prompt on each occurrence" basis like that. Just monitoring crashes is not nearly enough to create a competitive browser. Performance bugs, many of which are specific to older systems mostly used by people who can't be expected to file bugs in Bugzilla, cannot be reliably caught without some kind of telemetry.
chris_wot 9y ago
And what about the non-transparent bug? https://bugzilla.mozilla.org/show_bug.cgi?id=1423003 https://bugzilla.mozilla.org/show_bug.cgi?id=1423003 And no updates on the public bug, and it was summarily closed: https://bugzilla.mozilla.org/show_bug.cgi?id=1424977 https://bugzilla.mozilla.org/show_bug.cgi?id=1424977 That hardly inspires confidence on transparency.
- zbraniecki 9y ago
  I don't have access to the private bug myself, but I can try to reason about it. I believe that at this point, opening up this bug would do exclusively harm and no good to anyone. There's nothing I can imagine in the bug to be of value to our understanding of the situation. If the people working on it were oblivious to what they are doing, then it would just look plain stupid from hindsight 20/20. If the people working on it were aware and hoped that no one will raise a fuss, then it'll look even worse for them. The important fact is that Mozilla reacted, and that the leadership does have access to this bug. Whoever was involved is probably currently involved in debriefing what has happened there and that bug is part of it. I hope it'll be open at some point, but I'd hate if access to the bug resulted in a witch hunt and public shaming of that person/people which, as we all know, the Internet is great at. We know that our leadership reacted and we know that they recognize what has happened. I'm not asking you to trust them, obviously that has to be regained and the process is painfully slow, but I do ask you to give them time. The emotional reaction is short-termed. I hope that this incident will have a long term positive consequences to our project.
  - chris_wot 9y ago
    Of course, a witch hunt does no good to anyone and to my mind, it's a mistake (albeit a bad one). My issue is that the public bug was closed off early. In future, perhaps the Mozilla team might take it into account that communication might be smoother if they keep things more transparent. I'm a massive fan of Mozilla. In fact, I'm trying to get more folks in my org to use it instead of Chrome (it's a hell of a lot more stable, and the Chrome team tends to break our web apps frequently). I largely trust Mozilla far more than the Google team, and this unfortunate episode, for me at least, just made me mad because it was such a major cock-up that it was entirely unexpected.
cjsuk 9y ago
"We didn't think hard enough" is the 2017 version of "we thought we could get away with it"
- reustle 9y ago
  You're right, but it started a few years ago. At least.
guelo 9y ago
Jascha Kaykas-Wolff should be fired. Marketing shouldn't be allowed to modify the shipping bits at all, even if the Chief Marketing Officer tells them to. Any and all product changes should go through engineering and tracked in bugzilla. The CMO can file a ticket in the open just like anybody else can.
- dang 9y ago
  This counts as a personal attack. Those aren't ok on HN and we ban accounts that do it, so please don't do it again. You may not owe better to whoever installed an extension in your browser but you do owe better to this community, if you want to comment here. I'd appreciate it if you'd (re-)read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and take the spirit of this site more to heart. Also https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html. p.s. Your comment without the first sentence would be fine.
- persona_reuse 9y ago
  To me, the sad part is (based on what little you can find in public bugs) the Shield team seemed to be engaged in this, and didn't raise a flag that their platform of experiments was being co-opted to push out a game. There's all the talk that Mozilla violated peoples privacy, and they're not wrong, but the larger loss, I think, is all the technical people who will turn off Shield and never come back to using it.
djanogo 9y ago
Why does Mozilla have a relationship with a television show?, does the show promote Firefox?. "..Firefox has enjoyed a growing relationship with the Mr. Robot television show.."
- geraltofrivia 9y ago
  One gotsta make them dollars, right? I am not aware of their financial status but I'm fairly certain that Quantum development would have burnt a substantial hole in their Pocket.
- detaro 9y ago
  > does the show promote Firefox? That seems to have been the point of running an ARG tying Firefox to the show. Get viewers to use Firefox to "play".
- ufo 9y ago
  Mozilla advertises Firefox in that tv show, both through product placement and actual ads.
tomc1985 9y ago
They should have given the same treatment to Pocket and Hello: optional, manifests as an add-on, and possibly off-by-default for certain kinds of users. Instead we get value-adds baked directly into the broswer itself. I HATE this new age of corporate-oriented thinking, especially from a company that claims to reject those values. I suppose Looking Glass is progress....
pkamb 9y ago
> unpaid collaboration Even worse if this wasn't a google-like revenue deal.
- ufo 9y ago
  Mr Robot advertises Firefox in the TV show. It is unclear if Mozilla is paying them or if this is an unpaid thing in both directions.
Sohcahtoa82 9y ago
I just wanna know what kind of idiot thought this was a good idea from the beginning. I mean, I'm just a cybersecurity guy and a software engineer. I'm no PR person. But it doesn't take a PR expert to know that the world would eventually find out about an addon getting installed without permission and it would be a disaster.
- detaro 9y ago
  My guess would be that a PR person did not think about the aspects that went wrong and was more enthusiastic about having a clean way of delivering this. Not much to do, it just appears, no need to tell people how to install an add-on, no issue since it doesn't do anything to people that don't turn it on. Privacy check passes, since it doesn't do anything that impacts privacy. (Which the first press responses focused on pointing out). Since it's supposed to be stealth (it's an ARG), only a small group is involved, hyped about bulding this cool thing. Totally could have happened that way, totally missed something crucial at every single step that came back to bite them.
- itronitron 9y ago
  If they rename 'addon' to 'ad-on' that might help Mozilla manage user expectations.
  - scrollaway 9y ago
    What are you talking about?
    - itronitron 9y ago
      I'm talking about Mozilla using the Firefox 'addon' extensions mechanism to support an ad campaign, hence renaming the extension mechanism to 'ad-on' might make it more clear to users what Mozilla is using it for.
      - scrollaway 9y ago
        Ads usually have a financial exchange to them. And this didn't use the add-on system, it inappropriately used the studies system.
zakk 9y ago
I don't think this is the full story. They claim the add-on was disabled by default, and needed to be manually activated. Note that the description of the Looking Glass addon was "MY REALITY IS JUST DIFFERENT THAN YOURS." Note also that I have never activated such add-on. Now, If I go to about:studies (for those not familiar with SHIELD studies https://support.mozilla.org/en-US/kb/shield https://support.mozilla.org/en-US/kb/shield) I see the following 'study': pug-experience Complete • My reality is different than yours So, there was a Mozilla study, with almost the shame shady description, which DID run by default, at least for some users. Are the Looking Glass add-on and this SHIELD study completely unrelated? Why do they share the same description? Why is Mozilla using these shady descriptions in the first place? Probably I am just being paranoid, but Mozilla has done nothing to gain my trust, lately.
- detaro 9y ago
  From what I understand, the add-on wrapper checks for a preference immediately on startup and only loads the WebExtension doing anything if it is set manually. It's enabled in the sense that the wrapper loads and shuts down again, it's disabled in the sense that none of its functionality actually runs.
- Manishearth 9y ago
  > Are the Looking Glass add-on and this SHIELD study completely unrelated? The addon is the shield study. Shield is the mechanism for deploying addons (usually A/B tests) to release populations. What was enabled was a small piece of code[1] that would enable the full addon when a pref was flipped. [1]: https://github.com/mozilla/addon-wr/blob/master/addon/bootstrap.js#L20-L41 https://github.com/mozilla/addon-wr/blob/master/addon/bootst...
Gatsky 9y ago
The outrage to significance ratio is off the charts on this one.
- jacquesm 9y ago
  The fuck it is. Mozilla, champion of the free web goes corporate, the first action after their force-fed update ('for your own good') is to start pushing this sort of thing? Significance of trial balloons should not be underestimated.
  - Gatsky 9y ago
    I see your point. But large tech organisations commit these faux pas/atrocities (depending on your point of view) all the time, regardless of their relationship with profit. I think the reason they happen at all and the shrill tenor of the associated backlash come from the same place though - a kind of echo chamber insularity.
    - jacquesm 9y ago
      For me the motivator is the fact that they cost me a couple of hours in lost time due to their botched upgrade. This last episode is just icing on the cake and illustrates how completely out of touch Mozilla is with the users that make up their core. It's roughly on par with Apple pissing all over the designers and animators and movie makers that were their lifeblood in the pre-Ipod days. Only in Mozilla's case they don't have an Ipod.
    - blub 9y ago
      Well, if the US had privacy laws with teeth, said organisations would learn quite fast not to commit such "mistakes". As such, all it takes apparently is a corporate drone to push hard enough and poof go the customer rights. Food for thought regarding your outrage comment: one does not protect their rights by bending over every time they are taken advantage of.
    - Crespyl 9y ago
      I hold Mozilla to a much higher standard than other large tech organizations. This particular incident shows either massive process failure (allowing marketing to auto-deploy code without sufficient review), or that no one in the review process recognized the issues with using development and debugging tools to push marketing software. Either version is (yet another) blow to the trust I want to have in an organization that I still care very deeply about.
jacquesm 9y ago
What really bugs me is that I had a perfectly good Firefox until a few scant weeks ago when Mozilla decided to force-feed me an upgrade to new browser tech that I didn't ask for, screwed me six different ways at once in the middle of a project where I fairly critically depended on an extension that suddenly stopped working that had just about half the notes of a project in it and then, to add insult to injury push their own add-ons down my throat that I didn't ask for. For someone who has stood by Mozilla over the last decade or so and who never switched to Chrome you can't begin to imagine how pissed off I am. User trust is earned bit-by-bit, you can lose it all in a day. Ask Lenovo how that sort of thing works.
- eganist 9y ago
  > Mozilla decided to force-feed me an upgrade to new browser tech that I didn't ask for https://www.mozilla.org/en-US/firefox/organizations/ https://www.mozilla.org/en-US/firefox/organizations/ That's one thing the Firefox ESR is designed to mitigate. If sequential automatic upgrades weren't quite up your alley, this might have been the right solution for you at the time.
  - jacquesm 9y ago
    Which I had installed, which happily upgraded to FF 57. (I still don't get how that happened the first time, it could have been Ubuntu doing the upgrade, it could have been FF itself but I don't have time to dig this out and I'm not even sure if it is something I'll be able to prove one way or the other.) I've gone so far now as to drop any mozilla.org domains through DNS hacks to make sure this never ever happens again, because after I downgraded it the first time it happily immediately updated back to 57 in spite of having all auto-update settings switched to off. Back to 52.5 it is for me. No more tricks like that. Which is sad because if there is a critical security vulnerability in this browser I'm likely not going to notice immediately.
    - yoklov 9y ago
      ESR versions get security updates.
suby 9y ago
I'm happy to see an apology, but there are further steps they could take. I just did a clean install of Firefox and unless I somehow messed that up, it looks like user studies are enabled by default. Someone correct me if I'm wrong here, as I didn't expect that to be the case. They should absolutely not be running any sort of user studies on people who may not be aware it is being done, which is going to be the case with the current setup. The only way it sits right in my mind is if user studies are opt-in instead of opt out. This is especially ridiculous as their marketing is focused on respecting privacy. An apology is nice, but changing this setting would go a long way towards proving that.
- detaro 9y ago
  I believe that is a strong part of the current outrage: people did not realize that this existed and was turned on. Since actual studies would collect actual user data (unlike this now), the fact that it surprises people suggests that they did not obtain meaningful consent for their data collection. At least from a quick search, I could not find good documentation what studies do exactly to avoid or properly handle personal data, it's possible that they do a very good job of that. (Suggestion to Mozilla: talk about these details at least after the study is done, show what you found. Hopefully: More tech-content to publish, less questions, less ugly surprises)
- tosssh 9y ago
  Shield Studies are opt-out by default https://github.com/mozilla/normandy/issues/741 https://github.com/mozilla/normandy/issues/741 https://bugzilla.mozilla.org/show_bug.cgi?id=1370801 https://bugzilla.mozilla.org/show_bug.cgi?id=1370801 https://bugzilla.mozilla.org/show_bug.cgi?id=1370799 https://bugzilla.mozilla.org/show_bug.cgi?id=1370799
danso 9y ago
As a huge Mr. Robot fan, but one who realizes how niche the show is (the ratings have substantially dropped year after year), I’m embarrassed that Mozilla sullied its reputation for such a small promo — at least U2 was a huge band most people have heard of when Apple pushed their music onto users. The controversy makes Mr. Robot look pretty bad too, even though AFAIK, Firefox (unlike Amazon’s Echo) never was prominently mentioned on the show.
DonHopkins 9y ago
