> Is the extension on or off when it gets installed invisibly?

You could argue technicalities for either, but semantically, it's off by default.

The add-on is implemented as an "embedded webextension" which is wholly contained by an outer "bootstrapped add-on." The bootstrapped add-on controls whether or not the embedded webextension gets initialized, and that's all it does.

The bootstrapped add-on is literally just this one file: https://github.com/mozilla/addon-wr/blob/59659431fd2a75c33ac...

The outer shell is on by default. The embedded webextension is only initialized by the bootstrapped add-on if the user manually flips the "extensions.pug.lookingglass" preference in about:config. That preference is off by default.

> why not just have the user actually install the extension at the time of consent, rather than prefetching?

That's what we're moving to by pulling the add-on from Firefox and posting it on AMO.

I just want to say thank you for engaging here!

Mozilla fucking up like this still feels like a friend fucking up. It's frustrating and disappointing precisely because I expect Mozilla to be better than this.

Err... No. The first time around (Pocket), yes. The second time (changing my explicitly set default search engine) - maybe. But this? Bundling ads with my browser? Not acknowledging it is a problem? No.

Don't forget the Cliqz debacle. And that in privacy oriented Germany. I'm in Berlin right now, and they don't appear to use a NFC card for public transport. In contrast to NL and UK they're still using tickets here.

> That's what we're moving to by pulling the add-on from Firefox and posting it on AMO.

Why was this not done in the first place?

I'm not personally aware of the answer to that question, but I expect it will be covered in a postmortem in the coming days.

I am anxiously waiting for the postmortem. As others have written, this is not a first such incident that goes against (perceived) core values of Mozilla. Either you need to pull your act together and change the process that leads to such decisions or you need to come clean (and admit that you are selling out your users for profit, the way Google does). Well, you can also ignore the situation and public will understand that you chose the latter...

If you do decide to come clean, it would help a lot if you gave assurances about what you have learned and how you will change the process so that this doesn't happen again. Trust is difficult to gain and easy to lose.

I must say I am sorry to see all this happening though. I have always hated Chrome (a bit less than IE, but for other reasons) and am (still) your loyal user. I even enabled telemetrics recently (which means _a lot_ - there is no other piece of software that gets this willingly from me) - needless to say, they are turned off again. We'll see how the postmortem turns out.

Gentle question:

was it a candid easter egg ?

I feel a bit distanced about the whole situation. The issues I've seen are:

- getting money from secret extension - potential security risk - bad will from mozilla

the name shield studies feels a bit scary, a CIA paranoia tone but anyway.. I believe that's the era that is tense and what seems to be an easter egg as you say, ends up as a brutally negative thing.

So basically, much ado about nothing. I am glad you engaged, thank you. People are too quick to overreact these days.

People are too quick to overreact these days. - it's as much fun a burst of dopamine and involvement as any gamified mobile game.

And it's not like we have any massive problems to unite against (that we can actually feel like we can help with).

> You could argue technicalities for either, but semantically, it's off by default.

That’s a very dangerous type of justification there, not one I expected someone at Mozilla to get that wrong.

He's being more generous than he needs to be. It is off by default.