▲ 506 points
back
371 comments
Good move, congrats on surviving the second armag-add-on finally BUT I won't be moving from chromium until Firefox (or Mozilla) explains:
- why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is)
- what does app.normandy.enabled switch do and why is its default value is True and doesn't change to false when I explicitly state I don't want to be in the Studies program?
- why can't we see any xpi's installed by studies program unless we explicitly go to about:studies?
I don't say chromium is better, but I think we deserve an explanation regarding these points.
Chromium is definitely worse.
While these deserve an explanation, you should not wait to move.
Chrome is spyware that does web browsing. It's parent company also shows ads, all the time.
Chrome's auto update not only allows them to silently update or change your browser, it allows them to silently install other software on your computer.
Firefox is a browser. It can auto-update in a way that may be questionable, but it also has a lot of cranky devs looking over their shoulder to call them out years later because Mr. Robot may have been able to show them an ad. FF deserves to be called out on their mistakes, and need offer an explanation. But perspective!
Why would you not move now?
> why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is)
I came here to mention exactly this. I don't mind the certificate issue (as long as there is a post mortem and they learn something from it).
I was wondering how my addons came back automatically (without me having to upgrade to 66.0.4) and I found out about this studies thing, which I never consented to. I feel violated. And the problem is, what browser am I supposed to use from now on? Lynx? Sigh
ETA: I am (was) a proud Firefox user since it was called Firebird, and changing browsers never crossed my mind before (even if Chrome felt faster some times). At this exact moment, I have zero trust on Mozilla, just like I have zero trust on Google (Chrome). Extremely frustrated and disappointed.
Chromium has a working exploit (AFAIK it still is not patched) that allows third-party code to masquerade as first-party code. Unless you run a special addon[1], you are vulnerable to this.
The fact that I still can't find that it's patched now tells me nothing good about the health of the ecosystem and who it is meant to serve. That should be all the reason you need to switch to Firefox, which admittedly also has huge warts but to my mind ones that aren't quite so egregious.
[1] https://chrome.google.com/webstore/detail/ublock-origin-extr...
It is interesting the quantity of studies they push to their opted-in normandy students.
Take a look at https://normandy.cdn.mozilla.net/api/v1/recipe/
Looking Glass is a collaboration between Mozilla and the makers of Mr. Robot to provide a shared world experience
Mozilla wants to know more about knowledge and opinions of news on the Web.
Etc.
There are also links to what seems to be internal documentation.
It shocked me the interest and the infrastructure they have just for collecting information. This is not just a couple of developers trying to figure out what feature is used and/or studying bugs.
"To provide this fix on short notice, we are using the Studies system. This system is enabled by default, and no action is needed unless Studies have been disabled. [..] It may take up to six hours for the Study to be applied to Firefox. To check if the fix has been applied, you can enter “about:studies” in the location bar... "
https://blog.mozilla.org/addons/2019/05/04/update-regarding-...
Consider running Icecat. It's most convenient to use it by installing a fully libre distribution such as Parabola or Guix System. Distributions which respect the FSDG don't just exclude proprietary software, but actually take software like Firefox which is 99% libre, and chucks out the last 1% of junk, improving many defaults. You're unlikely to have ethical qualms with such an Icecat.
https://www.gnu.org/software/gnuzilla/ You can see how it's made here: https://git.savannah.gnu.org/cgit/gnuzilla.git/tree/makeicec...
Note that it looks like it disables sync, but that should still work, and you can add whatever addons you like.
Chrome has studies too, called field trials. https://blog.chromium.org/2012/05/changes-to-field-trials-in...
This might be a stupid question, but have you asked them through their support or social media channels yet?
I switched to FF a couple of months ago, and was not opted in to Studies automatically. I'm based in Norway though so maybe GDPR had something to say. I had to opt-in to Studies to fix the certificate issue.
No release for android yet, at least not on [1], where I am getting the apk files from. As of now, latest release uploaded there is 66.0.2 from March.
[1]: https://archive.mozilla.org/pub/mobile/releases/
EDIT it's up: https://archive.mozilla.org/pub/mobile/releases/66.0.4/
I was already a bit mad at them for removing RSS support and claiming their proprietary service that's built in is an alternative, now their proprietary service keeps working (presumably, I didn't use it but it's not an addon so I doubt it's signed the same way) and I can't use the RSS addon.
I know this was a mistake, but I can't help but be mad that their proprietary built in stuff effectively gets a free pass and special treatment and meanwhile I can't use RSS and all my containers were deleted (those didn't come back after the study was pushed either).
About time. Embarrassing bug. The only reason i didn't permanently swap browser is because of the lack of alternatives since none has the functionality I apply through the addons.
