151–160 of 504 posts
Earlier quoted context omitted.
It's installed as a study addon, only Mozilla could install these.
> It's installed as a study addon, only Mozilla could install these. And that gives it access to use `Cc`/Components.classes?
An article that mentions a timeframe of “the next few hours”, but doesn't have any timestamp besides a date without a timezone.
If Mozilla Studies are implemented the way other "push" update systems are, then probably your browser has an ID that it hashes to get a bucket ID that it builds into a URL to check for updates, plus a cron time offset for running those checks. Then, the experiments are rolled out by walking up the bucket ID list and gradually adding the addon to said buckets. Usually, this mechanism is explained as being helpful to…
You go a bit in, wait to see if the canary, then go further.
Earlier quoted context omitted.
Well, I disagree that it's a UX issue. The problem is they shouldn't be expiring local software at all . If it was trustworthy at the time of install, why should the calendar date matter? If users don't want to stay up to date, that may be unwise, but that's there call.
Because if the cert is (for example) actively revoked, that probably means you should stop trusting things signed by it in the past.
If you're worried about a cert being compromised long after expiration and used to back-date a signature, you can show a warning, add a second signature with a local key at time of installation, use a blockchain to prove age, have a timestamping service generate its own signature at time of generation, etc.
Earlier quoted context omitted.
Well, I disagree that it's a UX issue. The problem is they shouldn't be expiring local software at all . If it was trustworthy at the time of install, why should the calendar date matter? If users don't want to stay up to date, that may be unwise, but that's there call.
Because if the cert is (for example) actively revoked, that probably means you should stop trusting things signed by it in the past.
I know Firefox isn't being malicious, but ugh, this seems like the worst possible PR move for this, optics wise. "Hey so uh, we accidentally broke your browser, so you need to opt-in to becoming a guinney pig. But don't worry! You probably were already opted in anyway and just didn't realize it! Also it might take six hours to work."
Yes, it's unfortunate, I'd expect them to meet it head on, push a tested fix in a timely matter, admit a mistake was made, explain publicly how/why and apply learning moving forward. Beyond that, what's your expectation?
Granted I'm using Nightly (and previously disabled extension signing in about:config), but now all my themes are disabled, even the default one apparently, though that is what it is using. Cannot be re-enabled. When do I get my dark theme back? Also...my default search engine is now Amazon.com?? WTF is going on. EDIT: Also my only search engine. Heck of a job Mozilla.
Bezos and his strategy to name the company something starting with A so it always comes first finally pays off.
In the meantime I'm enjoying trying out Vivaldi[1] - really reminds me of opera 3/4, that I loved.
Earlier quoted context omitted.
> Also why it took 6 hrs to assign P1 to the bug Because people were staying up until the wee hours of the morning working on fixing it instead of toggling priorities in Bugzilla. This was treated as a five-alarm fire.
I agree with you, it was more important to do the work than to signal. However, I bet it’s likely they have procedures and policies for work that first involve signaling like for example the priority level. I’d be willing to bet lots of things surrounding this issue weren’t handled in a by the book manner. So if you are always going to wing it, why have a book (or a public priority level system) at all?
"The book" is something that needs to change and improve like anything else. Sometimes, that means you'll still need to wing it and add that thing to the book later.
Instead of enabling studies just click on this link. It installs that specific "study" (hotfix) without installing anything else. https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...
You would think they could have linked to that in their blog post, since people who have disabled "studies" have probably done so for a reason. Telemetry is bad enough; even without the "Mr. Robot" thing, there's no way I would let Mozilla randomly push changes to my browser just to see what happens.