I won't dispute that history; just trying to add context to this one and agree that it's disappointing.

As to your edit, I absolutely agree. That's what I meant when I said pushing the add-on was not good. I was only suggesting that an add-on is a reasonable place to implement an easter egg, since it's separate from the core browser code. Distributing that add-on is a different matter, and I personally disagree with what happened there.

> I was only suggesting that an add-on is a reasonable place to implement an easter egg, since it's separate from the core browser code.

It was not a common add-on but an ad disguised as a "study." The question is still: why?

Why did that marketing team need that treatment instead of giving to the interested users a link to the normal add on? What was the actually planned scenario? Was it planned that that "study" (the studies are apparently officially "a way of making more informed product decisions based on actual user needs") uses some functionality not available to the normal add-ons? Was it that the normal add-ons wouldn't have access to the API that the "study" would use but that is forbidden to the normal add-ons since v57?

Indeed, that was not a normal extension:

"The addon is actually deployed as an embedded WebExtension, which is subtly different. It has a 40-line legacy XUL/XPCOM bootstrapper controlling whether the WebExtension part of it runs. The legacy code actually could upload your hard drive and isn't bound by any of the WebExtension restrictions. We know it doesn't do anything harmful, but it could have done so.

The WebExtension itself also has <all_urls> and webRequest permissions, granting it the ability to sniff the content and headers of every page."

(Source: https://www.reddit.com/r/talesfromtechsupport/comments/7k7wu... )

The question is still: what was the goal?

I would also take issue with calling it an easter egg. It wasn't an easter egg. It was an advertisement. That they silently installed on people's computers without their notification or knowledge.

That's not okay.

Honest question:

Pretty much every site on the internet does that.

Why are we spending 500 replies and all this developer time on an issue that if done by, say google on their home page, would be considered at best a fun little doodle at worst business as usual?

Firefox isn't a website. This is contrary to user expectation.

There is some degree of deceit present here which bothers me. They pushed out this advertisement through user studies, a feature that ostensibly exists and is designed to improve Firefox. I take issue with it instead serving as a backdoor silently install an advertisement.

If I personally saw this in my add-on page without any knowledge of what it was, I would be alarmed. My first thought would be that my computer had been somehow compromised.

I'm also slightly sympathetic to the idea that these user studies / telemetry can be used to improve FF. By abusing the feature, they encourage people to disable it, which harms Firefox if you take the position that the data gained by telemetry is useful. I certainly no longer have it turned on.

I've seen people link to anecdotes about the user study feature being reenabled after an update was downloaded. All I'll say here is that this is not cool if true.

And really, at the end of the day, why should I put up with any form of advertisements in my actual browser software? Good alternatives exist that don't have advertisements. Advertisements embedded in the product is a huge part of the reason why I switched away from Windows 10 to Linux.

To me, it's a worrying trend between this, Cliqz, the initial integration of pocket, and the the advertisements on the default new tab page.

I'm not particularly sympathetic to the idea that Mozilla needs to pull these kind of anti-user stunts in order to function. We're talking about a foundation that saw revenue of 421 million US Dollars in 2015 and 520 million in 2016.[0]

[0] - https://www.ghacks.net/2017/12/02/mozillas-revenue-increased...

>> My first thought would be that my computer had been somehow compromised.

... your computer was compromised.

I think we should all expect a full accounting from Mozilla on their actions and what data and information was acquired by them or a 3rd party as a result of the 'study' as well as what steps they will take to prevent this from happening again (now that they have a proof of concept (MVP?) surely another 3rd party can plant their own easter eggs in the future.

>I'm also slightly sympathetic to the idea that these user studies / telemetry can be used to improve FF. By abusing the feature, they encourage people to disable it, which harms Firefox if you take the position that the data gained by telemetry is useful. I certainly no longer have it turned on.

Count me in here... I was opposed to this feature and commented about making it Opt-in when it was introduced, however I did leave it enabled on a few of my systems believing it would only be used to improve the technology of the browser.

It is now (or will be soon) disabled on every system I manage...

Good Job Mozilla...

I think it's about domains of control: I expect that Google controls which image appears on their home page; I expect that I control which add-ons are installed in my Firefox.

If this code had been in core-Firefox, we'd never have noticed it. Counter-intuitively, maybe it wouldn't have felt as invasive, because I know that Mozilla controls core-Firefox, not me. (And I choose to defer to their judgement, because my other options are to defer to Google or Apple.)

>If this code had been in core-Firefox, we'd never have noticed it. Counter-intuitively, maybe it wouldn't have felt as invasive, because I know that Mozilla controls core-Firefox, not me. (And I choose to defer to their judgement, because my other options are to defer to Google or Apple.)

The code is available. I'm pretty sure the tor project would have noticed it.

I expect advertisements from a website.

I do not expect advertisements from my web browser - and I don't think that's an unreasonable line to draw.

I feel like this is way overblown but I think the logic here is that Mozilla claims to be an ally of privacy and internet freedom. While Google obviously, does not.

It is not overblown. Many of us powerusers / influencers stood by Firefox because of privacy. Latest failures have damaged my trust considerably.

To add insult to injury I don't see an apology or anything similar from Mozilla (or callahad here on hn) that would show me they understand the extent of this issue - how badly they f* up on how many occasions.

It's ironic, right when browser can finally stand next to Chrome in terms of performance...

Then people need to learn to slow down and back off - my privacy is a major part of my time's value. I will gladly spend a few half-seconds longer to be more private and more secure on an XUL-based browser rather than ever use an insecure WebExtensions-backed multi-process mess that accesses the Web without my consent or control.

apart from the fact that mozilla has standards it (supposedly) holds itself to, firefox is a beloved tool. It's not a piece of content, it's a tool. My content can be messed with, for sure. My tools can not.

Because many people use Firefox precisely because it's not Google?

Because Google is an advertisement company.

> modifies headers and content

No, it doesn't do that until you explicitly activate it.

The "pretty reasonable" core idea is just having that flag available in about:config or on the addons website or similar.