11 ms·

I can do a quick summary of what's being proposed and why. I work in the JS team at Mozilla and deal directly with the problems caused by insufficient data. P

I can do a quick summary of what's being proposed and why. I work in the JS team at Mozilla and deal directly with the problems caused by insufficient data. Please note that I'm speaking for myself here, and not on behalf of Mozilla as a whole. Tracking down regressions, crashes, and perf issues without good telemetry about how often it's happening and in what context. Issues that might have otherwise taken a few days to resolve with good info, become multi-week efforts at reproduction-of-the-issue with little information. It simply boils down to the fact that we can't build a better browser without good information on how it's behaving in the wild. That's the pain point anyway. Mozilla's general mission, however, makes it very difficult to collect detailed data - user privacy is paramount. So we have two major issues that conflict: the need to get better information about how the product is serving users, and the need for users to be secure in their browsing habits. We also know from history that benevolent intent is not that significant. Organizations change, and intents change, and data that's collected now with good intent can be used with bad intent in the future. So we need to be careful about whatever compromise we choose, to ensure that a change of intent in the future doesn't compromise our original guarantees to the user. This is a proposed compromise that is being floated. Don't collect URLs, but only top-level+1 domains (e.g. images.google.com), and associate information with that. That lets us know broadly what sites we are seeing problems on, hopefully without compromising the user's privacy too much. Also, the information associated with the site is performance data: the time spent by the longest garbage-collection, paint janks. This is a difficult compromise to make, which is why I assume it took so long for Mozilla to come around to proposing this. These public outreaches are almost always the last stage of a length internal discussion on whether proposals fit within our mission or not. I'm not directly involved in this proposal, but I personally think it's necessary, and strikes a reasonable balance between the privacy-for-users and actionable-information-for-developers requirements.

