6 ms·

Firefox installs add-ons into your browser without consent, again

71 points by foxrider 8y ago

mishurov 8y ago
Makes inappropriate advances.
Insanity 8y ago
I have also opted out of data collection for firefox, but the mentioned extensions in the article can not be found for me. I can, however, find one under the telemetry heading called "follow on search". EDIT: I'm using Firefox quantum 60.2.0esr. Just because the add-on is installed does not make it active though, I can't see it as being active (or I can not find an option to enable / disable it anyway)
- rhelmer 8y ago
  This is only being served to Release channel users currently (per the bug in the extension ID, https://bugzilla.mozilla.org/show_bug.cgi?id=1487578 https://bugzilla.mozilla.org/show_bug.cgi?id=1487578) ESR users are on a separate channel.
- bigbugbag 8y ago
  ESR means you usually have a little time before the next nonsense hits you, though it was not the case for dropping alsa in favor of only pulseaudio.
abdullahkhalids 8y ago
Not taking sides on this, but this is what Mozilla has to say about this. About "hidden addons" [1]: > It is true that we're now releasing some features internally as something we call "System Extension", which technically is the same as an addon you could install on addons.mozilla.org, with the difference that these come pre-installed with Firefox and there is no way to disable them. We mainly do this to be able to ship updates faster, but it's also nice that we have some features totally separated, which makes the development process easier for us! And about these particular addons [2]: > we will measure Telemetry Coverage, which is the percentage of all Firefox users who report telemetry. The Telemetry Coverage measurement will sample a portion of all Firefox clients and report whether telemetry is enabled. This measurement will not include a client identifier and will not be associated with our standard telemetry. [1] https://superuser.com/questions/1117062/what-is-the-web-compat-firefox-addon-avast-suggest-removing https://superuser.com/questions/1117062/what-is-the-web-comp... [2] https://medium.com/@neothefox/firefox-installs-add-ons-into-your-browser-without-consent-again-d3e2c8e08587 https://medium.com/@neothefox/firefox-installs-add-ons-into-...
- jake_the_third 8y ago
  >we will measure Telemetry Coverage, which is the percentage of all Firefox users who report telemetry. The Telemetry Coverage measurement will sample a portion of all Firefox clients and report whether telemetry is enabled. This measurement will not include a client identifier and will not be associated with our standard telemetry. Telemetry for telemetry. Nice.
  - trendia 8y ago
    > Telemetry for telemetry. Nice. It's just a matter of time until some developer poses the question: "Are people who opt out of telemetry more likely to use Linux? Or live in Europe? Or have NVidia GPUs? Or... " and gosh darn everyone else at Mozilla begins to wonder the same thing, and the best way to answer that question is to include it in your "totally not telemetry" telemetry reports, and then we're back to Square One.
- pdkl95 8y ago
  > This measurement will not include a client identifier That cannot be correct unless they have figured out a way to transfer the user's data without using IP. The Source Address and other fields in the IP header can easily be enough to fingerprint the user[1]. Mozilla may not be storing the data in the current version, but they are still collecting a de fact client identifier. (it wouldn't surprise me if the data is submitted over HTTPS, which might include headers with additional bits fingerprintable entropy) > and will not be associated with our standard telemetry Just because they are not currently intending to correlate the databases doesn't prevent them (or others) from doing so in the future. This kind of claim isn't worth much without a Ulysses Contract[2][3] binding their future actions. [1] https://news.ycombinator.com/item?id=17170468 https://news.ycombinator.com/item?id=17170468 [2] https://en.wikipedia.org/wiki/Ulysses_pact https://en.wikipedia.org/wiki/Ulysses_pact [3] https://www.youtube.com/watch?v=zlN6wjeCJYk https://www.youtube.com/watch?v=zlN6wjeCJYk
  - bigbugbag 8y ago
    Mozilla's answer is clearly some PR attempt again. Anyone with basic technical understanding knows that any form of communication includes ways ot identifying and tracking. The dishonesty of silently installing telemetry to monitor people who disable telemetry is a telltale sign of this attitude. Once again it is weakening the leftover trust in mozilla and pushes long time supporter away to alternatives such as waterfox. It raises the question again of mozilla " making far-reaching and very short-sighted decisions in a vacuum." taking control away from users, not respecting privacy and user choice. http://forums.mozillazine.org/viewtopic.php?f=7&t=2970749 http://forums.mozillazine.org/viewtopic.php?f=7&t=2970749
remarkEon 8y ago
This is annoying, yes. Changing the default search engine to yahoo every time there's an update is equally annoying.
- favadi 8y ago
  Any chance you are using Linux Mint?
- JoshMnem 8y ago
  Did you originally install Firefox through a Yahoo ad? Yahoo used to run ads for Firefox keywords to get you to download their version of the browser. The ads looked like search results, so it was easy to visit the wrong download page.
  - remarkEon 8y ago
    No, I'm certain I did not. As an aside, wouldn't that mean I'd be running a Yahoo-ized version of Firefox?
    - JoshMnem 8y ago
