7 ms·

pushed it out to users via Normandy (this should be most users) Is the existence of a back door method of updating Firefox preferences something that will be

pushed it out to users via Normandy (this should be most users) Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? What about a UI knob to disable it?

bo1024 8y ago
Agree with this concern.
daleharvey 8y ago
> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout > What about a UI knob to disable it? app.normandy.enabled
- inferiorhuman 8y ago
  app.normandy.enabled That is not what I meant by a UI knob, and I sure hope you knew that. By UI knob I mean something easily discoverable and self-explanatory. Rooting around a gated (with a mighty strong warning, I should add) config section for something called "normandy" is not intuitive, and it's not self-explanatory. And I sure hope that by disclosed to users I did not mean some Hitchhiker's Guide-esque disclaimer on a wiki page. Something as (potentially) insidious as a preferences backdoor should absolutely be disclosed to users with the same level of visibility as the stories nonsense. Perhaps "normandy" is entirely harmless, but you guys lost a metric fuckton of credibility by using your backdoors to spam people[1]. Playing coy does nothing to improve your credibility or reputation. 1: https://www.theregister.co.uk/2017/12/18/mozilla_mr_robot_firefox_promotion/ https://www.theregister.co.uk/2017/12/18/mozilla_mr_robot_fi...
  - dbrgn 8y ago
    I'm sorry to break it to you, but a fuckton is not actually part of the metric system...
    - CompuHacker 8y ago
      Well, it should be, but that's an entirely different discussion.
    - Redoubts 8y ago
      This unit modifier was specified under RFC 69420
- oAlbe 8y ago
  > app.normandy.enabled I fail to see both the "UI" and the "knob" part of this. Why is this not a checkbox in the preferences? Why do so many people not know about Normandy?
  - deleted 8y ago
    [deleted]
- lawl 8y ago
  The UI knob is Options -> Privacy & Security > Allow Firefox to install and run studies They're using the studies system to push this hotfix faster for those that have it enabled. Edit: Source: See: https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disabled-or-fail-to-install/39047/14 https://discourse.mozilla.org/t/certificate-issue-causing-ad... > In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Preferences -> Privacy & Security -> Allow Firefox to install and run studies. Normandy seems to be the internal name for this system: https://github.com/mozilla/normandy https://github.com/mozilla/normandy
  - inferiorhuman 8y ago
    No, it's not. This Normandy nonsense and stories are two separate, yet creepy features. I've already disabled stories but it looks like Mozilla still retains control of my preferences (without disclosing it).
    - vesinisa 8y ago
      I sure wonder how people so suspicious of Mozilla dare use their browser.
      - hyeonwho4 8y ago
        Setting preferences really should not be shocking, given that they have the capacity to run automatic updates. I'm more surprised that they can push code without certificates.
        vesinisa 8y ago
        > I'm more surprised that they can push code without certificates. Where are you getting this from? AFAIK all Mozilla code / prefs they can push should be signed -- this very issue seems to stem from the cert used to sign AMO extensions expired.
        Piskvorrr 8y ago
- nanis 8y ago
  >> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? > It will even be documented for them: That sounds like you do not think the concern is warranted. I've used Firefox since the first time it was available, and Netscape starting with the first ever betas. At no point was there a dialog that said "Do you want us to be able to change your browser settings remotely?" >> What about a UI knob to disable it? > app.normandy.enabled That is not a "UI knob" by any stretch of the imagination. Looking in about:config revealed: app.normandy.logging.level Is there a way to find out what is being logged and why? So, the question can be rephrased as "is the fact that Firefox has been logging all users' entire browsing history despite the fact that the user has not chosen to set up a Firefox account going to be disclosed?"
  - Yoric 8y ago
