Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser • Hacker News Board

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#511

Post by scrollaway » Sat, Dec 16, 2017, 3:44 PM UTC

bkdbkd wrote: post #500

scrollaway wrote: post #469

Earlier quoted context omitted.

Waterfox is nonsense, no offense to the people behind it. Removing some stuff from Firefox and calling it a day does not make a better Firefox, it just makes for a preconfigured one. You might as well just run Chromium. The problem is that Mozilla is a good company, that has had a true net positive effect on the world, especially in tech, and continues to do so today with wonderful projects like Rust etc. If Mozilla…

Heaven forbid the decisions about what features an application gives and takes away are decided by lowly users. The free in free software means libre still, right? So if someone forks over 1 change or 10 they are still libre to do it, or is that passe? Its free as in liberty, as in freedom of thought, or is that also passe? Forking a project, and adding features and removing pulls that you don't want and/or need is k…

The new extension system was announced years in advance, including the warning that XUL addons would eventually be deprecated.

This design decision is behind a large part of the performance improvement in 57.

Yes I'm sad, I lost some of my favourite addons as well. But this move was announced well in advance and it had a serious technical reason behind it.

In a difficult situation, Mozilla made a tough decision that is good in the long run and that benefits all its users. Crying "fork!" over it is so blind it leaves a bad taste in my mouth.

> So if someone forks over 1 change or 10 they are still libre to do it, or is that passe?

It's nonsense. Doesn't mean they can't do it, doesn't mean it's not nonsense. Furthermore, in some situations, forks can be harmful to the overall health of an already fragile ecosystem. They're not free of externalities.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#512

Post by ackalker » Sat, Dec 16, 2017, 3:48 PM UTC

kryptiskt wrote: post #383

kryptiskt wrote: post #267

Earlier quoted context omitted.

The major problem is that they installed an add-on without properly communicating what it was. A somewhat smaller problem but still a big problem is that was an utterly frivolous add-on that shouldn't have been pushed to people who didn't explicitly want it. But the biggest problem is that Mozilla seems to have trouble understanding why any of those two would be a problem, I want my browser vendor to be serious and n…

So this is the first response from Mozilla in the Gizmodo article: “Firefox worked with the Mr. Robot team to create a custom experience that would surprise and delight fans of the show and our users. It’s especially important to call out that this collaboration does not compromise our principles or values regarding privacy. The experience does not collect or share any data,” Jascha Kaykas-Wolff, chief marketing offi…

> [...] The experience does not collect or share any data [...]

Wrong (unless proven otherwise).

From the Shield Studies FAQ[1]:

> What data do Shield Studies normally collect?

> [...]

> Mechanism:

>

> - at STARTUP, SHUTDOWN, INSTALL, UNINSTALL, - send a `shield-study` packet containing the Unified Telemetry Environment.

As was stated before, users report that they have had this extension pushed to their browser without their prior consent to sending any telemetry data.

[1]: https://wiki.mozilla.org/Firefox/Shield/Shield_Studies

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#513

Post by acqq » Sat, Dec 16, 2017, 4:29 PM UTC

acqq wrote: post #458

callahad wrote: post #457

Earlier quoted context omitted.

The add-on only initializes itself (and thus sends the header) if the user has manually gone into about:config and flipped the `extensions.pug.lookingglass` preference: https://github.com/gregglind/addon-wr/blob/59659431fd2a75c33...

It was obviously not complete in the form it was delivered, the "turning on" was supposed to be added somewhere at some later moment. The whole thing is still suspicious: it was delivered to everybody whereas if it was supposed to be used only by the users who are aware of it, as now Mozilla tries to spin it, i.e. only to those who decided to "play the game", then the hidden install, especially to every user, was unn…

The proof of the planned data collection, confirming my previous claims, found declared in the source of the extension itself:

"## Observed data

- Possible page view counts on SUMO

- Possible page view counts (with and without the special 'enrolled' header) on Partner pages."

I've also already explained the "special 'enrolled' header."

The turning on was obviously either planned for some special moment, which wasn't the moment of that the extension was actually delivered, or the extension was accidentally delivered in the unfinished state -- doesn't matter, it provably didn't get enough scrutiny, see my other comments here for the details, the damage it actually done is regarding "tracking" less than planned, but regarding annoyance of their users probably more.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#514

Post by ackalker » Sat, Dec 16, 2017, 4:33 PM UTC

acqq wrote: post #510

ackalker wrote: post #507

Earlier quoted context omitted.

> [...] the extension gets silently pushed to all the US users(!) Non-US user here, my Firefox got it, too.

It's not what you are but what your settings are, please go here and check what your browser reports under ACCEPT_LANGUAGE. If it is "en-US" you are considered a "US user" enough: https://www.whatismybrowser.com/detect/what-http-headers-is-... BTW: the extension we all talk about here has exactly this site that is used for checking the headers hardcoded inside, obviously in order for the developers to test their newl…

In my case the setting lists two languages, but "en-US" does appear to have a higher 'quality' factor, so there.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#515

Post by pbhjpbhj » Sat, Dec 16, 2017, 4:45 PM UTC

DarronWyke wrote: post #353

kuschku wrote: post #321

Earlier quoted context omitted.

Correct, those ToS and EULA are considered invalid, if they contain unexpected agreements, such as "your firstborn belongs to us", or "we can install whatever software we want on your system".