Fixed Firefox spelling and URL master (#43) @gregglind gregglind committed 4 days ago: + "description": "MY REALITY IS JUST DIFFERENT THAN YOURS.\n\nLooking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience. Are you a fan of Mr. Robot? If so, join the hunt for answers!\n\nParticipating in this shared world experience requires explicit user opt in. If you are not actively participating in the ARG (Augmented Reality Game) no modifications will be made to Firefox.\n\nhttps://support.mozilla.org/kb/lookingglass" https://support.mozilla.org/kb/lookingglass", Sigh. Again [2], it's definitely not an "Augmented Reality Game". And it hardly qualifies as an "Alternate Reality Game", which is defined as "intense player involvement with a story that takes place in real time and evolves according to players' responses". [3] How does this extension affect the evolution of the TV show's plot? If there's not interactivity and feedback, it's Alternative Reality Static Content (aka Alternative Facts), not a game. For what it's worth, we developed a TV show with Current TV called "Bar Karma" [4..7] along with a web site and mobile app, enabling viewers to collaboratively write, discuss and vote on the scripts of each episode. But as far as I can tell, that's not the point of this extension. [1] Fixed Firefox spelling and URL master: https://github.com/mozilla/addon-wr/commit/fdd61682e5b8ef778a5c3e8dd688d1cd28b2a4a6 https://github.com/mozilla/addon-wr/commit/fdd61682e5b8ef778... [2] Not AR: https://news.ycombinator.com/item?id=15936727 https://news.ycombinator.com/item?id=15936727 [3] Alternate reality game: https://en.wikipedia.org/wiki/Alternate_reality_game https://en.wikipedia.org/wiki/Alternate_reality_game [4] Will Wright's Current TV show shooting pilot this week: https://www.engadget.com/2010/08/20/will-wright-current-tv-show-shooting-pilot-this-week/ https://www.engadget.com/2010/08/20/will-wright-current-tv-s... [5] https://en.wikipedia.org/wiki/Bar_Karma https://en.wikipedia.org/wiki/Bar_Karma [6] Bar Karma | Trailer: https://www.youtube.com/watch?v=JIlTVoedDXY https://www.youtube.com/watch?v=JIlTVoedDXY [7] Will Wright Talks Bar Karma: https://www.youtube.com/watch?v=5tsWTb9RHSQ https://www.youtube.com/watch?v=5tsWTb9RHSQ
bjt2n3904 9y ago
So this is coming from the Chief Marketing Officer...!? If this was a marketing/advertising related debacle, then the buck stops with him. Either he approved this (which shows privacy isn't on his list of concerns), or he doesn't know what his marketing department is doing (which doesn't speak volumes about his leadership). Interesting that no other Chief Officer is writing the letter.
- cjbprime 9y ago
  This is also the same person who wrote a defensive non-apology on the evening of the initial publicity, so it seems like they owe us an explanation of why they were wrong then that's missing here.
  - bjt2n3904 9y ago
    He's getting pushed infront of the bus, though I wouldn't be surprised if he wasn't the only officer who knew what was going on.
    - cjbprime 9y ago
      If he was really getting pushed in front of the bus, the apology would be from the CEO (I think it should have been here, for something as serious as a loss of trust) and the CMO wouldn't work there anymore. :)
- int_19h 9y ago
  What really surprised me about all this, is that apparently not a single person involved in shipping the extension had any concerns about that whole "install it for everyone, oh, and it shouldn't show in list of extensions either" (it did, but that was a bug - it wasn't supposed to). It would seem to imply either that there are very few people involved in that decision - which is strange, because, given the privacy and security implications of this kind of stuff, this is exactly the sort of thing where you get formal sign-offs, probably including legal. Or that there were many people, but none of them cared - which doesn't speak well of Mozilla's internal priorities...
hysan 9y ago
I hope this post mortem includes insight into how the bug tracker is being handled. We've now seen with Cliqz and Looking Glass that there are certain members of the Mozilla team that have no qualms with making controversial tickets private and locking/deleting comments in public tickets. That's not a behavior that fosters trust in a community that is in dire need of it.
- Crespyl 9y ago
  There's something to be said for firm moderation in public forums, but there's a point at which it starts to look like evasion and shutting down discourse rather than making forward progress and winning hearts and minds. I hold Mozilla to a very high standard of openness, transparency, user rights, and technical competence; something they've invited (and indeed earned) in the past, and they need (and, I hope, still want) to be called to account when they fall short of that standard.
Sir_Cmpwn 9y ago
This article is not visible from the main page of the blog, or via search: https://blog.mozilla.org/ https://blog.mozilla.org/ Probably a mistake? Probably...
- dumindunuwan 9y ago
  nice catch :D
  - Sir_Cmpwn 9y ago
    Credit for noticing this goes to an IRC friend.
- steveklabnik 9y ago
  I noticed this as well, but it is on the front page of the Firefox blog https://blog.mozilla.org/firefox/ https://blog.mozilla.org/firefox/ I don't know how the blogs work, but it doesn't seem like these two share any posts, so you wouldn't expect it on the main blog.
biocomputation 9y ago
I totally understand that this was not okay, but at least Mozilla apologized and is in the process of making things right. To the best of my knowledge, Mozilla is not a greedy, power-hungry org that serves its own interests first. Every company makes mistakes. Mozilla are really, really, really trying to actually make the web/society a better place, and they deserve support from anyone who actually cares about these things. I get that stuff like this isn't cool, but at least they are responsive. We are as close as we have ever been to a complete corporate takeover of the web, and now is not the time for those of who support Mozilla to turn against them or each other.
wangii 9y ago
what I am not happy with mozilla is the 'internal review'. Firefox is opensourced, Mozilla is non-profit. Although there must be something need be keep in private, I don't think the review process falls into that category. In fact, Mozilla, why don't take the opportunity to make yourself more transparent?
- FireBeyond 9y ago
  Well, that was a complaint about the issue from the start. As soon as the red flags started to get attention on Bugzilla, the "bug" about this was marked "private/internal only".
seanwilson 9y ago
> Instead of giving users the choice to install this add-on, we initially pushed an update to Firefox that installed the “Looking Glass” add-on for English speaking users. This add-on was installed and set to ‘OFF’ and made no changes in the user experience unless it was explicitly turned on by a user, but it was added. Why was this done over asking the user to install the add-on themselves? Given relatively few people were going to use this, why push it to every English speaking user? It's not like enabling an extension or installing one is much different in terms of UX but allowing the former is much more intrusive for everyone not interested in "Looking Glass".
- QAPereo 9y ago
  Do you really need to ask? They did that, because that is what they sold for money to a client. The money made them stupid, short-sighted, and ultimately led to a bad judgement call.
  - mintplant 9y ago
    I really doubt money had much to do with this. It was meant to feature into a broader cross-promotional, privacy-themed campaign between Mr. Robot and Firefox, that exposed the latter to the former's viewing audience.
  - frankacter 9y ago
    Unless you believe they are lying, it specifically states in the blog post: >we developed an unpaid collaboration to engage our users and viewers of the show in a new way
    - a_imho 9y ago
      You are certainly right, that implies money is not directly involved. Assuming no other non-monetary favours (in which case this apology would be pretty disingenuous), I don't think spending resources on a marketing campaign for a TV show the majority of the users do not care about for free is a good and responsible thing to do as a non profit. Not to mention the circumventing the end user part.
Veedrac 9y ago
Imagine you download an update for a video game. In the settings is a new oddly-labeled toggle that, when enabled, changes a few sprites as an homage to a popular celebrity. This button was meant to be hidden by default, but was accidentally shown to 5% of their userbase. The developers later apologised that the wording spooked their customers, some of whom were aware that certain malicious game mods also gave opaque additions to the settings page, and removed the change thereafter. Q: Do you boycott this company?
- CptMauli 9y ago
  The difference is, it is not a video game.
  - zolthrowaway 9y ago
    Exactly. GP is not using an apt comparison. For many people, the primary reason to use Firefox is privacy. They made a massive faux pas against their primary selling point and people are upset. Would you consider switching a product if the main reason you liked a product came into question? I think any rational person would.
    - Paianni 9y ago
      Not really, because there aren't any thoroughly supported, mainstream browsers as clean of spyware features as Firefox.
      - zolthrowaway 9y ago
        It would be easier for me to use Chrome. All of my coworkers use Chrome. Before Quantum, Chrome had better performance [1]. Chrome is everywhere. I have to test my web apps on Chrome regardless of whether it is my primary browser or not. I'm not saying I'm leaving Firefox, but I am going to reevaluate which browser I choose. Mozilla lost a lot of trust from me and I am going to reevaluate how I interact with their products. If supported, mainstream, and clean of spyware are the three boxes you are trying to check and you still feel Firefox checks them, great. But, now is as good of a time as any to reevaluate why you are using a browser and if the browser really meets what you are looking for. [1] https://www.digitaltrends.com/computing/best-browser-internet-explorer-vs-chrome-vs-firefox-vs-safari-vs-edge/2/ https://www.digitaltrends.com/computing/best-browser-interne...
pablo-massa 9y ago
It's hard to forgive. I believe that ethical branding exists, and Mozilla was able to create an emotional relationship with many people, that's why this issue hurts deep for many. When I can't uninstall the Google Plus app from my Nexus 5 I get mad, when Apple put that U2 album on every iPhone I laughed, but this was different, it was disappointing, I feel the same vibes when I do an Ubuntu fresh install and see those Amazon links, but this is even more unexpected, I just can't believe it when I read it, for me, it can be told as a joke on when Mozilla lost his principles, I just can't see it as a silly marketing decision, sorry. For the people who also get emotional, I encourage to think in all the good stuff that Mozilla did, and try to forgive this big conceptual mistake, but don't try to forget about it. Note: My English isn't the best and I'm from my phone.
- mercer 9y ago
  I had this 'relationship' with Mozilla until the Pocket and Cliqz(?) debacles. Either one of these I'd have shrugged off as a misstep, but having done both kind of squandered the goodwill. And now with this too I think the only way to get me 'back' (and probably many others) is not just just some words and promises, but an explanation as to why they keep doing this kind of stuff, and some concrete solutions to keep it from happening (firing one or more higher-ups?). I'm rather skeptical that they will actually 'change their processes', but I really hope they do. While it might seem overblown, I'm even more inclined to stick with Chrome because at least that's a known 'evil', and do any sensitive stuff in Safari. I don't want it to be that way, but it do.
  - CannisterFlux 9y ago
    Have you been reading the Mozilla Glassdoor reviews? https://www.glassdoor.com/Reviews/Mozilla-Reviews-E19129.htm https://www.glassdoor.com/Reviews/Mozilla-Reviews-E19129.htm I'm subscribed to the RSS feed and I think there are clues in the posts over the last couple of years to explain why Mozilla feels so fake nowadays. Here are some choice quotes (FWIW I use Firefox on Desktop and Android pretty much exclusively, I think the product is great but the marketing is terrible): "I have never worked for a company with so many middle managers." "Full of corporate middle managers with not much to do. Expect many meetings with product managers, engineering managers, project managers, strategy managers, with one developer to solve simple problems." "Management is rotten to the core. The company is very top heavy with some 30 executives that travel the world first class to have meetings in lavish places but in the end nothing comes from it." "Cut the corporate bs at the top and empower the people doing actual work to drive where the company goes." "Company vision and mission is feel-good therapy for the upper inner-circle. The company is bleeding talent and the core business is imploding."
ben_jones 9y ago
To regain my confidence mozilla would have to release a real audit log about how this happened. Because to me it looks like some Hollywood executive is close to someone high up at mozilla, and that individual at Mozilla shoved an update straight past QA, something which is unacceptable in such a security critical piece of software. Look I get it, companies make mistakes. Quantum was amazing. A lot of Mozilla work is amazing. But now I know this is something I can expect from Mozilla, and not from Google chrome.
jarym 9y ago
"We took immediate actions to correct this" - no you didn't, you immediately tried to justify it! You made an indefensible mistake and then tried to defend it. Totally inadequate for anyone in a CxO position and the only reasonable response is to step down imo.
- r3bl 9y ago
  How did Mozilla try to defend it?
  - cjbprime 9y ago
    The initial response published by Gizmodo neither apologizes nor says the plugin will be removed: > “Firefox worked with the Mr. Robot team to create a custom experience that would surprise and delight fans of the show and our users. It’s especially important to call out that this collaboration does not compromise our principles or values regarding privacy. The experience does not collect or share any data,” Jascha Kaykas-Wolff, chief marketing officer of Mozilla, said in a statement to Gizmodo. “The experience was kept under wraps to be introduced at the conclusion of the season of Mr. Robot. We gave Mr. Robot fans a unique mystery to solve to deepen their connection and engagement with the show and is only available in Firefox.” This new apology -- from the same person! -- now claims that their values were compromised, but it doesn't say so in a way that acknowledges that they previously felt differently, or explains what caused them to change their mind, which leaves it feeling dishonest.
- btschaegg 9y ago
