6 ms·

Anyone have thoughts on the opt-out telemetry default? I had to read the privacy notice they open on start to find out that telemetry was enabled by default.

sillysaurus3 9y ago
My gut reaction was to be suspicious of Mozilla, but then I remembered that they're Mozilla. They're probably just trying to figure out which features are confusing for users. It's strange because we do this type of tracking in all facets of webapps, but desktop apps trigger our suspicion meter.
- doiwin 9y ago
  Desktop apps are much more intrusive then web apps.
- chrstphrhrt 9y ago
  Yeah definitely. I think the scope of desktop apps is often wider though. With web apps any telemetry data is pretty much limited to things on that domain. Browsers have access to more in principle. I guess if the data transmitted is not personally-identifying or profile-building then it's fine. E.g. number of sites only, not urls. On second glance at the new FF page https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/ it seems like the stuff they collect is pretty innocuous. Paranoia ftw.
- Tomte 9y ago
  Firefox is actually the only software where I've reviewed the privacy settings when asked and allowed it to send more information than the default setting to the vendor. Because Mozilla.
  - blub 9y ago
    How about sending the URLs you visit? This could actually happen to you, since you likely live in Germany based on your comments: http://www.zdnet.com/article/firefox-tests-cliqz-engine-which-slurps-user-browsing-data/ http://www.zdnet.com/article/firefox-tests-cliqz-engine-whic...
    - deleted 9y ago
      [deleted]
    - r3bl 9y ago
      1. Chances are 1 in a 100 by default. 2. Chances are significantly lower considering that this collaboration started only recently on the new installs from the website. Judging by his comment, I don't think he's a new Firefox user. Of course, the chance is still there, but I would argue that it's low enough to be negligible, at least for him.
- userbinator 9y ago
  It's strange because we do this type of tracking in all facets of webapps It's natural because in some sense, a webapp is more like regular visiting a site; and just like the fact that my requests to websites will show up in their server logs is, for the most part, not really a concern. To use an analogy, "if you want to have a conversation, both sides need to be able to contact each other." But when software is monitoring what I'm doing with it, and reporting to one central site, when I'm visiting other sites? That just evokes "do not want". I don't care if it's Mozilla or Google or whoever else. Just. Stop. Watching. Me.
- Manishearth 9y ago
  Mozilla's pretty careful about what goes into the default telemetry, too. Most of it is info that isn't very identifying (stuff like "how many cores do you have" or "how many times did this specific kind of jank occur for you") FWIW in Firefox nightly (maybe also beta?) if you flip the privacy.firstparty.isolate then the fact that websites can talk to each other is severely reduced; basically third party iframes get their own set of cookies for each domain they're embedded in, so tracking iframes know about each other less. Flipping this pref will log you out of everything though (only the one time), and some sites don't work with it (nothing major so far, and you can file a bug. In many cases it's the site relying on iframes in a weird way).
  - blub 9y ago
    Any comments on the cliqz experiment? Sending visited URLs doesn't sound very careful.
    - Manishearth 9y ago
      I don't know much about that. I'm talking about Firefox in particular. Edit: Ah, this is a part of Firefox. It looks like they're using some crypto/privacy features such that "aggregation is not technically feasible". Strongly blinding stuff that way isn't new; e.g. the safe browsing stuff uses differential privacy.
    - tormeh 9y ago
      Cliqz isn't (pure) telemetry, it's more like the suggestions at the top of the page on Google. It reads what you're typing in the address bar and tries to give you clever info based on what it thinks you're looking for.
    - Sylos 9y ago
      Sending data by itself isn't commonly seen as an attack vector with things like TLS in place and working, as far as we know. At least, Google has been sending browsing history with no additional encryption as part of Chrome Sync since its inception and there we don't know of data leaks during send so far either. And at the server where it's sent to, it gets disconnected from the IP address and intermixed with other people's browsing history. So, it's not stored in personally identifiable form and therefore not vulnerable there either. Mozilla has also made an official statement that neither they nor Cliqz store personally identifiable information as part of this, so doing it anyways would be misleading of consumers, i.e. breaking the law. Not to mention that it would violate German privacy laws (which is where it's currently being tested), if they collected personally identifiable information without clearly notifying the user and at least some checkbox that the user has to tick. It's easy to spin this, so that it sounds like Mozilla is doing pure evil here, but it's just not the case.
- blub 9y ago
  Mozilla ain't what it used to be: http://www.zdnet.com/article/firefox-tests-cliqz-engine-which-slurps-user-browsing-data/ http://www.zdnet.com/article/firefox-tests-cliqz-engine-whic...
  - Fnoord 9y ago
    Agreed this is an ill effort which should be shot down but even though Mozilla isn't perfect, they're still miles ahead of Google, Apple, and Microsoft. My point being, what you linked isn't a reason to not go for Firefox 57 or to not be enthusiastic about Firefox 57.
- jancsika 9y ago
  > My gut reaction was to be suspicious of Mozilla, but then I remembered that they're Mozilla. Mozilla's track record of software that aligns with FLOSS principles makes me trust them when they release new software which they claim aligns with FLOSS principles. But if Mozilla engages in what you call "suspicious behavior," it seems like a bad idea to assume that it's ok because of Mozilla's track record. In fact, I'd go in the other direction and say that suspicious behavior from Mozilla is enough of an anomaly that you should pay more attention to it, not less.
userbinator 9y ago
Unfortunately telemetry is everywhere now, and it disgusts me greatly. Personally, I find the idea that software should continuously phone home about its use, and this silent data collection/monitoring, extremely abhorrent. Some apps that really do not need to interact with the network at all do it, and those can be easily firewalled, but not so with a browser. Edit: Wow, downvotes for opposing pervasive telemetry. Now that is scary...
- jayd16 9y ago
  Every app and app developer could use crash/bug reports. I can understand your paranoia that something else is being sent but I would hardly call the idea of asking to send back bug reports abhorrent.
  - blub 9y ago
    Decent gaslighting attempt, but no. This is not paranoia, scummy software developers have actually sent much more than crash reports. And crash reports may contain private information anyway. Before anyone says Mozilla is different: http://www.zdnet.com/article/firefox-tests-cliqz-engine-which-slurps-user-browsing-data/ http://www.zdnet.com/article/firefox-tests-cliqz-engine-whic...
    - astura 9y ago
      That's not what gaslighting is.
    - kiriakasis 9y ago
      isn't cliqz basically the same as duckduckgo? i understand if you do not trust them specifically, but what i read there is that mozilla was intentionally reducing the information it could collect. i have seen this article already 5 times on this post, what is the point?
  - userbinator 9y ago
    I'm a developer myself and I absolutely oppose this practice. I don't do it and I don't want others to either. The possibility of exposing sensitive information is just not worth it. If you discover a bug you can always make a bug report and provide any details there. In that case, the consent and scope of disclosure is made very explicit. Chances are you don't know what information a machine-generated bug report contains, but you do know what you wrote when you reported it.

