Live data from Hacker News

Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

support.mozilla.org

281–290 of 537 posts

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#281

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the ad…

The major problem is that they installed an add-on without properly communicating what it was. A somewhat smaller problem but still a big problem is that was an utterly frivolous add-on that shouldn't have been pushed to people who didn't explicitly want it. But the biggest problem is that Mozilla seems to have trouble understanding why any of those two would be a problem, I want my browser vendor to be serious and n…

Being serious is quickly becoming a lost art. I don't know if the majority of the userbase really enjoys it, but I can't wait till the current fashion of treating your users like 3-year-olds blows through.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#282
post #278

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the ad…

> In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? An appropriate response here would be to decide that you no longer trust their browser at all. It's hard to quantify trust exactly. I'm fine with trusting the partly-closed-source Google…

>I technically have no grounds to complain that they abused their access.

I would argue that since they knew you were giving them access on the assumption that they would not do things like that, you would have grounds to complain. Similarly, I installed Firefox on the understanding that it would not phone home with opt-out telemetry, advertise third party products, or syntergise with acquired properties. Mozilla has, in the past few months, done all three.

I like Firefox, though, so I'd rather kick the tubas out of Mozilla than go kick them off my individual installation. Does the public have any power over Mozilla's governance?

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#283
post #85

Previously: * https://news.ycombinator.com/item?id=15921134 This is a link to the GitHub issue: * https://github.com/gregglind/addon-wr/issues/36 There are several scary things about this: - Unknown Mozilla developers can distribute addons to users without their permission - Mozilla developers can distribute addons to users without their knowledge - Mozilla developers themselves don't realise the consequences of doin…

Just coming up to speed, apologies for the potentially obvious questions. 1. Can you explain what you mean by "unknown Mozilla developers?" Unknown to whom? 2. Can you provide more detail on what specific configuration changes are reverted when opening the add-ons window? That sounds like a fairly serious bug. 3. What is the specific "this" you're trying to "properly disable?" You shouldn't have to dive into things l…

I'll try to answer in the parent's place, since I've been watching this issue.

> Can you explain what you mean by "unknown Mozilla developers?" Unknown to whom?

Unknown in the sense that this extension wasn't documented at all, there was no Bugzilla issue for it and it's not clear whether it was properly vetted by QA. Whether you argue that this kind of silent push updates is good or bad, I think they aren't tested as well as in-browser functionality. This is a necessary consequence of "let's try it and revert if something breaks or people complain".

More so, a rolled back Shield study will be invisible to the users, so any problems will be impossible to debug. This is made worse by the fact that most, if not all Shield studies are opt-out, so the user won't be notified.

> Can you provide more detail on what specific configuration changes are reverted when opening the add-ons window? That sounds like a fairly serious bug. > What is the specific "this" you're trying to "properly disable?" You shouldn't have to dive into things like lockpref.

People have reported that extensions.ui.experiment.hidden reverts after viewing the add-ons list. I haven't tried it myself, but you can find details in that Reddit thread.

Others have noticed that the Shield studies checkbox sometimes (possibly on version bumps) reverts to enabled. I can't overstate how bad this is; it's basically cheating the users' trust. Lately, Mozilla has been doing some pretty nasty things for an organization that takes pride in caring about the privacy of its users.

Are you aware of the complaints regarding Windows telemetry? Edge, for example, sends full browsing history to Microsoft by default. Should Mozilla follow suit? Because that's exactly what Pioneer does and, while it's not opt-out yet, Firefox advertises enabling it.

As for the rest of the system add-ons, they're either poorly documented (if they are at all), poorly named ("Presentation"), or seem concerning from a privacy point of view (e.g. Activity Stream, Follow-on Search Telemetry, Photon onboarding, Presentation, Web Compat Reporter).

For anyone curious, Presentation seems to be an implementation of a proposed Web API that allows browsers to find and talk to devices in their neighbourhood. Does that include location/proximity beacons like this old proposal https://hacks.mozilla.org/2013/06/the-proximity-api/ ? Do users really want Firefox to tell advertisers where they're shopping? That's the same kind of "experience improvement" that the spyware of yore used to bring.