  Aside from the publicity side, what irks me more about this statement is the "we will change some processes because of this" part. IMO, this is not a process-related problem. The fact that you have a way to install software on my computer without user feedback or the user's consent plus the possibility to hide that installation (read: backdoor) isn't due to a process. It displays a fundamental misunderstanding of what users expect of you. This neatly ties in with the pocket integration, as it basically is the same issue - only then, we knew about it. Edit: Yes, I know, backdoor is a harsh word for something non-targeted, but considering what potentially could happen, a process change doesn't fix this. Also, the moment we have to pick each FF update apart for hidden extensions is the moment FF has lost its reason to exist, as far as I'm concerned.
pasbesoin 9y ago
Screw all your "legacy" extensions, but here's a crap marketing extension for you. You're welcome.
- pasbesoin 9y ago
  I actually want Mozilla to succeed -- to be clear. But there are reasons I use Firefox -- the extensions, as is also the case with many others. And I find a bit of irony in a "worthless" extension being force-fed to us, the month after stable kills off its, well... "stable" of now "legacy" extensions. An as for Mr. Robot, since that's the topic of the extension of in question, I imagine he wants, for his browser, to "have it his way." Security, yeah. But not loss of his ability to filter, "firewall", or even -- gasp -- spoof, what gets sent up and down. Or what his user agent chooses to do with it. So, less "cross-branding", and more API updates and enhancements, please.
dilawar 9y ago
Well, even though their marketing team did break the user trust, I am not moving to other browsers. For simple reason that I owe more to Firefox than to other browsers. I am sticking with Firefox unless they stoop lower than the other competitors. Though I liked the backlash over this. Good to keep Mozilla on toes. I'd rather show tough love to Mozilla than accept 'grim' and move to other browsers.
calimac 9y ago
Firefox has been shit since their founding CEO resigned over political/social view. What makes it worse is the putrid Orwellian stench of Tim Cook's obsession with gay "rights" issues. He should be fired for using Apple as a soap box to promote gay political views as larger than life issues at the risk of alienating consumers and sacrificing apples brand and profit position.
whois 9y ago
What's really the big deal? It was sent out disabled. They didn't get payed for it. It's like if devs snuck in an Easter egg for their favorite show in a video game. Everyone keeps calling this the "end if Mozilla" and all that, I think people are overreacting juuussstttt a bunch. Chill out, put down your pitchforks, and keep the flag disabled.
- cevn 9y ago
  I'm a big a firefox fanboy as the next guy. But they didn't send it out disabled. I never opted into studies but the plugin was enabled on my browser. If mozilla wants to retain users who value privacy, they need to put their money where their mouth is and not sell them out for ARG $$. I'm not the only one, and this apology doesn't admit to that. Therefore it's as good as, if not worse than, no apology. Definitely considering switching back to chrome.
  - wnevets 9y ago
    >but the plugin was enabled on my browser. proof?
  - cpeterso 9y ago
    The installed Looking Glass add-on was enabled, but it didn't do anything unless the user manually set an about:config flag to enable the add-on's functionality.
    - a_imho 9y ago
      Maybe it was harmless, but the browser betrayed user trust.
      - enord 9y ago
        Maybe they did something silly that had no real consequences, but the browser should face consequences.
        9y ago
burnte 9y ago
"We didn’t think hard enough about how our actions would affect the community, and we’re sorry for letting you down." Yes, I know, Mozilla. I've been telling you this for 18 years now, and you still don't listen. I've called annoying, an unfair critic, and an asshole, and yet I've been RIGHT every time. And I've taken the time to tell you this for years because I CARE. That's why I spent years as a bug triager, a teacher to new triagers, a community member, a community news site publisher, and potential employee. And it's why I gave up on you about 3 years ago. Mozilla has always had a tone-deafness about criticism pertaining to it's public perception, and I have absolutely no reason to believe it will change. An idea takes hold, and people who suggest that maybe it might be perceived in a different light are ignored and shut out. Mozilla can't learn from its mistakes, and it's very sad, because they're not mistakes that are costly to avoid.
2g67vupsoknn 9y ago
> Even when turned on no user data was collected or shared. This is disingenuous at best. The extension (when enabled) injects an extra HTTP header into your browser's requests to 3 specific sites[1], (at least) one of which appears to be operated by NBC Universal. Are we really supposed to believe that _all_ of the servers handling these "special" requests were set up without any kind of logging enabled? That NBC Universal wasn't tracking how many times each page was loaded? And from which IP addresses? And when? Mozilla needs to clarify what they meant by "user data" and "collected" here. Seems like they're trying to hide the fact that your data WAS collected -- by a 3rd party, which is perhaps worse. [1] https://github.com/mozilla/addon-wr https://github.com/mozilla/addon-wr
- rpns 9y ago
  It required turning on via an about:config preference, the code on GitHub seems to have changed since then for the separately installed version. If you look into the repo history you can see what it was doing before: https://github.com/mozilla/addon-wr/blob/21ff53d2d5baab591d29b4ea5847d74cb6901b2c/addon/bootstrap.js#L15-L39 https://github.com/mozilla/addon-wr/blob/21ff53d2d5baab591d2...
  - 2g67vupsoknn 9y ago
    Thanks for the additional information. In any case, the claim that "no user data was collected or shared" is suspect. Users who enabled the extension and visited NBC Universal's site (and others) were sending extra HTTP header data to the server, data that identified them as a Firefox user, of a specific version, who had a particular extension installed -- that's how the "engagement" worked. Do you think the server(s) that handled these types of "special" requests were configured to specifically _not_ log the incoming traffic or extra headers? Do you think that NBC Universal would spend the resources to build an elaborate[1] ARG focused on digital "engagement" with fans, form a relationship with Mozilla to promote the show and ARG to Firefox users, but also specifically _not_ collect data about those users? It seems unlikely. [1] https://wiki.gamedetectives.net/index.php?title=Mr._Robot_ARG https://wiki.gamedetectives.net/index.php?title=Mr._Robot_AR...
  - 9y ago
weerd 9y ago
Funny thing about this whole situation... I've never heard of Mr. Robot until now and after reading about it I want to watch it.
deleted 9y ago
[deleted]
1024core 9y ago
This "apology" is written by the CMO. Why is the CMO writing this apology? Why didn't it come from the CEO or the COO, the people actually responsible for shipping the product?
- gridscomputing 9y ago
  BOOM! FATALITY!
- Meph504 9y ago
  Because this whole mess was very likely pushed by the marketing dept. and when things went wrong, and it rolled down hill it landed in their lap.
  - blub 9y ago
    Why does the marketing department have the power to force install things on my computer? What the hell is the technical leadership doing at this company? What the hell is the data protection officer doing? I hope they have one at least.
    - dcminter 9y ago
      For me, Mozilla needed to answer three questions: * Do you know you fucked up? * How did this happen? * What will you do to ensure this doesn't happen again? They've only answered the first one (admittedly with the "right" answer) so I have to assume marketing have the reins and won't be relinquishing them.
lovelearning 9y ago
Why would anybody do something like this that installs unwanted software on millions of devices worldwide just to provide entertainment to a handful of fans of some television show most users, I suspect, haven't even heard about? I have difficulty believing that there was no payment; if there wasn't any payment, what exactly was Mozilla gaining from this?
- elaus 9y ago
  They got screen time on the TV series and apparently some "sponsored by Firefox" metioning in the credits (?). So the whole "unpaid" thing is a bit misleading as they did get something in return (which has direct cash value).
gfodor 9y ago
I fully understand and empathize with the reaction that has happened and now that Mozilla (my employer) has a statement apologizing and committing to a public post-mortem (which I fully support) to the folks who are raising issues with the timing and sequence of events leading up to the response itself since Friday (I won't comment on the incident itself, since that's the job of the post-mortem) I wanted to mention one thing that may help add some human perspective: Mozilla is a distributed organization and was on the last day of its in-person, week-long, bi-yearly all-hands meeting in Austin on Friday when this started. At the time, and through large parts of Saturday, many Mozillians were in last-minute meetings, airports, in the air, or on the road, and were all concluding a week's worth of meetings where everyone was getting face time with collaborators and hashing out in person what we're doing for the next 6 months. I was not involved, but you can imagine that when trying to decide what to do in response to something like this that many people need to coordinate. So it was a bit of a perfect storm of having tired humans, many of whom were in and out of internet access, etc. edit: I fully understand the frustrated replies -- as I mentioned I personally feel that the reaction by the community to what happened was justified -- I wrote this not to comment on what happened (as noted in the post, Mozilla has publicly committed to a post-mortem) but wanted to provide this info about this unfolding when a lot of people were traveling, etc. I was happy and thankful to see this posted today and our rollback of the add-on over the weekend and hope that the follow-ups planned help us learn and move forward in a way that the community supports.
- justinjlynn 9y ago
  From Mr. Robot's own Whiterose: There are no coincidences. Or rather, from my perspective, of course there are coincidences; it's just that I don't trust them. ... and I need to be able to trust my tools.
- notatoad 9y ago
  >you can imagine that when trying to decide what to do in response to something like this that many people need to have their feedback taken into account before any statements are made or actions taken. If only such care was put into deciding whether or not to ship adware in your browser, maybe you guys wouldn't have this problem.
paulie_a 9y ago
I would honestly like to know who thought this was a good idea. Screw the press release of "we"
devit 9y ago
Why is the "Chief Marketing Officer" apologizing? Is he the person in charge of which code gets shipped to Firefox users? If so, that seems rather bad, and it ought to stop. If not, maybe the person in charge (probably the CTO) should be the one apologizing for letting them ship this thing?
- anygregor 9y ago
  Mozilla doesn't have a CTO any more. The SVP of Firefox should have been the decision maker in this case.
rootlocus 9y ago
> We didn’t think hard enough about how our actions would affect the community Which can be interpreted as "we didn't expect you to be such whiny bitches". I was hoping for something along the lines of "this breaks our principle <<Transparent community-based processes promote participation, accountability and trust.>> [1]". But PR seems to be more important than respecting principles. This time it was a disabled marketing addon. Next time it might be something worse. Betraying your core principles is a serious red flag. > Over the course of the year Firefox has enjoyed a growing relationship with the Mr. Robot television show And this is the first time I hear of it. [1] https://www.mozilla.org/en-US/about/manifesto/#principle-08 https://www.mozilla.org/en-US/about/manifesto/#principle-08
Traubenfuchs 9y ago
Mozilla continues its history of adding crap to Firefox that most people don't want, without asking. Anyone remember pocket?
- Paianni 9y ago
  It's their browser, they can do whatever they want.
  - scott_karana 9y ago
    That attitude sure turned out well for Opera.
a_imho 9y ago
It is pretty frustrating that moz://a is better at entrenching Chrome than Google.
zaro 9y ago
> We didn’t think hard enough about how our actions would affect the community, and we’re sorry for letting you down. It's OK Mozilla. Don't be too harsh on yourself. Everybody makes mistakes. We still love you :)
binaryapparatus 9y ago
While unfortunate it is good that this happened. It will help some 'more creative' individuals in marketing feel the boundaries they didn't understand. Comparing FF and Chrome security/privacy wise is ridiculous, I really don't understand that anybody tries to compare those two.
- pmlnr 9y ago
  People were comparing it to Chromium. Chrome and Chromium are not the same.
  - Paianni 9y ago
    Chromium still has more pervasive spyware features than Firefox with all the data collection options enabled.
privacywall 9y ago
I've been following the conversation for the last couple days and I think I may have a solution. I have been working on a program to block telemetry tracking at the OS level. It's called PrivacyWall, and it was originally meant to stop unwanted data collection by Windows 10. I built this to be a solution to block unwanted data collection by companies that sellout their customers to advertisers instead of putting their users first. It is more powerful than an Adblocker because it operates at the OS system and is able to block tracking by Windows programs and the Windows 10 operating system. I just added support to block Firefox tracking with the telemetry urls that Looking Glass is sending data to. I haven't been able to work on it for the last 3 months because I was trapped by the hurricane in Puerto Rico without power, internet, water. It's not ready for prime time, so this is a beta. You can try it here: https://www.privacywall.org https://www.privacywall.org I'm making it available for free for non-commercial use. PrivacyWall blocks a list of known Firefox, Chrome, and Edge telemetry urls and Windows 10 telemetry urls when you turn it on. You can also turn it off easily through the task tray. After you install PrivacyWall, no program on your computer will be able to send data to those urls anymore behind your back. If you try it out and like it or hate it, please send me your feedback. Let me know if there are more urls I should add to the block list. I have limited time to continue supporting this project. If anyone is interested in helping out, let me know.

