4 ms·

There is a response from a Mozilla security member at lobste.rs. https://lobste.rs/s/zcjtv2/1749908_infinite_loop_http3_hangs_socket#c_kikbal https://lobste.rs

There is a response from a Mozilla security member at lobste.rs. https://lobste.rs/s/zcjtv2/1749908_infinite_loop_http3_hangs_socket#c_kikbal https://lobste.rs/s/zcjtv2/1749908_infinite_loop_http3_hangs...

hdjjhhvvhga 5y ago
This is the interesting bit I had no idea about: > [Q] Do I understand from this that Mozilla can just update my browser settings remotely without my updating‽ > [A] Yes. This is part of the “Remote settings” service, which we can use to ship or unship features (or gradually) or recover from breakage (like here!). We mostly use it as a backend for Firefox Sync and certificate revocation lists. Technically, we could also ship a new Firefox executable and undo / change settings, but that would realistically take many more hours. Needless to says, every “large” software project has these capabilities. This is new to me. Can anyone tell me which other "large" projects have this capability?
- miohtama 5y ago
  Chrome
- iqanq 5y ago
  They are busy making us hate them as much as they can, eh?
- Karunamon 5y ago
  Multiple reports on the initial thread (https://news.ycombinator.com/item?id=29918717 https://news.ycombinator.com/item?id=29918717) that telemetry features are getting silently re-enabled after users explicitly disable them. If you had telemetry on, you hit this bug immediately due to the server configuration. I wonder if this is to blame? In any case, this is incredibly sketchy behavior for a "user-empowering", "privacy focused" browser.
- pmontra 5y ago
  I didn't know about Remote Settings. I found some detailed information on Mozilla's website [1] and I have three entries about RemoteSettings in about:config. app.normandy.startupRolloutPrefs.browser.topsites.useRemoteSetting browser.topsites.useRemoteSetting browser.urlbar.quicksuggest.remoteSettings.enabled I turned them to false. This [2] explains what Normandy is. [1] https://firefox-source-docs.mozilla.org/services/settings/index.html https://firefox-source-docs.mozilla.org/services/settings/in... [2] https://firefox-source-docs.mozilla.org/toolkit/components/normandy/normandy/index.html#components-normandy https://firefox-source-docs.mozilla.org/toolkit/components/n...
- djdjfhsje33edh 5y ago
  That's insane. Is there a way to disable "Remote settings" in about:config?
  - Schute 5y ago
    Not tested and I have no idea what this breaks, but you could set services.settings.server to something unusable like localhost. The pref was listed here (https://remote-settings.readthedocs.io/en/latest/tutorial-dev-server.html#prepare-the-client https://remote-settings.readthedocs.io/en/latest/tutorial-de...) in the dev environment instructions.
- tomudding 5y ago
  > Can anyone tell me which other "large" projects have this capability? I'd say that all popular apps (Android/iOS) have such functionality. Most will probably use it for A/B testing, but technically you could change anything you'd like with it. Apart from the companies creating their own implementations [0], popular services I have seen include Optimizely [1] and Firebase Remote Config [2]. [0]: https://engineering.fb.com/2014/01/09/android/airlock-facebook-s-mobile-a-b-testing-framework/ https://engineering.fb.com/2014/01/09/android/airlock-facebo... [1]: https://www.optimizely.com/products/intelligence/full-stack-experimentation/ https://www.optimizely.com/products/intelligence/full-stack-... [2]: https://firebase.google.com/docs/remote-config/ https://firebase.google.com/docs/remote-config/
- kevingadd 5y ago
  Most large software that hits servers on the network will have this because it's borderline malpractice not to. Not only would it make it difficult or impossible to fix third-party regressions like this, but if your software started causing issues for third parties (like crashing their servers or getting users kicked off the internet or corrupting their data), you'd have no way to mitigate it in a reasonable amount of time. FWIW I maintained a popular chrome extension (100k weekly users) and I eventually had to add an extensive set of chicken bits pulled from my server multiple times a day. Why? Because chrome updates take over a day to propagate and the extension could regularly break when webdevs made frontend changes to the websites my end users visited. It simply wasn't feasible to ask end users to manually pull a chrome update every time this happened (not to mention that chrome's extension store is designed to make this very hard.) I added an option to disable it but as far as I know none of my users turned that on. Not exactly the same but most modern hardware has equivalent functionality where they can flip 'chicken bits' in the hw to disable various features in response to regressions - stuff like spectre or meltdown is a good example. Naturally that is instead flipped by OS or firmware updates, but considering those come down across the wire automatically now, it's basically the same idea.
  - hdjjhhvvhga 5y ago
    > Not only would it make it difficult or impossible to fix third-party regressions like this, but if your software started causing issues for third parties (like crashing their servers or getting users kicked off the internet or corrupting their data), you'd have no way to mitigate it in a reasonable amount of time. I completely agree that in the current case resetting it remotely is the easiest solution for both parties. However, it is probably the first time many users learned something like this exists. One would think an open browser promoting user empowerment would have more transparency on this feature and how it can be controlled.
  - patrakov 5y ago
    This is also a place where corrupt governments can impose sanctions on other countries through.
    - 5y ago
- jacquesm 5y ago
  That also explains how the telemetry stuff could have been returned to default even though it was disabled, this mechanism has a lot of bad use cases that you'd have to trust Mozilla to never abuse.
- tinus_hn 5y ago
  For what it’s worth this sentence was updated.
mzs 5y ago
I wonder if remote settings is what changed my proxy settings after update too.

