I call complete and total BS on this. I may not be on the EFF echo-chamber, and I agree they handled this poorly, but this absolutely does not concern me after hearing the way th add-on behaved. They made a mistake in communications and behavior that should have been expected, but as they said, it did zero data collection and performance impact. It was a screw-up they have fixed via process.
If people are so upset at Firefox for a mostly innocuous mess-up that was quickly caled out and clarified/fixed in the future, that they would dump Firefox for the hero of privacy Chrome, they are very foolish in my opinion.
Firefox handled a mess up very well. The extension was always opt-in and never extracted any data. It came from a trusted source regardless via another layer of opt-in experiment beta testing.
Yes it wasn't cool they chose poor language and didn't fully consider the implications of installing a 'fun' experiment. But lets keep our shirts on.
Quantum has been more than rewarding and this minor PR issue is hardly deterring me from using Firefox... especially compared with Chrome being built by the biggest ad company in the world.
So yes, people will be outraged.
We're sick of being taken advantage of by dishonest companies and individuals because the US privacy laws are a complete joke.
Creating a plugin that modifies content on your screen and injects HTTP headers is egregious enough (just look at the response Comcast got for doing it), but doing it for a TV show tie-in? How did that idea even make it through one round of approvals, much less land on every Firefox user’s machine?
Users trust web browsers to deliver the exact content that was requested — that’s why we have gpg signatures, hashsums, and HTTPS. It’s arguably a core tenet of the web. IMO the reaction of the tech community can only be expected in response to such a deep violation of trust.
As you said, the real issue here is the terrible decision to push this to everyone.
After literally years of struggle with Chrome and Firefox I finally switched to Safari (recently I switched to iPhone so on mobile too) and yes for personal browsing, on a Mac, this is really better than any other browser out there and Quantum felt as good. No, I don't have benchmarking scores, but I am speaking from an end user point of view.
I was a lifetime Firefox user - started browsing on it when I bought my first laptop in 2007 and never touched anything else until Pocket happened and after testing Quantum for a few days I was so happy that the Firefox is back. I don't think so. I guess I will sit this one out. It's not an isolated incident. They have been doing it constantly since Pocket.
Three strikes... and I'm using Safari, because this seems to be the least bad right now. Pretty lame from Mozilla.
Edit: forgot about Pocket.
Of course, I am not leaving. The CMO should be leaving!
Yeah, but since it doesn't have an entire dev team committed to it, the fork dies and/or you're using an out of date browser with all sorts of security vulnerabilities and incompatibilities. Some attempts with actual resources behind them:
Cyberfox - dead
PCXFirefox - latest merge was FF 53. Using outdated plugins (e.g. Sumatra PDF from 2014!)
Waterfox - dead
Pale Moon - Still alive. Removes a host of features (e.g. Accessibility and Parental Controls) in the name of performance, yet performs horribly in benchmarks. Slow to adopt new features.
Besides, who's going to use these? A tiny fraction of the population consisting of people reading this thread and threads like it? Who cares?
So yeah, you _could_ "just" fork FF, but it won't get you anywhere. And why the hell am I doing this? I have much better things to do with my time than maintain my own damn web browser. I am constantly amazed at comments like this which are so obtuse as to be comical.
Since when? It's last commit was 5 days ago:
I never would have guessed. Browsing this thread and writing this comment in my sparkling brand new Waterfox 56.
> Pale Moon - Still alive [...] Slow to adopt new features Slow or reluctant by design. A fork from way back before FF started dismantling its UI. Many new 'features' will never be adopted by Pale Moon.
Snark is fine, but please base it on fact.
My point is that, if you (not a dev team) don't like something you (again, not a dev team) can build it from source to do exactly what you want. Firefox is OSS, most of the popular extensions are OSS. That's the whole point of the thing.
Mozilla has done a pretty good job of championing open standards, open source, user freedom, and all the stuff that people complain about on HN as if they weren't squarely first world problems. You outsource the upkeep of this incredibly complicated software to them and for the most part they do a great job. The level of vitriol about all of this just illustrates the whole "from-zero-to-death-threat" thing that has happened with everything in modern life.
I'm saying that they give you something awesome. They mainly do a pretty good job of championing some of the things that you care about. They made a mistake and they seem to understand everyone's displeasure with it. The end...or get off your ass and do something about it rather than just complaining about how the people giving you the awesome free thing hurt your fee-fee's.
Wrote this in a previous discussion: https://news.ycombinator.com/item?id=15940491
>> updates have been known to re-enable it if you turn it off ... But it doesn’t matter - you’re going to re-enable it on the next update.
> It's surprising how ... trustworthy Chrome is in this regard. My default search engine is set to DDG and through countless updates Chrome has never once attempted to reset it to Google.
Even though Chrome has every incentive to break privacy settings, even though Chrome has every incentive to revert the default search engine to Google, they don't.
So Chrome's privacy settings are already broken by default, in nearly the worst way they could be.
[0] https://www.google.com/chrome/browser/privacy/index.html, "Signed-in Chrome mode"
I did find this on their wiki: https://wiki.mozilla.org/CloudServices/Sync/FxSync/Archived/... interesting tidbit that you could host it yourself. Not sure if you still can.
I hear, it's not that easy to setup, though, as Mozilla only really needed to set it up for themselves a handful of times, probably.
According to the policy, they use this data only in anonymized and aggregated form.
That's the default, isn't it? So no, not only anonymized and in aggregate. And either way, your compylete raw browsing data is sitting there on Google's servers and associated with your account.
>> [Firefox] updates have been known to re-enable it if you turn it off ... But it doesn’t matter - you’re going to re-enable it on the next update.
You can choose to opt out of Chrome's phoning home in the privacy settings and they haven't tried to revert those settings in an update (and given their track record, I have no reason to believe they will try to surreptitiously change the settings in a future release)
With Firefox, the entire codebase has to shine, because someone will find it and hold Mozilla to a far higher standard. A bug in the update process that resets search engines is then only one of many things that they're supposed to watch out for.
https://www.youtube.com/watch?v=qMALm1VthGY
It's also disingenuous to present a false dichotomy with Chrome, as if there weren't any other privacy-focused alternatives out there:
Any browser is going to struggle against the top two behemoths, so I'm not sure why exactly that would be an argument to just accept it and continue using products by companies that have lost your trust. Are end users supposed to compromise their ethics just because web developers aren't in the habit of testing against their browser of choice yet? That just seems like an awfully 'silicon-valley-centric' view of the world.
What does this "success" thing have to do with ditching a product that had violated your trust anyway? Are businesses in most other industries viewed this way? Am I expected to stop buying food from local producers just because the big-box food suppliers are more ubiquitous?
To me, all that matters is sustainability, and IceCat has been going strong for 12 years, PaleMoon has been consistently developed for 8 years, and Waterfox for 6 years. So that's enough for me to at least give them a shot.
Every browser on that list is based on either Chromium or Gecko.
It's quite a disservice to Palemoon and Waterfox to include such an anti-user project as Brave.
I'm not sure what this means. Can you expand on how Eich has been dishonest in how he used his money?
Eich did everything he could to conceal that his libertarian image was a facade and in fact he was a social authoritarian.
Once it came out he was actively using his money on political campaigns designed to try and further empower and justify the state to decide what relationships between consenting adults was forbidden, he had a rather hard time being taken seriously in this area.
I'm not sure why someone who's actively and monetarily supported politicians saying homosexuals should have to register in a special registry parallel to the sex offender registry is being taken seriously in the privacy arena. Privacy is not something that can be decomposed as an asset to purchase. Every person who doesn't have it leaks information about the people they interact with, and that undermines privacy for everyone.
Did you ever support a politician (say, Obama) only to find they said something you disavowed? Sam Yagan of okcupid did. I disavow Buchanan’s unconstitutional AIDS registry, and probably other proposals he has made.
As for “social authoritarian”, California regulates and licenses marriage via family law, as do all states. I come from an older generation of allies who supported Mark Leno et al. when they labored over, passed, and amended to full positive-rights equivalence with marriage, CA’s Domestic Partner Law (https://en.m.wikipedia.org/wiki/Domestic_partnership_in_Cali...). This was considered just and sufficient, until it was not — and then anyone who questioned the revolutionary tactics used to cast former allies as haters and bigots became a hater too.
I dissent from all such revolutionary tactics and agendas. I agree with dissenting LGBTQ scholars of note on this point re marriage equality, e.g., Camille Paglia. (I don’t agree with those scholars on everything, of course. Same as with most people, including politicians I’ve supported in the past.)
Now the shoe is on the other foot. Marriage equality is law and I’m an officer of a corporation with a genuinely diverse roster of employees. I am committed to the fullest definition of inclusivity, which covers right wingers as well as left, libertarians and non-libertarians. For you to gin up a case that I pretended to be a libertarian is silly (I never pretended that).
But worse, if you judge Brave by a past and too-narrow slice of my opinions, you are doing what haters who boycott Apple because of Tim Cook do. It is your right, of course, but it looks like consequentialism (end justifies means) or really just Who/Whom ax-grinding. I hope you will use Brave in view of what we are trying to do, as a group of people who share a cause and set of beliefs, whatever our other or past causes and beliefs.
Oh, please, no, it wasn't by, well, almost anyone. Most LGBTQ advocates and allies never considered it “just and sufficient”, they (at best) considered it at best a distasteful compromise that was better than the pre-existing state and at worst a capitulation to those who wanted to give religious groups a veto over he definition of civil marriage which ignored the enduring lesson of the struggle for civil rights that separate institutions are inherently unequal nnyour and entrenched in law the othering of LGBTQ people and thir families and relationships.
The idea that there was ever a consensus, either in society or among LGBTQ advocates and allies, that the separate institution of domestic partnership was “just and sufficient” is rewriting history.
False. Mark Leno said so. http://www.sfgate.com/news/article/Gay-marriage-up-to-govern...
You may not be familiar, but in previous decades, Mark Simpson, Michel Foucault, and many other gay writers were against "gay marriage", often expliciltly arguing it was an embourgeoisement to be rejected.
Andrew Sullivan and others (with lots of documentary and eyewitness evidence) have written about how they had to move the consensus even among gay people toward marriage equality when it was far away. http://www.slate.com/articles/news_and_politics/politics/201...
I can believe Leno said that, but I am also quite aware that it was a very small minority opinion even among supporters of the legislation.
I'll also note that Leno isn't quoted as saying anything like that in the article you cite to support that Leno said it, though.
> You may not be familiar, but in previous decades, Mark Simpson, Michel Foucault, and many other gay writers were against "gay marriage", often expliciltly arguing it was an embourgeoisement to be rejected.
You are misrepresenting Foucault, who did not argue against (or for, it just simply wasn't a controversy he addressed) equality in marriage but that the limitations (irrespective of sexual preference of the partners) of socially acceptable and institutionalized relationships to only marriage and family-by-descent ought to be lifted and additional forms of relationship recognized and valorized.
Neither did Simpson come from the radical, anti-embourgeoisement, angle you suggest, instead simply buying into the (historically inaccurate) religious right story about the origin of civil marriage and the pro-state-establishment-of-religion argument of the religious right that would give the religious right veto power over the civil definition of religion. That's certainly a viewpoint that exists—and which AFAICT Simpson still holds—but it wasn't a dominant one among LGBTQ activists and allies anytime in the 1999-2011 history of the establishment and expansion of California's Domestic Partnership system. Not even when aggregated with people who did take the radical position you identify, even though neither Simpson nor Foucault are among them.
> Andrew Sullivan and others (with lots of documentary and eyewitness evidence) have written about how they had to move the consensus even among gay people toward marriage equality when it was far away.
I'm not sure why you are pointing to an Slate article that is simply a reprint of one of Sullivan's 1989 articles laying out a conservative case for gay marriage to support your contention that Sullivan and others still had to move the consensus of LGBTQ advocates and allies to support marriage sometime after the time in 2011 when California harmonized domestic partnership with marriage so that the two arguably differed in name only.
Sullivan was certainly important in moving the needle in terms of what people thought was reasonable to set as a near term goal and how they sought to sell it (whether he really shifted the ground on the long-term goal, or just made it seem less quixotic and pie-in-the-sky might be a debate), but he did that well before the time you are referencing.
You spin a fine tale, but it seems to be entirely historical revisionism backed with red herring links and name dropping.
As for Simpson, others should read him and decide for themselves: https://www.theguardian.com/commentisfree/2008/dec/02/propos... (among other pieces)
Pretending marriage equality was always on deck when Leno et al. were working on domestic partnership is the spin here. Either the advocates of the previous decade's reform were not telling the truth (and Obama was strategically lying when he too endorsed civil unions but rejected marriage equality), or they meant what they said at the time. You can't have it both ways.
Again the revolutionary (full Alinsky) playbook is evident: down the memory hole with the past; lie (to self and others, doesn't matter) about goals, promising no further; then go further the minute you get it and isolate and demonize anyone who objects. No thanks.
I'm not sure what you mean by “on deck”. If you mean tactically attainable, yes, there was a wide view even among advocates and allies that it was not. DP was a tactical advance, on that there was broad consensus (though, ironically, the anti-embourgeoisement radicals you point to support this weren't part of it, as they generally viewed marriage as an archaic social institution not to be sought or imitated, but to be eliminated.)
But your claim wasn't about what was viewed as politically pragmatic, but about DP status being seen by advocates and allies generally as “just and sufficient”, rather than unjust and insufficient because it was separate, but at least better than the status quo ante because it was—to the extent possible for the state alone—formally equal.
> and Obama was strategically lying when he too endorsed civil unions but rejected marriage equality
Disagreeing with a movements aspirations isn't a lie. Now, whether Obama was a secret supporter tactically lying to placate opponents, a moderate opponent of the goals of the movement telling the truth, or a stronger opponent telling tscticsl lies to get support of the movement while not alienating it's opponents is...well, completely irrelevant to whether the movement itself saw civil unions as “jist and sufficient” rather than merely a lesser injustice than the status quo ante.
> Either the advocates of the previous decade's reform were not telling the truth [...] or they meant what they said at the time.
You are conflating LGBTQ advocates with the politicians who were (or, in Obama's case, were not) involved in reforms. Those may be overlapping groups, but they aren't the same groups.
Now, if all you meant to say was that you identified with the narrow, political establishment group that endorsed civil unions as the end goal rather than the mainstream of LGBTQ advocates and allies at the time who openly called for marriage equality as the goal but accepted formally equal unions as a tactical advance, that's defensible. But it's not at all defensible to claim that the movement saw civil unions as “just and sufficient”, that was overtly never the case, whatever a handful of politicians trying to balance between the movement and conflicting groups might have said (and, who knows, might have even believed it when they said it.)
Perhaps it has been lost to the sands of time, but it seems curious that this didn't come up as a publicly stated defense while the Mozilla board was contemplating what to do with their total PR disaster out of a corporate office.
If you've changed your mind, or have reasons, or whatever? Great. But trying to suggest that in fact you were a better advocate and steward of LGBT rights while (perhaps unintentionally, perhaps deliberately) suggesting everyone else was wrong in what they wanted? No.
You could also just say, "I have changed my mind" or "I have decided this issue is less important to me now" or even maybe, "I thought I was doing the right thing, but in hindsight I chose a bad strategy." A million other phrases that own your actions and don't project onto others.
I suggested no such thing. I said explicitly I was sticking to a previous bargain. Hate on that if you must, but don’t put words in my mouth.
At this point you have misread so many declarative statements I’ve made here that I am going to let you have the last word, if you like. But no, I never suggested that. It seems to me you are engaging in faulty logic to cast what I wrote in an either/or. Stopping here.
Then I read about BAT. Your business plan soured me.
I'm very sorry that I missed ended your politics Brendan. Sincerely. O obviously misinterpreted what you said. But that changes very little, and I've already spoke at length about what it doesn't change elsewhere in this thread.
This technical interview with Eich was extremely illuminating and I'd urge you to watch it, particularly the second half: https://www.youtube.com/watch?v=MUtHhYes6-A
The current ad-tech ecosystem is a complete disaster, and Eich's vision for replacing it is, I think, genius.
Leverage properties of cryptography to build a browsing experience which respects privacy but retains opt-in ad relevance and anonymous metrics, and further leverage developments in cryptoeconomics to balance the requirements of user <-> publisher <-> advertiser in a properly-designed content generation and consumption ecosystem.
I find the whole idea elegant, ambitious and pragmatic.
What specifically do you find anti-user about Brave?
Eich's SALE of positioning his company as a gateway to all online advertising while spinning this as "pro-privacy" is indeed genius.
His actual vision of the product and the positioning of Brave as a controlling arbiter over all ads (and thus, as a central collection and monitoring point for data around ad consumption) is quite dystopian.
Nothing about logging our ad views to a publicly inspectable blockchain is in the interests of privacy. All it does is offer Eich's company an opportunity to make yet another skeezy ad platform with a new series of buzzwords. It will not be more difficult to game than any other browser, but it will sound impressive and current and gain ad buys.
And I submit that the inevitability of the ad network is itself a questionable notion when a more direct service economy is not only historically how things were done. That model faded as broadcast technology outpaced other IT, but as other IT caught up we've been seeing a return to direct-to-customer service models and these are outperforming ad models in some media markets.
It is not inherently a "blockchain" idea to sell off your time as ads in order to pay for your browser, and other folks are at least pretending to align their business model with user interests while building an information and attention economy (e.g., Steem)
Apollo phase of the roadmap will have multiple clients supporting BAT, with as much endpoint (client and site/creator/user, hard KYC issues here due to centralized fiat currencies and governments) logic moved on chain as we can given future Ethereum scaling and anonymity support. Web standards for particular innovations as apps join the platform and gain enough scale.
This move is a complete slap-to-the-face for everything that Mozilla and Firefox supposedly stands for, and would be heartbreaking for the developers to hear that this is going on in the wake of all the work around "Quantum" and everything else they've won with recently.
But really, this Mr Robot news went no further than an article on The Verge (I presume it even got there?). More importantly, those that care are able to think critically of the situation and don't really have anywhere better to go.
In a universe where no one is ever wrong about facts, sure.
I am now using Safari and have to keep an eye on the family computer to see what crap Mozilla decides to install next.
The nice thing about ethical organisations is that you can have peace of mind and don't have to worry about how they're going to screw you when their marketing department runs amok. Because of cliqz, the annoying telemetry (aka spyware) and this incident, I don't trust Mozilla any more.
Moving to Chrome would indeed be silly, bit it doesn't mean things are rosy.
It definitely sucks, but I don't see how it was anti-privacy at all. The extension didn't transmit data anywhere, it just modified web pages.
That's Mozilla taking another step down a very slippery slope. "It didn't hurt anyone" doesn't excuse ethical or moral wrongs. Given Mozilla's stated commitments to privacy and integrity, their choice here violated them.
It definitely increased the attack surface area[1] with no upside for 99.9%[2] of Firefox users.
1. It's a juicy target: an addon that can modify the content of any page a user visits? It doesn't take much of an imagination to think of how this could be subverted.
2. My conservertive guess of the fraction of Fx users not interested in Mr Robot easter eggs; I probably ought to add a couple more "9"s
Which is silly, IMO. What did this addon actually do, besides be installed without user consent? If this article is correct, the addon was installed automatically but was not 'activated'. Seems like a fuss over nothing, to me, but somebody correct me if I have the details wrong.
"Here, let me push closed source partner marketing materials on your bandwidth to you."
Directly contradictory to espoused values they trade on. Shameful.
What made you think it was closed source? The source for the add-on: https://github.com/mozilla/addon-wr
I switched from Chrome to the latest Firefox browser due to the awesome work the team has done on bringing it into the future. Then I find out that it comes pre-loaded with Pocket and this dumb ass game extension for a TV show promotion? Are you joking?! Fool me once...at least you can expect the level of integration you get within Google/Chrome.
This was completely incongruent with the ethos of Mozilla and Firefox. That is why this is a big deal. It's a huge slap in the face to those of us who choose to use this software because we know it WON'T do things like this.
You can't remove it (and disabling it is hard enough), so you cannot reduce the attack surface of your browser if you don't use it.
It's also really badly integrated into the new mobile version.
There's no need to disable it since nothing happens until you click the button. Removing the button itself is as simple as right-clicking it and clicking on the (only) available option: Remove from Address Bar.
"there's no need to remove the crapware bundled with [pick one: Android, Windows, Ubuntu] since nothing happens until you click the button. Removing the button itself is as simple as [opening the Settings, opening Control Panel, apt-get remove]." mozilla is in a seriously bad spot if it's lowering itself to the level of Acer, HP & co bundling crapware to the brim.
> It is so unlike Mozilla to introduce something like that, I ran a virus scan and checked what programs had been installed recently -- I assumed it had been put there in the same way that IE users used to get the Ask Toolbar installed.
> It says a lot about Mozilla when they decide to bundle fad features like these after spending years stripping existing features out of Firefox. During their effort to dumb-down Firefox, it was common to hear that removing those features didn't matter, as they should be provided by extensions instead. Apparently that cheap excuse is ignored when the feature when it is convenient to do so.
> Worst of all, there has been almost no communication on this. I subscribe to Planet Mozilla and read everything that seems interesting to me, and I still didn't know this was coming.
> They bundele it because they get payed for it. Same story with the new suggested site advertising. The alarming thing is that this way Mozilla is loosing it's independency.
> I didn't know I ever had to read the fine print with anything from Mozilla, and it turns out I was wrong.
(These are remarkably similar to the criticisms leveled against the current situation)
It is NOT ok to force install marketing/advertising content on somebody's conputer. Not ok, can you understand that?
It does not matter if the content is open source, who developed it or where or how it was announced.
And in this matter they HAVE to be perfect. It's not hard. Someone should sign off on features and block any silly marketing or advertising stunts. Not rocket science.
That said, I find the notion that being perfect is not hard rather ridiculous.
How arrogant. It's seem that even you struggle with being perfect...
One needs to invest significant design & development time in order to be "less than perfect" by adding tracking. Perfection would be easily within reach if corporate greed and lack of morals wouldn't be fighting it every step of the way.
Mozilla has admitted the promotion extension was a mistake and is removing it. I cannot remember the last time this sort of episode ever occurred with Firefox, it should be passable as a one-off.
If it wasn't in fact enabled, it's still dumb, but to me a misstep in respecting the user and not a complete breach of trust.
The problem is that auto-deploying marketing software (inert or not) over a channel expressly described as being a tool for development, debugging, and testing, is a breach of trust, and/or an indicator of massive process failure within the Mozilla organization.
Should be
> Which is silly, IMO. What did this addon actually do, besides break a trust and confidence that's been hard won over many years?
Which begs the question: if you had to do something to activate it anyway, why abuse the "studies" sidechannel to install something that is deactivated, when you could just as well prompt to install it when it's meant to be activated?
