Wow. So Mozilla lets advertisers push extensions to your browser? Is that right or am I misunderstanding something?

It seems to be developed by Mozilla employees, which is less terrible than allowing actual third-party addons, and it's disabled by default, but still - pretty distasteful.

> So Mozilla lets advertisers push extensions to your browser?

Of course not.

Mozilla can install extensions if you have "shield studies" enabled. They use extensions it to run UI studies and things like that. I think you have to opt-in to each study individually if you want to be part of it. Enabling the studies in your settings only means "notify me when there's a new study I can participate in".

See https://support.mozilla.org/en-US/kb/shield and https://wiki.mozilla.org/Firefox/Shield/Shield_Studies

Now they have partnered with Mr Robot to use the same feature to offer some sort of "Alternate Reality Game".

That sounds like "no they haven't pushed an unsolicited advert at all ... except to people who offered to be in a development program, who they've pushed an unsolicited advert to" ...

I was talking about advertisers running code in your browser. I think you have to opt-in to participate in one of the studies, so that's not happening without your consent.

It looks like Firefox auto-installs the studies though if you've enabled the feature. But it only activates the individual extensions for the studies once you've opted in to participate.

The extensions themselves need to be approved by a bunch of people at mozilla (at least for the normal studies). So I guess nothing bad can happen until you click "participate" or whatever they call it.

Still, I would also consider the notification itself to be an ad. This was obviously a bad idea and I don't want anyone to think I'm defending it. I guess they've chosen to abuse their shield studies for this because it's the only way for them to send notifications to the browser, but that's no excuse. I have the studies disabled anyway but now I'm not even going to consider ever turning them on.

I never knowingly opted in to anything and found both the "Studies" section and the "pug-experience" study turned on just now in about:studies. I don't know if it really is meant to be opt-in, but it certainly didn't seem like they've done it correctly.

The wiki page says that no changes are made until you opt in. Can you tell if you're part of the game? (I assume you'd be able to tell somehow)

I did not recall agreeing to opt-in for the studies and there it is under Privacy & Security as checked.

I have the pug experience study active and I don't recall the browser asking about it.

From the studies about page linked from about:studies...

"When a study is available, you will automatically be enrolled if you meet the criteria. There will be occasions where we might prompt you for participation first."

Just saw also that if you opt-in for the "Allow Firefox Developer Edition to send technical and interaction data to Mozilla" then it automatically checks the studies checkbox for you. I would wonder if I checked the allow sharing at some point in the past, or during installation, with no mention of the studies option. So it was presumed to opt me into the studies automatically.

It is also active for me, and there is zero chance id ever opt into this garbage.

Most shield studies are opt-out: https://www.jeffersonscher.com/sumo/shield.php (filter by "extensions").

But it appears from the link thread that there was no individual opt-in to this particular study, done for what appears to be the purposes of advertising. Clearly it's not as bad as what I first thought it to be, but still sounds fishy.

From the page:

> No changes will be made to Firefox unless you have opted in to this Alternate Reality Game.

Also, from the same page for those that appreciate irony:

> One of the 10 guiding principles of Mozilla's mission is that individuals' security and privacy on the internet are fundamental and must not be treated as optional. The more people know about what information they are sharing online, the more they can protect their privacy.

> No changes will be made to Firefox unless you have opted in to this Alternate Reality Game.

That can't possibly be true. I had it installed, and I'm on my work machine using Firefox Developer Edition. I didn't opt in to any ARG.

I think what they mean is that the addon doesn't do anything unless you opt-in. Still, why install it at all?

The installation of the add-on is unquestionably a change to Firefox. Whether the add-on does anything is largely immaterial.

Really poor choice of words here from mozilla. "The changes that already happened will not make changes to your firefox unless you enable them to", in other words the changes already happened and are just waiting to be activated.

It's installed, but apparently doesn't do anything if you don't have "studies" enabled.

Something was installed on my system without my permission, from a vendor that I chose specifically because they promise not to do things like that.

To put it another way - if I discovered a rootkit sitting in the ~/Downloads directory on my Mac, that would be a problem. If the entity that surreptitiously placed it there said that I shouldn't worry about it because it hadn't been run, I wouldn't be inclined to trust them.

That lack of permissions make this illegal IMO. CFAA in USA and CMA in UK both make unauthorised access and unauthorised modification of a computer a crime.

I've used FF since before it was FF, and I've installeded it on umpteen other people's computers; strongly advocating for it. Since they sacked that guy for not conforming to a specific liberal ideology they seem to have gone batshit crazy ... what happened? Was he their main privacy advocate or something?

Hahaha. You gave them permission when you agreed to their TOS. But you didn't read it, did you?

ToS terms that aren’t either expected by the user, or explained in plain text without having to click through anything, are considered null and void in the EU.

By that definition, this would be unallowed modification of the computer of the user, and fall under the various hacking acts.

The more interesting thing is that this has also been rolled out to german government computers, which mostly used to use Firefox, but due to previous troubles with CliqZ and the Google Analytics in the addon menus, have already moved on to other browsers.

