14 ms·

I know Firefox isn't being malicious, but ugh, this seems like the worst possible PR move for this, optics wise. "Hey so uh, we accidentally broke your browser,

I know Firefox isn't being malicious, but ugh, this seems like the worst possible PR move for this, optics wise. "Hey so uh, we accidentally broke your browser, so you need to opt-in to becoming a guinney pig. But don't worry! You probably were already opted in anyway and just didn't realize it! Also it might take six hours to work."

floatingatoll 8y ago
They only point out the opt-in instructions for the few people that voluntarily opt out of Shield studies and wish to get the fix sooner. Most Firefox users have that checkbox enabled by default, and so most Firefox users received the fix within 0-6 hours of the blog post's publication. HN readers often take special care to prevent Mozilla from updating Firefox, but that in no way represents the wider population of either all addons users or all Firefox users.
- toyg 8y ago
  This has nothing to do with "studies" and should be pushed as a general fix. There is just no excuse. What if this had been a security incident?
  - floatingatoll 8y ago
    Then it seems it’s a good thing they had a system in place that could deliver the quick fix in less than a day, on a Friday evening, when shipping a normal fix could have — is — taking longer to ship than that quick fix did.
    - toyg 8y ago
      > it’s a good thing they had a system in place that could deliver the quick fix No, it's not. "Studies" is not a security-related mechanism and it didn't exist in the past, when fixes were rolled out very quickly anyway for security reasons. "Studies" should not be relied on to be a fix-delivery mechanism, because it just isn't. This is not even about privacy, it's simple good engineering sense.
      - floatingatoll 8y ago
        It seems like your objection to the Normandy system is that the UX surrounding it includes the word “Studies”. I am grateful they chose in this instance to prioritize repairing addons worldwide over the confusion that word has caused you and potentially others. I assume, having seen this and other such comments delivered with outrage rather than thankfulness today, that they will re-evaluate the UX surrounding the Normandy system to ensure that it more clearly designates non-study changes as such.
        toyg 8y ago
        It's not about designation, it's about control. If Mozilla really cares about trust, they shouldn't mix their update delivery system, which should care for timely security-related material, with general telemetry, data-gathering, and experiments. I use FF because I care about principles. Otherwise I might as well just let myself be exploited by Google, MS, Apple and friends.
        floatingatoll 8y ago
        Ah, you object to Normandy’s design in some manner. That’s being hashed out in today’s Normandy thread, and if you haven’t already read that link you’ll definitely want to: https://news.ycombinator.com/item?id=19825830 https://news.ycombinator.com/item?id=19825830 (While of course you’re welcome to continue pursuing your issues with it here, your opinions will receive more views there.)
    - moontear 8y ago
      Why does it take longer to ship a general fix / update? They don’t do a full regression for the studies fix? Update mechanism doesn’t check for updates as often? I couldn’t find any information on this yet but would love to know.
      - floatingatoll 8y ago
        “How long does it take to build, unit test, performance test, and QA check a new Firefox release on every supported release of macOS, Windows, and Linux platform?” is absolutely a question that outraged users are trying not to confront. You’re right to ask it, so don’t let the downvotes get you down. Presumably the testing burden for a preference update using Normandy is smaller, as (and I’m guessing wildly here) fewer things can be altered with Normandy and therefore testing can be simplified to exclude, for made-up example, “the code-signed binary can be executed on all platforms”.
        moontear 8y ago
        Sounds reasonable to me. Would love too see that information on the official Mozilla blog for the post-mortem. I personally think it is great to have a mechanism to push fixes quickly - whatever the name is. I just don't understand why this mechanism can't be the regular update mechanism.
usecontainers 8y ago
So that's pretty unfair. 1) They state they are working on a fix for normal, release channel users who don't want to run studies 2) they tell you to temporarily run studies to get the fix within up to 6 six hours (could be faster; set expectation) 3) You can explicitly install nightly or 66.4 before it's pushed if you want a fix now Yes, it's unfortunate, I'd expect them to meet it head on, push a tested fix in a timely matter, admit a mistake was made, explain publicly how/why and apply learning moving forward. Beyond that, what's your expectation?
- Aeolun 8y ago
  My expectation is that something like this doesn’t happen in the first place. Given that it has happened, I expect them to provision a new certificate and push a fixed version within an hour or two to all release channels. What I would emphatically ‘not’ expect, is a hack that might take up to 6 hours to be applied.
- overgard 8y ago
  Not saying that their current actions are wrong, just that the optics of it are terrible for them. There was a chain of bad decisions that led them here though: 1) thinking it's ok to disable software after its installed (using cert expiration -- I'm ok if the cert was revoked but that's a totally different discussion), 2) Taking more control of people's local software than many people are comfortable with, especially considering that their main market is tech savvy people that tend to be more sensitive to this than most 3) Making some of these things opt-out rather than opt-in, giving the perception that they may value data collection and control more than their users privacy.
  - Vinnl 8y ago
    > their main market is tech savvy people that tend to be more sensitive to this than most Is that so, though? Firefox is still being used by millions of users, and I doubt those are only the tech savvy internet users. (Then again, this mostly applies to Firefox users using add-ons, which probably has a higher share of technical users.)
nsomaru 8y ago
On Debian the distributed ESR has that option greyed out anyways. Maybe we’ll have to wait for maintainers to push an update?
- gkya 8y ago
  I am sure an update will be pushed quickly. I'm waiting too, as a testing user. You can fix this temporarily via setting "xpinstall.signatures.required" to false. Toggle it back to true once update is released and you install it. Meanwhile I'm hijacking this comment that is to the upper parts of the tree to state this: the way the community treats Mozilla and Firefox is horribly, inexplicably, unacceptably unfair. This is nothing compared to innumerable other fuckups in software history, and even recent ones like goto fail, heartbleed, or Chrome logging you into Sync w/o notice. This is a mistake, an easily recoverable one, and is not intentional or malicious. Firefox is developed in the out and open, all the processes are public. And people, with an absurd entitlement and malice, go as far as to call things backdoors or malware. Meanwhile the alternative actually is a backdoor ridden malware. Please don't be this ungrateful.
  - a1369209993 8y ago
    > This is a mistake, an easily recoverable one, and is not intentional or malicious. While I agree with most of your comment, you're downplaying the severity here, especially since, IIUC, this situation also affected the Tor browser, disabling NoScript. If regimes like China were on the ball, and succeeded in escalating the remote code execution vulnerability into into deanonimization, this debacle may end up having a death toll attached to it.

