6 ms·

It is not clear what is best for the general public. You can aim for the "safest" choice, which seems to be what you are advocating. If so, it needs to be said

by ptero 7y ago

It is not clear what is best for the general public. You can aim for the "safest" choice, which seems to be what you are advocating. If so, it needs to be said explicitly and the implications of functionality reduction (that safety increases always brings) openly discussed and debated. The model of claiming "we will do what is best for users" with a freedom to replace "best" by "X" has been thoroughly compromised by googles and facebooks of this world. We need to be explicit about goals and tradeoffs. Not attacking your post, just arguing for being clear and honest on goals of non-commercial software. My 2c.

ghaff 7y ago
Yes, I'd argue "safest" is usually the best default for the general public. My reasoning is that a bit more fine-grained control, performance, choice, etc. doesn't have much upside for most people whereas getting compromised can be a very big downside. Perhaps Firefox hasn't been very clear on its tradeoffs but Apple, for example, seems to have been IMO. (Yes, it tends to be wrapped in marketing rather than tech speak but I think they've been pretty consistent about their priorities.)
- ptero 7y ago
  I personally have no objections (usually not even strong feelings) to setting defaults, as long as that's what they are -- default choices that users can change if they see fit. But an option that cannot be changed is not a default choice -- it is a hard coded design decision. My 2c.
  - ghaff 7y ago
    Firefox is open source. AFAIK you could always run a fork with your preferred behaviors. Same applies to speculative execution mitigations in Linux.
    - ptero 7y ago
      And so is, for example, Android. But due to some (shady) tactics, a successful fork of either is impossible for a small group. Saying to a hungry kid in a favela "you are free to get rich" is technically correct, but ignores practicalities. You could argue that Mozilla is either a shepherd (making best decisions for most users and that's it; take it or leave it) or a partner (listen to users and try to implement features they want) but you cannot eat your cake and have it too.
      - jtgeibel 7y ago
        What makes it nearly impossible to fork Firefox? Mozilla already distributes an unbranded "fork" that allows unigned extensions. It's just a build flag away. What potentially shady tactics am I missing?
      - kbenson 7y ago
        What, specifically, is the feature you think Firefox is removing the option to have, that you think people want? I suspect that if we drill down to this point, you'll find the feature is still available with a trivial amount of work, or on the outside case it's the more specific thing they actually talked about, it's not a trivial amount of work, but it's just not automated for enterprise installs anymore. So, what's this feature you're referring to?
        ptero 7y ago
        Manually installing extensions from an XPI file. I also think the discussion moved to a more generic "safe default with options for users to change" vs "choices hard-coded based on perceived safety for general users".
        kbenson 7y ago
        > Manually installing extensions from an XPI file. Everything I see indicates that is still supported. Especially if you read the comments to the post. XPI files seem to be supported, what they removed was the ability have an executable installer install them automatically. The change, which seems to have been communicated poorly, seems to be that some actions within Firefox need to take place (allowing the user to opt-in to the extension) before it will be used by Firefox. This comment[1] from Caitlin Neiman, who I just looked up on Google and appears to be the Firefox Addons Community Manager, states: Developers will still be able to self-distribute, and you will still be able to install extensions from self-distributed (non-AMO) sources. Going forward, developers won’t be able to distribute an extension through an executable application installer. > I also think the discussion moved to a more generic "safe default with options for users to change" vs "choices hard-coded based on perceived safety for general users". I'm pretty sure what they did is not hard coding choices. There are multiple ways to get an extension locally, the hardest of which but still works no matter what is installing the developer version and using source (XPI files can be unpacked). What they actually did was lock down one method of installation which is almost never used by users and is used by orgs and malware, which is to drop extension into the plugin folder with the extension name as the folder name and have it automatically added to Firefox. Now they require you add it through the Firefox browser interface so the user has to opt-in to the extension. 1: https://blog.mozilla.org/addons/2019/10/31/firefox-to-discontinue-sideloaded-extensions/#comment-226505 https://blog.mozilla.org/addons/2019/10/31/firefox-to-discon...
maxerickson 7y ago
They have those evil metrics about what users are doing. If 1% of users are getting exposed to malicious software by a feature and 0.0001% of users are using it, it's a little more clear than you say. I've made both of those numbers up, but I think it's likely enough that very few end users are depending on the ability of other software to silently inject plugins.
- gpvos 7y ago
  > metrics With the caveat that power users are probably the ones to have turned off metrics. Mozilla is probably aware of it, but it's still hard to compensate for that.
Digit-Al 7y ago
I do agree with you to a point. I do think they have a difficult task trying to balance protecting people from their own ignorance and catering to power users who know exactly what they are doing and desire more freedom. An option that just occurred to me is to be able to start Firefox with a special flag that would give access to some extra options to allow actions that reduce security - such as sideloading for example. To help prevent innocent users being coerced into starting Firefox with that flag it could be something like "Firefox.exe -pleasehackme". Power users would know what the flag is for but even the most naive user might hesitate to start Firefox using a command inviting themselves to be hacked :-) Probably a stupid idea, but just putting it out there.
- ptero 7y ago
  That is a fine idea. We can make Firefox as safe as they want at startup. Just keep it as a default option -- something power users can turn off and do not make this a hardcoded choice "because those users turning it off may not know what are they doing". Inform, not restrict. My 2c.
  - floatingatoll 7y ago
    They seem to agree, approximately: https://news.ycombinator.com/item?id=21418786 https://news.ycombinator.com/item?id=21418786
- mastax 7y ago
  So now the malware edits the firefox shortcut to start it with that argument and then installs its malicious addons. That doesn't help at all.
  - apostacy 7y ago
    Yeah, exactly. Malware could also just delete vanilla firefox and replace it with the developer edition. Just overlay ads over the browser window itself. Or anything else really. Trying to protect against hostile code already running on the same computer as the browser is futile. At best, it should warn the user if suspicious modifications were made. And it comes at such a high cost for such a narrow measure of protection.