      I don't know, but I haven't seen the search change to Yahoo on my computer, except when I briefly tried Linux Mint many years ago. Mint had set Firefox and Chromium to Yahoo and made it extremely difficult to remove. It was both browsers, so I'm assuming that it was Mint that did it and not Mozilla.
      - rhelmer 8y ago
        Would you mind pasting your `about:support` somewhere (github gist, pastebin, etc) and linking it here?
        JoshMnem 8y ago
        Me? I'm not having trouble with Firefox. The Yahoo problem with Linux Mint was many years ago. My search engines in Firefox haven't switched on me since I uninstalled Mint.
gergles 8y ago
Yeah, this is absurd. If I am opted out of telemetry, that means don't send any fucking telemetry. That includes the fact that I opted out of telemetry. If you aren't going to let me opt out of telemetry, don't give me the option. It's clear Mozilla is absolutely desperate to get 'telemetry' data to justify the continued Mickey Mousing of Firefox and I will happily cast aspersions from here about how I'm sure they'll say "well only 2% of users don't send telemetry, so whatever data we get from it lets us drive all our development". Edited to add: From the bug, you can go into about:config and add a New>Boolean pref "toolkit.telemetry.coverage.opt-out" and set it to true to opt out of this totally-not-telemetry telemetry.
- yborg 8y ago
  This is what I have out of the box on 63b8: https://my.mixtape.moe/sjlprj.jpg https://my.mixtape.moe/sjlprj.jpg - Telemetry? No thank you. https://my.mixtape.moe/sflqrh.jpg https://my.mixtape.moe/sflqrh.jpg - Great! Have some extra telemetry on us! The locked toolkit.telemetry.enabled is my favorite part.
  - rhelmer 8y ago
    If I am understanding correctly, these are two separate things: - https://my.mixtape.moe/sjlprj.jpg https://my.mixtape.moe/sjlprj.jpg - this is whether data is reported to mozilla servers - https://my.mixtape.moe/sflqrh.jpg https://my.mixtape.moe/sflqrh.jpg - this is data collected locally You can see the latter in `about:telemetry`
    - rhelmer 8y ago
      If you are seeing something different please let me know!
- eli 8y ago
  It seems wrong to assume malice
  - gergles 8y ago
deleted 8y ago
[deleted]
51lver 8y ago
GNU icecat is a firefox fork with many privacy violating issues removed. It's pretty nice.
- ewzimm 8y ago
  This is one reason why GNU is so important. Some people might think they're zealots about free software, but if you have to trust someone with your software, wouldn't you rather trust someone who has built their reputation on respecting privacy and freedom? It goes beyond the debate about software licensing.
- bigbugbag 8y ago
  waterfox is even better, it also removes several other mozilla nonsense such as pocket and maintain support for legacy extensions. https://www.waterfoxproject.org/ https://www.waterfoxproject.org/
jstewartmobile 8y ago
Web is already an exploitative platform. Mozilla's just trying to keep their end up. Most of the good stuff is libre anyway. Self-host a Wikipedia mirror and some python docs, use lynx, and let Google/Mozilla/Yahoo/et.al. put that in their pipes and smoke it.
rgbrenner 8y ago
The Firefox Monitor is not a telemetry study. It's this: https://blog.mozilla.org/futurereleases/2018/06/25/testing-firefox-monitor-a-new-security-tool/ https://blog.mozilla.org/futurereleases/2018/06/25/testing-f... This extension is listed under about:debugging.. the same place where you'll see other features like Pocket, Form Autofill, and Firefox Screenshots. It's a new Firefox feature. It's not alarming, and it's not Firefox installing things without your permission. Complaining about this is literally complaining that the new version you just installed has a new feature. If a new version didn't change anything, they wouldn't need a new version.
- sjwright 8y ago
  > Complaining about this is literally complaining that the new version you just installed has a new feature. A hundred times this. The article is misleading click-bait taking advantage of people's historical aversion towards drive-by downloads of malicious add-ons. Mozilla could have just as easily implemented this directly in the browser and this article probably wouldn't have been written, or if it was, it would have at least focused on the legitimate question about telemetry. There is a legitimate debate worth having here, but basing the complaint on the good code hygiene practiced by Mozilla developers is silly. Meanwhile, every web page you visit leaks the fact of your existence a hundred different ways and 99% of us don't care much.
- mgurlitz 8y ago
  That post isn't explicitly about a Firefox Monitor extension, and I could only find this rollout to US users mentioned on 3rd party websites. Those posts include BugZilla links, but they're restricted. I can easily disable Pocket, Autofill, and Screenshots in about:config, and Firefox support explains that. With this extension, I'm missing a "extensions.fxmonitor.enabled" option. I understand it's good to build in optional security features like this, but I don't see how it's acceptable to not notify users or provide an opt-out.
  - rgbrenner 8y ago
    here's an article about the add-on: https://www.ghacks.net/2018/08/25/firefox-62-firefox-monitor-system-add-on-integration/ https://www.ghacks.net/2018/08/25/firefox-62-firefox-monitor... They are missing the about:config setting.. but it's early. Might be a bug, or maybe its not being used(?) Eventually it'll display a popup in the UI that will notify you if the website you're on has been breached. I think we can all agree that would be useful. Edit: Here's the code for the add-on: https://github.com/mozilla/blurts-addon https://github.com/mozilla/blurts-addon

