Hacker News new | past | comments | ask | show | jobs | submit login

They kinda missed the point that people dont like when companies install things on their devices without permission. If its part of the shield program how about we provide more transparency on that? Like how to opt-in/opt-out, what exactly it does? etc? I've been a firefox user since it came along to displace IE6 and i've never heard of the shield program. Better communication with your userbase is essential to maintain a sustainable product for the long term.



> They kinda missed the point that people dont like when companies install things on their devices without permission.

But it's a pretty blurry line, isn't it? You give permission to install Firefox, and it's somewhat arbitrary is a specific code is "part of Firefox" or "part of an extension" when that extension is shipped with Firefox by default.

(In this case, the specific code wasn't even executed unless the user flipped a switch in about:config. The problematic part was something being listed among your extensions that you couldn't make sense of as a user.)


No, it's not that blurry.

Any competent manager should be able to tell the difference between "functionality directly related to what users expect of a browser" and "code that we have installed on their machines without their knowledge, primarily motivated by our interests rather than theirs".

This is not about the specific implementation of such decisions, such as whether including it as "part of" or "extension to". That's a pointless distinction - also something any competent manager in the tech sector should be aware of.


So as a silly example, that means about:mozilla or Chrome's dinosaur game shouldn't have been shipped at all?


I'll take up the argument that they shouldn't have shipped, sure. Bear in mind that I myself don't actually care that much, but I do think we need devil's advocates for this sort of thing on occasion.

Easter eggs started at a time when software and games were shipped on cartridges, disks, or other media. If there was extra room available, it didn't affect the user experience to include them (performance was always very much in mind back then).

Today, however, we see a couple of changes:

First, apps and games are mostly downloaded. Easter eggs take up additional space, slowing down your download in the best case, and eating away at data caps in the worst cases. So you're already doing something that is somewhat hostile to the user.

Second, both Mozilla and Google position their browsers as fast and lightweight. Does including Easter eggs actually help further either of those claims? Most likely not. One Easter egg might not really impact performance at all, but at what point does it become a problem? There are probably different teams working on the browser, and if each of them are adding Easter eggs, how long before those start to affect performance, whether because it's cruft or because many users are on older systems that don't have as much memory as the typical developer is used to?

This at least bears consideration.


Thanks, I think this is a reasonable viewpoint that I can understand, even if I don't agree with it - but it makes it clear that we come from different places and hence different conclusions on the situation at hand as well.


Easter eggs have no functionality, and they follow the precedents of being harmless.


Well, the same was true for the so heftily discussed Looking Glass extension.

It did not do anything, unless you manually switched on an about:config value. And if you did, then all it did, was flip some random words on webpages upside down.


We can add a third criteria, then -- Easter eggs have no commercial purpose. The Looking Glass extension had tie-ins to a TV show.


Which is a relatively arbitrary criteria to be so categorical about.

No, I don't like it either to have eastereggs in my software that wasn't just put there for the fun of it, and rather was also motivated to some degree by a continued commercial relationship. But if this commercially motivated easter egg helps to gather more money to improve the software, which itself is non-commercial, and is as harmless as Looking Glass, then I do not see a problem with that.

And let me repeat that, if it is as harmless as Looking Glass. I do not see a reason to categorically exclude any sort of commercially motivated thing from the browser. Even including some actual ads would in my opinion not be unthinkable, given that they get enough money for it and have effective ways to do good with that money, while especially also taking into account that users will get pissed off by it and leave the browser, effectively slimming the ability of Mozilla to do good.

If you take everything into account, you can be morally on the good side without having to resort to never doing things from certain categories.


Don't know why you're getting downvote, the first part of your stmt might be debatable, but being harmless is reasonable and in the example of about:config, it's also useful for a smaller set of users.


It's their obligation to make sure the line is not blurry. As a user I always want to know the following:

- What does it do?

- Is it needed for core functionality or optional?

- How do you switch it off/on?

- Does it transmit any data, and if so, which one and how do I control the data flow?

- Who are the developers and is the code open source or is it proprietary?

- What are the default settings and why?

If it's optional, then it's an extension. If it's on by default, I better get a very good reason for it (e.g. that it ostensibly enhances security). All of the above questions need to be answered before I install it, i.e., the information needs to be freely available and easy to find on web pages, release notes, Readme, etc. If something is added in an update or upgrade, I need to be informed and given a choice about it.


It should be so, but Mozilla demonstrated they feel the line can be as blurry as they wish by integrating Pocket a year or two back. That should have remained an entirely optional addon.


So as a silly example, that means about:mozilla or Chrome's dinosaur game shouldn't have been shipped at all?


Easter eggs are somewhat of a software tradition.

This particular one didn't get complains because of a combination of reasons like:

- It is completely off-line (hell, it's only available on the "you're off-line" screen, where there isn't much else you can do with a browser).

- It's off by default (you need to be on a proper screen).

- It's a small and self-contained game. Doesn't impact anything else beyond a small area on the tab, which makes it just a step up from an animated GIF.

- It's just a joke, it isn't tied to any commercial franchise or brand, nor does it promote any ideology or organization.

- People expect less user-fairness from Google than from Mozilla.

Ultimately, the line is fuzzy, but Chrome's dinosaur is clearly more like an Easter egg, and Mozilla's Looking Glass is clearly more like a very specific extension/feature.


> It's just a joke, it isn't tied to any commercial franchise or brand, nor does it promote any ideology or organization.

This is an interesting point - I guess the blowback would also have been far less intense had it been a reference to e.g. Big Buck Bunny rather than Mr. Robot.


Yeah, I suspect this is the main underlying reason behind the drama - Looking Glass is, ultimately, an advertisement.


There's a reason Microsoft banned its developers from doing easter eggs.

There's a fine line between "Easter Egg" and "within of 3 months we've installed without user approval CliqZ's tracking, added Google Analytics to the about:addons Discovery menu, and added some easter eggs". This is how you lose all trust.


This is the kind of logic that ends up with things like a Java installer "helpfully" giving the user a Yahoo Toolbar in their browser or, for more extreme examples, Superfish and the Sony rootkit.


How about a notification when some new component is added? That's fairly common standard procedure for getting permission without being deceptive.


The question then is how to avoid alert fatigue [1]. "Component" is also a fairly ill-defined term, I think.

[1] https://en.wikipedia.org/wiki/Alarm_fatigue


A good strategy is to bundle them, so that users can review a bunch of alerts when they're ready for the task.

Release Notes of a new version is a good place to place that bundle. People concerned with security do set aside time for such task.


I would argue it's almost always obfuscatory, if not deceptive. How many emails/updates do we all get with something along the lines of `We've updated our terms, read them here!`. This extension could have easily found its way into one of those updates


It was an ad for a TV-show. I wouldn't really like if deceptively concealed ad's were bundled as part of Firefox proper either.


I dont think the line is that blurry personally, we get asked permission if we want to send usage data back to Mozilla to help them, i allow that, because i'm asked and informed about whats happening. I dont see why the same prinipal cant be applied to the shield program.


I wasn't talking about sending data back being blurry, but about the line between code "being installed together with Firefox" and code "just being part of Firefox".


The line is blurry indeed, but a tv show tie-in is clearly very far away from that line. (Not on the good side, but on the not-good side)


Yeah, it sure feels like "some time ago we identified the need to have this, and also to better not tell you about it."


Options -> Privacy and Security -> Allow Firefox to install and run studies. I don't remember if it's on by default.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: