Hacker News Reader

Comment by callahad | Hacker News Reader

Even if the add-on is "enabled," it's doesn't initialize itself unless a specific about:config value is also manually flipped: https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac...

And, for good measure, here's an official quote confirming that we're pulling the add-on from Firefox: https://gizmodo.com/after-blowback-firefox-will-move-mr-robo...

View on HN

It would be easier to forgive if this was the first time Mozilla pulled this sort of thing. Instead, we see Mozilla making this same kind of mistake -- i.e. trying to turn what is otherwise a great browser into some kind of "platform" for things that do not actually serve users -- over and over again.

It's great that it was pulled, but what about removing the ability to silently install add-ons? Give up the power to make this mistake in the future if you want forgiveness.

Absolutely. The whole ordeal reminds me awfully of Ajit Pai's tone as he kills net neutrality, sounding as if everything was fine until net neutrality came along.

Although different, this too brushes off this one instance as a mistake, and entirely disregards the rest of the article, not even trying to address or explain the rest of Mozilla's recent borderline malicious behavior.

A serious fork is long overdue, if only it didn't take a corporation as big as Mozilla to undo their bad deeds.

I'm just one DevRel engineer on a layover; I'm not the right person to answer those broader questions. Not trying to be dismissive, just trying to engage in the areas where I'm most able.

Do you have an insight into whether or not Mozilla will issue an update that removes the ability to push add-ons in this fashion?

Bah. This was something that looked spooky but ran exactly zero payload by itself. It implies failed processes inside mozilla, but nothing malicious.

I still want a justification of the cliqz thing, sure, but I don't demand it in relation to this.

I'm glad it doesn't do anything, but if I saw this in my extensions list, I would think it was malware. That does have an impact. I could have spent hours with my hair on fire trying to figure out how my system was compromised, and I wouldn't be surprised if others have. I'd expect better from an org that has to deal with security issues all the time.

> callahad 4 hours ago [-]

Even if the add-on is "enabled," it's doesn't initialize itself unless a specific about:config value is also manually flipped

Attack surface 101 / reason nobody else does this

How is this a particular attack surface? Changing an about:config value requires quite a bit of effort from an attacker and enabling this extension would not actually pose a security risk either. There's plenty of better about:config values to be changing, too.

Reply on news.ycombinator.com