>ToS terms that aren’t either expected by the user, or explained in plain text without having to click through anything, are considered null and void in the EU.

You mean like the TOS and EULA you agree to when you install the browser? That would qualify as "expected by the user" and "explained in plain text" both.

Correct, those ToS and EULA are considered invalid, if they contain unexpected agreements, such as "your firstborn belongs to us", or "we can install whatever software we want on your system".

Except they didn't install whatever software they want. They said they can install software to check metrics and more. Which is what this is.

"and more" == "whatever"

Check metrics !== advertise a game.

Installing extensions is not "No changes will be made to Firefox".

> No changes will be made to Firefox unless you have opted in to this Alternate Reality Game.

How does it not occur to them that this is a clear lie?

Because the previous ads for Pocket and Telefonica were effective and they don't care?

I hardly think it's a lie. My browser contains no trace of anything related to Looking Glass, even though I'm opted into Shield Studies. It seems to affect some people but not others. Definitely something that should be fixed in the core mechanism of how these things are downloaded by your browser if there are cases where it can happen without user intervention, but it doesn't seem to be intentional to download extensions without the user's consent.

It's absolutely a lie.

Mozilla has injected malicious-looking advertisement executable software into my process without my permission and then lied about it. I have no idea what this software is, what it does, or whether it is proprietary or free. I opted into nothing.

This is a huge, huge mistake by Mozilla.

The ads during the show are super cringey. It's not as bad as the Alexa product placement, but still

Seems kind of like it is part of an ARG. I can't say I'm totally against something like that; Mozilla's gotta make money somehow, and as long as it's not selling out user privacy it's a better tradeoff than Chrome.

You think having advertisers change text on unrelated websites you visit is an acceptable tradeoff?

> Mozilla's gotta make money somehow

Actually they do not. their revenue is at an all time high despite the market share reaching an all time low.

https://www.cnet.com/news/mozilla-revenue-jump-fuels-its-fir... https://www.computerworld.com/article/3240008/web-browsers/m... https://www.ghacks.net/2017/12/02/mozillas-revenue-increased...

Not to mention the great amount of money they've wasted in certain previous frivolous, doomed projects, like Firefox OS - great idea, by the way, to make your "native" app platform the most power hungry, slowest of them all, and then market the OS only for pairing it with low end devices sold to third worlders - because third worlders totally need slow software running on the hardware they can barely afford - it's not as if they were people, with real world needs, just like us, and not lab rats. For a company that prides itself on its open values.. that's really treating people with contempt.

However they're experimenting with selling user privacy to 3rd party companies, with small percentage of users in Germany (it's enabled by default).

Come on! their business model has been exactly that since they created the corporation to stop illegally collect money from google.

The whole partnership with google to put its search engine as default is about enabling google to profile firefox users and shows them ads.

> Mozilla's gotta make money somehow

They're a nonprofit; they're not allowed to just "make money". And, they already take donations.

I think the the term “non-profit” is more about how an organization spends the money, rather than how they make it. Non profits and charities definitely bring in money through channels other than donations...

I agree.

I merely challenge the notion that a nonprofit -- which proudly tumpets its benevolence and non-profitness -- should get a free pass for covertly installing advertising arrangements, just because they need to "make money".

Their charter and marketing is all about defending the internet from the companies doing shady things to make money, so they can't have their cake and eat it.

There is a difference between a non-profit and a non-for-profit (most health insurance companies are the later; go try and figure that out).

Firefox gets most of its donations from corporate sponsors. That's why the default search and switched back and fourth between Yahoo and Google; it's all about the amount of money they contribute for that. I'm not sure, but Pocket might be another example.

User contributions are actually pretty low. They don't go out and request them though like NPR or Wikipedia.

You're confusing mozilla foundation and mozilla corporation here. The default search with google and yahoo is not donations for the foundation but a commercial contract with the corporation.

I'm not sure mozilla even gets a significant amount of donations compared to their commercial contracts.

Mozilla bought Pocket a while ago.

That would be a valid complaint if this was an advertising arrangment, rather than one where if you watch the TV show, you learn that you can activate a firefox addon to participate in an small AR game that changes your normal web experience into a Mr Robot style web experience for the duration.

The addon itself does not advertise for Mr. Robot, Mr. Robot advertises for this addon.

Sure, but why install it on random people's installs, even in some sort of disabled state? Viewers should be called on to install it themselves. I'd be cool with, say, an about: page that makes it easy for users to discover it, but pre-installing the addon in people's browser's seems a bit much.

It actually claims to be an "Alternate Reality Game (ARG)", not a "small AR game" as in "Augmented Reality" or "Mixed Reality". That's something else:

https://research.mozilla.org/mixed-reality/

I'd charitably call it "Augmented Memory", but it's definitely not "Augmented Reality".

And I'd hardly call it a game, just a parasitic advertising gimmick that slows and bloats the browser. It just injects a bunch of JavaScript code, DOM elements and CSS effects into every tab.

