Hacker News Reader

Hacker News

Comment by gilrain | Hacker News Reader

Full thread

gilrain

There is a response from a Mozilla security member at lobste.rs.

https://lobste.rs/s/zcjtv2/1749908_infinite_loop_http3_hangs...

View on HN

This is the interesting bit I had no idea about:

> [Q] Do I understand from this that Mozilla can just update my browser settings remotely without my updating‽

> [A] Yes. This is part of the “Remote settings” service, which we can use to ship or unship features (or gradually) or recover from breakage (like here!). We mostly use it as a backend for Firefox Sync and certificate revocation lists. Technically, we could also ship a new Firefox executable and undo / change settings, but that would realistically take many more hours. Needless to says, every “large” software project has these capabilities.

This is new to me. Can anyone tell me which other "large" projects have this capability?

Chrome

They are busy making us hate them as much as they can, eh?

Multiple reports on the initial thread (https://news.ycombinator.com/item?id=29918717) that telemetry features are getting silently re-enabled after users explicitly disable them. If you had telemetry on, you hit this bug immediately due to the server configuration.

I wonder if this is to blame?

In any case, this is incredibly sketchy behavior for a "user-empowering", "privacy focused" browser.

I didn't know about Remote Settings.

I found some detailed information on Mozilla's website [1] and I have three entries about RemoteSettings in about:config.

app.normandy.startupRolloutPrefs.browser.topsites.useRemoteSetting

browser.topsites.useRemoteSetting

browser.urlbar.quicksuggest.remoteSettings.enabled

I turned them to false.

This [2] explains what Normandy is.

[1] https://firefox-source-docs.mozilla.org/services/settings/in...

[2] https://firefox-source-docs.mozilla.org/toolkit/components/n...

That's insane. Is there a way to disable "Remote settings" in about:config?

Not tested and I have no idea what this breaks, but you could set services.settings.server to something unusable like localhost. The pref was listed here (https://remote-settings.readthedocs.io/en/latest/tutorial-de...) in the dev environment instructions.

> Can anyone tell me which other "large" projects have this capability?

I'd say that all popular apps (Android/iOS) have such functionality. Most will probably use it for A/B testing, but technically you could change anything you'd like with it.

Apart from the companies creating their own implementations [0], popular services I have seen include Optimizely [1] and Firebase Remote Config [2].

[0]: https://engineering.fb.com/2014/01/09/android/airlock-facebo...

[1]: https://www.optimizely.com/products/intelligence/full-stack-...

[2]: https://firebase.google.com/docs/remote-config/

Most large software that hits servers on the network will have this because it's borderline malpractice not to. Not only would it make it difficult or impossible to fix third-party regressions like this, but if your software started causing issues for third parties (like crashing their servers or getting users kicked off the internet or corrupting their data), you'd have no way to mitigate it in a reasonable amount of time.

FWIW I maintained a popular chrome extension (100k weekly users) and I eventually had to add an extensive set of chicken bits pulled from my server multiple times a day. Why? Because chrome updates take over a day to propagate and the extension could regularly break when webdevs made frontend changes to the websites my end users visited. It simply wasn't feasible to ask end users to manually pull a chrome update every time this happened (not to mention that chrome's extension store is designed to make this very hard.) I added an option to disable it but as far as I know none of my users turned that on.

Not exactly the same but most modern hardware has equivalent functionality where they can flip 'chicken bits' in the hw to disable various features in response to regressions - stuff like spectre or meltdown is a good example. Naturally that is instead flipped by OS or firmware updates, but considering those come down across the wire automatically now, it's basically the same idea.

> Not only would it make it difficult or impossible to fix third-party regressions like this, but if your software started causing issues for third parties (like crashing their servers or getting users kicked off the internet or corrupting their data), you'd have no way to mitigate it in a reasonable amount of time.

I completely agree that in the current case resetting it remotely is the easiest solution for both parties. However, it is probably the first time many users learned something like this exists. One would think an open browser promoting user empowerment would have more transparency on this feature and how it can be controlled.

This is also a place where corrupt governments can impose sanctions on other countries through.

If they want to do that, they'll do it. Governments have forced online service providers to implement back doors before, so Mozilla or Google could similarly be forced to do that.

That also explains how the telemetry stuff could have been returned to default even though it was disabled, this mechanism has a lot of bad use cases that you'd have to trust Mozilla to never abuse.

For what it’s worth this sentence was updated.

I wonder if remote settings is what changed my proxy settings after update too.

Reply on news.ycombinator.com