Unknown Mozilla dev addon "Looking Glass 1.0.3" on browser - <AUTHOR> https://support.mozilla.org/en-US/questions/1194583 <comment><USER3> Many people seem to be shocked because Mozilla installed an add-on automatically. In my opinion, it doesn't really matter since the code is coming from Mozilla - they're building the whole browser, so they could introduce functionality anywhere. If someone distrusts their add-ons, why trust their browser at all?

The main question is what behavior is being introduced. I haven't researched deeply, but apparently the add-on does nothing until the user opts-in on studies.

<comment><USER4> The major problem is that they installed an add-on without properly communicating what it was. A somewhat smaller problem but still a big problem is that was an utterly frivolous add-on that shouldn't have been pushed to people who didn't explicitly want it. But the biggest problem is that Mozilla seems to have trouble understanding why any of those two would be a problem, I want my browser vendor to be serious and not play silly games that can so easily backfire.

Yeah, add-ons from Mozilla merits the same trust as the browser. But this cuts both ways, this stuff undermines my and probably more people's trust in the browser.

<comment><USER4> So this is the first response from Mozilla in the Gizmodo article:

"Firefox worked with the Mr. Robot team to create a custom experience that would surprise and delight fans of the show and our users. It's especially important to call out that this collaboration does not compromise our principles or values regarding privacy. The experience does not collect or share any data," Jascha Kaykas-Wolff, chief marketing officer of Mozilla, said in a statement to Gizmodo. "The experience was kept under wraps to be introduced at the conclusion of the season of Mr. Robot. We gave Mr. Robot fans a unique mystery to solve to deepen their connection and engagement with the show and is only available in Firefox."

This is horrible. They pushed out this crap under false pretenses as a study and obfuscated it. Don't talk the ethics talk if you're not prepared to do the ethics walk.

<comment><USER5> I've been using Firefox for 90% of my browsing for a few years now and really want to continue to do so but I really wish Mozilla would stop shooting themselves in the foot already. This once again gives the impression that they have some teams that aren't in touch with the reality on the ground, that these types of initiatives hurt their chances of gaining more users.

<comment><USER6> Let me suggest you a browser aptly named waterfox, that could be described as firefox without mozilla nonsense.

[1]: [https://www.waterfoxproject.org/](https://www.waterfoxproject.org/)

<comment><USER7> Waterfox _is_ nonsense, no offense to the people behind it. Removing some stuff from Firefox and calling it a day does not make a better Firefox, it just makes for a preconfigured one. You might as well just run Chromium.

The problem is that Mozilla is a good company, that has had a true net positive effect on the world, especially in tech, and continues to do so _today_ with wonderful projects like Rust etc.

If Mozilla were a shitty company, we could all simply dismiss Firefox and get on with our day. But Mozilla is not a shitty company and the fact they keep shooting themselves in the foot like GP said, the fact they are completely out of touch with their userbase, that they cannot see the OBVIOUS problems with this addon even after the Pocket debacle, is ridiculous.

<comment><USER8> Heaven forbid the decisions about what features an application gives and takes away are decided by lowly users. The free in free software means libre still, right? So if someone forks over 1 change or 10 they are still libre to do it, or is that passe? Its free as in liberty, as in freedom of thought, or is that also passe?

Forking a project, and adding features and removing pulls that you don't want and/or need is kinda the idea behind the whole 'open source' thing.. cause what else would you do with the source code, but compile it.

Speaking of Firefox, a build or two ago, without warning, Firefox deprecated (broke) every add-on. Because [insert-old-architecture-security- justification]. It's not like anybody was doing anything real with a browser anyway.

<comment><USER7> The new extension system was announced years in advance, including the warning that XUL addons would eventually be deprecated.

This design decision is behind a large part of the performance improvement in 57.

Yes I'm sad, I lost some of my favourite addons as well. But this move was announced well in advance and it _had a serious technical reason behind it_.

In a difficult situation, Mozilla made a tough decision that is good in the long run and that benefits all its users. Crying "fork!" over it is so blind it leaves a bad taste in my mouth.

> _So if someone forks over 1 change or 10 they are still libre to do it, or > is that passe?_

It's nonsense. Doesn't mean they can't do it, doesn't mean it's not nonsense. Furthermore, in some situations, forks can be harmful to the overall health of an already fragile ecosystem. They're not free of externalities.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Previously:

* [https://news.ycombinator.com/item?id=15921134](https://news.ycombinator.com/item?id=15921134)

This is a link to the GitHub issue:

* [https://github.com/gregglind/addon-wr/issues/36](https://github.com/gregglind/addon-wr/issues/36)

There are several scary things about this:

\- Unknown Mozilla developers can distribute addons to users without their permission

\- Mozilla developers can distribute addons to users _without their knowledge_

\- Mozilla developers themselves _don 't realise the consequences of doing this_

\- Experiments are not explicitly enabled by users

\- Opening the addons window _reverts configuration changes which disable experiments_

\- The only way to properly disable this requires fairly arcane knowledge Firefox preferences (lockpref(), which I'd never heard of until today)

<comment><USER10> > Unknown Mozilla developers can distribute addons to users without their > permission

"In related news, unknown website developers can distribute programs and run them in your browser. Additionally, it's been determined that browsers sometimes download changed versions of themselves without your permission. Worst of all, we've determined that sometimes the program you download and run yourself on your computer does stuff it didn't say it would do!"

In all seriousness, I understand this is an important issue, and needs to be addressed, but we've obviously gotten to the point as a society recently where no news can't be played up for hype by pundits and commentators for their own benefit (and probably without realizing they are doing it in a lot of cases).

The whole way this is being presented (by many here, not to pick on the parent) as a new chunk of the sky falling is what _I_ find really troublesome. No, chicken littles, the sky isn't falling, but there _is_ some interesting shit going on up there that deserves a look.

I fail to see how getting half the people frothing at the mouth and the other half downplaying it just to try to keep some sanity in the discussion helps for a good outcome.

<comment><USER6> > "In related news, unknown website developers can distribute programs and run > them in your browser. Additionally, it's been determined that browsers > sometimes download changed versions of themselves without your permission. > Worst of all, we've determined that sometimes the program you download and > run yourself on your computer does stuff it didn't say it would do!"

No they can't, despite mozilla removing the option to prevent this, I have an extension preventing website to run code in my browser without my permission. it happens to be one of the most popular firefox extension: noscript. (also umatrix and request policy).

No the browsers do not download changed version of themselves, they do not have the administrative permissions required to install programs on my box. I get my update from the official distro repository on my terms.

I do not download and run programs, they come from the distro repository. This is a matter of trusting the package maintainers but up until now this has served many people well.

It seems you guessed wrong and it does not work the same for everybody, some of us have chosen to take the extra step required for this kind of misadventure to be unlikely.

<comment><USER10> > No they can't, despite mozilla removing the option to prevent this, I have > an extension preventing website to run code in my browser without my > permission. it happens to be one of the most popular firefox extension: > noscript. (also umatrix and request policy).

You've conflated third party javascript with javascript in general. You _can_ turn off javascript entirely, but unless you do so, that website is generally able to ship javascript to you as included scripts from the same domain or in a script section or inline with attribute handlers.

> No the browsers do not download changed version of themselves, they do not > have the administrative permissions required to install programs on my box. > I get my update from the official distro repository on my terms.

Yes, they very often do. Currently, they generally ask if you want to restart using the new version and give you that choice, but they are often downloading newer versions of themselves ahead of time to speed up this process.

Whether they have permissions depends entirely how you installed the application. If it wasn't installed globally, user permissions are all that is needed.

> I do not download and run programs, they come from the distro repository. > This is a matter of trusting the package maintainers but up until now this > has served many people well.

Good! I hope you've also never _ever_ piped wget output to a shell for some application's quick installer. I also hope you've never installed any programming language module through that language's package manager and not your distro's package system, because those are notoriously bad at making sure there's not holes through which bad stuff can happen either.

Regardless, it's possible that the package you downloaded, no matter the source, _can_ do something other than stated.

> It seems you guessed wrong and it does not work the same for everybody, some > of us have chosen to take the extra step required for this kind of > misadventure to be unlikely.

Actually, I don't think I guessed wrong because I wasn't _guessing_ anything, and I never said it works the same for everybody. I believe, since I was careful to qualify my statements, that each is easily proven correct, and I've done so.

</comment></comment></comment></comment><comment><USER11> Looks like it's a promo for Mr Robot, which is really not ok.

> What's happening? Are you a fan of Mr Robot? Are you trying to solve one of > the many puzzles that the Mr Robot team has built? You're on the right > track. Firefox and Mr Robot have collaborated on a shared experience to > further your immersion into the Mr Robot universe, also known as an > Alternate Reality Game (ARG). The effects you're seeing are a part of this > shared experience.[0]

EDIT: looking at this[1] comment, perhaps it's not a promo?

[0]: [https://support.mozilla.org/en- US/kb/lookingglass](https://support.mozilla.org/en-US/kb/lookingglass) [1]: [https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...](https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_looking_glass/dr6fiaz/)

<comment><USER12> Seems kind of like it is part of an ARG. I can't say I'm totally against something like that; Mozilla's gotta make money somehow, and as long as it's not selling out user privacy it's a better tradeoff than Chrome.

<comment><USER13> > Mozilla's gotta make money somehow

They're a nonprofit; they're not allowed to just "make money". And, they already take donations.

<comment><USER14> I think the the term "non-profit" is more about how an organization spends the money, rather than how they make it. Non profits and charities definitely bring in money through channels other than donations...

<comment><USER13> I agree.

I merely challenge the notion that a nonprofit -- which proudly tumpets its benevolence and non-profitness -- should get a free pass for covertly installing advertising arrangements, just because they need to "make money".

Their charter and marketing is all about defending the internet from the companies doing shady things to make money, so they can't have their cake and eat it.

<comment><USER15> There is a difference between a non-profit and a non-for-profit (most health insurance companies are the later; go try and figure that out).

Firefox gets most of its donations from corporate sponsors. That's why the default search and switched back and fourth between Yahoo and Google; it's all about the amount of money they contribute for that. I'm not sure, but Pocket might be another example.

User contributions are actually pretty low. They don't go out and request them though like NPR or Wikipedia.

<comment><USER6> You're confusing mozilla foundation and mozilla corporation here. The default search with google and yahoo is not donations for the foundation but a commercial contract with the corporation.

I'm not sure mozilla even gets a significant amount of donations compared to their commercial contracts.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> This happened to me yesterday, so I looked for it.

The Extension actually does nothing, but invert (make them upside down) a few words on specific sites.

It's an experiment called "PUG ARG" to check whether page contents sniffing works. Its page doesn't reference any Bugzilla issue or Wiki page, while [https://wiki.mozilla.org/Firefox/Shield/Shield_Studies/Queue](https://wiki.mozilla.org/Firefox/Shield/Shield_Studies/Queue) doesn't list it.

The source code references [https://support.mozilla.org/kb/lookingglass](https://support.mozilla.org/kb/lookingglass), which (as of now) only says "test - 12817".

The add-on tests whether specific words can be detected on sites; the current list has nice picks like "revolution" and "privacy". Of course, this is only a test, but in the future Firefox might look for specific terms in the pages you load and do specific things based on them.

The other thing it's doing is to send an extra header to three specific sites: [https://github.com/gregglind/addon- wr/blob/da464ac8f1c3b0894...](https://github.com/gregglind/addon- wr/blob/da464ac8f1c3b089405ca96fc68b999d2b624ef4/addon/webextension/background.js#L52). I suppose the words and the domain are a reference to the Mr. Robot series.

The add-on describes itself as an "Augmented Reality Game Experience" and was made by a certain "PUG Experience Group": [https://github.com/gregglind/addon- wr/blob/da464ac8f1c3b0894...](https://github.com/gregglind/addon- wr/blob/da464ac8f1c3b089405ca96fc68b999d2b624ef4/package.json).

Of course, Shield Studies are supposed to be a way of making "more informed product decisions based on actual user needs".

[https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...](https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_looking_glass/)

<comment><USER17> Wow, FF is sniffing the content and changing words.

Could not think of anything worse a web browser could do.

Do they change political arguments on pages in the future to see how I react in a user study?

Signed Mr. Guinea Pig

<comment><USER18> That's ridiculous, since FF is literally fetching and rendering that content, being its raison d'être.

You can't "sniff" what is already yours to begin with.

<comment><USER19> Sniff implies sending. It's the scanned content transportation and destination that's the issue.

<comment><USER18> There's no sending involved with this add-on.

</comment></comment></comment></comment></comment><comment><USER20> 1) Mozilla uses weird, spooky language in an add-on.

2) Users are justifiably concerned.

3) Mozilla explains that the add-on is actually anodyne; the developers responsible were having fun with an opt-in research service.

4) Some users try to justify their initial overreaction by painting Firefox as mysterious, dangerous entity, fabulating conspiracy theories about one of the most forthright and open OSS companies in the world.

Really, guys. If Mozilla was hellbent on invading your privacy, do you really think they would proudly entitle their tracker "Looking Glass". Or would they call it debugservice_1223?

<comment><USER21> 3.5) Most users insist that this isn't okay, that addon installations should be approved by the owner of the computer.

This isn't about what the addon itself does or does not do, it's the principle of force-pushing unwanted content without prior affirmative consent.

This would apply even if the addon was just a stub that didn't have any executable code in it. In this case, it's worse: an ad.

<comment><USER20> I would agree with you, if the add-on in question was not developed, shipped, and offered by the people who made the browser, of which the add-on sandbox is a part.

In my view, that sandbox is a trusted area between the browser and the user.

Mozilla has the privilege accorded to it as the developer of the browser, to modify the addon sandbox so long as they don't infringe on my interests, e.g., security, stability, privacy, speed.

For example, Chrome automatically disable extensions that ask for too many new permissions upon update. Chrome will also make it difficult to add extensions that are not listed on the chrome store.

If we remove the right for browser developers to install, uninstall and alter add-ons, then we're essentially forcing them to modify the browser instead, which is overkill for the add-on in question.

At the end of the day, if you can't trust the developers of your browser, then you should install another one and disable add-ons entirely.

3.5 falls into 4.

</comment></comment></comment><comment><USER22> In the Preferences, scroll down to "Data Collection and Use", and disable _everything_.

I know that you only need to need to turn off "install and run studies", but this has now cost Mozilla all telemetry data from me, and I encourage everyone to do the same.

<comment><USER23> I've switched to Waterfox, because of things like this (including the Cliqz issues). I'm all for Mozilla making money and trying things, the problem is the way in which they do it. They fail to respect the users enough to communicate things, and have not been behaving like a user-friendly transparent company for some time now. I was a big enough fan to regularly donate and urge friends to do the same, but something has gone wrong inside the company.

<comment><USER22> I heard about Waterfox, but support for legacy extensions is a huge warning sign. I don't want to be stuck on FF56 technology forever.

</comment></comment></comment><comment><USER24> What the fuck Mozilla? You can't just sideload extensions that are _literally ads_. There is no universe in which this is even a little bit okay.

[http://qutebrowser.org/](http://qutebrowser.org/)

<comment><USER25> And this is exactly what I'm going to do, switch to a simple browser, in my personal computers. If they programmed firefox to be capable of doing thinks like this, then definitely I cannot trust them anymore.

</comment></comment><comment><USER26> Go to settings, look in Firefox Data Collection and Use.

Why are these turned on automatically? Plus, I turned mine off, and now they're back on again, with this looking junk installed.

What the heck Mozilla? What happened to caring about the users? We definitely can't trust Mozilla anymore.

<comment><USER27> Firefox has a tendency of resetting it's settings. I think the UI calls it "Refresh", but it's basically yet-another-nagbar that we all know and hate.

</comment></comment><comment><USER28> Out of _literally_ all the software vendors I know, including the one I'm working for, Mozilla is the one I'd have least expected to allow such a thing. I'm very surprised (Negatively, needless to say)

<comment><USER29> I would have said the same thing until they integrated the W3C Encrypted Media Extensions. It's clear they lost their way some time ago.

<comment><USER30> Why? They allowed proprietary extensions (e.g. Flash) from the start. I don't like it, but I don't see how it represents a loss of their way. Mozilla was never GNU.

<comment><USER29> Big difference between an extension and being integrated into the browser. It's directly analogous to the difference between your OS being closed source and your OS being able to run closed source programs. The former is a liability; the latter is an ability that you grant to users to use the system the way they want.

<comment><USER30> The CDM modules are not integrated with the browser. The browser only has an (open source) sandbox to run them.

</comment></comment></comment></comment></comment><comment><USER31> Mozilla Firefox installer is signed by a code-signing certificate. But at the very end it means nearly nothing: if the developer cannot be trusted, no amounts of certificates, green bars, smart screens, stores and walled gardens can fix that.

That's a very important point to grasp, as I hear a lot of voices nowadays claiming that the modern security model (read walled gardens of all kinds) is the universal panacea.

Just the opposite, it brings a false sense of security making you more vulnerable. It also tends to inhibit a healthy and free market competition when a lot of potentially good software suppliers are gated off from the walled gardens from the start.

<comment><USER32> In general though, what is the alternative to trusting the source and distributor of a piece of content? As you've noted, if you can't trust the developer, the walled garden is irrelelvant... But if you can't trust the data source, isn't basically everything about the medium irrelevant?

In contrast, if you do trust the data source, why is a walled garden model of security worse than alternatives?

</comment></comment><comment><USER33> Somewhat tangential to this particular issue, but this is a good lesson for developers in why you should be dry and explicit in your writing.

Sure `alert("FFFUUU WHY U NO WORK");` keeps you entertained for 5 minutes while you debug a problem but when that accidentally gets to prod...

<comment><USER34> I see you, but your example outlines a problem with the process/workflow, not with the developer.

<comment><USER35> GP meant the style of _writing English_ , not code. Funny messages almost always end up causing problems at the end of the day.

</comment></comment></comment><comment><USER36> HOLD THE PHONE

The support thread links to [https://support.mozilla.org/en- US/kb/lookingglass](https://support.mozilla.org/en-US/kb/lookingglass).

That page says, in a clearly delineated box,

> _No changes will be made to Firefox unless you have opted in to this > Alternate Reality Game._

PLEASE EXPLAIN THIS INCONSISTENCY.

<comment><USER37> Hopefully, it's a bug, and that addon wasn't intended to be installed (much less active) universally like it is.

That doesn't make it OK, but it would make me look at them with suspicion instead of hostility.

</comment></comment><comment><USER38> Ffs .. I've just checked my addons b/c of the headline and sure enough it has been installed against my will.

I've been very loyal to mozilla over all these years but this really is not ok. If they keep doing shit like this I'll switch to a fork.

</comment><comment><USER39> I just wanted to add a few things.

1\. I notice it yesterday, only because Avast was showing I have a low trust level Add-On installed in Firefox.

2\. I googled it, and the first results was from Mozilla, showing it was part of their studies and experiment.

3\. That was Ok, because I trust Mozilla, although somewhere in the back of my mind I thought every studies were supposed to be opt-in, since I have a few Add On installed in the week and I dont restart my browser, I thought i might have clicked it by mistake.

4\. Now I am reading this through, I am more then worried. If I am reading the online comment correctly, Mozilla installed an Add On without user permission, enabled, collected data, and not for their own UX studies but a third party.

And to make the matter worst, that Add-On is now gone. It disappeared in my Add on Screen now I just check. Call me old fashion but that is not how i view privacy.

Like I said before, Mozilla's management and culture has a tendency of self destruction and messing things up right after they start being good. Still this is turning around much quicker then I thought.

<comment><USER40> I cant find any indication that Mozilla was collecting any data from this addon, either for themselves or for anyone else. The only way anyone would even be affected by it is by going to one of 3 hard-coded websites owned by the network behind Mr. Robot (a show known for putting easter eggs all over the web) and hovering over some text. It's definitely a dick move, but it isn't spyware as some people are saying, just a very poorly executed promotion.

</comment></comment><comment><USER41> If they state as an explicit principle that no addons/studies are actually enabled unless the user opted in, then I'm going to give them the benefit of the doubt that _if_ that happened to users that did not opt in, it was a terrible mistake (I.e a bug).

I can tolerate bugs, much more than I can tolerate sneaky app behavior. But I hope the statement about explicit opt-in will be repeated, and this will be explained.

At first I thought it must have been users that explicitly had opted in, but with so many users claiming they haven't, it seems unlikely.

The next possibility is that preview versions have things opt-out instead of opt in (because in preview versions you need more data from users - <USER2> for closed alphas etc) - _but_ then this should be very clearly explained on download/install.

<comment><USER41> I haven't understood whether this thing is completely inert or actually does anything without opt in.

If it is downloaded and listed without opt-in, but only actually invoked after opt-in, then I'll call it acceptable (not great, but not terrible either)

<comment><USER42> The source is at [https://github.com/gregglind/addon- wr/](https://github.com/gregglind/addon-wr/)

Its startup is controlled by the addon/bootstrap.js file. Per line 22, it's completely inert unless the user manually toggles `extensions.pug.lookingglass` in about:config: [https://github.com/gregglind/addon- wr/blob/59659431fd2a75c33...](https://github.com/gregglind/addon- wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js#L22-L24)

</comment></comment></comment><comment><USER43> Mozilla can't stop doing crap like this. I love the engineering behind it and thr tech but I don't want any of your shenanigans. This makes me affraid to update.

</comment><comment><USER44> I like Mozilla a lot. And this extension doesn't really bother me, since it's benign.

But oh boy, do they have a talent for always doing benign and harmless things that look bad at first glance. It's almost like they want to turn away typical messaging board users.

</comment><comment><USER45> Menu > Options > Privacy & Security > untick Allow Firefox to install and run studies

I deliberately kept that enabled initially but if they're going to use it for Adware..

<comment><USER46> If you're still using Firefox after this it's probably safest and best just to disable everything under Firefox Data Collection and Use

</comment></comment><comment><USER47> While I agree that releasing this as an undocumented extension was a poor PR move, in practical terms, I don't see how this is any more insidious than the 'no internet' dinosaur jumping game built in to chrome.

Both are first-party. The difference seems to be that the dinosaur game keeps you entertained, where as this hopes to promote awareness of privacy/security.

<comment><USER48> The dinosaur was not placed there by a movie studio to promote a random.movie.

<comment><USER47> Neither was the Looking Glass extension.

<comment><USER49> It is related to Mr Robot

</comment></comment></comment></comment><comment><USER50> FF 57 installed from Debian unstable repository has "Data reporting is disabled for this build configuration" \- which disabled, in theory, the shield "studies" as well. I don't know who made this decision at Debian, but thank you.

<comment><USER51> I wonder if the Ubuntu stable ones have this too?

<comment><USER49> Ubuntu once sent everything typed in the search bar to Amazon, so...

</comment></comment></comment><comment><USER52> And this is one of the reasons I stopped my yearly donation to the Mozilla foundation even if I love the new FF. If they need money so badly they should push their donation campaign and keep their products clean instead of pushing some shady alliances with big corporations.

</comment><comment><USER53> Canceled my monthly donation because of this.

<comment><USER54> I deleted my Facebook because of this and I'm much happier as a result.

</comment></comment><comment><USER55> So, a lot of people in this thread are saying that Mozilla is a non-profit. There are in fact two Mozillas. One is the Mozilla Foundation, which is the non-profit. They are not involved with Firefox development, as I understand it. The Mozilla Corporation, which I think is owned by the non-profit, does the development. I think the foundation just does cute videos and outreach and other things not directly related to writing software. I also understand that if you donate money to the Mozilla foundation, the money would not make it to Mozilla corp and thus would not pay for the salary of any Firefox hacker.

I've never quite understood how exactly does this financial arrangement work and I would be grateful to anyone who could explain this to me.

<comment><USER56> It's the other way around - the foundation owns the corporation.

[https://en.wikipedia.org/wiki/Mozilla_Corporation](https://en.wikipedia.org/wiki/Mozilla_Corporation)

</comment></comment><comment><USER57> I don't remember if this is opt-in or not, but I do not have it in my Firefox. Maybe I just removed it myself immediately after first install, when I went through to update all of the privacy and other browser settings.

I agree that it seems like a crappy extension, and people should be upset about things being preloaded to their browser.

But there's a point here to be made, that if you're concerned about privacy at all today, you need to look at the settings of any software after you install it. It doesn't matter how much previous trust you have for the developers. This should just be default behavior so that any surprise is met immediately, and not after any damage it could perform has been done.

</comment><comment><USER58> Didn't I see something on here recently about Mozilla increasing its revenue significantly? [0] ;)

[0] [https://news.ycombinator.com/item?id=15880565](https://news.ycombinator.com/item?id=15880565)

</comment><comment><USER17> Anyone know how I can turn off Firefox sending technical details and interactions?

Everytime I turn this off, and restart FF it's on again.

58.0b11

<comment><USER59> If you are on a Nightly or Developer build, you can not turn it off, I asked on Mozilla's IRC.

Downloading these builds is considered opt-in into telemetry, and toolkit.telemetry.enabled is hardcoded to enabled, the opt-out checkbox literally does nothing, I was told. And about:config confirmed this.

<comment><USER60> Okay, having a checkbox that does nothing is _really bad_. The fact that the privacy policy only just says something like "this policy might not apply to non-release builds", without actually having a policy for those also is more than questionable.

</comment></comment></comment><comment><USER17> One step ahead (Quantum), two steps back.

</comment><comment><USER61> Doesn't bother me at all - I am fully acclimated to the idea that the browser and other applications _do_ run arbitrary A/B test and other code all the time.

</comment><comment><USER62> I switched to waterfox for quite awhile. I've lost trust in mozilla when they bundled "Pocket" and people then didn't think much of it. When you lose ability to control the browser its no longer a fair game. Bundling addons, changing settings, ads and "enhancements" no one asked for, all eroded trust. Not to mention its aping Chrome more and more each version. We need more firefox forks, not less. Chrome has dozens, because the privacy threat from google is obvious: firefox hdoesn't have that much forks,because its trusted by distro makers to be safe(but its not, as mozilla just proved). People are upset when this implicit assumption that Firefox is the only browser(among modern graphical browsers) you can trust is actually false.

</comment><comment><USER63> There is more information on this Reddit post:

[https://www.reddit.com/r/firefox/comments/7jvm2t/this_lookin...](https://www.reddit.com/r/firefox/comments/7jvm2t/this_looking_glassmr_robot_sht_really_psses_me_off/)

<comment><USER64> The original thread from 2 days ago: [https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_loo...](https://www.reddit.com/r/firefox/comments/7jh9rv/what_is_looking_glass/)

</comment></comment><comment><USER21> Better yet, it appears that these "studies" (read: Mozilla pushing addons to your browser without notification or permission) are default opt-out.

Will they stop doing it? Of course not. I can't recall any time that this company has changed course in response to outcry.

<comment><USER65> I can: when they renamed firebird to firefox.

<comment><USER66> Was that outcry? I thought it was that or get sued. Been a while, though, so maybe I misrecollect.

</comment></comment></comment><comment><USER67> TechCrunch and Gizmodo just picked up the story:

[https://techcrunch.com/2017/12/15/mozillas-mr-robot-promo- ba...](https://techcrunch.com/2017/12/15/mozillas-mr-robot-promo-backfires- after-it-installs-firefox-extension-without-permission/)

[https://gizmodo.com/mozilla-slipped-a-mr-robot-promo- plugin-...](https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-into- firefox-1821332254)

Also AFAIK the second link has the first official response of any kind? "A representative told Gizmodo the company is looking into the issue."

</comment><comment><USER68> It's a PR disaster from Mozilla. I was once a Mozilla rep and I'm ashamed of this. Studies like these should always be turned off by default and the user can opt in voluntarily. But launching Firefox and digging into the preferences to find that I'm enrolled into some studies by default is unethical for me. Sadly, I'll have to switch to Brave or some other privacy concerned browser until I see an official statement and action from Mozilla. I'm sure the management there have something to do with all of this.

</comment><comment><USER69> Big Browser is watching. Browse freely with Firefox.

[https://pbs.twimg.com/media/DDsLeqvV0AE1k-2.jpg](https://pbs.twimg.com/media/DDsLeqvV0AE1k-2.jpg)

The hypocrisy is amazing.

</comment><comment><USER70> I actually discovered this because my browser would not stop running at 100% cpu utilization about 3 days ago, not doing anything, just sitting at Google.com with one tab open. It freaked me out because I couldn't find any documentation on the extension. Once removed Firefox was running fine again. I guess I'm relieved to know it wasn't some malware or something more sketchy, but I am wondering what it was doing pegging my cpu at 100% whenever my browser was open...

<comment><USER42> Whatever you experienced is very unlikely to be caused by this add-on. The add-on only initializes if you manually dig into about:config and enable `extensions.pug.lookingglass`. Otherwise, it just starts up once at browser launch, checks that preference, and shuts itself down. ([https://github.com/gregglind/addon- wr/blob/59659431fd2a75c33...](https://github.com/gregglind/addon- wr/blob/59659431fd2a75c33ac70a0e6e3e193a01ff8f66/addon/bootstrap.js#L22-L24))

If you're able to consistently reproduce the issue, please let me know.

</comment></comment><comment><USER71> The best way to disable these things is to go to about:config, search and delete/replace all mozilla urls. For this particular case, the api url is probably in "extensions.shield-recipe-client.api_url" [0]

[0] - [https://dxr.mozilla.org/mozilla- central/source/browser/exten...](https://dxr.mozilla.org/mozilla- central/source/browser/extensions/shield-recipe-client/bootstrap.js)

</comment><comment><USER72> I'm using FF57 and did not get this addon. Was I just lucky?

<comment><USER73> same. is it just US stuff?

<comment><USER22> I'm in Germany and it was installed here.

</comment></comment></comment><comment><USER74> Once again saved by [https://github.com/pyllyukko/user.js](https://github.com/pyllyukko/user.js)

</comment><comment><USER75> I just checked my installation of Firefox and this addon was present as well. The developers involved (Greg Lind et al) should acknowledge this and apologize.

<comment><USER76> Same, why is this in my addons..?

I really don't understand what they were thinking.

</comment></comment><comment><USER58> I checked out FF for the zillionth time the other week after the Quantum release hoping to love it, but the deep Pocket integration was just too offputting. Turning it off requires some Googling. There were other irritating commercial things too. It's a shame. FF is probably the most important open source project in the world and it's a shame they do stuff like this. I'm still on Chrome :(

<comment><USER77> > but the deep Pocket integration was just too offputting

You mean the single button that does _literally nothing_ until and unless you click on it?

<comment><USER78> Add a couple more buttons and hey, you've got a toolbar going.

Why can't they just make a web browser that's... just a web browser? Chrome has never had buttons to email pages with gmail, record videos onto YouTube, share pages on G+ etc.

<comment><USER79> The default new tab in Chrome contains links to all of those things and more.

<comment><USER80> Not exactly a great example if Mozilla is trying to claim the high ground.

</comment></comment></comment></comment></comment><comment><USER81> From the wikipedia article. linked in the ticket

> Shield Studies are available on all channels. Individual studies can be opt- > out or opt-in and any and all data being collected will be declared openly. > After confirming willingness to participation, a self expiring add-on will > be installed on the user's machine.

Mozilla is only installing an experimental feature ass an add-on if they opt in.

</comment><comment><USER82> As of about 5:30 GMT it looks like the addon was automatically removed from my browser. I know I saw it a couple hours ago.

</comment><comment><USER83> What I really do not understand is why this game thing was installed automatically given that websites can ask the user to install an extension when they land on a webpage. A popup that is part of Firefox shows up and asks the user if he really wants to install it.

</comment><comment><USER84> Is the "Unknown" part in the title really unknown, or just Mozilla trying to protect its developer(s) from pitchforks? If it's really "unknown", then that's the really concerning part.

</comment><comment><USER85> I haven't noticed this extension sending data to outside services. Did somebody find if/where it does that? If it is sending personal or browsing- related data out, we can flood the servers with garbage.

</comment><comment><USER86> Posted here a few days ago about how Mozilla being for-profit joined at the hip with a non-profit seems kind of shady, and got dogpiled for it. Then they do this as a tie-in for Mr. Robot.

Vindication!

</comment><comment><USER87> I use Firefox 58 beta developer edition in the USA and this extension didn't install automatically...

Maybe the government need to start sponsoring Mozilla so that they stop doing things like this.

</comment><comment><USER88> This is disappointing rather. When Mozilla spent $$ in advertising Firefox Quantum in the internet media articles, they could have mentioned this at least somewhere in them.

</comment><comment><USER89> Mozilla takes in about half a billion dollars per year, has anyone considered the consideration for which this money is being paid ?

<comment><USER42> That's FUD. Mozilla is a 501(c)3 non-profit, and our audited financial statements and IRS Form 990 can be found at [https://www.mozilla.org/en- US/foundation/annualreport/](https://www.mozilla.org/en- US/foundation/annualreport/)

<comment><USER55> Mozilla is... both. There's the Mozilla Foundation which is a nonprofit and the Mozilla Corporation which is very much not.

I've never quite understood what each Mozilla does, but AIUI, the Firefox development is all done by Mozilla Corp and the nonprofit does stuff like make those cute videos about how Firefox is going to save the world and make us all smiley and multiethnic.

I've talked to a number of Mozilla employees, and they also seem confused about the relationship between the corp and the foundation.

<comment><USER90> The Mozilla Corporation is 100% owned by the non-profit Mozilla Foundation, so any earnings that the Corporation makes, they either have to reinvest, put it to the side to reinvest it later or pay it out to the Foundation, where it's again in non-profit hands (i.e. forced to invest into their specified mission).

The only way that the Corporation could do shenanigans, is by paying their employees higher wages than would be necessary to hold them or is considered reasonable for the job that they do.

It was set up, because there's limits to how much money a non-profit is allowed to put to the side, which would have limited Mozilla's strategic flexibility.

</comment></comment></comment></comment><comment><USER91> This is the second spyware extension in recent memory.

How hard is it to fork Firefox with all this stuff hardcoded off?

<comment><USER92> waterfox? or perhaps pale moon are what you are after?

</comment></comment><comment><USER93> Developers have a million other ways to be cute and clever.

</comment><comment><USER94> I've been seeing the YouTube logo inverted recently. I wonder if this has something to do with it. If so. I'm done with Firefox. I've used it since it was Netscape in 1996. Enough is enough.

<comment><USER95> This has nothing to do with Firefox, it was Youtube promoting its Youtube Rewind: [https://en.wikipedia.org/wiki/YouTube_Rewind](https://en.wikipedia.org/wiki/YouTube_Rewind)

</comment></comment><comment><USER96> [https://support.mozilla.org/en- US/kb/lookingglass](https://support.mozilla.org/en-US/kb/lookingglass)

 _The Mr. Robot series centers around the theme of online privacy and security. One of the 10 guiding principles of Mozilla 's mission is that individuals' security and privacy on the internet are fundamental and must not be treated as optional. The more people know about what information they are sharing online, the more they can protect their privacy._

...which you've done by installing a fishy-looking addon without our permission and making us less likely to trust you?

Well-done, Mozilla.

<comment><USER97> If you clicked on the link about shield studies you'd see it says they're opt in, did you not getting prompted about it?

<comment><USER98> Apparently it's getting loaded anyway for some people that say they had "Studies" disabled and/or "Studies" itself became re-enabled.

The whole idea of slipping paid advertorial content into what are billed as "research" kind of gives the lie to this whole thing and is why I never turn these on in any product. Which is also why it's now "opt-out" by default, and why it will eventually not be an option at all. It's all for our own good, you see.

<comment><USER64> You don't just need "Studies" enabled, you also need to explicitly opt-in to each specific study on an individual basis:

> Participation in an individual study is opt-in

Source: [https://wiki.mozilla.org/Firefox/Shield/Shield_Studies](https://wiki.mozilla.org/Firefox/Shield/Shield_Studies)

If that didn't happen in this case, then I suspect it's probably a bug.

<comment><USER99> > you also need to explicitly opt-in

Wrong, as far as I see: Looking in my about:config, I see

        app.shield.optoutstudies.enabled=true
        browser.onboarding.shieldstudy.enabled=true

_enabled by default_. The settings that I've changed from the default are shown in bold. These aren't bold. Those are the defaults. Everybody can check.

That means that the user must actively take steps to disable them, if he knows that they exist and where he can disable them.

Every time the user creates a new profile, and most probably also when he "refreshes" an old one, he has _by default_ the studies _allowed._

It's even worse in other aspects: through the UI the "Allow Firefox to install and run studies" can be unchecked but it doesn't change the value of "experiments.enabled" to false in about:config.

Apparently the "experiments" allow Mozilla to install the "experimental" extensions to any user, without him knowing. And these extensions are invisible in the GUI! Even if the user goes to the about:config and sets extensions.ui.experiment.hidden to false, it will be automatically set to true again.

<comment><USER64> Are you sure that's what those config options do? I tried looking them up, but they don't seem to be listed in Mozilla's config documentation: [http://kb.mozillazine.org/About:config_entries](http://kb.mozillazine.org/About:config_entries)

According to the Wiki page I linked in my previous comment, global settings shouldn't even matter in this case; since each SHIELD study must be opted into on an individual basis. (Or at least, that's how it's _supposed_ to work.)

Edit: Looks like the wiki was updated to state that some studies can be opt- out rather than opt-in. This also seems in-line with the documentation for SHIELD, which has a section on opt-out studies: [https://normandy.readthedocs.io/en/latest/user/actions/opt-o...](https://normandy.readthedocs.io/en/latest/user/actions/opt- out-study.html)

<comment><USER99> Your link in edit part is the answer to your question before the edit:

[https://normandy.readthedocs.io/en/latest/user/actions/opt-o...](https://normandy.readthedocs.io/en/latest/user/actions/opt- out-study.html)

"opt-out-study: Install a Study Add-on Without Prompting

The opt-out-study action installs an add-on, typically one that implements a feature experiment by changing Firefox and measuring how it affects the user."

They are obviously the topic of:

app.shield.optoutstudies.enabled=true

That I mentioned.

I see a lot of commenters trying to excuse them. The problem is, people allowed the "studies" because Mozilla claimed that they are "measuring" whatever "to make Firefox better." They never told anybody that they are selling the "studies" functionality which silently installs ("opt-out" not opt in!) to the advertisers.

I don't know how anybody can defend such an approach.

</comment></comment></comment></comment></comment></comment></comment><comment><USER100> Between broken font handling and this Looking Glass thing whatever it is Firefox 57 (Quantum) has been less than stellar.

</comment><comment><USER101> They should rename Firefox to Fiasco.

</comment><comment><AUTHOR> This is what it looks like: [https://imgur.com/a/mriUw](https://imgur.com/a/mriUw)

It scared the hell out of me! Are these guys losing their minds?

It was reported as a bug and the response thus far is indeed underwhelming for such a severe issue: [https://bugzilla.mozilla.org/show_bug.cgi?id=1424977](https://bugzilla.mozilla.org/show_bug.cgi?id=1424977)

<comment><USER102> It wasn't supposed to be visible on the addons page

<comment> mark-r I don't think that makes it better. Knowing that there's a way to get an addon installed invisibly is going to be more justification for paranoia.

<comment><USER102> You can disable these studies under Options | Privacy and Security

<comment><USER103> I hate the fact that Firefox increasingly makes me jump through all sorts of hoops to find all the hidden options to turn off their various spyware attempts. Its the Win10 of browsers...

<comment><USER104> Going through your browser settings really is quite the hoop.

<comment><USER103> Yeah, its so intuitive for the average person to type: about:config in address bar and scroll through hundreds of oddly named parameters to turn off spyware.

Comments like yours are illustrative of a certain mindset. When you encounter the complexity of domains you are not intimately familiar with (court system, law, finance, etc), and those complexities are designed specifically to make it hard for you to protect yourself, I'm sure you are just as understanding as you are now.

<comment><USER102> You're being hyperbolic, you don't need to go into about:config.

It's right in the main browser settings, under the Privacy and Security section where one would expect settings like this to be

<comment><USER6> If what you say is true, please point me to where I can find the following privacy settings in the main preferences:

      network.websocket.enabled
      network.IDN_show_punycode
      dom.event.clipboardevents.enabled
      dom.storage.enabled
      dom.indexedDB.enabled
      dom.battery.enabled
      dom.enable_user_timing
      dom.enable_resource_timing
      dom.netinfo.enabled
      layout.css.visited_links_enabled
      browser.safebrowsing.phishing.enabled
      browser.safebrowsing.downloads.remote.enabled
      browser.safebrowsing.malware.enabled
      browser.send_pings
      beacon.enabled
      privacy.donottrackheader.enabled
      privacy.trackingprotection.enabled
      dom.enable_performance
      datareporting.healthreport.service.enabled
      datareporting.healthreport.uploadEnabled
      toolkit.telemetry.enabled
      toolkit.telemetry.unified
      media.peerconnection.enabled
      media.peerconnection.ice.default_address_only
      media.peerconnection.ice.no_host
      media.eme.enabled
      media.gmp-eme-adobe.enabled
      webgl.disabled
      geo.enabled
      camera.control.face_detection.enabled
      device.sensors.enabled
      security.tls.unrestricted_rc4_fallback
      security.tls.insecure_fallback_hosts.use_static_list
      security.ssl.require_safe_negotiation
      security.ssl.treat_unsafe_negotiation_as_broken

<comment><USER105> Errr... is "dom.enable_performance" really a privacy setting?

Doing someone online searching now, not seeing an explanation for it. There is one other HN post though, also mentioning it in a privacy context, but not further info either. :/

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER106> Having issues with your extra? Beginning with Firefox 57 (in discharge), just additional items manufactured utilizing WebExtensions APIs, the new innovation for Firefox expansions will work.

</comment><comment><USER107> The cringe-worthy construction "different than" which should be "different from" makes this episode even worse.

</comment><comment><USER46> Just checked and saw the Looking Glass add-on installed on my work laptop.

I've uninstalled Firefox and will be removing it from all of my computers. I had just started slowly migrating back to it with the performance enhancements in the latest update, but honestly I don't think I can get past a breach of trust at this level.

<comment><USER15> I switched to Vivaldi a few months back and tried out FF57 recently. I really wanted to move back to FF again, but two weeks in, the performance enhancements just seem really overrated. The UI is still draggy, load times are not great.

I ended up going back to Vivaldi.</comment></comment>


Show HN: Quibi Is Doomed Site with Reactive Charts - <AUTHOR> https://quibi-is-doomed.web.app/ <comment> tren-hard I like your breakdown and effort you put into this. But I also don't think Quibi is going to fail anytime soon.

> The BBC is joining an expansive roster of Quibi investors that includes > Disney, Sony, Warner Bros., Fox, Viacom, and Goldman Sachs. Beyond that, > Google, WalMart, and Proctor & Gamble are among the service's advertising > cohorts.[1]

That's a lot of big names putting money into this.

Now look at all the people they've got making content, it's a massive list of celebrities that draws from more than just Hollywood which means a lot of demographics are covered.

This story from the la times does have a lot of back and forth debate over topics you covered [2] worth a skim

[1] [https://www.yahoo.com/entertainment/analysis-quibi- continues...](https://www.yahoo.com/entertainment/analysis-quibi-continues- excite-investors-213023272.html)

[2] [https://www.latimes.com/entertainment- arts/tv/story/2020-04-...](https://www.latimes.com/entertainment- arts/tv/story/2020-04-07/quibi-youtube-best-and-worst)

<comment><AUTHOR> Solid point. Uber has raised 26 billion, still don't make a profit and probably aren't going anywhere anytime soon. Just kind of drives me crazy the amount of money dumped into ideas that could start with very little money and become profitable on their own, or they'd just die out because it's not working.

</comment></comment><comment><USER2> I find it funny that they basically took an idea I had 13 years ago to learn programming and called it their core innovation. [http://chamilyan.com](http://chamilyan.com)

<comment><AUTHOR> Haha nice, maybe you can sue and get some of that Quibi money ;)

</comment></comment><comment><AUTHOR> I've been learning Svelte, and was annoyed at Quibi's business model, so I made a site! Hosted on firebase, it's got reactive charts, cloud functions and it should look great from mobile to mega.

</comment><comment><USER3> There is a lot of demand for online media right now. Quibi could work if it captures the attention of a certain market. It all depends on the content. If they get a show like Game of Thrones, that could be a winning formula.

I'm honestly tired of Netflix, their new content is a bit meh nowadays.

So Quibi could take off, who knows, if it has real good high quality shows.

</comment><comment><USER4> While I agree with everything you posted, I'd like to raise the saltiness and state that quibi is still better than having a CCP member approve your tik-tok post...</comment>


Show HN: Java multicore intelligence - <AUTHOR> HTTPS://github.com/keppel/pinn <comment><USER2> Maybe it was a bit early to share these 30 lines of code...?

<comment><AUTHOR> Why? It is good code.</comment></comment>


Apple to Deprecate Scripting Languages in Future Versions of macOS - <AUTHOR> https://tidbits.com/2019/06/25/apple-to-deprecate-scripting-languages-in-future-versions-of-macos/ <comment><USER2> Previous discussion 3 months ago: [https://news.ycombinator.com/item?id=20109469](https://news.ycombinator.com/item?id=20109469).

</comment><comment><USER3> About bloody time!

Apple don't keep their scripting languages updated. For example, macOS Mojave 10.14.6 ships with perl 5, version 18, subversion 4 (v5.18.4) in /usr/bin/perl; but my homebrew setup provides perl 5, version 30, subversion 0 (v5.30.0).

(And for those who don't know perl, it's been semi-permanently pinned at "perl 5" as a major version number for about 20 years due to the existence of perl 6, which is effectively a different language—as different as C++ is from C—so those minor version number differences are as significant as a major version number change in another language.)

<comment><USER4> Whoa, I've been using Mac for almost a decade and I never knew it shipped with perl!

<comment><USER5> Most Unix systems do. Apple just does a terrible job of keeping scripting runtimes up to date.

<comment><USER6> Everything seems to be frozen in time at just before a project changed to GPL 3

</comment></comment></comment></comment><comment><USER7> Title is misleading and makes it sound like Apple is removing support for scripting features that are integrated with macOS - AppleScript for instance.

More like "Apple to stop shipping scripting language interpreters in macOS".

<comment><USER8> If they ship with the OS, they're "integrated" with the OS.

<comment><USER9> Not really, no. Python/Ruby/Perl interpreters are not "integrated" into the OS like AppleScript and Automator are. They're just some binaries sitting in /usr/local/bin.

</comment></comment></comment><comment><USER10> _scripts are just text files that can do a great deal when executed by the scripting language runtime_

Microsoft have done a lot in Windows 10 to counter PowerShell malware

[https://blogs.technet.microsoft.com/poshchap/2015/10/16/secu...](https://blogs.technet.microsoft.com/poshchap/2015/10/16/security- focus-defending-powershell-with-the-anti-malware-scan-interface-amsi/)

[https://www.microsoft.com/security/blog/2017/12/04/windows-d...](https://www.microsoft.com/security/blog/2017/12/04/windows- defender-atp-machine-learning-and-amsi-unearthing-script-based-attacks-that- live-off-the-land/)

It's not foolproof but it copes with many common attacks. It's surprising Apple hasn't taken this approach.

<comment><USER11> To do so would run counter to the "Mac's don't get viruses/malware" mythology.

There's been a persistent "That's only a PC thing" for a long time. Fairly sure it was even referenced in Apple's own advertising during the "I'm a Mac, I'm a PC" phase.

<comment><USER8> Apple still advertises their operating systems as "Secure By Design". With the latest news about iOS zerodays in the wild for years, we know this isn't true.

Do a google search for "Secure By Design" site:apple.com to see where they use this term for both iOS and OSX. Someday, someone will win in court over this.

<comment><USER12> Designing for security doesn't guarantee no security issues.

Done well it should substantially reduce the number and severity of security issues. To back up your claim from a numbers standpoint you'd have to quantify the number and severity of security issues in Apple OSs vs comparable OSs that aren't "Secure by Design". That's obviously problematic in a few ways. You could also analyze the design of the OS for security flaws. Though again, finding that the design isn't perfect isn't enough. You'd need to show how the design disregards security. A proper analysis should acknowledge history, BTW.

<comment><USER13> > You'd need to show how the design disregards security.

I mostly agree with you, but don't forget the 'root login with empty password' or 'the password hint showing the password on encrypted disk unlock' issues. I don't see how anyone can claim that was secure by design. Sure, it was a bug, but a secure design would not have permitted that issue.

</comment></comment></comment></comment></comment><comment><USER14> I think its going to cause problems for developers if they completely remove them. As people won't be able to run the script to install the things that give them up to date scripts.

Its like using the default web browser to download the "browser of your choice".

There is the issue that apple usually "quarantines" executable downloads ("You downloaded this from X, do you really want to run) and these scripts do an end run around that. will apple be forcing a download of a signed package dng that installs macports or brew..?

<comment><USER15> They won't get rid of _zsh_ , which they've just adopted as the default shell going forward. Macports and homebrew can bootstrap with a shell script.

</comment></comment><comment><USER16> Don't just deprecate. Remove them entirely please. If I wanted them I would install up to date versions.

<comment><USER17> It's good practice to not just remove stuff, but to deprecate it first, to give everybody time to migrate. That's exactly what Apple is doing there. The deprecation notices clearly states that they'll eventually remove it:

> Scripting language runtimes such as Python, Ruby, and Perl are included in > macOS for compatibility with legacy software. Future versions of macOS won't > include scripting language runtimes by default, and might require you to > install additional packages. If your software depends on scripting > languages, it's recommended that you bundle the runtime within the app.

</comment></comment><comment><USER18> So not only is macOS changing from bash to zsh by default, but (potentially) pulling all scripting languages. Reduced attack surface... I like it! I had no idea Perl support was still there since I don't use it.

</comment><comment><USER19> This sounds good to me. Best practice since probably close to a decade ago has been to use scripting executables with regular user permissions in their own environment with associated required libraries per app, if not in a container.

</comment><comment><USER20> Good, they were poor at keeping them updated. Glad they did not limp into python3 and encumber the ecosystem with some version that would have to be supported for a long time.

<comment><USER21> Amusingly enough, 10.15 is the first _and_ last macOS to ship with python3 bundled as standard.

As to the rest of it, I'll just re-post the same comment I post every time some muppet starts with all the wailing and rending of teeth:

This is a perfect opportunity for FOSS to position Homebrew—a proven, successful, developer-friendly software distribution channel—as an integral part of the standard development toolkit of ALL Mac developers; up to and including convincing the Xcode team to bundle it themselves.

..

Apple serves on a plate the greatest geek market opportunity in the 20-year history of Mac OS X… and only the geeks could so totally miss it!

</comment></comment><comment><USER22> If I use homebrew or macports to install the latest versions of these languages, are their runtimes included? Just asking.

<comment><USER23> Yes, basically this news means "Ruby, python and Perl may not be preinstallled, install them yourself".

It's not a big deal for users of Homebrew or other package managers.

<comment><USER24> It's a big deal for Homebrew, which is written in Ruby and uses the version shipped with macOS to install itself.

<comment><USER25> I think that telling users to execute a shell command to install software is not the smartest idea in any case (eg. no way to verify signatures of installed software)

A standard installer package would be much better.

<comment><USER26> > I think that telling users to execute a shell command to install software is > not the smartest idea in any case (eg. no way to verify signatures of > installed software)

Installing via a shell command has nothing to do with the (in)ability to verify signatures. You aren't more protected running a random installer package than an auditable shell script from the official Homebrew repo. Also, Homebrew supports more installation methods including cloning the git repo by yourself or un-taring an archive.

<comment><USER25> Installers are signed, scripts piped from curl to ruby are not.

Homebrew circumvents all the protections built into macOS (like Gatekeeper / Xprotect etc) for convenience.

I don't think this method for distributing software has much of a future.

</comment></comment></comment></comment></comment></comment><comment><USER27> Also AppleScript?

<comment><USER28> AppleScript will remain

<comment><USER21> AppleScript's reckoning will come once Siri Shortcuts officially ships in macOS 10.16. As Steve Troughton-Smith has demonstrated, the technical guts are already present in 10.15 [1]; it's just not quite ready to roll as a _Product_ yet.

[1] [https://twitter.com/stroughtonsmith/status/11359563313603461...](https://twitter.com/stroughtonsmith/status/1135956331360346113)

</comment></comment></comment><comment><USER29> Brew.sh

</comment><comment><USER30> It's not really UNIX anymore.

<comment><USER31> POSIX defines what Unix is, and there's no Python/Ruby/Perl here:

[https://shellhaters.org](https://shellhaters.org)

[https://pubs.opengroup.org/onlinepubs/9699919799/](https://pubs.opengroup.org/onlinepubs/9699919799/)

<comment><USER30> Agreed as it relates to UNIX(R). But, I think we have all come to expect BASH and other scripting to be available on our systems.

<comment><USER31> Given that GNU stands for GNU's Not Unix then the whole puzzle is fitting together just perfectly.

</comment></comment></comment></comment><comment><USER32> So they want to make it Windows? Going to get rid of AWK next? Not cool. Far too many things rely on them.

Good internally for Apple to stop relying on them.</comment>


BitsBox – monthly programming kit for children - <AUTHOR> https://bitsbox.com/ <comment><AUTHOR> I heard this at TechCrunch last night. I enjoyed a monthly electronics kit (amplifier, radio, telgraph, etc) as a teenager.</comment>


Electron is Harmful - <AUTHOR> https://medium.com/@caspervonb/electron-is-bad-b066108e6c32 <comment><USER2> Any reason why there's not more support for the Progressive Web Apps standard on desktop browsers [1]?

It seems to me that many Electron apps these days (most chat apps: Slack, WhatsApp, Discord, etc) are super-thin wrappers around a web app that don't actually need the full desktop access offered by Electron (things like local filesystem access, multi-process execution, multi-window management, arbitrary node APIs, etc).

They just need a way for users to "install" the app so that it 1) has a separate shortcut and appears in a separate window from the browser, 2) can send notifications through the native notifications stack, and use a fallback on systems where one isn't available, 3) is available for use offline.

The Progressive Web Apps spec has answers to all of these problems, and it would vastly improve the resource usage model compared to Electron because each PWA would share the same browser runtime as the user's browser of choice, which is more likely than not running 24/7 anyways.

I know PWA was designed with mobile apps in mind originally, but it'd be a shame to limit it to that use case, as there is clearly a lot of demand for building desktop apps with web technologies, and PWA sounds like an excellent alternative to the current status quo that's dominated by Electron.

[1] [https://developer.mozilla.org/en- US/Apps/Progressive](https://developer.mozilla.org/en-US/Apps/Progressive)

Disclaimer: Please excuse me for recycling this old comment, because I do think the idea is still worth spreading.

<comment><USER3> I think pwa can replace many election app, MS thinks so too they are allowing them in the app store.

<comment><USER4> You mean UWP JavaScript apps?

</comment></comment></comment><comment><USER5> Articles complaining about electron pop up at least once every month. One thing I always see missing from them is a better idea.

The reason electron is prevalent in businesses nowadays is because it's easy to develop and deliver to customers. Apparently this comes with the price of performance loss.

Please, the next time you feel the need to use your time to write an article about how electron is "cancer", try spending a little bit of time brainstorming a better solution that still fits the bill.

<comment><USER6> I haven't tried them yet but I've heard good things about javafx and sciter. Sciter especially looks like a nice replacement for electron.

<comment><USER7> JavaFX is a actually pretty terrible and underdeveloped. On and off development and relatively low availability still.

</comment></comment></comment><comment><USER8> Disclosure: I am heavily invested in NW.JS(which is similar to electron) because my app is written in it.

I think this article complains about a problem, but that problem is not necessarily caused by electron, or electron as a whole. Hear me out. The memory leaks could be bad code in the application itself. If the memory leaks are from electron, the problem still isn't electron as a whole, it's the leaks themselves and should be fixed in the electron code.

> Bottom line; as an end user I really could not care less about how easy it > was for you to make the application, if it is not working properly it is not > working properly, being slow on today's super fast hardware is a bug.

Sure you do, by proxy. If it was easier to write, there will be more and better features, which you definitely care about. Therefore, the easier to write, the faster to develop, the more polish and the more value there is. Again, if the problem is performance, then fix the problem, don't curse the whole system.

I find many pro's making NW.JS well worth it. I can fix the performance problems as they arise, and just because developers of certain electron apps don't address performance, does not mean electron as a whole is bad.

</comment><comment><USER9> As someone who doesn't particularly like Electron, I have an honest question: Why all the hate?

Sure, it's slower and less resource-efficient, but is anyone making you use it?

Yes, it makes it easier to "just use your web developers" instead of hiring native app devs, but how many of those apps would even exist if the only path was to develop a native app?

Electron is too slow for me, so I just stick to e.g. Emacs and Sublime text. Other people get along just fine with Electron, and love VS Code.

Why can't it be fine for people like what works for them?

<comment><USER10> >Sure, it's slower and less resource-efficient, but is anyone making you use it?

Yes. Is impossed on the users by the developers using it.

<comment><USER11> You can just use an alternative. If the company you work for is mandating that you use specific tools, that's a different issue, orthogonal to electron.

<comment><USER10> Which alternative can be used if the app is made only with electron?

No all apps have multitude of implementations.

</comment></comment></comment></comment><comment><USER11> Software development is primarily an engineering discipline, so cost and time to ship must be weighted along with performance. (a classic example of a trade-off) There's no point in making things more performant than required. (Except perhaps from an enthusiast/hobbist/academic/curiosity perspective)

If we can ship apps on Windows, Mac and Linux with a near native experience, a fraction of the cost and benefiting from readily available professionals with web skills, that's fantastic.

Don't get me wrong, there are several classes of tasks where performance is a requirement. For these, Electron is indeed not a great choice. However, it's usually possible to combine it with a more suitable technology to get the desired results. For instance: VSCode uses ripgrep, a command line tool written in Rust to provide the fastest possible search experience.

> even the simplest elements like the native menu bar is not available.

Not entirely sure what you mean by that, VSCode has a completely normal menu bar on both Windows and Mac, and context menus are also native. (At least on OS X; on Windows it's hard to know what "native" even means for context menus since UWP apps and Win32 apps have completely different styles for them)

By the way, if there's a market for more efficient competitors to electron apps, these will flourish and electron apps will "lose", but that doesn't seem to be the trend.

</comment><comment><USER12> The accessibility that electron has makes it invaluable for me personally. I use it to create tools internally; tools I simply wouldn't otherwise have the time nor capability to create. In this respect, Electron is extremely helpful, not harmful.

While I'd certainly agree that a larger company that's pushing out a production product _shouldn 't_ use Electron, calling it harmful overall is like calling 3d printing harmful when injection molds / CNC milled products have a better finish. It's about using the right tool for the right job. Just because it's slow doesn't mean there isn't value in how quickly you can create things in it.

</comment><comment><USER13> > "Well, it works fine on my machine, and I only have 32 gigabytes of ram."

Tangentially, this problem is not limited to Electron. Developers should regularly test (and why not also build) their software on an old laptop with 2GiB of RAM.

I don't get why I have to bump the maximum heap size of Gradle daemons to 2 or 3 GiB just so they don't barf under their own GC vomit. Building an in-memory representation of your project's modules and dependencies (even hundreds thereof) should not take more than a few MiB if done correctly.

</comment><comment><USER14> This again?

<comment><USER15> Wow are you some sort of mind reader??

</comment></comment><comment><USER16> > You are not your end-users, and you if you are a developer most likely do > not run average hardware.

Then your end users won't buy your product and you will be forced to write a native application to not go out of business. But if your users can run it and your product is successful (ie Slack) why do you need to spend more resources to make it native?

This is like the "supporting IE matters" thing. It does matter if your target uses IE. If only a negligible slice of your target uses IE, it doesn't matter.

</comment><comment><USER17> Electron apps could be resource hogs, but VSCode is my favorite editor by far! I don't care if it'll load 1 second later. Same goes for others like Slack, Discord, Spotify. I want them to look the same everywhere I use them. I just don't care if I'll wait a bit longer for the window to show up.</comment>


Universal Basic Income and cost of things - <AUTHOR> https://medium.com/@senkorasic/universal-basic-income-and-cost-of-things-a4ab82fa8385 <comment><USER2> "However, all it takes is one savvy baker to recognize he or she could raise the prices just a little lower than everyone else, enough for people to start preferring their shop instead of the competition."

This doesn't take the free market into account. The reason the baker is forced to raise their prices is because when everyone is getting the same amount of money, they will be unwilling to work for a wage that is lower than it.

So, in addition to the employees at the bakery now requiring a higher wage, all of the people along the supply chain of the baked goods (eggs, milk, flour, etc) will also see a boost in pay (and the costs will be pushed down to the chain until it reaches the consumer).

If the baker doesn't increase prices, they will quickly go out of business.

"Which is the exact same price point as before[0], and doesn't depend on the purchasing power of the consumers (that is, it's not tied to how much money people have)"

Another problem is that UBI is coming directly out of the pockets of those same bakery owners. The boost in taxes will just mean another boost in consumer prices.

"Since it is not in the universities' interest to increase number of students, increasing the money supply for the prospective students with student loans meant that students were now able to pay more for the same thing and that universities could simply increase the tuition fee[1]. Increasing the money supply to students via UBI would have the same effect."

Universities are basically getting welfare. The cash goes directly from the government to the university. They don't really care how the student actually pays it back and also know that it can't be declared in a bankruptcy.

The result is ridiculous prices, universities getting rich, and students being in debt for decades. It would be better to take student loans out of the equation completely. We would have a more even playing field because universities wouldn't be able to charge those ridiculous prices and be forced to lower tuition costs. They also wouldn't be getting a guaranteed income stream and would have to work much harder to keep students.

We have the same problem with healthcare. Because insurance companies are paying the costs directly, the hospitals can charge $150 for a bottle of Aspirin and the patient only sees the cost after it was covered.

If you take insurance companies out, costs will go way down because hospitals will actually have to charge the real free market rates instead of the controlled market we have now.

Government controlled markets, while sounds great in theory, usually means the consumer suffers.</comment>


Show HN: Writing modern C unit tests with Criterion - <AUTHOR> https://github.com/Snaipe/Criterion

<comment><AUTHOR> Developer here.

I made this unit testing framework out of frustrations I had (and still have) with other C frameworks like CUnit or Check.

I wanted to make something much more simple, yet as powerful, and I think (and hope) I nailed it pretty much after a few months of work.

If you have any questions or suggestions, feel free to ask :)

<comment><USER2> Why did you rule out using Google Test ([https://code.google.com/p/googletest](https://code.google.com/p/googletest))?

(In case you mulled over using it.)

<comment><AUTHOR> Google Test requires you to write your tests in C++ rather than C; so there was times I just could not use it.

<comment><USER3> I'm having a little trouble imagining a situation where unit tests for a C codebase are appropriate that would be stymied by having to write the tests in C++. (Maybe relying on struct layout?)

<comment><AUTHOR> Because C hasn't been a subset of C++ since C99, there are plenty of case where trying to do C in C++ is awkward or just not possible with standard C++:

First, you'd have to wrap your header inclusions in `extern "C"` to disable mangling, then you would have to make sure you static_cast all your pointers where normally `void*` conversions would have done its job.

Furthermore, all interfaces relying on designated initializers and compound literals are broken unless you decide to compile in nonstandard GNU C++.

And there are more incompatibilities, such as using `static` or `const` in array parameter declarations or using VLA in macros which are not recognized by C++.

It's all about using the right tool for the right job, ultimately.

</comment></comment></comment></comment></comment><comment><USER4> personally I use Glib test ([https://developer.gnome.org/glib/stable/glib- Testing.html](https://developer.gnome.org/glib/stable/glib-Testing.html)) for c testing, but I'll check this out. Does this let you test what a program sends to stdout and stderr, and let you trap a subprocess to test that the program exits right?

<comment><AUTHOR> By default, if the test raises any signal or exits with anything other than 0, the test fails.

Otherwise, you can't (yet!) test if the code exits with a specific value nor simply redirect input/output, but I'll be sure to take these suggestions into account, thanks!

Both will be implemented quite soon.

</comment></comment><comment><USER5> This looks like some good stuff, but browsing through your code, it's honestly pretty opaque macro hell. Why so obfuscated?

<comment><AUTHOR> Macros are used to handle platform specific details, for the most part. I don't think it's that opaque, but then again I might be biased.</comment></comment>


Ask HN: Should developers provide time estimates? - <AUTHOR> We have debate in our company - who should provide the estimation for the duration of a task (usually part of a project). I have seen a few popular options:
- the developer who will implement the task (a somewhat prevailing opinion on the internet) - senior developers - project managers
Thinking about it a new option may have emerged: estimates should not really be needed; and I would like to explore this option below.
Let's agree first that estimates are mandated for various business reasons but we won't require greater precision than a day of work.
Now, doing a thought experiment we analyse if there would be any estimate difference for a task requiring one line of code or "Hello World!" and agree that no matter who would provide the estimate the answer will be the same - probably the smallest unit of estimation since the task is trivial and the solution is canonical.
Going forward, however we agree that there is a point where estimates will diverge even between the most seasoned developers and estimators. I would argue that in that point the divergence stems either from a difference in understanding of the problem or different approaches in solving the respective (complex) task. Since both scenarios could cause problems down the line in the project, the team should step back, clarify the requirements & approach to the solution and break it down into further tasks that are trivial enough to be executed in the smallest unit of estimation.
In summary, estimation is the wrong problem to solve, the team should spend the time to thoroughly understand the requirements and truly define the solution approach, leaving the time estimate to be just a matter of counting the generated tasks and multiplying that with the agreed smallest unit of work.
While the above is a hypothetical scenario, what are your thoughts around it? Where do you see its flaws and where do you see its merits? Is anyone doing such a thing or was it tried and failed? <comment><USER3> There are different kinds of estimates used for different purposes. When making an estimate, know what it's for and if it has any value at all or can be omitted.

Very high-level estimates can be used to decide whether to do one project or another. Here we're both guessing time/cost as well as expected value. If unclear do some work to make better guesses of time/cost or expected value.

Estimates can also be used go co-ordinate with other teams if there are scheduling dependencies. Communicate early and often. Do some work to validate estimates. Complete tasks in a way that makes other estimates more accurate. e.g. deploy the smallest feature to prod with all steps completed rather than 100% of scope 10% done. If it's an external team, make your best guess, leave some room and aim to be early because you won't be.

Estimates to fill plan/fill work weeks are mostly a waste of time. Instead identify what's important, break them down into small parts with the immediately sequenced parts in higher resolution and do as many as you can in a natural order.

You can still schedule tasks expected to be completed in a cycle but it's a direct assessment as in "I can do items 1 & 4 in the next two weeks" not an abstract each item got a team-agreed T-shirt size and you've been selected to do these ones that add up to 10 days.

</comment><comment><AUTHOR> There is a secondary discussion if developers should be accountable for sticking to estimates, and my opinion is that they shouldn't - <USER2> should be accountable for the quality and maintainability of the produced code, documentation and tests, not timelines - that's the job of the PM. A good PM will be able to observe that on average the unit of estimation takes 20% longer or shorter and adjust the project timelines accordingly. Also, if someone is worried about developer productivity, it can always evaluate it in relative terms, i.e. how many tasks generated with the above method does one developer execute vs another developer in the same unit of time.

</comment><comment><USER4> There is a fair chance I maybe an idiot but I've rarely worked on a problem where I could:

 _" thoroughly understand the requirements and truly define the solution approach, leaving the time estimate to be just a matter of counting the generated tasks"_

The problems I've been paid to solve are problems that haven't been solved yet or at least _I_ have never solved them before so I would have difficulty making a estimate.

(This isn't meant as a criticism. It's just my experience.)

</comment><comment><USER5> Is your company requiring hour or even minute accuracy of the estimate?

In my whole professional life, I have not been put in such situation, even when working as consultant where we charge by the hour -- we simply estimate by week or day then multiply.

The art part of estimation is setting expectations, or more precisely, adding and justifying buffer time, and form an acceptable narrative when the schedule deviate from plan.

<comment><AUTHOR> I mentioned that no greater precision than a day of work is required. The point of the question is not precision, but who and possibly how.</comment></comment>


California Classifies Immigration Enforcement as Misuse of Network - <AUTHOR> https://www.eff.org/deeplinks/2019/05/california-now-classifies-immigration-enforcement-misuse-statewide-law-enforcement <comment><USER2> I think it's a mistake for the EFF to get involved in the politics of enforcement of immigration law.

I support EFF's main mission. But I don't necessarily agree with their positions on these ancillary issues. I'm less likely now to support the EFF financially and otherwise.

<comment><AUTHOR> This is a bigger issue than immigration, and the EFF isn't taking a position on immigration.

The EFF identified abuse of the CLETS system before immigration became relevant.

It's now relevant since a new California law prohibits use of state resources for federal immigration enforcement (except for prosecuting property crimes and violent crimes).

So using CLETS to support mass deportations of people who aren't wanted for property crimes or violent crimes is unlawful.

Are we a nation of laws, or is it just ideology all the way down? Do we expect law enforcement to follow the law, or can they break the law with impunity?

<comment><USER3> >Are we a nation of laws, or is it just ideology all the way down? Do we expect law enforcement to follow the law, or can they break the law with impunity?

In this context there's a conflict between state and federal law, so any law enforcement would be simultaneously following and breaking the law. Personally I'm more for state sovereignty than federal control (for issues on both side of the spectrum, none of that hypocritical bullshit here), but proponents of a more centralized form of government would argue differently.

<comment><AUTHOR> There's no conflict between state and federal law.

Immigration law a federal responsibility. States don't maintain national borders.

California isn't contravening federal law, they've made it unlawful to use California-funded networks to enforce federal law.

Federal law enforcement officers are violating California law, currently with impunity. Seems to me if you believe in the rule of law, then you shouldn't support law enforcement breaking the law.

</comment></comment></comment></comment><comment><USER4> Hispanics are the largest ethnic group in California [1], so it is not surprising that they would push for laws in their own ethnic self-interest. Once immigration has progressed sufficiently, it can no longer be stopped.

[1] [https://en.wikipedia.org/wiki/Demographics_of_California#Nat...](https://en.wikipedia.org/wiki/Demographics_of_California#National_origin)

<comment><USER5> >> Hispanics are the largest ethnic group in California [1], so it is not surprising that they would push for laws in their own ethnic self-interest. Once immigration has progressed sufficiently, it can no longer be stopped.

Am I the only one who sees this as racist?

Are there no hispanic Americans?

Can hispanic Americans not be a majority?

Are hispanic Americans not supposed to care for their near and dear when law enforcement has gone bonkers?

What makes non-hispanic ethnicities so special that they can comment on hispanics as a whole?

What makes you so special to think ethnic self interested is all there can be?

<comment><USER4> > Am I the only one who sees this as racist?

Feel free to point out if there's something factually incorrect in my statement. Bear in mind 59% of hispanic Americans view their ethnicity as extremely to very important to their identity (compared to 15% of whites) [1], so it's not unfounded to say their votes would be influenced by ethnic self- interest.

[1] [https://www.pewsocialtrends.org/2019/04/09/race-in- america-2...](https://www.pewsocialtrends.org/2019/04/09/race-in- america-2019/)

<comment><USER6> Seems far more complicated than that:

"There's one obvious reason that the Hispanic and Latino vote splits up and isn't monolithic: Hispanic and Latino voters aren't one identity homogeneous group. As with every other large racial and ethnic category (white, black, Asian), there's a lot of internal diversity when you look under the hood.

Hispanic and Latino Americans, like Asian Americans, don't all come from one place. Most originally come from Mexico, but a solid number come from Puerto Rico, Cuba and elsewhere in Central and South America. And voting patterns vary across these groups. Cubans, for example, are a key voting group in Florida, and they tend to be more Republican than other Latino populations. There are real generational divides: Self-identified Hispanics who are third- generation or higher are more likely than others to self-describe primarily as American rather than Hispanic/Latino, less likely to say they have felt discriminated against because of their background and feel less connected to their country of origin. Hispanics live in a wide variety of areas, and there's some evidence that rural Hispanics moved a bit toward Trump in 2016. Evangelical Protestant Hispanics are more Republican than mainline Protestant, Catholic or religiously unaffiliated Hispanics. There's a gender gap in Hispanic voting, too. Democrats won both Hispanic men and women in 2018, but Hispanic men were more likely to vote for Republicans than women were."

[1] [https://www.washingtonpost.com/opinions/2019/03/05/trumps- su...](https://www.washingtonpost.com/opinions/2019/03/05/trumps-support- among-hispanics-latinos-is-real-dont-assume-it-will- fade/?noredirect=on&utm_term=.705f49cce3cd)</comment></comment></comment></comment>


China is building an alternative to GitHub called gitee – would you swap? - <AUTHOR> https://techcrunch.com/2020/08/21/china-is-building-its-github-alternative-gitee/ <comment><USER2> The reasoning doesn't make any sense. China's Open source code vulnerable to what external factors? Not being censored? Github getting blocked in China?

The code is all open source... You can literally just copy and mirror everything. This is a blatant move to get China's open source community to move where they can be easy controlled

<comment><AUTHOR> yes makes sense</comment></comment>


The Seven Habits of One Highly Effective Manager of Managers: Charity Majors - <AUTHOR> https://honkathon.com/2019-12-19-seven-habits/ <comment><AUTHOR> I find this a great list of behaviors to consider when you are in a leading role, maybe even if you are not in such a role, as it reflects well on your job.

</comment><comment><USER2> I really want to work for a boss like this, but the really good managers are rare.

My last "manager" didn't talk to me for nearly the last 5 months I worked at the company and I hounded him for code reviews and 1 on 1 meetings constantly. I just started to review my own code and then merge it because otherwise nothing would get done. He was a very capable engineer, but the worst manager I've ever had, even compared to the guy who i had to report to HR in a previous job because he did a lot of blatantly illegal things in regards to the employees I supervised and their working hours (mandatory overtime with no extra breaks, shorted lunch breaks, etc).

<comment><USER3> Any manager that doesn't respond to 1x1 requests _from their direct_ should probably be fired to make room for someone more competent. I'm sorry you had to deal with that.</comment></comment>


Betrayed - <AUTHOR> http://blog.seanbonner.com/2015/08/10/betrayed/

<comment><USER2> I've been really disappointed with my new Mac-book. I have a Thunderbolt Display and 4k monitor both connected to my old MacBook through thunderbolt connection.

The new MacBook has a single usb-c connector and I can't charge my iPhone, iPad or connect my thunderbolt screens to it ... WTF Apple?!?! I purchased an adaptor that has usb and a single hdmi port but what about my dual displays?

I've gone back to my old MacBook, and the new one is gathering dust. Next purchase will not be Apple

</comment><comment><USER3> tl;dr: Unauthorized updates are deleting massive fractions of he and his family's media on iOS platforms, which was discovered just after plane takeoff.

To quote a Microsoft guy, "You made a mistake, you trusted us."</comment>