Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the ad…
The major problem is that they installed an add-on without properly communicating what it was. A somewhat smaller problem but still a big problem is that was an utterly frivolous add-on that shouldn't have been pushed to people who didn't explicitly want it. But the biggest problem is that Mozilla seems to have trouble understanding why any of those two would be a problem, I want my browser vendor to be serious and n…
Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser
281–290 of 537 posts
Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser
#282Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the ad…
> In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? An appropriate response here would be to decide that you no longer trust their browser at all. It's hard to quantify trust exactly. I'm fine with trusting the partly-closed-source Google…
I would argue that since they knew you were giving them access on the assumption that they would not do things like that, you would have grounds to complain. Similarly, I installed Firefox on the understanding that it would not phone home with opt-out telemetry, advertise third party products, or syntergise with acquired properties. Mozilla has, in the past few months, done all three.
I like Firefox, though, so I'd rather kick the tubas out of Mozilla than go kick them off my individual installation. Does the public have any power over Mozilla's governance?
Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser
#283Previously: * https://news.ycombinator.com/item?id=15921134 This is a link to the GitHub issue: * https://github.com/gregglind/addon-wr/issues/36 There are several scary things about this: - Unknown Mozilla developers can distribute addons to users without their permission - Mozilla developers can distribute addons to users without their knowledge - Mozilla developers themselves don't realise the consequences of doin…
Just coming up to speed, apologies for the potentially obvious questions. 1. Can you explain what you mean by "unknown Mozilla developers?" Unknown to whom? 2. Can you provide more detail on what specific configuration changes are reverted when opening the add-ons window? That sounds like a fairly serious bug. 3. What is the specific "this" you're trying to "properly disable?" You shouldn't have to dive into things l…
> Can you explain what you mean by "unknown Mozilla developers?" Unknown to whom?
Unknown in the sense that this extension wasn't documented at all, there was no Bugzilla issue for it and it's not clear whether it was properly vetted by QA. Whether you argue that this kind of silent push updates is good or bad, I think they aren't tested as well as in-browser functionality. This is a necessary consequence of "let's try it and revert if something breaks or people complain".
More so, a rolled back Shield study will be invisible to the users, so any problems will be impossible to debug. This is made worse by the fact that most, if not all Shield studies are opt-out, so the user won't be notified.
> Can you provide more detail on what specific configuration changes are reverted when opening the add-ons window? That sounds like a fairly serious bug. > What is the specific "this" you're trying to "properly disable?" You shouldn't have to dive into things like lockpref.
People have reported that extensions.ui.experiment.hidden reverts after viewing the add-ons list. I haven't tried it myself, but you can find details in that Reddit thread.
Others have noticed that the Shield studies checkbox sometimes (possibly on version bumps) reverts to enabled. I can't overstate how bad this is; it's basically cheating the users' trust. Lately, Mozilla has been doing some pretty nasty things for an organization that takes pride in caring about the privacy of its users.
Are you aware of the complaints regarding Windows telemetry? Edge, for example, sends full browsing history to Microsoft by default. Should Mozilla follow suit? Because that's exactly what Pioneer does and, while it's not opt-out yet, Firefox advertises enabling it.
As for the rest of the system add-ons, they're either poorly documented (if they are at all), poorly named ("Presentation"), or seem concerning from a privacy point of view (e.g. Activity Stream, Follow-on Search Telemetry, Photon onboarding, Presentation, Web Compat Reporter).
For anyone curious, Presentation seems to be an implementation of a proposed Web API that allows browsers to find and talk to devices in their neighbourhood. Does that include location/proximity beacons like this old proposal https://hacks.mozilla.org/2013/06/the-proximity-api/ ? Do users really want Firefox to tell advertisers where they're shopping? That's the same kind of "experience improvement" that the spyware of yore used to bring.
Why should Pocket be an add-on with superpowers? There was quite a bit of backlash over it a while ago, but Mozilla didn't budge, and some employees actually spread misinformation (not to say "lied"). And actually none of my system add-ons seems to be providing any important functionality (if you disregard the new tab page, for which I haven't seen yet a privacy policy). Looking at Shield studies ( https://www.jeffersonscher.com/sumo/shield.php ), it's even worse: most are surveys, advertisements, asking the user to enable Pioneer (i.e. send full browsing history to Mozilla).
Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser
#284Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser
#285Earlier quoted context omitted.
This is being added to the browser, outside the realm of security updates, through what is supposed to be a UX improvement program, for commercial purposes. It's written by a commercial company that produces advertisement content. It's not clear this code is audited. Sorry, but I'm uninstalling firefox. They have broken the basic trust I have in them as a user to not push arbitrary code to my machine against my inter…
What browser are you going to use instead?
No, it doesn't show PDFs or videos, but does that belong in the browser anyway?
Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser
#286Earlier quoted context omitted.
> Now the code contains the ability to go fetch arbitrary code behind our backs and run it against our will. How is that not what automatic updates are?
Right. I trust my browser vendor to send me automatic updates without me reviewing because I believe that's net good for my security. I'd prefer to live in a world where I don't have to question that.
It's disheartening when the update is a marketing tie-in.
Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser
#287Earlier quoted context omitted.
If this were the first incident, and they quickly backtracked on it, then maybe we can give them a pass. But this isn't the first case of somewhat shady behavior. Remember the "user-enhancing" sponsored tiles a few years ago? https://twitter.com/dherman76/status/433320156496789504 > Excited to share the launch of @mozilla @firefox Tiles program, the first of our user-enhancing programs The problem there wasn't just t…
That tweet sounds like doublespeak, but Directory Tiles really did have some genuinely good ideas mixed in with the bad. I don't know how far we got with it, but one of the ideas was to serve a generic bundle of ads, and then select which ones to display locally, based on an entirely private, client-side analysis of the browser's history. Now, that probably shouldn't have been on the new tab page, and probably not in…
Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser
#288Earlier quoted context omitted.
This is being added to the browser, outside the realm of security updates, through what is supposed to be a UX improvement program, for commercial purposes. It's written by a commercial company that produces advertisement content. It's not clear this code is audited. Sorry, but I'm uninstalling firefox. They have broken the basic trust I have in them as a user to not push arbitrary code to my machine against my inter…
What browser are you going to use instead?
If you're looking for a browser with first-class vim compatibility qutebrowser is outstanding.
I've also found palemoon to be a perfectly boring/stable/functional variant of firefox without all the drastic/breaking changes (vim plugins work quite well also)
Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser
#289Earlier quoted context omitted.
> I haven't researched deeply, but apparently the add-on does nothing until the user opts-in on studies. It adds some css to a list of words: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894...
The extension only starts up if the config option "extensions.pug.lookingglass" is set to "true" though: https://github.com/gregglind/addon-wr/blob/da464ac8f1c3b0894... (It defaults to "false.")
Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser
#290Earlier quoted context omitted.
I'm not entirely comfortable with how this all went, but it's at least worth noting that the add-on was written entirely by Mozilla engineers.
This is the opposite of comforting