11 ms·

Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains: - why am I opted-in

Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains: - why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) - what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies program? - why can't we see any xpi's installed by studies program unless we explicitly go to about:studies? I don't say chromium is better, but I think we deserve an explanation regarding these points.

brendyn 7y ago
Consider running Icecat. It's most convenient to use it by installing a fully libre distribution such as Parabola or Guix System. Distributions which respect the FSDG don't just exclude proprietary software, but actually take software like Firefox which is 99% libre, and chucks out the last 1% of junk, improving many defaults. You're unlikely to have ethical qualms with such an Icecat. https://www.gnu.org/software/gnuzilla/ https://www.gnu.org/software/gnuzilla/ You can see how it's made here: https://git.savannah.gnu.org/cgit/gnuzilla.git/tree/makeicecat https://git.savannah.gnu.org/cgit/gnuzilla.git/tree/makeicec... Note that it looks like it disables sync, but that should still work, and you can add whatever addons you like.
ntp85 7y ago
This might be a stupid question, but have you asked them through their support or social media channels yet?
- f4stjack 7y ago
  I did from twitter, no answer yet. And I think this is an answer owed to all of the users - not just me.
  - ntp85 7y ago
    Absolutely, I didn't necessarily want to disagree with you and was just asking.
napsterbr 7y ago
> why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) I came here to mention exactly this. I don't mind the certificate issue (as long as there is a post mortem and they learn something from it). I was wondering how my addons came back automatically (without me having to upgrade to 66.0.4) and I found out about this studies thing, which I never consented to. I feel violated. And the problem is, what browser am I supposed to use from now on? Lynx? Sigh ETA: I am (was) a proud Firefox user since it was called Firebird, and changing browsers never crossed my mind before (even if Chrome felt faster some times). At this exact moment, I have zero trust on Mozilla, just like I have zero trust on Google (Chrome). Extremely frustrated and disappointed.
- sequence7 7y ago
  You could just turn off all studies in Firefox. It's a simple option: https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-all-studies https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...
  - Crontab 7y ago
    That's not enough. Opt-out features are wrong because organizations/companies know that most people won't pay attention or not fully appreciate the dangers of it.
    - reciprocity 7y ago
      What would you propose?
      - manigandham 7y ago
        Opt-in. Firefox is all about informed choice, it seems people want them to stick to it.
  - pbhjpbhj 7y ago
    They can just flip the option or create a version of studies called "enquiries" or force a new addon that you can't remove in the next update .. 3 years ago you'd think Mozilla wouldn't ever imagine doing things like that.
scoutt 7y ago
It is interesting the quantity of studies they push to their opted-in normandy students. Take a look at https://normandy.cdn.mozilla.net/api/v1/recipe/ https://normandy.cdn.mozilla.net/api/v1/recipe/ Looking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience Mozilla wants to know more about knowledge and opinions of news on the Web. Etc. There are also links to what seems to be internal documentation. It shocked me the interest and the infrastructure they have just for collecting information. This is not just a couple of developers trying to figure out what feature is used and/or studying bugs.
sam_goody 7y ago
Chromium is definitely worse. While these deserve an explanation, you should not wait to move. Chrome is spyware that does web browsing. It's parent company also shows ads, all the time. Chrome's auto update not only allows them to silently update or change your browser, it allows them to silently install other software on your computer. Firefox is a browser. It can auto-update in a way that may be questionable, but it also has a lot of cranky devs looking over their shoulder to call them out years later because Mr. Robot may have been able to show them an ad. FF deserves to be called out on their mistakes, and need offer an explanation. But perspective! Why would you not move now?
- pbhjpbhj 7y ago
  Google still pay for Firefox; about $2 per user. So, Chrome and Firefox are funded by the same people. In fact Google upped the money they're paying despite FF's falling users share, what are they getting for their money - I doubt they're giving it out of charity. It's like price differentiation, I feel. FF is for people who want to avoid Google, but Google are paying to get privacy-infringement lite. Who knows what else besides being default search provider, and getting every search you type in through search suggestions, they're getting for their money? >cranky devs looking over their shoulder to call them out years later because Mr. Robot may have been able to show them an ad // Way to underplay things. Do Chrome change their UI (ie chrome) to ad advertising? Do they force add-ons on people that are unremovable in order to advertise a product? And then update, re-placing the advert into users chrome who've removed it? Do they blank out users home-screen settings in order to add advertising? (I think they did do that one?) Chrome may be spyware, but default so is FF. And Mozilla have shown they're more than happy to mess around with their users browsers for advertising/promotions. Aside: how is Chromium worse? Waterfox is looking like a good option.
- diegoperini 7y ago
  I've been reading lot of comments like the parent lately. Thanks for voicing my thoughts.
- andai 7y ago
  I want the ethics of Firefox and the speed / user experience (eg. select & move multiple tabs) of Chrome, so I moved to Brave. It's a Chromium fork that's a bit more Firefoxy -- made by Brendan Eich, former Mozilla CEO and inventor of JS, (eg has the "Switch to Open Tab" feature I love from FF), although there's some cryptocurrency stuff thrown in that I'm not a fan of, but so far it feels like a net positive over both FF and Chrome. It's very privacy oriented, to such a degree that it actually breaks a lot of websites (but you can disable the shields easy).
krageon 7y ago
Chromium has a working exploit (AFAIK it still is not patched) that allows third-party code to masquerade as first-party code. Unless you run a special addon[1], you are vulnerable to this. The fact that I still can't find that it's patched now tells me nothing good about the health of the ecosystem and who it is meant to serve. That should be all the reason you need to switch to Firefox, which admittedly also has huge warts but to my mind ones that aren't quite so egregious. [1] https://chrome.google.com/webstore/detail/ublock-origin-extra/pgdnlhfefecpicbbihgmbmffkjpaplco?hl=en https://chrome.google.com/webstore/detail/ublock-origin-extr...
- f4stjack 7y ago
  Wow this is... scary and you say it is still not patched? Thank you.
- pbhjpbhj 7y ago
  You make it sound like it's a third-party RCE; but it's a cookie bypass, so it's tracking -- that's serious still [and the implementation sounds illegal to me]. The companies Instart Manager (used by cnet, tomshardware, etc., see link) and Upmanager that are doing this workaround of ublock -- are they not able to attack other browsers, only Chromium? I guess one benefit of being the biggest advertising company is that people don't want to mess with Google's stuff in case they suffer financial repercussions. https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO-Extra-is-useful https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO...
  - krageon 7y ago
    > workaround of ublock This has nothing to do with ublock origin specifically, ublock origin's author just happens to have a band-aid for this exploit. Assuming I don't misunderstand what is happening, any other blocking plugin is vulnerable as well. > people don't want to mess with Google's stuff I don't understand what you're saying. Chromium is vulnerable and by extension, so is Chrome. Edit: > You make it sound like it's a third-party RCE I don't think I am. I said third-party code looks like first-party code, that is precisely what is happening.
mstg 7y ago
I switched to FF a couple of months ago, and was not opted in to Studies automatically. I'm based in Norway though so maybe GDPR had something to say. I had to opt-in to Studies to fix the certificate issue.
vansteen 7y ago
"To provide this fix on short notice, we are using the Studies system. This system is enabled by default, and no action is needed unless Studies have been disabled. [..] It may take up to six hours for the Study to be applied to Firefox. To check if the fix has been applied, you can enter “about:studies” in the location bar... " https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/ https://blog.mozilla.org/addons/2019/05/04/update-regarding-...
shthed 7y ago
Chrome has studies too, called field trials. https://blog.chromium.org/2012/05/changes-to-field-trials-infrastructure.html https://blog.chromium.org/2012/05/changes-to-field-trials-in...