71 points by foxrider 8y ago

Makes inappropriate advances.

I have also opted out of data collection for firefox, but the mentioned extensions in the article can not be found for me. I can, however, find one under the telemetry heading called "follow on search". EDIT: I'm using Firefox quantum 60.2.0esr. Just because the add-on is installed does not make it active though, I can't see it as being active (or I can not find an option to enable / disable it anyway)

rhelmer 8y ago
This is only being served to Release channel users currently (per the bug in the extension ID, https://bugzilla.mozilla.org/show_bug.cgi?id=1487578 https://bugzilla.mozilla.org/show_bug.cgi?id=1487578) ESR users are on a separate channel.
bigbugbag 8y ago
ESR means you usually have a little time before the next nonsense hits you, though it was not the case for dropping alsa in favor of only pulseaudio.

abdullahkhalids 8y ago

Not taking sides on this, but this is what Mozilla has to say about this. About "hidden addons" [1]: > It is true that we're now releasing some features internally as something we call "System Extension", which technically is the same as an addon you could install on addons.mozilla.org, with the difference that these come pre-installed with Firefox and there is no way to disable them. We mainly do this to be able to ship updates faster, but it's also nice that we have some features totally separated, which makes the development process easier for us! And about these particular addons [2]: > we will measure Telemetry Coverage, which is the percentage of all Firefox users who report telemetry. The Telemetry Coverage measurement will sample a portion of all Firefox clients and report whether telemetry is enabled. This measurement will not include a client identifier and will not be associated with our standard telemetry. [1] https://superuser.com/questions/1117062/what-is-the-web-compat-firefox-addon-avast-suggest-removing https://superuser.com/questions/1117062/what-is-the-web-comp... [2] https://medium.com/@neothefox/firefox-installs-add-ons-into-your-browser-without-consent-again-d3e2c8e08587 https://medium.com/@neothefox/firefox-installs-add-ons-into-...

