Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> C:\Program Files\Mozilla Firefox\browser\features\

WOAH.

That's some genuinely nasty stuff that no one would normally want on their machines AND visible only from an obscure about:support page AND with no clear way of disabling it, save for deleting .xpi files:

    [email protected] [1]
    [email protected] [2]
There are also these two that explicitly disrespect and ignore one's updating preferences:

    [email protected]
    [email protected]
These appear to be a way for Mozilla to push "urgent" patches bypassing the normal update mechanism and user consent.

    ---
This is completely unacceptable. This sort of functionality should be in the main UI and it should be possible to disable it with one click, permanently.

[1] https://blog.mozilla.org/data/2017/06/05/measuring-search-in...

[2] https://wiki.mozilla.org/Firefox/Shield - generalized engine for running "study" recipes.



Shield Studies are in the "Privacy & Security" settings: "Allow Firefox to install and run studies"

"Follow On Search" is AFAIK controlled by the Telemetry settings in the same dialog in "Privacy & Security".

ignore one's updating preferences

Are you sure? They're add-ons, so they should follow the add-on update preferences. Given that aushelper apparently does nothing aside from modify the update URL to include info whether the system is affected by some bug, it's hard to see how it wouldn't respect the settings.


While I understand you not wanting Mozilla to be able to push urgent patches, this is (in my) opinion necessary in sufficently serious cases. Imagine a remote code execution hole in Firefox, being actively attacked through ad networks. In that situation, every minute counts, and an attack could perform serious damage.


"The road to hell is paved with good intentions."

It's not about denying Mozilla an option of pushing zero-day patches. It's about the fact that it's a built-in always-on _concealed_ feature.


The source code is public, there's probably been a blog post about it, there's an about-page for it, and there actually is a setting for it in the main-UI.

I really don't see how it's particularly concealed. If they actually tried to conceal it, you would not know about it at all.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: