28 ms·

If you actually look into it, there's basically nothing that you can accuse them of here. There's the possibility that Cliqz does actually start collecting the

If you actually look into it, there's basically nothing that you can accuse them of here. There's the possibility that Cliqz does actually start collecting the data, i.e. breaks the contract, commits a crime, and that then Mozilla, which owns parts of Cliqz and therefore has insight, does not notice right away. Other than that, there's nothing. No serious journalist will pick this up, because it would in turn damage their reputation to accuse Mozilla of mishandling user data here. Yes, it is still going to damage Mozilla's brand, because people prefer conspiracy theories over actually reading up on what they're doing, but it's going to stay isolated to first-hand news discussion forums, like HN, Reddit, Slashdot. This is simply an investment that Mozilla is willing to take to potentially improve search in their browser and to decrease the internet's dependence on classic web search engines, which is to say Google.

dingaling 9y ago
> and to decrease the internet's dependence on classic web search engines Which seems like a worthy objective. However automatically enroling users as pawns in that strategy is not noble. Create a strategy, advertise it and discuss it on the Mozilla mailing lists before launching the feature. This 'feature' doesn't involve Mozilla financial or proprietary data. Quite the contrary it involves the data of their end-users who, through their indifference to the Cliqz add-on, have already shown that they're not interested in the deal.
jasonkostempski 9y ago
Its really fucking simple, NO TRUST! If something reqires that I have take someones word for it, then the feature does not belong in a privacy focused application, no exceptions.
- matt4077 9y ago
  And that's really fucking unworkable as a principle. Because you rely on trust thousands of times every day, if you want it or not.
  - pdkl95 9y ago
    > Because you rely on trust thousands of times every day, Of course; everyone makes countless decisions about who to trust every day, as we adapt to our changing knowledge, environment, and situation. These decisions are necessarily unique to each person. Trust is not transitive. You can recommend some{one,thing} as trustworthy, and you an explain why you trust some{one,thing}. However, you cannot get other people to trust a 3rd party - even if they do trust you - simply by fiat. Trust is earned, and betraying existing trust is very hard recover. This attitude that asks users to believe that trust is transitive but risk is not transitive is misguided, rude, and possibly sociopathic.
    - rrix2 9y ago
      > Trust is not transitive. So you only browse sites whose SSL cert was issued by Mozilla? Or do you trust the SSL root Store provided by Mozilla and your OS and, transitively, everyone they trust?
      - pdkl95 9y ago
        No, I do not trust the entire set of root authorities provided by Mozilla. I have disabled some of the certs. The entire PKI system - as currently implemented - is another abuse of trust. The user needs to be informed about the chain-of-trust that is currently vouching the website they are using. The user also needs an easy way to indicate who they trust and the scope/limits of their trust. A proper web of trust[1] can respect the user. [1] https://users.ece.cmu.edu/~adrian/630-f04/PGP-intro.html#p19 https://users.ece.cmu.edu/~adrian/630-f04/PGP-intro.html#p19
        rrix2 9y ago
        That you've disabled some of the Mozilla roots is laudable. However you're still trusting every other root to trust their intermediaries to trust their intermediaries and on and on to trust the people they issue certs to. This is fundamentally how the modern internet works. The same is true for DNS as SSL. As for your solution: a web of trust is also transitive, unless your depth of trust is one. If your depth of trust is one, the only way you're productively browsing the internet is by doing TOFU for every single cert at which point I have other questions.
Vinnl 9y ago
> but it's going to stay isolated to first-hand news discussion forums, like HN, Reddit, Slashdot. I don't think you can call that isolated. Although I don't have data to back it up, it does not seem unlikely that a lot of their user base starts from there. This reader base includes many people's tech person, that e.g. help their friends install a browser.

dingaling 9y ago

> and to decrease the internet's dependence on classic web search engines Which seems like a worthy objective. However automatically enroling users as pawns in that strategy is not noble. Create a strategy, advertise it and discuss it on the Mozilla mailing lists before launching the feature. This 'feature' doesn't involve Mozilla financial or proprietary data. Quite the contrary it involves the data of their end-users who, through their indifference to the Cliqz add-on, have already shown that they're not interested in the deal.

jasonkostempski 9y ago

Its really fucking simple, NO TRUST! If something reqires that I have take someones word for it, then the feature does not belong in a privacy focused application, no exceptions.

matt4077 9y ago
And that's really fucking unworkable as a principle. Because you rely on trust thousands of times every day, if you want it or not.
- pdkl95 9y ago
  > Because you rely on trust thousands of times every day, Of course; everyone makes countless decisions about who to trust every day, as we adapt to our changing knowledge, environment, and situation. These decisions are necessarily unique to each person. Trust is not transitive. You can recommend some{one,thing} as trustworthy, and you an explain why you trust some{one,thing}. However, you cannot get other people to trust a 3rd party - even if they do trust you - simply by fiat. Trust is earned, and betraying existing trust is very hard recover. This attitude that asks users to believe that trust is transitive but risk is not transitive is misguided, rude, and possibly sociopathic.
  - rrix2 9y ago
    > Trust is not transitive. So you only browse sites whose SSL cert was issued by Mozilla? Or do you trust the SSL root Store provided by Mozilla and your OS and, transitively, everyone they trust?
    - pdkl95 9y ago
      No, I do not trust the entire set of root authorities provided by Mozilla. I have disabled some of the certs. The entire PKI system - as currently implemented - is another abuse of trust. The user needs to be informed about the chain-of-trust that is currently vouching the website they are using. The user also needs an easy way to indicate who they trust and the scope/limits of their trust. A proper web of trust[1] can respect the user. [1] https://users.ece.cmu.edu/~adrian/630-f04/PGP-intro.html#p19 https://users.ece.cmu.edu/~adrian/630-f04/PGP-intro.html#p19
      - rrix2 9y ago
        That you've disabled some of the Mozilla roots is laudable. However you're still trusting every other root to trust their intermediaries to trust their intermediaries and on and on to trust the people they issue certs to. This is fundamentally how the modern internet works. The same is true for DNS as SSL. As for your solution: a web of trust is also transitive, unless your depth of trust is one. If your depth of trust is one, the only way you're productively browsing the internet is by doing TOFU for every single cert at which point I have other questions.

Vinnl 9y ago

> but it's going to stay isolated to first-hand news discussion forums, like HN, Reddit, Slashdot. I don't think you can call that isolated. Although I don't have data to back it up, it does not seem unlikely that a lot of their user base starts from there. This reader base includes many people's tech person, that e.g. help their friends install a browser.