Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

support.mozilla.org

Post reply on HN
Print view View original

521–530 of 537 posts

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#521

Post by siimtalvik »

ubernostrum wrote: post #446
gorbachev wrote: post #269

Earlier quoted context omitted.

Unfortunately the most important person involved didn't get to review the plugin before it was installed on my computer. Me.

OK, I have to rant a bit on this. I worked at Mozilla for about four years (2011-2015), on MDN. It's built as a wiki, with wiki features open to everyone. The code is all open source and on GitHub. Its issues and tasks and roadmap are tracked in a public bug tracker. We operated in a public IRC channel. We didn't have to do that. We could have just built something targeted to only be used by the technical writing sta…

One of the reasons people are angry, is that this type of investigation has been made as hard as possible currently.

Posts are being removed from bugzilla and threads being locked. The code itself comes from a random github repo, not affiliated with mozilla/firefox. (https://github.com/gregglind/addon-wr/)

https://bugzilla.mozilla.org/show_bug.cgi?id=1424977

people here were asking why normal process wasn't followed. No answer or links to resources.

another closed discussion here:

https://bugzilla.mozilla.org/show_bug.cgi?id=1425187

and here:

https://bugzilla.mozilla.org/show_bug.cgi?id=1425171

I appreciate your input as someone who knows the process, but this really wasn't followed this time.

edit: they've changed the repo now. so it's redirected to https://github.com/mozilla/addon-wr

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#522

Post by icebraining »

Simon_says wrote: post #447
icebraining wrote: post #81

Earlier quoted context omitted.

Why? They allowed proprietary extensions (e.g. Flash) from the start. I don't like it, but I don't see how it represents a loss of their way. Mozilla was never GNU.

Big difference between an extension and being integrated into the browser. It's directly analogous to the difference between your OS being closed source and your OS being able to run closed source programs. The former is a liability; the latter is an ability that you grant to users to use the system the way they want.

The CDM modules are not integrated with the browser. The browser only has an (open source) sandbox to run them.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#523

Post by geofft »

zie wrote: post #478
geofft wrote: post #279

Earlier quoted context omitted.

I'm running Firefox via Debian, and I intend to continue running Firefox via Debian - I trust that the outcry in the Debian community would be so huge if the Firefox maintainer (or any other maintainer) allowed this sort of code from upstream through.

Well FF did just get caught with their pants down, installing a Mr.Robot (tv show tie-in) Add-on(extension) to FF users, without their consent. Since it was an Add-On that was pushed after a debian install, Debian devs wouldn't have been able catch it before it reached end-users. That said, I still use FF, but I do make sure I keep all the opt-in telemetry and stuff off, since it was one of these settings that "let t…

The Debian package of Firefox is not supposed to pull any code directly from Mozilla - whether security updates, marketing tie-ins, updated SSL libraries, whatever. Like all Debian packages, code is supposed to go through Debian. The only Debian programs that are supposed to fetch code on their own are ones where you explicitly tell it to do so (e.g., you're running `pip install` or something).

So the only way this code would end up on my machine is one of two ways:

1. The Debian Firefox package is pulling code from Mozilla without the maintainer's review (which is definitely possible, given how complex Firefox is and how there's approximately one person packaging updates including timely security updates), which would of itself be seen as a serious problem

2. The Debian maintainer specifically picked up this code as part of the tarball from Mozilla, and shipped it without noticing (also definitely possible!) or decided it was worth including

For what it's worth, I do not have this plugin in about:addons, and Debian unstable hasn't picked up a Firefox update since December 1, so as far as I can tell the system is working properly.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#524

Post by Simon_says »

callahad wrote: post #246
TAForObvReasons wrote: post #187

Earlier quoted context omitted.

