5 ms·

I understand that the Heartbeat user rating system can be disabled, but I'm still very much against it and think it will drive a lot of less technically-savvy u

I understand that the Heartbeat user rating system can be disabled, but I'm still very much against it and think it will drive a lot of less technically-savvy users mad. I honestly thought it was an April Fools joke at first through reading it.

itsthatguyagain 12y ago
And sigh, yet something else I'll have to disable (or remember to disable) on new installs and upgrades. I wonder if non-savvy people will be able to figure out how to disable it so it doesn't interrupt their time on the internet.
- walterbell 12y ago
  Yikes. At what point will people start backporting security fixes to an older version of Firefox, to avoid the forced bundling of unwanted browser "features"?
  - mccr8 12y ago
    I realize that you are just making a snarky dig, but probably never. It would be a huge amount of work just to backport basic security fixes, and almost impossible to backport large architectural changes that are made in the service of security. Are you going to backport multiprocess Firefox once that is working? It is much easier to flip a preference. If you wanted to get sophisticated, you could create an addon that disables all of the preferences you dislike.
    - jamespo 12y ago
      Will setting the about:config option to disable be preserved across browsers with firefox sync?
      - reubenmorais 12y ago
        It will if there's a corresponding services.sync.prefs.sync.the.pref.you.want.synced.here pref set.
    - walterbell 12y ago
      > you could create an addon that disables all of the preferences you dislike. That's a good idea. Another option is to patch the code to remove the new features, unless Mozilla has taken steps to deter unbundling.
      - sp332 12y ago
        Mozilla is very protective of the Firefox trademark. They don't even use it for their own nightly builds, because they want people to associate "Firefox" with stability. So they make it very easy to unbundle.
  - melling 12y ago
    There's an opportunity cost to supporting older versions. Sure, there's always going to be a small group of people who are happy with what they currently have but most people are happy moving forward. If there's a big enough market, perhaps some company will backport the security fixes. How much are you willing to pay? Another option is that you could volunteer and start the fork. Of course, there's that other problem where developers are only going to support the latest browser.
    - walterbell 12y ago
      A functional subset would not be a fork. If users were given a choice, we would find out which version they considered best aligned with the brand.
      - melling 12y ago
        You aren't being clear. Do you think that older code that gives older functionality doesn't ever get changed? Patches will have to be created, etc. It's not trivial work. And as I mentioned, web developers aren't going to support the older CSS/HTML/JavaScript in your older browser.
        walterbell 12y ago
        Lack of clarity was due to sibling comment. Repeating here: an option is to patch the current code to remove unwanted new features. This provides users with current features, e.g. CSS/HTML/JS and security fixes, a "minimal build" of the browser.
johnchristopher 12y ago
I wondered what that `Hearbeat` thing was so for once I checked the release notes and https://wiki.mozilla.org/Advocacy/heartbeat#Experience_Flow https://wiki.mozilla.org/Advocacy/heartbeat#Experience_Flow > Every day a random subset of users are offered a rating widget > After rating Firefox, an ENGAGEMENT page may open in a background tab. That's... not the phoenix I signed up for.
- maxerickson 12y ago
  Even when it was Phoenix, the branding or whatever you want to call it was to focus on users. Compared to Mozilla/Navigator that meant stripping out a whole lot of stuff, but an effort to find out what their broader set of users want is not incompatible with the original mission. (I'm sure I'll toggle this off)
- danpat 12y ago
  Related: https://careers.mozilla.org/en-US/position/oXqA0fwH https://careers.mozilla.org/en-US/position/oXqA0fwH
ehPReth 12y ago
The check-in URL for heartbeat seems to be HTTP ("http://self-repair.mozilla.org/%LOCALE%/repair" http://self-repair.mozilla.org/%LOCALE%/repair"). Will Firefox 37.0 automatically convert that to HTTPS (HSTS preload, etc) or is there an insecure redirect lurking?
- fabrice_d 12y ago
  It's a https url. Check the source: http://mxr.mozilla.org/mozilla-central/source/browser/app/profile/firefox.js?rev=77a2c0f13869#1029 http://mxr.mozilla.org/mozilla-central/source/browser/app/pr...
  - ehPReth 12y ago
    Is the 'mozilla-release' branch for the current 37.0 release? It shows 'http' instead of 'https': https://mxr.mozilla.org/mozilla-release/source/browser/app/profile/firefox.js#1036 https://mxr.mozilla.org/mozilla-release/source/browser/app/p...
    - fabrice_d 12y ago
      You're right. It was changed to https in https://bugzilla.mozilla.org/show_bug.cgi?id=1138323 https://bugzilla.mozilla.org/show_bug.cgi?id=1138323 and will only end up in Firefox 39
      - ehPReth 12y ago
        Ah, I see. Thanks! Too bad it didn't land for 37.0 but glad to see it fixed for the future
coldpie 12y ago
Just wondering, what do you find so problematic about it? These kinds of rating prompts are extremely common in the mobile app space. They work there, presumably, or they wouldn't be so common. Why don't you think the idea will work here? I'm a big fan of Firefox, and I would find being prompted to provide them with useful feedback a positive experience.
- freehunter 12y ago
  There are a lot of things that work in the mobile space that are use-hostile. The only reason they work is due to limited choice (or at least the perception of limited choice). Ads popping up in between games is common, let's support Firefox by randomly disabling the pop-up blocker. IAP is common, let's give users the ability to view static sites, but CSS is ten sites for 99c, Javascript is five sites for $1.99, or you can get it all for $99! Subscribers get SSL added on for only $15/mo.

