5 ms·

> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https:

> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? It will even be documented for them: https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout > What about a UI knob to disable it? app.normandy.enabled

inferiorhuman 7y ago
app.normandy.enabled That is not what I meant by a UI knob, and I sure hope you knew that. By UI knob I mean something easily discoverable and self-explanatory. Rooting around a gated (with a mighty strong warning, I should add) config section for something called "normandy" is not intuitive, and it's not self-explanatory. And I sure hope that by disclosed to users I did not mean some Hitchhiker's Guide-esque disclaimer on a wiki page. Something as (potentially) insidious as a preferences backdoor should absolutely be disclosed to users with the same level of visibility as the stories nonsense. Perhaps "normandy" is entirely harmless, but you guys lost a metric fuckton of credibility by using your backdoors to spam people[1]. Playing coy does nothing to improve your credibility or reputation. 1: https://www.theregister.co.uk/2017/12/18/mozilla_mr_robot_firefox_promotion/ https://www.theregister.co.uk/2017/12/18/mozilla_mr_robot_fi...
- dbrgn 7y ago
  I'm sorry to break it to you, but a fuckton is not actually part of the metric system...
  - CompuHacker 7y ago
    Well, it should be, but that's an entirely different discussion.
  - Redoubts 7y ago
    This unit modifier was specified under RFC 69420
oAlbe 7y ago
> app.normandy.enabled I fail to see both the "UI" and the "knob" part of this. Why is this not a checkbox in the preferences? Why do so many people not know about Normandy?
- deleted 7y ago
  [deleted]
lawl 7y ago
The UI knob is Options -> Privacy & Security > Allow Firefox to install and run studies They're using the studies system to push this hotfix faster for those that have it enabled. Edit: Source: See: https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disabled-or-fail-to-install/39047/14 https://discourse.mozilla.org/t/certificate-issue-causing-ad... > In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Preferences -> Privacy & Security -> Allow Firefox to install and run studies. Normandy seems to be the internal name for this system: https://github.com/mozilla/normandy https://github.com/mozilla/normandy
- inferiorhuman 7y ago
  No, it's not. This Normandy nonsense and stories are two separate, yet creepy features. I've already disabled stories but it looks like Mozilla still retains control of my preferences (without disclosing it).
  - vesinisa 7y ago
    I sure wonder how people so suspicious of Mozilla dare use their browser.
    - hyeonwho4 7y ago
      Setting preferences really should not be shocking, given that they have the capacity to run automatic updates. I'm more surprised that they can push code without certificates.
      - vesinisa 7y ago
        > I'm more surprised that they can push code without certificates. Where are you getting this from? AFAIK all Mozilla code / prefs they can push should be signed -- this very issue seems to stem from the cert used to sign AMO extensions expired.
      - Piskvorrr 7y ago
nanis 7y ago
>> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? > It will even be documented for them: That sounds like you do not think the concern is warranted. I've used Firefox since the first time it was available, and Netscape starting with the first ever betas. At no point was there a dialog that said "Do you want us to be able to change your browser settings remotely?" >> What about a UI knob to disable it? > app.normandy.enabled That is not a "UI knob" by any stretch of the imagination. Looking in about:config revealed: app.normandy.logging.level Is there a way to find out what is being logged and why? So, the question can be rephrased as "is the fact that Firefox has been logging all users' entire browsing history despite the fact that the user has not chosen to set up a Firefox account going to be disclosed?"
- Yoric 7y ago
  > So, the question can be rephrased as "is the fact that Firefox has been logging all users' entire browsing history despite the fact that the user has not chosen to set up a Firefox account going to be disclosed?" Chill out, this preference only determines what is logged locally (never sent to the server). It's a debugging tool. Sources: - https://searchfox.org/mozilla-central/source/toolkit/components/normandy/Normandy.jsm#32 https://searchfox.org/mozilla-central/source/toolkit/compone... - https://searchfox.org/mozilla-central/source/services/common/logmanager.js https://searchfox.org/mozilla-central/source/services/common...
  - rue 7y ago
    Look, at this point it’s not the user’s responsibility to “chill out”. It’s very much Firefox’s responsibility to try to repair their reputation by: 1. being completely transparent about all the mechanisms that data or code can be pushed to or pulled by the browser, or pushed from or pulled from the browser; and 2. having a toggle for all of them, yes every single one, in Privacy & Security.
tssva 7y ago
From the wiki entry. > Normandy Pref Rollout is a feature that allows Mozilla to change the default value of a preference for a targeted set of users, without deploying an update to Firefox. Rolling out a new certificate goes beyond changing the default value of a preference which rightly raises questions about what else Normandy allows which is not documented.

