Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

support.mozilla.org

Post reply on HN
Print view View original

461–470 of 537 posts

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#461

Post by WCityMike »

ubernostrum wrote: post #446
gorbachev wrote: post #269

Earlier quoted context omitted.

Unfortunately the most important person involved didn't get to review the plugin before it was installed on my computer. Me.

OK, I have to rant a bit on this. I worked at Mozilla for about four years (2011-2015), on MDN. It's built as a wiki, with wiki features open to everyone. The code is all open source and on GitHub. Its issues and tasks and roadmap are tracked in a public bug tracker. We operated in a public IRC channel. We didn't have to do that. We could have just built something targeted to only be used by the technical writing sta…

You want to point us towards where ... on Bugzilla and the Mozilla project wiki pages and the source code and all the other things you mentioned ... this addon was discussed?

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#462

Post by bigbugbag »

jotux wrote: post #220
skymt wrote: post #181

Earlier quoted context omitted.

Speaking for myself here, but I'm not concerned that Mozilla might push malware into Firefox installations. I'm concerned about the lack of judgement in pushing an extension with a vague, scary-sounding name and description simply for a cross-marketing tie-in, and I'm worried that it could have damaged the trust ordinary users have in Firefox.

I'm worried my work Security/IT department will see it, freak out, and blanket ban Firefox on all machines for 6 months.

If this does not happen at your workplace, it will certainly happen at some other workplace around the world.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#463

Post by DonHopkins »

TheRealPomax wrote: post #245
tamriel wrote: post #84

Earlier quoted context omitted.

I agree. I merely challenge the notion that a nonprofit -- which proudly tumpets its benevolence and non-profitness -- should get a free pass for covertly installing advertising arrangements, just because they need to "make money". Their charter and marketing is all about defending the internet from the companies doing shady things to make money, so they can't have their cake and eat it.

That would be a valid complaint if this was an advertising arrangment, rather than one where if you watch the TV show, you learn that you can activate a firefox addon to participate in an small AR game that changes your normal web experience into a Mr Robot style web experience for the duration. The addon itself does not advertise for Mr. Robot, Mr. Robot advertises for this addon.

It actually claims to be an "Alternate Reality Game (ARG)", not a "small AR game" as in "Augmented Reality" or "Mixed Reality". That's something else:

https://research.mozilla.org/mixed-reality/

I'd charitably call it "Augmented Memory", but it's definitely not "Augmented Reality".

And I'd hardly call it a game, just a parasitic advertising gimmick that slows and bloats the browser. It just injects a bunch of JavaScript code, DOM elements and CSS effects into every tab.

There's really no game there, and it's pretentious to call it an "Alternate Reality Game", which is defined as "intense player involvement with a story that takes place in real time and evolves according to players' responses":

https://en.wikipedia.org/wiki/Alternate_reality_game

This extension just wraps all occurrences of a set of keywords (now including "fuck") in a span with some css animations and a tooltip that links to their web page.

https://github.com/gregglind/addon-wr/commit/da464ac8f1c3b08...

But in terms of memory usage, CPU and battery consumption, it's not that small, either.

It injects a blob of CSS and some JavaScript into every tab, then it does a regular expression search of every text node on each page, filtering out everything but paragraphs, then for each occurrence of a keyword in the text, it creates a new text node to split the current text node, then inserts a new span element between them, containing its own text node, then it creates an additional tooltip element containing six text nodes, five br elements, and one anchor element linking to https://support.mozilla.org/kb/lookingglass , and it also configures css class names to associate all those new nodes it created with the blob of css styling and animations that it injected.

This extension isn't the best example of their technology for Mozilla to be promoting and distributing, if they're really serious about delivering a fast memory efficient browser.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#464

Post by jopsen »

pmlnr wrote: post #190
skymt wrote: post #181

Earlier quoted context omitted.

Speaking for myself here, but I'm not concerned that Mozilla might push malware into Firefox installations. I'm concerned about the lack of judgement in pushing an extension with a vague, scary-sounding name and description simply for a cross-marketing tie-in, and I'm worried that it could have damaged the trust ordinary users have in Firefox.

> I'm not concerned that Mozilla might push malware into Firefox installations Nobody is concerned about that, in my opinion. I'm concerned someone will push malware through Mozilla into Firefox installations. Pushing addon installs should not be possible at all.

I suspect it's a plan to make some functionality optional... Or opt out..

Ie. code spitting and reducing bloat, and speeding up development by providing some features as add-ons...

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#465

Post by Mithaldu »

TheRealPomax wrote: post #301
UmmNope wrote: post #290

Earlier quoted context omitted.

Well it is - one could expect this sort of crap pushed by marketing/bizdev via management but the fact that Mozilla engineers actively collaborated on this is a sign of deep normative inadequacy among the people who are supposed to be the last line of defense against this sort of thing.

You seem to either not understand or ignore that even in a company like Mozilla, there are decisions made by marketing that end up having to be implemented by engineers. It might be a non-profit, but it's a non-profit corporation with salaried employees, not a loose assembly of people purely in it for the love of a browser. If the incredibly high up people say X needs to happen, you make X happen.

It's a non-profit with a duty specifically different from "make profits" and there are consequences to this.

To quote an ex-mozilla employee:

""

Because the Mozilla Foundation is a nonprofit corporation, it has a specific legal purpose for existing spelled out explicitly in its articles of incorporation: "The specific purpose of the Corporation [here meaning the Foundation] is to promote the development of, public access to and adoption of the open source Mozilla web browsing and Internet application software." If Mozilla Foundation were to ignore this mandate, it would jeopardize the nonprofit, tax exempt status of the foundation

""

In this case they are definitely ignoring the mandate, and this should never remotely have happened.

