A good outcome of this certificate fiasco is that many firefox users learned about the "studies" and "Normandy" brain-damage and promptly disabled them.
I'm actually curious about how the common user reacted to this. There isn't a clue about this on (1) the add-on page, (2) Mozilla's home page, (3) no emails sent out (I get plenty of other emails from Mozilla).
Currently, when you try and (re)install an "unsupported" add-on, you get a cryptic message stating: "Download failed. Please check your connection."
So the only communication from Mozilla is that it's my fault and I need to "check" my connection.
Honestly... there's so much fail here - even at the communication level.
That's a good question. Of course we have to assume we're talking about the common add-on user, since some users don't have addons.
An incredible 3.2 million users (out of 10 million daily active) attempted to download Adblock Plus on Saturday, after it was disabled. Some of these might be duplicates of course, but I think this suggests:
(1) most users who use addons noticed when they were disabled (2) most of them were confused (at least initially) about the reason this happened, since there was no direct communication from Mozilla about the problem in the browser itself (3) many of these attempted to redownload their extensions as a solution to the problem
https://addons.mozilla.org/en-us/firefox/addon/adblock-plus/...
A completely careful open source project would normally leave such controversial things off by default, and moz which leans corporate will go part of the way towards enabling such features. I don't mind their compromise, they do good.
And the annoying part of this being developers who act as if they do not understand (or just brush off) the concerns that the users have.
Like, people want control over their own machines. How is that hard to understand?
And yet we were somehow able to ship stable software to millions of people in the days before telemetry/studies. What telemetry/studies truly provides is offloading QA costs to users.
Using users for QA has made us lazy and borderline incompetent.
And the stable software in the past may be due to nostalgia. They had bugs. Even before dialup was common, games were patched: Diablo 1 had a number of patches for example, Quake 3 went up to 1.32, Dune 2 (1992) got 1.07. We just accepted bugs, because... what can you do?
Do you have any source for that? If you truly believe that Firefox is optimizing metrics that aren't in the users' best interest in general, why are you even using said software in the first place?
Is Chrome compiled from source safe from tracking?
Waterfox, Safari. Some others too but they're a pain to use (ungoogled-chromium for example). Chrome itself has a bunch of binary blobs so I would stay away from that.
I agree that it’s appropriate to A/B test changes, within reasonable bounds. I wish the debate would focus more on what the reasonable bounds are to each objector.
This unlimited testing can easily be seeking to better maximize psychological exploits with no regulation.
So, yes, I'm happy to see someone putting in a bit of control.
I don't think so. Mozilla is not google, and apart from the mr. Robot error, that they apologized for, I am sure Mozilla is using it for making the browser better, and not to use you for targeted ads like the other browser maker does.
"RLZ gives us the ability to accurately measure the success of marketing promotions and distribution partnerships in order to meet our contractual and financial obligations."
https://www.google.com/intl/en/chrome/privacy/whitepaper.htm...
These so-called "best practices" often aren't.
Something went terrible wrong somewhere, that we got to this.
I, for one, as a matter of principle, opt-in to all user tracking systems that are disabled by default, and try to opt-out whenever they are enabled by default. In the case of firefox, it was never clear to me that the tracking/remote install capability was enabled by default.
A/B testing is necessary for stable rollouts, that much seems self evident.
So what is the evidence that A/B testing is harmful to users?
Wouldn't it be more irresponsible to deploy to every user without first testing it out?
Experimental/beta channels can have these changes pushed to it, since that's implied by the name, and those people who like living on the edge of new features do so knowingly.
Let the users control their destiny, let the users decide when. That's the hallmark of a trustworthy company.
The discussion isn't "modify stuff" vs. "don't modify stuff". The discussion is "some users" vs. "all users".
And obviously if you have an auto-update mechanism you're modifying stuff on the user's computer. Chrome updates are near invisible on modern machines. That's a good thing. It keeps the browser evergreen and protects users. If everything were opt-in because "Google shouldn't modify stuff on my computer" that would be an absolute disaster for everyone. No way.
A/B testing through that branch breaks that expectation (and no, mentioning it somewhere hidden in some EULA or equally obfuscated place does not mean people will not have the expectation - hell, even mentioning it right below the download wont make a difference).
Are you the unlucky one that ended up with the broken A/B testing change? Well, sucks for you and nobody will be able to help you. Do you want to try a specific testing change because you like it/something is broken on your end and that will fix it? Sucks to be you again, you get no choice on this. Do you want to analyze the change to see if they have something bad in it? Nope, not possible unless if you end up being one of the lucky ones. In addition if Mozilla were to get compromised (either as an organization or in software side) could use it as a backdoor on unsuspecting users or even do targeted attacks.
None of that would not be an issue if they depended on nightly/beta for changes and error detection, nor would it be if they had a list of possible tests somewhere that the user could manually enable and possibly ask some users explicitly if they want to enable one on the browser startup.
Very strange and unsettling.