Did this issue cause all add-on data to be wiped? After updating to 66.0.4, all of the containers I'd created with the multi-account containers add-on were gone and replaced with what appeared to be a default set of containers. I spent a lot of time setting that up—is there no way to get it all back if I don't have some sort of manual backup? And if not, what files do I need to manually back up to make sure I don't lose my data next time?
Edit: To be clear, at no point did I delete the add-ons I had installed.
Is a more robust way around this to use a trusted timestamping service?
This is the way code-signing on Windows works, and allows you to prove that code was signed by a valid certificate while it was in its validity date - so even once the certificate expires, the code will still run as long as the cryptographic timestamping signature is valid.
What about older versions? Does this mean that older versions of firefox can never be used with addons (even matching older versions) anymore?
This is pretty bad for Firefox. I wonder how much people straight up & left for Chrome as a result of it.
I have to say I was very pleased that the Debian-ESR package a) disables telemetry in the build and b) ESR still allows you to override the extension signing for now...
Lost my containers yet again, I am now on the last straws with Firefox, this whole Normandy thing is not helping the case. Firefox never asked me to opt in!
Link where the release notes will be posted:
I'm really worried about the average users not knowing what happened here. At least an email should be sent informing about the issue. But I guess many of those average users don't have a single extension installed, no problems for them.
The fix doesn't seem to work if you've been using Firefox Beta (67.0b16), or if you then install Stable (66.0.4) and sign in to sync - all addons are still marked as "legacy" and not enabled.
However, if you find each one in the store and (re-)install them - they work again and their data is back intact as expected.
I've always been a fan of native browsers, and have been using Chromium-based Edge[0] as my daily driver at work. While I wasn't one who was impacted by the extensions change, The removal of Live Bookmarks really stung for me, as I've used that feature since 2002.
Container support (with Containerise), a dedicated search bar to use with DDG bangs, and easy 'send tab to device' is what has me holding on today.
But I have to admit that Microsoft's eventual offering is pretty appealing, a Chromium-based browser with the advantages of Chrome's compatibility and Edge's conservative battery sipping. I'm one who has always liked and even preferred Microsoft's products and their integration on as objective of a basis as a human can muster. Even if it's in different aspects, I think they're going to probably have Edge become a package equally appealing to the things I love about Firefox. Edge/Safari are definitely where I'll go if Firefox really starts circling the drain, but having been on FF since it was Phoenix, it'll take more than this debacle.
Our extension sets https://www.givero.com as the default search engine. After the extension got disabled and re-enabled, searches now default to Google.
So this fix is not complete.
Our efforts in getting Firefox users to install our extension has been in vain. "Luckily" we didn't have many users yet but imagine the amount of money this will cost bigger search engines like DDG, Qwant, etc.
Is there a little more background to what is happening here? The link is to an ftp, so I have no idea what is broken, fixed or why it matters.
I'm still on 66.0.3 and the issue resolved itself, I believe, yesterday...
New version doesn't show up while following the instructions on: <https://support.mozilla.org/en-US/kb/update-firefox-latest-r...
I don't understand why renewing the certificate wouldn't fix the issue ?
How does the 66.0.4 fix the problem exactly ?
Not seeing any updates in `apt`.
Yet the official download on download.mozilla.org is still the old, broken version.
We need a new Phoenix, I feel.
From Wikipedia:
>They [the original Phoenix devs] believed the commercial requirements of Netscape's sponsorship and developer-driven feature creep compromised the utility of the Mozilla browser.
Probably less important given the type (and number) of users who are on Firefox Nightly, but it's still at "68.0a1 (2019-05-03)" without an update available yet.
Is the TOR browser update out soon?
I've been waiting to see this. Just updated from 65.0 to 66.0.3. My addons are still disabled. Tried to install ublock origin, and it's not letting me. I'm getting a "Download failed. Please check your connection."
This is crazy, and I'm really disappointed with Mozilla. I'd leave firefox right now, but I don't want to contribute to the destruction of one of the last good pieces of software not owned by Google.
GNU icecat is a very nicely modified firefox that respects the users. I highly suggest giving it a try if firefox has been bothering you lately.
studies, normandy, looking glass, forced signing of addons... Mozilla is giving away a lot of good-will lately. Still my favorite browser, but I don't like the general direction. Privacy should always default to true.
I hope for Mozilla to find a source of income that isn't Google, because they did a lot for the web. Let us just hope they don't need to make too many compromises.
Why I still can not install addons after upgrading? On the addon page it shows "only with firefox - get firefox now".
So nothing for those of us still running 56 beause Quantum trashed our extensions (and there are still not equivalent availale)?
What about ESR?
What about updating also the beta channel, I am using 67.0b16 and I still think I am affected because, not updates since and all the addons are shown as "ALLOWED IN PRIVATE WINDOWS"
installing and running this version did not resolve the issue for me
is there something else I need to do?
Mine says : Firefox Developer Edition 67.0b16 (64-bit). No fix yet there...
thanks for the heads up, now alive!