sillysaurus3 9y ago

My gut reaction was to be suspicious of Mozilla, but then I remembered that they're Mozilla. They're probably just trying to figure out which features are confusing for users. It's strange because we do this type of tracking in all facets of webapps, but desktop apps trigger our suspicion meter.

doiwin 9y ago
Desktop apps are much more intrusive then web apps.
chrstphrhrt 9y ago
Yeah definitely. I think the scope of desktop apps is often wider though. With web apps any telemetry data is pretty much limited to things on that domain. Browsers have access to more in principle. I guess if the data transmitted is not personally-identifying or profile-building then it's fine. E.g. number of sites only, not urls. On second glance at the new FF page https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/ it seems like the stuff they collect is pretty innocuous. Paranoia ftw.
Tomte 9y ago
Firefox is actually the only software where I've reviewed the privacy settings when asked and allowed it to send more information than the default setting to the vendor. Because Mozilla.
- blub 9y ago
  How about sending the URLs you visit? This could actually happen to you, since you likely live in Germany based on your comments: http://www.zdnet.com/article/firefox-tests-cliqz-engine-which-slurps-user-browsing-data/ http://www.zdnet.com/article/firefox-tests-cliqz-engine-whic...
  - deleted 9y ago
    [deleted]
  - r3bl 9y ago
    1. Chances are 1 in a 100 by default. 2. Chances are significantly lower considering that this collaboration started only recently on the new installs from the website. Judging by his comment, I don't think he's a new Firefox user. Of course, the chance is still there, but I would argue that it's low enough to be negligible, at least for him.
userbinator 9y ago
It's strange because we do this type of tracking in all facets of webapps It's natural because in some sense, a webapp is more like regular visiting a site; and just like the fact that my requests to websites will show up in their server logs is, for the most part, not really a concern. To use an analogy, "if you want to have a conversation, both sides need to be able to contact each other." But when software is monitoring what I'm doing with it, and reporting to one central site, when I'm visiting other sites? That just evokes "do not want". I don't care if it's Mozilla or Google or whoever else. Just. Stop. Watching. Me.
Manishearth 9y ago
Mozilla's pretty careful about what goes into the default telemetry, too. Most of it is info that isn't very identifying (stuff like "how many cores do you have" or "how many times did this specific kind of jank occur for you") FWIW in Firefox nightly (maybe also beta?) if you flip the privacy.firstparty.isolate then the fact that websites can talk to each other is severely reduced; basically third party iframes get their own set of cookies for each domain they're embedded in, so tracking iframes know about each other less. Flipping this pref will log you out of everything though (only the one time), and some sites don't work with it (nothing major so far, and you can file a bug. In many cases it's the site relying on iframes in a weird way).
- blub 9y ago
  Any comments on the cliqz experiment? Sending visited URLs doesn't sound very careful.
  - Manishearth 9y ago
    I don't know much about that. I'm talking about Firefox in particular. Edit: Ah, this is a part of Firefox. It looks like they're using some crypto/privacy features such that "aggregation is not technically feasible". Strongly blinding stuff that way isn't new; e.g. the safe browsing stuff uses differential privacy.
  - tormeh 9y ago
    Cliqz isn't (pure) telemetry, it's more like the suggestions at the top of the page on Google. It reads what you're typing in the address bar and tries to give you clever info based on what it thinks you're looking for.
  - Sylos 9y ago
    Sending data by itself isn't commonly seen as an attack vector with things like TLS in place and working, as far as we know. At least, Google has been sending browsing history with no additional encryption as part of Chrome Sync since its inception and there we don't know of data leaks during send so far either. And at the server where it's sent to, it gets disconnected from the IP address and intermixed with other people's browsing history. So, it's not stored in personally identifiable form and therefore not vulnerable there either. Mozilla has also made an official statement that neither they nor Cliqz store personally identifiable information as part of this, so doing it anyways would be misleading of consumers, i.e. breaking the law. Not to mention that it would violate German privacy laws (which is where it's currently being tested), if they collected personally identifiable information without clearly notifying the user and at least some checkbox that the user has to tick. It's easy to spin this, so that it sounds like Mozilla is doing pure evil here, but it's just not the case.
blub 9y ago
Mozilla ain't what it used to be: http://www.zdnet.com/article/firefox-tests-cliqz-engine-which-slurps-user-browsing-data/ http://www.zdnet.com/article/firefox-tests-cliqz-engine-whic...
- Fnoord 9y ago
  Agreed this is an ill effort which should be shot down but even though Mozilla isn't perfect, they're still miles ahead of Google, Apple, and Microsoft. My point being, what you linked isn't a reason to not go for Firefox 57 or to not be enthusiastic about Firefox 57.
jancsika 9y ago
> My gut reaction was to be suspicious of Mozilla, but then I remembered that they're Mozilla. Mozilla's track record of software that aligns with FLOSS principles makes me trust them when they release new software which they claim aligns with FLOSS principles. But if Mozilla engages in what you call "suspicious behavior," it seems like a bad idea to assume that it's ok because of Mozilla's track record. In fact, I'd go in the other direction and say that suspicious behavior from Mozilla is enough of an anomaly that you should pay more attention to it, not less.

userbinator 9y ago

Unfortunately telemetry is everywhere now, and it disgusts me greatly. Personally, I find the idea that software should continuously phone home about its use, and this silent data collection/monitoring, extremely abhorrent. Some apps that really do not need to interact with the network at all do it, and those can be easily firewalled, but not so with a browser. Edit: Wow, downvotes for opposing pervasive telemetry. Now that is scary...

jayd16 9y ago
Every app and app developer could use crash/bug reports. I can understand your paranoia that something else is being sent but I would hardly call the idea of asking to send back bug reports abhorrent.
- blub 9y ago
  Decent gaslighting attempt, but no. This is not paranoia, scummy software developers have actually sent much more than crash reports. And crash reports may contain private information anyway. Before anyone says Mozilla is different: http://www.zdnet.com/article/firefox-tests-cliqz-engine-which-slurps-user-browsing-data/ http://www.zdnet.com/article/firefox-tests-cliqz-engine-whic...
  - astura 9y ago
    That's not what gaslighting is.
  - kiriakasis 9y ago
    isn't cliqz basically the same as duckduckgo? i understand if you do not trust them specifically, but what i read there is that mozilla was intentionally reducing the information it could collect. i have seen this article already 5 times on this post, what is the point?
- userbinator 9y ago
  I'm a developer myself and I absolutely oppose this practice. I don't do it and I don't want others to either. The possibility of exposing sensitive information is just not worth it. If you discover a bug you can always make a bug report and provide any details there. In that case, the consent and scope of disclosure is made very explicit. Chances are you don't know what information a machine-generated bug report contains, but you do know what you wrote when you reported it.