inferiorhuman 7y ago

app.normandy.enabled That is not what I meant by a UI knob, and I sure hope you knew that. By UI knob I mean something easily discoverable and self-explanatory. Rooting around a gated (with a mighty strong warning, I should add) config section for something called "normandy" is not intuitive, and it's not self-explanatory. And I sure hope that by disclosed to users I did not mean some Hitchhiker's Guide-esque disclaimer on a wiki page. Something as (potentially) insidious as a preferences backdoor should absolutely be disclosed to users with the same level of visibility as the stories nonsense. Perhaps "normandy" is entirely harmless, but you guys lost a metric fuckton of credibility by using your backdoors to spam people[1]. Playing coy does nothing to improve your credibility or reputation. 1: https://www.theregister.co.uk/2017/12/18/mozilla_mr_robot_firefox_promotion/ https://www.theregister.co.uk/2017/12/18/mozilla_mr_robot_fi...

dbrgn 7y ago
I'm sorry to break it to you, but a fuckton is not actually part of the metric system...
- CompuHacker 7y ago
  Well, it should be, but that's an entirely different discussion.
- Redoubts 7y ago
  This unit modifier was specified under RFC 69420

oAlbe 7y ago

> app.normandy.enabled I fail to see both the "UI" and the "knob" part of this. Why is this not a checkbox in the preferences? Why do so many people not know about Normandy?

deleted 7y ago
[deleted]

lawl 7y ago

The UI knob is Options -> Privacy & Security > Allow Firefox to install and run studies They're using the studies system to push this hotfix faster for those that have it enabled. Edit: Source: See: https://discourse.mozilla.org/t/certificate-issue-causing-add-ons-to-be-disabled-or-fail-to-install/39047/14 https://discourse.mozilla.org/t/certificate-issue-causing-ad... > In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by going to Firefox Preferences -> Privacy & Security -> Allow Firefox to install and run studies. Normandy seems to be the internal name for this system: https://github.com/mozilla/normandy https://github.com/mozilla/normandy

inferiorhuman 7y ago
No, it's not. This Normandy nonsense and stories are two separate, yet creepy features. I've already disabled stories but it looks like Mozilla still retains control of my preferences (without disclosing it).
- vesinisa 7y ago
  I sure wonder how people so suspicious of Mozilla dare use their browser.
  - hyeonwho4 7y ago
    Setting preferences really should not be shocking, given that they have the capacity to run automatic updates. I'm more surprised that they can push code without certificates.
    - vesinisa 7y ago
      > I'm more surprised that they can push code without certificates. Where are you getting this from? AFAIK all Mozilla code / prefs they can push should be signed -- this very issue seems to stem from the cert used to sign AMO extensions expired.
    - Piskvorrr 7y ago

nanis 7y ago

>> Is the existence of a back door method of updating Firefox preferences something that will be disclosed to users? > It will even be documented for them: That sounds like you do not think the concern is warranted. I've used Firefox since the first time it was available, and Netscape starting with the first ever betas. At no point was there a dialog that said "Do you want us to be able to change your browser settings remotely?" >> What about a UI knob to disable it? > app.normandy.enabled That is not a "UI knob" by any stretch of the imagination. Looking in about:config revealed: app.normandy.logging.level Is there a way to find out what is being logged and why? So, the question can be rephrased as "is the fact that Firefox has been logging all users' entire browsing history despite the fact that the user has not chosen to set up a Firefox account going to be disclosed?"

Yoric 7y ago
> So, the question can be rephrased as "is the fact that Firefox has been logging all users' entire browsing history despite the fact that the user has not chosen to set up a Firefox account going to be disclosed?" Chill out, this preference only determines what is logged locally (never sent to the server). It's a debugging tool. Sources: - https://searchfox.org/mozilla-central/source/toolkit/components/normandy/Normandy.jsm#32 https://searchfox.org/mozilla-central/source/toolkit/compone... - https://searchfox.org/mozilla-central/source/services/common/logmanager.js https://searchfox.org/mozilla-central/source/services/common...
- rue 7y ago
  Look, at this point it’s not the user’s responsibility to “chill out”. It’s very much Firefox’s responsibility to try to repair their reputation by: 1. being completely transparent about all the mechanisms that data or code can be pushed to or pulled by the browser, or pushed from or pulled from the browser; and 2. having a toggle for all of them, yes every single one, in Privacy & Security.

tssva 7y ago

From the wiki entry. > Normandy Pref Rollout is a feature that allows Mozilla to change the default value of a preference for a targeted set of users, without deploying an update to Firefox. Rolling out a new certificate goes beyond changing the default value of a preference which rightly raises questions about what else Normandy allows which is not documented.