belorn 9y ago
If user privacy is paramount, then there are multiple ways to lower the privacy incursion that is caused by the data collection. Only collect top-level domains of Alexa rank 1k. That users are using a highway is less sensitive than a specific street where there only exists 5 homes, and it reassures users that private domain names won't be leaked. Send the data through Tor. That way you only get the data about the browser <-> site interaction, not user<->browser<->site interaction. And make it opt-in and notify users of the purpose of the data collection. A good model to follow here is Debian installer and popcon. Follow the good practices of data collection in the free software world and do not use dark patterns.
- moosingin3space 9y ago
  This is a reasonable compromise, but it does bias the sample towards popular sites. Granted, many of these sites are the sites that Firefox struggles with, but browsing habits are a heavy-tailed distribution. That said, smaller sites do open the door for problems, so it's probably a workable compromise. EDIT: It should also be completely disabled in Private Browsing mode -- otherwise the optics are even worse than they are now.
- Ajedi32 9y ago
  > there are multiple ways to lower the privacy incursion that is caused by the data collection The OP actually discusses a very interesting method for doing exactly that using differential privacy techniques. I personally think that's a very good compromise for this use-case.
  - belorn 9y ago
    From the OP, one suggestion is to collect "top-level+1 domains". This don't solve the issue of a person going to "starting_a_union_inside_company_x.com", which would be a top-level domain. Niche domains don't have a large number of users and as such the users can be trivial to deanonymized. It is also rather common that domain name servers have a private and public side. Firefox could easily become a vector of leaking from the private side, possible revealing sensitive information such as unannounced products. From the OP we can also see that they don't intend to store IP-addresses, but it will always be possible. By using a anonymity network they can reassure the user and at the same time eliminate the risk that a malicious actor in the future will silently manage to start tracking information about which websites users go to. Additional benefits is that Mozilla also won't become a target for governments, a risk that no organization can ever be safe from if they start gather information about users. It is not enough to strike a reasonable balance between the privacy-for-users and actionable-information-for-developers. You also need to find a balance between risk management and time spent on reducing risks. What I propose primarily is that they spend a bit more time on reducing risks, as that would benefit everyone.
    - 9y ago
yuhong 9y ago
Mozilla's crash reporter already has the option of submitting the URL.
- kannanvijayan 9y ago
  There are a couple different reasons crash reports aren't sufficient: 1. Crash reports only report crashes. We need also want to see perf issues like GC and paint jank, etc. 2. Crash reports don't sample the general population, so statistically the information is less useful. If we get a perf issue, it's very important to know whether that issue is suffered by 10% of the users in general pop, or 0.5% of users in general pop. You want to prioritize the stuff that has the greatest impact on the general user population. Lastly, crash reports are sort of a boolean filter - you only get the people that crash. The things I'd like to know to help in my development are things like "what is the histogram of max GC pause times on docs.google.com". Getting that info requires a good random sampling of the population, not just those who exhibit problems.
  - thanksgiving 9y ago
    > Lastly, crash reports are sort of a boolean filter - you only get the people that crash. The things I'd like to know to help in my development are things like "what is the histogram of max GC pause times on docs.google.com". Getting that info requires a good random sampling of the population, not just those who exhibit problems. PLEASE do not go down this road. Look where "optimizing" video card drivers has led the video game industry. Game engine developers and game developers are lazier than ever. It is not up to you to make sure docs.google.com runs well on your browser. It is up to you to provide browser that adheres to (and defines if it must) standards. It is up to the web developers at docs dot google dot com to make their application work on Mozilla Firefox.
    - kannanvijayan 9y ago
      This is getting off-topic, but it's interesting. I think I have the exact opposite take on things from you :) A program written by a developer and used by a user is a relationship between that developer and the user. I just work on the platform that allows that relationship to exist. I feel it's overstepping our boundaries as platform providers to say "we're not going to make this platform faster for you because we think developers are writing bad code using that performance as a crutch". It feels like I'd be setting myself up as a self-appointed clergy over moral matters in software development. It's not a hat I'm comfortable with.
syshum 9y ago
>>This is a difficult compromise to make, Sorry I do not accept this compromise. Mozilla seems to have lost its way of late. Sad to see a company that was at the fore front of Privacy, and Security abandon that in name of market share and performance. I would rather sacrifice performance for privacy, not the other way around. From EME, to the adoption of Browser Extensions as the only customization option, now this.... Mozilla and FF is changing in ways that are harmful to the open, secure, and private web. Following the trends and policies of MS and Google is not the correct path.
- kannanvijayan 9y ago
  I think the core disagreement here is not ideological per se, but on premises. I agree with the motivation of not collecting any data. That said, I don't feel that we have a choice but to compromise. If we don't build a better browser, then the other browsers will win by default, which means you lose all those privacy and security motivations anyway. This is not some gleeful romp down the yellow brick road of data collection. It's a hard-searched, difficult compromise to a question that there are no good answers to, and LOTS of disagreement about.
  - syshum 9y ago
    What are we attempting to "win". Again I go back to my statement of compromising princibles in the name of market share I have used FF since Ver 1.0 for a few reasons the top ones being it is Open Source, it has always been the most privacy and security focused browser, and were strong advocates of Open Standards that where inter-operable on ALL platforms with out vendor lock in FF is still open source.... the rest that seems to be in flux now.
    - kannanvijayan 9y ago
      > What are we attempting to "win". Again I go back to my statement of compromising princibles in the name of market share I don't see it as an either-or, but rather a balance to strike. A perfectly private browser with no marketshare doesn't help users. A completely compromised browser with 100% marketshare doesn't help users either.
noir_lord 9y ago
No compromise, I switched to FF on Android to avoid this crap from Chrome and now you'll do it as well. I look forwards to the fork.
- yoasif_ 9y ago
  They already said that anything they would do would have an opt-out available.
  - jlgaddis 9y ago
    Regardless, opt-in should not be the default. They say they have to default to opt-in because otherwise users will not enable this type of data collection. That, in my opinion, should be the #1 indicator that users DO NOT want this collection happening in the first place. They default to opt-in because they know most people won't opt-out, either because they forget, aren't aware that it is happening, or various other reasons. I'm okay with them collecting any data they want to so long as it is opt-in (because I never will). Mozilla is slowly eroding their original, core values.
- quantum_magpie 9y ago
  Palemoon on android works wonderfully.