    > So, the question can be rephrased as "is the fact that Firefox has been logging all users' entire browsing history despite the fact that the user has not chosen to set up a Firefox account going to be disclosed?" Chill out, this preference only determines what is logged locally (never sent to the server). It's a debugging tool. Sources: - https://searchfox.org/mozilla-central/source/toolkit/components/normandy/Normandy.jsm#32 https://searchfox.org/mozilla-central/source/toolkit/compone... - https://searchfox.org/mozilla-central/source/services/common/logmanager.js https://searchfox.org/mozilla-central/source/services/common...
    - rue 8y ago
      Look, at this point it’s not the user’s responsibility to “chill out”. It’s very much Firefox’s responsibility to try to repair their reputation by: 1. being completely transparent about all the mechanisms that data or code can be pushed to or pulled by the browser, or pushed from or pulled from the browser; and 2. having a toggle for all of them, yes every single one, in Privacy & Security.
- tssva 8y ago
  From the wiki entry. > Normandy Pref Rollout is a feature that allows Mozilla to change the default value of a preference for a targeted set of users, without deploying an update to Firefox. Rolling out a new certificate goes beyond changing the default value of a preference which rightly raises questions about what else Normandy allows which is not documented.
nanis 8y ago
This is the first I hear about Normandy[1]. Firefox has been my main browser for a long time, only because I could use uBlock origin. Now, all of a sudden that is disabled, and with the recent version they got rid of my ability to always prevent autoplaying of videos. Apparently, there is no one associated with browsers can be trusted in the least. [1]: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout
- daleharvey 8y ago
  In the recent version we added the ability to always prevent autoplaying of videos, in the next version we will be adding further UI to let the user disable all (not just muted) videos from autoplaying - https://bugzilla.mozilla.org/show_bug.cgi?id=1543812 https://bugzilla.mozilla.org/show_bug.cgi?id=1543812
  - inferiorhuman 8y ago
    That does nothing to mitigate the wholesale disabling of already trusted plugins like uBlock.
    - Yoric 8y ago
      Well, if you follow the OP, you'll realize that it's a bug and people are working to fix it :)
      - shstalwart 8y ago
        The bug is that plugins can't be manually enable. Nobody is working to fix that.
- deleted 8y ago
  [deleted]
deleted 8y ago
[deleted]
RpFLCL 8y ago
One result of this, when I use firefox from now on, I'll be disabling "Normandy"
oldjokes 8y ago
I have spent ~10 years using Firefox daily, tweaking the config and getting the addons set up the way I want. I was a professional web developer for most of those years. This is the first I have heard of Firefox changing my config settings invisibly in the background. This is obscene. Who on earth thought this was a good idea? The security ramifications are limitless. I understand all too well that most companies have decided to start A/B testing things on subsets of users, but that doesn't mean you should force that mode of thinking into everything. What a horrible decision. I don't recall ever seeing any news or notifications or checkboxes about studies or "Normandy" at any point. Are there some other good open source alternatives to Firefox? I remember hearing about Brave but also that it was tied into some cryptocoin nonsense, so I'm not sure what else to look at.
- syshum 8y ago
  >>This is the first I have heard of Firefox changing my config settings invisibly in the background. you must not have been paying attention the last 3 or so years Mozilla is doing all kinds of, IMO, unethical things with FireFox that goes against the core value of the mission statement of the Mozilla Foundation. They are too busy trying to replicate Chrome to care about privacy, security, or basic user rights
  - oldjokes 8y ago
    I read all about the DRM stuff but I figured that was just the awful standards boards being awful standards boards. I didn't realize what a true mess Mozilla had become.
    - syshum 8y ago
      Not just DRM Looking Glass, Pocket, Banning Plugins based on Political ideology, Backdoors like Normandy, and the STUDIES system, their creation of what amounts to Mozilla version of the Ministry of Truth, Their partnership with Cloudflare to send everyone's DNS to Cloudfare over HTTP, and whole host of other things
- jammygit 8y ago

