This discussion on Reddit[0] would indicate that quite a few people saw this behavior unexpectedly, so even though it was off by default, it came as an unpleasant surprise to people who had opted in. It seems that they thought they were opting into Mozilla-lab-like experiments for improving the browser. Instead, they get an ad/easter egg that makes them think they-- or the site they are visiting-- have been hacked.

[0] https://www.reddit.com/r/programming/comments/7k8pf7/firefox...

It has also already caused economic damage as well as waisting a lot of people's time. https://reddit.com/r/talesfromtechsupport/comments/7k7wum/wh...

This. Apparently, we're still waiting for a Therac-class incident before "don't mess with critical infrastructure for what seems harmless fun to you" will even register on the radar with the "move fast and break other people's things" crowd.

That story, uh. If you cut off the last couple sentences it would be somewhat convincing. In its entirety it just suggests a very broken process. Where an automatic extension invalidates firefox, but renaming chrome.exe to firefox doesn't invalidate firefox!?

Or, they have multiple scripts running in the background which assume there is a `firefox` process. In such a case the smallest (and quickest) change is to rename the binary.

Perhaps Chrome is also supported by the testing infrastructure, but they chose to use only firefox?

Incredible. Mozilla really screwed up on this one.

mozilla has something called "system-extension" (the name changes over the years) that never shows up to the end user, and sole purpose is to enable/disable things in the users browsers.

the use, as far as I know, has always been to disable broken features in older versions of users that do not update. pretty ok and necessary.

but this makes me think they are using it to a/b test or capacity plan for marketing campaigns now :(

I agree it is useful to disable broken features, or other things in software that is not getting updates

I completely disagree this need to be hidden from the end user, it should be FULLY and COMPLETELY transparent what is being disabled, added, or changed. There should be an "about/system-extension" page where a person could go and see everything that is doing or has done, and even optionally disable it if they desire.

> pretty ok and necessary.

There is NEVER a ethical reason for a dark update channel to exist. Altering the functionality of installed software without consent or notification is an act of sabotage, even when done by the vendor. If you want to disable broken features you prompt the user to have them disabled. Worst case (say something that allows malware to propagate or puts them or others at active risk) you disable it and display a message telling exactly what has happened.

Can you point to a specific comment where someone saw the behavior unexpectedly?

I've only seen people that saw the addon being installed unexpectedly.

That doesn't lead to thinking any sites have been hacked.

Even if the add-on is "enabled," it's doesn't initialize itself unless a specific about:config value is also manually flipped: https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac...

And, for good measure, here's an official quote confirming that we're pulling the add-on from Firefox: https://gizmodo.com/after-blowback-firefox-will-move-mr-robo...

It would be easier to forgive if this was the first time Mozilla pulled this sort of thing. Instead, we see Mozilla making this same kind of mistake -- i.e. trying to turn what is otherwise a great browser into some kind of "platform" for things that do not actually serve users -- over and over again.

It's great that it was pulled, but what about removing the ability to silently install add-ons? Give up the power to make this mistake in the future if you want forgiveness.

Absolutely. The whole ordeal reminds me awfully of Ajit Pai's tone as he kills net neutrality, sounding as if everything was fine until net neutrality came along.

Although different, this too brushes off this one instance as a mistake, and entirely disregards the rest of the article, not even trying to address or explain the rest of Mozilla's recent borderline malicious behavior.

A serious fork is long overdue, if only it didn't take a corporation as big as Mozilla to undo their bad deeds.

I'm just one DevRel engineer on a layover; I'm not the right person to answer those broader questions. Not trying to be dismissive, just trying to engage in the areas where I'm most able.

Do you have an insight into whether or not Mozilla will issue an update that removes the ability to push add-ons in this fashion?

Bah. This was something that looked spooky but ran exactly zero payload by itself. It implies failed processes inside mozilla, but nothing malicious.

I still want a justification of the cliqz thing, sure, but I don't demand it in relation to this.

I'm glad it doesn't do anything, but if I saw this in my extensions list, I would think it was malware. That does have an impact. I could have spent hours with my hair on fire trying to figure out how my system was compromised, and I wouldn't be surprised if others have. I'd expect better from an org that has to deal with security issues all the time.

> callahad 4 hours ago [-]

Even if the add-on is "enabled," it's doesn't initialize itself unless a specific about:config value is also manually flipped

Attack surface 101 / reason nobody else does this

How is this a particular attack surface? Changing an about:config value requires quite a bit of effort from an attacker and enabling this extension would not actually pose a security risk either. There's plenty of better about:config values to be changing, too.

> The one thing I know is that I am writing from a Firefox right now and don't see headers, inversions etc. at all. The examples given in the article should have all been inverted, right?

"It involved sideloading a sketchy browser extension which will invert text that matches a list of Mr. Robot-related keywords like “fsociety”, “robot”, “undo”, and “fuck”, and does a number of other things like adding an HTTP header to certain sites you visit."

Only if HN is on the list of "certain sites". It's also irrelevant because the extension offers me no value so Mozilla was not acting in my best interest.

OK, so I got that wrong with the "certain sites".

But still, the fact that the extension was not active unless you mess around in about:config is a crucial fact, which should not have been omitted in an highly critical article, specially if they use words like "Mozilla, you fucked up bad, and you still haven’t apologised. The study is still active and ongoing".

I feel misinformed by that article, to say the less.

> Only if HN is on the list of "certain sites".

If that is the case (I'm not saying it's not, just that I don't know)... why did the extension even need to exist? Presumably "certain sites" are partner sites participating in the promotion. If they are participating and (I assume) they control their own content, why didn't they just invert those words or whatever else they wanted to do with the content when they served it?

I'm very confused about why this needed to roll out as a browser extension at all.

The articles on this whole controversy describe it as an ARG - an Alternate Reality Game. I don't know exactly how this ARG works, but ARGs in general are like scavenger hunts - players investigate what's causing the changes, which give them hints as to where to look next.

So presumably it was implemented as a browser extension so game players would be able to find the browser extension, which would give them hints about what to do next.

The add-on doesn't do anything unless you go to about:config and turn it on.