thanksgiving 9y ago
> I'm not directly involved in this proposal, but I personally think it's necessary, and strikes a reasonable balance between the privacy-for-users and actionable-information-for-developers requirements. I use Firefox and always opt into any telemetry that sends data back to Mozilla. You could say I am a fanboy. I think it is a HORRIBLE idea and Mozilla should scrap it yesterday and never bring it up again. If people bring it up again, send them to the roof team (if it doesn't exist, create one). If they come downstairs, fire them. You already have people like me who are willing to opt-in to every single thing you can try. For example, Firefox nightly on Android has consistently crashed for me about every five minutes or so since the last weekend and yet I keep using it. Don't throw away this goodwill.
- Ajedi32 9y ago
  The problem here is that, for certain types of data, statistics obtained exclusively from users who opt-in to data collection aren't very useful because they're heavily biased in favor of the type of user likely to opt-in (which often isn't very well representative of the average user).
  - Paul-ish 9y ago
    Bias can be corrected statistically.
    - floatingatoll 9y ago
      Statistics are not a substitute for the long-tail effect. Lack of reporting from non-technical people who aren't aware they can opt-in cannot be corrected statistically, as the two categories of people (technical, non-technical) use the browser very differently. For made up example, if you type "Yahoo" into the search bar and then type "Search" into the field and then type your search into the third page, you'll be acting as many normal world users do, and you may uncover crashes on page #2 at Yahoo that a technical user would never encounter, simply because they wouldn't type the word "Search" into the search field at Yahoo and trigger a JS bug where "Search" or "Yahoo" gets used one too many places and ends up crashing the CSS parser because it race conditions with repaint. If that problem affects 0.01% of the Firefox population, that's a lot of people who don't think technically, and do feel regret when we crash and can't help them because we can't see where it crashed. (Yes, employed. No, I didn't talk to anyone else before I posted here. My own thoughts, I am not a number^Wcorporation, etc.)
beachwood23 9y ago
Thanks for your input. Glad to hear someone from the Mozilla team on this thread. Its an interesting compromise... because without improved performance and features, we'll lose Firefox entirely, and all of the relative privacy / security gains that entails. This is a good example where "perfect" privacy that reaches only a few is the enemy of "good" privacy that reaches more people.
- moosingin3space 9y ago
  Firefox must continue to exist if we are to have any browser without an economic incentive to be user-hostile. If they need performance traces from websites, and they have an open, clear discussion of how to preserve as much user privacy as possible, they should collect them.
  - izacus 9y ago
    The data collection MAKES it user-hostile. If they start collecting data, then there's no point for Firefox to exist - they're just a crappier version of Chrome.
clarkevans 9y ago
> Don't collect URLs, but only top-level+1 domains (e.g. images.google.com) Do you consider images.google.com to be eTLD+1? The eTLD would be .com; so, eTLD+1 would be google.com; and hence, images.google.com would be eTLD+2? eTLD: https://en.wikipedia.org/wiki/Public_Suffix_List https://en.wikipedia.org/wiki/Public_Suffix_List
- BenjiWiebe 9y ago
  This is clearly an example of the infamous off-by-one error.
- kannanvijayan 9y ago
  Yeah, you're right. Thanks for the correction. It's eTLD+1, I just erroneously used images.google.com as an example.
keithpeter 9y ago
"This is a difficult compromise to make" Then don't make the compromise. As others have expressed here the reason few people opt in to data collection may be because they have chosen to use a Web browser that does not mandate the collection of data. I'm assuming there will always be an opt out which I shall add to my list of things I have to do when installing Firefox.
- kannanvijayan 9y ago
  > I'm assuming there will always be an opt out which I shall add to my list of things I have to do when installing Firefox. There will be. Sorry for the hassle :(
  - deleted 9y ago
    [deleted]
  - im3w1l 9y ago
    How can I recommend my friends to use Firefox when I know they wont remember to opt out?
    - yflu 9y ago
      The way I see it is that if Firefox's userbase dwindles because of this, either we get our Firefox with opt-out telemetry or... Firefox dies. And now we have a Chrome monopoly. I'm not sure I like that gamble.
    - keithpeter 9y ago
      On Linux it may be that the various distributions decide to repackage Firefox with the default setting flipped. Not sure about the various policies on that one. The ESR track presumably will have the default flipped because corporations get funny about data transfers to remote servers - mind you Microsoft seem to be getting away with it for business who don't have a full on Enterprise set up.
joosters 9y ago
If it's so harmless, let users opt-in. Adding data collection via an opt-out is shameful, it shows that you know people would not want this and yet you'd prefer to get more data anyway.
stewbrew 9y ago
> Tracking down regressions, crashes, and perf issues without good telemetry about how often it's happening and in what context. If that's what you're aiming at. Collect the data but keep it local. Install some sort of responsiveness/"problem" monitoring. Ask the user to send data relevant to the problem if a problem occurs. IMHO there is no need to systematically collect user data for that. Or get the data from a random sample of users. You don't need data from everyone.
- Vinnl 9y ago
  > Or get the data from a random sample of users. You don't need data from everyone. To my amateur ear, that actually sounds like a good compromise to lessen the blow somewhat more. You should suggest it to Mozilla :)
  - mintplant 9y ago
    That's what's proposed here. I guess no one actually read the post...?
    - dsp1234 9y ago
      There is no mention that once validated, that the RAPPOR-based metrics when fully deployed would be take from a random population. Only that the initial study of the system will be done to a random population. FTA: What we plan to do now is run an opt-out SHIELD study [6] to validate our implementation of RAPPOR. This study will collect the value for users’ home page (eTLD+1) for a randomly selected group of our release population We are hoping to launch this in mid-September." Notably: "this study will collect ... for a randomly selected group" [6] - https://wiki.mozilla.org/Firefox/Shield/Shield_Studies https://wiki.mozilla.org/Firefox/Shield/Shield_Studies
    - stewbrew 9y ago
      I added the second part about the random sample later to the comment when I moved the proposal already out of my short term memory. I hope they use the data from their initial study to test whether the opt-out group actually is different from the group they already get data from.
msla 9y ago
You wouldn't say anything else, so your statements don't change anything: Any company which wants to collect more data would justify it in the same way. The main reason to collect data is monetization. People don't like to think they're being sold, so it's justified on other grounds. That's a universal. Since the way data is monetized is to track and segregate users, claims that it can be done in a privacy-respecting fashion are, therefore, specious. There is one conclusion to be drawn here, and it isn't that Mozilla is going to respect my privacy.
- Ajedi32 9y ago
  Are you honestly suggesting that the only possible use for aggregate user statistics is for ads? Not for A/B testing or tracking performance regressions?
  - msla 9y ago
    I'm saying that the behavior of someone who was collecting aggregate statistics for ads and the behavior of someone who was collecting aggregate statistics for another reason would be identical in this forum, so we must assume the worst.
