Which is silly, IMO. What did this addon actually do, besides be installed without user consent? If this article is correct, the addon was installed automatically but was not 'activated'. Seems like a fuss over nothing, to me, but somebody correct me if I have the details wrong.
I switched from Chrome to the latest Firefox browser due to the awesome work the team has done on bringing it into the future. Then I find out that it comes pre-loaded with Pocket and this dumb ass game extension for a TV show promotion? Are you joking?! Fool me once...at least you can expect the level of integration you get within Google/Chrome.
This was completely incongruent with the ethos of Mozilla and Firefox. That is why this is a big deal. It's a huge slap in the face to those of us who choose to use this software because we know it WON'T do things like this.
You can't remove it (and disabling it is hard enough), so you cannot reduce the attack surface of your browser if you don't use it.
It's also really badly integrated into the new mobile version.
There's no need to disable it since nothing happens until you click the button. Removing the button itself is as simple as right-clicking it and clicking on the (only) available option: Remove from Address Bar.
"there's no need to remove the crapware bundled with [pick one: Android, Windows, Ubuntu] since nothing happens until you click the button. Removing the button itself is as simple as [opening the Settings, opening Control Panel, apt-get remove]." mozilla is in a seriously bad spot if it's lowering itself to the level of Acer, HP & co bundling crapware to the brim.
> It is so unlike Mozilla to introduce something like that, I ran a virus scan and checked what programs had been installed recently -- I assumed it had been put there in the same way that IE users used to get the Ask Toolbar installed.
> It says a lot about Mozilla when they decide to bundle fad features like these after spending years stripping existing features out of Firefox. During their effort to dumb-down Firefox, it was common to hear that removing those features didn't matter, as they should be provided by extensions instead. Apparently that cheap excuse is ignored when the feature when it is convenient to do so.
> Worst of all, there has been almost no communication on this. I subscribe to Planet Mozilla and read everything that seems interesting to me, and I still didn't know this was coming.
> They bundele it because they get payed for it. Same story with the new suggested site advertising. The alarming thing is that this way Mozilla is loosing it's independency.
> I didn't know I ever had to read the fine print with anything from Mozilla, and it turns out I was wrong.
(These are remarkably similar to the criticisms leveled against the current situation)
It is NOT ok to force install marketing/advertising content on somebody's conputer. Not ok, can you understand that?
It does not matter if the content is open source, who developed it or where or how it was announced.
And in this matter they HAVE to be perfect. It's not hard. Someone should sign off on features and block any silly marketing or advertising stunts. Not rocket science.
That said, I find the notion that being perfect is not hard rather ridiculous.
How arrogant. It's seem that even you struggle with being perfect...
One needs to invest significant design & development time in order to be "less than perfect" by adding tracking. Perfection would be easily within reach if corporate greed and lack of morals wouldn't be fighting it every step of the way.
Mozilla has admitted the promotion extension was a mistake and is removing it. I cannot remember the last time this sort of episode ever occurred with Firefox, it should be passable as a one-off.
It's actively trying to be opaque. That's the opposite of transparency.
Curious adventurous people install the test build because they want to try out new features and extensions. Those are the users who are most likely to know about and use "about:config". The config option and description of the plugin are mysterious and enigmatic, which tempts your curiosity into turning it on to see what it does, because you presumably trust that Mozilla wouldn't distribute just any old extension that didn't have a purpose other than scanning and modifying the content of every web page, inserting dynamic content adjacent to keywords, and advertising a TV show.
Did it actually display an ad? I didn't see anything such on my Firefox.
It's not that it displays an ad, it's that it IS an ad.
Not only that, but it also parasitically hooks in and wastes resources (memory, cpu time, battery life) in each and every tab visiting each and every web page.
That's yet another reason it's totally inappropriate in the context of Firefox, which is trying to dig itself out of the hole of being slow and bloated.
Fair point.
> It's not that it displays an ad, it's that it IS an ad.
If it's an add, it's the most well-hidden ad in history, since you need to find both a hidden preference to turn it on and a specific and non-documented website to let it display anything.
> Not only that, but it also parasitically hooks in and wastes resources (memory, cpu time, battery life) in each and every tab visiting each and every web page.
No, it doesn't.
More importantly, it is software that has nothing to do with improving FireFox, collecting telemetry, error reports, running tests, experimental features, or anything else the Shield Studies program is ostensibly to be used for.
I agree that delivering it through Shield was not a good idea.
So well hidden, it's practically underwater.
http://www.paulgraham.com/submarine.html
Yet in spite of how well hidden it was (or rather, because of), we're now all talking about Mr. Robot, somehow. Funny how that works!
> No, it doesn't [parasitically hook in and waste resources]. [...] since you need [...] a specific and non-documented website to let it display anything
Yes it does hook into and waste resources and potentially display ads on ALL web pages.
Hover text injected into headline on Washington Post #39: https://github.com/mozilla/addon-wr/issues/39
Have you read the source code?
background.js: https://github.com/mozilla/addon-wr/blob/master/addon/backgr...
content-script.js: https://github.com/mozilla/addon-wr/blob/master/addon/conten...
The extension literally injects ads for Mr. Robot in the form of popup tooltips with links on every web page that contains certain keywords. And it also wastes memory, CPU time and battery life for web pages not containing those keywords.
How much more like parasitic adware does it have be before you can see that it walks and quacks like a duck, because its intended purpose is to advertise a television show?
https://news.ycombinator.com/item?id=15936727
>It injects a blob of CSS and some JavaScript into every tab, then it does a regular expression search of every text node on each page, filtering out everything but paragraphs, then for each occurrence of a keyword in the text, it creates a new text node to split the current text node, then inserts a new span element between them, containing its own text node, then it creates an additional tooltip element containing six text nodes, five br elements, and one anchor element linking to https://support.mozilla.org/kb/lookingglass , and it also configures css class names to associate all those new nodes it created with the blob of css styling and animations that it injected.