There's really no game there, and it's pretentious to call it an "Alternate Reality Game", which is defined as "intense player involvement with a story that takes place in real time and evolves according to players' responses":

https://en.wikipedia.org/wiki/Alternate_reality_game

This extension just wraps all occurrences of a set of keywords (now including "fuck") in a span with some css animations and a tooltip that links to their web page.

https://github.com/gregglind/addon-wr/commit/da464ac8f1c3b08...

But in terms of memory usage, CPU and battery consumption, it's not that small, either.

It injects a blob of CSS and some JavaScript into every tab, then it does a regular expression search of every text node on each page, filtering out everything but paragraphs, then for each occurrence of a keyword in the text, it creates a new text node to split the current text node, then inserts a new span element between them, containing its own text node, then it creates an additional tooltip element containing six text nodes, five br elements, and one anchor element linking to https://support.mozilla.org/kb/lookingglass , and it also configures css class names to associate all those new nodes it created with the blob of css styling and animations that it injected.

This extension isn't the best example of their technology for Mozilla to be promoting and distributing, if they're really serious about delivering a fast memory efficient browser.

While I agree with you on that, your previous comment was simply wrong. Non-profits are very much allowed to just "take money" (legal restrictions aside, but for-profit businesses also have legal restrictions). They're not allowed to take that money and distribute it to shareholders as profit.

Non-profit orgs are such due to legal designations that give them favorable tax treatment. In return they promise to organize and operate only to fulfill a charitable mission. The mission of Mr. Robot (content sniffing) has nothing to do with the charitable mission of Mozilla, "Our mission is to ensure the Internet is a global public resource, open and accessible to all."

The charitable mission of mozilla ended with their deal with google in 2004. Let's not forget that mozilla had frozen 15 millions dollars because of the IRS audit related to this deal and mozilla status, ending up settling outside of court for 1.5 millions.

> I think the the term “non-profit” is more about how an organization spends the money, rather than how they make it.

Tax-exempt non-profit (especially charity) status is very much about both how money is made and how it is distributed/spent.

This is a very common misconception about non-profits that is not true. The details depend on local laws, but generally a non-profit only means that the owner of the non-profit can't take the all of the actual profit (money) directly out of the non-profit via dividends. Things like non-profits must be focused public good or they can't pay high (or any) salaries are urban legends that have no basis in reality.

The key word is "just".

That's not a misconception I share. I understand Mozilla can and should make money to further its mission.

But unlike a for-profit, making money isn't the mission of Mozilla. So needing to make money can't be used as a justification for doing naughty things against the public good.

Making money may not be the mission of the mozilla foundation, but it is the mission of the mozilla corporation fully owned by the mozilla foundation.

And money it makes, in the hundred of millions, for serving its users to the worst known worldwide privacy offender, collecting and profiling user to sell advertising.

The "good" non profit charity foundation is governing the "evil" for profit corporation giving away users to the worst opponent of the mission of the charity. Quite a contradiction in this.

They also have limits on political speech. The IRS gives them breaks. One of the big misunderstandings/myths is that a church cannot support a political candidate.

Some people cry "free speech violation" but they can endorse a candidate, they just need to give up their tax privileges. This is why the ACLU is split into two parts. One you can donate to and get tax dedications for, but the other is their lobbying arm, and therefore cannot allow tax deductions for their donors.

"non-profit" isn't a magical incantation that means they can run with a revenue deficit forever though. They have expenses and there has to be enough revenue coming in to cover those expenses, or they will go out of business. That's true for any business, whether it's for-profit or non-profit.

Mozilla foundation (the non profit) set up Mozilla Corporation (the for profit raking in hundreds of millions of dollars) when the IRS investigated the foundation about tax fraud.

Of course non profits are allowed to make money.

I believe the idea is that Mr. Robot fans use Firefox to participate in the ARG, not that Firefox users suddenly start watching Mr. Robot. So if anything I'd expect that Mozilla pays Mr. Robot for this.

If it was a promo, it would be a real bad promo. I did not watch Mr Robot and that quote did not made me aware of it until people started referencing it here.

The extension is for shield study, when you install Firefox for the first time it asks if you want to take part in it (it is enabled by default though)

Mr Robot is a tv show repeatedly showing how you can pwn other people computer by pushing seemingly innocuous code.

It has been praised for its technical accuracy, basically the show warns us about exactly what mozilla did as this could be exploited to hack into computers.

> Looks like it's a promo for Mr Robot, which is really not ok.

From what I've heard (I work for Mozilla), this is promo for Firefox. As I just wrote elsewhere in this thread: I believe the idea is that Mr. Robot fans use Firefox to participate in the ARG, not that Firefox users suddenly start watching Mr. Robot. So if anything I'd expect that Mozilla pays Mr. Robot for this.

That would be an idiotic waste of money by a non-profit organisation considering the audience of Mr Robot.

> So if anything I'd expect that Mozilla pays Mr. Robot for this.

The irony is that Mr. Robot is owned by Universal, a subsidiary of Comcast. So much for that commitment to net neutrality.

Google is among the worst privacy offender there is and mozilla has been sending their users towards then in return for a small share of the google mega profits.

So much for the advertised protection of user privacy.