disconnected 9y ago
Ok, I get your point. You need the extra debugging information. Now, here's my concern. I DO NOT want compromises. I DO NOT want to balance anything. I DO NOT want this telemetry crud on my browser spewing out my browsing history to anyone, no matter how anonymous you people claim it will be. I just want a decent web browser. What are my options? "Mozilla's way or the highway"? Redirect evil.telemetry.things.mozilla.org to /dev/null? Go back to elinks? Or will there be a "disable this piece of crap utterly and completely" button somewhere not hidden under an URL? Or even better, a compile flag? Edit: spelling...
- Ajedi32 9y ago
  There'll be an opt-out, just as there always has. That's not what's being discussed here. The question is whether to allow these stats to be collected as an opt-out vs opt-in.
  - RaleyField 9y ago
    Before you send any telemetry get informed consent by presenting the user a dialog enumerating everything that you are sending and I'd be fine with opt-out otherwise this is a dark pattern and you are getting on my shit list.
    - comex 9y ago
      If you present the user a dialog, that is effectively opt-in, which is what already exists.
gorhill 9y ago
> Don't collect URLs, but only top-level+1 domains (e.g. images.google.com), and associate information with that. Using "images.google.com" as an example is too convenient. That would be great if you could also add whatever TLD+1 most people would rather keep private as another example right after "images.google.com".
SilasX 9y ago
>This is a proposed compromise that is being floated. Don't collect URLs, but only top-level+1 domains (e.g. images.google.com), and associate information with that. Until sites start programmatically generating a unique subdomain for each [Firefox] user.
AdmiralAsshat 9y ago
Top-level domains are still betraying the user's privacy. Does it bug me that PornoTube is significantly laggier on Firefox than YouTube? Sure. Do I want Mozilla to know that I'm visiting it? Hell no.
- yoasif_ 9y ago
  They wouldn't know that you are visiting it, just that someone is visiting it.
  - mirimir 9y ago
    How can they not know that I'm visiting it? I mean, the data is coming from my IP address. Sure, they may be dropping that data before storage. But what if it's intercepted?
    - marumari 9y ago
      Connections to the Mozilla Telemetry server are done over HTTPS, so all an interceptor would know is that you are sending Telemetry and not what that Telemetry is.
      - mirimir 9y ago
        OK, fair enough. Then an adversary inside Mozilla that can intercept the data. I mean, the NSA is inside Mozilla, right? It'd be foolish, in my opinion, to assume that they're not. Such a juicy target, and all.
z3t4 9y ago
Take a list of sites, for example Alexa top 10,000 and make an automatic script that browse these sites and collect whatever information you need. Have a bunch of devices, phones, laptops, PC's from different brands doing this. This will not cost much and you don't have to spy on your users.
pishpash 9y ago
Many problems here: 1. You're proposing a mechanism for collecting data, and a strategy for extracting more data than you currently do. You have not figured out the type of data that you will finally need, only a set of things that you currently envision. Naturally, the data that you will collect in the future will be more than what you currently envision. There is built-in mission creep that is dangerous. 2. What you currently envision is not fleshed out as especially useful. You only believe it is useful. The pain point of biased data is red herring. Your concern is more about not enough data. 3. You have found a technology which you believe will allow you to collect a lot of data anonymously. But none of you seem to understand the technology very well. It seems like a shiny toy that you are eager to go to town with. I am not sure this is the right attitude. 4. You're proposing to use your users in lieu of proper testers, or to save time. There are many ways to properly test software and to save time. Have they been explored? There used to be a time when beta software was a thing. Prompt the users to become testers for your beta software. If users don't want to be testers then don't collect data from them. How much data do you actually need anyway? Have you fully utilized your existing data? Over all, I see this as a nice-to-have luxury, not some life-and-death situation, and subverting the goodwill of users is not worth it, IMHO.
- Ar-Curunir 9y ago
  Differential privacy is relatively battle-tested. I wouldn't be too worried about it standing up to scrutiny.
  - Sir_Substance 9y ago
    The problem with differential privacy is I have to trust the person aggregating the data to actually do it.
    - cgio 9y ago
      Do you? Excuse my ignorance, but I thought there was a way to locally mangle the data before submitting. Is that not what apple is doing?
feelin_googley 9y ago
".. we can't build a better browser without good information on how it's behaving in the wild." Who decides what is a "better" browser? 1. Is it the authors? Do they write the software for themselves and agree to share it for free with anyone who may want to use it? 2. Is it the users? Do the authors solicit feedback from users to determine what users want? If users demanded a browser with no default telemetry, would the authors comply? 3. Is it third parties who have an interest in the behavior of users? For example, domain name industry, ad-supported businesses, their employees or advertisers themselves. Are the authors on salary, compensated indirectly from advertising revenue? Or does it come from somewhere else? 4. Is it all of the above? If we follow the money where does it lead? Whose decision of what is "better" is the most important? Mozilla is descended from a defunct 1990's company that aimed to license a web browser to corporations for a fee. It would have been very clear in that case who the browser was being written for. But today, it is not so clear who Mozilla is serving. It resembles some sort of "multi-stakeholder" project. It would be nice to have a browser that fits description 1 or 2. I believe there are plenty of folks, including some developers, who would appreciate a browser with no default telemetry. By virtue of the total absence of data collection, they might consider it "better" than alternative browsers that "need telemetry" for whatever reason.
mirimir 9y ago
This is a horrible development. If Mozilla starts collecting this sort of data on an opt-out basis, it will put many users at risk. Seriously, WTF? > This is a proposed compromise that is being floated. Don't collect URLs, but only top-level+1 domains (e.g. images.google.com), and associate information with that. That lets us know broadly what sites we are seeing problems on, hopefully without compromising the user's privacy too much. Sure, there's no problem with images.google.com because it's generically innocuous. But what about pornhub.com for users in Saudi Arabia? Or some Japanese site that's essentially child porn for users in the US? The top-level+1 domain in many cases is totally incriminating. > Also, the information associated with the site is performance data: the time spent by the longest garbage-collection, paint janks. Maybe so. But it's collection of the top-level+1 domain that's the problem. > I'm not directly involved in this proposal, but I personally think it's necessary, and strikes a reasonable balance between the privacy-for-users and actionable-information-for-developers requirements. Fine. But then, make it opt-in, to protect users.
im3w1l 9y ago
There are many very, very political people inside Mozilla. Some of them may even want to commit political violence. Political violence seems to be a problem that just grows and grows, so how can we be sure that it's not supported in Mozilla. These would be a very small minority of Mozilla of course, but the problem is that you don't know who it is. And it only takes a single extremist to betray your users. To get your users injured or even killed. The same concern will of course apply to any other data harvesters, but that's for another thread