itsthatguyagain 12y ago

And sigh, yet something else I'll have to disable (or remember to disable) on new installs and upgrades. I wonder if non-savvy people will be able to figure out how to disable it so it doesn't interrupt their time on the internet.

walterbell 12y ago
Yikes. At what point will people start backporting security fixes to an older version of Firefox, to avoid the forced bundling of unwanted browser "features"?
- mccr8 12y ago
  I realize that you are just making a snarky dig, but probably never. It would be a huge amount of work just to backport basic security fixes, and almost impossible to backport large architectural changes that are made in the service of security. Are you going to backport multiprocess Firefox once that is working? It is much easier to flip a preference. If you wanted to get sophisticated, you could create an addon that disables all of the preferences you dislike.
  - jamespo 12y ago
    Will setting the about:config option to disable be preserved across browsers with firefox sync?
    - reubenmorais 12y ago
      It will if there's a corresponding services.sync.prefs.sync.the.pref.you.want.synced.here pref set.
  - walterbell 12y ago
    > you could create an addon that disables all of the preferences you dislike. That's a good idea. Another option is to patch the code to remove the new features, unless Mozilla has taken steps to deter unbundling.
    - sp332 12y ago
      Mozilla is very protective of the Firefox trademark. They don't even use it for their own nightly builds, because they want people to associate "Firefox" with stability. So they make it very easy to unbundle.
- melling 12y ago
  There's an opportunity cost to supporting older versions. Sure, there's always going to be a small group of people who are happy with what they currently have but most people are happy moving forward. If there's a big enough market, perhaps some company will backport the security fixes. How much are you willing to pay? Another option is that you could volunteer and start the fork. Of course, there's that other problem where developers are only going to support the latest browser.
  - walterbell 12y ago
    A functional subset would not be a fork. If users were given a choice, we would find out which version they considered best aligned with the brand.
    - melling 12y ago
      You aren't being clear. Do you think that older code that gives older functionality doesn't ever get changed? Patches will have to be created, etc. It's not trivial work. And as I mentioned, web developers aren't going to support the older CSS/HTML/JavaScript in your older browser.
      - walterbell 12y ago
        Lack of clarity was due to sibling comment. Repeating here: an option is to patch the current code to remove unwanted new features. This provides users with current features, e.g. CSS/HTML/JS and security fixes, a "minimal build" of the browser.

johnchristopher 12y ago

I wondered what that `Hearbeat` thing was so for once I checked the release notes and https://wiki.mozilla.org/Advocacy/heartbeat#Experience_Flow https://wiki.mozilla.org/Advocacy/heartbeat#Experience_Flow > Every day a random subset of users are offered a rating widget > After rating Firefox, an ENGAGEMENT page may open in a background tab. That's... not the phoenix I signed up for.

maxerickson 12y ago
Even when it was Phoenix, the branding or whatever you want to call it was to focus on users. Compared to Mozilla/Navigator that meant stripping out a whole lot of stuff, but an effort to find out what their broader set of users want is not incompatible with the original mission. (I'm sure I'll toggle this off)
danpat 12y ago
Related: https://careers.mozilla.org/en-US/position/oXqA0fwH https://careers.mozilla.org/en-US/position/oXqA0fwH

ehPReth 12y ago

The check-in URL for heartbeat seems to be HTTP ("http://self-repair.mozilla.org/%LOCALE%/repair" http://self-repair.mozilla.org/%LOCALE%/repair"). Will Firefox 37.0 automatically convert that to HTTPS (HSTS preload, etc) or is there an insecure redirect lurking?

fabrice_d 12y ago
It's a https url. Check the source: http://mxr.mozilla.org/mozilla-central/source/browser/app/profile/firefox.js?rev=77a2c0f13869#1029 http://mxr.mozilla.org/mozilla-central/source/browser/app/pr...
- ehPReth 12y ago
  Is the 'mozilla-release' branch for the current 37.0 release? It shows 'http' instead of 'https': https://mxr.mozilla.org/mozilla-release/source/browser/app/profile/firefox.js#1036 https://mxr.mozilla.org/mozilla-release/source/browser/app/p...
  - fabrice_d 12y ago
    You're right. It was changed to https in https://bugzilla.mozilla.org/show_bug.cgi?id=1138323 https://bugzilla.mozilla.org/show_bug.cgi?id=1138323 and will only end up in Firefox 39
    - ehPReth 12y ago
      Ah, I see. Thanks! Too bad it didn't land for 37.0 but glad to see it fixed for the future

coldpie 12y ago

Just wondering, what do you find so problematic about it? These kinds of rating prompts are extremely common in the mobile app space. They work there, presumably, or they wouldn't be so common. Why don't you think the idea will work here? I'm a big fan of Firefox, and I would find being prompted to provide them with useful feedback a positive experience.

freehunter 12y ago
There are a lot of things that work in the mobile space that are use-hostile. The only reason they work is due to limited choice (or at least the perception of limited choice). Ads popping up in between games is common, let's support Firefox by randomly disabling the pop-up blocker. IAP is common, let's give users the ability to view static sites, but CSS is ten sites for 99c, Javascript is five sites for $1.99, or you can get it all for $99! Subscribers get SSL added on for only $15/mo.