Source of the legalese: https://static.mozilla.com/foundation/documents/mf-articles-...

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#466

Post by SpliffnCola »

franga2000 wrote: post #410
toyg wrote: post #384

Earlier quoted context omitted.

1) One day you wake up and somebody is watching TV in your living room. 2) you freak out. Who is this guy? I didn't invite anyone last night! 3) The guy turns around and it's just your mate Chad. He didn't mean any harm, just wanted to watch TV and hang out. 4) This is not on, Chad is a psycho. Intentions don't really matter: they've just demonstrated a scary and invasive capability without any warning. Minimizing it…

This "scary and invasive capability" has been included in almost every larger piece of software for years and is widely accepted to be a mostly good thing - it's called automatic updates. Considering updates allow pushing native, even admin-level code, this capability of pushing little bits of JS becomes benign in comparison. Therefore, the only thing that's left to worry about are their intentions. And I, for one, w…

"Automatic update" implies updating of an _already_ installed add-on/program.

This was not an automatic update, it was an installation.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#467

Post by SpliffnCola »

confounded wrote: post #184

While I agree that releasing this as an undocumented extension was a poor PR move, in practical terms, I don’t see how this is any more insidious than the ‘no internet’ dinosaur jumping game built in to chrome. Both are first-party. The difference seems to be that the dinosaur game keeps you entertained, where as this hopes to promote awareness of privacy/security.

>"I don’t see how this is any more insidious than the ‘no internet’ dinosaur jumping game built in to chrome."

You don't see the difference between a built-in game (included in the installation of Chrome) vs. Mozilla pushing an add-on to a Firefox installation using a channel meant for helping to improve the browser?

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#468

Post by awalton »

pilif wrote: post #401
Parcissons wrote: post #326

Earlier quoted context omitted.

I deeply hate this update methodology. Some hippster fresh from university decides that the gui, approach, functionality i use daily is no longer needed and pushes his rewrite into a release. One click later im stuck with this, because all the bundled crap is hijacking the "security" for a ride. If any software developer would truely respect users, he would offer updates as seperate packages, where users can opt out…

Imagine the complexity of maintaining the software when every patch must anticipate a fragmented mess of different pieces of patches being installed on target systems. Imagine the explosion of testcases required. At that point, it’s probably better to just stop feature development and do nothing but security patches, which of course will lead to stagnation and which will also lead to fragmentation as many more incomp…

> Imagine the complexity of maintaining the software when every patch must anticipate a fragmented mess of different pieces of patches being installed on target systems.

...why imagine? That's life as a Windows/Linux/Android dev. (Apple is sort of a stand-out because it has vastly fewer installable parts and less versions in the wild such that it's actually possible to test every patch level of every supported version of macOS or iOS at any given time).

But none of that makes push updates right or wrong. The reality is that it's less of a push than it is a pull anyway - in this case the client is asking for updates on an interval, and the server says "yep, there's one for you." The client grabs it and installs it. And it's turned on by default because, for the most part, that's the right thing to do for your users: you'd rather them be on the newest patch level. Hell for IT admins though, which is why it's almost always a feature they can disable at will.

So here's where this case differs: it's an "experiment" that's actually just marketing trash pushed through the "experiments" channel which is also armed by default, rather than a security or product update (which anybody reasonable can argue should be on by default - secure by default is the goal, after all). The only "experiment" in this case is seeing how many users will put up with Mozilla continuing to pimp out Firefox to the highest bidder as a grab for a new revenue stream before they reluctantly switch back to Chrome.

And judging by the backlash on patches like this one, it's not going so well...

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#469

Post by scrollaway »

bigbugbag wrote: post #396
avtar wrote: post #392

Earlier quoted context omitted.

I've been using Firefox for 90% of my browsing for a few years now and really want to continue to do so but I really wish Mozilla would stop shooting themselves in the foot already. This once again gives the impression that they have some teams that aren't in touch with the reality on the ground, that these types of initiatives hurt their chances of gaining more users.

Let me suggest you a browser aptly named waterfox, that could be described as firefox without mozilla nonsense. [1]: https://www.waterfoxproject.org/

Waterfox is nonsense, no offense to the people behind it. Removing some stuff from Firefox and calling it a day does not make a better Firefox, it just makes for a preconfigured one. You might as well just run Chromium.

The problem is that Mozilla is a good company, that has had a true net positive effect on the world, especially in tech, and continues to do so today with wonderful projects like Rust etc.

If Mozilla were a shitty company, we could all simply dismiss Firefox and get on with our day. But Mozilla is not a shitty company and the fact they keep shooting themselves in the foot like GP said, the fact they are completely out of touch with their userbase, that they cannot see the OBVIOUS problems with this addon even after the Pocket debacle, is ridiculous.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#470

Post by FrozenVoid »

I switched to waterfox for quite awhile. I've lost trust in mozilla when they bundled "Pocket" and people then didn't think much of it. When you lose ability to control the browser its no longer a fair game. Bundling addons, changing settings, ads and "enhancements" no one asked for, all eroded trust. Not to mention its aping Chrome more and more each version. We need more firefox forks, not less. Chrome has dozens, because the privacy threat from google is obvious: firefox hdoesn't have that much forks,because its trusted by distro makers to be safe(but its not, as mozilla just proved). People are upset when this implicit assumption that Firefox is the only browser(among modern graphical browsers) you can trust is actually false.
Post reply on HN