Except they didn't install whatever software they want. They said they can install software to check metrics and more. Which is what this is.

Check metrics !== advertise a game.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#516

Post by muraiki » Sat, Dec 16, 2017, 6:16 PM UTC

ubernostrum wrote: post #479

gorbachev wrote: post #475

Earlier quoted context omitted.

I think you misunderstood. I don't want to review the damn source code. I don't have time to do that. I am pretty sure the Mozilla developers are all better developers than I am as well, so my contributions there would be a complete waste of time. However, when you decided that the source code I could review would be installed on my computer without my consent, then I do object. It's my computer. It runs things that…

You chose to install Firefox, and you chose not to participate in the process that creates it. What happened next was not "without your consent". What happened absolutely had your consent. You consented by deciding that the whole messy process of producing the software was going to be someone else's problem, and you just wanted the sausage without having to see or take part in how it got made. You consented by delega…

> You had a million and one opportunities to "review" the code you were going to download and run. You just chose to do other things instead.

False dichotomy. I chose to opt into USER STUDIES because I trusted Mozilla. I use Firefox specifically because I do not want to use a browser from a company that makes its money off of advertising, meaning Chrome. I trusted Mozilla to hold to their word regarding what opting in to user studies meant, and they instead gave me exactly what I didn't want: advertising.

If your solution to this is to completely throw away my trust in Mozilla, replacing it with having to spend an extraordinary amount of time reviewing every wiki change, mailing list post, commit, and bug, then you're being ridiculous and showing extraordinary contempt for users -- especially the many users who aren't programmers. Firefox is supposed to be a browser that respects users, but this case shows that it doesn't.

Finally, I have both donated to Mozilla and helped resolve a bug, so I absolutely have participated in the process.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#517

Post by michaelmrose » Sat, Dec 16, 2017, 6:43 PM UTC

bigbugbag wrote: post #396

avtar wrote: post #392

Earlier quoted context omitted.

I've been using Firefox for 90% of my browsing for a few years now and really want to continue to do so but I really wish Mozilla would stop shooting themselves in the foot already. This once again gives the impression that they have some teams that aren't in touch with the reality on the ground, that these types of initiatives hurt their chances of gaining more users.

Let me suggest you a browser aptly named waterfox, that could be described as firefox without mozilla nonsense. [1]: https://www.waterfoxproject.org/

Is there any reason to believe that one guy has sufficient resources to maintain a fork of firefox? Its not like he can keep backporting all fixes from what will increasingly be an incompatible browser.

It also wont get any of the improvements mozilla is in the process of making so it will ultimately be slower and with fewer features.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#518

Post by michaelmrose » Sat, Dec 16, 2017, 7:00 PM UTC

TheRealPomax wrote: post #303

UmmNope wrote: post #298

Earlier quoted context omitted.

The major problem was building a feature into the product that allowed for pushing add-ons without users knowledge much less active consent in the first place, there is no benign use for this kind of functionality.

you mean the automatic update process, which can change every single byte of every file in every directory under Firefox's control? Because unless you want to live in a world where your browser can't automatically apply security patches and upgrade critical components, the fact that the application can update itself is very much not the actual problem (and with the new web extension addon system rathern than the old…

Actually an application being able to update itself is a security issue and terrible design. Strictly speaking it should have only have write access to say its cache files and a directory where you store downloads.

Its also moronic to have a different update policy per app that is achieved in 35 different UIs.

This is the norm on windows because they were late to the party as far as a central source of software and further managed to make it an unattractive proposition and didn't get much buy in from developers.

Totally aside from the implicit security issue the ui flow is also terrible. Either each of 35 different apps runs their own update checker process in the background wasting your resources and prompting you at annoying times or when you run an app one out of n times it will prompt you to update whereupon you will ultimately have to stop doing whatever you were actually doing and let it update itself and restart.

It is truly amazing that people not only put up with this ridiculous situation but defend this as a feature.

Your system should periodically on a schedule you set update every piece of software you own and never bother you otherwise.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#519

Post by siimtalvik » Sat, Dec 16, 2017, 8:00 PM UTC

mshenfield wrote: post #474

kibibu wrote: post #204

Earlier quoted context omitted.

I'm concerned about Mozilla pushing software written by the Mr Robot marketing department.

This thread needs to lighten up. It's one goofily named add-on pushed to a miniscule number of users in an opt in program. Firefox and their judgement are fine.

it was an opt-out program actually.

Studies are enabled by default.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#520

Post by smsm42 » Sat, Dec 16, 2017, 8:39 PM UTC

blauditore wrote: post #170

Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all? The main question is what behavior is being introduced. I haven't researched deeply, but apparently the ad…

Somebody trusted their browser, because never before they attempted such things as installing code that has nothing to do with the browser and is an advertisement gimmick.

I am genuinely astonished that somebody up the corporate tree at Mozilla thought this is a good idea. I mean, I get the appeal of getting the money and doing the cool IRL tie-in to the show, but that's not just how you do it. If I am a fan of a particular actor, I don't expect him/her to suddenly be in my bedroom when I come home one day. I would prefer to invite them first (if I am so inclined).

The trust here is specifically trusting them not to do such things. Which now has been violated. And the fact that CMO says anything else than "Man, did we screw up! We're so sorry, would never happen again!" is deeply sad and concerning.