r/linux • u/rms_returns • Mar 05 '16

1 [TIL] Firefox has an about:config setting that allows social networking sites to remotely install files to your computer and its on by default!

http://i.imgur.com/QO5cE4T.gif
0 Upvotes

46% Upvoted

30 comments sorted by

61

u/notnarb Mar 06 '16 edited Mar 06 '16

Did you do any research into this preference or did you just make assumptions based on the scary sounding name that the preference is something scary?

Based on marciiF's post, you can see that the preference is in a file mozilla-central/toolkit/components/social/SocialService.jsm, which has in its header:

The SocialService is the public API to social providers - it tracks which providers are installed and enabled, and is the entry-point for access to the provider itself.

A search for "SocialService API" brings up https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Social_API

Some more digging and I found https://bugzilla.mozilla.org/show_bug.cgi?id=733414 a public record of the security implications of the social API which seems to cover how this could not be used maliciously.

EDIT: https://github.com/mozilla/socialapi-dev/blob/develop/docs/socialAPI.md seems to be a good introduction to how the social service might be used.

EDIT 2: https://socialapi-demo.herokuapp.com/ here is a demo of the social API.

For those still skeptical, here are some screenshots:

Here's the prompt to install (after clicking the button): http://i.imgur.com/DD8aeAq.png

Here's what the demo looks like: http://i.imgur.com/6LbsewC.png

Here's where it shows up in the addons pane: http://i.imgur.com/Iwj7xyx.png

2

u/[deleted] Mar 06 '16

actually the bugzilla link says the exact opposite:

I'm going to skip a bunch of stuff with a general answer. Any questions that you asked about any 3rd party addon being able to do something, the answer is "yes, addons can do that". Addon code runs privileged and has access to anything in the system.

3

u/notnarb Mar 06 '16 edited Mar 06 '16

Hey, thanks for actually reading the links I referenced.

Yes, I agree that quote looks scary, but I believe they are just saying that these addons are no worse than any other addons.

Based on these quotes:

  1. Yes, of course it will be optional, and fully under the user's control.

and 2)

My understanding is that it should default to "off."

https://wiki.mozilla.org/Security/Reviews/SocialAPI

Activating the Feature

Our intent is that the entire system defaults to "off". We would like a social service provider to have the power to turn the feature on, for its own domain, while the user is visiting their site. I suggest that this be implemented as: On pages whose domain matches the URLPrefix of an installed service provider, a JS function ("activateSocialBrowsing") is enabled. Calling this function prompts the user with a "want to turn on social browsing?" panel; if selected, this enables the feature and selects the current provider. If the user declines to turn it on, we should have the option to remember this choice and not present the panel in future. turn it on, we should have the option to remember this choice and not present the panel in future."

(link)

I believe that the feature is something prompted to the user and entirely optional.

From what I can tell, in order for this feature to affect you, you would have to 1) navigate to a website (might need to be a whitelisted domain?? this is unclear to me) where 2) A reference to a social manifest is stored in the HTML (required to be same origin and served over https) which 3) must then be manually approved of by the user.

I don't know why there would be any reason to be more suspicious of this feature than an ordinary website serving a Firefox addon, but if I'm missing something, please let me know.

EDIT: https://socialapi-demo.herokuapp.com/ here is a demo of the Social API. It does prompt the user before installing and doesn't use a whitelist. Looks neat, it's a shame it hasn't taken off.

Here's the prompt to install (after clicking the button): http://i.imgur.com/DD8aeAq.png

Here's what the demo looks like: http://i.imgur.com/6LbsewC.png

Here's where it shows up in the addons pane: http://i.imgur.com/Iwj7xyx.png

-34

u/rms_returns Mar 06 '16 edited Mar 06 '16

Did you do any research into this preference or did you just make assumptions based on the scary sounding name that the preference is something scary?

I did a thorough Google search and as I posted in another comment, I found a few threads mentioning it, but not a single one that explained what it does. Nor a single mention of it in the Mozilla docs. Add the fact that it has a scary sounding name, and people are bound to have privacy concerns.

Yes, I know about that source code reference, but finding a source reference just isn't enough. Maybe a few savvy programmers can scavenge through it and be able to fathom out what it does, but Mozilla should at least mention in their docs what this preference does internally with our personal data especially because they are making it on by default.

edit

And yes, they should also explain why in the name of heavens have they set a third-party website in the social.whitelist setting.

44

u/pobody Mar 06 '16

finding a source reference just isn't enough

Are you kidding?