393 points by runesoerensen 9y ago

I'm glad that Mozilla has responded in this way. My disappointment remains, however. I am one of those not affected at all by the Looking Glass extension but still, my trust is Mozilla (which has been eroding as of late) has suffered greatly. I am giving Mozilla exactly one more chance before uninstalling FF on ever device I have. In the meantime, I will no longer volunteer for ANY data collection. Last chance, Mozilla.

orf 9y ago
But.... why? And what browser on gods earth are you going to switch to that has the same respect for privacy as Firefox (excluding poorly maintained FF forks). It's a blip, one you where not affected by at all and in the scheme of things not major compared to other vendors. But hey, boo mozilla uninstall everything and use lynx/curl!
- cuckcuckspruce 9y ago
  Mozilla as an organization and Firefox displayed their reckless disregard for my privacy. It would be foolish to dismiss it as just a blip. If Mozilla cared about people trusting them with their privacy then they shouldn't have evicerated that trust by installing an extension (even switched off) behind their back. They did this with Looking Glass, they did this with Pocket, and they did this with non-free WebRTC support. Three strikes and you're out!
  - TheDong 9y ago
    None of those violated your privacy by any reasonable definition. Those three things did not provide any additional information about you to any third party (unless you opted in to using pocket). WebRTC did violate your fundamental freedoms as defined by the FSF, but that's not a privacy violation. Please explain how your privacy was actually meaningfully violated.
  - orf 9y ago
    Ok, so are you going to be using Edge or Chrome, and which of those respects your privacy more than Firefox. No organisation is perfect and you have a right to be angry, but you're being a bit extreme IMO. It's much more nuanced than three strikes and you're out, and it's a shame to reduce it to that level.
  - icebraining 9y ago
    What's the non-free WebRTC support? I missed that.
detaro 9y ago
So what are you moving to if they fail your challenge? (I've asked myself this question, and apart from "try something exotic like Qutebrowser, prepared to move back if it doesn't work out" I don't see a better alternative personally)

detaro 9y ago

A bit clearer than the initial empty press statements, but I guess we'll have to wait for the detailed post-mortems and changes to see how far their understanding for the various concerns goes. Not much detail here.

lookingcrass 9y ago

I hate that Mozilla constantly updates FF and everytime it's like a round of russian roulette with regard to installed addons. Mozilla decided it's no longer compatible? BOOM! GONE FOREVER! Oh, you relied on that one? Welp..

j_s 9y ago

I read some other news story on this today. Is there an actual apology yet? And if not, does it matter? In my mind, no apology is better than a 'sorry you were upset' non-apology, but there are apologies that manage to seem genuine as well. As I write this I am reminded of the show 'The Orville's "apology tour"... I don't necessarily think an apology is needed or helpful. Always interested in examples of corporate PR, whether negative, neutral-ish, or positive. Edit: obviously I don't care enough(?) about the specifics of this instance... Hopefully it's also obvious that I appreciate the chance to evaluate the community's response to a favored company. Mozilla seems to be allowed quite a bit of leeway.

r3bl 9y ago
If you actually read the article, I'm pretty sure you'll find the words "we're sorry" in there.
- nnethercote 9y ago
  Twice!
- j_s 9y ago
  Thanks. Do you have time to expand on why this counts as a genuine apology to you (or not?). Interesting to me that all it takes to count as an apology to some is the words 'we're sorry'. I hope to find similar discussion(s) where an HN user practiced his hobby of rewriting corporate apologies. Also nice to have another example where initial response can be completely tone deaf with little consequence.
  - 2g67vupsoknn 9y ago
    You might find this thread[1] of interest. All you have to do is drop the word "sorry", it doesn't matter if the apology actually addressed any of the concerns that were raised. FB was sorry for being "unclear". Mozilla is sorry for "the confusion" and for "letting down members of [the] community". The headlines will read "[Company] apologizes for [event that triggered criticism]" and everyone will carry on as if the apology directly addressed that event. The lawyers and shareholders will breathe a sigh of relief, and the matter will soon be forgotten. [1] https://news.ycombinator.com/item?id=15449954 https://news.ycombinator.com/item?id=15449954

dmitrygr 9y ago

A pretty typical "sorry we got caught" post.

Ded7xSEoPKYNsDd 9y ago
They never tried to hide this - they actually thought they were building some cute easter egg, without thinking about how people would react to a phishy-looking add-on getting installed in their browser without consent or notice.
- dmitrygr 9y ago
  And they still haven't said "we are sorry, this was 100% wrong. we 100% promise to never again do this"
dajt 9y ago
Yeah, that was a pathetic self-justifying post. "Sorry, won't do it again." would have been better. Losing their next bonus would be better still.

j_koreth 9y ago

Still heavily disappointed with Mozilla I this case, especially due to the previous outrage with Pocket.

justinclift 9y ago
> due to the previous outrage with Pocket. Which they still haven't fixed. That's still forced on everyone regardless. :(
- fabrice_d 9y ago
  Mozilla bought Pocket. It would be extremely surprising if they turned their back on shipping it by default. However it's so easy to disable that this is a non issue.
  - justinclift 9y ago
    Maybe a non-issue for you. Less so for others it seems. :)
  - digi_owl 9y ago
    Meaning that someone in management didn't think to reconsider but instead doubled down on the established path. Frankly that ship is out hunting some kind of white whale, and it is best people get out before it is too late.

cddotdotslash 9y ago

The amount of negative press this received nearly cancels out all the positive news from Quantum's release barely a month ago. It's such a shame that the years of hard work and effort on the dev teams are being overshadowed by such a ridiculous marketing mistake. For a browser that is one of the last big proponents of a privacy-centered, user-first web, these kinds of mistakes can't happen... period. Now it's nearly back to the starting line on re-gaining user trust again.

