I'm glad that Mozilla has responded in this way. My disappointment remains, however.
I am one of those not affected at all by the Looking Glass extension but still, my trust is Mozilla (which has been eroding as of late) has suffered greatly.
I am giving Mozilla exactly one more chance before uninstalling FF on ever device I have. In the meantime, I will no longer volunteer for ANY data collection.
Last chance, Mozilla.
But.... why? And what browser on gods earth are you going to switch to that has the same respect for privacy as Firefox (excluding poorly maintained FF forks).
It's a blip, one you where not affected by at all and in the scheme of things not major compared to other vendors. But hey, boo mozilla uninstall everything and use lynx/curl!
Mozilla as an organization and Firefox displayed their reckless disregard for my privacy. It would be foolish to dismiss it as just a blip.
If Mozilla cared about people trusting them with their privacy then they shouldn't have evicerated that trust by installing an extension (even switched off) behind their back.
They did this with Looking Glass, they did this with Pocket, and they did this with non-free WebRTC support. Three strikes and you're out!
None of those violated your privacy by any reasonable definition. Those three things did not provide any additional information about you to any third party (unless you opted in to using pocket).
WebRTC did violate your fundamental freedoms as defined by the FSF, but that's not a privacy violation.
Please explain how your privacy was actually meaningfully violated.
Ok, so are you going to be using Edge or Chrome, and which of those respects your privacy more than Firefox.
No organisation is perfect and you have a right to be angry, but you're being a bit extreme IMO. It's much more nuanced than three strikes and you're out, and it's a shame to reduce it to that level.
So what are you moving to if they fail your challenge? (I've asked myself this question, and apart from "try something exotic like Qutebrowser, prepared to move back if it doesn't work out" I don't see a better alternative personally)
A bit clearer than the initial empty press statements, but I guess we'll have to wait for the detailed post-mortems and changes to see how far their understanding for the various concerns goes. Not much detail here.
I read some other news story on this today. Is there an actual apology yet? And if not, does it matter?
In my mind, no apology is better than a 'sorry you were upset' non-apology, but there are apologies that manage to seem genuine as well. As I write this I am reminded of the show 'The Orville's "apology tour"... I don't necessarily think an apology is needed or helpful.
Always interested in examples of corporate PR, whether negative, neutral-ish, or positive.
Edit: obviously I don't care enough(?) about the specifics of this instance... Hopefully it's also obvious that I appreciate the chance to evaluate the community's response to a favored company. Mozilla seems to be allowed quite a bit of leeway.
Thanks. Do you have time to expand on why this counts as a genuine apology to you (or not?).
Interesting to me that all it takes to count as an apology to some is the words 'we're sorry'.
I hope to find similar discussion(s) where an HN user practiced his hobby of rewriting corporate apologies. Also nice to have another example where initial response can be completely tone deaf with little consequence.
All you have to do is drop the word "sorry", it doesn't matter if the apology actually addressed any of the concerns that were raised.
FB was sorry for being "unclear". Mozilla is sorry for "the confusion" and for "letting down members of [the] community".
The headlines will read "[Company] apologizes for [event that triggered criticism]" and everyone will carry on as if the apology directly addressed that event. The lawyers and shareholders will breathe a sigh of relief, and the matter will soon be forgotten.
Thanks for another example, and the specifics of this one.
From what you've said it doesn't sound like anyone at Mozilla (specifically the Chief Marketing Officer representing the company) apologized for doing anything wrong. "letting down" comes closest for sure and may be enough for most.
abbasmehdi: Proper apologies have three parts: 1) What I did was wrong. 2) I’m sorry that I hurt you. 3) How do I make it better? It’s the third part that people tend to forget…. Apologize when you screw up and focus on other people, not on yourself.
>anon808: The most import part of that apology formula is missing, actually meaning it. Also if the answer to #3 is obvious (ie stop doing what your apologizing for) then one shouldn't have to ask.
The first sentence reads: 'We didn’t think hard enough about how our actions would affect the community, and we’re sorry for letting you down.' So yes, they have apologised.
They never tried to hide this - they actually thought they were building some cute easter egg, without thinking about how people would react to a phishy-looking add-on getting installed in their browser without consent or notice.
Mozilla bought Pocket. It would be extremely surprising if they turned their back on shipping it by default. However it's so easy to disable that this is a non issue.
The amount of negative press this received nearly cancels out all the positive news from Quantum's release barely a month ago. It's such a shame that the years of hard work and effort on the dev teams are being overshadowed by such a ridiculous marketing mistake. For a browser that is one of the last big proponents of a privacy-centered, user-first web, these kinds of mistakes can't happen... period. Now it's nearly back to the starting line on re-gaining user trust again.
> The amount of negative press this received nearly cancels out all the positive news from Quantum's release barely a month ago.
Which is silly, IMO. What did this addon actually do, besides be installed without user consent? If this article is correct, the addon was installed automatically but was not 'activated'. Seems like a fuss over nothing, to me, but somebody correct me if I have the details wrong.
How can that possibly be a downside? If they had made money, people would be even more up in arms. If anything, this reinforces the “Easter egg” intent of the extension; it serves no other purpose.
Neither of which should have been included in the core browser (even though I quite liked hello, and have been using appear.in, it's more stable cousin, for years now)
It's not what the extension did or did-not do, it's the fact that Mozilla was originally a champion of privacy, open-source, and free software. The entire purpose of this browser was to escape the corporate bullshit of Netscape/AOL.
I switched from Chrome to the latest Firefox browser due to the awesome work the team has done on bringing it into the future. Then I find out that it comes pre-loaded with Pocket and this dumb ass game extension for a TV show promotion? Are you joking?! Fool me once...at least you can expect the level of integration you get within Google/Chrome.
This was completely incongruent with the ethos of Mozilla and Firefox. That is why this is a big deal. It's a huge slap in the face to those of us who choose to use this software because we know it WON'T do things like this.
There's no need to disable it since nothing happens until you click the button. Removing the button itself is as simple as right-clicking it and clicking on the (only) available option: Remove from Address Bar.
"there's no need to remove the crapware bundled with [pick one: Android, Windows, Ubuntu] since nothing happens until you click the button. Removing the button itself is as simple as [opening the Settings, opening Control Panel, apt-get remove]." mozilla is in a seriously bad spot if it's lowering itself to the level of Acer, HP & co bundling crapware to the brim.
> It is so unlike Mozilla to introduce something like that, I ran a virus scan and checked what programs had been installed recently -- I assumed it had been put there in the same way that IE users used to get the Ask Toolbar installed.
> It says a lot about Mozilla when they decide to bundle fad features like these after spending years stripping existing features out of Firefox. During their effort to dumb-down Firefox, it was common to hear that removing those features didn't matter, as they should be provided by extensions instead. Apparently that cheap excuse is ignored when the feature when it is convenient to do so.
> Worst of all, there has been almost no communication on this. I subscribe to Planet Mozilla and read everything that seems interesting to me, and I still didn't know this was coming.
> They bundele it because they get payed for it. Same story with the new suggested site advertising. The alarming thing is that this way Mozilla is loosing it's independency.
> I didn't know I ever had to read the fine print with anything from Mozilla, and it turns out I was wrong.
(These are remarkably similar to the criticisms leveled against the current situation)
The extension is open source and free software, and did not violate your privacy. The bad thing about it was that it was unclear that it was so, which really indeed is bad communication, but let's not pretend that Mozilla is not a champion of privacy, open source and free software. It's just that they're not perfect, which is a shame, but that's it.
Ethical software development needs to be taught in schools, because the level of discourse here is dismaying.
It is NOT ok to force install marketing/advertising content on somebody's conputer. Not ok, can you understand that?
It does not matter if the content is open source, who developed it or where or how it was announced.
And in this matter they HAVE to be perfect. It's not hard. Someone should sign off on features and block any silly marketing or advertising stunts. Not rocket science.
When perfection means not collecting information about one's customers without their permission, that's a very low bar to pass...
One needs to invest significant design & development time in order to be "less than perfect" by adding tracking. Perfection would be easily within reach if corporate greed and lack of morals wouldn't be fighting it every step of the way.
Pocket can be disabled by setting extensions.pocket.enabled to false.
Mozilla has admitted the promotion extension was a mistake and is removing it. I cannot remember the last time this sort of episode ever occurred with Firefox, it should be passable as a one-off.
It being installed without user consent is pretty shitty, but this whole time I was under the impression that it was enabled by default, which is insane.
If it wasn't in fact enabled, it's still dumb, but to me a misstep in respecting the user and not a complete breach of trust.
Its existence is fine, in fact I wouldn't even mind seeing more collaborations of its kind.
The problem is that auto-deploying marketing software (inert or not) over a channel expressly described as being a tool for development, debugging, and testing, is a breach of trust, and/or an indicator of massive process failure within the Mozilla organization.
It was activated, but not activated-activated (in that the addon gracefully decided to not do anything). But obviously we can't delegate that decision to the addons, that's why the addons pane exists after all.
Which begs the question: if you had to do something to activate it anyway, why abuse the "studies" sidechannel to install something that is deactivated, when you could just as well prompt to install it when it's meant to be activated?
The "studies" sidechannel is the ideal place to distribute a deactivated plugin if you want curious people to activate because they want to test out new features. People subscribe to the studies sidechannel BECAUSE they want to try out new features, and those people tend to know about and use about:config, so it's likely many people will enable it, to see what it does.
You're right that "studies" is designed for distributing/testing experimental features, among other development and debugging uses.
I'd dispute any characterization of LookingGlass as a FireFox feature though, and feel very strongly that using Studies to distribute marketing software (inert or not) was an entirely inappropriate use of the tool.
Mozilla being willing to use Studies (or having a process that allows for it to be used) in this way means that, although I was fine with the extra telemetry, debugging, a/b testing, etc., I cannot trust Studies to be used strictly for development related things.
How did it break user trust? I mean, I see that some people are unhappy, and I can't say that this stuff was thoroughly thought out, but this was an add-on whose only effect on user's computer was... nothing, by design, unless you opted-in.
>Which is silly, IMO. What did this addon actually do, besides be installed without user consent?
1) Demonstrated that Mozilla has the ability to silently push addons without any kind of notification to the user that their browser behavior has been patched.
2) Demonstrated (allegedly) that there are privacy and security related preferences in Firefox that are reverting themselves to less-safe defaults without user interaction, aka Microsoft preferences.
3) Demonstrated Mozilla's marketing department lacks the good sense to respect these capabilities for the loaded gun they are
It's not about what they did, it's about what they could do. Mozilla doesn't need these tools, and these tools are dangerous. Why did they make them? Why shouldn't we ask Mozilla to remove them?
>Demonstrated that Mozilla has the ability to silently push addons without any kind of notification to the user that their browser behavior has been patched.
If you allow firefox updates they can silently push any code on to your machine, right?
yes, and most people have grudgingly accepted the semi-weekly FF updates in order to receive the latest security updates... to hijack that update contract to push a marketing agenda is counter productive
Updates are under public view, and users can trust that this process is hard to infiltrate. Silent addon-installations in the background, which appearently can be even pinpointed to specific usergroups, are not. Mozilla can anytime do anything on your system, without anyone watching them, and people just learned the hard way about it.
> 3) Demonstrated Mozilla's marketing department lacks the good sense to respect these capabilities for the loaded gun they are
This is the most critical issue, by far. Apparently nobody ran this by any reasonable person or went through any reasonable review process before shipping it.
They may have some naive people running things. when you have millions of people running your software stuff like this tends to blow up. I personally don't see it as a huge issue of a breach of trust but I don't fault people for being mad about it.
This is nowhere near the level of naiveté that google had when they had a real name policy for some of their services that outed dissidents, LGBTQ people, and other marginalized people. Not even the same ballpark. If Mozilla really wanted to do something nefarious or bad they could have added things into the codebase directly instead of as an adjunct. I still trust Mozilla personally and I believe they are a net benefit to the internet.
> 1) Demonstrated that Mozilla has the ability to silently push addons without any kind of notification to the user that their browser behavior has been patched.
Wait, did someone assume that Mozilla didn't have this ability? How did people think that they got security updates?
> 2) Demonstrated (allegedly) that there are privacy and security related preferences in Firefox that are reverting themselves to less-safe defaults without user interaction, aka Microsoft preferences.
If that's the case, it's a bug. Bugs happen. Regardless, doesn't seem happen
> 3) Demonstrated Mozilla's marketing department lacks the good sense to respect these capabilities for the loaded gun they are
Fair enough, to some extent.
> It's not about what they did, it's about what they could do. Mozilla doesn't need these tools, and these tools are dangerous. Why did they make them? Why shouldn't we ask Mozilla to remove them?
Wait, what? Why does Mozilla have tools to distribute code? Because Mozilla uses it regularly to fix issues. This has been the case since Firefox 1.0, I assume.
Why does Mozilla have tools that handles and/or updates and/or forgets preferences? Because preferences can't be handled anywhere else, since they are preferences for Mozilla tools. I haven't heard of preferences being force-changed until now, with the exception of fighting malware and switching stuff from experimental to mainstream. But, yeah, bugs happen.
Why does Mozilla have a marketing department? I assume that's not a real question.
>Wait, did someone assume that Mozilla didn't have this ability? How did people think that they got security updates?
Via an updater that pops up a little window showing you Mozilla is installing stuff, or via an apt-get/yum/whatever command. Point is, it is (and should be) visible when Mozilla is pushing code.
> Wait, did someone assume that Mozilla didn't have this ability? How did people think that they got security updates?
The difference is that in one case the updates are released following a public process, with bugzilla entries, proper review and engineering practices, while in the other case it's pushed with no oversight, secretly, by some guy in marketing. It's like Google Tab Manager in your browser. Browsers are too sensitive, too central in people's lives nowadays to allow such things.
It's unfortunate, I agree; but it's the principle of the matter.
This was the company who extolls privacy, openness, and attracts (among others) the sort of people who are uneasy at competing browsers shipped by advertising companies, or old-guard software shops pivoting into more profitable ways to leverage their installbase. This was the company who branded, then re-branded themselves as champions of a more people-conscious web. The exact company who should've known better.
Even their apology, though probably sincere, has a tinge of corporate, marketing wishwash. Maybe it's just the title, but a "We Messed Up" would've been punchier without being vulgar, instead of this bury-the-headline-style "Update on..." crap all too familiar from security vulnerabilities.
The point is that Mozilla prides themselves on transparency, but the name of the config option was "extensions.pug.lookingglass" -- meaningless buzz words with no reference to Mr. Robot -- and the description was just "MY REALITY IS DIFFERENT THAN YOURS" -- an enigmatic Alice in Wonderland quote.
It's actively trying to be opaque. That's the opposite of transparency.
Curious adventurous people install the test build because they want to try out new features and extensions. Those are the users who are most likely to know about and use "about:config". The config option and description of the plugin are mysterious and enigmatic, which tempts your curiosity into turning it on to see what it does, because you presumably trust that Mozilla wouldn't distribute just any old extension that didn't have a purpose other than scanning and modifying the content of every web page, inserting dynamic content adjacent to keywords, and advertising a TV show.
If being opaque is pretty much required, then Firefox is absolutely the wrong context for that extension, whose whole point is transparency.
It's not that it displays an ad, it's that it IS an ad.
Not only that, but it also parasitically hooks in and wastes resources (memory, cpu time, battery life) in each and every tab visiting each and every web page.
That's yet another reason it's totally inappropriate in the context of Firefox, which is trying to dig itself out of the hole of being slow and bloated.
> If being opaque is pretty much required, then Firefox is absolutely the wrong context for that extension, whose whole point is transparency.
Fair point.
> It's not that it displays an ad, it's that it IS an ad.
If it's an add, it's the most well-hidden ad in history, since you need to find both a hidden preference to turn it on and a specific and non-documented website to let it display anything.
> Not only that, but it also parasitically hooks in and wastes resources (memory, cpu time, battery life) in each and every tab visiting each and every web page.
Advertisement or not, it is software created for the purpose of marketing, increasing brand awareness/engagement.
More importantly, it is software that has nothing to do with improving FireFox, collecting telemetry, error reports, running tests, experimental features, or anything else the Shield Studies program is ostensibly to be used for.
> More importantly, it is software that has nothing to do with improving FireFox, collecting telemetry, error reports, running tests, experimental features, or anything else the Shield Studies program is ostensibly to be used for.
I agree that delivering it through Shield was not a good idea.
Yet in spite of how well hidden it was (or rather, because of), we're now all talking about Mr. Robot, somehow. Funny how that works!
> No, it doesn't [parasitically hook in and waste resources]. [...] since you need [...] a specific and non-documented website to let it display anything
Yes it does hook into and waste resources and potentially display ads on ALL web pages.
The extension literally injects ads for Mr. Robot in the form of popup tooltips with links on every web page that contains certain keywords. And it also wastes memory, CPU time and battery life for web pages not containing those keywords.
How much more like parasitic adware does it have be before you can see that it walks and quacks like a duck, because its intended purpose is to advertise a television show?
>It injects a blob of CSS and some JavaScript into every tab, then it does a regular expression search of every text node on each page, filtering out everything but paragraphs, then for each occurrence of a keyword in the text, it creates a new text node to split the current text node, then inserts a new span element between them, containing its own text node, then it creates an additional tooltip element containing six text nodes, five br elements, and one anchor element linking to https://support.mozilla.org/kb/lookingglass , and it also configures css class names to associate all those new nodes it created with the blob of css styling and animations that it injected.
If you wanted to develop your own malicious adware like Superfish that injects your own ads into every web page, this code and the browser hijacking techniques it uses would be an excellent starting point.
The point is that they make a browser. I don't want anyone installing random stuff for a TV show into the program I use to access the internet without my consent.
> This experiment also includes the data collection tool Cliqz uses to build its recommendation engine. Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit.
> Cliqz uses several techniques to attempt to remove sensitive information from this browsing data before it is sent from Firefox. Cliqz does not build browsing profiles for individual users and discards the user’s IP address once the data is collected. Cliqz’s code is available for public review and a description of these techniques can be found here.
Retrofitting something into a definition does not help anyone. We have more precision available than calling it "spyware" can deliver, so argue around that. If you think their anonymisation techniques are faulty or you have reason to believe that Cliqz will violate the law by collecting personal data, then bring that forth.
If mozilla is willing to ship adware in their browser, how can i continue to trust them? the fact that this advertisment was innocuous is totally irrelevant, the problem is that there's nobody in the chain between marketing and product release that had the sense to say "hey, that's a terrible idea, we shouldn't do that to our users".
>The amount of negative press this received nearly cancels out all the positive news from Quantum's release barely a month ago.
I call complete and total BS on this. I may not be on the EFF echo-chamber, and I agree they handled this poorly, but this absolutely does not concern me after hearing the way th add-on behaved. They made a mistake in communications and behavior that should have been expected, but as they said, it did zero data collection and performance impact. It was a screw-up they have fixed via process.
If people are so upset at Firefox for a mostly innocuous mess-up that was quickly caled out and clarified/fixed in the future, that they would dump Firefox for the hero of privacy Chrome, they are very foolish in my opinion.
I agree completely. I'm not leaving Firefox over this. They made a silly mistake, with no sinister motivations (can't confidently say the same about any other major browser)
It's a good example of the outrage culture we live in, and have incentivized on social media, being taken very seriously when it reality the issues have very little real affect on peoples lives...
Firefox handled a mess up very well. The extension was always opt-in and never extracted any data. It came from a trusted source regardless via another layer of opt-in experiment beta testing.
Yes it wasn't cool they chose poor language and didn't fully consider the implications of installing a 'fun' experiment. But lets keep our shirts on.
Quantum has been more than rewarding and this minor PR issue is hardly deterring me from using Firefox... especially compared with Chrome being built by the biggest ad company in the world.
It is pretty outrageous to have one's computer and information be at the mercy of every software developer out there who thinks it's their divine right to collect information about you and how you use their product, to force install software on your computer and generally treat you - the customer - with contempt.
So yes, people will be outraged.
We're sick of being taken advantage of by dishonest companies and individuals because the US privacy laws are a complete joke.
I think my issue is that everything about this plugin — from the marketing tie-in, to the rollout, to the effects of the plugin itself once activated — all indicate a complete breakdown of core values.
Creating a plugin that modifies content on your screen and injects HTTP headers is egregious enough (just look at the response Comcast got for doing it), but doing it for a TV show tie-in? How did that idea even make it through one round of approvals, much less land on every Firefox user’s machine?
Users trust web browsers to deliver the exact content that was requested — that’s why we have gpg signatures, hashsums, and HTTPS. It’s arguably a core tenet of the web. IMO the reaction of the tech community can only be expected in response to such a deep violation of trust.
There are plenty of people who don't care about the santicity of delivered web content, as can be seen by the popularity of things such as the cloud-to-butt extension. And I am sure that the die hard Mr robot fans that are the target audience for this ARG wouldn't have seen anything wrong with that extension.
As you said, the real issue here is the terrible decision to push this to everyone.
Here's another perspective - I am not coming to Firefox over this.
After literally years of struggle with Chrome and Firefox I finally switched to Safari (recently I switched to iPhone so on mobile too) and yes for personal browsing, on a Mac, this is really better than any other browser out there and Quantum felt as good. No, I don't have benchmarking scores, but I am speaking from an end user point of view.
I was a lifetime Firefox user - started browsing on it when I bought my first laptop in 2007 and never touched anything else until Pocket happened and after testing Quantum for a few days I was so happy that the Firefox is back. I don't think so. I guess I will sit this one out. It's not an isolated incident. They have been doing it constantly since Pocket.
Yes, I use this extension. Update etc aren't as smooth in Chrome/FF but I haven't faced any major issue. GitHub issues section is quite active and there are helpful users.
I may seem naïve but I'm kind of constantly surprised that people take this attitude with open source. Nothing is stopping one of these people from building FF from source and having exact total control over how it behaves. Instead they farm that part out and then get upset when this group of people who have alleviated you of that work make a mistake? It's just extreme entitlement.
>Nothing is stopping one of these people from building FF from source and having exact total control over how it behaves.
Yeah, but since it doesn't have an entire dev team committed to it, the fork dies and/or you're using an out of date browser with all sorts of security vulnerabilities and incompatibilities. Some attempts with actual resources behind them:
Cyberfox - dead
PCXFirefox - latest merge was FF 53. Using outdated plugins (e.g. Sumatra PDF from 2014!)
Waterfox - dead
Pale Moon - Still alive. Removes a host of features (e.g. Accessibility and Parental Controls) in the name of performance, yet performs horribly in benchmarks. Slow to adopt new features.
Besides, who's going to use these? A tiny fraction of the population consisting of people reading this thread and threads like it? Who cares?
So yeah, you _could_ "just" fork FF, but it won't get you anywhere. And why the hell am I doing this? I have much better things to do with my time than maintain my own damn web browser. I am constantly amazed at comments like this which are so obtuse as to be comical.
I never would have guessed. Browsing this thread and writing this comment in my sparkling brand new Waterfox 56.
> Pale Moon - Still alive [...] Slow to adopt new features
Slow or reluctant by design. A fork from way back before FF started dismantling its UI. Many new 'features' will never be adopted by Pale Moon.
I'm amazed by people who act like using someone's software product is like some kind of sacrifice or something.
My point is that, if you (not a dev team) don't like something you (again, not a dev team) can build it from source to do exactly what you want. Firefox is OSS, most of the popular extensions are OSS. That's the whole point of the thing.
Mozilla has done a pretty good job of championing open standards, open source, user freedom, and all the stuff that people complain about on HN as if they weren't squarely first world problems. You outsource the upkeep of this incredibly complicated software to them and for the most part they do a great job. The level of vitriol about all of this just illustrates the whole "from-zero-to-death-threat" thing that has happened with everything in modern life.
I'm saying that they give you something awesome. They mainly do a pretty good job of championing some of the things that you care about. They made a mistake and they seem to understand everyone's displeasure with it. The end...or get off your ass and do something about it rather than just complaining about how the people giving you the awesome free thing hurt your fee-fee's.
>> updates have been known to re-enable it if you turn it off ... But it doesn’t matter - you’re going to re-enable it on the next update.
> It's surprising how ... trustworthy Chrome is in this regard. My default search engine is set to DDG and through countless updates Chrome has never once attempted to reset it to Google.
Even though Chrome has every incentive to break privacy settings, even though Chrome has every incentive to revert the default search engine to Google, they don't.
It’s very sad that they reset some privacy preferences on updates. It can be explained by incompetence or bad faith, but coming from Mozilla I'd rather assume incompetence.
In its default configuration Chrome's sync service uses transport-only encryption, not end-to-end, so that Google can read all your history, cookies, and so on. Their privacy policy [0] allows Google to mine this data for its own purposes. I would wager a very, very small proportion of Chrome's userbase manually enables the end-to-end sync encryption option buried in the settings; even technically-minded friends I've told about this are usually surprised.
So Chrome's privacy settings are already broken by default, in nearly the worst way they could be.
they do this becuase I set up end to end for my parents and they lost the password. they never want to use encryption again. the default to user-friendliness which is not a bad thing.
I don't remember that too precisely anymore, but are you sure that you're not thinking of the identifier? It used to be pretty cryptic by itself. Now they use the e-mail address as identifier.
> If “Include history from Chrome and other apps in your Web & App Activity” is checked on the Web & App Activity controls page, Google also uses your synchronized browsing data to provide personalized Google products and services to you.
That's the default, isn't it? So no, not only anonymized and in aggregate. And either way, your compylete raw browsing data is sitting there on Google's servers and associated with your account.
>> [Firefox] updates have been known to re-enable it if you turn it off ... But it doesn’t matter - you’re going to re-enable it on the next update.
You can choose to opt out of Chrome's phoning home in the privacy settings and they haven't tried to revert those settings in an update (and given their track record, I have no reason to believe they will try to surreptitiously change the settings in a future release)
Because that would be absolutely nuclear for Chrome's PR. There are a handful of places where Chrome needs to shine and then they obviously watch out for those more. The depths of the codebase look much the contrary.
With Firefox, the entire codebase has to shine, because someone will find it and hold Mozilla to a far higher standard. A bug in the update process that resets search engines is then only one of many things that they're supposed to watch out for.
Do any of them have a decent chance of success? Or are they doomed to struggle to copy chromes features. Doomed to break because no one tests against them?
If your goal is utmost privacy like many of these projects are providing, you're already going to expect and experience some breakages regardless.
Any browser is going to struggle against the top two behemoths, so I'm not sure why exactly that would be an argument to just accept it and continue using products by companies that have lost your trust. Are end users supposed to compromise their ethics just because web developers aren't in the habit of testing against their browser of choice yet? That just seems like an awfully 'silicon-valley-centric' view of the world.
What does this "success" thing have to do with ditching a product that had violated your trust anyway? Are businesses in most other industries viewed this way? Am I expected to stop buying food from local producers just because the big-box food suppliers are more ubiquitous?
To me, all that matters is sustainability, and IceCat has been going strong for 12 years, PaleMoon has been consistently developed for 8 years, and Waterfox for 6 years. So that's enough for me to at least give them a shot.
Although not a FF derivative, I've been using Vivaldi for a while and do enjoy it. I hate not supporting an OSS browser though, but found even with the performance improvement in FF57, it still didn't compare to a Chromium based browser like Vivaldi. It's got a decently large userbase and could be a viable alternative.
It is very difficult to take Brave seriously given how very shady its fundraising (the entire premise of brave is that they can capitalize on selling your attention) was and how historically dishonest Eich has been about using his money for socio-political, anti-libertarian activism.
It's quite a disservice to Palemoon and Waterfox to include such an anti-user project as Brave.
Eich did everything he could to conceal that his libertarian image was a facade and in fact he was a social authoritarian.
Once it came out he was actively using his money on political campaigns designed to try and further empower and justify the state to decide what relationships between consenting adults was forbidden, he had a rather hard time being taken seriously in this area.
I'm not sure why someone who's actively and monetarily supported politicians saying homosexuals should have to register in a special registry parallel to the sex offender registry is being taken seriously in the privacy arena. Privacy is not something that can be decomposed as an asset to purchase. Every person who doesn't have it leaks information about the people they interact with, and that undermines privacy for everyone.
Hey, Dave. I’m not sure why you thought I was a libertarian. I haven’t identified as such since the ‘80s. As for Buchanan in the ‘90s, I don’t support everything he said - I was most supportive of his economic nationalism.
Did you ever support a politician (say, Obama) only to find they said something you disavowed? Sam Yagan of okcupid did. I disavow Buchanan’s unconstitutional AIDS registry, and probably other proposals he has made.
As for “social authoritarian”, California regulates and licenses marriage via family law, as do all states. I come from an older generation of allies who supported Mark Leno et al. when they labored over, passed, and amended to full positive-rights equivalence with marriage, CA’s Domestic Partner Law (https://en.m.wikipedia.org/wiki/Domestic_partnership_in_Cali...). This was considered just and sufficient, until it was not — and then anyone who questioned the revolutionary tactics used to cast former allies as haters and bigots became a hater too.
I dissent from all such revolutionary tactics and agendas. I agree with dissenting LGBTQ scholars of note on this point re marriage equality, e.g., Camille Paglia. (I don’t agree with those scholars on everything, of course. Same as with most people, including politicians I’ve supported in the past.)
Now the shoe is on the other foot. Marriage equality is law and I’m an officer of a corporation with a genuinely diverse roster of employees. I am committed to the fullest definition of inclusivity, which covers right wingers as well as left, libertarians and non-libertarians. For you to gin up a case that I pretended to be a libertarian is silly (I never pretended that).
But worse, if you judge Brave by a past and too-narrow slice of my opinions, you are doing what haters who boycott Apple because of Tim Cook do. It is your right, of course, but it looks like consequentialism (end justifies means) or really just Who/Whom ax-grinding. I hope you will use Brave in view of what we are trying to do, as a group of people who share a cause and set of beliefs, whatever our other or past causes and beliefs.
> I come from an older generation of allies who supported Mark Leno et al. when they labored over, passed, and amended to full positive-rights equivalence with marriage, CA’s Domestic Partner Law [...] This was considered just and sufficient, until it was not
Oh, please, no, it wasn't by, well, almost anyone. Most LGBTQ advocates and allies never considered it “just and sufficient”, they (at best) considered it at best a distasteful compromise that was better than the pre-existing state and at worst a capitulation to those who wanted to give religious groups a veto over he definition of civil marriage which ignored the enduring lesson of the struggle for civil rights that separate institutions are inherently unequal nnyour and entrenched in law the othering of LGBTQ people and thir families and relationships.
The idea that there was ever a consensus, either in society or among LGBTQ advocates and allies, that the separate institution of domestic partnership was “just and sufficient” is rewriting history.
You may not be familiar, but in previous decades, Mark Simpson, Michel Foucault, and many other gay writers were against "gay marriage", often expliciltly arguing it was an embourgeoisement to be rejected.
Andrew Sullivan and others (with lots of documentary and eyewitness evidence) have written about how they had to move the consensus even among gay people toward marriage equality when it was far away. http://www.slate.com/articles/news_and_politics/politics/201...
I can believe Leno said that, but I am also quite aware that it was a very small minority opinion even among supporters of the legislation.
I'll also note that Leno isn't quoted as saying anything like that in the article you cite to support that Leno said it, though.
> You may not be familiar, but in previous decades, Mark Simpson, Michel Foucault, and many other gay writers were against "gay marriage", often expliciltly arguing it was an embourgeoisement to be rejected.
You are misrepresenting Foucault, who did not argue against (or for, it just simply wasn't a controversy he addressed) equality in marriage but that the limitations (irrespective of sexual preference of the partners) of socially acceptable and institutionalized relationships to only marriage and family-by-descent ought to be lifted and additional forms of relationship recognized and valorized.
Neither did Simpson come from the radical, anti-embourgeoisement, angle you suggest, instead simply buying into the (historically inaccurate) religious right story about the origin of civil marriage and the pro-state-establishment-of-religion argument of the religious right that would give the religious right veto power over the civil definition of religion. That's certainly a viewpoint that exists—and which AFAICT Simpson still holds—but it wasn't a dominant one among LGBTQ activists and allies anytime in the 1999-2011 history of the establishment and expansion of California's Domestic Partnership system. Not even when aggregated with people who did take the radical position you identify, even though neither Simpson nor Foucault are among them.
> Andrew Sullivan and others (with lots of documentary and eyewitness evidence) have written about how they had to move the consensus even among gay people toward marriage equality when it was far away.
I'm not sure why you are pointing to an Slate article that is simply a reprint of one of Sullivan's 1989 articles laying out a conservative case for gay marriage to support your contention that Sullivan and others still had to move the consensus of LGBTQ advocates and allies to support marriage sometime after the time in 2011 when California harmonized domestic partnership with marriage so that the two arguably differed in name only.
Sullivan was certainly important in moving the needle in terms of what people thought was reasonable to set as a near term goal and how they sought to sell it (whether he really shifted the ground on the long-term goal, or just made it seem less quixotic and pie-in-the-sky might be a debate), but he did that well before the time you are referencing.
You spin a fine tale, but it seems to be entirely historical revisionism backed with red herring links and name dropping.
Pretending marriage equality was always on deck when Leno et al. were working on domestic partnership is the spin here. Either the advocates of the previous decade's reform were not telling the truth (and Obama was strategically lying when he too endorsed civil unions but rejected marriage equality), or they meant what they said at the time. You can't have it both ways.
Again the revolutionary (full Alinsky) playbook is evident: down the memory hole with the past; lie (to self and others, doesn't matter) about goals, promising no further; then go further the minute you get it and isolate and demonize anyone who objects. No thanks.
> Pretending marriage equality was always on deck when Leno et al. were working on domestic partnership is the spin here
I'm not sure what you mean by “on deck”. If you mean tactically attainable, yes, there was a wide view even among advocates and allies that it was not. DP was a tactical advance, on that there was broad consensus (though, ironically, the anti-embourgeoisement radicals you point to support this weren't part of it, as they generally viewed marriage as an archaic social institution not to be sought or imitated, but to be eliminated.)
But your claim wasn't about what was viewed as politically pragmatic, but about DP status being seen by advocates and allies generally as “just and sufficient”, rather than unjust and insufficient because it was separate, but at least better than the status quo ante because it was—to the extent possible for the state alone—formally equal.
> and Obama was strategically lying when he too endorsed civil unions but rejected marriage equality
Disagreeing with a movements aspirations isn't a lie. Now, whether Obama was a secret supporter tactically lying to placate opponents, a moderate opponent of the goals of the movement telling the truth, or a stronger opponent telling tscticsl lies to get support of the movement while not alienating it's opponents is...well, completely irrelevant to whether the movement itself saw civil unions as “jist and sufficient” rather than merely a lesser injustice than the status quo ante.
> Either the advocates of the previous decade's reform were not telling the truth [...] or they meant what they said at the time.
You are conflating LGBTQ advocates with the politicians who were (or, in Obama's case, were not) involved in reforms. Those may be overlapping groups, but they aren't the same groups.
Now, if all you meant to say was that you identified with the narrow, political establishment group that endorsed civil unions as the end goal rather than the mainstream of LGBTQ advocates and allies at the time who openly called for marriage equality as the goal but accepted formally equal unions as a tactical advance, that's defensible. But it's not at all defensible to claim that the movement saw civil unions as “just and sufficient”, that was overtly never the case, whatever a handful of politicians trying to balance between the movement and conflicting groups might have said (and, who knows, might have even believed it when they said it.)
It's pretty wild how far into this we are given that Eich wants to present himself as somehow pro-LGBT for Prop8 support.
Perhaps it has been lost to the sands of time, but it seems curious that this didn't come up as a publicly stated defense while the Mozilla board was contemplating what to do with their total PR disaster out of a corporate office.
Your decisions are your own. But trying to suggest that donating for CA's prop-8 was in fact a pro-LGBT act is simply not going work well here. Please stop insulting our collective intelligence suggesting this.
If you've changed your mind, or have reasons, or whatever? Great. But trying to suggest that in fact you were a better advocate and steward of LGBT rights while (perhaps unintentionally, perhaps deliberately) suggesting everyone else was wrong in what they wanted? No.
You could also just say, "I have changed my mind" or "I have decided this issue is less important to me now" or even maybe, "I thought I was doing the right thing, but in hindsight I chose a bad strategy." A million other phrases that own your actions and don't project onto others.
> trying to suggest that donating for CA's prop-8 was in fact a pro-LGBT act...
I suggested no such thing. I said explicitly I was sticking to a previous bargain. Hate on that if you must, but don’t put words in my mouth.
At this point you have misread so many declarative statements I’ve made here that I am going to let you have the last word, if you like. But no, I never suggested that. It seems to me you are engaging in faulty logic to cast what I wrote in an either/or. Stopping here.
I actually supported Brave in spite of your history. We've talked on Mastodon.social about it. I am always a fan of humans being complex and redemption being contextual.
Then I read about BAT. Your business plan soured me.
I'm very sorry that I missed ended your politics Brendan. Sincerely. O obviously misinterpreted what you said. But that changes very little, and I've already spoke at length about what it doesn't change elsewhere in this thread.
The current ad-tech ecosystem is a complete disaster, and Eich's vision for replacing it is, I think, genius.
Leverage properties of cryptography to build a browsing experience which respects privacy but retains opt-in ad relevance and anonymous metrics, and further leverage developments in cryptoeconomics to balance the requirements of user <-> publisher <-> advertiser in a properly-designed content generation and consumption ecosystem.
I find the whole idea elegant, ambitious and pragmatic.
What specifically do you find anti-user about Brave?
> The current ad-tech ecosystem is a complete disaster, and Eich's vision for replacing it is, I think, genius.
Eich's SALE of positioning his company as a gateway to all online advertising while spinning this as "pro-privacy" is indeed genius.
His actual vision of the product and the positioning of Brave as a controlling arbiter over all ads (and thus, as a central collection and monitoring point for data around ad consumption) is quite dystopian.
Nothing about logging our ad views to a publicly inspectable blockchain is in the interests of privacy. All it does is offer Eich's company an opportunity to make yet another skeezy ad platform with a new series of buzzwords. It will not be more difficult to game than any other browser, but it will sound impressive and current and gain ad buys.
And I submit that the inevitability of the ad network is itself a questionable notion when a more direct service economy is not only historically how things were done. That model faded as broadcast technology outpaced other IT, but as other IT caught up we've been seeing a return to direct-to-customer service models and these are outperforming ad models in some media markets.
It is not inherently a "blockchain" idea to sell off your time as ads in order to pay for your browser, and other folks are at least pretending to align their business model with user interests while building an information and attention economy (e.g., Steem)
Please read the white paper at attentiontoken.org. We do not dream of monopolizing the browser market, of course.
Apollo phase of the roadmap will have multiple clients supporting BAT, with as much endpoint (client and site/creator/user, hard KYC issues here due to centralized fiat currencies and governments) logic moved on chain as we can given future Ethereum scaling and anonymity support. Web standards for particular innovations as apps join the platform and gain enough scale.
This move is a complete slap-to-the-face for everything that Mozilla and Firefox supposedly stands for, and would be heartbreaking for the developers to hear that this is going on in the wake of all the work around "Quantum" and everything else they've won with recently.
But really, this Mr Robot news went no further than an article on The Verge (I presume it even got there?). More importantly, those that care are able to think critically of the situation and don't really have anywhere better to go.
>> The amount of negative press this received nearly cancels out all the positive news from Quantum's release barely a month ago.
> I call complete and total BS on this.
Well it's the truth. Use "Google News" and search for Firefox. You will see much more news sites write about the fiasco last weekend then about a faster Firefox.
And guess what, rather rude comments came from employee trying to clean up by voting down comments hours too late. It's time to fire the responsible marketing manager/exec. Mozilla is setup as a non-profit org but acts like a unicorn startup, playing rich and flying in all employees every 6 months, that also happened on that very day, so the corporate drones couldn't response and clean up the outcry in time.
On the other hand, I was in the process of moving over to using Firefox as my main browser, and this has me reconsidering that decision. Chrome is far from perfect (and chances are I'll move to Firefox or some fork anyway because the main process in Chrome keeps seemingly pegging one core [constant 20-25% CPU usage]), but they haven't made the obvious mistakes Firefox has (adding Pocket to the default browser, the handling of this extension) and I generally feel it stays more out of your way (probably a personal dislike of mine, but I wasn't fond of opening Add-on settings and it presenting a list of suggested stuff to install).
Indeed. I get that people are upset about this, and might even switch to Pale Moon/Waterfox/what have you, but those that switched to Chrome? Whatever your reasons for switching are, privacy really cannot be it.
This is one more anti-privacy move from Mozilla in a series of such moves.
I am now using Safari and have to keep an eye on the family computer to see what crap Mozilla decides to install next.
The nice thing about ethical organisations is that you can have peace of mind and don't have to worry about how they're going to screw you when their marketing department runs amok. Because of cliqz, the annoying telemetry (aka spyware) and this incident, I don't trust Mozilla any more.
Moving to Chrome would indeed be silly, bit it doesn't mean things are rosy.
That's Mozilla taking another step down a very slippery slope. "It didn't hurt anyone" doesn't excuse ethical or moral wrongs. Given Mozilla's stated commitments to privacy and integrity, their choice here violated them.
> It definitely sucks, but I don't see how it was anti-privacy at all.
It definitely increased the attack surface area[1] with no upside for 99.9%[2] of Firefox users.
1. It's a juicy target: an addon that can modify the content of any page a user visits? It doesn't take much of an imagination to think of how this could be subverted.
2. My conservertive guess of the fraction of Fx users not interested in Mr Robot easter eggs; I probably ought to add a couple more "9"s
May be you don't have any sensitive info being accessed day in and day out but some of us do. And we trust firefox with it. I panicked when I saw the add-on because I use the same browser for trading as well.
Firefox still crashes or freezes for me.. (Arch 6gb ram) -- I want to be able to use it, but chrome seems to work better and longer. I do like tree-style tabs, but I can't have my browser crashing or freezing when I'm working. Time is money. I also noticed that some of the dev tools stuff doesn't catch as much as google chrome does... I couldn't solve an issue because some vue errors weren't showing at all.. open it up and chrome and the console lit up.
Albeit I'm more of a backend guy so debugging in chrome/firefox isn't my forte, but I can usually gather enough data from dev tools to fix things.
I have switched back to Firefox after years on Chrome due to Quantum, and could not be more pleased with the switch so far. This is disappointing, but doesn't really affect my decision
I just hope this makes the outraged people quiet for a while. This is a clear apology and Mozilla seems to have learned the lesson. Let’s now show some love and support for this powerful open-source organization.
It seemed like a fair apology written by a non-tech person who may not understand the situation 100% and was given some bullets to write about.
We must forgive them and stop being so negative. They've made their apology. If _this specific_ thing happens again then I'll join you with some pitch forks.
To be so negative and full of hate isn't healthy for anyone.
> It seemed like a fair apology written by a non-tech person who may not understand the situation 100% and was given some bullets to write about.
In the context of the last big "good guys" entity in a sector where technical understanding is key, this might make it even worse. User trust is the single thing the browser ecosystem boils down to.
I don't think you're accurate in identifying hate as the catalyst for this issue -- I'd go with concern. And seeing one's concerns handled with such thoughtlessness does foster negativity.
We care because we know FF is the best mainstream pick when it comes to privacy and user rights, and seeing Mozilla go down that route reminds us that we're very easily screwed.
This apology from the CMO is only the start of what I hope to see.
What lesson they learn from this remains to be seen, based on what steps they take to prevent this happening again. The fact that any "lessons learned" from the Pocket debacle weren't enough to prevent this (IMO even more egregious) case doesn't speak very well to Mozilla managements ability to learn from their mistakes.
I hold Mozilla to a very high standard compared to pretty much any other tech organization, I care deeply about FireFox, Rust, Servo and the technical work Mozilla does, but they need to be held to account when they take actions that violate our shared values.
it promotes firefox to viewers of the show about online privacy... the viewers are probably more receptive than most to changing over to a more privacy oriented browser.
Yeah, it can be interpreted in a few different ways.
Sometimes places say "we weren't paid anything" in an attempt to pretend it was out of the goodness of their hearts (or similar)... when in fact they were receiving benefits of some other kind. Just not directly money.
Note - Corruption often seems to work like this too, as "payment in services" (eg kickbacks, etc) instead of money can be harder to track.
So, when places say they did something and didn't get paid for it... I also (personally) find it's best to double check if they received services/benefits instead which they'd not mentioning. Just in case.
It gets a lot of screen time. I believe there was one scene in which Tor was used as a browser. The main characters all use Firefox on a number of occasions, in all three seasons.
Firefox/Mozilla claims to be pro Net Neutrality, yet they pull this stunt running a promotion for a Comcast owned TV show, one of the biggest anti-NN lobbyists.
That's fairly typical corp speak and it's a surefire way to discredit everything else you're about to say. I really don't get why companies keep doing this, it's not as if their audience is entirely dumb.
Mr Robot is a very activist show. It's entertainment, sure, but it's also attempting to send a message to it's viewers. Mozilla is attempting to push the same message. Aside from this misstep, what's wrong with that?
I just think it's gauche. I don't want to hear about the TV shows that you're a fan of in your software. Keep that stuff at home. I know that's subjective and probably seems miserable.
But actually I realised that I do think there is something wrong with pop culture references. They’re inside jokes. They exclude people who don’t watch the same things as you. They reinforce the tech bubble and frustrate people who don’t understand.
I read a comment by someone who’s lecturer was confusing them by talking about the master theorem as the doctor theorem because he liked Doctor Who! The poor guy was embarrassed because he didn’t get it.
They’re also just dull! Wow you watch that same TV show as me? Wow incredible. How wacky are we.
Outside of the man thing, and it was promptly fixed when found to interfere with usage, those things are passive things that one have to know the source for to pick up on.
This "extension" would be actively modifying pages based on triggers, behavior more akin to malware.
All those references are very old, and none of them were made in an attempt to market anything. They aren't ads. They're minor tokens of genuine appreciation people added to the tools they wrote.
The extension is essentially just an advertisement for Mr. Robot, which has a big budget. Presumably they pay for their other advertising, and pay their employees to develop their own web sites, whose URLs are built into the extension, and which receive special treatment by sending a custom header in each request.
The obvious problems with how the extension was distributed and described aside, I think Mozilla still deserves to be paid for developing and especially distributing such advertisements, because it has cost them time, resources and reputation.
Pre-installing a plug-in in the development build is a service that many people would pay for -- please install my bitcoin mining extension (and don't forget to enable its configuration flag "extensions.pug.lookingglass.super.awesome.download.accelerator"), it needs a lot of testing!
How much does Google (or whoever) pay to be the default search engine, and how much is automatically installing an extension in the test build worth?
If the Mr. Robot show is sincerely activist, they should be happy to pay Mozilla what it's worth for Mr. Robot to benefit from such special treatment. Especially if it was their idea to distribute and describe it the problematic way it was. At least Mr. Robot could barter in kind, by doing an episode all about the virtues of Mozilla, with a flashing download link at the bottom of the screen? ;)
Mr Robot does "product placement" for Firefox when it shows the main characters using it as their web browser. The ARG also markets Firefox because the fans wanting to play the game must use Firefox to do so.
I do agree that pushing this extension to everyone is a horrible idea though.
(Somewhat off-topic, but Mr. Robot as an ''activist'' show is heavily steeped in irony. Not only is the show a huge cash cow for a massive corporation, but much of the second season is focused around the main characters realizing this whole cyber-socialist revolution thing isn't what it was cracked up to be. There's also insanity, violence, and heavy drug use, and things become more abstract and more insane as the show progresses. It's very dark and somewhat disturbing. Good television, but not sure that's a message Mozilla really wants to align with?)
Yes, in a capitalist system, money comes from somewhere, and there's no ethical consumption. It's possible for that to happen and Mr. Robot to still carry strong anti-capitalist, anti-1%, pro-digital freedom messaging.
> It's possible for that to happen and Mr. Robot to still carry strong anti-capitalist, anti-1%, pro-digital freedom messaging.
What? I must admit that I haven't watched the third season yet, but the aftermath of the "revolution" shown in the second is a perfect rebuttal to the idiotic anti-capitalist ideals of the main heroes. When I started watching, I was afraid that it would turn into a typical "occupy something" propaganda, but it turned out much more intelligent and thoroughly implemented jab at it's own characters.
Well that explains why i found their initial show ad off putting, and likely why i have found the valley "way" less and less appealing. Activism of that sort rarely bring anything more than hot air and bad blood.
> as part of this relationship, we developed an unpaid collaboration to engage our users and viewers of the show in a new way
I'm almost more annoyed it was unpaid, and they integrated a gimmick for a television show into the browser to be 'engaging' to users. That leads me to believe they're really out of touch with their core audience.
I mean, Mr Robot probably wouldn't use Microsoft Edge. Probably some hacky shit I never heard of, but Firefox seems like an appropriate choice to drive an anti-billion-dollar-corp-controlled-internet message. I don't have a problem with it, really.
The addon seems harmless, too, but sends the opposite message and I don't understand why their marketing and security teams didn't sit down to discuss this and immediately come to the conclusion that it's a horrible idea.
It's documented that Shield studies can be run without prompt for the individual study, no need to assume otherwise. People primarily worried about their privacy should have been worried about the study feature in cases where they'd actually run studies collecting data, not here.
Pushed out silently as part of a mechanism designed to beta-test new browser features. Per their own documentation the extension is supposed to target 1-2% of the install base and pop up asking permission to continue.
This is basically Microsoft using Windows Update to install a desktop icon promoting the latest season of The Voice.
> This is basically Microsoft using Windows Update to install...
Asphalt 8, Candy Crush, Keeper (also, see this[0]).
These are the three[1] apps that I had to remove from a laptop purchased last month. They weren't a part of the OEM install, they came with the updates after the system was up and running. Bad example.
We really need a fork of Firefox with all the garbage removed, including the ability for Mozilla's marketroids to push things at us remotely. (Also "telemetry", DRM, Pocket, spam on the new tab page, etc.)
A browser should just be a tool which answers to the user. I want my browser to be like a pair of pliers or a bicycle, neither of which have relationships with television shows. I think Iceweasel was essentially this, until the Debian project abandoned the effort.
We want our browsers to work. Without telemetry, they simply won't be able to find and solve bugs and crashes effectively.
Without crash reporting and other basic telemetry, it's basically impossible to know how prevalent certain bugs and configurations... which is of the utmost important for making a browser which actually works.
Not "e.g. after a crash", "only after a crash". That's about the only kind of telemetry you can get on a "prompt on each occurrence" basis like that. Just monitoring crashes is not nearly enough to create a competitive browser. Performance bugs, many of which are specific to older systems mostly used by people who can't be expected to file bugs in Bugzilla, cannot be reliably caught without some kind of telemetry.
These discussions with responses from Mozilla employees demonstrate that hasn't always been the case (I'm not 100% sure the add-on settings tracking is opt-in at this point, it appears to have been fixed to follow the 'Do Not Track' setting) and show a bit more of the mindset of the company. They want to have their cake and eat it too.
My intention was to warn that Mozilla's use of the term 'Telemetry' as a feature does not cover all of their data collection, and to point to official examples demonstrating the mindset of the Mozilla developers for a higher-level perspective. As you have repeated, the one (primary) aspect of of Firefox's data collection that you mentioned (dubbed Telemetry, which I initially confused in context of OP's comment as intending to include all data collection) is documented on your link as opt-in. Props for that, but there are other aspects. (I am also going to verify it must indeed be enabled manually during a default install.)
Per OP: The last thing I want is my browser to 'phone home' when it feels like it.
I may be wrong, but my understading is that "Google Analytics in the add-on settings" has been improved only to _opt-out_ rather than being required in the past.
Also, per their website SHIELD Studies seem to have a global opt-in followed by a per-study opt-in/out setting. Unfortunately the wording seems a bit wishy-washy and there are anecdotes on this discussion claiming this specific "study"/marketing opportunity did install and run something (at the very least: to skip enabling itself) without purposeful opt-in. There is a lot of confusion here. https://support.mozilla.org/en-US/kb/shield
(Reply after actually double-checking, also heavily edited)
I just went to getfirefox.com, ran the download, and this URL was displayed within tab 2 next to the 'Welcome to Firefox' tab (unfortunately I didn't record which tab was given initial focus) when Firefox started for the first time:
Effective September 28, 2017 [...] Firefox by default shares [...] Interaction data [...] Technical data
Since the page you linked was "Last edited 3 years ago" I'm going to specifically contradict what you re-emphasized as fact by stating: telemetry, the feature, has been changed to currently (Sep 2017-present [as of Dec 2017]) be _opt-out_, unless the development of ancient feature capital-T Telemetry somehow still exists separately from contemporary lowercase-t telemetry (per this link also referencing the telemetry documentation).
This conversation/investigation/out-of-date documentation reinforces what I see as a very recent trend where Mozilla/Firefox is heading in the wrong direction, basically spending/burning the political capital/trust they've earned while (perhaps unintentionally) deceiving even their most technically adept defenders. I would love to investigate how this approach took root; how it was finally given the official green light; and how its ongoing escalation has affected rank-and-file Mozilla developers, supporters, and the various categories of users. In my opinion, the "spirit of Mozilla" is changing ever so slightly (eerily similar to Google's pro-marketing turn away from "don't be evil" culminating in merging of all collected data). My biggest beef with this is that Mozilla has pushed its public branding further laying claim to protecting privacy, but this could be tempered somewhat with a comparison to Signal's inclination toward practicality rather than perfection.
I would be interested to hear how you feel after doubling down on this, since it appears to have indeed changed from opt-out to opt-in without your knowledge. Further, if you did not originally opt-in on install long ago I would be curious to hear what the current value of the setting is now. (Was a previous non-opt-in "default" updated to the new non-opt-out "default" at any point? I hope not!) It goes without saying that you should feel no obligation to invest the time to respond, especially to these last unnecessarily detailed and specific interests.
Optimizing for benchmarks only gets you so far, and often a change that benchmarks well can actually hurt performance in the real world, so telemetry is vitally important for judging real-world performance. Since Google is pretty comfortable with adding telemetry, they have excellent data and deep insights into the performance (and hardware compatibility, and network reliability, etc.) problems that occur in the real world, and can design Chrome to meet those needs. Mozilla is unwilling to telemetrize All The Things, but in order to stay competitive they need to understand the problem-space at least as well as their competition, and so you see them tying themselves in knots trying to walk the line between privacy and useful telemetry.
A fork of Firefox fixes none of the issues at hand. At best it gives a couple hundred users some obscure name to proudly flaunt when they are asked what browser they use.
Mozilla is what's important, not Firefox. And Mozilla needs to be fixed.
I don't have access to the private bug myself, but I can try to reason about it.
I believe that at this point, opening up this bug would do exclusively harm and no good to anyone.
There's nothing I can imagine in the bug to be of value to our understanding of the situation.
If the people working on it were oblivious to what they are doing, then it would just look plain stupid from hindsight 20/20.
If the people working on it were aware and hoped that no one will raise a fuss, then it'll look even worse for them.
The important fact is that Mozilla reacted, and that the leadership does have access to this bug. Whoever was involved is probably currently involved in debriefing what has happened there and that bug is part of it.
I hope it'll be open at some point, but I'd hate if access to the bug resulted in a witch hunt and public shaming of that person/people which, as we all know, the Internet is great at.
We know that our leadership reacted and we know that they recognize what has happened. I'm not asking you to trust them, obviously that has to be regained and the process is painfully slow, but I do ask you to give them time. The emotional reaction is short-termed. I hope that this incident will have a long term positive consequences to our project.
Of course, a witch hunt does no good to anyone and to my mind, it's a mistake (albeit a bad one).
My issue is that the public bug was closed off early. In future, perhaps the Mozilla team might take it into account that communication might be smoother if they keep things more transparent.
I'm a massive fan of Mozilla. In fact, I'm trying to get more folks in my org to use it instead of Chrome (it's a hell of a lot more stable, and the Chrome team tends to break our web apps frequently). I largely trust Mozilla far more than the Google team, and this unfortunate episode, for me at least, just made me mad because it was such a major cock-up that it was entirely unexpected.
Jascha Kaykas-Wolff should be fired. Marketing shouldn't be allowed to modify the shipping bits at all, even if the Chief Marketing Officer tells them to. Any and all product changes should go through engineering and tracked in bugzilla. The CMO can file a ticket in the open just like anybody else can.
This counts as a personal attack. Those aren't ok on HN and we ban accounts that do it, so please don't do it again. You may not owe better to whoever installed an extension in your browser but you do owe better to this community, if you want to comment here.
To me, the sad part is (based on what little you can find in public bugs) the Shield team seemed to be engaged in this, and didn't raise a flag that their platform of experiments was being co-opted to push out a game.
There's all the talk that Mozilla violated peoples privacy, and they're not wrong, but the larger loss, I think, is all the technical people who will turn off Shield and never come back to using it.
One gotsta make them dollars, right? I am not aware of their financial status but I'm fairly certain that Quantum development would have burnt a substantial hole in their Pocket.
They should have given the same treatment to Pocket and Hello: optional, manifests as an add-on, and possibly off-by-default for certain kinds of users. Instead we get value-adds baked directly into the broswer itself. I HATE this new age of corporate-oriented thinking, especially from a company that claims to reject those values.
I just wanna know what kind of idiot thought this was a good idea from the beginning.
I mean, I'm just a cybersecurity guy and a software engineer. I'm no PR person. But it doesn't take a PR expert to know that the world would eventually find out about an addon getting installed without permission and it would be a disaster.
My guess would be that a PR person did not think about the aspects that went wrong and was more enthusiastic about having a clean way of delivering this. Not much to do, it just appears, no need to tell people how to install an add-on, no issue since it doesn't do anything to people that don't turn it on. Privacy check passes, since it doesn't do anything that impacts privacy. (Which the first press responses focused on pointing out). Since it's supposed to be stealth (it's an ARG), only a small group is involved, hyped about bulding this cool thing.
Totally could have happened that way, totally missed something crucial at every single step that came back to bite them.
I'm talking about Mozilla using the Firefox 'addon' extensions mechanism to support an ad campaign, hence renaming the extension mechanism to 'ad-on' might make it more clear to users what Mozilla is using it for.
Because it was turned into an addon following the debacle, which was the correct move. If you're going to make jokes you could at least research the material?
pug-experience
Complete • My reality is different than yours
So, there was a Mozilla study, with almost the shame shady description, which DID run by default, at least for some users.
Are the Looking Glass add-on and this SHIELD study completely unrelated? Why do they share the same description? Why is Mozilla using these shady descriptions in the first place?
Probably I am just being paranoid, but Mozilla has done nothing to gain my trust, lately.
From what I understand, the add-on wrapper checks for a preference immediately on startup and only loads the WebExtension doing anything if it is set manually. It's enabled in the sense that the wrapper loads and shuts down again, it's disabled in the sense that none of its functionality actually runs.
The fuck it is. Mozilla, champion of the free web goes corporate, the first action after their force-fed update ('for your own good') is to start pushing this sort of thing? Significance of trial balloons should not be underestimated.
I see your point. But large tech organisations commit these faux pas/atrocities (depending on your point of view) all the time, regardless of their relationship with profit. I think the reason they happen at all and the shrill tenor of the associated backlash come from the same place though - a kind of echo chamber insularity.
For me the motivator is the fact that they cost me a couple of hours in lost time due to their botched upgrade. This last episode is just icing on the cake and illustrates how completely out of touch Mozilla is with the users that make up their core.
It's roughly on par with Apple pissing all over the designers and animators and movie makers that were their lifeblood in the pre-Ipod days. Only in Mozilla's case they don't have an Ipod.
I hold Mozilla to a much higher standard than other large tech organizations.
This particular incident shows either massive process failure (allowing marketing to auto-deploy code without sufficient review), or that no one in the review process recognized the issues with using development and debugging tools to push marketing software.
Either version is (yet another) blow to the trust I want to have in an organization that I still care very deeply about.
What really bugs me is that I had a perfectly good Firefox until a few scant weeks ago when Mozilla decided to force-feed me an upgrade to new browser tech that I didn't ask for, screwed me six different ways at once in the middle of a project where I fairly critically depended on an extension that suddenly stopped working that had just about half the notes of a project in it and then, to add insult to injury push their own add-ons down my throat that I didn't ask for.
For someone who has stood by Mozilla over the last decade or so and who never switched to Chrome you can't begin to imagine how pissed off I am. User trust is earned bit-by-bit, you can lose it all in a day. Ask Lenovo how that sort of thing works.
That's one thing the Firefox ESR is designed to mitigate. If sequential automatic upgrades weren't quite up your alley, this might have been the right solution for you at the time.
Which I had installed, which happily upgraded to FF 57. (I still don't get how that happened the first time, it could have been Ubuntu doing the upgrade, it could have been FF itself but I don't have time to dig this out and I'm not even sure if it is something I'll be able to prove one way or the other.)
I've gone so far now as to drop any mozilla.org domains through DNS hacks to make sure this never ever happens again, because after I downgraded it the first time it happily immediately updated back to 57 in spite of having all auto-update settings switched to off.
Back to 52.5 it is for me. No more tricks like that. Which is sad because if there is a critical security vulnerability in this browser I'm likely not going to notice immediately.
Did you really not know the "force-feed" browser upgrade was coming, and that add-ons were going to break? We've been talking about it on HN for a like a year before it happened.
They also had to do it at some point, XUL was a dead-end.
> (...) where I fairly critically depended on an extension that suddenly stopped working (...)
We communicated about the old addons deprecation for over a year. I'm sorry the news didn't reach you, but we tried.
If it didn't reach to you in time for a year, I doubt we could have done anything more to not make it sudden for you.
> User trust is earned bit-by-bit, you can lose it all in a day.
I know the add-ons would stop working, that's why I had a perfectly good FF 52 running which was supposed not to upgrade. The fact that it did (on all three of my machines, no less) caused me no end of annoyance. Fortunately I've managed to fix it, at the cost of lots of lost time in the middle of a time critical job.
As I wrote elsewhere in this thread, neither do I, chances are that Ubuntu did the upgrade but after I downgraded FF to 52.5 again it did it once more.
So there is really something weird going on there. But it's end of the year and I have a ton of work to do not related to debugging browser issues so it will have to wait until I have some spare time.
But thank you for caring, it really means a lot to me.
Oh, btw: backwards compatibility is a thing that most users appreciate.
That went into a separate directory (~/ff/) with a symlink from /usr/bin/firefox to /myhome/ff/firefox/firefox
After that I locked down all access to mozilla domains to make sure it would not do anything funny again.
I'm not sure where that 'channel' link you put there lives, I assume that's one of the about:config settings?
Possibly it somehow managed to use the settings from the original browser installed with Ubuntu rather than the ones that it came with. That would at least explain the weird upgrade behavior.
edit: located the 'channel' setting it's app.update.channel and it is set to simply 'esr'. But I have no idea what it was in the past, this is a completely fresh installation in my homedir.
Thank you for all your time, I have to go to sleep now.
At the risk of sounding like a Linux snob, there is a right way and a wrong way to do package management in Linux. Installing binaries into your home directory then linking them to a system directory isn't the right way, unless it absolutely can't be avoided. Not surprised this happened -- use the package management system that comes with your distribution, especially if you have special requirements on maintaining certain versions.
While you're technically right :), it's pretty common for people to discover this the hard way.
It sounds like jacquesm's hit that point, unfortunately at a time critical spot. Probably won't happen twice though. :)
Thinking about this a bit more, it almost sounds like the Ubuntu supplied Firefox (in the base system) was updated to v57, and likely overwrote the /usr/bin/firefox link.
If that's the case, then the manually downloaded v52 ESR is probably still in /myhome/ff/firefox/firefox.
jacquesm, when you have time to check... see if you can launch the version in /myhome/ff/firefox/firefox directly (instead of using the /usr/bin/firefox link). It'd be interesting to see which version is in there. :)
I realise the timeline is a bit confusing by now but here is the complete sequence:
- install Ubuntu
- remove OS supplied Firefox package
- install Firefox ESR
- have a 'surprise upgrade'
- re-install Firefox ESR
- have another 'surprise upgrade'
- install Firefox ESR in my homedir
- symlink it from /usr/bin
So now if it pulls any other tricks I can restore the symlink and call it a day, but for now it looks as if that last move did the trick because since I did that (and dropped all FF domains in through /etc/hosts) it has not done any more upgrades, though there is a chance that it attempted to do that.
The one saving grace in the whole story is that at least the plug-ins that got forcibly removed/disabled had their data survive the whole ordeal.
I did that after the whole thing went South in the first place. So yes, obviously that's not the way to do things by default. But it's a useful way to override package management and auto-upgrade trickery. Worst case now if it happens again (which I really hope it will not) I have to restore one symlink.
> I doubt we could have done anything more to not make it sudden for you.
It should have been a new-window snippet. Depending on users to read blogs is living by hope. They should have put the news in their faces, unavoidably.
I'm happy to see an apology, but there are further steps they could take. I just did a clean install of Firefox and unless I somehow messed that up, it looks like user studies are enabled by default. Someone correct me if I'm wrong here, as I didn't expect that to be the case.
They should absolutely not be running any sort of user studies on people who may not be aware it is being done, which is going to be the case with the current setup. The only way it sits right in my mind is if user studies are opt-in instead of opt out.
This is especially ridiculous as their marketing is focused on respecting privacy. An apology is nice, but changing this setting would go a long way towards proving that.
I believe that is a strong part of the current outrage: people did not realize that this existed and was turned on. Since actual studies would collect actual user data (unlike this now), the fact that it surprises people suggests that they did not obtain meaningful consent for their data collection.
At least from a quick search, I could not find good documentation what studies do exactly to avoid or properly handle personal data, it's possible that they do a very good job of that. (Suggestion to Mozilla: talk about these details at least after the study is done, show what you found. Hopefully: More tech-content to publish, less questions, less ugly surprises)
As a huge Mr. Robot fan, but one who realizes how niche the show is (the ratings have substantially dropped year after year), I’m embarrassed that Mozilla sullied its reputation for such a small promo — at least U2 was a huge band most people have heard of when Apple pushed their music onto users. The controversy makes Mr. Robot look pretty bad too, even though AFAIK, Firefox (unlike Amazon’s Echo) never was prominently mentioned on the show.
Fixed Firefox spelling and URL master (#43) @gregglind gregglind committed 4 days ago:
+ "description": "MY REALITY IS JUST DIFFERENT THAN YOURS.\n\nLooking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience. Are you a fan of Mr. Robot? If so, join the hunt for answers!\n\nParticipating in this shared world experience requires explicit user opt in. If you are not actively participating in the ARG (Augmented Reality Game) no modifications will be made to Firefox.\n\nhttps://support.mozilla.org/kb/lookingglass",
Sigh. Again [2], it's definitely not an "Augmented Reality Game". And it hardly qualifies as an "Alternate Reality Game", which is defined as "intense player involvement with a story that takes place in real time and evolves according to players' responses". [3] How does this extension affect the evolution of the TV show's plot? If there's not interactivity and feedback, it's Alternative Reality Static Content (aka Alternative Facts), not a game.
For what it's worth, we developed a TV show with Current TV called "Bar Karma" [4..7] along with a web site and mobile app, enabling viewers to collaboratively write, discuss and vote on the scripts of each episode. But as far as I can tell, that's not the point of this extension.
399 comments
[ 3.1 ms ] story [ 302 ms ] threadI am one of those not affected at all by the Looking Glass extension but still, my trust is Mozilla (which has been eroding as of late) has suffered greatly.
It's a blip, one you where not affected by at all and in the scheme of things not major compared to other vendors. But hey, boo mozilla uninstall everything and use lynx/curl!
If Mozilla cared about people trusting them with their privacy then they shouldn't have evicerated that trust by installing an extension (even switched off) behind their back.
They did this with Looking Glass, they did this with Pocket, and they did this with non-free WebRTC support. Three strikes and you're out!
WebRTC did violate your fundamental freedoms as defined by the FSF, but that's not a privacy violation.
Please explain how your privacy was actually meaningfully violated.
No organisation is perfect and you have a right to be angry, but you're being a bit extreme IMO. It's much more nuanced than three strikes and you're out, and it's a shame to reduce it to that level.
Mozilla decided it's no longer compatible? BOOM! GONE FOREVER!
Oh, you relied on that one? Welp..
In my mind, no apology is better than a 'sorry you were upset' non-apology, but there are apologies that manage to seem genuine as well. As I write this I am reminded of the show 'The Orville's "apology tour"... I don't necessarily think an apology is needed or helpful.
Always interested in examples of corporate PR, whether negative, neutral-ish, or positive.
Edit: obviously I don't care enough(?) about the specifics of this instance... Hopefully it's also obvious that I appreciate the chance to evaluate the community's response to a favored company. Mozilla seems to be allowed quite a bit of leeway.
Interesting to me that all it takes to count as an apology to some is the words 'we're sorry'.
I hope to find similar discussion(s) where an HN user practiced his hobby of rewriting corporate apologies. Also nice to have another example where initial response can be completely tone deaf with little consequence.
All you have to do is drop the word "sorry", it doesn't matter if the apology actually addressed any of the concerns that were raised.
FB was sorry for being "unclear". Mozilla is sorry for "the confusion" and for "letting down members of [the] community".
The headlines will read "[Company] apologizes for [event that triggered criticism]" and everyone will carry on as if the apology directly addressed that event. The lawyers and shareholders will breathe a sigh of relief, and the matter will soon be forgotten.
[1] https://news.ycombinator.com/item?id=15449954
From what you've said it doesn't sound like anyone at Mozilla (specifically the Chief Marketing Officer representing the company) apologized for doing anything wrong. "letting down" comes closest for sure and may be enough for most.
swanson: My hobby: role-playing how I would respond as the CEO if my company was getting skewered on HN. Here is my version!
Also, https://news.ycombinator.com/item?id=3523763
abbasmehdi: Proper apologies have three parts: 1) What I did was wrong. 2) I’m sorry that I hurt you. 3) How do I make it better? It’s the third part that people tend to forget…. Apologize when you screw up and focus on other people, not on yourself.
(Couldn't find the exact YouTube timecode; https://teamrich.wordpress.com/2007/10/20/pausch-last-lectur... )
>anon808: The most import part of that apology formula is missing, actually meaning it. Also if the answer to #3 is obvious (ie stop doing what your apologizing for) then one shouldn't have to ask.
Which they still haven't fixed. That's still forced on everyone regardless. :(
Frankly that ship is out hunting some kind of white whale, and it is best people get out before it is too late.
Which is silly, IMO. What did this addon actually do, besides be installed without user consent? If this article is correct, the addon was installed automatically but was not 'activated'. Seems like a fuss over nothing, to me, but somebody correct me if I have the details wrong.
"Here, let me push closed source partner marketing materials on your bandwidth to you."
Directly contradictory to espoused values they trade on. Shameful.
What made you think it was closed source? The source for the add-on: https://github.com/mozilla/addon-wr
I switched from Chrome to the latest Firefox browser due to the awesome work the team has done on bringing it into the future. Then I find out that it comes pre-loaded with Pocket and this dumb ass game extension for a TV show promotion? Are you joking?! Fool me once...at least you can expect the level of integration you get within Google/Chrome.
This was completely incongruent with the ethos of Mozilla and Firefox. That is why this is a big deal. It's a huge slap in the face to those of us who choose to use this software because we know it WON'T do things like this.
You can't remove it (and disabling it is hard enough), so you cannot reduce the attack surface of your browser if you don't use it.
It's also really badly integrated into the new mobile version.
There's no need to disable it since nothing happens until you click the button. Removing the button itself is as simple as right-clicking it and clicking on the (only) available option: Remove from Address Bar.
"there's no need to remove the crapware bundled with [pick one: Android, Windows, Ubuntu] since nothing happens until you click the button. Removing the button itself is as simple as [opening the Settings, opening Control Panel, apt-get remove]." mozilla is in a seriously bad spot if it's lowering itself to the level of Acer, HP & co bundling crapware to the brim.
> It is so unlike Mozilla to introduce something like that, I ran a virus scan and checked what programs had been installed recently -- I assumed it had been put there in the same way that IE users used to get the Ask Toolbar installed.
> It says a lot about Mozilla when they decide to bundle fad features like these after spending years stripping existing features out of Firefox. During their effort to dumb-down Firefox, it was common to hear that removing those features didn't matter, as they should be provided by extensions instead. Apparently that cheap excuse is ignored when the feature when it is convenient to do so.
> Worst of all, there has been almost no communication on this. I subscribe to Planet Mozilla and read everything that seems interesting to me, and I still didn't know this was coming.
> They bundele it because they get payed for it. Same story with the new suggested site advertising. The alarming thing is that this way Mozilla is loosing it's independency.
> I didn't know I ever had to read the fine print with anything from Mozilla, and it turns out I was wrong.
(These are remarkably similar to the criticisms leveled against the current situation)
It is NOT ok to force install marketing/advertising content on somebody's conputer. Not ok, can you understand that?
It does not matter if the content is open source, who developed it or where or how it was announced.
And in this matter they HAVE to be perfect. It's not hard. Someone should sign off on features and block any silly marketing or advertising stunts. Not rocket science.
That said, I find the notion that being perfect is not hard rather ridiculous.
How arrogant. It's seem that even you struggle with being perfect...
One needs to invest significant design & development time in order to be "less than perfect" by adding tracking. Perfection would be easily within reach if corporate greed and lack of morals wouldn't be fighting it every step of the way.
Mozilla has admitted the promotion extension was a mistake and is removing it. I cannot remember the last time this sort of episode ever occurred with Firefox, it should be passable as a one-off.
If it wasn't in fact enabled, it's still dumb, but to me a misstep in respecting the user and not a complete breach of trust.
The problem is that auto-deploying marketing software (inert or not) over a channel expressly described as being a tool for development, debugging, and testing, is a breach of trust, and/or an indicator of massive process failure within the Mozilla organization.
Should be
> Which is silly, IMO. What did this addon actually do, besides break a trust and confidence that's been hard won over many years?
Which begs the question: if you had to do something to activate it anyway, why abuse the "studies" sidechannel to install something that is deactivated, when you could just as well prompt to install it when it's meant to be activated?
And here's a bug report about something it does:
https://github.com/mozilla/addon-wr/issues/39
AFAIK, you are opted-in by default - I recently had to disable it on a clean installation.
I'd dispute any characterization of LookingGlass as a FireFox feature though, and feel very strongly that using Studies to distribute marketing software (inert or not) was an entirely inappropriate use of the tool.
Mozilla being willing to use Studies (or having a process that allows for it to be used) in this way means that, although I was fine with the extra telemetry, debugging, a/b testing, etc., I cannot trust Studies to be used strictly for development related things.
1) Demonstrated that Mozilla has the ability to silently push addons without any kind of notification to the user that their browser behavior has been patched.
2) Demonstrated (allegedly) that there are privacy and security related preferences in Firefox that are reverting themselves to less-safe defaults without user interaction, aka Microsoft preferences.
3) Demonstrated Mozilla's marketing department lacks the good sense to respect these capabilities for the loaded gun they are
It's not about what they did, it's about what they could do. Mozilla doesn't need these tools, and these tools are dangerous. Why did they make them? Why shouldn't we ask Mozilla to remove them?
If you allow firefox updates they can silently push any code on to your machine, right?
This is the most critical issue, by far. Apparently nobody ran this by any reasonable person or went through any reasonable review process before shipping it.
This is nowhere near the level of naiveté that google had when they had a real name policy for some of their services that outed dissidents, LGBTQ people, and other marginalized people. Not even the same ballpark. If Mozilla really wanted to do something nefarious or bad they could have added things into the codebase directly instead of as an adjunct. I still trust Mozilla personally and I believe they are a net benefit to the internet.