brendyn 7y ago

Consider running Icecat. It's most convenient to use it by installing a fully libre distribution such as Parabola or Guix System. Distributions which respect the FSDG don't just exclude proprietary software, but actually take software like Firefox which is 99% libre, and chucks out the last 1% of junk, improving many defaults. You're unlikely to have ethical qualms with such an Icecat. https://www.gnu.org/software/gnuzilla/ https://www.gnu.org/software/gnuzilla/ You can see how it's made here: https://git.savannah.gnu.org/cgit/gnuzilla.git/tree/makeicecat https://git.savannah.gnu.org/cgit/gnuzilla.git/tree/makeicec... Note that it looks like it disables sync, but that should still work, and you can add whatever addons you like.

ntp85 7y ago

This might be a stupid question, but have you asked them through their support or social media channels yet?

f4stjack 7y ago
I did from twitter, no answer yet. And I think this is an answer owed to all of the users - not just me.
- ntp85 7y ago
  Absolutely, I didn't necessarily want to disagree with you and was just asking.

napsterbr 7y ago

> why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) I came here to mention exactly this. I don't mind the certificate issue (as long as there is a post mortem and they learn something from it). I was wondering how my addons came back automatically (without me having to upgrade to 66.0.4) and I found out about this studies thing, which I never consented to. I feel violated. And the problem is, what browser am I supposed to use from now on? Lynx? Sigh ETA: I am (was) a proud Firefox user since it was called Firebird, and changing browsers never crossed my mind before (even if Chrome felt faster some times). At this exact moment, I have zero trust on Mozilla, just like I have zero trust on Google (Chrome). Extremely frustrated and disappointed.

sequence7 7y ago
You could just turn off all studies in Firefox. It's a simple option: https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-all-studies https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...
- Crontab 7y ago
  That's not enough. Opt-out features are wrong because organizations/companies know that most people won't pay attention or not fully appreciate the dangers of it.
  - reciprocity 7y ago
    What would you propose?
    - manigandham 7y ago
      Opt-in. Firefox is all about informed choice, it seems people want them to stick to it.
- pbhjpbhj 7y ago
  They can just flip the option or create a version of studies called "enquiries" or force a new addon that you can't remove in the next update .. 3 years ago you'd think Mozilla wouldn't ever imagine doing things like that.