Why should Pocket be an add-on with superpowers? There was quite a bit of backlash over it a while ago, but Mozilla didn't budge, and some employees actually spread misinformation (not to say "lied"). And actually none of my system add-ons seems to be providing any important functionality (if you disregard the new tab page, for which I haven't seen yet a privacy policy). Looking at Shield studies ( https://www.jeffersonscher.com/sumo/shield.php ), it's even worse: most are surveys, advertisements, asking the user to enable Pioneer (i.e. send full browsing history to Mozilla).

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#285

Earlier quoted context omitted.

This is being added to the browser, outside the realm of security updates, through what is supposed to be a UX improvement program, for commercial purposes. It's written by a commercial company that produces advertisement content. It's not clear this code is audited. Sorry, but I'm uninstalling firefox. They have broken the basic trust I have in them as a user to not push arbitrary code to my machine against my inter…

What browser are you going to use instead?

Links2. http://links.twibright.com

No, it doesn't show PDFs or videos, but does that belong in the browser anyway?

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#286
post #280

Earlier quoted context omitted.

> Now the code contains the ability to go fetch arbitrary code behind our backs and run it against our will. How is that not what automatic updates are?

Right. I trust my browser vendor to send me automatic updates without me reviewing because I believe that's net good for my security. I'd prefer to live in a world where I don't have to question that.

There are definitely situations like corporate networks where automatic updates need to be quarantined and tested before rolling them out to all the machines, but since I don't pay a dedicated sysadmin to run tests on all my software on my personal computer before I receive updates, I'm content to trust my browser to update itself and hope it doesn't break anything.

It's disheartening when the update is a marketing tie-in.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#287

Earlier quoted context omitted.

If this were the first incident, and they quickly backtracked on it, then maybe we can give them a pass. But this isn't the first case of somewhat shady behavior. Remember the "user-enhancing" sponsored tiles a few years ago? https://twitter.com/dherman76/status/433320156496789504 > Excited to share the launch of @mozilla @firefox Tiles program, the first of our user-enhancing programs The problem there wasn't just t…

That tweet sounds like doublespeak, but Directory Tiles really did have some genuinely good ideas mixed in with the bad. I don't know how far we got with it, but one of the ideas was to serve a generic bundle of ads, and then select which ones to display locally, based on an entirely private, client-side analysis of the browser's history. Now, that probably shouldn't have been on the new tab page, and probably not in…

You think because your code is running native you can spy on me better for ad purposes, and that's a feature? That is just tone-deaf.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#288

Earlier quoted context omitted.

This is being added to the browser, outside the realm of security updates, through what is supposed to be a UX improvement program, for commercial purposes. It's written by a commercial company that produces advertisement content. It's not clear this code is audited. Sorry, but I'm uninstalling firefox. They have broken the basic trust I have in them as a user to not push arbitrary code to my machine against my inter…

What browser are you going to use instead?

Firefox 57's sweeping changes ruined most of my vim-like ui customizations (vimperator, vimfx). For 2 months I've switched to qutebrowser and palemoon as a backup and dont miss firefox at all.

If you're looking for a browser with first-class vim compatibility qutebrowser is outstanding.

I've also found palemoon to be a perfectly boring/stable/functional variant of firefox without all the drastic/breaking changes (vim plugins work quite well also)

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#289

Earlier quoted context omitted.

> I haven't researched deeply, but apparently the add-on does nothing until the user opts-in on studies. It adds some css to a list of words: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894...

The extension only starts up if the config option "extensions.pug.lookingglass" is set to "true" though: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894... (It defaults to "false.")

We already have a mechanism for disabling or enabling addons, it's not installing them in the first place. Why on earth would we put it to addons to self-police them.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#290

Earlier quoted context omitted.

I'm not entirely comfortable with how this all went, but it's at least worth noting that the add-on was written entirely by Mozilla engineers.

This is the opposite of comforting

Well it is - one could expect this sort of crap pushed by marketing/bizdev via management but the fact that Mozilla engineers actively collaborated on this is a sign of deep normative inadequacy among the people who are supposed to be the last line of defense against this sort of thing.
Post reply on HN