3 ms·

Let me propose an experiment: fire up wire shark and start your favourite browser and revel in the boatload of encrypted traffic that gets phoned home on startu

Let me propose an experiment: fire up wire shark and start your favourite browser and revel in the boatload of encrypted traffic that gets phoned home on startup. Now turn off updates, telemetry and a bunch of other built in features and do the same with Mozilla: the tcp connections out of your system are zero, nada. You can literally turn off everything.

lucideer 9y ago
Mostly. There are some exceptions, mostly not easily detectable by wireshark while Firefox is idling. These are things like extra requests made while browsing ancillary to the requests you're explicitly making, certain browser functions needlessly requiring an internet connection when they could well work fine without, and also in the form of "bugs" that slipped into the browser largely out of a lack of consideration for users' privacy by devs. The point here is that, while competitors' browsers might be worse, this doesn't mean that being "almost private" should be good enough for Firefox. Saying "but Firefox is still better than X at privacy" doesn't mean they can't be better. X is setting a very low bar.
- Sylos 9y ago
  >and also in the form of "bugs" that slipped into the browser largely out of a lack of consideration for users' privacy by devs. Tor Browser is based on Firefox. Human lifes would be at risk, if Tor Browser were to send additional data over the net that it's not supposed to send. So, Firefox is going to be very well vetted for whatever kind of bugs you imagine to be there.
  - lucideer 9y ago
    If Tor browser sends additional data over the net, it does so via the Tor network, so you are at no more risk than any other explicit requests you make via Tor browser. Unless you're using uMatrix in advanced mode with extra strict content settings enabled, Tor browser won't keep your session completely private. It isn't designed to do so. It's designed to keep a single session isolated and - if you're careful - anonymous within itself, but any activity within that session can still be easily associated with other activity within that session, unless you're selectively blocking 3rd parties. NoScript (bundled with TorBrowser) does this partially but not fully. Beyond the above (that TorBrowser isn't designed to protect from what we're discussing here, and as such their vetting won't be overly concerned with it), there's also the fact that they track ESR which is likely to have less of these issues since they'll usually be fixed before feature releases are backported. Edit: In case you're still of the view these bugs are "imagined", here's two small (related) examples: [0], [1] though not the only ones. The "lack of consideration" I referred to in my above post that imo causes these bugs is the language seen in the second one of those bugs: > It's not tracking but I'd imagine users who were uncomfortable submitting usage data from the app to GA also don't want to log their errors in Sentry This is a Mozilla developer who seems to fundamentally disagree with (I'd guess most) users on what tracking means. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1380754 https://bugzilla.mozilla.org/show_bug.cgi?id=1380754 [1] https://github.com/mozilla/addons-frontend/issues/2802 https://github.com/mozilla/addons-frontend/issues/2802
_Codemonkeyism 9y ago
Until it gets activated again with the next restart or update.
- sfink 9y ago
  Please, if anyone has steps to reproduce this behavior (beyond anecdotes of other people experiencing it), please file a bug. We engineers (I work on spidermonkey) put a lot of effort into making sure opt-in things are truly opt-in, and make sacrifices as well. (I would love to be able to automatically gather cpu or memory profiles with full urls included, to make it easier to reproduce field problems. Heck, we can't even tell if a set of crash reports comes from the same user. But I'd rather not have any of that, given the privacy risks. )
  - lucideer 9y ago
    The Mr. Robot thing is not the first one of these issues we've seen with Firefox, but most of them (from my anecdotal perspective) seem to be either with web dev (teams managing moz web properties), ui design (e.g. the privacy issues in about:addons I linked to in a comment above) or extensions development* (this Mr. Robot thing, Pocket, and a lot of issues with the entire Test Pilot project). I'm curious about whether the problems being discussed in the article above are not so much systemic to Mozilla itself (as many commenting here fear), but rather an issue with management of certain teams within the organisation. * I refer here to teams working on web extensions, rather than those working on web extensions APIs.

lucideer 9y ago

Mostly. There are some exceptions, mostly not easily detectable by wireshark while Firefox is idling. These are things like extra requests made while browsing ancillary to the requests you're explicitly making, certain browser functions needlessly requiring an internet connection when they could well work fine without, and also in the form of "bugs" that slipped into the browser largely out of a lack of consideration for users' privacy by devs. The point here is that, while competitors' browsers might be worse, this doesn't mean that being "almost private" should be good enough for Firefox. Saying "but Firefox is still better than X at privacy" doesn't mean they can't be better. X is setting a very low bar.

Sylos 9y ago
>and also in the form of "bugs" that slipped into the browser largely out of a lack of consideration for users' privacy by devs. Tor Browser is based on Firefox. Human lifes would be at risk, if Tor Browser were to send additional data over the net that it's not supposed to send. So, Firefox is going to be very well vetted for whatever kind of bugs you imagine to be there.
- lucideer 9y ago
  If Tor browser sends additional data over the net, it does so via the Tor network, so you are at no more risk than any other explicit requests you make via Tor browser. Unless you're using uMatrix in advanced mode with extra strict content settings enabled, Tor browser won't keep your session completely private. It isn't designed to do so. It's designed to keep a single session isolated and - if you're careful - anonymous within itself, but any activity within that session can still be easily associated with other activity within that session, unless you're selectively blocking 3rd parties. NoScript (bundled with TorBrowser) does this partially but not fully. Beyond the above (that TorBrowser isn't designed to protect from what we're discussing here, and as such their vetting won't be overly concerned with it), there's also the fact that they track ESR which is likely to have less of these issues since they'll usually be fixed before feature releases are backported. Edit: In case you're still of the view these bugs are "imagined", here's two small (related) examples: [0], [1] though not the only ones. The "lack of consideration" I referred to in my above post that imo causes these bugs is the language seen in the second one of those bugs: > It's not tracking but I'd imagine users who were uncomfortable submitting usage data from the app to GA also don't want to log their errors in Sentry This is a Mozilla developer who seems to fundamentally disagree with (I'd guess most) users on what tracking means. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1380754 https://bugzilla.mozilla.org/show_bug.cgi?id=1380754 [1] https://github.com/mozilla/addons-frontend/issues/2802 https://github.com/mozilla/addons-frontend/issues/2802

_Codemonkeyism 9y ago

Until it gets activated again with the next restart or update.

sfink 9y ago
Please, if anyone has steps to reproduce this behavior (beyond anecdotes of other people experiencing it), please file a bug. We engineers (I work on spidermonkey) put a lot of effort into making sure opt-in things are truly opt-in, and make sacrifices as well. (I would love to be able to automatically gather cpu or memory profiles with full urls included, to make it easier to reproduce field problems. Heck, we can't even tell if a set of crash reports comes from the same user. But I'd rather not have any of that, given the privacy risks. )
- lucideer 9y ago
  The Mr. Robot thing is not the first one of these issues we've seen with Firefox, but most of them (from my anecdotal perspective) seem to be either with web dev (teams managing moz web properties), ui design (e.g. the privacy issues in about:addons I linked to in a comment above) or extensions development* (this Mr. Robot thing, Pocket, and a lot of issues with the entire Test Pilot project). I'm curious about whether the problems being discussed in the article above are not so much systemic to Mozilla itself (as many commenting here fear), but rather an issue with management of certain teams within the organisation. * I refer here to teams working on web extensions, rather than those working on web extensions APIs.