scoutt 7y ago

It is interesting the quantity of studies they push to their opted-in normandy students. Take a look at https://normandy.cdn.mozilla.net/api/v1/recipe/ https://normandy.cdn.mozilla.net/api/v1/recipe/ Looking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience Mozilla wants to know more about knowledge and opinions of news on the Web. Etc. There are also links to what seems to be internal documentation. It shocked me the interest and the infrastructure they have just for collecting information. This is not just a couple of developers trying to figure out what feature is used and/or studying bugs.

sam_goody 7y ago

Chromium is definitely worse. While these deserve an explanation, you should not wait to move. Chrome is spyware that does web browsing. It's parent company also shows ads, all the time. Chrome's auto update not only allows them to silently update or change your browser, it allows them to silently install other software on your computer. Firefox is a browser. It can auto-update in a way that may be questionable, but it also has a lot of cranky devs looking over their shoulder to call them out years later because Mr. Robot may have been able to show them an ad. FF deserves to be called out on their mistakes, and need offer an explanation. But perspective! Why would you not move now?

pbhjpbhj 7y ago
Google still pay for Firefox; about $2 per user. So, Chrome and Firefox are funded by the same people. In fact Google upped the money they're paying despite FF's falling users share, what are they getting for their money - I doubt they're giving it out of charity. It's like price differentiation, I feel. FF is for people who want to avoid Google, but Google are paying to get privacy-infringement lite. Who knows what else besides being default search provider, and getting every search you type in through search suggestions, they're getting for their money? >cranky devs looking over their shoulder to call them out years later because Mr. Robot may have been able to show them an ad // Way to underplay things. Do Chrome change their UI (ie chrome) to ad advertising? Do they force add-ons on people that are unremovable in order to advertise a product? And then update, re-placing the advert into users chrome who've removed it? Do they blank out users home-screen settings in order to add advertising? (I think they did do that one?) Chrome may be spyware, but default so is FF. And Mozilla have shown they're more than happy to mess around with their users browsers for advertising/promotions. Aside: how is Chromium worse? Waterfox is looking like a good option.
diegoperini 7y ago
I've been reading lot of comments like the parent lately. Thanks for voicing my thoughts.
andai 7y ago
I want the ethics of Firefox and the speed / user experience (eg. select & move multiple tabs) of Chrome, so I moved to Brave. It's a Chromium fork that's a bit more Firefoxy -- made by Brendan Eich, former Mozilla CEO and inventor of JS, (eg has the "Switch to Open Tab" feature I love from FF), although there's some cryptocurrency stuff thrown in that I'm not a fan of, but so far it feels like a net positive over both FF and Chrome. It's very privacy oriented, to such a degree that it actually breaks a lot of websites (but you can disable the shields easy).

krageon 7y ago

Chromium has a working exploit (AFAIK it still is not patched) that allows third-party code to masquerade as first-party code. Unless you run a special addon[1], you are vulnerable to this. The fact that I still can't find that it's patched now tells me nothing good about the health of the ecosystem and who it is meant to serve. That should be all the reason you need to switch to Firefox, which admittedly also has huge warts but to my mind ones that aren't quite so egregious. [1] https://chrome.google.com/webstore/detail/ublock-origin-extra/pgdnlhfefecpicbbihgmbmffkjpaplco?hl=en https://chrome.google.com/webstore/detail/ublock-origin-extr...

f4stjack 7y ago
Wow this is... scary and you say it is still not patched? Thank you.
pbhjpbhj 7y ago
You make it sound like it's a third-party RCE; but it's a cookie bypass, so it's tracking -- that's serious still [and the implementation sounds illegal to me]. The companies Instart Manager (used by cnet, tomshardware, etc., see link) and Upmanager that are doing this workaround of ublock -- are they not able to attack other browsers, only Chromium? I guess one benefit of being the biggest advertising company is that people don't want to mess with Google's stuff in case they suffer financial repercussions. https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO-Extra-is-useful https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO...
- krageon 7y ago
  > workaround of ublock This has nothing to do with ublock origin specifically, ublock origin's author just happens to have a band-aid for this exploit. Assuming I don't misunderstand what is happening, any other blocking plugin is vulnerable as well. > people don't want to mess with Google's stuff I don't understand what you're saying. Chromium is vulnerable and by extension, so is Chrome. Edit: > You make it sound like it's a third-party RCE I don't think I am. I said third-party code looks like first-party code, that is precisely what is happening.

mstg 7y ago

I switched to FF a couple of months ago, and was not opted in to Studies automatically. I'm based in Norway though so maybe GDPR had something to say. I had to opt-in to Studies to fix the certificate issue.

vansteen 7y ago

"To provide this fix on short notice, we are using the Studies system. This system is enabled by default, and no action is needed unless Studies have been disabled. [..] It may take up to six hours for the Study to be applied to Firefox. To check if the fix has been applied, you can enter “about:studies” in the location bar... " https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/ https://blog.mozilla.org/addons/2019/05/04/update-regarding-...

shthed 7y ago

Chrome has studies too, called field trials. https://blog.chromium.org/2012/05/changes-to-field-trials-infrastructure.html https://blog.chromium.org/2012/05/changes-to-field-trials-in...