On 19/12/17 01:11, Thomas Daede wrote:
On 12/18/2017 03:00 PM, Sam Varshavchik wrote:
Does anyone read this as Mozilla admitting that they messed up?
This was published today: https://blog.mozilla.org/firefox/update-looking-glass-add/
It's certainly an improvement on their previous efforts though it still rather skates around some of the most important points.
They still seem to be concentrating on the details of what this specific addon did or didn't do rather than on the abuse of the "shield studies" mechanism. To remind ourselves https://support.mozilla.org/en-US/kb/shield describes them as:
SHIELD studies let you try out different features and ideas before they are released to all Firefox users. Using your feedback, we can make more informed decisions based on what you actually need.
So they are about testing new browser features, and yet in that blog post they are described as "our auto-install mechanism for add-ons" which while it might be what shield studies amount to technically shows that internally they are viewed (at least by some people) much more broadly.
I realise it goes on to say they are conducting a review, which will presumably cover the approval process for shield studies and why it seems that marketing was able to push this through - indeed why marketing even had access to a channel designed for feature testing.
Just the fact that response to this still seems to be led by their marketing department (with all response coming from the chief marketing officer) and not by security/privacy teams says quite a lot really.
It seems obvious that either people with responsibility for security and privacy issues didn't have visibility of what was happening here, which would suggest a seriously broken process for approving shield studies, or they didn't have the political power to overrule the marketing department which is many ways an even bigger problem because that is a cultural issue at the heart of the organisation that will be hard to fix.
Tom