Hacker News Reader

Hacker News

Comment by brador | Hacker News Reader

Parent Full thread

brador

What is Normandy?

View on HN

https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout

So is that a backdoor into my prefs? How can I check if Normandy is active on my installation?

Type about:config in the address bar and search for 'app.normandy.enabled' flag.

here the flag is true but the extensions are still unsupported

It may take a little time for the partial fix to be distributed.

Well that's interesting. I see Normandy enabled, but if I go to the "Privacy and Security" section of the preferences page I see all the data collection and use stuff disabled. There's no obvious way to disable the Normandy back door.

Oh well, at least we don't have another season of Mr Robot spam to look forward to.

> There's no obvious way to disable the Normandy back door.

???

It's a publicly documented feature with a publicly documented way to disable it.

With an obscure name and no correlation to all the other spying and backdoor ING Mozilla are doing. Is this really the best option tog etaprivacy focused browser? I think this is all very worrying.

Can you elaborate on what 'other spying' Mozilla does? Do you mean their telemetry?

Spying was the wrong word. But yes, the telemetry. The google analytics that are hidden on the extensions page, that only listen to the Do not track, but not the turn off telemetry checkbox. Sadly it just doesn't seem to stop.

It's named after a world famous beachhead of an invasion. The name isn't that obscure for a feature that invades the userbase with a takeover.

I am not sure what 'spying' Mozilla is doing, but I agree this should be better named and better highlighted.

Presumably the logic is something like:

    if (studies.enabled) {
      if (normandy.enabled) {
        ...
      }
    }

Not so in Firefox for Android. No normandy to find.

Something with a public wiki page describing what it does exactly is hardly a backdoor.

Also here's the code for the server: https://github.com/mozilla/normandy

The wiki entry evidently doesn't describe what it does because according to the wiki entry it allows for the enabling and disabling of preferences. The updating of a certificate is beyond what is described in the wiki.

Mozilla should follow up with a post describing exactly how Normandy works and the full capabilities it gives them.

From what I understand, Normandy is an infrastructure for delivery of some changes to some of Firefox users (or all of them). There are two major use cases: preferences rollout and studies. In the first case default values of preferences get changed (if your pref has non-default value, it won't affect you). In case of studies some piece of code gets delivered and executed, which cat do anything. In this hotfix the study installs add-on, which in turn installs certificate.

Reply on news.ycombinator.com