7 ms·

They kinda missed the point that people dont like when companies install things on their devices without permission. If its part of the shield program how about

They kinda missed the point that people dont like when companies install things on their devices without permission. If its part of the shield program how about we provide more transparency on that? Like how to opt-in/opt-out, what exactly it does? etc? I've been a firefox user since it came along to displace IE6 and i've never heard of the shield program. Better communication with your userbase is essential to maintain a sustainable product for the long term.

sho_hn 9y ago
Yeah, it sure feels like "some time ago we identified the need to have this, and also to better not tell you about it."
Vinnl 9y ago
> They kinda missed the point that people dont like when companies install things on their devices without permission. But it's a pretty blurry line, isn't it? You give permission to install Firefox, and it's somewhat arbitrary is a specific code is "part of Firefox" or "part of an extension" when that extension is shipped with Firefox by default. (In this case, the specific code wasn't even executed unless the user flipped a switch in about:config. The problematic part was something being listed among your extensions that you couldn't make sense of as a user.)
- TuringTest 9y ago
  How about a notification when some new component is added? That's fairly common standard procedure for getting permission without being deceptive.
  - cbcoutinho 9y ago
    I would argue it's almost always obfuscatory, if not deceptive. How many emails/updates do we all get with something along the lines of `We've updated our terms, read them here!`. This extension could have easily found its way into one of those updates
  - Vinnl 9y ago
    The question then is how to avoid alert fatigue [1]. "Component" is also a fairly ill-defined term, I think. [1] https://en.wikipedia.org/wiki/Alarm_fatigue https://en.wikipedia.org/wiki/Alarm_fatigue
    - TuringTest 9y ago
      A good strategy is to bundle them, so that users can review a bunch of alerts when they're ready for the task. Release Notes of a new version is a good place to place that bundle. People concerned with security do set aside time for such task.
- Traubenfuchs 9y ago
  The line is blurry indeed, but a tv show tie-in is clearly very far away from that line. (Not on the good side, but on the not-good side)
- TamDenholm 9y ago
  I dont think the line is that blurry personally, we get asked permission if we want to send usage data back to Mozilla to help them, i allow that, because i'm asked and informed about whats happening. I dont see why the same prinipal cant be applied to the shield program.
  - Vinnl 9y ago
    I wasn't talking about sending data back being blurry, but about the line between code "being installed together with Firefox" and code "just being part of Firefox".
- contrast 9y ago
  No, it's not that blurry. Any competent manager should be able to tell the difference between "functionality directly related to what users expect of a browser" and "code that we have installed on their machines without their knowledge, primarily motivated by our interests rather than theirs". This is not about the specific implementation of such decisions, such as whether including it as "part of" or "extension to". That's a pointless distinction - also something any competent manager in the tech sector should be aware of.
  - Vinnl 9y ago
    So as a silly example, that means about:mozilla or Chrome's dinosaur game shouldn't have been shipped at all?
    - Wingman4l7 9y ago
      Easter eggs have no functionality, and they follow the precedents of being harmless.
      - aangjie 9y ago
        Don't know why you're getting downvote, the first part of your stmt might be debatable, but being harmless is reasonable and in the example of about:config, it's also useful for a smaller set of users.
      - Sylos 9y ago
        Well, the same was true for the so heftily discussed Looking Glass extension. It did not do anything, unless you manually switched on an about:config value. And if you did, then all it did, was flip some random words on webpages upside down.
        Wingman4l7 9y ago
        We can add a third criteria, then -- Easter eggs have no commercial purpose. The Looking Glass extension had tie-ins to a TV show.
- jonathanstrange 9y ago
  It's their obligation to make sure the line is not blurry. As a user I always want to know the following: - What does it do? - Is it needed for core functionality or optional? - How do you switch it off/on? - Does it transmit any data, and if so, which one and how do I control the data flow? - Who are the developers and is the code open source or is it proprietary? - What are the default settings and why? If it's optional, then it's an extension. If it's on by default, I better get a very good reason for it (e.g. that it ostensibly enhances security). All of the above questions need to be answered before I install it, i.e., the information needs to be freely available and easy to find on web pages, release notes, Readme, etc. If something is added in an update or upgrade, I need to be informed and given a choice about it.
  - Vinnl 9y ago
    So as a silly example, that means about:mozilla or Chrome's dinosaur game shouldn't have been shipped at all?
    - kuschku 9y ago
      There's a reason Microsoft banned its developers from doing easter eggs. There's a fine line between "Easter Egg" and "within of 3 months we've installed without user approval CliqZ's tracking, added Google Analytics to the about:addons Discovery menu, and added some easter eggs". This is how you lose all trust.
    - TeMPOraL 9y ago
      Easter eggs are somewhat of a software tradition. This particular one didn't get complains because of a combination of reasons like: - It is completely off-line (hell, it's only available on the "you're off-line" screen, where there isn't much else you can do with a browser). - It's off by default (you need to be on a proper screen). - It's a small and self-contained game. Doesn't impact anything else beyond a small area on the tab, which makes it just a step up from an animated GIF. - It's just a joke, it isn't tied to any commercial franchise or brand, nor does it promote any ideology or organization. - People expect less user-fairness from Google than from Mozilla. Ultimately, the line is fuzzy, but Chrome's dinosaur is clearly more like an Easter egg, and Mozilla's Looking Glass is clearly more like a very specific extension/feature.
- jlgaddis 9y ago
  This is the kind of logic that ends up with things like a Java installer "helpfully" giving the user a Yahoo Toolbar in their browser or, for more extreme examples, Superfish and the Sony rootkit.
- olavk 9y ago
  It was an ad for a TV-show. I wouldn't really like if deceptively concealed ad's were bundled as part of Firefox proper either.
sp332 9y ago
Options -> Privacy and Security -> Allow Firefox to install and run studies. I don't remember if it's on by default.

sho_hn 9y ago

Yeah, it sure feels like "some time ago we identified the need to have this, and also to better not tell you about it."

