[superkuh]

Also ironic given that Mozilla continues to violate software freedoms by removing control from the very users they pay lip service to protecting. Until they go back on requiring their own cryptographic signature on all add-ons and the Facebook style walled garden this creates these PR moves will fall flat.

And before anyone says,

Yes, you can use developer version but that's a beta (yes, it is). Using a beta as your daily driver shouldn't be a thing.

Yes, you can use the unbranded not-Firefox version. But now you have to install it manually (not in any distro's repository) and keep it up to date manually.

[confounded]

Can you help us understand the problems with this?

[bad_user]

The problem is that every time Mozilla is mentioned on HN, a contingent will see it as an opportunity to bitch and moan about Mozilla not being the FSF.

[DonHopkins]

Don't get screwed by security! You can easily tell if they're truly sincere RMS disciples or just ersatz RMS poseurs by trying to log in to their account using their login name as their password.

http://www.gnu.org/philosophy/stallman-kth.html

>When I found out about those, I overthrew them. The first time, I happened to know the password of one of the people who was included among the elite, so I was able to use that to turn everyone back on. The second time he had changed his password, he had now changed his sympathies, he was now part of the aristocratic party. So, I had to bring the machine down and use non-timeshared DDT to poke around. I poked around in the monitor for a while, and eventually figured out how to get it to load itself in and let me patch it, so that I could turn off password checking and then I turned back on a whole bunch of people's wheel bits and posted a system message. I have to explain that the name of this machine was OZ, so I posted a system message saying: “There was another attempt to seize power. So far the aristocratic forces have been defeated—Radio Free OZ”. Later I discovered that “Radio Free OZ” is one of the things used by Firesign Theater. I didn't know that at the time.

>But gradually things got worse and worse, it's just the nature of the way the system had been constructed forced people to demand more and more security. Until eventually I was forced to stop using the machine, because I refused to have a password that was secret. Ever since passwords first appeared at the MIT-AI lab I had come to the conclusion that to stand up for my belief, to follow my belief that there should be no passwords, I should always make sure to have a password that is as obvious as possible and I should tell everyone what it is. Because I don't believe that it's really desirable to have security on a computer, I shouldn't be willing to help uphold the security regime. On the systems that permit it I use the “empty password”, and on systems where that isn't allowed, or where that means you can't log in at all from other places, things like that, I use my login name as my password. It's about as obvious as you can get. And when people point out that this way people might be able to log in as me, i say “yes that's the idea, somebody might have a need to get some data from this machine. I want to make sure that they aren't screwed by security”.

[superkuh]

It is supposed to provide increased security for users that don't know what they are doing. But because it's not feasible to have humans review every single change made to every single add-on in a reasonable time they've automated the system. So now instead of providing security all it does is make a walled garden where everything has to be approved by mozilla but no one actually checks what they're approving.

So it both provides a false sense of security and prevents users from being able to control the software they run on their own machines.

[IAmLiterallyAB]

It does ensure that the add-ons you download were at least approved once to enter the add-on store. So if you were at a sketchy website and were prompted to install an add-on, it would fail the check. So that's something. I agree it could be a lot better from a security point of view, but I don't think it's malicious.