belorn 9y ago

If user privacy is paramount, then there are multiple ways to lower the privacy incursion that is caused by the data collection. Only collect top-level domains of Alexa rank 1k. That users are using a highway is less sensitive than a specific street where there only exists 5 homes, and it reassures users that private domain names won't be leaked. Send the data through Tor. That way you only get the data about the browser <-> site interaction, not user<->browser<->site interaction. And make it opt-in and notify users of the purpose of the data collection. A good model to follow here is Debian installer and popcon. Follow the good practices of data collection in the free software world and do not use dark patterns.

moosingin3space 9y ago
This is a reasonable compromise, but it does bias the sample towards popular sites. Granted, many of these sites are the sites that Firefox struggles with, but browsing habits are a heavy-tailed distribution. That said, smaller sites do open the door for problems, so it's probably a workable compromise. EDIT: It should also be completely disabled in Private Browsing mode -- otherwise the optics are even worse than they are now.
Ajedi32 9y ago
> there are multiple ways to lower the privacy incursion that is caused by the data collection The OP actually discusses a very interesting method for doing exactly that using differential privacy techniques. I personally think that's a very good compromise for this use-case.
- belorn 9y ago
  From the OP, one suggestion is to collect "top-level+1 domains". This don't solve the issue of a person going to "starting_a_union_inside_company_x.com", which would be a top-level domain. Niche domains don't have a large number of users and as such the users can be trivial to deanonymized. It is also rather common that domain name servers have a private and public side. Firefox could easily become a vector of leaking from the private side, possible revealing sensitive information such as unannounced products. From the OP we can also see that they don't intend to store IP-addresses, but it will always be possible. By using a anonymity network they can reassure the user and at the same time eliminate the risk that a malicious actor in the future will silently manage to start tracking information about which websites users go to. Additional benefits is that Mozilla also won't become a target for governments, a risk that no organization can ever be safe from if they start gather information about users. It is not enough to strike a reasonable balance between the privacy-for-users and actionable-information-for-developers. You also need to find a balance between risk management and time spent on reducing risks. What I propose primarily is that they spend a bit more time on reducing risks, as that would benefit everyone.
  - 9y ago

yuhong 9y ago

Mozilla's crash reporter already has the option of submitting the URL.

kannanvijayan 9y ago
There are a couple different reasons crash reports aren't sufficient: 1. Crash reports only report crashes. We need also want to see perf issues like GC and paint jank, etc. 2. Crash reports don't sample the general population, so statistically the information is less useful. If we get a perf issue, it's very important to know whether that issue is suffered by 10% of the users in general pop, or 0.5% of users in general pop. You want to prioritize the stuff that has the greatest impact on the general user population. Lastly, crash reports are sort of a boolean filter - you only get the people that crash. The things I'd like to know to help in my development are things like "what is the histogram of max GC pause times on docs.google.com". Getting that info requires a good random sampling of the population, not just those who exhibit problems.
- thanksgiving 9y ago
  > Lastly, crash reports are sort of a boolean filter - you only get the people that crash. The things I'd like to know to help in my development are things like "what is the histogram of max GC pause times on docs.google.com". Getting that info requires a good random sampling of the population, not just those who exhibit problems. PLEASE do not go down this road. Look where "optimizing" video card drivers has led the video game industry. Game engine developers and game developers are lazier than ever. It is not up to you to make sure docs.google.com runs well on your browser. It is up to you to provide browser that adheres to (and defines if it must) standards. It is up to the web developers at docs dot google dot com to make their application work on Mozilla Firefox.
  - kannanvijayan 9y ago
    This is getting off-topic, but it's interesting. I think I have the exact opposite take on things from you :) A program written by a developer and used by a user is a relationship between that developer and the user. I just work on the platform that allows that relationship to exist. I feel it's overstepping our boundaries as platform providers to say "we're not going to make this platform faster for you because we think developers are writing bad code using that performance as a crutch". It feels like I'd be setting myself up as a self-appointed clergy over moral matters in software development. It's not a hat I'm comfortable with.

syshum 9y ago

>>This is a difficult compromise to make, Sorry I do not accept this compromise. Mozilla seems to have lost its way of late. Sad to see a company that was at the fore front of Privacy, and Security abandon that in name of market share and performance. I would rather sacrifice performance for privacy, not the other way around. From EME, to the adoption of Browser Extensions as the only customization option, now this.... Mozilla and FF is changing in ways that are harmful to the open, secure, and private web. Following the trends and policies of MS and Google is not the correct path.