If this were the first incident, and they quickly backtracked on it, then maybe we can give them a pass. But this isn't the first case of somewhat shady behavior. Remember the "user-enhancing" sponsored tiles a few years ago? https://twitter.com/dherman76/status/433320156496789504 > Excited to share the launch of @mozilla @firefox Tiles program, the first of our user-enhancing programs The problem there wasn't just t…

That tweet sounds like doublespeak, but Directory Tiles really did have some genuinely good ideas mixed in with the bad. I don't know how far we got with it, but one of the ideas was to serve a generic bundle of ads, and then select which ones to display locally, based on an entirely private, client-side analysis of the browser's history. Now, that probably shouldn't have been on the new tab page, and probably not in…

I've recently switched to a browser that doesn't fund itself through ads. It's not an iron law of the universe that the Internet needs ads to function.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#525

Post by sharno »

It's a PR disaster from Mozilla. I was once a Mozilla rep and I'm ashamed of this. Studies like these should always be turned off by default and the user can opt in voluntarily. But launching Firefox and digging into the preferences to find that I'm enrolled into some studies by default is unethical for me. Sadly, I'll have to switch to Brave or some other privacy concerned browser until I see an official statement and action from Mozilla. I'm sure the management there have something to do with all of this.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#526

Post by bad_user »

brador wrote: post #373
bad_user wrote: post #156

Earlier quoted context omitted.

That's ridiculous, since FF is literally fetching and rendering that content, being its raison d'être. You can't "sniff" what is already yours to begin with.

Sniff implies sending. It's the scanned content transportation and destination that's the issue.

There's no sending involved with this add-on.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#527

Post by ubernostrum »

gorbachev wrote: post #505
ubernostrum wrote: post #479

Earlier quoted context omitted.

You chose to install Firefox, and you chose not to participate in the process that creates it. What happened next was not "without your consent". What happened absolutely had your consent. You consented by deciding that the whole messy process of producing the software was going to be someone else's problem, and you just wanted the sausage without having to see or take part in how it got made. You consented by delega…

Again, I did not have a chance to review whether or not the add-on would be installed and run on my computer, because you installed and ran it without my consent. This is not hard. Don't automatically install stuff on your users' computers. You're defending something every other software company has found themselves in trouble for previously. I really don't understand why. The fact that Firefox is open source in no w…

because you installed and ran it without my consent

I didn't install and run anything on your computer. I don't work for Mozilla.

And you installed a piece of open-source software whose source code you could have audited at any time, but you chose not to. You delegated the auditing to someone else, and now you're upset at what they chose to do with the power you gave them. You're free to complain that you don't like what they did, and not to trust them in the future, but you don't get to say that you had no chance to give input or to see what would run. You had plenty of opportunities for that and did not do it.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#528

Post by majewsky »

sundarurfriend wrote: post #115
majewsky wrote: post #56

In the Preferences, scroll down to "Data Collection and Use", and disable everything . I know that you only need to need to turn off "install and run studies", but this has now cost Mozilla all telemetry data from me, and I encourage everyone to do the same.

I've switched to Waterfox, because of things like this (including the Cliqz issues). I'm all for Mozilla making money and trying things, the problem is the way in which they do it. They fail to respect the users enough to communicate things, and have not been behaving like a user-friendly transparent company for some time now. I was a big enough fan to regularly donate and urge friends to do the same, but something h…

I heard about Waterfox, but support for legacy extensions is a huge warning sign. I don't want to be stuck on FF56 technology forever.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#529

Post by YtvwlD »

chippy wrote: post #202
pmlnr wrote: post #132

FF 57 installed from Debian unstable repository has "Data reporting is disabled for this build configuration" - which disabled, in theory, the shield "studies" as well. I don't know who made this decision at Debian, but thank you.

I wonder if the Ubuntu stable ones have this too?

Ubuntu stable seems to have disabled this as well.

Re: Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser

#530

Post by mshenfield »

siimtalvik wrote: post #519
mshenfield wrote: post #474

Earlier quoted context omitted.

This thread needs to lighten up. It's one goofily named add-on pushed to a miniscule number of users in an opt in program. Firefox and their judgement are fine.

it was an opt-out program actually. Studies are enabled by default.

See the dev's response on the "slippery slope" thread. You had to go into about:config to enable it.
Post reply on HN