News for hackers. Stuff that matters.
Re:Firefox 115 can silently remotely disable my extension on... by concinds on Wednesday July 05, 2023 @01:00PM (#36603300)
> is being communicated

In the release notes which 95% of users don't read, and in a text label hidden in a toolbar menu. No informed consent or prompt to opt-in. And Mozilla hasn't disclosed their criteria for inclusion of websites, and what they plan to use it for.

Re:Firefox 115 can silently remotely disable my extension on... by kemotep on Wednesday July 05, 2023 @01:14PM (#36603534)
The average user isn’t using Firefox to begin with. In fact 5% market share for Mozilla is probably pretty generous.

I agree with you that Mozilla has certainly dropped the ball regarding this change. Much like pocket, the Mr Robot ARG, the Quantum update, DoH with Cloudflare as the default provider, and so on. But again all but the Quantum update have been user configurable, and in my experience, have not been reverted unlike my browser preferences on Windows, where Edge hijacks anything and everything with very little recourse.

Re:Firefox 115 can silently remotely disable my extension on... by NooneAtAll3 on Wednesday July 05, 2023 @02:07PM (#36604517)
> The average user isn’t using Firefox to begin with.

that's... not a valid argument for this discussion? market share and user conservatism has no connection to concerns about basic safety affecting everyone

judgement should be applied equally, every user and every product

Re:Firefox 115 can silently remotely disable my extension on... by mrtranscendence on Wednesday July 05, 2023 @02:14PM (#36604642)
> that's... not a valid argument for this discussion?

I believe the intention was to argue against the notion that 95% of users don't read release notes. The contention seems to be that, because Firefox users are more technical (or enthusiast, perhaps), more than 5% of Firefox users would read be aware of this change.

Re:Firefox 115 can silently remotely disable my extension on... by kemotep on Wednesday July 05, 2023 @02:17PM (#36604694)
The grandparent comment was regarding that the average user doesn’t read release notes and I was remarking that Firefox users are not average.

Now I agree that this change is not being communicated properly but to claim that the Firefox user is similar to the average computer user is not something I would agree with.

Re:Firefox 115 can silently remotely disable my extension on... by netheril96 on Wednesday July 05, 2023 @11:25PM (#36610740)
> The average user isn’t using Firefox to begin with. In fact 5% market share for Mozilla is probably pretty generous.

Is Mozilla content with that market share? If not, it must act with the assumption that its users are average.

Re:Firefox 115 can silently remotely disable my extension on... by JohnFen on Thursday July 06, 2023 @02:20PM (#36620484)
I'm sure they're not, but that's what they've got -- and it's continuing to decline.
Re:Firefox 115 can silently remotely disable my extension on... by wernercd on Wednesday July 05, 2023 @01:58PM (#36604319)
Is it there fault if you don't read? or it your fault?

Likewise... who's to blame if a rogue addon isn't responded too?

Same arguments get bundled about stuff for iOS and it's absolutely responsible for companies to be proactive about issues with stuff like automatic updates because failure to do is, in aggregate, is worse because of stuff like zero days.

Re:Firefox 115 can silently remotely disable my extension on... by starttoaster on Wednesday July 05, 2023 @02:06PM (#36604484)
> Is it there fault if you don't read? or it your fault?

I don't know their exact argument, but I would assume a better place for a notice like this would be a popup or some kind of tiny tooltip window when you update to Firefox 115 that says "hey, we can disable an extension at any time if we find reason to believe they're acting untrustworthy and misbehaving, you can disable that behavior by going here."

I cannot fathom how someone would disagree with this user experience suggestion around this new feature.

Re:Firefox 115 can silently remotely disable my extension on... by Hizonner on Wednesday July 05, 2023 @04:05PM (#36606289)
> Is it there fault if you don't read? or it your fault?

I guess I need to read every line of the source code, too. After all, they publish the code, so that's fair warning.

> Likewise... who's to blame if a rogue addon isn't responded too?

The person who chose to install it.

Re:Firefox 115 can silently remotely disable my extension on... by kelnos on Wednesday July 05, 2023 @04:09PM (#36606350)
> Is it there fault if you don't read? or it your fault?

Given that Firefox auto-updates, and most of the time doesn't put up a "What's New" type page after the update installs, I don't think it's reasonable to expect that most users would even know that there's a separate release notes page, let alone that they should read it.

Re:Firefox 115 can silently remotely disable my extension on... by GeekyBear on Wednesday July 05, 2023 @02:11PM (#36604580)
> No informed consent or prompt to opt-in.

Are users giving informed consent for Google's ability to remotely disable Android apps or Apple's ability to do the same on iOS?

The ability to disable malware as it is discovered seems to be a very common pattern.

If you include the bundled malware scanners on MacOS and Windows, it's taking place on them as well.

Re:Firefox 115 can silently remotely disable my extension on... by ezfe on Wednesday July 05, 2023 @02:37PM (#36605035)
Disabling apps is different from disabling non-verified extensions. The linked article addresses that Mozilla already has the capability to handle discovered malware, which is separate from this issue.
Re:Firefox 115 can silently remotely disable my extension on... by JohnFen on Wednesday July 05, 2023 @02:20PM (#36604747)
> Are users giving informed consent for Google's ability to remotely disable Android apps or Apple's ability to do the same on iOS?

No, but we expect Google to be user-hostile. We expect the opposite of Mozilla.

Re:Firefox 115 can silently remotely disable my extension on... by okasaki on Wednesday July 05, 2023 @04:56PM (#36606988)
That's an expectation that hasn't been sensible for a decade...
Re:Firefox 115 can silently remotely disable my extension on... by Hizonner on Wednesday July 05, 2023 @04:03PM (#36606263)
If I want a browser that acts like it comes from Google, then I will use fucking Chrome. Lots of idiotic user-hostile things are "common patterns".
Re:Firefox 115 can silently remotely disable my extension on... by Deebster on Thursday July 06, 2023 @06:48PM (#36624343)
I read the release notes, and I still didn't see where this was mentioned.

This feature does seem like it's designed to help defend against bad plugins, but in other hands it could be a source of worry.