8 ms·

Using a web browser from a company basing most of its income on web advertising does come with such unpleasantness. I was hoping mozilla would have their users

by blub 11y ago

Using a web browser from a company basing most of its income on web advertising does come with such unpleasantness. I was hoping mozilla would have their users' back, but a default install of Firefox also makes multiple connections to mozilla, google and other domains when started. Some extensions (notably NoScript and Ghostery) ping the mothership. Safari connects to configuration.apple.com and the google website blacklist. uBlock for Safari tries to update itself even if no one asked it to. Later edit: I have been told that I am perhaps being unfair to Mozilla. Let's see - I started reading https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making..., to see how I can stop Firefox from connecting to servers without being requested to. While it's nice that they provide this page, this article's breadth only serves to prove that this browser is out of control when it comes to making connections to servers by itself. I have the following settings: * disabled Firefox health report * disabled crash reporting * never check for updates * do not check for addon updates * block reported attack sites * block reported forgeries After reading the page, it turns out that I also have to disable the following from about:config: * the addons blocklist * link prefetching * DNS prefetching * speculative pre-connections * firefox Hello * tiles, even if they were already disabled from the UI * the default search engine geo-location * the what's new page * add-on metadata updating * the heartbeat For reference, here are the connections that Firefox tries to establish immediately after startup: Outgoing to self-repair.mozilla.org (54.230.200.16), Port https (443), Protocol TCP (6), 0 B sent, 0 B received Outgoing to shavar.prod.mozaws.net (52.26.89.67), Port https (443), Protocol TCP (6), 0 B sent, 0 B received Outgoing to safebrowsing.google.com (2a00:1450:4001:809::1005), Port https (443), Protocol TCP (6), 0 B sent, 0 B received Outgoing to tiles.r53-2.services.mozilla.com (52.25.98.110), Port https (443), Protocol TCP (6), 0 B sent, 0 B received Outgoing to cmp-cdn.ghostery.com (54.152.180.212), Port https (443), Protocol TCP (6), 0 B sent, 0 B received Outgoing to search.services.mozilla.com (54.69.18.27), Port https (443), Protocol TCP (6), 0 B sent, 0 B received

newman314 11y ago
It would be nice if there was an extension/script that enabled "max privacy mode" by frobbing all these config bits.
rockdoe 11y ago
I was hoping mozilla would have their users' back, but a default install of Firefox also makes multiple connections to mozilla, google and other domains when started. Firefox checks for updates, and will update the malware/phishing databases a bit after startup. That's actually the same SafeBrowsing the OP mentions. All of this can be toggled. I'm not sure what your vague "other domains" is. I'm a bit puzzled at the extreme shortsightedness of a browser checking for security updates being branded as "not having their users' back".
- bobbyi_settv 11y ago
  Isn't also shortsighted to expect every application to implement its own system for checking for security updates? Wouldn't it be more secure to have this managed by the OS or a package manager instead of hoping every application does it correctly?
  - mcherm 11y ago
    That depends on whether the OS or package manager does a better job of providing security updates, or the application does. Historically, browsers -- because of their enormous potential risk (easy to exploit) -- have done a better job of providing security updates quickly than have other tools.
  - acdha 11y ago
    That's only true if the OS has a solid, secure and open package manager. Linux users have had that since the mid-90s but it still doesn't exist for Windows or OS X users unless you count their respective app stores or are talking about a few niches (Flash, drivers) where Microsoft is willing to distribute things through Windows Update.
BuckRogers 11y ago
Perfect is the enemy of better. As long as you stay away from browsers with strong for-profit origins, especially Google who thrives on data mining, you'll be better off.
- EC1 11y ago
  Yeah hold on let me fire up Opera. No. What do you suggest? Compile Chromium from source?
  - coldtea 11y ago
    Firefox. Explorer. Safari. All three don't make their money off of data-mining / ad revenue. Not that I'm advocating for them (I use Chrome myself), but those fit what the parent suggested.
    - Confusion 11y ago
      You should really read up on where Mozilla's money comes from. See the financing section of https://en.m.wikipedia.org/wiki/Mozilla_Foundation https://en.m.wikipedia.org/wiki/Mozilla_Foundation
      - coldtea 11y ago
        From selling its "default search engine" spot -- I'm on this web business professionally since 1995, I know that. That's not direct ad sales and Mozilla wasn't created with the specific purposes to sell ads or collect private information, nor is owned by an ad-selling company. Besides you can change the default search engine in a heartbeat.
        Confusion 11y ago
        I certainly consider that funding by direct ad sales. It's like any other affiliate model: your contribution is to get their product to be sold.
    - 11y ago
wonkaWonka 11y ago
...and don't forget: WGET is a "hacker tool"
click170 11y ago
These requests are trivial to detect and block with a proper gateway firewall like pfsense or others. Consumer grade firewalls just don't have enough options, or resources to support those options. Trust, but verify.
ljk 11y ago
> Some extensions (notably NoScript and Ghostery) ping the mothership. could you explain what this means? Been using uBlockOrigin+NoScript+Ghostery combo for quite a some time now and never realized how NoScript might be unsafe
- rockdoe 11y ago
  I'm going to guess they use lists of exceptions (NoScript) or of trackers (Ghostery) that need to be updated.
- JupiterMoon 11y ago
  I guess it's a cost benefit. Does noscript block more than it leaks? Given the noscript is integrated into the tor browser bundle it can't be that bad... Right? We hope...
- blub 11y ago
  NoScript is unfortunately quite sketchy, I don't use it any more. It has a whitelist supposedly to not break "top websites", but this list contained IMO some questionable choices last I checked it. It also tries to connect to the dev's website for no reason at all (addons are updated directly from Firefox) and after updates, "to show the release notes". Last but not least, this is the same dev which got involved in a scandal for trying to underhandedly whitelist the said website into an ad-blocking addon.
  - okasaki 11y ago
    What list is that? I'm looking at it and I'm pretty sure I personally whitelisted all of those domains. The only ones that seem to have come from NoScript are the about:... ones
    - blub 11y ago
      I reinstalled it to check again and it seems you are correct, there's nothing except about:* links. I remember it had some big portal websites I hadn't visited and would not enable JS for, however I am willing to accept I was wrong. Unfortunately, I can't edit my initial comment any more. Thanks for checking and sorry for my confusing initial post...
Aissen 11y ago
At least Mozilla documents every connection made and explains why they're made, and how to disable them: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making...
moron4hire 11y ago
Where do you think Mozilla makes most of its money? Hint: it ain't donations.
- rockdoe 11y ago
  They get money from Yahoo for putting it as their default search engine in the USA. What was your point exactly? I fail to see any relation here.
  - moron4hire 11y ago
    Is it Yahoo again? I thought it was Bing now. But it's advertising. It's advertising for whomever gets their shitty search engine in the prime real estate.
    - drzaiusapelord 11y ago
      I believe yahoo search is bing.
kalsk 11y ago
This is about Chromium, not Chrome. A lot of people assume that Chromium is safer because things like this should get caught by the community. I think the lesson to be learned here is that FOSS can be just as dangerous as commercial software if not enough people are inspecting the code and following development. It seems there are a lot of people who unconditionally trust anything that's open-source.
hsivonen 11y ago
The flipside: https://groups.google.com/d/msg/mozilla.dev.planning/wBgLRXCTlaw/sbmQagO1BgAJ https://groups.google.com/d/msg/mozilla.dev.planning/wBgLRXC... "That said, the fact that Linux distros might switch off Telemetry and [Firefox Health Report] by default causes issues right in that way: they are undercounted and [Mozilla] may disregard them completely in data-driven decisions. If you are a Linux distro package manager, think about that."
rockdoe 11y ago
I have been told that I am perhaps being unfair to Mozilla...For reference, here are the connections that Firefox tries to establish immediately after startup So: It connects to Mozilla itself and to Google (specifically their server for the malware/phishing DB). The fact that Ghostery is in there is because you have third party addons installed. FWIW shavar.prod.mozaws.net is a Mozilla server which updates the blocklist for Tracking Protection. Somewhat ironic you're complaining about it given the context.
Sanddancer 11y ago
They do have the user's back. That means not wearing a tin foil hat. In order for a modern browser to work in a halfway decent manner, they need to ensure that things are reasonably up to date, that developers see crash reports so they can discover bugs and security flaws before someone malicious does, and that lists of malicious sites get updated. Not checking for updates, not providing bug reports is the opposite of good software hygiene.

by blub 11y ago

newman314 11y ago

It would be nice if there was an extension/script that enabled "max privacy mode" by frobbing all these config bits.

rockdoe 11y ago

I was hoping mozilla would have their users' back, but a default install of Firefox also makes multiple connections to mozilla, google and other domains when started. Firefox checks for updates, and will update the malware/phishing databases a bit after startup. That's actually the same SafeBrowsing the OP mentions. All of this can be toggled. I'm not sure what your vague "other domains" is. I'm a bit puzzled at the extreme shortsightedness of a browser checking for security updates being branded as "not having their users' back".

bobbyi_settv 11y ago
Isn't also shortsighted to expect every application to implement its own system for checking for security updates? Wouldn't it be more secure to have this managed by the OS or a package manager instead of hoping every application does it correctly?
- mcherm 11y ago
  That depends on whether the OS or package manager does a better job of providing security updates, or the application does. Historically, browsers -- because of their enormous potential risk (easy to exploit) -- have done a better job of providing security updates quickly than have other tools.
- acdha 11y ago
  That's only true if the OS has a solid, secure and open package manager. Linux users have had that since the mid-90s but it still doesn't exist for Windows or OS X users unless you count their respective app stores or are talking about a few niches (Flash, drivers) where Microsoft is willing to distribute things through Windows Update.

BuckRogers 11y ago

Perfect is the enemy of better. As long as you stay away from browsers with strong for-profit origins, especially Google who thrives on data mining, you'll be better off.

EC1 11y ago
Yeah hold on let me fire up Opera. No. What do you suggest? Compile Chromium from source?
- coldtea 11y ago
  Firefox. Explorer. Safari. All three don't make their money off of data-mining / ad revenue. Not that I'm advocating for them (I use Chrome myself), but those fit what the parent suggested.
  - Confusion 11y ago
    You should really read up on where Mozilla's money comes from. See the financing section of https://en.m.wikipedia.org/wiki/Mozilla_Foundation https://en.m.wikipedia.org/wiki/Mozilla_Foundation
    - coldtea 11y ago
      From selling its "default search engine" spot -- I'm on this web business professionally since 1995, I know that. That's not direct ad sales and Mozilla wasn't created with the specific purposes to sell ads or collect private information, nor is owned by an ad-selling company. Besides you can change the default search engine in a heartbeat.
      - Confusion 11y ago
        I certainly consider that funding by direct ad sales. It's like any other affiliate model: your contribution is to get their product to be sold.
  - 11y ago

wonkaWonka 11y ago

...and don't forget: WGET is a "hacker tool"

click170 11y ago

These requests are trivial to detect and block with a proper gateway firewall like pfsense or others. Consumer grade firewalls just don't have enough options, or resources to support those options. Trust, but verify.

ljk 11y ago

> Some extensions (notably NoScript and Ghostery) ping the mothership. could you explain what this means? Been using uBlockOrigin+NoScript+Ghostery combo for quite a some time now and never realized how NoScript might be unsafe

rockdoe 11y ago
I'm going to guess they use lists of exceptions (NoScript) or of trackers (Ghostery) that need to be updated.
JupiterMoon 11y ago
I guess it's a cost benefit. Does noscript block more than it leaks? Given the noscript is integrated into the tor browser bundle it can't be that bad... Right? We hope...
blub 11y ago
NoScript is unfortunately quite sketchy, I don't use it any more. It has a whitelist supposedly to not break "top websites", but this list contained IMO some questionable choices last I checked it. It also tries to connect to the dev's website for no reason at all (addons are updated directly from Firefox) and after updates, "to show the release notes". Last but not least, this is the same dev which got involved in a scandal for trying to underhandedly whitelist the said website into an ad-blocking addon.
- okasaki 11y ago
  What list is that? I'm looking at it and I'm pretty sure I personally whitelisted all of those domains. The only ones that seem to have come from NoScript are the about:... ones
  - blub 11y ago
    I reinstalled it to check again and it seems you are correct, there's nothing except about:* links. I remember it had some big portal websites I hadn't visited and would not enable JS for, however I am willing to accept I was wrong. Unfortunately, I can't edit my initial comment any more. Thanks for checking and sorry for my confusing initial post...

Aissen 11y ago

At least Mozilla documents every connection made and explains why they're made, and how to disable them: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making...

moron4hire 11y ago

Where do you think Mozilla makes most of its money? Hint: it ain't donations.

rockdoe 11y ago
They get money from Yahoo for putting it as their default search engine in the USA. What was your point exactly? I fail to see any relation here.
- moron4hire 11y ago
  Is it Yahoo again? I thought it was Bing now. But it's advertising. It's advertising for whomever gets their shitty search engine in the prime real estate.
  - drzaiusapelord 11y ago
    I believe yahoo search is bing.

kalsk 11y ago

This is about Chromium, not Chrome. A lot of people assume that Chromium is safer because things like this should get caught by the community. I think the lesson to be learned here is that FOSS can be just as dangerous as commercial software if not enough people are inspecting the code and following development. It seems there are a lot of people who unconditionally trust anything that's open-source.

hsivonen 11y ago

The flipside: https://groups.google.com/d/msg/mozilla.dev.planning/wBgLRXCTlaw/sbmQagO1BgAJ https://groups.google.com/d/msg/mozilla.dev.planning/wBgLRXC... "That said, the fact that Linux distros might switch off Telemetry and [Firefox Health Report] by default causes issues right in that way: they are undercounted and [Mozilla] may disregard them completely in data-driven decisions. If you are a Linux distro package manager, think about that."

rockdoe 11y ago

I have been told that I am perhaps being unfair to Mozilla...For reference, here are the connections that Firefox tries to establish immediately after startup So: It connects to Mozilla itself and to Google (specifically their server for the malware/phishing DB). The fact that Ghostery is in there is because you have third party addons installed. FWIW shavar.prod.mozaws.net is a Mozilla server which updates the blocklist for Tracking Protection. Somewhat ironic you're complaining about it given the context.

Sanddancer 11y ago

They do have the user's back. That means not wearing a tin foil hat. In order for a modern browser to work in a halfway decent manner, they need to ensure that things are reasonably up to date, that developers see crash reports so they can discover bugs and security flaws before someone malicious does, and that lists of malicious sites get updated. Not checking for updates, not providing bug reports is the opposite of good software hygiene.