kannanvijayan 9y ago
I think the core disagreement here is not ideological per se, but on premises. I agree with the motivation of not collecting any data. That said, I don't feel that we have a choice but to compromise. If we don't build a better browser, then the other browsers will win by default, which means you lose all those privacy and security motivations anyway. This is not some gleeful romp down the yellow brick road of data collection. It's a hard-searched, difficult compromise to a question that there are no good answers to, and LOTS of disagreement about.
- syshum 9y ago
  What are we attempting to "win". Again I go back to my statement of compromising princibles in the name of market share I have used FF since Ver 1.0 for a few reasons the top ones being it is Open Source, it has always been the most privacy and security focused browser, and were strong advocates of Open Standards that where inter-operable on ALL platforms with out vendor lock in FF is still open source.... the rest that seems to be in flux now.
  - kannanvijayan 9y ago
    > What are we attempting to "win". Again I go back to my statement of compromising princibles in the name of market share I don't see it as an either-or, but rather a balance to strike. A perfectly private browser with no marketshare doesn't help users. A completely compromised browser with 100% marketshare doesn't help users either.

noir_lord 9y ago

No compromise, I switched to FF on Android to avoid this crap from Chrome and now you'll do it as well. I look forwards to the fork.

yoasif_ 9y ago
They already said that anything they would do would have an opt-out available.
- jlgaddis 9y ago
  Regardless, opt-in should not be the default. They say they have to default to opt-in because otherwise users will not enable this type of data collection. That, in my opinion, should be the #1 indicator that users DO NOT want this collection happening in the first place. They default to opt-in because they know most people won't opt-out, either because they forget, aren't aware that it is happening, or various other reasons. I'm okay with them collecting any data they want to so long as it is opt-in (because I never will). Mozilla is slowly eroding their original, core values.
quantum_magpie 9y ago
Palemoon on android works wonderfully.

thanksgiving 9y ago

> I'm not directly involved in this proposal, but I personally think it's necessary, and strikes a reasonable balance between the privacy-for-users and actionable-information-for-developers requirements. I use Firefox and always opt into any telemetry that sends data back to Mozilla. You could say I am a fanboy. I think it is a HORRIBLE idea and Mozilla should scrap it yesterday and never bring it up again. If people bring it up again, send them to the roof team (if it doesn't exist, create one). If they come downstairs, fire them. You already have people like me who are willing to opt-in to every single thing you can try. For example, Firefox nightly on Android has consistently crashed for me about every five minutes or so since the last weekend and yet I keep using it. Don't throw away this goodwill.

Ajedi32 9y ago
The problem here is that, for certain types of data, statistics obtained exclusively from users who opt-in to data collection aren't very useful because they're heavily biased in favor of the type of user likely to opt-in (which often isn't very well representative of the average user).
- Paul-ish 9y ago
  Bias can be corrected statistically.
  - floatingatoll 9y ago
    Statistics are not a substitute for the long-tail effect. Lack of reporting from non-technical people who aren't aware they can opt-in cannot be corrected statistically, as the two categories of people (technical, non-technical) use the browser very differently. For made up example, if you type "Yahoo" into the search bar and then type "Search" into the field and then type your search into the third page, you'll be acting as many normal world users do, and you may uncover crashes on page #2 at Yahoo that a technical user would never encounter, simply because they wouldn't type the word "Search" into the search field at Yahoo and trigger a JS bug where "Search" or "Yahoo" gets used one too many places and ends up crashing the CSS parser because it race conditions with repaint. If that problem affects 0.01% of the Firefox population, that's a lot of people who don't think technically, and do feel regret when we crash and can't help them because we can't see where it crashed. (Yes, employed. No, I didn't talk to anyone else before I posted here. My own thoughts, I am not a number^Wcorporation, etc.)

beachwood23 9y ago

Thanks for your input. Glad to hear someone from the Mozilla team on this thread. Its an interesting compromise... because without improved performance and features, we'll lose Firefox entirely, and all of the relative privacy / security gains that entails. This is a good example where "perfect" privacy that reaches only a few is the enemy of "good" privacy that reaches more people.

moosingin3space 9y ago
Firefox must continue to exist if we are to have any browser without an economic incentive to be user-hostile. If they need performance traces from websites, and they have an open, clear discussion of how to preserve as much user privacy as possible, they should collect them.
- izacus 9y ago
  The data collection MAKES it user-hostile. If they start collecting data, then there's no point for Firefox to exist - they're just a crappier version of Chrome.

clarkevans 9y ago

> Don't collect URLs, but only top-level+1 domains (e.g. images.google.com) Do you consider images.google.com to be eTLD+1? The eTLD would be .com; so, eTLD+1 would be google.com; and hence, images.google.com would be eTLD+2? eTLD: https://en.wikipedia.org/wiki/Public_Suffix_List https://en.wikipedia.org/wiki/Public_Suffix_List

BenjiWiebe 9y ago
This is clearly an example of the infamous off-by-one error.
kannanvijayan 9y ago
Yeah, you're right. Thanks for the correction. It's eTLD+1, I just erroneously used images.google.com as an example.

keithpeter 9y ago

"This is a difficult compromise to make" Then don't make the compromise. As others have expressed here the reason few people opt in to data collection may be because they have chosen to use a Web browser that does not mandate the collection of data. I'm assuming there will always be an opt out which I shall add to my list of things I have to do when installing Firefox.

kannanvijayan 9y ago
> I'm assuming there will always be an opt out which I shall add to my list of things I have to do when installing Firefox. There will be. Sorry for the hassle :(
- deleted 9y ago
  [deleted]
- im3w1l 9y ago
  How can I recommend my friends to use Firefox when I know they wont remember to opt out?
  - yflu 9y ago
    The way I see it is that if Firefox's userbase dwindles because of this, either we get our Firefox with opt-out telemetry or... Firefox dies. And now we have a Chrome monopoly. I'm not sure I like that gamble.
  - keithpeter 9y ago
    On Linux it may be that the various distributions decide to repackage Firefox with the default setting flipped. Not sure about the various policies on that one. The ESR track presumably will have the default flipped because corporations get funny about data transfers to remote servers - mind you Microsoft seem to be getting away with it for business who don't have a full on Enterprise set up.

joosters 9y ago

If it's so harmless, let users opt-in. Adding data collection via an opt-out is shameful, it shows that you know people would not want this and yet you'd prefer to get more data anyway.

stewbrew 9y ago

> Tracking down regressions, crashes, and perf issues without good telemetry about how often it's happening and in what context. If that's what you're aiming at. Collect the data but keep it local. Install some sort of responsiveness/"problem" monitoring. Ask the user to send data relevant to the problem if a problem occurs. IMHO there is no need to systematically collect user data for that. Or get the data from a random sample of users. You don't need data from everyone.

Vinnl 9y ago
> Or get the data from a random sample of users. You don't need data from everyone. To my amateur ear, that actually sounds like a good compromise to lessen the blow somewhat more. You should suggest it to Mozilla :)
- mintplant 9y ago
  That's what's proposed here. I guess no one actually read the post...?
  - dsp1234 9y ago
    There is no mention that once validated, that the RAPPOR-based metrics when fully deployed would be take from a random population. Only that the initial study of the system will be done to a random population. FTA: What we plan to do now is run an opt-out SHIELD study [6] to validate our implementation of RAPPOR. This study will collect the value for users’ home page (eTLD+1) for a randomly selected group of our release population We are hoping to launch this in mid-September." Notably: "this study will collect ... for a randomly selected group" [6] - https://wiki.mozilla.org/Firefox/Shield/Shield_Studies https://wiki.mozilla.org/Firefox/Shield/Shield_Studies
  - stewbrew 9y ago
    I added the second part about the random sample later to the comment when I moved the proposal already out of my short term memory. I hope they use the data from their initial study to test whether the opt-out group actually is different from the group they already get data from.

msla 9y ago

You wouldn't say anything else, so your statements don't change anything: Any company which wants to collect more data would justify it in the same way. The main reason to collect data is monetization. People don't like to think they're being sold, so it's justified on other grounds. That's a universal. Since the way data is monetized is to track and segregate users, claims that it can be done in a privacy-respecting fashion are, therefore, specious. There is one conclusion to be drawn here, and it isn't that Mozilla is going to respect my privacy.

Ajedi32 9y ago
Are you honestly suggesting that the only possible use for aggregate user statistics is for ads? Not for A/B testing or tracking performance regressions?
- msla 9y ago
  I'm saying that the behavior of someone who was collecting aggregate statistics for ads and the behavior of someone who was collecting aggregate statistics for another reason would be identical in this forum, so we must assume the worst.

disconnected 9y ago

Ok, I get your point. You need the extra debugging information. Now, here's my concern. I DO NOT want compromises. I DO NOT want to balance anything. I DO NOT want this telemetry crud on my browser spewing out my browsing history to anyone, no matter how anonymous you people claim it will be. I just want a decent web browser. What are my options? "Mozilla's way or the highway"? Redirect evil.telemetry.things.mozilla.org to /dev/null? Go back to elinks? Or will there be a "disable this piece of crap utterly and completely" button somewhere not hidden under an URL? Or even better, a compile flag? Edit: spelling...

Ajedi32 9y ago
There'll be an opt-out, just as there always has. That's not what's being discussed here. The question is whether to allow these stats to be collected as an opt-out vs opt-in.
- RaleyField 9y ago
  Before you send any telemetry get informed consent by presenting the user a dialog enumerating everything that you are sending and I'd be fine with opt-out otherwise this is a dark pattern and you are getting on my shit list.
  - comex 9y ago
    If you present the user a dialog, that is effectively opt-in, which is what already exists.

gorhill 9y ago

> Don't collect URLs, but only top-level+1 domains (e.g. images.google.com), and associate information with that. Using "images.google.com" as an example is too convenient. That would be great if you could also add whatever TLD+1 most people would rather keep private as another example right after "images.google.com".

SilasX 9y ago

>This is a proposed compromise that is being floated. Don't collect URLs, but only top-level+1 domains (e.g. images.google.com), and associate information with that. Until sites start programmatically generating a unique subdomain for each [Firefox] user.

