Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

support.mozilla.org

Post reply on HN
Print view View original

351–360 of 537 posts

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#351

Post by TooFastIndeed »

UmmNope wrote: post #298
kryptiskt wrote: post #267

Earlier quoted context omitted.

The major problem is that they installed an add-on without properly communicating what it was. A somewhat smaller problem but still a big problem is that was an utterly frivolous add-on that shouldn't have been pushed to people who didn't explicitly want it. But the biggest problem is that Mozilla seems to have trouble understanding why any of those two would be a problem, I want my browser vendor to be serious and n…

The major problem was building a feature into the product that allowed for pushing add-ons without users knowledge much less active consent in the first place, there is no benign use for this kind of functionality.

Automatically updating an already enabled add-on is hardly the same thing as silently pushing a new one.

Security updates were and still are configurable to be installed after prompting, also when they are installed automatically I am notified that this has happened. There is also an implicit trust in the vendor that only security-related functionality should be changed in a security update.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#352

Post by zb3 »

The best way to disable these things is to go to about:config, search and delete/replace all mozilla urls. For this particular case, the api url is probably in "extensions.shield-recipe-client.api_url" [0]

[0] - https://dxr.mozilla.org/mozilla-central/source/browser/exten...

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#353

Post by DarronWyke »

kuschku wrote: post #321
DarronWyke wrote: post #316

Earlier quoted context omitted.

>ToS terms that aren’t either expected by the user, or explained in plain text without having to click through anything, are considered null and void in the EU. You mean like the TOS and EULA you agree to when you install the browser? That would qualify as "expected by the user" and "explained in plain text" both.

Correct, those ToS and EULA are considered invalid, if they contain unexpected agreements, such as "your firstborn belongs to us", or "we can install whatever software we want on your system".

Except they didn't install whatever software they want. They said they can install software to check metrics and more. Which is what this is.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#354

Post by kbenson »

pgl wrote: post #85

Previously: * https://news.ycombinator.com/item?id=15921134 This is a link to the GitHub issue: * https://github.com/gregglind/addon-wr/issues/36 There are several scary things about this: - Unknown Mozilla developers can distribute addons to users without their permission - Mozilla developers can distribute addons to users without their knowledge - Mozilla developers themselves don't realise the consequences of doin…

> Unknown Mozilla developers can distribute addons to users without their permission

"In related news, unknown website developers can distribute programs and run them in your browser. Additionally, it's been determined that browsers sometimes download changed versions of themselves without your permission. Worst of all, we've determined that sometimes the program you download and run yourself on your computer does stuff it didn't say it would do!"

In all seriousness, I understand this is an important issue, and needs to be addressed, but we've obviously gotten to the point as a society recently where no news can't be played up for hype by pundits and commentators for their own benefit (and probably without realizing they are doing it in a lot of cases).

The whole way this is being presented (by many here, not to pick on the parent) as a new chunk of the sky falling is what I find really troublesome. No, chicken littles, the sky isn't falling, but there is some interesting shit going on up there that deserves a look.

I fail to see how getting half the people frothing at the mouth and the other half downplaying it just to try to keep some sanity in the discussion helps for a good outcome.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#355

Post by code_duck »

skymt wrote: post #181
blauditore wrote: post #170

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the ad…

Speaking for myself here, but I'm not concerned that Mozilla might push malware into Firefox installations. I'm concerned about the lack of judgement in pushing an extension with a vague, scary-sounding name and description simply for a cross-marketing tie-in, and I'm worried that it could have damaged the trust ordinary users have in Firefox.

Hopefully this helped people who were scared by it learn how to analyze add-ons for trustworthiness.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#357

Post by katastic »

blauditore wrote: post #170

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the ad…

>If someone distrusts their add-ons, why trust their browser at all?

You mean like when they set the default search to Bing?

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#358

Post by flamedoge »

pavel_lishin wrote: post #350
WhitneyLand wrote: post #344

Earlier quoted context omitted.

I don’t see the harm in a good organization contributing lot of value to this world having a little fun. Some of the comments are mentioning IT managers banning firefox, those will be the same IT managers doing all the other pennywise/pound foolish things that make you try not to work on their team in the first place. Maybe it’s actually good to put something scary sounding in there to raise awareness. It could help…

> I don’t see the harm in a good organization contributing lot of value to this world having a little fun. One potential downside is that now people might not pay close attention to the installed addons. "Oh, must be some Mozilla thing", as GoldenDwarf quietly consumes user CPU cycles to mine cryptocurrency for someone else.

This calls for.... anti mining extension. like adblock, miningblock.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#360

Post by callahad »

hitekker wrote: post #319

1) Mozilla uses weird, spooky language in an add-on. 2) Users are justifiably concerned. 3) Mozilla explains that the add-on is actually anodyne; the developers responsible were having fun with an opt-in research service. 4) Some users try to justify their initial overreaction by painting Firefox as mysterious, dangerous entity, fabulating conspiracy theories about one of the most forthright and open OSS companies in…

Thanks for the positive take, but I do think that folks are justified in their anger.

Even though the add-on itself was innocuous, the context around its scope, delivery, and presentation were not what they should have been.

Post reply on HN