Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser • Hacker News Board

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#381

Post by TylerH » Fri, Dec 15, 2017, 9:41 PM UTC

skymt wrote: post #181

blauditore wrote: post #170

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the ad…

Speaking for myself here, but I'm not concerned that Mozilla might push malware into Firefox installations. I'm concerned about the lack of judgement in pushing an extension with a vague, scary-sounding name and description simply for a cross-marketing tie-in, and I'm worried that it could have damaged the trust ordinary users have in Firefox.

What's scary about "Looking Glass"? It's not named something like "PrivacyRemover" or "SpamEmailer" or anything.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#382

Post by JadeNB » Fri, Dec 15, 2017, 9:43 PM UTC

bwat49 wrote: post #96

_red wrote: post #52

Earlier quoted context omitted.

Yeah, its so intuitive for the average person to type: about:config in address bar and scroll through hundreds of oddly named parameters to turn off spyware. Comments like yours are illustrative of a certain mindset. When you encounter the complexity of domains you are not intimately familiar with (court system, law, finance, etc), and those complexities are designed specifically to make it hard for you to protect yo…

You're being hyperbolic, you don't need to go into about:config. It's right in the main browser settings, under the Privacy and Security section where one would expect settings like this to be

> It's right in the main browser settings, under the Privacy and Security section where one would expect settings like this to be

If you asked me "where would you go to change settings to prevent the browser from violating your privacy and infringing on your security?", then, yes, I would go to "Privacy and Security". If, however, you asked me "what would you expect to find under 'Privacy and Security'?", my answer would be that that's where I would go to protect myself from malicious websites, not from malicious browsers.

(I know that 'malicious' is quite, and almost certainly too, strong here, but the point is that I think, and am explicitly encouraged to think, of Mozilla as being on my side against the sites I visit, and I don't think it's natural to expect that I will start thinking of how I need to protect myself from Mozilla to use their products in the way that I, rather than they, intend.)

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#383

Post by kryptiskt » Fri, Dec 15, 2017, 9:49 PM UTC

kryptiskt wrote: post #267

blauditore wrote: post #170

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the ad…

The major problem is that they installed an add-on without properly communicating what it was. A somewhat smaller problem but still a big problem is that was an utterly frivolous add-on that shouldn't have been pushed to people who didn't explicitly want it. But the biggest problem is that Mozilla seems to have trouble understanding why any of those two would be a problem, I want my browser vendor to be serious and n…

So this is the first response from Mozilla in the Gizmodo article:

“Firefox worked with the Mr. Robot team to create a custom experience that would surprise and delight fans of the show and our users. It’s especially important to call out that this collaboration does not compromise our principles or values regarding privacy. The experience does not collect or share any data,” Jascha Kaykas-Wolff, chief marketing officer of Mozilla, said in a statement to Gizmodo. “The experience was kept under wraps to be introduced at the conclusion of the season of Mr. Robot. We gave Mr. Robot fans a unique mystery to solve to deepen their connection and engagement with the show and is only available in Firefox.”

This is horrible. They pushed out this crap under false pretenses as a study and obfuscated it. Don't talk the ethics talk if you're not prepared to do the ethics walk.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#384

Post by toyg » Fri, Dec 15, 2017, 9:50 PM UTC

hitekker wrote: post #319

1) Mozilla uses weird, spooky language in an add-on. 2) Users are justifiably concerned. 3) Mozilla explains that the add-on is actually anodyne; the developers responsible were having fun with an opt-in research service. 4) Some users try to justify their initial overreaction by painting Firefox as mysterious, dangerous entity, fabulating conspiracy theories about one of the most forthright and open OSS companies in…

1) One day you wake up and somebody is watching TV in your living room.

2) you freak out. Who is this guy? I didn't invite anyone last night!

3) The guy turns around and it's just your mate Chad. He didn't mean any harm, just wanted to watch TV and hang out.

4) This is not on, Chad is a psycho.

Intentions don't really matter: they've just demonstrated a scary and invasive capability without any warning. Minimizing it doesn't help.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#385

Post by okasaki » Fri, Dec 15, 2017, 9:56 PM UTC

TheRealPomax wrote: post #303

UmmNope wrote: post #298

Earlier quoted context omitted.

The major problem was building a feature into the product that allowed for pushing add-ons without users knowledge much less active consent in the first place, there is no benign use for this kind of functionality.

you mean the automatic update process, which can change every single byte of every file in every directory under Firefox's control? Because unless you want to live in a world where your browser can't automatically apply security patches and upgrade critical components, the fact that the application can update itself is very much not the actual problem (and with the new web extension addon system rathern than the old…

In Linux distributions you get it from the distribution repository, and automatic updates are disabled. So at least it's reviewed by a third party.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#386

Post by jhiska » Fri, Dec 15, 2017, 9:57 PM UTC

toastercat wrote: post #83

positivecomment wrote: post #17

Earlier quoted context omitted.

Could you please be more clear? I disabled all my extensions and still don't see anything there that is based on feelings?

I think they are feeling betrayed by Mozilla, and that they are saying language like "We all love the web" and "Internet for people" inspires feelings.

You could have asked me what I meant.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#387

Post by notanote » Fri, Dec 15, 2017, 10:02 PM UTC

rnhmjoj wrote: post #330

Grollicus wrote: post #313

Earlier quoted context omitted.

I think about doing this as well but heard a lot of bad things about the firefox build process. How long does it take to build for you?

They are probably true. Using an i5 @4.3GHz it takes 2.5/3 hours to build. To test changes you must set up a compiler cache or it's going to take forever.

That seems a little slow. I compile nightly for my own use and it takes around 20 minutes on a haswell i5, using tmpfs for the build directory.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#388

Post by hitekker » Fri, Dec 15, 2017, 10:02 PM UTC

callahad wrote: post #360

hitekker wrote: post #319

1) Mozilla uses weird, spooky language in an add-on. 2) Users are justifiably concerned. 3) Mozilla explains that the add-on is actually anodyne; the developers responsible were having fun with an opt-in research service. 4) Some users try to justify their initial overreaction by painting Firefox as mysterious, dangerous entity, fabulating conspiracy theories about one of the most forthright and open OSS companies in…

Thanks for the positive take, but I do think that folks are justified in their anger. Even though the add-on itself was innocuous, the context around its scope, delivery, and presentation were not what they should have been.

Justified in their concerns, certainly. But not in their seething, frothing paranoia.

We have people comparing the installation of a near-stub browser add-on by the browser vendor, to full-on home invasions.

The language was a mistake and should have not been pushed out, or maybe even written to begin with. Mozilla ought to remember how skittish their userbase can be.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#389

Post by chris_wot » Fri, Dec 15, 2017, 10:02 PM UTC

45h34jh53k4j wrote: post #270

jotux wrote: post #220

Earlier quoted context omitted.

I'm worried my work Security/IT department will see it, freak out, and blanket ban Firefox on all machines for 6 months.

your work security team loves mr robot, it will be fine...

No, it really will not. My workplace saw that OpenOffice had a security issue, and banned it AND LibreOffice.

Nothing I can do about it. Can’t argue. Trust is very, very easily lost and incredibly hard to regain. And it can hit innocent third parties. It’s very, very wrong to do anything that could destroy trust.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#390

Post by bigbugbag » Fri, Dec 15, 2017, 10:14 PM UTC

blauditore wrote: post #170

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the ad…

You're assuming people trust firefox or mozilla.

I do not trust mozilla, they've repeatedly proven they cannot be trusted. I do not trust firefox, because a piece of software is open source software does not mean it should be trusted.