And here's a bug report about something it does:
AFAIK, you are opted-in by default - I recently had to disable it on a clean installation.
I'd dispute any characterization of LookingGlass as a FireFox feature though, and feel very strongly that using Studies to distribute marketing software (inert or not) was an entirely inappropriate use of the tool.
Mozilla being willing to use Studies (or having a process that allows for it to be used) in this way means that, although I was fine with the extra telemetry, debugging, a/b testing, etc., I cannot trust Studies to be used strictly for development related things.
1) Demonstrated that Mozilla has the ability to silently push addons without any kind of notification to the user that their browser behavior has been patched.
2) Demonstrated (allegedly) that there are privacy and security related preferences in Firefox that are reverting themselves to less-safe defaults without user interaction, aka Microsoft preferences.
3) Demonstrated Mozilla's marketing department lacks the good sense to respect these capabilities for the loaded gun they are
It's not about what they did, it's about what they could do. Mozilla doesn't need these tools, and these tools are dangerous. Why did they make them? Why shouldn't we ask Mozilla to remove them?
If you allow firefox updates they can silently push any code on to your machine, right?
This is the most critical issue, by far. Apparently nobody ran this by any reasonable person or went through any reasonable review process before shipping it.
This is nowhere near the level of naiveté that google had when they had a real name policy for some of their services that outed dissidents, LGBTQ people, and other marginalized people. Not even the same ballpark. If Mozilla really wanted to do something nefarious or bad they could have added things into the codebase directly instead of as an adjunct. I still trust Mozilla personally and I believe they are a net benefit to the internet.
Wait, did someone assume that Mozilla didn't have this ability? How did people think that they got security updates?
> 2) Demonstrated (allegedly) that there are privacy and security related preferences in Firefox that are reverting themselves to less-safe defaults without user interaction, aka Microsoft preferences.
If that's the case, it's a bug. Bugs happen. Regardless, doesn't seem happen
> 3) Demonstrated Mozilla's marketing department lacks the good sense to respect these capabilities for the loaded gun they are
Fair enough, to some extent.
> It's not about what they did, it's about what they could do. Mozilla doesn't need these tools, and these tools are dangerous. Why did they make them? Why shouldn't we ask Mozilla to remove them?
Wait, what? Why does Mozilla have tools to distribute code? Because Mozilla uses it regularly to fix issues. This has been the case since Firefox 1.0, I assume.
Why does Mozilla have tools that handles and/or updates and/or forgets preferences? Because preferences can't be handled anywhere else, since they are preferences for Mozilla tools. I haven't heard of preferences being force-changed until now, with the exception of fighting malware and switching stuff from experimental to mainstream. But, yeah, bugs happen.
Why does Mozilla have a marketing department? I assume that's not a real question.
Via an updater that pops up a little window showing you Mozilla is installing stuff, or via an apt-get/yum/whatever command. Point is, it is (and should be) visible when Mozilla is pushing code.
The difference is that in one case the updates are released following a public process, with bugzilla entries, proper review and engineering practices, while in the other case it's pushed with no oversight, secretly, by some guy in marketing. It's like Google Tab Manager in your browser. Browsers are too sensitive, too central in people's lives nowadays to allow such things.
This was the company who extolls privacy, openness, and attracts (among others) the sort of people who are uneasy at competing browsers shipped by advertising companies, or old-guard software shops pivoting into more profitable ways to leverage their installbase. This was the company who branded, then re-branded themselves as champions of a more people-conscious web. The exact company who should've known better.
Even their apology, though probably sincere, has a tinge of corporate, marketing wishwash. Maybe it's just the title, but a "We Messed Up" would've been punchier without being vulgar, instead of this bury-the-headline-style "Update on..." crap all too familiar from security vulnerabilities.
It's actively trying to be opaque. That's the opposite of transparency.