bo1024 8y ago

Agree with this concern.

daleharvey 8y ago

> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout > What about a UI knob to disable it? app.normandy.enabled

inferiorhuman 8y ago
app.normandy.enabled That is not what I meant by a UI knob, and I sure hope you knew that. By UI knob I mean something easily discoverable and self-explanatory. Rooting around a gated (with a mighty strong warning, I should add) config section for something called "normandy" is not intuitive, and it's not self-explanatory. And I sure hope that by disclosed to users I did not mean some Hitchhiker's Guide-esque disclaimer on a wiki page. Something as (potentially) insidious as a preferences backdoor should absolutely be disclosed to users with the same level of visibility as the stories nonsense. Perhaps "normandy" is entirely harmless, but you guys lost a metric fuckton of credibility by using your backdoors to spam people[1]. Playing coy does nothing to improve your credibility or reputation. 1: https://www.theregister.co.uk/2017/12/18/mozilla_mr_robot_firefox_promotion/ https://www.theregister.co.uk/2017/12/18/mozilla_mr_robot_fi...
- dbrgn 8y ago
  I'm sorry to break it to you, but a fuckton is not actually part of the metric system...
  - CompuHacker 8y ago
    Well, it should be, but that's an entirely different discussion.
  - Redoubts 8y ago
    This unit modifier was specified under RFC 69420
oAlbe 8y ago
> app.normandy.enabled I fail to see both the "UI" and the "knob" part of this. Why is this not a checkbox in the preferences? Why do so many people not know about Normandy?
- deleted 8y ago
  [deleted]
lawl 8y ago
The UI knob is Options -> Privacy & Security > Allow Firefox to install and run studies They're using the studies system to push this hotfix faster for those that have it enabled. Edit: Source: See: https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disabled-or-fail-to-install/39047/14 https://discourse.mozilla.org/t/certificate-issue-causing-ad... > In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Preferences -> Privacy & Security -> Allow Firefox to install and run studies. Normandy seems to be the internal name for this system: https://github.com/mozilla/normandy https://github.com/mozilla/normandy
- inferiorhuman 8y ago
  No, it's not. This Normandy nonsense and stories are two separate, yet creepy features. I've already disabled stories but it looks like Mozilla still retains control of my preferences (without disclosing it).
  - vesinisa 8y ago
    I sure wonder how people so suspicious of Mozilla dare use their browser.
    - hyeonwho4 8y ago
      Setting preferences really should not be shocking, given that they have the capacity to run automatic updates. I'm more surprised that they can push code without certificates.
      - vesinisa 8y ago
        > I'm more surprised that they can push code without certificates. Where are you getting this from? AFAIK all Mozilla code / prefs they can push should be signed -- this very issue seems to stem from the cert used to sign AMO extensions expired.
      - Piskvorrr 8y ago
nanis 8y ago
>> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? > It will even be documented for them: That sounds like you do not think the concern is warranted. I've used Firefox since the first time it was available, and Netscape starting with the first ever betas. At no point was there a dialog that said "Do you want us to be able to change your browser settings remotely?" >> What about a UI knob to disable it? > app.normandy.enabled That is not a "UI knob" by any stretch of the imagination. Looking in about:config revealed: app.normandy.logging.level Is there a way to find out what is being logged and why? So, the question can be rephrased as "is the fact that Firefox has been logging all users' entire browsing history despite the fact that the user has not chosen to set up a Firefox account going to be disclosed?"
- Yoric 8y ago
  > So, the question can be rephrased as "is the fact that Firefox has been logging all users' entire browsing history despite the fact that the user has not chosen to set up a Firefox account going to be disclosed?" Chill out, this preference only determines what is logged locally (never sent to the server). It's a debugging tool. Sources: - https://searchfox.org/mozilla-central/source/toolkit/components/normandy/Normandy.jsm#32 https://searchfox.org/mozilla-central/source/toolkit/compone... - https://searchfox.org/mozilla-central/source/services/common/logmanager.js https://searchfox.org/mozilla-central/source/services/common...
  - rue 8y ago
    Look, at this point it’s not the user’s responsibility to “chill out”. It’s very much Firefox’s responsibility to try to repair their reputation by: 1. being completely transparent about all the mechanisms that data or code can be pushed to or pulled by the browser, or pushed from or pulled from the browser; and 2. having a toggle for all of them, yes every single one, in Privacy & Security.
tssva 8y ago
From the wiki entry. > Normandy Pref Rollout is a feature that allows Mozilla to change the default value of a preference for a targeted set of users, without deploying an update to Firefox. Rolling out a new certificate goes beyond changing the default value of a preference which rightly raises questions about what else Normandy allows which is not documented.

nanis 8y ago

This is the first I hear about Normandy[1]. Firefox has been my main browser for a long time, only because I could use uBlock origin. Now, all of a sudden that is disabled, and with the recent version they got rid of my ability to always prevent autoplaying of videos. Apparently, there is no one associated with browsers can be trusted in the least. [1]: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout

daleharvey 8y ago
In the recent version we added the ability to always prevent autoplaying of videos, in the next version we will be adding further UI to let the user disable all (not just muted) videos from autoplaying - https://bugzilla.mozilla.org/show_bug.cgi?id=1543812 https://bugzilla.mozilla.org/show_bug.cgi?id=1543812
- inferiorhuman 8y ago
  That does nothing to mitigate the wholesale disabling of already trusted plugins like uBlock.
  - Yoric 8y ago
    Well, if you follow the OP, you'll realize that it's a bug and people are working to fix it :)
    - shstalwart 8y ago
      The bug is that plugins can't be manually enable. Nobody is working to fix that.
deleted 8y ago
[deleted]

deleted 8y ago

[deleted]

RpFLCL 8y ago

One result of this, when I use firefox from now on, I'll be disabling "Normandy"

oldjokes 8y ago

I have spent ~10 years using Firefox daily, tweaking the config and getting the addons set up the way I want. I was a professional web developer for most of those years. This is the first I have heard of Firefox changing my config settings invisibly in the background. This is obscene. Who on earth thought this was a good idea? The security ramifications are limitless. I understand all too well that most companies have decided to start A/B testing things on subsets of users, but that doesn't mean you should force that mode of thinking into everything. What a horrible decision. I don't recall ever seeing any news or notifications or checkboxes about studies or "Normandy" at any point. Are there some other good open source alternatives to Firefox? I remember hearing about Brave but also that it was tied into some cryptocoin nonsense, so I'm not sure what else to look at.

syshum 8y ago
>>This is the first I have heard of Firefox changing my config settings invisibly in the background. you must not have been paying attention the last 3 or so years Mozilla is doing all kinds of, IMO, unethical things with FireFox that goes against the core value of the mission statement of the Mozilla Foundation. They are too busy trying to replicate Chrome to care about privacy, security, or basic user rights
- oldjokes 8y ago
  I read all about the DRM stuff but I figured that was just the awful standards boards being awful standards boards. I didn't realize what a true mess Mozilla had become.
  - syshum 8y ago
    Not just DRM Looking Glass, Pocket, Banning Plugins based on Political ideology, Backdoors like Normandy, and the STUDIES system, their creation of what amounts to Mozilla version of the Ministry of Truth, Their partnership with Cloudflare to send everyone's DNS to Cloudfare over HTTP, and whole host of other things
jammygit 8y ago