If you wanted to develop your own malicious adware like Superfish that injects your own ads into every web page, this code and the browser hijacking techniques it uses would be an excellent starting point.
Browser Hijacking: https://en.wikipedia.org/wiki/Browser_hijacking
Threat Introduced via Browser Extensions: https://blog.sucuri.net/2014/10/threat-introduced-via-browse...
How to find Chrome extensions that inject ads into any webpage I browse? https://superuser.com/questions/893843/how-to-find-chrome-ex...
If it wasn't in fact enabled, it's still dumb, but to me a misstep in respecting the user and not a complete breach of trust.
The problem is that auto-deploying marketing software (inert or not) over a channel expressly described as being a tool for development, debugging, and testing, is a breach of trust, and/or an indicator of massive process failure within the Mozilla organization.
Another example: https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...
> This experiment also includes the data collection tool Cliqz uses to build its recommendation engine. Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit.
> Cliqz uses several techniques to attempt to remove sensitive information from this browsing data before it is sent from Firefox. Cliqz does not build browsing profiles for individual users and discards the user’s IP address once the data is collected. Cliqz’s code is available for public review and a description of these techniques can be found here.
Installed without explicit consent + collecting data = spyware.
This was the company who extolls privacy, openness, and attracts (among others) the sort of people who are uneasy at competing browsers shipped by advertising companies, or old-guard software shops pivoting into more profitable ways to leverage their installbase. This was the company who branded, then re-branded themselves as champions of a more people-conscious web. The exact company who should've known better.
Even their apology, though probably sincere, has a tinge of corporate, marketing wishwash. Maybe it's just the title, but a "We Messed Up" would've been punchier without being vulgar, instead of this bury-the-headline-style "Update on..." crap all too familiar from security vulnerabilities.
1) Demonstrated that Mozilla has the ability to silently push addons without any kind of notification to the user that their browser behavior has been patched.
2) Demonstrated (allegedly) that there are privacy and security related preferences in Firefox that are reverting themselves to less-safe defaults without user interaction, aka Microsoft preferences.
3) Demonstrated Mozilla's marketing department lacks the good sense to respect these capabilities for the loaded gun they are
It's not about what they did, it's about what they could do. Mozilla doesn't need these tools, and these tools are dangerous. Why did they make them? Why shouldn't we ask Mozilla to remove them?
If you allow firefox updates they can silently push any code on to your machine, right?
This is the most critical issue, by far. Apparently nobody ran this by any reasonable person or went through any reasonable review process before shipping it.
This is nowhere near the level of naiveté that google had when they had a real name policy for some of their services that outed dissidents, LGBTQ people, and other marginalized people. Not even the same ballpark. If Mozilla really wanted to do something nefarious or bad they could have added things into the codebase directly instead of as an adjunct. I still trust Mozilla personally and I believe they are a net benefit to the internet.
Wait, did someone assume that Mozilla didn't have this ability? How did people think that they got security updates?
> 2) Demonstrated (allegedly) that there are privacy and security related preferences in Firefox that are reverting themselves to less-safe defaults without user interaction, aka Microsoft preferences.
If that's the case, it's a bug. Bugs happen. Regardless, doesn't seem happen
> 3) Demonstrated Mozilla's marketing department lacks the good sense to respect these capabilities for the loaded gun they are
Fair enough, to some extent.
> It's not about what they did, it's about what they could do. Mozilla doesn't need these tools, and these tools are dangerous. Why did they make them? Why shouldn't we ask Mozilla to remove them?
Wait, what? Why does Mozilla have tools to distribute code? Because Mozilla uses it regularly to fix issues. This has been the case since Firefox 1.0, I assume.
Why does Mozilla have tools that handles and/or updates and/or forgets preferences? Because preferences can't be handled anywhere else, since they are preferences for Mozilla tools. I haven't heard of preferences being force-changed until now, with the exception of fighting malware and switching stuff from experimental to mainstream. But, yeah, bugs happen.
Why does Mozilla have a marketing department? I assume that's not a real question.
Via an updater that pops up a little window showing you Mozilla is installing stuff, or via an apt-get/yum/whatever command. Point is, it is (and should be) visible when Mozilla is pushing code.
The difference is that in one case the updates are released following a public process, with bugzilla entries, proper review and engineering practices, while in the other case it's pushed with no oversight, secretly, by some guy in marketing. It's like Google Tab Manager in your browser. Browsers are too sensitive, too central in people's lives nowadays to allow such things.
Which begs the question: if you had to do something to activate it anyway, why abuse the "studies" sidechannel to install something that is deactivated, when you could just as well prompt to install it when it's meant to be activated?
And here's a bug report about something it does:
AFAIK, you are opted-in by default - I recently had to disable it on a clean installation.
I'd dispute any characterization of LookingGlass as a FireFox feature though, and feel very strongly that using Studies to distribute marketing software (inert or not) was an entirely inappropriate use of the tool.
Mozilla being willing to use Studies (or having a process that allows for it to be used) in this way means that, although I was fine with the extra telemetry, debugging, a/b testing, etc., I cannot trust Studies to be used strictly for development related things.
Should be
> Which is silly, IMO. What did this addon actually do, besides break a trust and confidence that's been hard won over many years?
"Here, let me push closed source partner marketing materials on your bandwidth to you."
Directly contradictory to espoused values they trade on. Shameful.
What made you think it was closed source? The source for the add-on: https://github.com/mozilla/addon-wr