Curious adventurous people install the test build because they want to try out new features and extensions. Those are the users who are most likely to know about and use "about:config". The config option and description of the plugin are mysterious and enigmatic, which tempts your curiosity into turning it on to see what it does, because you presumably trust that Mozilla wouldn't distribute just any old extension that didn't have a purpose other than scanning and modifying the content of every web page, inserting dynamic content adjacent to keywords, and advertising a TV show.
Did it actually display an ad? I didn't see anything such on my Firefox.
It's not that it displays an ad, it's that it IS an ad.
Not only that, but it also parasitically hooks in and wastes resources (memory, cpu time, battery life) in each and every tab visiting each and every web page.
That's yet another reason it's totally inappropriate in the context of Firefox, which is trying to dig itself out of the hole of being slow and bloated.
Fair point.
> It's not that it displays an ad, it's that it IS an ad.
If it's an add, it's the most well-hidden ad in history, since you need to find both a hidden preference to turn it on and a specific and non-documented website to let it display anything.
> Not only that, but it also parasitically hooks in and wastes resources (memory, cpu time, battery life) in each and every tab visiting each and every web page.
No, it doesn't.
More importantly, it is software that has nothing to do with improving FireFox, collecting telemetry, error reports, running tests, experimental features, or anything else the Shield Studies program is ostensibly to be used for.
I agree that delivering it through Shield was not a good idea.
So well hidden, it's practically underwater.
http://www.paulgraham.com/submarine.html
Yet in spite of how well hidden it was (or rather, because of), we're now all talking about Mr. Robot, somehow. Funny how that works!
> No, it doesn't [parasitically hook in and waste resources]. [...] since you need [...] a specific and non-documented website to let it display anything
Yes it does hook into and waste resources and potentially display ads on ALL web pages.
Hover text injected into headline on Washington Post #39: https://github.com/mozilla/addon-wr/issues/39
Have you read the source code?
background.js: https://github.com/mozilla/addon-wr/blob/master/addon/backgr...
content-script.js: https://github.com/mozilla/addon-wr/blob/master/addon/conten...
The extension literally injects ads for Mr. Robot in the form of popup tooltips with links on every web page that contains certain keywords. And it also wastes memory, CPU time and battery life for web pages not containing those keywords.
How much more like parasitic adware does it have be before you can see that it walks and quacks like a duck, because its intended purpose is to advertise a television show?
https://news.ycombinator.com/item?id=15936727
>It injects a blob of CSS and some JavaScript into every tab, then it does a regular expression search of every text node on each page, filtering out everything but paragraphs, then for each occurrence of a keyword in the text, it creates a new text node to split the current text node, then inserts a new span element between them, containing its own text node, then it creates an additional tooltip element containing six text nodes, five br elements, and one anchor element linking to https://support.mozilla.org/kb/lookingglass , and it also configures css class names to associate all those new nodes it created with the blob of css styling and animations that it injected.
If you wanted to develop your own malicious adware like Superfish that injects your own ads into every web page, this code and the browser hijacking techniques it uses would be an excellent starting point.
Browser Hijacking: https://en.wikipedia.org/wiki/Browser_hijacking
Threat Introduced via Browser Extensions: https://blog.sucuri.net/2014/10/threat-introduced-via-browse...
How to find Chrome extensions that inject ads into any webpage I browse? https://superuser.com/questions/893843/how-to-find-chrome-ex...
Another example: https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...
> This experiment also includes the data collection tool Cliqz uses to build its recommendation engine. Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit.
> Cliqz uses several techniques to attempt to remove sensitive information from this browsing data before it is sent from Firefox. Cliqz does not build browsing profiles for individual users and discards the user’s IP address once the data is collected. Cliqz’s code is available for public review and a description of these techniques can be found here.
Installed without explicit consent + collecting data = spyware.
Albeit I'm more of a backend guy so debugging in chrome/firefox isn't my forte, but I can usually gather enough data from dev tools to fix things.
This wasn't a mistake, it was the inevitable outcome in a culture which has lost sight some time ago of its nominal core values.
House should be cleaned before trust is reearned.