Wait, did someone assume that Mozilla didn't have this ability? How did people think that they got security updates?
> 2) Demonstrated (allegedly) that there are privacy and security related preferences in Firefox that are reverting themselves to less-safe defaults without user interaction, aka Microsoft preferences.
If that's the case, it's a bug. Bugs happen. Regardless, doesn't seem happen
> 3) Demonstrated Mozilla's marketing department lacks the good sense to respect these capabilities for the loaded gun they are
Fair enough, to some extent.
> It's not about what they did, it's about what they could do. Mozilla doesn't need these tools, and these tools are dangerous. Why did they make them? Why shouldn't we ask Mozilla to remove them?
Wait, what? Why does Mozilla have tools to distribute code? Because Mozilla uses it regularly to fix issues. This has been the case since Firefox 1.0, I assume.
Why does Mozilla have tools that handles and/or updates and/or forgets preferences? Because preferences can't be handled anywhere else, since they are preferences for Mozilla tools. I haven't heard of preferences being force-changed until now, with the exception of fighting malware and switching stuff from experimental to mainstream. But, yeah, bugs happen.
Why does Mozilla have a marketing department? I assume that's not a real question.
Via an updater that pops up a little window showing you Mozilla is installing stuff, or via an apt-get/yum/whatever command. Point is, it is (and should be) visible when Mozilla is pushing code.
The difference is that in one case the updates are released following a public process, with bugzilla entries, proper review and engineering practices, while in the other case it's pushed with no oversight, secretly, by some guy in marketing. It's like Google Tab Manager in your browser. Browsers are too sensitive, too central in people's lives nowadays to allow such things.
This was the company who extolls privacy, openness, and attracts (among others) the sort of people who are uneasy at competing browsers shipped by advertising companies, or old-guard software shops pivoting into more profitable ways to leverage their installbase. This was the company who branded, then re-branded themselves as champions of a more people-conscious web. The exact company who should've known better.
Even their apology, though probably sincere, has a tinge of corporate, marketing wishwash. Maybe it's just the title, but a "We Messed Up" would've been punchier without being vulgar, instead of this bury-the-headline-style "Update on..." crap all too familiar from security vulnerabilities.
It's actively trying to be opaque. That's the opposite of transparency.
Curious adventurous people install the test build because they want to try out new features and extensions. Those are the users who are most likely to know about and use "about:config". The config option and description of the plugin are mysterious and enigmatic, which tempts your curiosity into turning it on to see what it does, because you presumably trust that Mozilla wouldn't distribute just any old extension that didn't have a purpose other than scanning and modifying the content of every web page, inserting dynamic content adjacent to keywords, and advertising a TV show.
Did it actually display an ad? I didn't see anything such on my Firefox.
It's not that it displays an ad, it's that it IS an ad.
Not only that, but it also parasitically hooks in and wastes resources (memory, cpu time, battery life) in each and every tab visiting each and every web page.
That's yet another reason it's totally inappropriate in the context of Firefox, which is trying to dig itself out of the hole of being slow and bloated.
Fair point.
> It's not that it displays an ad, it's that it IS an ad.
If it's an add, it's the most well-hidden ad in history, since you need to find both a hidden preference to turn it on and a specific and non-documented website to let it display anything.
> Not only that, but it also parasitically hooks in and wastes resources (memory, cpu time, battery life) in each and every tab visiting each and every web page.
No, it doesn't.
More importantly, it is software that has nothing to do with improving FireFox, collecting telemetry, error reports, running tests, experimental features, or anything else the Shield Studies program is ostensibly to be used for.
I agree that delivering it through Shield was not a good idea.
So well hidden, it's practically underwater.
http://www.paulgraham.com/submarine.html
Yet in spite of how well hidden it was (or rather, because of), we're now all talking about Mr. Robot, somehow. Funny how that works!
> No, it doesn't [parasitically hook in and waste resources]. [...] since you need [...] a specific and non-documented website to let it display anything
Yes it does hook into and waste resources and potentially display ads on ALL web pages.
Hover text injected into headline on Washington Post #39: https://github.com/mozilla/addon-wr/issues/39
Have you read the source code?
background.js: https://github.com/mozilla/addon-wr/blob/master/addon/backgr...
content-script.js: https://github.com/mozilla/addon-wr/blob/master/addon/conten...
The extension literally injects ads for Mr. Robot in the form of popup tooltips with links on every web page that contains certain keywords. And it also wastes memory, CPU time and battery life for web pages not containing those keywords.
How much more like parasitic adware does it have be before you can see that it walks and quacks like a duck, because its intended purpose is to advertise a television show?
https://news.ycombinator.com/item?id=15936727
>It injects a blob of CSS and some JavaScript into every tab, then it does a regular expression search of every text node on each page, filtering out everything but paragraphs, then for each occurrence of a keyword in the text, it creates a new text node to split the current text node, then inserts a new span element between them, containing its own text node, then it creates an additional tooltip element containing six text nodes, five br elements, and one anchor element linking to https://support.mozilla.org/kb/lookingglass , and it also configures css class names to associate all those new nodes it created with the blob of css styling and animations that it injected.
If you wanted to develop your own malicious adware like Superfish that injects your own ads into every web page, this code and the browser hijacking techniques it uses would be an excellent starting point.
Browser Hijacking: https://en.wikipedia.org/wiki/Browser_hijacking
Threat Introduced via Browser Extensions: https://blog.sucuri.net/2014/10/threat-introduced-via-browse...
How to find Chrome extensions that inject ads into any webpage I browse? https://superuser.com/questions/893843/how-to-find-chrome-ex...
Another example: https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...
> This experiment also includes the data collection tool Cliqz uses to build its recommendation engine. Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit.
> Cliqz uses several techniques to attempt to remove sensitive information from this browsing data before it is sent from Firefox. Cliqz does not build browsing profiles for individual users and discards the user’s IP address once the data is collected. Cliqz’s code is available for public review and a description of these techniques can be found here.
Installed without explicit consent + collecting data = spyware.
This wasn't a mistake, it was the inevitable outcome in a culture which has lost sight some time ago of its nominal core values.
House should be cleaned before trust is reearned.
I call complete and total BS on this. I may not be on the EFF echo-chamber, and I agree they handled this poorly, but this absolutely does not concern me after hearing the way th add-on behaved. They made a mistake in communications and behavior that should have been expected, but as they said, it did zero data collection and performance impact. It was a screw-up they have fixed via process.
If people are so upset at Firefox for a mostly innocuous mess-up that was quickly caled out and clarified/fixed in the future, that they would dump Firefox for the hero of privacy Chrome, they are very foolish in my opinion.
Firefox handled a mess up very well. The extension was always opt-in and never extracted any data. It came from a trusted source regardless via another layer of opt-in experiment beta testing.
Yes it wasn't cool they chose poor language and didn't fully consider the implications of installing a 'fun' experiment. But lets keep our shirts on.
Quantum has been more than rewarding and this minor PR issue is hardly deterring me from using Firefox... especially compared with Chrome being built by the biggest ad company in the world.
So yes, people will be outraged.
We're sick of being taken advantage of by dishonest companies and individuals because the US privacy laws are a complete joke.
Creating a plugin that modifies content on your screen and injects HTTP headers is egregious enough (just look at the response Comcast got for doing it), but doing it for a TV show tie-in? How did that idea even make it through one round of approvals, much less land on every Firefox user’s machine?
Users trust web browsers to deliver the exact content that was requested — that’s why we have gpg signatures, hashsums, and HTTPS. It’s arguably a core tenet of the web. IMO the reaction of the tech community can only be expected in response to such a deep violation of trust.
As you said, the real issue here is the terrible decision to push this to everyone.
After literally years of struggle with Chrome and Firefox I finally switched to Safari (recently I switched to iPhone so on mobile too) and yes for personal browsing, on a Mac, this is really better than any other browser out there and Quantum felt as good. No, I don't have benchmarking scores, but I am speaking from an end user point of view.
I was a lifetime Firefox user - started browsing on it when I bought my first laptop in 2007 and never touched anything else until Pocket happened and after testing Quantum for a few days I was so happy that the Firefox is back. I don't think so. I guess I will sit this one out. It's not an isolated incident. They have been doing it constantly since Pocket.
1: https://github.com/el1t/uBlock-Safari
Three strikes... and I'm using Safari, because this seems to be the least bad right now. Pretty lame from Mozilla.
Edit: forgot about Pocket.
Of course, I am not leaving. The CMO should be leaving!
Yeah, but since it doesn't have an entire dev team committed to it, the fork dies and/or you're using an out of date browser with all sorts of security vulnerabilities and incompatibilities. Some attempts with actual resources behind them:
Cyberfox - dead
PCXFirefox - latest merge was FF 53. Using outdated plugins (e.g. Sumatra PDF from 2014!)
Waterfox - dead
Pale Moon - Still alive. Removes a host of features (e.g. Accessibility and Parental Controls) in the name of performance, yet performs horribly in benchmarks. Slow to adopt new features.
Besides, who's going to use these? A tiny fraction of the population consisting of people reading this thread and threads like it? Who cares?
So yeah, you _could_ "just" fork FF, but it won't get you anywhere. And why the hell am I doing this? I have much better things to do with my time than maintain my own damn web browser. I am constantly amazed at comments like this which are so obtuse as to be comical.
Since when? It's last commit was 5 days ago:
https://github.com/MrAlex94/Waterfox
I never would have guessed. Browsing this thread and writing this comment in my sparkling brand new Waterfox 56.
> Pale Moon - Still alive [...] Slow to adopt new features Slow or reluctant by design. A fork from way back before FF started dismantling its UI. Many new 'features' will never be adopted by Pale Moon.
Snark is fine, but please base it on fact.
My point is that, if you (not a dev team) don't like something you (again, not a dev team) can build it from source to do exactly what you want. Firefox is OSS, most of the popular extensions are OSS. That's the whole point of the thing.
Mozilla has done a pretty good job of championing open standards, open source, user freedom, and all the stuff that people complain about on HN as if they weren't squarely first world problems. You outsource the upkeep of this incredibly complicated software to them and for the most part they do a great job. The level of vitriol about all of this just illustrates the whole "from-zero-to-death-threat" thing that has happened with everything in modern life.
I'm saying that they give you something awesome. They mainly do a pretty good job of championing some of the things that you care about. They made a mistake and they seem to understand everyone's displeasure with it. The end...or get off your ass and do something about it rather than just complaining about how the people giving you the awesome free thing hurt your fee-fee's.
Wrote this in a previous discussion: https://news.ycombinator.com/item?id=15940491
>> updates have been known to re-enable it if you turn it off ... But it doesn’t matter - you’re going to re-enable it on the next update.
> It's surprising how ... trustworthy Chrome is in this regard. My default search engine is set to DDG and through countless updates Chrome has never once attempted to reset it to Google.
Even though Chrome has every incentive to break privacy settings, even though Chrome has every incentive to revert the default search engine to Google, they don't.
So Chrome's privacy settings are already broken by default, in nearly the worst way they could be.
[0] https://www.google.com/chrome/browser/privacy/index.html, "Signed-in Chrome mode"
I did find this on their wiki: https://wiki.mozilla.org/CloudServices/Sync/FxSync/Archived/... interesting tidbit that you could host it yourself. Not sure if you still can.
I hear, it's not that easy to setup, though, as Mozilla only really needed to set it up for themselves a handful of times, probably.
According to the policy, they use this data only in anonymized and aggregated form.
That's the default, isn't it? So no, not only anonymized and in aggregate. And either way, your compylete raw browsing data is sitting there on Google's servers and associated with your account.
>> [Firefox] updates have been known to re-enable it if you turn it off ... But it doesn’t matter - you’re going to re-enable it on the next update.
You can choose to opt out of Chrome's phoning home in the privacy settings and they haven't tried to revert those settings in an update (and given their track record, I have no reason to believe they will try to surreptitiously change the settings in a future release)
With Firefox, the entire codebase has to shine, because someone will find it and hold Mozilla to a far higher standard. A bug in the update process that resets search engines is then only one of many things that they're supposed to watch out for.
https://www.youtube.com/watch?v=qMALm1VthGY
It's also disingenuous to present a false dichotomy with Chrome, as if there weren't any other privacy-focused alternatives out there:
https://www.waterfoxproject.org/
https://brave.com/
https://iridiumbrowser.de/
https://www.palemoon.org/
https://www.gnu.org/software/icecat/
Any browser is going to struggle against the top two behemoths, so I'm not sure why exactly that would be an argument to just accept it and continue using products by companies that have lost your trust. Are end users supposed to compromise their ethics just because web developers aren't in the habit of testing against their browser of choice yet? That just seems like an awfully 'silicon-valley-centric' view of the world.
What does this "success" thing have to do with ditching a product that had violated your trust anyway? Are businesses in most other industries viewed this way? Am I expected to stop buying food from local producers just because the big-box food suppliers are more ubiquitous?
To me, all that matters is sustainability, and IceCat has been going strong for 12 years, PaleMoon has been consistently developed for 8 years, and Waterfox for 6 years. So that's enough for me to at least give them a shot.
Every browser on that list is based on either Chromium or Gecko.
It's quite a disservice to Palemoon and Waterfox to include such an anti-user project as Brave.
I'm not sure what this means. Can you expand on how Eich has been dishonest in how he used his money?
Eich did everything he could to conceal that his libertarian image was a facade and in fact he was a social authoritarian.
Once it came out he was actively using his money on political campaigns designed to try and further empower and justify the state to decide what relationships between consenting adults was forbidden, he had a rather hard time being taken seriously in this area.
I'm not sure why someone who's actively and monetarily supported politicians saying homosexuals should have to register in a special registry parallel to the sex offender registry is being taken seriously in the privacy arena. Privacy is not something that can be decomposed as an asset to purchase. Every person who doesn't have it leaks information about the people they interact with, and that undermines privacy for everyone.
Did you ever support a politician (say, Obama) only to find they said something you disavowed? Sam Yagan of okcupid did. I disavow Buchanan’s unconstitutional AIDS registry, and probably other proposals he has made.
As for “social authoritarian”, California regulates and licenses marriage via family law, as do all states. I come from an older generation of allies who supported Mark Leno et al. when they labored over, passed, and amended to full positive-rights equivalence with marriage, CA’s Domestic Partner Law (https://en.m.wikipedia.org/wiki/Domestic_partnership_in_Cali...). This was considered just and sufficient, until it was not — and then anyone who questioned the revolutionary tactics used to cast former allies as haters and bigots became a hater too.
I dissent from all such revolutionary tactics and agendas. I agree with dissenting LGBTQ scholars of note on this point re marriage equality, e.g., Camille Paglia. (I don’t agree with those scholars on everything, of course. Same as with most people, including politicians I’ve supported in the past.)
Now the shoe is on the other foot. Marriage equality is law and I’m an officer of a corporation with a genuinely diverse roster of employees. I am committed to the fullest definition of inclusivity, which covers right wingers as well as left, libertarians and non-libertarians. For you to gin up a case that I pretended to be a libertarian is silly (I never pretended that).