by ptero 7y ago

ghaff 7y ago

Yes, I'd argue "safest" is usually the best default for the general public. My reasoning is that a bit more fine-grained control, performance, choice, etc. doesn't have much upside for most people whereas getting compromised can be a very big downside. Perhaps Firefox hasn't been very clear on its tradeoffs but Apple, for example, seems to have been IMO. (Yes, it tends to be wrapped in marketing rather than tech speak but I think they've been pretty consistent about their priorities.)

ptero 7y ago
I personally have no objections (usually not even strong feelings) to setting defaults, as long as that's what they are -- default choices that users can change if they see fit. But an option that cannot be changed is not a default choice -- it is a hard coded design decision. My 2c.
- ghaff 7y ago
  Firefox is open source. AFAIK you could always run a fork with your preferred behaviors. Same applies to speculative execution mitigations in Linux.
  - ptero 7y ago
    And so is, for example, Android. But due to some (shady) tactics, a successful fork of either is impossible for a small group. Saying to a hungry kid in a favela "you are free to get rich" is technically correct, but ignores practicalities. You could argue that Mozilla is either a shepherd (making best decisions for most users and that's it; take it or leave it) or a partner (listen to users and try to implement features they want) but you cannot eat your cake and have it too.
    - jtgeibel 7y ago
      What makes it nearly impossible to fork Firefox? Mozilla already distributes an unbranded "fork" that allows unigned extensions. It's just a build flag away. What potentially shady tactics am I missing?
    - kbenson 7y ago
      What, specifically, is the feature you think Firefox is removing the option to have, that you think people want? I suspect that if we drill down to this point, you'll find the feature is still available with a trivial amount of work, or on the outside case it's the more specific thing they actually talked about, it's not a trivial amount of work, but it's just not automated for enterprise installs anymore. So, what's this feature you're referring to?
      - ptero 7y ago
        Manually installing extensions from an XPI file. I also think the discussion moved to a more generic "safe default with options for users to change" vs "choices hard-coded based on perceived safety for general users".
        kbenson 7y ago
        > Manually installing extensions from an XPI file. Everything I see indicates that is still supported. Especially if you read the comments to the post. XPI files seem to be supported, what they removed was the ability have an executable installer install them automatically. The change, which seems to have been communicated poorly, seems to be that some actions within Firefox need to take place (allowing the user to opt-in to the extension) before it will be used by Firefox. This comment[1] from Caitlin Neiman, who I just looked up on Google and appears to be the Firefox Addons Community Manager, states: Developers will still be able to self-distribute, and you will still be able to install extensions from self-distributed (non-AMO) sources. Going forward, developers won’t be able to distribute an extension through an executable application installer. > I also think the discussion moved to a more generic "safe default with options for users to change" vs "choices hard-coded based on perceived safety for general users". I'm pretty sure what they did is not hard coding choices. There are multiple ways to get an extension locally, the hardest of which but still works no matter what is installing the developer version and using source (XPI files can be unpacked). What they actually did was lock down one method of installation which is almost never used by users and is used by orgs and malware, which is to drop extension into the plugin folder with the extension name as the folder name and have it automatically added to Firefox. Now they require you add it through the Firefox browser interface so the user has to opt-in to the extension. 1: https://blog.mozilla.org/addons/2019/10/31/firefox-to-discontinue-sideloaded-extensions/#comment-226505 https://blog.mozilla.org/addons/2019/10/31/firefox-to-discon...

maxerickson 7y ago

They have those evil metrics about what users are doing. If 1% of users are getting exposed to malicious software by a feature and 0.0001% of users are using it, it's a little more clear than you say. I've made both of those numbers up, but I think it's likely enough that very few end users are depending on the ability of other software to silently inject plugins.

gpvos 7y ago
> metrics With the caveat that power users are probably the ones to have turned off metrics. Mozilla is probably aware of it, but it's still hard to compensate for that.

Digit-Al 7y ago

I do agree with you to a point. I do think they have a difficult task trying to balance protecting people from their own ignorance and catering to power users who know exactly what they are doing and desire more freedom. An option that just occurred to me is to be able to start Firefox with a special flag that would give access to some extra options to allow actions that reduce security - such as sideloading for example. To help prevent innocent users being coerced into starting Firefox with that flag it could be something like "Firefox.exe -pleasehackme". Power users would know what the flag is for but even the most naive user might hesitate to start Firefox using a command inviting themselves to be hacked :-) Probably a stupid idea, but just putting it out there.

ptero 7y ago
That is a fine idea. We can make Firefox as safe as they want at startup. Just keep it as a default option -- something power users can turn off and do not make this a hardcoded choice "because those users turning it off may not know what are they doing". Inform, not restrict. My 2c.
- floatingatoll 7y ago
  They seem to agree, approximately: https://news.ycombinator.com/item?id=21418786 https://news.ycombinator.com/item?id=21418786
mastax 7y ago
So now the malware edits the firefox shortcut to start it with that argument and then installs its malicious addons. That doesn't help at all.
- apostacy 7y ago
  Yeah, exactly. Malware could also just delete vanilla firefox and replace it with the developer edition. Just overlay ads over the browser window itself. Or anything else really. Trying to protect against hostile code already running on the same computer as the browser is futile. At best, it should warn the user if suspicious modifications were made. And it comes at such a high cost for such a narrow measure of protection.