floatingatoll 8y ago

They only point out the opt-in instructions for the few people that voluntarily opt out of Shield studies and wish to get the fix sooner. Most Firefox users have that checkbox enabled by default, and so most Firefox users received the fix within 0-6 hours of the blog post's publication. HN readers often take special care to prevent Mozilla from updating Firefox, but that in no way represents the wider population of either all addons users or all Firefox users.

toyg 8y ago
This has nothing to do with "studies" and should be pushed as a general fix. There is just no excuse. What if this had been a security incident?
- floatingatoll 8y ago
  Then it seems it’s a good thing they had a system in place that could deliver the quick fix in less than a day, on a Friday evening, when shipping a normal fix could have — is — taking longer to ship than that quick fix did.
  - toyg 8y ago
    > it’s a good thing they had a system in place that could deliver the quick fix No, it's not. "Studies" is not a security-related mechanism and it didn't exist in the past, when fixes were rolled out very quickly anyway for security reasons. "Studies" should not be relied on to be a fix-delivery mechanism, because it just isn't. This is not even about privacy, it's simple good engineering sense.
    - floatingatoll 8y ago
      It seems like your objection to the Normandy system is that the UX surrounding it includes the word “Studies”. I am grateful they chose in this instance to prioritize repairing addons worldwide over the confusion that word has caused you and potentially others. I assume, having seen this and other such comments delivered with outrage rather than thankfulness today, that they will re-evaluate the UX surrounding the Normandy system to ensure that it more clearly designates non-study changes as such.
      - toyg 8y ago
        It's not about designation, it's about control. If Mozilla really cares about trust, they shouldn't mix their update delivery system, which should care for timely security-related material, with general telemetry, data-gathering, and experiments. I use FF because I care about principles. Otherwise I might as well just let myself be exploited by Google, MS, Apple and friends.
        floatingatoll 8y ago
        Ah, you object to Normandy’s design in some manner. That’s being hashed out in today’s Normandy thread, and if you haven’t already read that link you’ll definitely want to: https://news.ycombinator.com/item?id=19825830 https://news.ycombinator.com/item?id=19825830 (While of course you’re welcome to continue pursuing your issues with it here, your opinions will receive more views there.)
  - moontear 8y ago
    Why does it take longer to ship a general fix / update? They don’t do a full regression for the studies fix? Update mechanism doesn’t check for updates as often? I couldn’t find any information on this yet but would love to know.
    - floatingatoll 8y ago
      “How long does it take to build, unit test, performance test, and QA check a new Firefox release on every supported release of macOS, Windows, and Linux platform?” is absolutely a question that outraged users are trying not to confront. You’re right to ask it, so don’t let the downvotes get you down. Presumably the testing burden for a preference update using Normandy is smaller, as (and I’m guessing wildly here) fewer things can be altered with Normandy and therefore testing can be simplified to exclude, for made-up example, “the code-signed binary can be executed on all platforms”.
      - moontear 8y ago
        Sounds reasonable to me. Would love too see that information on the official Mozilla blog for the post-mortem. I personally think it is great to have a mechanism to push fixes quickly - whatever the name is. I just don't understand why this mechanism can't be the regular update mechanism.

usecontainers 8y ago

So that's pretty unfair. 1) They state they are working on a fix for normal, release channel users who don't want to run studies 2) they tell you to temporarily run studies to get the fix within up to 6 six hours (could be faster; set expectation) 3) You can explicitly install nightly or 66.4 before it's pushed if you want a fix now Yes, it's unfortunate, I'd expect them to meet it head on, push a tested fix in a timely matter, admit a mistake was made, explain publicly how/why and apply learning moving forward. Beyond that, what's your expectation?

Aeolun 8y ago
My expectation is that something like this doesn’t happen in the first place. Given that it has happened, I expect them to provision a new certificate and push a fixed version within an hour or two to all release channels. What I would emphatically ‘not’ expect, is a hack that might take up to 6 hours to be applied.
overgard 8y ago
Not saying that their current actions are wrong, just that the optics of it are terrible for them. There was a chain of bad decisions that led them here though: 1) thinking it's ok to disable software after its installed (using cert expiration -- I'm ok if the cert was revoked but that's a totally different discussion), 2) Taking more control of people's local software than many people are comfortable with, especially considering that their main market is tech savvy people that tend to be more sensitive to this than most 3) Making some of these things opt-out rather than opt-in, giving the perception that they may value data collection and control more than their users privacy.
- Vinnl 8y ago
  > their main market is tech savvy people that tend to be more sensitive to this than most Is that so, though? Firefox is still being used by millions of users, and I doubt those are only the tech savvy internet users. (Then again, this mostly applies to Firefox users using add-ons, which probably has a higher share of technical users.)

nsomaru 8y ago

On Debian the distributed ESR has that option greyed out anyways. Maybe we’ll have to wait for maintainers to push an update?

gkya 8y ago
I am sure an update will be pushed quickly. I'm waiting too, as a testing user. You can fix this temporarily via setting "xpinstall.signatures.required" to false. Toggle it back to true once update is released and you install it. Meanwhile I'm hijacking this comment that is to the upper parts of the tree to state this: the way the community treats Mozilla and Firefox is horribly, inexplicably, unacceptably unfair. This is nothing compared to innumerable other fuckups in software history, and even recent ones like goto fail, heartbleed, or Chrome logging you into Sync w/o notice. This is a mistake, an easily recoverable one, and is not intentional or malicious. Firefox is developed in the out and open, all the processes are public. And people, with an absurd entitlement and malice, go as far as to call things backdoors or malware. Meanwhile the alternative actually is a backdoor ridden malware. Please don't be this ungrateful.
- a1369209993 8y ago
  > This is a mistake, an easily recoverable one, and is not intentional or malicious. While I agree with most of your comment, you're downplaying the severity here, especially since, IIUC, this situation also affected the Tor browser, disabling NoScript. If regimes like China were on the ball, and succeeded in escalating the remote code execution vulnerability into into deanonimization, this debacle may end up having a death toll attached to it.