Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser • Hacker News Board

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#471

Post by zie » Sat, Dec 16, 2017, 3:30 AM UTC

feelin_googley wrote: post #324

zie wrote: post #222

Earlier quoted context omitted.

Have fun in Lynx. that's probably the only browser that wouldn't do something like this. Well maybe Safari, not because Apple wouldn't, but because they just don't care enough about ad revenue. Chrome: They leech everything they can get away with, granted it goes only to Google, but you know it's just to feed their never-ending ad-revenue goal. MS: They bypassed IE only ads, and went on to build ads into the entire O…

The truth is that there have been other text-only browsers both before and after lynx. I have tried every one I could ever find, since the 1990s. Some of them seem to have been forgotten. IMO, whatever is in todays package collections is not a true representation of all text-only browsers ever written. Most times when someone cites "lynx", as is common on HN, I interpret this as a signal they are not too familiar wit…

I agree, I just used lynx there as a stand in for all text based browsers, since it's the most well known, and easiest to get running.

I'm not sure I agree the web is getting more text-friendly.. it is getting more JSON friendly, mostly, but actually visiting web-pages where JS isn't required is becoming increasingly rare. I've yet to find a text/console browser that can actually run JS. (I know there have been some experiments, but none that actually work last I checked)..

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#472

Post by mshenfield » Sat, Dec 16, 2017, 3:33 AM UTC

From the wikipedia article. linked in the ticket

> Shield Studies are available on all channels. Individual studies can be opt-out or opt-in and any and all data being collected will be declared openly. After confirming willingness to participation, a self expiring add-on will be installed on the user's machine.

Mozilla is only installing an experimental feature ass an add-on if they opt in.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#473

Post by zie » Sat, Dec 16, 2017, 3:35 AM UTC

bigbugbag wrote: post #406

zie wrote: post #222

Earlier quoted context omitted.

Have fun in Lynx. that's probably the only browser that wouldn't do something like this. Well maybe Safari, not because Apple wouldn't, but because they just don't care enough about ad revenue. Chrome: They leech everything they can get away with, granted it goes only to Google, but you know it's just to feed their never-ending ad-revenue goal. MS: They bypassed IE only ads, and went on to build ads into the entire O…

what about otter ? waterfox ? uzbl ? poseidon ? netsurf ? falkon ? k-meleon ? Iron ? Iridium ? Liri ? Min ? To cite some of the browsers you overlooked in your snarky comment.

It was definitely snarky, but I did try to qualify the snark to be useful-snark, and not just plain snarky.

As for all these browsers, all of them(unless I'm mistaken) are based off of one of the big 3(Chrome, FF, Safari) so you still have to trust the big 3 to run these, for the most part, as they are all single-developer or maybe a very small team, and would be very hard pressed to catch underhanded attempts from any of the big 3 to embed any nastiness.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#474

Post by mshenfield » Sat, Dec 16, 2017, 3:35 AM UTC

kibibu wrote: post #204

pmlnr wrote: post #190

Earlier quoted context omitted.

> I'm not concerned that Mozilla might push malware into Firefox installations Nobody is concerned about that, in my opinion. I'm concerned someone will push malware through Mozilla into Firefox installations. Pushing addon installs should not be possible at all.

I'm concerned about Mozilla pushing software written by the Mr Robot marketing department.

This thread needs to lighten up. It's one goofily named add-on pushed to a miniscule number of users in an opt in program. Firefox and their judgement are fine.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#475

Post by gorbachev » Sat, Dec 16, 2017, 3:37 AM UTC

ubernostrum wrote: post #446

gorbachev wrote: post #269

Earlier quoted context omitted.

Unfortunately the most important person involved didn't get to review the plugin before it was installed on my computer. Me.

OK, I have to rant a bit on this. I worked at Mozilla for about four years (2011-2015), on MDN. It's built as a wiki, with wiki features open to everyone. The code is all open source and on GitHub. Its issues and tasks and roadmap are tracked in a public bug tracker. We operated in a public IRC channel. We didn't have to do that. We could have just built something targeted to only be used by the technical writing sta…

I think you misunderstood. I don't want to review the damn source code. I don't have time to do that. I am pretty sure the Mozilla developers are all better developers than I am as well, so my contributions there would be a complete waste of time.

However, when you decided that the source code I could review would be installed on my computer without my consent, then I do object. It's my computer. It runs things that I choose to run on it, not things your marketing/sales department thinks my computer should run.

Additionally I find your rant about "open source is for all of us to contribute and if you don't shut the fuck up" wholly ridiculous.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#476

Post by ubernostrum » Sat, Dec 16, 2017, 3:38 AM UTC

WCityMike wrote: post #461

ubernostrum wrote: post #446

Earlier quoted context omitted.

OK, I have to rant a bit on this. I worked at Mozilla for about four years (2011-2015), on MDN. It's built as a wiki, with wiki features open to everyone. The code is all open source and on GitHub. Its issues and tasks and roadmap are tracked in a public bug tracker. We operated in a public IRC channel. We didn't have to do that. We could have just built something targeted to only be used by the technical writing sta…

You want to point us towards where ... on Bugzilla and the Mozilla project wiki pages and the source code and all the other things you mentioned ... this addon was discussed?