But worse, if you judge Brave by a past and too-narrow slice of my opinions, you are doing what haters who boycott Apple because of Tim Cook do. It is your right, of course, but it looks like consequentialism (end justifies means) or really just Who/Whom ax-grinding. I hope you will use Brave in view of what we are trying to do, as a group of people who share a cause and set of beliefs, whatever our other or past causes and beliefs.
Oh, please, no, it wasn't by, well, almost anyone. Most LGBTQ advocates and allies never considered it “just and sufficient”, they (at best) considered it at best a distasteful compromise that was better than the pre-existing state and at worst a capitulation to those who wanted to give religious groups a veto over he definition of civil marriage which ignored the enduring lesson of the struggle for civil rights that separate institutions are inherently unequal nnyour and entrenched in law the othering of LGBTQ people and thir families and relationships.
The idea that there was ever a consensus, either in society or among LGBTQ advocates and allies, that the separate institution of domestic partnership was “just and sufficient” is rewriting history.
False. Mark Leno said so. http://www.sfgate.com/news/article/Gay-marriage-up-to-govern...
You may not be familiar, but in previous decades, Mark Simpson, Michel Foucault, and many other gay writers were against "gay marriage", often expliciltly arguing it was an embourgeoisement to be rejected.
Andrew Sullivan and others (with lots of documentary and eyewitness evidence) have written about how they had to move the consensus even among gay people toward marriage equality when it was far away. http://www.slate.com/articles/news_and_politics/politics/201...
I can believe Leno said that, but I am also quite aware that it was a very small minority opinion even among supporters of the legislation.
I'll also note that Leno isn't quoted as saying anything like that in the article you cite to support that Leno said it, though.
> You may not be familiar, but in previous decades, Mark Simpson, Michel Foucault, and many other gay writers were against "gay marriage", often expliciltly arguing it was an embourgeoisement to be rejected.
You are misrepresenting Foucault, who did not argue against (or for, it just simply wasn't a controversy he addressed) equality in marriage but that the limitations (irrespective of sexual preference of the partners) of socially acceptable and institutionalized relationships to only marriage and family-by-descent ought to be lifted and additional forms of relationship recognized and valorized.
Neither did Simpson come from the radical, anti-embourgeoisement, angle you suggest, instead simply buying into the (historically inaccurate) religious right story about the origin of civil marriage and the pro-state-establishment-of-religion argument of the religious right that would give the religious right veto power over the civil definition of religion. That's certainly a viewpoint that exists—and which AFAICT Simpson still holds—but it wasn't a dominant one among LGBTQ activists and allies anytime in the 1999-2011 history of the establishment and expansion of California's Domestic Partnership system. Not even when aggregated with people who did take the radical position you identify, even though neither Simpson nor Foucault are among them.
> Andrew Sullivan and others (with lots of documentary and eyewitness evidence) have written about how they had to move the consensus even among gay people toward marriage equality when it was far away.
I'm not sure why you are pointing to an Slate article that is simply a reprint of one of Sullivan's 1989 articles laying out a conservative case for gay marriage to support your contention that Sullivan and others still had to move the consensus of LGBTQ advocates and allies to support marriage sometime after the time in 2011 when California harmonized domestic partnership with marriage so that the two arguably differed in name only.
Sullivan was certainly important in moving the needle in terms of what people thought was reasonable to set as a near term goal and how they sought to sell it (whether he really shifted the ground on the long-term goal, or just made it seem less quixotic and pie-in-the-sky might be a debate), but he did that well before the time you are referencing.
You spin a fine tale, but it seems to be entirely historical revisionism backed with red herring links and name dropping.
As for Simpson, others should read him and decide for themselves: https://www.theguardian.com/commentisfree/2008/dec/02/propos... (among other pieces)
Pretending marriage equality was always on deck when Leno et al. were working on domestic partnership is the spin here. Either the advocates of the previous decade's reform were not telling the truth (and Obama was strategically lying when he too endorsed civil unions but rejected marriage equality), or they meant what they said at the time. You can't have it both ways.
Again the revolutionary (full Alinsky) playbook is evident: down the memory hole with the past; lie (to self and others, doesn't matter) about goals, promising no further; then go further the minute you get it and isolate and demonize anyone who objects. No thanks.
I'm not sure what you mean by “on deck”. If you mean tactically attainable, yes, there was a wide view even among advocates and allies that it was not. DP was a tactical advance, on that there was broad consensus (though, ironically, the anti-embourgeoisement radicals you point to support this weren't part of it, as they generally viewed marriage as an archaic social institution not to be sought or imitated, but to be eliminated.)
But your claim wasn't about what was viewed as politically pragmatic, but about DP status being seen by advocates and allies generally as “just and sufficient”, rather than unjust and insufficient because it was separate, but at least better than the status quo ante because it was—to the extent possible for the state alone—formally equal.
> and Obama was strategically lying when he too endorsed civil unions but rejected marriage equality
Disagreeing with a movements aspirations isn't a lie. Now, whether Obama was a secret supporter tactically lying to placate opponents, a moderate opponent of the goals of the movement telling the truth, or a stronger opponent telling tscticsl lies to get support of the movement while not alienating it's opponents is...well, completely irrelevant to whether the movement itself saw civil unions as “jist and sufficient” rather than merely a lesser injustice than the status quo ante.
> Either the advocates of the previous decade's reform were not telling the truth [...] or they meant what they said at the time.
You are conflating LGBTQ advocates with the politicians who were (or, in Obama's case, were not) involved in reforms. Those may be overlapping groups, but they aren't the same groups.
Now, if all you meant to say was that you identified with the narrow, political establishment group that endorsed civil unions as the end goal rather than the mainstream of LGBTQ advocates and allies at the time who openly called for marriage equality as the goal but accepted formally equal unions as a tactical advance, that's defensible. But it's not at all defensible to claim that the movement saw civil unions as “just and sufficient”, that was overtly never the case, whatever a handful of politicians trying to balance between the movement and conflicting groups might have said (and, who knows, might have even believed it when they said it.)
Perhaps it has been lost to the sands of time, but it seems curious that this didn't come up as a publicly stated defense while the Mozilla board was contemplating what to do with their total PR disaster out of a corporate office.
If you've changed your mind, or have reasons, or whatever? Great. But trying to suggest that in fact you were a better advocate and steward of LGBT rights while (perhaps unintentionally, perhaps deliberately) suggesting everyone else was wrong in what they wanted? No.
You could also just say, "I have changed my mind" or "I have decided this issue is less important to me now" or even maybe, "I thought I was doing the right thing, but in hindsight I chose a bad strategy." A million other phrases that own your actions and don't project onto others.
I suggested no such thing. I said explicitly I was sticking to a previous bargain. Hate on that if you must, but don’t put words in my mouth.
At this point you have misread so many declarative statements I’ve made here that I am going to let you have the last word, if you like. But no, I never suggested that. It seems to me you are engaging in faulty logic to cast what I wrote in an either/or. Stopping here.
Then I read about BAT. Your business plan soured me.
I'm very sorry that I missed ended your politics Brendan. Sincerely. O obviously misinterpreted what you said. But that changes very little, and I've already spoke at length about what it doesn't change elsewhere in this thread.
This technical interview with Eich was extremely illuminating and I'd urge you to watch it, particularly the second half: https://www.youtube.com/watch?v=MUtHhYes6-A
The current ad-tech ecosystem is a complete disaster, and Eich's vision for replacing it is, I think, genius.
Leverage properties of cryptography to build a browsing experience which respects privacy but retains opt-in ad relevance and anonymous metrics, and further leverage developments in cryptoeconomics to balance the requirements of user <-> publisher <-> advertiser in a properly-designed content generation and consumption ecosystem.
I find the whole idea elegant, ambitious and pragmatic.
What specifically do you find anti-user about Brave?
Eich's SALE of positioning his company as a gateway to all online advertising while spinning this as "pro-privacy" is indeed genius.
His actual vision of the product and the positioning of Brave as a controlling arbiter over all ads (and thus, as a central collection and monitoring point for data around ad consumption) is quite dystopian.
Nothing about logging our ad views to a publicly inspectable blockchain is in the interests of privacy. All it does is offer Eich's company an opportunity to make yet another skeezy ad platform with a new series of buzzwords. It will not be more difficult to game than any other browser, but it will sound impressive and current and gain ad buys.
And I submit that the inevitability of the ad network is itself a questionable notion when a more direct service economy is not only historically how things were done. That model faded as broadcast technology outpaced other IT, but as other IT caught up we've been seeing a return to direct-to-customer service models and these are outperforming ad models in some media markets.
It is not inherently a "blockchain" idea to sell off your time as ads in order to pay for your browser, and other folks are at least pretending to align their business model with user interests while building an information and attention economy (e.g., Steem)
Apollo phase of the roadmap will have multiple clients supporting BAT, with as much endpoint (client and site/creator/user, hard KYC issues here due to centralized fiat currencies and governments) logic moved on chain as we can given future Ethereum scaling and anonymity support. Web standards for particular innovations as apps join the platform and gain enough scale.
This move is a complete slap-to-the-face for everything that Mozilla and Firefox supposedly stands for, and would be heartbreaking for the developers to hear that this is going on in the wake of all the work around "Quantum" and everything else they've won with recently.
But really, this Mr Robot news went no further than an article on The Verge (I presume it even got there?). More importantly, those that care are able to think critically of the situation and don't really have anywhere better to go.
> I call complete and total BS on this.
Well it's the truth. Use "Google News" and search for Firefox. You will see much more news sites write about the fiasco last weekend then about a faster Firefox.
And guess what, rather rude comments came from employee trying to clean up by voting down comments hours too late. It's time to fire the responsible marketing manager/exec. Mozilla is setup as a non-profit org but acts like a unicorn startup, playing rich and flying in all employees every 6 months, that also happened on that very day, so the corporate drones couldn't response and clean up the outcry in time.
In a universe where no one is ever wrong about facts, sure.
I am now using Safari and have to keep an eye on the family computer to see what crap Mozilla decides to install next.
The nice thing about ethical organisations is that you can have peace of mind and don't have to worry about how they're going to screw you when their marketing department runs amok. Because of cliqz, the annoying telemetry (aka spyware) and this incident, I don't trust Mozilla any more.
Moving to Chrome would indeed be silly, bit it doesn't mean things are rosy.
It definitely sucks, but I don't see how it was anti-privacy at all. The extension didn't transmit data anywhere, it just modified web pages.
That's Mozilla taking another step down a very slippery slope. "It didn't hurt anyone" doesn't excuse ethical or moral wrongs. Given Mozilla's stated commitments to privacy and integrity, their choice here violated them.
It definitely increased the attack surface area[1] with no upside for 99.9%[2] of Firefox users.
1. It's a juicy target: an addon that can modify the content of any page a user visits? It doesn't take much of an imagination to think of how this could be subverted.
2. My conservertive guess of the fraction of Fx users not interested in Mr Robot easter eggs; I probably ought to add a couple more "9"s
Albeit I'm more of a backend guy so debugging in chrome/firefox isn't my forte, but I can usually gather enough data from dev tools to fix things.
It's a sad day when I now have more trust in Apple and Safari than I do in Mozilla and Firefox.
We must forgive them and stop being so negative. They've made their apology. If _this specific_ thing happens again then I'll join you with some pitch forks.
To be so negative and full of hate isn't healthy for anyone.
In the context of the last big "good guys" entity in a sector where technical understanding is key, this might make it even worse. User trust is the single thing the browser ecosystem boils down to.
I don't think you're accurate in identifying hate as the catalyst for this issue -- I'd go with concern. And seeing one's concerns handled with such thoughtlessness does foster negativity.
We care because we know FF is the best mainstream pick when it comes to privacy and user rights, and seeing Mozilla go down that route reminds us that we're very easily screwed.
Also, hadn't they already learned the lesson with Pocket?
What lesson they learn from this remains to be seen, based on what steps they take to prevent this happening again. The fact that any "lessons learned" from the Pocket debacle weren't enough to prevent this (IMO even more egregious) case doesn't speak very well to Mozilla managements ability to learn from their mistakes.
I hold Mozilla to a very high standard compared to pretty much any other tech organization, I care deeply about FireFox, Rust, Servo and the technical work Mozilla does, but they need to be held to account when they take actions that violate our shared values.
This line is just absolutely crazy by itself when you think about it.
Why does a browser team have any kind of relationship at all with some TV show? What is going on?
Their "an unpaid collaboration" phrase is an attempt to spin it as if there wasn't.
Doesn't seem like honest wording in their apology then. :(
Sometimes places say "we weren't paid anything" in an attempt to pretend it was out of the goodness of their hearts (or similar)... when in fact they were receiving benefits of some other kind. Just not directly money.
Note - Corruption often seems to work like this too, as "payment in services" (eg kickbacks, etc) instead of money can be harder to track.
So, when places say they did something and didn't get paid for it... I also (personally) find it's best to double check if they received services/benefits instead which they'd not mentioning. Just in case.
It seems like that's what's happening here too.
I mean, I already don't trust them with my privacy anymore. Clearly I need to re-evaluate their actual actions in Net Neutrality after this action.
But actually I realised that I do think there is something wrong with pop culture references. They’re inside jokes. They exclude people who don’t watch the same things as you. They reinforce the tech bubble and frustrate people who don’t understand.
I read a comment by someone who’s lecturer was confusing them by talking about the master theorem as the doctor theorem because he liked Doctor Who! The poor guy was embarrassed because he didn’t get it.
They’re also just dull! Wow you watch that same TV show as me? Wow incredible. How wacky are we.
This "extension" would be actively modifying pages based on triggers, behavior more akin to malware.
The obvious problems with how the extension was distributed and described aside, I think Mozilla still deserves to be paid for developing and especially distributing such advertisements, because it has cost them time, resources and reputation.
Pre-installing a plug-in in the development build is a service that many people would pay for -- please install my bitcoin mining extension (and don't forget to enable its configuration flag "extensions.pug.lookingglass.super.awesome.download.accelerator"), it needs a lot of testing!
How much does Google (or whoever) pay to be the default search engine, and how much is automatically installing an extension in the test build worth?
If the Mr. Robot show is sincerely activist, they should be happy to pay Mozilla what it's worth for Mr. Robot to benefit from such special treatment. Especially if it was their idea to distribute and describe it the problematic way it was. At least Mr. Robot could barter in kind, by doing an episode all about the virtues of Mozilla, with a flashing download link at the bottom of the screen? ;)
I do agree that pushing this extension to everyone is a horrible idea though.
What? I must admit that I haven't watched the third season yet, but the aftermath of the "revolution" shown in the second is a perfect rebuttal to the idiotic anti-capitalist ideals of the main heroes. When I started watching, I was afraid that it would turn into a typical "occupy something" propaganda, but it turned out much more intelligent and thoroughly implemented jab at it's own characters.
I'm almost more annoyed it was unpaid, and they integrated a gimmick for a television show into the browser to be 'engaging' to users. That leads me to believe they're really out of touch with their core audience.
The addon seems harmless, too, but sends the opposite message and I don't understand why their marketing and security teams didn't sit down to discuss this and immediately come to the conclusion that it's a horrible idea.
This is basically Microsoft using Windows Update to install a desktop icon promoting the latest season of The Voice.
https://wiki.mozilla.org/Firefox/Shield/Shield_Studies
Mozilla have said that this test was meant to be invisible, so whilst this is an accurate analogy of the end result, it's also an accidental one.
