Firefox 66.0.4 is out, fixes disabled add-ons • Hacker News Board

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#321

Post by AstralStorm » Mon, May 06, 2019, 9:59 AM UTC

tknkx wrote: post #308

sequence7 wrote: post #289

Earlier quoted context omitted.

You could just turn off all studies in Firefox. It's a simple option: https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...

I'm a privacy conscious person so I disabled all spyware that Firefox included. But I went to check, studies was enabled, probably because it was included and enabled by default in the last years and I didn't notice. So how long until Firefox adds something else to have remote code execution rights on my machine?

Studies do send telemetry which is not quite the same as being spyware.

You can actually check what is sent, though there's no option to more finely disable studies requiring, say, cursor, keyboard or tab name monitoring. I haven't seen any such studies though.

The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time.

As for browser code itself, it is open, go read the changelog. If you're extra paranoid, you can build it yourself. Study code is also fully readable.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#322

Post by tinus_hn » Mon, May 06, 2019, 10:02 AM UTC

sam_goody wrote: post #302

f4stjack wrote: post #261

Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains: - why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) - what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies…

Chromium is definitely worse. While these deserve an explanation, you should not wait to move. Chrome is spyware that does web browsing. It's parent company also shows ads, all the time. Chrome's auto update not only allows them to silently update or change your browser, it allows them to silently install other software on your computer. Firefox is a browser. It can auto-update in a way that may be questionable, but…

Chromium is not Chrome. It does not have auto-update. Surprisingly this gives more control by default than with Firefox.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#323

Post by AstralStorm » Mon, May 06, 2019, 10:03 AM UTC

userbinator wrote: post #147

jopsen wrote: post #112

Earlier quoted context omitted.

You're better off waiting a few more hours that disabling important security features.

The only "security" it provided was to prevent people from installing add-ons that Mozilla didn't approve of, ostensibly ones it thinks are malicious, and I'd bet that on Android (which has its own app isolation features anyway) that's even less of a problem.

Not exactly. You can install add-ons from outside of Mozilla add-ons site. The extra certificate is more of Mozilla's seal of approval.

This is why quite a few of my add-ons were not disabled - they were installed with trust from another site and this intermediate certificate was never in chain.

You could even manually sign these add-ons you trust with custom imported CA key for your personal or corporare vetting.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#324

Post by AstralStorm » Mon, May 06, 2019, 10:07 AM UTC

deadbunny wrote: post #143

jopsen wrote: post #112

Earlier quoted context omitted.

You're better off waiting a few more hours that disabling important security features.

Disabling noscript is a bigger security issue.

It only got disabled if you installed the version from addons.mozilla.org and not the noscript.net.

Some sort of pinning mechanism would be nice though without having to rely on manual installs and signing.

It's a trade-off, you could end up with a version having a gaping security hole.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#325

Post by tinus_hn » Mon, May 06, 2019, 10:10 AM UTC

AaronFriel wrote: post #4

enriquto wrote: post #3

A good outcome of this certificate fiasco is that many firefox users learned about the "studies" and "Normandy" brain-damage and promptly disabled them.

Having a capability for widespread A/B testing is brain-damage?

Having a backdoor on by default while you’re pretending to be ‘the good guy’ is brain damage. It’s taking an age to build trust and then throwing it away in a second.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#326

Post by _Donny » Mon, May 06, 2019, 10:33 AM UTC

fraudsyndrome wrote: post #258

wdr1 wrote: post #90

This is pretty bad for Firefox. I wonder how much people straight up & left for Chrome as a result of it.

I was on the reddit thread when it happened - was super confused as I just updated my firefox and it happened at a very similar time frame so I assumed it was from the update I personally found the issue trivial, my main addon is ublock origin. There was a workaround using about:debugging and installing UBO on there which worked so it's not like the fix was a long process. Being committed to a single browser, if anyo…

I have been on the tipping edge of switching from FF to another browser for a long time now.

Short-lived bugs such as this one do not annoy me as much as the terrible performance of FF. It is not rare that FF uses 2 cores at full utilization all the time.

I always end up installing a new browser out of anger, but I _always_ come back to FF for its great features that I have become addicted to.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#327

Post by wtmt » Mon, May 06, 2019, 10:36 AM UTC

andai wrote: post #318

sam_goody wrote: post #302

Earlier quoted context omitted.

Chromium is definitely worse. While these deserve an explanation, you should not wait to move. Chrome is spyware that does web browsing. It's parent company also shows ads, all the time. Chrome's auto update not only allows them to silently update or change your browser, it allows them to silently install other software on your computer. Firefox is a browser. It can auto-update in a way that may be questionable, but…

I want the ethics of Firefox and the speed / user experience (eg. select & move multiple tabs) of Chrome, so I moved to Brave. It's a Chromium fork that's a bit more Firefoxy -- made by Brendan Eich, former Mozilla CEO and inventor of JS, (eg has the "Switch to Open Tab" feature I love from FF), although there's some cryptocurrency stuff thrown in that I'm not a fan of, but so far it feels like a net positive over bo…

If you haven't read this one yet, here's one data point on Brave doing something unethical (blocking ads and collecting payments on behalf of websites without consent/agreement). [1] Tangentially, I'm writing this comment using Brave.

[1]: https://news.ycombinator.com/item?id=18734999

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#328

Post by Crontab » Mon, May 06, 2019, 10:49 AM UTC

sequence7 wrote: post #289

napsterbr wrote: post #284

Earlier quoted context omitted.

> why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is) I came here to mention exactly this. I don't mind the certificate issue (as long as there is a post mortem and they learn something from it). I was wondering how my addons came back automatically (without me having to upgrade to 66.0.4) and I found out about this studies thing, which I never consented…

You could just turn off all studies in Firefox. It's a simple option: https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...

That's not enough. Opt-out features are wrong because organizations/companies know that most people won't pay attention or not fully appreciate the dangers of it.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#329

Post by arghwhat » Mon, May 06, 2019, 10:53 AM UTC

tinus_hn wrote: post #322

sam_goody wrote: post #302

Earlier quoted context omitted.

Chromium is definitely worse. While these deserve an explanation, you should not wait to move. Chrome is spyware that does web browsing. It's parent company also shows ads, all the time. Chrome's auto update not only allows them to silently update or change your browser, it allows them to silently install other software on your computer. Firefox is a browser. It can auto-update in a way that may be questionable, but…

Chromium is not Chrome. It does not have auto-update. Surprisingly this gives more control by default than with Firefox.

But Chromium still has most, if not all, the Google integration.

There are forks that try to strip Google from it, but it is a mistake to assume that Chromium is somehow better than Chrome.

Re: Firefox 66.0.4 is out, fixes disabled add-ons

#330

Post by TeMPOraL » Mon, May 06, 2019, 11:00 AM UTC

rasmussondk wrote: post #298

Our extension sets https://www.givero.com as the default search engine. After the extension got disabled and re-enabled, searches now default to Google. So this fix is not complete. Our efforts in getting Firefox users to install our extension has been in vain. "Luckily" we didn't have many users yet but imagine the amount of money this will cost bigger search engines like DDG, Qwant, etc.

> but imagine the amount of money this will cost bigger search engines like DDG, Qwant, etc.

People use extensions to change the default search engine in their browsers? I honestly thought only malware does that; regular people use the Settings menu.