Firefox is open source. Someone had to have committed code to make this happen, which you can use to go dig up the history if you want to.

But you're not going to do that. Which is your right; it's just hard to complain about not being consulted/not getting to review/etc. when you're talking about a piece of open-source software with public repositories and trackers. Anyone on earth is allowed to see what's going on in there.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#477

Post by Zancarius » Sat, Dec 16, 2017, 3:41 AM UTC

TheRealPomax wrote: post #303

UmmNope wrote: post #298

Earlier quoted context omitted.

The major problem was building a feature into the product that allowed for pushing add-ons without users knowledge much less active consent in the first place, there is no benign use for this kind of functionality.

you mean the automatic update process, which can change every single byte of every file in every directory under Firefox's control? Because unless you want to live in a world where your browser can't automatically apply security patches and upgrade critical components, the fact that the application can update itself is very much not the actual problem (and with the new web extension addon system rathern than the old…

I'd argue there's a vast difference between an automatic update for something that was already manually installed, by the user, and automatically installing something without any indication to the user that it was installed. Worse, it's impossible to argue that this was even a useful extension.

I don't watch television, and I don't keep up with any popular modern shows. I had no idea what Mr. Robot was until looking through this thread, and the description text for the addon was, at first glance, suspicious. This was a terrible idea and isn't even remotely analogous to applying security updates automatically. If I have something I specifically installed, fine, I can expect those addons to be updated automatically. I don't expect them to side load something I don't even want. "Delight fans" my ass. You have to be a fan first, and I'm not even sure most people who are fans of Mr. Robot would think this is a particularly good idea.

Funny enough, the only thing I can think of that's even remotely similar to this is the "Hell, Dolly" plugin for WordPress, and that's installed out of the box as part of the distribution.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#478

Post by zie » Sat, Dec 16, 2017, 3:48 AM UTC

geofft wrote: post #279

zie wrote: post #222

Earlier quoted context omitted.

Have fun in Lynx. that's probably the only browser that wouldn't do something like this. Well maybe Safari, not because Apple wouldn't, but because they just don't care enough about ad revenue. Chrome: They leech everything they can get away with, granted it goes only to Google, but you know it's just to feed their never-ending ad-revenue goal. MS: They bypassed IE only ads, and went on to build ads into the entire O…

I'm running Firefox via Debian, and I intend to continue running Firefox via Debian - I trust that the outcry in the Debian community would be so huge if the Firefox maintainer (or any other maintainer) allowed this sort of code from upstream through.

Well FF did just get caught with their pants down, installing a Mr.Robot (tv show tie-in) Add-on(extension) to FF users, without their consent. Since it was an Add-On that was pushed after a debian install, Debian devs wouldn't have been able catch it before it reached end-users.

That said, I still use FF, but I do make sure I keep all the opt-in telemetry and stuff off, since it was one of these settings that "let them" get away with installing the add-on without consent.

Granted the add-on by default didn't do anything unless you enabled it, but still.....

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#479

Post by ubernostrum » Sat, Dec 16, 2017, 4:22 AM UTC

gorbachev wrote: post #475

ubernostrum wrote: post #446

Earlier quoted context omitted.

OK, I have to rant a bit on this. I worked at Mozilla for about four years (2011-2015), on MDN. It's built as a wiki, with wiki features open to everyone. The code is all open source and on GitHub. Its issues and tasks and roadmap are tracked in a public bug tracker. We operated in a public IRC channel. We didn't have to do that. We could have just built something targeted to only be used by the technical writing sta…

I think you misunderstood. I don't want to review the damn source code. I don't have time to do that. I am pretty sure the Mozilla developers are all better developers than I am as well, so my contributions there would be a complete waste of time. However, when you decided that the source code I could review would be installed on my computer without my consent, then I do object. It's my computer. It runs things that…

You chose to install Firefox, and you chose not to participate in the process that creates it. What happened next was not "without your consent". What happened absolutely had your consent. You consented by deciding that the whole messy process of producing the software was going to be someone else's problem, and you just wanted the sausage without having to see or take part in how it got made. You consented by delegating to the people who actually did the hard work of making and shipping the software.

If you now decide you don't want to run that software anymore, that's perfectly fine and is your choice to make. But arguing that you didn't have an opportunity to know what was going on or review code before it landed on your computer, when you installed Firefox by your own choice, when you decided not to take advantage of the radically transparent and open way it's built, is just not going to fly. You had a million and one opportunities to "review" the code you were going to download and run. You just chose to do other things instead. You seem to regret that, but you also seem not to have learned any lesson from it.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#480

Post by [deleted] » Sat, Dec 16, 2017, 5:02 AM UTC

ubernostrum wrote: post #479

gorbachev wrote: post #475

Earlier quoted context omitted.

I think you misunderstood. I don't want to review the damn source code. I don't have time to do that. I am pretty sure the Mozilla developers are all better developers than I am as well, so my contributions there would be a complete waste of time. However, when you decided that the source code I could review would be installed on my computer without my consent, then I do object. It's my computer. It runs things that…

You chose to install Firefox, and you chose not to participate in the process that creates it. What happened next was not "without your consent". What happened absolutely had your consent. You consented by deciding that the whole messy process of producing the software was going to be someone else's problem, and you just wanted the sausage without having to see or take part in how it got made. You consented by delega…

[deleted]