GunlogAlm 9y ago
> The amount of negative press this received nearly cancels out all the positive news from Quantum's release barely a month ago. Which is silly, IMO. What did this addon actually do, besides be installed without user consent? If this article is correct, the addon was installed automatically but was not 'activated'. Seems like a fuss over nothing, to me, but somebody correct me if I have the details wrong.
- DonHopkins 9y ago
  The point is that Mozilla prides themselves on transparency, but the name of the config option was "extensions.pug.lookingglass" -- meaningless buzz words with no reference to Mr. Robot -- and the description was just "MY REALITY IS DIFFERENT THAN YOURS" -- an enigmatic Alice in Wonderland quote. It's actively trying to be opaque. That's the opposite of transparency. Curious adventurous people install the test build because they want to try out new features and extensions. Those are the users who are most likely to know about and use "about:config". The config option and description of the plugin are mysterious and enigmatic, which tempts your curiosity into turning it on to see what it does, because you presumably trust that Mozilla wouldn't distribute just any old extension that didn't have a purpose other than scanning and modifying the content of every web page, inserting dynamic content adjacent to keywords, and advertising a TV show.
  - Yoric 9y ago
    To be fair, this was part of a hint in a scavenger hunt, so being opaque is pretty much required in that context. Did it actually display an ad? I didn't see anything such on my Firefox.

martin_andrino 9y ago

I just hope this makes the outraged people quiet for a while. This is a clear apology and Mozilla seems to have learned the lesson. Let’s now show some love and support for this powerful open-source organization.

whalesalad 9y ago
Ok, Mozilla Employee with the fresh account.
- dang 9y ago
  This breaks the HN guideline against accusing other users. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and don't do this again.
cuckcuckspruce 9y ago
Apology does not mean instant forgiveness nor does it mean do-over. It's a sad day when I now have more trust in Apple and Safari than I do in Mozilla and Firefox.
- tiles 9y ago
  Not to say you should doubt the Safari team, but I remember the auto-push of U2 albums to users without an opt-in being comically similar.
  - i_s 9y ago
    Pushing unwanted sound files and pushing unwanted executable code are two very different things.
    - digi_owl 9y ago
      In the end they are both symptoms of a tone deaf management that think that their world view is the majority world view...

rebelwebmaster 9y ago

I wonder if "process changes" include actually enforcing the already-existing rules around Shield deployments that were outlined on their wiki.

SethKinast 9y ago
I don't really plan on giving them a chance; I went to about:preferences#privacy and removed the permission.

chrisseaton 9y ago

> Over the course of the year Firefox has enjoyed a growing relationship with the Mr. Robot television show This line is just absolutely crazy by itself when you think about it. Why does a browser team have any kind of relationship at all with some TV show? What is going on?

suby 9y ago
Did Firefox perhaps get screen time in Mr. Robot?
- jacquesm 9y ago
  Who cares if it did?
  - suby 9y ago
    It's just bizarre, is all. Especially considering that they claim they did not get paid for Looking Glass.
    - detaro 9y ago
      I assume the idea of the ARG was that it promotes Firefox to viewers of the show as much as the other way around.
      - weaksauce 9y ago
        it promotes firefox to viewers of the show about online privacy... the viewers are probably more receptive than most to changing over to a more privacy oriented browser.
- knaik94 9y ago
  Firefox ads run a lot during the show. And before the show, they have a mini blurb saying "this week sponsored by firefox"

SamReidHughes 9y ago

This was an inactive extension that didn't do anything unless you activated it, right?

detaro 9y ago
Yes. (well, technically it started and checked if it is turned on before not starting the part that would have done everything else)
ovao 9y ago
Correct.
cuckcuckspruce 9y ago
Assuming that they don't have or can't patch in the ability to push extensions hidden and already activated would be naive at this point.
- detaro 9y ago
  It's documented that Shield studies can be run without prompt for the individual study, no need to assume otherwise. People primarily worried about their privacy should have been worried about the study feature in cases where they'd actually run studies collecting data, not here.
dsl 9y ago
Pushed out silently as part of a mechanism designed to beta-test new browser features. Per their own documentation the extension is supposed to target 1-2% of the install base and pop up asking permission to continue. This is basically Microsoft using Windows Update to install a desktop icon promoting the latest season of The Voice. https://wiki.mozilla.org/Firefox/Shield/Shield_Studies https://wiki.mozilla.org/Firefox/Shield/Shield_Studies
- Veedrac 9y ago
  > This is basically Microsoft using Windows Update to install a desktop icon promoting the latest season of The Voice. Mozilla have said that this test was meant to be invisible, so whilst this is an accurate analogy of the end result, it's also an accidental one.

chrismartin 9y ago

We really need a fork of Firefox with all the garbage removed, including the ability for Mozilla's marketroids to push things at us remotely. (Also "telemetry", DRM, Pocket, spam on the new tab page, etc.) A browser should just be a tool which answers to the user. I want my browser to be like a pair of pliers or a bicycle, neither of which have relationships with television shows. I think Iceweasel was essentially this, until the Debian project abandoned the effort.

jimktrains2 9y ago
Don't iceweasle and friends do that?
TheDong 9y ago
> removed .. telemetry We want our browsers to work. Without telemetry, they simply won't be able to find and solve bugs and crashes effectively. Without crash reporting and other basic telemetry, it's basically impossible to know how prevalent certain bugs and configurations... which is of the utmost important for making a browser which actually works.
- chrismartin 9y ago
  > Without telemetry, they simply won't be able to find and solve bugs and crashes effectively. Users can be prompted to report bugs with some facility to provide telemetry (e.g. after a crash), but the browser must ask permission first. On-by-default telemetry is tantamount to malware exfiltrating information about your computing activity to a third party.
  - pcwalton 9y ago
    > e.g. after a crash Not "e.g. after a crash", "only after a crash". That's about the only kind of telemetry you can get on a "prompt on each occurrence" basis like that. Just monitoring crashes is not nearly enough to create a competitive browser. Performance bugs, many of which are specific to older systems mostly used by people who can't be expected to file bugs in Bugzilla, cannot be reliably caught without some kind of telemetry.

chris_wot 9y ago

And what about the non-transparent bug? https://bugzilla.mozilla.org/show_bug.cgi?id=1423003 https://bugzilla.mozilla.org/show_bug.cgi?id=1423003 And no updates on the public bug, and it was summarily closed: https://bugzilla.mozilla.org/show_bug.cgi?id=1424977 https://bugzilla.mozilla.org/show_bug.cgi?id=1424977 That hardly inspires confidence on transparency.

zbraniecki 9y ago
I don't have access to the private bug myself, but I can try to reason about it. I believe that at this point, opening up this bug would do exclusively harm and no good to anyone. There's nothing I can imagine in the bug to be of value to our understanding of the situation. If the people working on it were oblivious to what they are doing, then it would just look plain stupid from hindsight 20/20. If the people working on it were aware and hoped that no one will raise a fuss, then it'll look even worse for them. The important fact is that Mozilla reacted, and that the leadership does have access to this bug. Whoever was involved is probably currently involved in debriefing what has happened there and that bug is part of it. I hope it'll be open at some point, but I'd hate if access to the bug resulted in a witch hunt and public shaming of that person/people which, as we all know, the Internet is great at. We know that our leadership reacted and we know that they recognize what has happened. I'm not asking you to trust them, obviously that has to be regained and the process is painfully slow, but I do ask you to give them time. The emotional reaction is short-termed. I hope that this incident will have a long term positive consequences to our project.
- chris_wot 9y ago
  Of course, a witch hunt does no good to anyone and to my mind, it's a mistake (albeit a bad one). My issue is that the public bug was closed off early. In future, perhaps the Mozilla team might take it into account that communication might be smoother if they keep things more transparent. I'm a massive fan of Mozilla. In fact, I'm trying to get more folks in my org to use it instead of Chrome (it's a hell of a lot more stable, and the Chrome team tends to break our web apps frequently). I largely trust Mozilla far more than the Google team, and this unfortunate episode, for me at least, just made me mad because it was such a major cock-up that it was entirely unexpected.

cjsuk 9y ago

"We didn't think hard enough" is the 2017 version of "we thought we could get away with it"

reustle 9y ago
You're right, but it started a few years ago. At least.

guelo 9y ago

Jascha Kaykas-Wolff should be fired. Marketing shouldn't be allowed to modify the shipping bits at all, even if the Chief Marketing Officer tells them to. Any and all product changes should go through engineering and tracked in bugzilla. The CMO can file a ticket in the open just like anybody else can.

dang 9y ago
This counts as a personal attack. Those aren't ok on HN and we ban accounts that do it, so please don't do it again. You may not owe better to whoever installed an extension in your browser but you do owe better to this community, if you want to comment here. I'd appreciate it if you'd (re-)read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and take the spirit of this site more to heart. Also https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html. p.s. Your comment without the first sentence would be fine.
persona_reuse 9y ago
To me, the sad part is (based on what little you can find in public bugs) the Shield team seemed to be engaged in this, and didn't raise a flag that their platform of experiments was being co-opted to push out a game. There's all the talk that Mozilla violated peoples privacy, and they're not wrong, but the larger loss, I think, is all the technical people who will turn off Shield and never come back to using it.

djanogo 9y ago

Why does Mozilla have a relationship with a television show?, does the show promote Firefox?. "..Firefox has enjoyed a growing relationship with the Mr. Robot television show.."

geraltofrivia 9y ago
One gotsta make them dollars, right? I am not aware of their financial status but I'm fairly certain that Quantum development would have burnt a substantial hole in their Pocket.
detaro 9y ago
> does the show promote Firefox? That seems to have been the point of running an ARG tying Firefox to the show. Get viewers to use Firefox to "play".
ufo 9y ago
Mozilla advertises Firefox in that tv show, both through product placement and actual ads.

tomc1985 9y ago

They should have given the same treatment to Pocket and Hello: optional, manifests as an add-on, and possibly off-by-default for certain kinds of users. Instead we get value-adds baked directly into the broswer itself. I HATE this new age of corporate-oriented thinking, especially from a company that claims to reject those values. I suppose Looking Glass is progress....

pkamb 9y ago

> unpaid collaboration Even worse if this wasn't a google-like revenue deal.

ufo 9y ago
Mr Robot advertises Firefox in the TV show. It is unclear if Mozilla is paying them or if this is an unpaid thing in both directions.