Vinnl 9y ago

> They kinda missed the point that people dont like when companies install things on their devices without permission. But it's a pretty blurry line, isn't it? You give permission to install Firefox, and it's somewhat arbitrary is a specific code is "part of Firefox" or "part of an extension" when that extension is shipped with Firefox by default. (In this case, the specific code wasn't even executed unless the user flipped a switch in about:config. The problematic part was something being listed among your extensions that you couldn't make sense of as a user.)

TuringTest 9y ago
How about a notification when some new component is added? That's fairly common standard procedure for getting permission without being deceptive.
- cbcoutinho 9y ago
  I would argue it's almost always obfuscatory, if not deceptive. How many emails/updates do we all get with something along the lines of `We've updated our terms, read them here!`. This extension could have easily found its way into one of those updates
- Vinnl 9y ago
  The question then is how to avoid alert fatigue [1]. "Component" is also a fairly ill-defined term, I think. [1] https://en.wikipedia.org/wiki/Alarm_fatigue https://en.wikipedia.org/wiki/Alarm_fatigue
  - TuringTest 9y ago
    A good strategy is to bundle them, so that users can review a bunch of alerts when they're ready for the task. Release Notes of a new version is a good place to place that bundle. People concerned with security do set aside time for such task.
Traubenfuchs 9y ago
The line is blurry indeed, but a tv show tie-in is clearly very far away from that line. (Not on the good side, but on the not-good side)
TamDenholm 9y ago
I dont think the line is that blurry personally, we get asked permission if we want to send usage data back to Mozilla to help them, i allow that, because i'm asked and informed about whats happening. I dont see why the same prinipal cant be applied to the shield program.
- Vinnl 9y ago
  I wasn't talking about sending data back being blurry, but about the line between code "being installed together with Firefox" and code "just being part of Firefox".
contrast 9y ago
No, it's not that blurry. Any competent manager should be able to tell the difference between "functionality directly related to what users expect of a browser" and "code that we have installed on their machines without their knowledge, primarily motivated by our interests rather than theirs". This is not about the specific implementation of such decisions, such as whether including it as "part of" or "extension to". That's a pointless distinction - also something any competent manager in the tech sector should be aware of.
- Vinnl 9y ago
  So as a silly example, that means about:mozilla or Chrome's dinosaur game shouldn't have been shipped at all?
  - Wingman4l7 9y ago
    Easter eggs have no functionality, and they follow the precedents of being harmless.
    - aangjie 9y ago
      Don't know why you're getting downvote, the first part of your stmt might be debatable, but being harmless is reasonable and in the example of about:config, it's also useful for a smaller set of users.
    - Sylos 9y ago
      Well, the same was true for the so heftily discussed Looking Glass extension. It did not do anything, unless you manually switched on an about:config value. And if you did, then all it did, was flip some random words on webpages upside down.
      - Wingman4l7 9y ago
        We can add a third criteria, then -- Easter eggs have no commercial purpose. The Looking Glass extension had tie-ins to a TV show.
jonathanstrange 9y ago
It's their obligation to make sure the line is not blurry. As a user I always want to know the following: - What does it do? - Is it needed for core functionality or optional? - How do you switch it off/on? - Does it transmit any data, and if so, which one and how do I control the data flow? - Who are the developers and is the code open source or is it proprietary? - What are the default settings and why? If it's optional, then it's an extension. If it's on by default, I better get a very good reason for it (e.g. that it ostensibly enhances security). All of the above questions need to be answered before I install it, i.e., the information needs to be freely available and easy to find on web pages, release notes, Readme, etc. If something is added in an update or upgrade, I need to be informed and given a choice about it.
- Vinnl 9y ago
  So as a silly example, that means about:mozilla or Chrome's dinosaur game shouldn't have been shipped at all?
  - kuschku 9y ago
    There's a reason Microsoft banned its developers from doing easter eggs. There's a fine line between "Easter Egg" and "within of 3 months we've installed without user approval CliqZ's tracking, added Google Analytics to the about:addons Discovery menu, and added some easter eggs". This is how you lose all trust.
  - TeMPOraL 9y ago
    Easter eggs are somewhat of a software tradition. This particular one didn't get complains because of a combination of reasons like: - It is completely off-line (hell, it's only available on the "you're off-line" screen, where there isn't much else you can do with a browser). - It's off by default (you need to be on a proper screen). - It's a small and self-contained game. Doesn't impact anything else beyond a small area on the tab, which makes it just a step up from an animated GIF. - It's just a joke, it isn't tied to any commercial franchise or brand, nor does it promote any ideology or organization. - People expect less user-fairness from Google than from Mozilla. Ultimately, the line is fuzzy, but Chrome's dinosaur is clearly more like an Easter egg, and Mozilla's Looking Glass is clearly more like a very specific extension/feature.
jlgaddis 9y ago
This is the kind of logic that ends up with things like a Java installer "helpfully" giving the user a Yahoo Toolbar in their browser or, for more extreme examples, Superfish and the Sony rootkit.
olavk 9y ago
It was an ad for a TV-show. I wouldn't really like if deceptively concealed ad's were bundled as part of Firefox proper either.

sp332 9y ago

Options -> Privacy and Security -> Allow Firefox to install and run studies. I don't remember if it's on by default.