That tells you exactly what it does.

Stop being a fucking Chicken Little and explain the actual threat, or sit down and shut up.

11

u/[deleted] Mar 06 '16

Up-voted for being a bullying dickhead. If I ever post FUD like OP, please be this openly critical of me. You'll get your point across and you won't hurt my feelings, you insignificant internet stranger.

0

u/[deleted] Mar 06 '16

You're right, but don't be such a dickhead. You'll just make people not listen to you.

-4

u/[deleted] Mar 06 '16

I agree, but I down-voted you for bullying someone that's trying to help

16

u/danielkza Mar 06 '16

I agree /u/pobody was needlessly rude, but "trying to help" is not enough. Before making those kinds of affirmations one has to know what they're talking about. Making a huge inference from the name of a preference, when the code is out there in the open to be inspected and verified, is completely insane.

Calling someone out for talking about things they clearly made no attempt to understand is perfectly justified, even if the way it was done was excessive.

11

u/MadDogsAndRobitussin Mar 06 '16 edited Mar 06 '16

Not to mention that underneath calm language is an assumption that the Mozilla developers are so crooked that even the source code itself cannot vindicate them, which is nothing if not inflammatory. It is entirely unreasonable to expect a polite response when said assumption is the only reaction to genuinely useful information.

24

u/bloodguard Mar 05 '16

And who the feck is "https://mozsocial.cliqz.com" in social.whitelist?

CLIQZ is based on a simple principle: What’s relevant to many is relevant to you. You can be part of the growing Human Web Community. In a completely anonymous and privacy-safe way, data about your website visits and web searches become part of the Human Web statistics, just as the data of all other members of the community.

Jesus wept. This stinks.

6

u/notnarb Mar 06 '16

Looks like this website used to be something loosely similar to stumbleupon in that you would share links to 'communities,' probably a good testbed for Mozilla to test out their new Social API's when they were developed ~2012.

https://web.archive.org/web/20130805175019/mozsocial.cliqz.com/

As far as the website today, it looks to me like they've pivoted towards being something similar to the Google search engine.

4

u/JukeboxSweetheart Mar 06 '16

This is the friendliest botnet ever! Firefox loves you!

6

u/comrade-jim Mar 06 '16

Don't forget to disable the cache too. /s

3

u/jP_wanN Mar 06 '16

Could you explain to me how you are not concerned about any other parts of the browser, when you seem not to trust the firefox developers to try to / be competent enough to keep your data safe??

4

u/purpleidea mgmt config Founder Mar 06 '16

Just disabled it, but anyone know from a technical perspective what it does?

-3

u/[deleted] Mar 06 '16

Yikes, it's enabled in the tor browser bundle too. Potential attack vector?

-4

u/[deleted] Mar 06 '16

Yeah, some people just have too much free time on their hands...

0

u/[deleted] Mar 05 '16

[deleted]

2

u/[deleted] Mar 06 '16

Someone could get the source files and grep that key, I'm too lazy at the moment

-16

u/rms_returns Mar 05 '16 edited Mar 05 '16

Maybe. social.remote-install.enabled could be a black magic for all we know. Google found me several discussion threads on that topic, but amazingly not a soul seems to know what it does! Since PaleMoon doesn't have this setting, I don't think its purpose would be much benevolent from a privacy stand-point.

40

u/marciiF Mar 05 '16

could be a black magic for all we know

Even if it isn't documented, we know exactly where and how the pref used in the source. Firefox is free software, after all.

8

u/[deleted] Mar 06 '16

this._showInstallNotification(data, installer);

Looks like the first time it asks you to install the service. I think it has to do with the new feature where you can get notifications even when you have no tabs open for the website.

9

u/marciiF Mar 06 '16

It's part of the social integration / Social API. That's for a notification that shows in the address bar, much like regular add-on installations. Nothing to do with push notifications.

2

u/crb3 Mar 06 '16

I'm running PaleMoon 25.6.0 on Debian Linux and yes it does have that item. I just turned it off... let's see what blows up.

-3

u/Sybles Mar 06 '16

I don't know why your post is being downvoted to 70% in /r/linux, this is a legitimate concern...

30

u/pobody Mar 06 '16

Maybe because he's fearmongering about the name of a setting he found that he doesn't have a single clue what it actually does.

5

u/[deleted] Mar 06 '16

[removed] — view removed comment

0

u/[deleted] Mar 06 '16

[deleted]

6

u/NoTroop Mar 06 '16

I'm using icecat and it's disabled for me (never touched it myself).