Sohcahtoa82 9y ago

I just wanna know what kind of idiot thought this was a good idea from the beginning. I mean, I'm just a cybersecurity guy and a software engineer. I'm no PR person. But it doesn't take a PR expert to know that the world would eventually find out about an addon getting installed without permission and it would be a disaster.

detaro 9y ago
My guess would be that a PR person did not think about the aspects that went wrong and was more enthusiastic about having a clean way of delivering this. Not much to do, it just appears, no need to tell people how to install an add-on, no issue since it doesn't do anything to people that don't turn it on. Privacy check passes, since it doesn't do anything that impacts privacy. (Which the first press responses focused on pointing out). Since it's supposed to be stealth (it's an ARG), only a small group is involved, hyped about bulding this cool thing. Totally could have happened that way, totally missed something crucial at every single step that came back to bite them.
itronitron 9y ago
If they rename 'addon' to 'ad-on' that might help Mozilla manage user expectations.
- scrollaway 9y ago
  What are you talking about?
  - itronitron 9y ago
    I'm talking about Mozilla using the Firefox 'addon' extensions mechanism to support an ad campaign, hence renaming the extension mechanism to 'ad-on' might make it more clear to users what Mozilla is using it for.
    - scrollaway 9y ago
      Ads usually have a financial exchange to them. And this didn't use the add-on system, it inappropriately used the studies system.

zakk 9y ago

I don't think this is the full story. They claim the add-on was disabled by default, and needed to be manually activated. Note that the description of the Looking Glass addon was "MY REALITY IS JUST DIFFERENT THAN YOURS." Note also that I have never activated such add-on. Now, If I go to about:studies (for those not familiar with SHIELD studies https://support.mozilla.org/en-US/kb/shield https://support.mozilla.org/en-US/kb/shield) I see the following 'study': pug-experience Complete • My reality is different than yours So, there was a Mozilla study, with almost the shame shady description, which DID run by default, at least for some users. Are the Looking Glass add-on and this SHIELD study completely unrelated? Why do they share the same description? Why is Mozilla using these shady descriptions in the first place? Probably I am just being paranoid, but Mozilla has done nothing to gain my trust, lately.

detaro 9y ago
From what I understand, the add-on wrapper checks for a preference immediately on startup and only loads the WebExtension doing anything if it is set manually. It's enabled in the sense that the wrapper loads and shuts down again, it's disabled in the sense that none of its functionality actually runs.
Manishearth 9y ago
> Are the Looking Glass add-on and this SHIELD study completely unrelated? The addon is the shield study. Shield is the mechanism for deploying addons (usually A/B tests) to release populations. What was enabled was a small piece of code[1] that would enable the full addon when a pref was flipped. [1]: https://github.com/mozilla/addon-wr/blob/master/addon/bootstrap.js#L20-L41 https://github.com/mozilla/addon-wr/blob/master/addon/bootst...

Gatsky 9y ago

The outrage to significance ratio is off the charts on this one.

jacquesm 9y ago
The fuck it is. Mozilla, champion of the free web goes corporate, the first action after their force-fed update ('for your own good') is to start pushing this sort of thing? Significance of trial balloons should not be underestimated.
- Gatsky 9y ago
  I see your point. But large tech organisations commit these faux pas/atrocities (depending on your point of view) all the time, regardless of their relationship with profit. I think the reason they happen at all and the shrill tenor of the associated backlash come from the same place though - a kind of echo chamber insularity.
  - jacquesm 9y ago
    For me the motivator is the fact that they cost me a couple of hours in lost time due to their botched upgrade. This last episode is just icing on the cake and illustrates how completely out of touch Mozilla is with the users that make up their core. It's roughly on par with Apple pissing all over the designers and animators and movie makers that were their lifeblood in the pre-Ipod days. Only in Mozilla's case they don't have an Ipod.
  - blub 9y ago
    Well, if the US had privacy laws with teeth, said organisations would learn quite fast not to commit such "mistakes". As such, all it takes apparently is a corporate drone to push hard enough and poof go the customer rights. Food for thought regarding your outrage comment: one does not protect their rights by bending over every time they are taken advantage of.
  - Crespyl 9y ago
    I hold Mozilla to a much higher standard than other large tech organizations. This particular incident shows either massive process failure (allowing marketing to auto-deploy code without sufficient review), or that no one in the review process recognized the issues with using development and debugging tools to push marketing software. Either version is (yet another) blow to the trust I want to have in an organization that I still care very deeply about.

jacquesm 9y ago

What really bugs me is that I had a perfectly good Firefox until a few scant weeks ago when Mozilla decided to force-feed me an upgrade to new browser tech that I didn't ask for, screwed me six different ways at once in the middle of a project where I fairly critically depended on an extension that suddenly stopped working that had just about half the notes of a project in it and then, to add insult to injury push their own add-ons down my throat that I didn't ask for. For someone who has stood by Mozilla over the last decade or so and who never switched to Chrome you can't begin to imagine how pissed off I am. User trust is earned bit-by-bit, you can lose it all in a day. Ask Lenovo how that sort of thing works.

eganist 9y ago
> Mozilla decided to force-feed me an upgrade to new browser tech that I didn't ask for https://www.mozilla.org/en-US/firefox/organizations/ https://www.mozilla.org/en-US/firefox/organizations/ That's one thing the Firefox ESR is designed to mitigate. If sequential automatic upgrades weren't quite up your alley, this might have been the right solution for you at the time.
- jacquesm 9y ago
  Which I had installed, which happily upgraded to FF 57. (I still don't get how that happened the first time, it could have been Ubuntu doing the upgrade, it could have been FF itself but I don't have time to dig this out and I'm not even sure if it is something I'll be able to prove one way or the other.) I've gone so far now as to drop any mozilla.org domains through DNS hacks to make sure this never ever happens again, because after I downgraded it the first time it happily immediately updated back to 57 in spite of having all auto-update settings switched to off. Back to 52.5 it is for me. No more tricks like that. Which is sad because if there is a critical security vulnerability in this browser I'm likely not going to notice immediately.
  - yoklov 9y ago
    ESR versions get security updates.

suby 9y ago

I'm happy to see an apology, but there are further steps they could take. I just did a clean install of Firefox and unless I somehow messed that up, it looks like user studies are enabled by default. Someone correct me if I'm wrong here, as I didn't expect that to be the case. They should absolutely not be running any sort of user studies on people who may not be aware it is being done, which is going to be the case with the current setup. The only way it sits right in my mind is if user studies are opt-in instead of opt out. This is especially ridiculous as their marketing is focused on respecting privacy. An apology is nice, but changing this setting would go a long way towards proving that.

detaro 9y ago
I believe that is a strong part of the current outrage: people did not realize that this existed and was turned on. Since actual studies would collect actual user data (unlike this now), the fact that it surprises people suggests that they did not obtain meaningful consent for their data collection. At least from a quick search, I could not find good documentation what studies do exactly to avoid or properly handle personal data, it's possible that they do a very good job of that. (Suggestion to Mozilla: talk about these details at least after the study is done, show what you found. Hopefully: More tech-content to publish, less questions, less ugly surprises)
tosssh 9y ago
Shield Studies are opt-out by default https://github.com/mozilla/normandy/issues/741 https://github.com/mozilla/normandy/issues/741 https://bugzilla.mozilla.org/show_bug.cgi?id=1370801 https://bugzilla.mozilla.org/show_bug.cgi?id=1370801 https://bugzilla.mozilla.org/show_bug.cgi?id=1370799 https://bugzilla.mozilla.org/show_bug.cgi?id=1370799

danso 9y ago

As a huge Mr. Robot fan, but one who realizes how niche the show is (the ratings have substantially dropped year after year), I’m embarrassed that Mozilla sullied its reputation for such a small promo — at least U2 was a huge band most people have heard of when Apple pushed their music onto users. The controversy makes Mr. Robot look pretty bad too, even though AFAIK, Firefox (unlike Amazon’s Echo) never was prominently mentioned on the show.

DonHopkins 9y ago

Fixed Firefox spelling and URL master (#43) @gregglind gregglind committed 4 days ago: + "description": "MY REALITY IS JUST DIFFERENT THAN YOURS.\n\nLooking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience. Are you a fan of Mr. Robot? If so, join the hunt for answers!\n\nParticipating in this shared world experience requires explicit user opt in. If you are not actively participating in the ARG (Augmented Reality Game) no modifications will be made to Firefox.\n\nhttps://support.mozilla.org/kb/lookingglass" https://support.mozilla.org/kb/lookingglass", Sigh. Again [2], it's definitely not an "Augmented Reality Game". And it hardly qualifies as an "Alternate Reality Game", which is defined as "intense player involvement with a story that takes place in real time and evolves according to players' responses". [3] How does this extension affect the evolution of the TV show's plot? If there's not interactivity and feedback, it's Alternative Reality Static Content (aka Alternative Facts), not a game. For what it's worth, we developed a TV show with Current TV called "Bar Karma" [4..7] along with a web site and mobile app, enabling viewers to collaboratively write, discuss and vote on the scripts of each episode. But as far as I can tell, that's not the point of this extension. [1] Fixed Firefox spelling and URL master: https://github.com/mozilla/addon-wr/commit/fdd61682e5b8ef778a5c3e8dd688d1cd28b2a4a6 https://github.com/mozilla/addon-wr/commit/fdd61682e5b8ef778... [2] Not AR: https://news.ycombinator.com/item?id=15936727 https://news.ycombinator.com/item?id=15936727 [3] Alternate reality game: https://en.wikipedia.org/wiki/Alternate_reality_game https://en.wikipedia.org/wiki/Alternate_reality_game [4] Will Wright's Current TV show shooting pilot this week: https://www.engadget.com/2010/08/20/will-wright-current-tv-show-shooting-pilot-this-week/ https://www.engadget.com/2010/08/20/will-wright-current-tv-s... [5] https://en.wikipedia.org/wiki/Bar_Karma https://en.wikipedia.org/wiki/Bar_Karma [6] Bar Karma | Trailer: https://www.youtube.com/watch?v=JIlTVoedDXY https://www.youtube.com/watch?v=JIlTVoedDXY [7] Will Wright Talks Bar Karma: https://www.youtube.com/watch?v=5tsWTb9RHSQ https://www.youtube.com/watch?v=5tsWTb9RHSQ

bjt2n3904 9y ago

So this is coming from the Chief Marketing Officer...!? If this was a marketing/advertising related debacle, then the buck stops with him. Either he approved this (which shows privacy isn't on his list of concerns), or he doesn't know what his marketing department is doing (which doesn't speak volumes about his leadership). Interesting that no other Chief Officer is writing the letter.

cjbprime 9y ago
This is also the same person who wrote a defensive non-apology on the evening of the initial publicity, so it seems like they owe us an explanation of why they were wrong then that's missing here.
- bjt2n3904 9y ago
  He's getting pushed infront of the bus, though I wouldn't be surprised if he wasn't the only officer who knew what was going on.
  - cjbprime 9y ago
    If he was really getting pushed in front of the bus, the apology would be from the CEO (I think it should have been here, for something as serious as a loss of trust) and the CMO wouldn't work there anymore. :)
int_19h 9y ago
What really surprised me about all this, is that apparently not a single person involved in shipping the extension had any concerns about that whole "install it for everyone, oh, and it shouldn't show in list of extensions either" (it did, but that was a bug - it wasn't supposed to). It would seem to imply either that there are very few people involved in that decision - which is strange, because, given the privacy and security implications of this kind of stuff, this is exactly the sort of thing where you get formal sign-offs, probably including legal. Or that there were many people, but none of them cared - which doesn't speak well of Mozilla's internal priorities...

hysan 9y ago

I hope this post mortem includes insight into how the bug tracker is being handled. We've now seen with Cliqz and Looking Glass that there are certain members of the Mozilla team that have no qualms with making controversial tickets private and locking/deleting comments in public tickets. That's not a behavior that fosters trust in a community that is in dire need of it.

Crespyl 9y ago
There's something to be said for firm moderation in public forums, but there's a point at which it starts to look like evasion and shutting down discourse rather than making forward progress and winning hearts and minds. I hold Mozilla to a very high standard of openness, transparency, user rights, and technical competence; something they've invited (and indeed earned) in the past, and they need (and, I hope, still want) to be called to account when they fall short of that standard.

Sir_Cmpwn 9y ago

This article is not visible from the main page of the blog, or via search: https://blog.mozilla.org/ https://blog.mozilla.org/ Probably a mistake? Probably...

dumindunuwan 9y ago
nice catch :D
- Sir_Cmpwn 9y ago
  Credit for noticing this goes to an IRC friend.
steveklabnik 9y ago
I noticed this as well, but it is on the front page of the Firefox blog https://blog.mozilla.org/firefox/ https://blog.mozilla.org/firefox/ I don't know how the blogs work, but it doesn't seem like these two share any posts, so you wouldn't expect it on the main blog.

biocomputation 9y ago

I totally understand that this was not okay, but at least Mozilla apologized and is in the process of making things right. To the best of my knowledge, Mozilla is not a greedy, power-hungry org that serves its own interests first. Every company makes mistakes. Mozilla are really, really, really trying to actually make the web/society a better place, and they deserve support from anyone who actually cares about these things. I get that stuff like this isn't cool, but at least they are responsive. We are as close as we have ever been to a complete corporate takeover of the web, and now is not the time for those of who support Mozilla to turn against them or each other.

wangii 9y ago

what I am not happy with mozilla is the 'internal review'. Firefox is opensourced, Mozilla is non-profit. Although there must be something need be keep in private, I don't think the review process falls into that category. In fact, Mozilla, why don't take the opportunity to make yourself more transparent?

FireBeyond 9y ago
Well, that was a complaint about the issue from the start. As soon as the red flags started to get attention on Bugzilla, the "bug" about this was marked "private/internal only".

seanwilson 9y ago

> Instead of giving users the choice to install this add-on, we initially pushed an update to Firefox that installed the “Looking Glass” add-on for English speaking users. This add-on was installed and set to ‘OFF’ and made no changes in the user experience unless it was explicitly turned on by a user, but it was added. Why was this done over asking the user to install the add-on themselves? Given relatively few people were going to use this, why push it to every English speaking user? It's not like enabling an extension or installing one is much different in terms of UX but allowing the former is much more intrusive for everyone not interested in "Looking Glass".

QAPereo 9y ago
Do you really need to ask? They did that, because that is what they sold for money to a client. The money made them stupid, short-sighted, and ultimately led to a bad judgement call.
- mintplant 9y ago
  I really doubt money had much to do with this. It was meant to feature into a broader cross-promotional, privacy-themed campaign between Mr. Robot and Firefox, that exposed the latter to the former's viewing audience.
- frankacter 9y ago
  Unless you believe they are lying, it specifically states in the blog post: >we developed an unpaid collaboration to engage our users and viewers of the show in a new way
  - a_imho 9y ago
    You are certainly right, that implies money is not directly involved. Assuming no other non-monetary favours (in which case this apology would be pretty disingenuous), I don't think spending resources on a marketing campaign for a TV show the majority of the users do not care about for free is a good and responsible thing to do as a non profit. Not to mention the circumventing the end user part.

Veedrac 9y ago

Imagine you download an update for a video game. In the settings is a new oddly-labeled toggle that, when enabled, changes a few sprites as an homage to a popular celebrity. This button was meant to be hidden by default, but was accidentally shown to 5% of their userbase. The developers later apologised that the wording spooked their customers, some of whom were aware that certain malicious game mods also gave opaque additions to the settings page, and removed the change thereafter. Q: Do you boycott this company?

CptMauli 9y ago
The difference is, it is not a video game.
- zolthrowaway 9y ago
  Exactly. GP is not using an apt comparison. For many people, the primary reason to use Firefox is privacy. They made a massive faux pas against their primary selling point and people are upset. Would you consider switching a product if the main reason you liked a product came into question? I think any rational person would.
  - Paianni 9y ago
    Not really, because there aren't any thoroughly supported, mainstream browsers as clean of spyware features as Firefox.
    - zolthrowaway 9y ago
      It would be easier for me to use Chrome. All of my coworkers use Chrome. Before Quantum, Chrome had better performance [1]. Chrome is everywhere. I have to test my web apps on Chrome regardless of whether it is my primary browser or not. I'm not saying I'm leaving Firefox, but I am going to reevaluate which browser I choose. Mozilla lost a lot of trust from me and I am going to reevaluate how I interact with their products. If supported, mainstream, and clean of spyware are the three boxes you are trying to check and you still feel Firefox checks them, great. But, now is as good of a time as any to reevaluate why you are using a browser and if the browser really meets what you are looking for. [1] https://www.digitaltrends.com/computing/best-browser-internet-explorer-vs-chrome-vs-firefox-vs-safari-vs-edge/2/ https://www.digitaltrends.com/computing/best-browser-interne...

pablo-massa 9y ago

It's hard to forgive. I believe that ethical branding exists, and Mozilla was able to create an emotional relationship with many people, that's why this issue hurts deep for many. When I can't uninstall the Google Plus app from my Nexus 5 I get mad, when Apple put that U2 album on every iPhone I laughed, but this was different, it was disappointing, I feel the same vibes when I do an Ubuntu fresh install and see those Amazon links, but this is even more unexpected, I just can't believe it when I read it, for me, it can be told as a joke on when Mozilla lost his principles, I just can't see it as a silly marketing decision, sorry. For the people who also get emotional, I encourage to think in all the good stuff that Mozilla did, and try to forgive this big conceptual mistake, but don't try to forget about it. Note: My English isn't the best and I'm from my phone.

mercer 9y ago
I had this 'relationship' with Mozilla until the Pocket and Cliqz(?) debacles. Either one of these I'd have shrugged off as a misstep, but having done both kind of squandered the goodwill. And now with this too I think the only way to get me 'back' (and probably many others) is not just just some words and promises, but an explanation as to why they keep doing this kind of stuff, and some concrete solutions to keep it from happening (firing one or more higher-ups?). I'm rather skeptical that they will actually 'change their processes', but I really hope they do. While it might seem overblown, I'm even more inclined to stick with Chrome because at least that's a known 'evil', and do any sensitive stuff in Safari. I don't want it to be that way, but it do.
- CannisterFlux 9y ago
  Have you been reading the Mozilla Glassdoor reviews? https://www.glassdoor.com/Reviews/Mozilla-Reviews-E19129.htm https://www.glassdoor.com/Reviews/Mozilla-Reviews-E19129.htm I'm subscribed to the RSS feed and I think there are clues in the posts over the last couple of years to explain why Mozilla feels so fake nowadays. Here are some choice quotes (FWIW I use Firefox on Desktop and Android pretty much exclusively, I think the product is great but the marketing is terrible): "I have never worked for a company with so many middle managers." "Full of corporate middle managers with not much to do. Expect many meetings with product managers, engineering managers, project managers, strategy managers, with one developer to solve simple problems." "Management is rotten to the core. The company is very top heavy with some 30 executives that travel the world first class to have meetings in lavish places but in the end nothing comes from it." "Cut the corporate bs at the top and empower the people doing actual work to drive where the company goes." "Company vision and mission is feel-good therapy for the upper inner-circle. The company is bleeding talent and the core business is imploding."

ben_jones 9y ago

To regain my confidence mozilla would have to release a real audit log about how this happened. Because to me it looks like some Hollywood executive is close to someone high up at mozilla, and that individual at Mozilla shoved an update straight past QA, something which is unacceptable in such a security critical piece of software. Look I get it, companies make mistakes. Quantum was amazing. A lot of Mozilla work is amazing. But now I know this is something I can expect from Mozilla, and not from Google chrome.

jarym 9y ago

"We took immediate actions to correct this" - no you didn't, you immediately tried to justify it! You made an indefensible mistake and then tried to defend it. Totally inadequate for anyone in a CxO position and the only reasonable response is to step down imo.

r3bl 9y ago
How did Mozilla try to defend it?
- cjbprime 9y ago
  The initial response published by Gizmodo neither apologizes nor says the plugin will be removed: > “Firefox worked with the Mr. Robot team to create a custom experience that would surprise and delight fans of the show and our users. It’s especially important to call out that this collaboration does not compromise our principles or values regarding privacy. The experience does not collect or share any data,” Jascha Kaykas-Wolff, chief marketing officer of Mozilla, said in a statement to Gizmodo. “The experience was kept under wraps to be introduced at the conclusion of the season of Mr. Robot. We gave Mr. Robot fans a unique mystery to solve to deepen their connection and engagement with the show and is only available in Firefox.” This new apology -- from the same person! -- now claims that their values were compromised, but it doesn't say so in a way that acknowledges that they previously felt differently, or explains what caused them to change their mind, which leaves it feeling dishonest.
btschaegg 9y ago
Aside from the publicity side, what irks me more about this statement is the "we will change some processes because of this" part. IMO, this is not a process-related problem. The fact that you have a way to install software on my computer without user feedback or the user's consent plus the possibility to hide that installation (read: backdoor) isn't due to a process. It displays a fundamental misunderstanding of what users expect of you. This neatly ties in with the pocket integration, as it basically is the same issue - only then, we knew about it. Edit: Yes, I know, backdoor is a harsh word for something non-targeted, but considering what potentially could happen, a process change doesn't fix this. Also, the moment we have to pick each FF update apart for hidden extensions is the moment FF has lost its reason to exist, as far as I'm concerned.

pasbesoin 9y ago

Screw all your "legacy" extensions, but here's a crap marketing extension for you. You're welcome.

pasbesoin 9y ago
I actually want Mozilla to succeed -- to be clear. But there are reasons I use Firefox -- the extensions, as is also the case with many others. And I find a bit of irony in a "worthless" extension being force-fed to us, the month after stable kills off its, well... "stable" of now "legacy" extensions. An as for Mr. Robot, since that's the topic of the extension of in question, I imagine he wants, for his browser, to "have it his way." Security, yeah. But not loss of his ability to filter, "firewall", or even -- gasp -- spoof, what gets sent up and down. Or what his user agent chooses to do with it. So, less "cross-branding", and more API updates and enhancements, please.

dilawar 9y ago

Well, even though their marketing team did break the user trust, I am not moving to other browsers. For simple reason that I owe more to Firefox than to other browsers. I am sticking with Firefox unless they stoop lower than the other competitors. Though I liked the backlash over this. Good to keep Mozilla on toes. I'd rather show tough love to Mozilla than accept 'grim' and move to other browsers.