jake_the_third 8y ago
>we will measure Telemetry Coverage, which is the percentage of all Firefox users who report telemetry. The Telemetry Coverage measurement will sample a portion of all Firefox clients and report whether telemetry is enabled. This measurement will not include a client identifier and will not be associated with our standard telemetry. Telemetry for telemetry. Nice.
- trendia 8y ago
  > Telemetry for telemetry. Nice. It's just a matter of time until some developer poses the question: "Are people who opt out of telemetry more likely to use Linux? Or live in Europe? Or have NVidia GPUs? Or... " and gosh darn everyone else at Mozilla begins to wonder the same thing, and the best way to answer that question is to include it in your "totally not telemetry" telemetry reports, and then we're back to Square One.
pdkl95 8y ago
> This measurement will not include a client identifier That cannot be correct unless they have figured out a way to transfer the user's data without using IP. The Source Address and other fields in the IP header can easily be enough to fingerprint the user[1]. Mozilla may not be storing the data in the current version, but they are still collecting a de fact client identifier. (it wouldn't surprise me if the data is submitted over HTTPS, which might include headers with additional bits fingerprintable entropy) > and will not be associated with our standard telemetry Just because they are not currently intending to correlate the databases doesn't prevent them (or others) from doing so in the future. This kind of claim isn't worth much without a Ulysses Contract[2][3] binding their future actions. [1] https://news.ycombinator.com/item?id=17170468 https://news.ycombinator.com/item?id=17170468 [2] https://en.wikipedia.org/wiki/Ulysses_pact https://en.wikipedia.org/wiki/Ulysses_pact [3] https://www.youtube.com/watch?v=zlN6wjeCJYk https://www.youtube.com/watch?v=zlN6wjeCJYk
- bigbugbag 8y ago
  Mozilla's answer is clearly some PR attempt again. Anyone with basic technical understanding knows that any form of communication includes ways ot identifying and tracking. The dishonesty of silently installing telemetry to monitor people who disable telemetry is a telltale sign of this attitude. Once again it is weakening the leftover trust in mozilla and pushes long time supporter away to alternatives such as waterfox. It raises the question again of mozilla " making far-reaching and very short-sighted decisions in a vacuum." taking control away from users, not respecting privacy and user choice. http://forums.mozillazine.org/viewtopic.php?f=7&t=2970749 http://forums.mozillazine.org/viewtopic.php?f=7&t=2970749

remarkEon 8y ago

This is annoying, yes. Changing the default search engine to yahoo every time there's an update is equally annoying.

favadi 8y ago
Any chance you are using Linux Mint?
JoshMnem 8y ago
Did you originally install Firefox through a Yahoo ad? Yahoo used to run ads for Firefox keywords to get you to download their version of the browser. The ads looked like search results, so it was easy to visit the wrong download page.
- remarkEon 8y ago
  No, I'm certain I did not. As an aside, wouldn't that mean I'd be running a Yahoo-ized version of Firefox?
  - JoshMnem 8y ago
    I don't know, but I haven't seen the search change to Yahoo on my computer, except when I briefly tried Linux Mint many years ago. Mint had set Firefox and Chromium to Yahoo and made it extremely difficult to remove. It was both browsers, so I'm assuming that it was Mint that did it and not Mozilla.
    - rhelmer 8y ago
      Would you mind pasting your `about:support` somewhere (github gist, pastebin, etc) and linking it here?
      - JoshMnem 8y ago
        Me? I'm not having trouble with Firefox. The Yahoo problem with Linux Mint was many years ago. My search engines in Firefox haven't switched on me since I uninstalled Mint.

gergles 8y ago

Yeah, this is absurd. If I am opted out of telemetry, that means don't send any fucking telemetry. That includes the fact that I opted out of telemetry. If you aren't going to let me opt out of telemetry, don't give me the option. It's clear Mozilla is absolutely desperate to get 'telemetry' data to justify the continued Mickey Mousing of Firefox and I will happily cast aspersions from here about how I'm sure they'll say "well only 2% of users don't send telemetry, so whatever data we get from it lets us drive all our development". Edited to add: From the bug, you can go into about:config and add a New>Boolean pref "toolkit.telemetry.coverage.opt-out" and set it to true to opt out of this totally-not-telemetry telemetry.

yborg 8y ago
This is what I have out of the box on 63b8: https://my.mixtape.moe/sjlprj.jpg https://my.mixtape.moe/sjlprj.jpg - Telemetry? No thank you. https://my.mixtape.moe/sflqrh.jpg https://my.mixtape.moe/sflqrh.jpg - Great! Have some extra telemetry on us! The locked toolkit.telemetry.enabled is my favorite part.
- rhelmer 8y ago
  If I am understanding correctly, these are two separate things: - https://my.mixtape.moe/sjlprj.jpg https://my.mixtape.moe/sjlprj.jpg - this is whether data is reported to mozilla servers - https://my.mixtape.moe/sflqrh.jpg https://my.mixtape.moe/sflqrh.jpg - this is data collected locally You can see the latter in `about:telemetry`
  - rhelmer 8y ago
    If you are seeing something different please let me know!
eli 8y ago
It seems wrong to assume malice
- gergles 8y ago

deleted 8y ago

[deleted]

51lver 8y ago

GNU icecat is a firefox fork with many privacy violating issues removed. It's pretty nice.

ewzimm 8y ago
This is one reason why GNU is so important. Some people might think they're zealots about free software, but if you have to trust someone with your software, wouldn't you rather trust someone who has built their reputation on respecting privacy and freedom? It goes beyond the debate about software licensing.
bigbugbag 8y ago
waterfox is even better, it also removes several other mozilla nonsense such as pocket and maintain support for legacy extensions. https://www.waterfoxproject.org/ https://www.waterfoxproject.org/

jstewartmobile 8y ago

Web is already an exploitative platform. Mozilla's just trying to keep their end up. Most of the good stuff is libre anyway. Self-host a Wikipedia mirror and some python docs, use lynx, and let Google/Mozilla/Yahoo/et.al. put that in their pipes and smoke it.

rgbrenner 8y ago

The Firefox Monitor is not a telemetry study. It's this: https://blog.mozilla.org/futurereleases/2018/06/25/testing-firefox-monitor-a-new-security-tool/ https://blog.mozilla.org/futurereleases/2018/06/25/testing-f... This extension is listed under about:debugging.. the same place where you'll see other features like Pocket, Form Autofill, and Firefox Screenshots. It's a new Firefox feature. It's not alarming, and it's not Firefox installing things without your permission. Complaining about this is literally complaining that the new version you just installed has a new feature. If a new version didn't change anything, they wouldn't need a new version.

sjwright 8y ago
> Complaining about this is literally complaining that the new version you just installed has a new feature. A hundred times this. The article is misleading click-bait taking advantage of people's historical aversion towards drive-by downloads of malicious add-ons. Mozilla could have just as easily implemented this directly in the browser and this article probably wouldn't have been written, or if it was, it would have at least focused on the legitimate question about telemetry. There is a legitimate debate worth having here, but basing the complaint on the good code hygiene practiced by Mozilla developers is silly. Meanwhile, every web page you visit leaks the fact of your existence a hundred different ways and 99% of us don't care much.
mgurlitz 8y ago
That post isn't explicitly about a Firefox Monitor extension, and I could only find this rollout to US users mentioned on 3rd party websites. Those posts include BugZilla links, but they're restricted. I can easily disable Pocket, Autofill, and Screenshots in about:config, and Firefox support explains that. With this extension, I'm missing a "extensions.fxmonitor.enabled" option. I understand it's good to build in optional security features like this, but I don't see how it's acceptable to not notify users or provide an opt-out.
- rgbrenner 8y ago
  here's an article about the add-on: https://www.ghacks.net/2018/08/25/firefox-62-firefox-monitor-system-add-on-integration/ https://www.ghacks.net/2018/08/25/firefox-62-firefox-monitor... They are missing the about:config setting.. but it's early. Might be a bug, or maybe its not being used(?) Eventually it'll display a popup in the UI that will notify you if the website you're on has been breached. I think we can all agree that would be useful. Edit: Here's the code for the add-on: https://github.com/mozilla/blurts-addon https://github.com/mozilla/blurts-addon