Aside from the publicity side, what irks me more about this statement is the "we will change some processes because of this" part. IMO, this is not a process-r

Aside from the publicity side, what irks me more about this statement is the "we will change some processes because of this" part. IMO, this is not a process-related problem. The fact that you have a way to install software on my computer without user feedback or the user's consent plus the possibility to hide that installation (read: backdoor) isn't due to a process. It displays a fundamental misunderstanding of what users expect of you. This neatly ties in with the pocket integration, as it basically is the same issue - only then, we knew about it. Edit: Yes, I know, backdoor is a harsh word for something non-targeted, but considering what potentially could happen, a process change doesn't fix this. Also, the moment we have to pick each FF update apart for hidden extensions is the moment FF has lost its reason to exist, as far as I'm concerned.