calimac 9y ago

Firefox has been shit since their founding CEO resigned over political/social view. What makes it worse is the putrid Orwellian stench of Tim Cook's obsession with gay "rights" issues. He should be fired for using Apple as a soap box to promote gay political views as larger than life issues at the risk of alienating consumers and sacrificing apples brand and profit position.

whois 9y ago

What's really the big deal? It was sent out disabled. They didn't get payed for it. It's like if devs snuck in an Easter egg for their favorite show in a video game. Everyone keeps calling this the "end if Mozilla" and all that, I think people are overreacting juuussstttt a bunch. Chill out, put down your pitchforks, and keep the flag disabled.

cevn 9y ago
I'm a big a firefox fanboy as the next guy. But they didn't send it out disabled. I never opted into studies but the plugin was enabled on my browser. If mozilla wants to retain users who value privacy, they need to put their money where their mouth is and not sell them out for ARG $$. I'm not the only one, and this apology doesn't admit to that. Therefore it's as good as, if not worse than, no apology. Definitely considering switching back to chrome.
- wnevets 9y ago
  >but the plugin was enabled on my browser. proof?
- cpeterso 9y ago
  The installed Looking Glass add-on was enabled, but it didn't do anything unless the user manually set an about:config flag to enable the add-on's functionality.
  - a_imho 9y ago
    Maybe it was harmless, but the browser betrayed user trust.
    - enord 9y ago
      Maybe they did something silly that had no real consequences, but the browser should face consequences.
      - 9y ago

burnte 9y ago

"We didn’t think hard enough about how our actions would affect the community, and we’re sorry for letting you down." Yes, I know, Mozilla. I've been telling you this for 18 years now, and you still don't listen. I've called annoying, an unfair critic, and an asshole, and yet I've been RIGHT every time. And I've taken the time to tell you this for years because I CARE. That's why I spent years as a bug triager, a teacher to new triagers, a community member, a community news site publisher, and potential employee. And it's why I gave up on you about 3 years ago. Mozilla has always had a tone-deafness about criticism pertaining to it's public perception, and I have absolutely no reason to believe it will change. An idea takes hold, and people who suggest that maybe it might be perceived in a different light are ignored and shut out. Mozilla can't learn from its mistakes, and it's very sad, because they're not mistakes that are costly to avoid.

2g67vupsoknn 9y ago

> Even when turned on no user data was collected or shared. This is disingenuous at best. The extension (when enabled) injects an extra HTTP header into your browser's requests to 3 specific sites[1], (at least) one of which appears to be operated by NBC Universal. Are we really supposed to believe that _all_ of the servers handling these "special" requests were set up without any kind of logging enabled? That NBC Universal wasn't tracking how many times each page was loaded? And from which IP addresses? And when? Mozilla needs to clarify what they meant by "user data" and "collected" here. Seems like they're trying to hide the fact that your data WAS collected -- by a 3rd party, which is perhaps worse. [1] https://github.com/mozilla/addon-wr https://github.com/mozilla/addon-wr

rpns 9y ago
It required turning on via an about:config preference, the code on GitHub seems to have changed since then for the separately installed version. If you look into the repo history you can see what it was doing before: https://github.com/mozilla/addon-wr/blob/21ff53d2d5baab591d29b4ea5847d74cb6901b2c/addon/bootstrap.js#L15-L39 https://github.com/mozilla/addon-wr/blob/21ff53d2d5baab591d2...
- 2g67vupsoknn 9y ago
  Thanks for the additional information. In any case, the claim that "no user data was collected or shared" is suspect. Users who enabled the extension and visited NBC Universal's site (and others) were sending extra HTTP header data to the server, data that identified them as a Firefox user, of a specific version, who had a particular extension installed -- that's how the "engagement" worked. Do you think the server(s) that handled these types of "special" requests were configured to specifically _not_ log the incoming traffic or extra headers? Do you think that NBC Universal would spend the resources to build an elaborate[1] ARG focused on digital "engagement" with fans, form a relationship with Mozilla to promote the show and ARG to Firefox users, but also specifically _not_ collect data about those users? It seems unlikely. [1] https://wiki.gamedetectives.net/index.php?title=Mr._Robot_ARG https://wiki.gamedetectives.net/index.php?title=Mr._Robot_AR...
- 9y ago

weerd 9y ago

Funny thing about this whole situation... I've never heard of Mr. Robot until now and after reading about it I want to watch it.

deleted 9y ago

[deleted]

1024core 9y ago

This "apology" is written by the CMO. Why is the CMO writing this apology? Why didn't it come from the CEO or the COO, the people actually responsible for shipping the product?

gridscomputing 9y ago
BOOM! FATALITY!
Meph504 9y ago
Because this whole mess was very likely pushed by the marketing dept. and when things went wrong, and it rolled down hill it landed in their lap.
- blub 9y ago
  Why does the marketing department have the power to force install things on my computer? What the hell is the technical leadership doing at this company? What the hell is the data protection officer doing? I hope they have one at least.
  - dcminter 9y ago
    For me, Mozilla needed to answer three questions: * Do you know you fucked up? * How did this happen? * What will you do to ensure this doesn't happen again? They've only answered the first one (admittedly with the "right" answer) so I have to assume marketing have the reins and won't be relinquishing them.

lovelearning 9y ago

Why would anybody do something like this that installs unwanted software on millions of devices worldwide just to provide entertainment to a handful of fans of some television show most users, I suspect, haven't even heard about? I have difficulty believing that there was no payment; if there wasn't any payment, what exactly was Mozilla gaining from this?

elaus 9y ago
They got screen time on the TV series and apparently some "sponsored by Firefox" metioning in the credits (?). So the whole "unpaid" thing is a bit misleading as they did get something in return (which has direct cash value).

gfodor 9y ago

I fully understand and empathize with the reaction that has happened and now that Mozilla (my employer) has a statement apologizing and committing to a public post-mortem (which I fully support) to the folks who are raising issues with the timing and sequence of events leading up to the response itself since Friday (I won't comment on the incident itself, since that's the job of the post-mortem) I wanted to mention one thing that may help add some human perspective: Mozilla is a distributed organization and was on the last day of its in-person, week-long, bi-yearly all-hands meeting in Austin on Friday when this started. At the time, and through large parts of Saturday, many Mozillians were in last-minute meetings, airports, in the air, or on the road, and were all concluding a week's worth of meetings where everyone was getting face time with collaborators and hashing out in person what we're doing for the next 6 months. I was not involved, but you can imagine that when trying to decide what to do in response to something like this that many people need to coordinate. So it was a bit of a perfect storm of having tired humans, many of whom were in and out of internet access, etc. edit: I fully understand the frustrated replies -- as I mentioned I personally feel that the reaction by the community to what happened was justified -- I wrote this not to comment on what happened (as noted in the post, Mozilla has publicly committed to a post-mortem) but wanted to provide this info about this unfolding when a lot of people were traveling, etc. I was happy and thankful to see this posted today and our rollback of the add-on over the weekend and hope that the follow-ups planned help us learn and move forward in a way that the community supports.

justinjlynn 9y ago
From Mr. Robot's own Whiterose: There are no coincidences. Or rather, from my perspective, of course there are coincidences; it's just that I don't trust them. ... and I need to be able to trust my tools.
notatoad 9y ago
>you can imagine that when trying to decide what to do in response to something like this that many people need to have their feedback taken into account before any statements are made or actions taken. If only such care was put into deciding whether or not to ship adware in your browser, maybe you guys wouldn't have this problem.

paulie_a 9y ago

I would honestly like to know who thought this was a good idea. Screw the press release of "we"

devit 9y ago

Why is the "Chief Marketing Officer" apologizing? Is he the person in charge of which code gets shipped to Firefox users? If so, that seems rather bad, and it ought to stop. If not, maybe the person in charge (probably the CTO) should be the one apologizing for letting them ship this thing?

anygregor 9y ago
Mozilla doesn't have a CTO any more. The SVP of Firefox should have been the decision maker in this case.

rootlocus 9y ago

> We didn’t think hard enough about how our actions would affect the community Which can be interpreted as "we didn't expect you to be such whiny bitches". I was hoping for something along the lines of "this breaks our principle <<Transparent community-based processes promote participation, accountability and trust.>> [1]". But PR seems to be more important than respecting principles. This time it was a disabled marketing addon. Next time it might be something worse. Betraying your core principles is a serious red flag. > Over the course of the year Firefox has enjoyed a growing relationship with the Mr. Robot television show And this is the first time I hear of it. [1] https://www.mozilla.org/en-US/about/manifesto/#principle-08 https://www.mozilla.org/en-US/about/manifesto/#principle-08

Traubenfuchs 9y ago

Mozilla continues its history of adding crap to Firefox that most people don't want, without asking. Anyone remember pocket?

Paianni 9y ago
It's their browser, they can do whatever they want.
- scott_karana 9y ago
  That attitude sure turned out well for Opera.

a_imho 9y ago

It is pretty frustrating that moz://a is better at entrenching Chrome than Google.

zaro 9y ago

> We didn’t think hard enough about how our actions would affect the community, and we’re sorry for letting you down. It's OK Mozilla. Don't be too harsh on yourself. Everybody makes mistakes. We still love you :)

binaryapparatus 9y ago

While unfortunate it is good that this happened. It will help some 'more creative' individuals in marketing feel the boundaries they didn't understand. Comparing FF and Chrome security/privacy wise is ridiculous, I really don't understand that anybody tries to compare those two.

pmlnr 9y ago
People were comparing it to Chromium. Chrome and Chromium are not the same.
- Paianni 9y ago
  Chromium still has more pervasive spyware features than Firefox with all the data collection options enabled.

privacywall 9y ago

I've been following the conversation for the last couple days and I think I may have a solution. I have been working on a program to block telemetry tracking at the OS level. It's called PrivacyWall, and it was originally meant to stop unwanted data collection by Windows 10. I built this to be a solution to block unwanted data collection by companies that sellout their customers to advertisers instead of putting their users first. It is more powerful than an Adblocker because it operates at the OS system and is able to block tracking by Windows programs and the Windows 10 operating system. I just added support to block Firefox tracking with the telemetry urls that Looking Glass is sending data to. I haven't been able to work on it for the last 3 months because I was trapped by the hurricane in Puerto Rico without power, internet, water. It's not ready for prime time, so this is a beta. You can try it here: https://www.privacywall.org https://www.privacywall.org I'm making it available for free for non-commercial use. PrivacyWall blocks a list of known Firefox, Chrome, and Edge telemetry urls and Windows 10 telemetry urls when you turn it on. You can also turn it off easily through the task tray. After you install PrivacyWall, no program on your computer will be able to send data to those urls anymore behind your back. If you try it out and like it or hate it, please send me your feedback. Let me know if there are more urls I should add to the block list. I have limited time to continue supporting this project. If anyone is interested in helping out, let me know.