AdmiralAsshat 9y ago

Top-level domains are still betraying the user's privacy. Does it bug me that PornoTube is significantly laggier on Firefox than YouTube? Sure. Do I want Mozilla to know that I'm visiting it? Hell no.

yoasif_ 9y ago
They wouldn't know that you are visiting it, just that someone is visiting it.
- mirimir 9y ago
  How can they not know that I'm visiting it? I mean, the data is coming from my IP address. Sure, they may be dropping that data before storage. But what if it's intercepted?
  - marumari 9y ago
    Connections to the Mozilla Telemetry server are done over HTTPS, so all an interceptor would know is that you are sending Telemetry and not what that Telemetry is.
    - mirimir 9y ago
      OK, fair enough. Then an adversary inside Mozilla that can intercept the data. I mean, the NSA is inside Mozilla, right? It'd be foolish, in my opinion, to assume that they're not. Such a juicy target, and all.

z3t4 9y ago

Take a list of sites, for example Alexa top 10,000 and make an automatic script that browse these sites and collect whatever information you need. Have a bunch of devices, phones, laptops, PC's from different brands doing this. This will not cost much and you don't have to spy on your users.

pishpash 9y ago

Many problems here: 1. You're proposing a mechanism for collecting data, and a strategy for extracting more data than you currently do. You have not figured out the type of data that you will finally need, only a set of things that you currently envision. Naturally, the data that you will collect in the future will be more than what you currently envision. There is built-in mission creep that is dangerous. 2. What you currently envision is not fleshed out as especially useful. You only believe it is useful. The pain point of biased data is red herring. Your concern is more about not enough data. 3. You have found a technology which you believe will allow you to collect a lot of data anonymously. But none of you seem to understand the technology very well. It seems like a shiny toy that you are eager to go to town with. I am not sure this is the right attitude. 4. You're proposing to use your users in lieu of proper testers, or to save time. There are many ways to properly test software and to save time. Have they been explored? There used to be a time when beta software was a thing. Prompt the users to become testers for your beta software. If users don't want to be testers then don't collect data from them. How much data do you actually need anyway? Have you fully utilized your existing data? Over all, I see this as a nice-to-have luxury, not some life-and-death situation, and subverting the goodwill of users is not worth it, IMHO.

Ar-Curunir 9y ago
Differential privacy is relatively battle-tested. I wouldn't be too worried about it standing up to scrutiny.
- Sir_Substance 9y ago
  The problem with differential privacy is I have to trust the person aggregating the data to actually do it.
  - cgio 9y ago
    Do you? Excuse my ignorance, but I thought there was a way to locally mangle the data before submitting. Is that not what apple is doing?

feelin_googley 9y ago

".. we can't build a better browser without good information on how it's behaving in the wild." Who decides what is a "better" browser? 1. Is it the authors? Do they write the software for themselves and agree to share it for free with anyone who may want to use it? 2. Is it the users? Do the authors solicit feedback from users to determine what users want? If users demanded a browser with no default telemetry, would the authors comply? 3. Is it third parties who have an interest in the behavior of users? For example, domain name industry, ad-supported businesses, their employees or advertisers themselves. Are the authors on salary, compensated indirectly from advertising revenue? Or does it come from somewhere else? 4. Is it all of the above? If we follow the money where does it lead? Whose decision of what is "better" is the most important? Mozilla is descended from a defunct 1990's company that aimed to license a web browser to corporations for a fee. It would have been very clear in that case who the browser was being written for. But today, it is not so clear who Mozilla is serving. It resembles some sort of "multi-stakeholder" project. It would be nice to have a browser that fits description 1 or 2. I believe there are plenty of folks, including some developers, who would appreciate a browser with no default telemetry. By virtue of the total absence of data collection, they might consider it "better" than alternative browsers that "need telemetry" for whatever reason.

mirimir 9y ago

This is a horrible development. If Mozilla starts collecting this sort of data on an opt-out basis, it will put many users at risk. Seriously, WTF? > This is a proposed compromise that is being floated. Don't collect URLs, but only top-level+1 domains (e.g. images.google.com), and associate information with that. That lets us know broadly what sites we are seeing problems on, hopefully without compromising the user's privacy too much. Sure, there's no problem with images.google.com because it's generically innocuous. But what about pornhub.com for users in Saudi Arabia? Or some Japanese site that's essentially child porn for users in the US? The top-level+1 domain in many cases is totally incriminating. > Also, the information associated with the site is performance data: the time spent by the longest garbage-collection, paint janks. Maybe so. But it's collection of the top-level+1 domain that's the problem. > I'm not directly involved in this proposal, but I personally think it's necessary, and strikes a reasonable balance between the privacy-for-users and actionable-information-for-developers requirements. Fine. But then, make it opt-in, to protect users.

im3w1l 9y ago

There are many very, very political people inside Mozilla. Some of them may even want to commit political violence. Political violence seems to be a problem that just grows and grows, so how can we be sure that it's not supported in Mozilla. These would be a very small minority of Mozilla of course, but the problem is that you don't know who it is. And it only takes a single extremist to betray your users. To get your users injured or even killed. The same concern will of course apply to any other data harvesters, but that's for another thread