Asphalt 8, Candy Crush, Keeper (also, see this[0]).
These are the three[1] apps that I had to remove from a laptop purchased last month. They weren't a part of the OEM install, they came with the updates after the system was up and running. Bad example.
[0] https://betanews.com/2017/12/17/windows-10-keeper-vulnerabil...
[1] I think there was one more, but I can't remember its name.
What about enterprise installs, where IT must have control over what gets installed on the company's computers..?
A browser should just be a tool which answers to the user. I want my browser to be like a pair of pliers or a bicycle, neither of which have relationships with television shows. I think Iceweasel was essentially this, until the Debian project abandoned the effort.
We want our browsers to work. Without telemetry, they simply won't be able to find and solve bugs and crashes effectively.
Without crash reporting and other basic telemetry, it's basically impossible to know how prevalent certain bugs and configurations... which is of the utmost important for making a browser which actually works.
Users can be prompted to report bugs with some facility to provide telemetry (e.g. after a crash), but the browser must ask permission first.
On-by-default telemetry is tantamount to malware exfiltrating information about your computing activity to a third party.
Not "e.g. after a crash", "only after a crash". That's about the only kind of telemetry you can get on a "prompt on each occurrence" basis like that. Just monitoring crashes is not nearly enough to create a competitive browser. Performance bugs, many of which are specific to older systems mostly used by people who can't be expected to file bugs in Bugzilla, cannot be reliably caught without some kind of telemetry.
"Firefox tracks users with Google Analytics in the add-on settings" | https://news.ycombinator.com/item?id=14753546
kannanvijayan: we can't build a better browser without good information on how it's behaving in the wild
"Studying how Firefox can collect additional data in a privacy-preserving way" | https://news.ycombinator.com/item?id=15071492
potch: negotiated a special contract with Google to only collect a subset of data and that that data is only used for statistical purposes
My intention was to warn that Mozilla's use of the term 'Telemetry' as a feature does not cover all of their data collection, and to point to official examples demonstrating the mindset of the Mozilla developers for a higher-level perspective. As you have repeated, the one (primary) aspect of of Firefox's data collection that you mentioned (dubbed Telemetry, which I initially confused in context of OP's comment as intending to include all data collection) is documented on your link as opt-in. Props for that, but there are other aspects. (I am also going to verify it must indeed be enabled manually during a default install.)
Per OP: The last thing I want is my browser to 'phone home' when it feels like it.
I may be wrong, but my understading is that "Google Analytics in the add-on settings" has been improved only to _opt-out_ rather than being required in the past.
Also, per their website SHIELD Studies seem to have a global opt-in followed by a per-study opt-in/out setting. Unfortunately the wording seems a bit wishy-washy and there are anecdotes on this discussion claiming this specific "study"/marketing opportunity did install and run something (at the very least: to skip enabling itself) without purposeful opt-in. There is a lot of confusion here. https://support.mozilla.org/en-US/kb/shield
https://news.ycombinator.com/item?id=15956568
>Manishearth: What was enabled was a small piece of code[1] that would enable the full addon when a pref was flipped
(Note: the Github link 404's since the add-on has been updated after this story broke.)
https://news.ycombinator.com/item?id=15958466
>tosssh: Shield Studies are opt-out by default
I just went to getfirefox.com, ran the download, and this URL was displayed within tab 2 next to the 'Welcome to Firefox' tab (unfortunately I didn't record which tab was given initial focus) when Firefox started for the first time:
https://www.mozilla.org/en-US/privacy/firefox/#firefox-by-de...
Effective September 28, 2017 [...] Firefox by default shares [...] Interaction data [...] Technical data
Since the page you linked was "Last edited 3 years ago" I'm going to specifically contradict what you re-emphasized as fact by stating: telemetry, the feature, has been changed to currently (Sep 2017-present [as of Dec 2017]) be _opt-out_, unless the development of ancient feature capital-T Telemetry somehow still exists separately from contemporary lowercase-t telemetry (per this link also referencing the telemetry documentation).
This conversation/investigation/out-of-date documentation reinforces what I see as a very recent trend where Mozilla/Firefox is heading in the wrong direction, basically spending/burning the political capital/trust they've earned while (perhaps unintentionally) deceiving even their most technically adept defenders. I would love to investigate how this approach took root; how it was finally given the official green light; and how its ongoing escalation has affected rank-and-file Mozilla developers, supporters, and the various categories of users. In my opinion, the "spirit of Mozilla" is changing ever so slightly (eerily similar to Google's pro-marketing turn away from "don't be evil" culminating in merging of all collected data). My biggest beef with this is that Mozilla has pushed its public branding further laying claim to protecting privacy, but this could be tempered somewhat with a comparison to Signal's inclination toward practicality rather than perfection.
I would be interested to hear how you feel after doubling down on this, since it appears to have indeed changed from opt-out to opt-in without your knowledge. Further, if you did not originally opt-in on install long ago I would be curious to hear what the current value of the setting is now. (Was a previous non-opt-in "default" updated to the new non-opt-out "default" at any point? I hope not!) It goes without saying that you should feel no obligation to invest the time to respond, especially to these last unnecessarily detailed and specific interests.
Mozilla is what's important, not Firefox. And Mozilla needs to be fixed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1423003
And no updates on the public bug, and it was summarily closed:
https://bugzilla.mozilla.org/show_bug.cgi?id=1424977
That hardly inspires confidence on transparency.
I believe that at this point, opening up this bug would do exclusively harm and no good to anyone. There's nothing I can imagine in the bug to be of value to our understanding of the situation. If the people working on it were oblivious to what they are doing, then it would just look plain stupid from hindsight 20/20. If the people working on it were aware and hoped that no one will raise a fuss, then it'll look even worse for them.
The important fact is that Mozilla reacted, and that the leadership does have access to this bug. Whoever was involved is probably currently involved in debriefing what has happened there and that bug is part of it.
I hope it'll be open at some point, but I'd hate if access to the bug resulted in a witch hunt and public shaming of that person/people which, as we all know, the Internet is great at.
We know that our leadership reacted and we know that they recognize what has happened. I'm not asking you to trust them, obviously that has to be regained and the process is painfully slow, but I do ask you to give them time. The emotional reaction is short-termed. I hope that this incident will have a long term positive consequences to our project.
My issue is that the public bug was closed off early. In future, perhaps the Mozilla team might take it into account that communication might be smoother if they keep things more transparent.
I'm a massive fan of Mozilla. In fact, I'm trying to get more folks in my org to use it instead of Chrome (it's a hell of a lot more stable, and the Chrome team tends to break our web apps frequently). I largely trust Mozilla far more than the Google team, and this unfortunate episode, for me at least, just made me mad because it was such a major cock-up that it was entirely unexpected.
I'd appreciate it if you'd (re-)read https://news.ycombinator.com/newsguidelines.html and take the spirit of this site more to heart. Also https://news.ycombinator.com/newswelcome.html.
p.s. Your comment without the first sentence would be fine.
There's all the talk that Mozilla violated peoples privacy, and they're not wrong, but the larger loss, I think, is all the technical people who will turn off Shield and never come back to using it.
"..Firefox has enjoyed a growing relationship with the Mr. Robot television show.."
That seems to have been the point of running an ARG tying Firefox to the show. Get viewers to use Firefox to "play".
I suppose Looking Glass is progress....
Even worse if this wasn't a google-like revenue deal.
It is unclear if Mozilla is paying them or if this is an unpaid thing in both directions.
I mean, I'm just a cybersecurity guy and a software engineer. I'm no PR person. But it doesn't take a PR expert to know that the world would eventually find out about an addon getting installed without permission and it would be a disaster.
Totally could have happened that way, totally missed something crucial at every single step that came back to bite them.
Note that the description of the Looking Glass addon was "MY REALITY IS JUST DIFFERENT THAN YOURS."
Note also that I have never activated such add-on.
Now, If I go to about:studies (for those not familiar with SHIELD studies https://support.mozilla.org/en-US/kb/shield) I see the following 'study':
pug-experience Complete • My reality is different than yours
So, there was a Mozilla study, with almost the shame shady description, which DID run by default, at least for some users.
Are the Looking Glass add-on and this SHIELD study completely unrelated? Why do they share the same description? Why is Mozilla using these shady descriptions in the first place?
Probably I am just being paranoid, but Mozilla has done nothing to gain my trust, lately.
The addon is the shield study. Shield is the mechanism for deploying addons (usually A/B tests) to release populations.
What was enabled was a small piece of code[1] that would enable the full addon when a pref was flipped.
[1]: https://github.com/mozilla/addon-wr/blob/master/addon/bootst...
It's roughly on par with Apple pissing all over the designers and animators and movie makers that were their lifeblood in the pre-Ipod days. Only in Mozilla's case they don't have an Ipod.
As such, all it takes apparently is a corporate drone to push hard enough and poof go the customer rights.
Food for thought regarding your outrage comment: one does not protect their rights by bending over every time they are taken advantage of.
This particular incident shows either massive process failure (allowing marketing to auto-deploy code without sufficient review), or that no one in the review process recognized the issues with using development and debugging tools to push marketing software.
Either version is (yet another) blow to the trust I want to have in an organization that I still care very deeply about.
For someone who has stood by Mozilla over the last decade or so and who never switched to Chrome you can't begin to imagine how pissed off I am. User trust is earned bit-by-bit, you can lose it all in a day. Ask Lenovo how that sort of thing works.
https://www.mozilla.org/en-US/firefox/organizations/
That's one thing the Firefox ESR is designed to mitigate. If sequential automatic upgrades weren't quite up your alley, this might have been the right solution for you at the time.
I've gone so far now as to drop any mozilla.org domains through DNS hacks to make sure this never ever happens again, because after I downgraded it the first time it happily immediately updated back to 57 in spite of having all auto-update settings switched to off.
Back to 52.5 it is for me. No more tricks like that. Which is sad because if there is a critical security vulnerability in this browser I'm likely not going to notice immediately.
They also had to do it at some point, XUL was a dead-end.
That's what it's for in the first place.
I'm sorry you had this experience.
> (...) where I fairly critically depended on an extension that suddenly stopped working (...)
We communicated about the old addons deprecation for over a year. I'm sorry the news didn't reach you, but we tried. If it didn't reach to you in time for a year, I doubt we could have done anything more to not make it sudden for you.
> User trust is earned bit-by-bit, you can lose it all in a day.
I know. You can imagine how I feel I hope.
Did you file a bug? I don't understand how your ESR channel could update you to 57 as it's still on 52!
So there is really something weird going on there. But it's end of the year and I have a ton of work to do not related to debugging browser issues so it will have to wait until I have some spare time.
But thank you for caring, it really means a lot to me.
Oh, btw: backwards compatibility is a thing that most users appreciate.
This is the channel that stays on ESR - https://launchpad.net/~jonathonf/+archive/ubuntu/firefox-esr
Hope it'll work for you and I apologize for the incident!
https://download.mozilla.org/?product=firefox-esr-latest-ssl...
That went into a separate directory (~/ff/) with a symlink from /usr/bin/firefox to /myhome/ff/firefox/firefox
After that I locked down all access to mozilla domains to make sure it would not do anything funny again.
I'm not sure where that 'channel' link you put there lives, I assume that's one of the about:config settings?
Possibly it somehow managed to use the settings from the original browser installed with Ubuntu rather than the ones that it came with. That would at least explain the weird upgrade behavior.
edit: located the 'channel' setting it's app.update.channel and it is set to simply 'esr'. But I have no idea what it was in the past, this is a completely fresh installation in my homedir.
Thank you for all your time, I have to go to sleep now.
It sounds like jacquesm's hit that point, unfortunately at a time critical spot. Probably won't happen twice though. :)
Thinking about this a bit more, it almost sounds like the Ubuntu supplied Firefox (in the base system) was updated to v57, and likely overwrote the /usr/bin/firefox link.
If that's the case, then the manually downloaded v52 ESR is probably still in /myhome/ff/firefox/firefox.
jacquesm, when you have time to check... see if you can launch the version in /myhome/ff/firefox/firefox directly (instead of using the /usr/bin/firefox link). It'd be interesting to see which version is in there. :)
- install Ubuntu - remove OS supplied Firefox package - install Firefox ESR - have a 'surprise upgrade' - re-install Firefox ESR - have another 'surprise upgrade' - install Firefox ESR in my homedir - symlink it from /usr/bin
So now if it pulls any other tricks I can restore the symlink and call it a day, but for now it looks as if that last move did the trick because since I did that (and dropped all FF domains in through /etc/hosts) it has not done any more upgrades, though there is a chance that it attempted to do that.
The one saving grace in the whole story is that at least the plug-ins that got forcibly removed/disabled had their data survive the whole ordeal.
So much for those plugins which can't be ported because the required WebExtensions API doesn't exist.
Not very pleased about that.
It should have been a new-window snippet. Depending on users to read blogs is living by hope. They should have put the news in their faces, unavoidably.
They should absolutely not be running any sort of user studies on people who may not be aware it is being done, which is going to be the case with the current setup. The only way it sits right in my mind is if user studies are opt-in instead of opt out.
This is especially ridiculous as their marketing is focused on respecting privacy. An apology is nice, but changing this setting would go a long way towards proving that.
At least from a quick search, I could not find good documentation what studies do exactly to avoid or properly handle personal data, it's possible that they do a very good job of that. (Suggestion to Mozilla: talk about these details at least after the study is done, show what you found. Hopefully: More tech-content to publish, less questions, less ugly surprises)
https://github.com/mozilla/normandy/issues/741
https://bugzilla.mozilla.org/show_bug.cgi?id=1370801
https://bugzilla.mozilla.org/show_bug.cgi?id=1370799
+ "description": "MY REALITY IS JUST DIFFERENT THAN YOURS.\n\nLooking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience. Are you a fan of Mr. Robot? If so, join the hunt for answers!\n\nParticipating in this shared world experience requires explicit user opt in. If you are not actively participating in the ARG (Augmented Reality Game) no modifications will be made to Firefox.\n\nhttps://support.mozilla.org/kb/lookingglass",
Sigh. Again [2], it's definitely not an "Augmented Reality Game". And it hardly qualifies as an "Alternate Reality Game", which is defined as "intense player involvement with a story that takes place in real time and evolves according to players' responses". [3] How does this extension affect the evolution of the TV show's plot? If there's not interactivity and feedback, it's Alternative Reality Static Content (aka Alternative Facts), not a game.
For what it's worth, we developed a TV show with Current TV called "Bar Karma" [4..7] along with a web site and mobile app, enabling viewers to collaboratively write, discuss and vote on the scripts of each episode. But as far as I can tell, that's not the point of this extension.
[1] Fixed Firefox spelling and URL master: https://github.com/mozilla/addon-wr/commit/fdd61682e5b8ef778...
[2] Not AR: https://news.ycombinator.com/item?id=15936727
[3] Alternate reality game: https://en.wikipedia.org/wiki/Alternate_reality_game
[4] Will Wright's Current TV show shooting pilot this week: https://www.engadget.com/2010/08/20/will-wright-current-tv-s...
[5] https://en.wikipedia.org/wiki/Bar_Karma
[6] Bar Karma | Trailer: https://www.youtube.com/watch?v=JIlTVoedDXY
[7] Will Wright Talks Bar Karma: https://www.youtube.com/watch?v=5tsWTb9RHSQ