hdjjhhvvhga 5y ago

This is the interesting bit I had no idea about: > [Q] Do I understand from this that Mozilla can just update my browser settings remotely without my updating‽ > [A] Yes. This is part of the “Remote settings” service, which we can use to ship or unship features (or gradually) or recover from breakage (like here!). We mostly use it as a backend for Firefox Sync and certificate revocation lists. Technically, we could also ship a new Firefox executable and undo / change settings, but that would realistically take many more hours. Needless to says, every “large” software project has these capabilities. This is new to me. Can anyone tell me which other "large" projects have this capability?

miohtama 5y ago
Chrome
iqanq 5y ago
They are busy making us hate them as much as they can, eh?
Karunamon 5y ago
Multiple reports on the initial thread (https://news.ycombinator.com/item?id=29918717 https://news.ycombinator.com/item?id=29918717) that telemetry features are getting silently re-enabled after users explicitly disable them. If you had telemetry on, you hit this bug immediately due to the server configuration. I wonder if this is to blame? In any case, this is incredibly sketchy behavior for a "user-empowering", "privacy focused" browser.
pmontra 5y ago
I didn't know about Remote Settings. I found some detailed information on Mozilla's website [1] and I have three entries about RemoteSettings in about:config. app.normandy.startupRolloutPrefs.browser.topsites.useRemoteSetting browser.topsites.useRemoteSetting browser.urlbar.quicksuggest.remoteSettings.enabled I turned them to false. This [2] explains what Normandy is. [1] https://firefox-source-docs.mozilla.org/services/settings/index.html https://firefox-source-docs.mozilla.org/services/settings/in... [2] https://firefox-source-docs.mozilla.org/toolkit/components/normandy/normandy/index.html#components-normandy https://firefox-source-docs.mozilla.org/toolkit/components/n...
djdjfhsje33edh 5y ago
That's insane. Is there a way to disable "Remote settings" in about:config?
- Schute 5y ago
  Not tested and I have no idea what this breaks, but you could set services.settings.server to something unusable like localhost. The pref was listed here (https://remote-settings.readthedocs.io/en/latest/tutorial-dev-server.html#prepare-the-client https://remote-settings.readthedocs.io/en/latest/tutorial-de...) in the dev environment instructions.
tomudding 5y ago
> Can anyone tell me which other "large" projects have this capability? I'd say that all popular apps (Android/iOS) have such functionality. Most will probably use it for A/B testing, but technically you could change anything you'd like with it. Apart from the companies creating their own implementations [0], popular services I have seen include Optimizely [1] and Firebase Remote Config [2]. [0]: https://engineering.fb.com/2014/01/09/android/airlock-facebook-s-mobile-a-b-testing-framework/ https://engineering.fb.com/2014/01/09/android/airlock-facebo... [1]: https://www.optimizely.com/products/intelligence/full-stack-experimentation/ https://www.optimizely.com/products/intelligence/full-stack-... [2]: https://firebase.google.com/docs/remote-config/ https://firebase.google.com/docs/remote-config/
kevingadd 5y ago
Most large software that hits servers on the network will have this because it's borderline malpractice not to. Not only would it make it difficult or impossible to fix third-party regressions like this, but if your software started causing issues for third parties (like crashing their servers or getting users kicked off the internet or corrupting their data), you'd have no way to mitigate it in a reasonable amount of time. FWIW I maintained a popular chrome extension (100k weekly users) and I eventually had to add an extensive set of chicken bits pulled from my server multiple times a day. Why? Because chrome updates take over a day to propagate and the extension could regularly break when webdevs made frontend changes to the websites my end users visited. It simply wasn't feasible to ask end users to manually pull a chrome update every time this happened (not to mention that chrome's extension store is designed to make this very hard.) I added an option to disable it but as far as I know none of my users turned that on. Not exactly the same but most modern hardware has equivalent functionality where they can flip 'chicken bits' in the hw to disable various features in response to regressions - stuff like spectre or meltdown is a good example. Naturally that is instead flipped by OS or firmware updates, but considering those come down across the wire automatically now, it's basically the same idea.
- hdjjhhvvhga 5y ago
  > Not only would it make it difficult or impossible to fix third-party regressions like this, but if your software started causing issues for third parties (like crashing their servers or getting users kicked off the internet or corrupting their data), you'd have no way to mitigate it in a reasonable amount of time. I completely agree that in the current case resetting it remotely is the easiest solution for both parties. However, it is probably the first time many users learned something like this exists. One would think an open browser promoting user empowerment would have more transparency on this feature and how it can be controlled.
- patrakov 5y ago
  This is also a place where corrupt governments can impose sanctions on other countries through.
  - 5y ago
jacquesm 5y ago
That also explains how the telemetry stuff could have been returned to default even though it was disabled, this mechanism has a lot of bad use cases that you'd have to trust Mozilla to never abuse.
tinus_hn 5y ago
For what it’s worth this sentence was updated.

mzs 5y ago

I wonder if remote settings is what changed my proxy settings after update too.