On 19/12/17 01:11, Thomas Daede wrote:
On 12/18/2017 03:00 PM, Sam Varshavchik wrote:
Does anyone read this as Mozilla admitting that they messed up?
This was published today:
https://blog.mozilla.org/firefox/update-looking-glass-add/
It's certainly an improvement on their previous efforts though it still
rather skates around some of the most important points.
They still seem to be concentrating on the details of what this specific
addon did or didn't do rather than on the abuse of the "shield studies"
mechanism. To remind ourselves
https://support.mozilla.org/en-US/kb/shield describes them as:
SHIELD studies let you try out different features and ideas before
they are released to all Firefox users. Using your feedback, we
can make more informed decisions based on what you actually need.
So they are about testing new browser features, and yet in that blog
post they are described as "our auto-install mechanism for add-ons"
which while it might be what shield studies amount to technically shows
that internally they are viewed (at least by some people) much more broadly.
I realise it goes on to say they are conducting a review, which will
presumably cover the approval process for shield studies and why it
seems that marketing was able to push this through - indeed why
marketing even had access to a channel designed for feature testing.
Just the fact that response to this still seems to be led by their
marketing department (with all response coming from the chief marketing
officer) and not by security/privacy teams says quite a lot really.
It seems obvious that either people with responsibility for security and
privacy issues didn't have visibility of what was happening here, which
would suggest a seriously broken process for approving shield studies,
or they didn't have the political power to overrule the marketing
department which is many ways an even bigger problem because that is a
cultural issue at the heart of the organisation that will be hard to fix.
Tom
--
Tom Hughes (tom@xxxxxxxxxx)
http://compton.nu/
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
