21 ms·

Firefox 57 delays requests to tracking domains

472 points by bzbarsky 9y ago

marten-de-vries 9y ago
Interesting approach. I hope more browser vendors will adopt it. It comes with an additional advantage: if a website still needs to function when tracking domains are delayed a second or so, they likely will function too with said domain completely disabled (e.g. using extensions). Sounds like a win from a user perspective.
- michaelmior 9y ago
  Do you mean that browsers implementing this will force website owners to make their sites work with tracking domains delayed? This does seem like a nice side benefit.
  - zAy0LfpBZLC8mAC 9y ago
    With tracking domains disabled!? Website operators will be annoyed by the delays, so they have an incentive to make the display of their website independent from tracking, which then also should make the website work just fine if tracking is blocked completely.
  - marten-de-vries 9y ago
    Yes, that's my hope. For the income of website owners it is better if they all collectively block their site until the trackers are fully loaded. But if only a few do so, users might avoid their site, so individuals are still encouraged to support delayed loading. I imagine Mozilla is in a similar situation: if too many websites block, they will have to disable the delay or start whitelisting trackers if they do not want to loose users. That is, unless other browsers follow their lead here. Prisoner's dilemmas all around. It's going to be fun to see what we'll end up with, although I'm optimistic as I haven't heard complaints about this yet, but then again I wouldn't notice any difference myself as I'm already using NoScript.
    - yjftsjthsd-h 9y ago
      I think it's not quite a normal prisoner's dilemma, because it's not boolean. The browser can be less aggressive initially, pushing against only the worst cases, then become more aggressive over time to make site behave better.
  - bigbugbag 9y ago
    He meant that no browser with a significant market share will implement thi, the sites will remain broken which will only be evident in firefox. The side effect will be people visiting those sites will switch a different browser.
    - michaelmior 9y ago
      Given the OP's reply, I don't think that's what he meant so I would be careful about making statements on behalf of others. Apparently Firefox is sitting at 6.1% market share right now[0]. Far behind Chrome and Safari but still quite significant. [0] https://amosbbatto.wordpress.com/2017/11/21/mozilla-market-share/ https://amosbbatto.wordpress.com/2017/11/21/mozilla-market-s...
- OnlyRepliesToBS 9y ago
  So the identified trackers' requests are.. merely delayed? Wowwie! It's a great justification for building a database of perceived trackers though. Lots of useful info to slurp. A better idea: DO NOT LOAD TRACKERS PERIOD. EDIT: Look how the crowd treats alternative opinions. Can't have that, can we?
  - xeromal 9y ago
    You write like an old grandma
  - mquander 9y ago
    There's an opt-in "tracking protection" checkbox in Firefox you can click that doesn't load them at all.
    - zaphirplane 9y ago
      Hmm doesn’t it send a do not track cookie, tracker JS is still loaded and discretionary
      - jonchang 9y ago
        No, it's basically a content blocker like Adblock or noscript.
        bigbugbag 9y ago
        I'm convinced it's not. noscript is blocking scripts and xss and does all kinds of things, while mozilla intently removed the option to disable scripts in firefox. I do not know about adblock as I stopped using it a long time ago and now use ublock origin a general purpose blocker, but I certainly remember how mozilla was vocal about never adding a blocker in firefox as this would be contrary to <insert BS PR> (actually their business model).
        Sylos 9y ago
- flukus 9y ago
  Trouble is the amount of popular websites that simply don't care how long the page takes to load, 30 seconds would be acceptable to many as long as they get their advertising dollars. Users won't know who to blame. They might blame the site but they're just as likely to blame Firefox, Microsoft, their ISP or a virus. There needs to be a display saying "hey, this site is slow because it's tracking you in 15 different ways, would you like to disable this permanently?".
  - thephyber 9y ago
    You're not thinking about this from a game theory perspective. Slow down pages -> more users bounce -> fewer ad impressions -> less ad revenue.
    - coolspot 9y ago
      Also possible scenario is Slow down pages -> more users frustrated with Firefox -> fewer user share -> Mozilla closes and donates all code to Apache Foundation.
      - zaphirplane 9y ago
        Or eclipse which gets unloved projects
      - bigbugbag 9y ago
        That would be great ! Where do I sign for this ? I cannot wait for this to happen.
    - nyolfen 9y ago
      how is this game theory?
    - mehrdadn 9y ago
      > You're not thinking about this from a game theory perspective. > Slow down pages -> more users bounce -> fewer ad impressions -> less ad revenue. Game theory is the theory of how agents deal with each other. You left out the most crucial part of agents affecting each other!
- legohead 9y ago
  This shouldn't be up to the browser. He even notes edge cases where this performs unexpectedly -- unacceptable. If this is such an issue and can actually be a performance increase, then someone should release a script with the same functionality. Or optionally make it an opt-in option in settings.
  - marten-de-vries 9y ago
    They do not violate the relevant specification. They just implement it in a way that has not been done before with the user's convenience in mind. That aside, your position is unrealistic: browsers regularly break non-spec conforming websites. They actually monitor such cases (telemetry) and try to work with popular websites to fix the issue before they ship the breaking update, but it's a tradeoff that is regularly made nonetheless.
    - xg15 9y ago
      While the actions were beneficial in this case, that argument would be more convincing if the spec itself weren't a constantly moving "Living standard" maintained by the exact same organisations that also develop the browsers. And even that spec is sometimes consciously broken in an "intervention".
  - testvox 9y ago
    It shouldn't be up to the browser to implement web standards? What should browsers be doing then?
    - legohead 9y ago
      What is the web standard about delaying scripts deliberately encoded into the page? Why downvote and no explanation? I want to know if I missed something.
      - bzbarsky 9y ago
        Per the standards, scheduling and prioritization of downloads is up to browsers. The standard also defines that scripts that are not async have to be executed before later content can be parsed (because they can document.write()). They can still be loaded with any priority the browser wants; they just need to block observable DOM construction.
- sometimes42 9y ago
  It seems short-sighted to me. It's penalizing vendors who went through the trouble to make their scripts load asynchronously - which is done specifically to help page load performance. The worst offenders, who block the page with sync scripts, actually gain a competitive advantage from this change.
- notyourday 9y ago
  I have an even better approach: uBlock origin + noscript
  - fishmeat 9y ago
    Is there much different between uBlock origin vs Ad Block Plus?
    - marcoperaza 9y ago
      Yes, Adblock Plus lets website operators pay them money to be whitelisted, if the ads comply with the "Acceptable Ads" policy.
    - XzetaU8 9y ago
      "Unexpected results: Adblock plus does not help with system resource utilisation" https://twitter.com/adildean/status/936183316134416384 https://twitter.com/adildean/status/936183316134416384
    - bigbugbag 9y ago
      adblock plus is commercial operated and is paid by advertisers to get whitelisted, akin to an extorsion mafia business. It's an ad blocker coming with tainted default settings. It used to significantly impact performances (not sure if this is still the case). ublock origin is a one man personal project to improve his online browsing experience that he shared with the public and has become the goto reference. It has no whitelist or acceptable ads policy, is a general purpose blocker (blocks trackers, remote fonts, etc.) coming with sane default settings. It does not have the same performance issues adblock plus has. In short: ditch adblock plus and switch to ublock origins. You'll find more details here: https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
  - acobster 9y ago
    uMatrix is also great. It does a lot of the same things NoScript does, but at a greater granularity. I still use NoScript for its XSS protection features but have the main JS-blocking feature disabled because it's redundant.
- Feniks 9y ago
  I block ads, analytics and 3rd party fonts. Almost every site works just fine.
  - cabaalis 9y ago
    As I'm sure you're aware, many content creators that you are reading the work of fund their efforts via ads. I think this is a happy medium to attempt to improve performance of these pages without denying them compensation.
    - jstarfish 9y ago
      I used to feel bad about it, but it has become evident that any content creator still primarily funding themselves through third-party ads in 2017 is the digital equivalent of a streetwalker. It's a low-class business model that is rife with disease. There's no barrier to entry-- literally anybody can do it, there is no filtering of who they'll do business with, and it's a race to the bottom to earn pennies at the expense of their integrity. Despite having actual content of value, they share a business model with a blog farm full of Markov-generated malware-laden shitposts. Given the now-well-known threats to health and safety that third-party ads present, one does not have the right to get upset when clients insist on using protection when dealing with them. Set up a Patreon for donations, set up affiliate links or offer subscriber perks if adblocking is cutting into revenue. Either option is far more lucrative, ethical and honest than whoring oneself out for the benefit of some shady ad firm that leaves the user with a nasty case of Bonzi.
    - Sammi 9y ago
      If the ads didn't feel abusive then I might feel bad. But they do.
    - xaldir 9y ago
      Fine. Except figuring out a business model is the content creator responsibility not the user's. Business models that involve hostile 3rd party adds/tracking are bad and if your users are trying to evade those, you need to figure out something better. Blaming the user reaction won't help.
fooyc 9y ago
Is this net neutrality compliant ?
- iscoelho 9y ago
  Net neutrality is in regards to the internet carrier, not the browser (or client). The browser is irrelevant to net neutrality.
  - pbhjpbhj 9y ago
    >The browser is irrelevant to net neutrality. // It's not the currently spoken of Net Neutrality, but it's relevant to the neutral carriage of data over the internet. If browser companies pick and choose whose data to delay (or otherwise alter) then they have the power to bias the web - Firefox could always delay scripts from other companies than Google, for example, in order to preference their business associate. They presumably aren't informing users, or requiring users to enable the function. In short it seems highly pertinent in the net neutrality debate, to me, despite perhaps not having reached problematic levels and despite not being the specific form of neutrality that has erstwhile been grabbing the headlines.
    - notatoad 9y ago
      it's an issue with similar consequences to net neutrality, but it's very much not the same issue. The network is one layer, the client is a different layer. Let's not start forcing clients to conform to network rules, or vice versa. additionally, the reason net neutrality is so important is because there is no consumer choice in the ISP market for many users. Even when one browser is dominant, there's a lot more choice among browser vendors, so pushing out regulation to them is less important. But let's not muddy the waters of net neutrality by injecting separate issues into the debate. Yes, browsers should treat all traffic equally, but that isn't net neutrality.
      - nasredin 9y ago
        I think the anti-net-neutrality people are running out of fresh, not yet discredited arguments. In OSI model IIRC: Application (software) is layer 7. Physical connection is layer 1. I am sure somebody will correct me.
korethr 9y ago
While I like the idea, a potential problem comes to mind. A list of what domains are tracking domains will need to be maintained. The need to maintain that list will possibly move the cat-and-mouse game of ads vs ad-blockers to the tracking list as well. I could totally see Alphabet paying Mozilla to remove analytics.google.com from the tracking domain list (because "it's just analytics; it doesn't track you or infringe on your privacy at all") similar to advertisers paying to be on Adblock Plus' "Acceptable Ads" list.
- user5994461 9y ago
  Google analytics tracks you and infringes on your privacy.
  - korethr 9y ago
    That's the reason I put that statement in quotes. A </sarcastic> tag seemed like it set an unduly negative tone to the rest of the post.
    - nasredin 9y ago
      OT. I think we need to standardize the sarcasm tag on the Internet. Not one of those RFC that no one implements, but something concrete, perhaps baked into the HTML standard. (If the W3C include DRM, they can include sarcasm). Or maybe something like ISO, but people ignore them too. /S
      - ovao 9y ago
        There’s actually a special character for this, unfortunately not in Unicode, called SarcMark. http://www.sarcmark.com http://www.sarcmark.com
        nasredin 9y ago
        Thanks. There was recently a NYT article on trying to get a ballet shoe emoji (high heel shoes & sexism related) into Unicode. Sarcasm should be in Unicode! --- >Sarcasm, Inc. was formed in 2006 to pursue this idea, and with a great deal of effort and undying support from family and friends, the punctuation mark for sarcasm came to life. This is why America is the greatest country in the world! Sarcasm Inc even has (sarcastic?) shareholders and apps!
peterwwillis 9y ago
Well, <expletive>. Looks like I can't rely on either Chrome or Firefox not to <expletive> with websites. I would really love to just stop using the web entirely and go back to Gopher.
- marten-de-vries 9y ago
  From the article: > Scripts are delayed only when added dynamically or as async. Tracking images are always delayed. This is legal according all HTML specifications and it’s assumed that well built sites will not be affected regarding functionality. (emphasis mine)
  - peterwwillis 9y ago
    I don't know about you, but I don't browse the World Wide Implements-The-Specification-Perfectly Web.
    - TeMPOraL 9y ago
      You should expect it, though.
      - peterwwillis 9y ago
        I have both written software for standards-based protocols, and used software written to standards-based protocols, so no, I would not expect it. Not breaking backwards compatibility for existing users is the golden rule of software support. When an unfortunate pull-requester attempts to break backwards compatibility with Linus Torvalds' software, he has some very choice language to complain about the practice. If they were attempting to break backwards compatibility just because they dis-liked some particular app or service or use case, he might even use foul language. Fortunately, I am a very well behaved and good little HN user, so I will not repeat that language here. But imagine what Linus would have said, really loudly, with all capital letters. There. That's better.
        9y ago
cookiecaper 9y ago
This is the ground on which the war against Google, Facebook, et al is fought, but open-source solutions like Firefox are going to need to find a better way to monetize if they want to win. All this does is firm up the resolve of user identity resellers like FB and Google to see that Firefox gets destroyed, and it demonstrates why tech eventually all boils down to platform control. With Facebook code intruding into every nook and cranny of the web via React and Google's position as digital Sauron, monitoring and parsing out your search history, watch history, all phone activity, emails, SMSes, and more, user identity resellers are a formidable foe, and Mozilla is in its familiar position as the David of noble, non-moneyed interests challenging the user-hostile Goliath. Firefox may find unlikely allies in Microsoft and Apple, since these two companies still make at least some money selling an actual product instead of just slurping up information about their users and repackaging it. The best thing Mozilla could do is convince Apple and Microsoft to give up their independent lackluster browser implementations and ship Firefox as the default instead.
- marten-de-vries 9y ago
  I agree it would be great if other browsers implemented this as well, but you lose me at: > The best thing Mozilla could do is convince Apple and Microsoft to give up their independent lackluster browser implementations and ship Firefox as the default instead. Multiple independent implementations are of vital importance to the web. We've seen it with IE6 before, and having two browsers is cutting it too close.
  - cookiecaper 9y ago
    The "independent implementations" aren't worth much if nobody uses them. Chrome already has a majority of the market share at ~60%, with Safari, its nearest competitor, trailing far behind at ~15%. Firefox is sitting at 9.3%. [0] Combining IE/Edge, Safari, and Firefox still leaves Firefox at half of the market share of Google, and that's still a distinct disadvantage, but it's a much stronger fighting position than single-digit market share. Google and Facebook are not naive upstarts and it won't be easy to quash them, especially not when little old Mozilla is running on comparative fumes compared to a couple of the best-capitalized companies on the planet. Google and Facebook's interests are aligned as both base their business model on profiling and reselling data derived from user behavior, so it's unlikely that Google will feel inclined to implement desired user protections against that business model. It's very important that we have strong competition representing a diversity of interests, especially when the dominant player's business model is just "slick spyware". Without a competitor in the same league, consumers don't really have an option. [0] https://www.w3counter.com/globalstats.php?year=2017&month=11 https://www.w3counter.com/globalstats.php?year=2017&month=11
jancsika 9y ago
Is there a config setting for the delay period in double precision units? :)
- stesch 9y ago
  Search for "network.http.tailing" on about:config. No, I don't know what the settings do. I was just searching for "delay" and found the tailing settings.
- TD-Linux 9y ago
  If you're alluding to setting the delay to infinitely large, you can do that by going to Settings -> Privacy -> Tracking Protection and setting it to "always".
dewiz 9y ago
I’d prefer to be paid to be tracked. Eg the browser should send my wallet address as a signed header, and upon payment verification the delay (or any other penalty) lifted for 60 minutes
bo1024 9y ago
I love to see software that is actually acting on behalf of the users running the code rather than companies serving it. This does point to some problematic directions though. If web standards were simpler and it were easier to build competing browsers (and/or if we could trust plugins more), then it wouldn't be much of a concern if some browsers choose to experiment with these kinds of protections.
rotrux 9y ago
:[ I'm afraid this might be a "too-little-too-late" attempt to stave-off the downfall of net-neutrality. Net-Neutrality means that the finance of the internet is driven by site-owners receiving funds from advertisers (or from subscriptions...but that seems comparatively negligible) Getting rid of net-neutrality will mean ISPs (despite their common-carrier designation) will control this whole model^...meaning they will control the internet. The largest argument in support of repealing net-neutrality involves taking power away from advertisers...so does this Mozilla policy.
- Rudism 9y ago
  I'm not sure what article you read, but this change in Firefox is simply a change in the timing of requests to certain domains that are known to be for tracking/analytics in an attempt to improve the load time of websites. If anything this move is anti-Net Neutrality since it's prioritizing non-tracking domains over tracking domains as opposed to treating all domains equally.
  - rotrux 9y ago
    A good point, although I read the article that this comment-chain is geared towards. Be more forthright with your condescension please ^_^. The article was put out by mozilla, so of course their stated point is to make everyone's experience better. I'm in marketing, so I tend to ignore a good portion of the text in marketing/PR-blogs such as this one. Aside from that, I hadn't thought of this. You're right that if anything, this will increase the load-times of companies who rely on advertising revenue. Perhaps it's preparation?
    - jrochkind1 9y ago
      > You're right that if anything, this will increase the load-times of companies who rely on advertising revenue. Perhaps it's preparation? The _intention_, if we believe the statement (I understand you may not) is actually the opposite of this. To _improve_ perceived load times (time to display/interactability) of sites that use lots and lots of tracking scripts. If a site does not use many or any tracking scripts, it actually won't effect it at all. There are sites that use lots and lots of tracking scripts, and it actually slows down UI. The intent of this change is to _speed it up_ again. If it doesn't do that, and instead makes lots of sites load more slowly to the user's perception, it will not have been succesful at it's claimed goal.
qwerty456127 9y ago
Isn't it anti-net-neutrality? Is it ok to build it into a major browser? I actually block all the tracking, malware, ads, social networks, fraud, gambling, porn (except a couple of porn sites I like :-)) etc domains I could find information about but this is my personal conscious choice, I have manually installed extensions for this and built the lists. Shouldn't other people do the same themselves too if they choose to or leave everything as is if they don't actually feel they need to change anything?
- andrei_says_ 9y ago
  This is a good question. I’d say it is not net-neutrality related as it doesn’t influence the “pipes.” On the other hand, if it silently influences internet traffic, it does in a way censor content and could influence their bottom line. I would expect this to be an explicit switch. Edit: clarity
- paulgb 9y ago
  For me, using Firefox is the personal conscious choice you refer to. Their brand is that the browser is on your side, I'm happy to have the defaults set accordingly. (Edit: I should add that I think you're asking a very valid philosophical question that my opinion as a user of Firefox doesn't fully address)
  - qwerty456127 9y ago
    From the practical point of view, I am afraid the trackers will respond a way if such a move is made on such a global level. Nobody was fighting AdBlock+ when it was only used by geeks and now as is it has gained so much attention there are a lot of sites that won't work if you use AdBlock+. Introducing te "do-not-track" header was a great idea but it has been completely ruined by major browsers turning it on by default so the trackers have legitimately chosen to ignore it.
    - fro0116 9y ago
      > Introducing te "do-not-track" header was a great idea but it has been completely ruined by major browsers turning it on by default so the trackers have legitimately chosen to ignore it. This seems to imply that doNotTrack would have been successful for its intended purpose had it not been a default setting at one point, which feels like wishful thinking. Sure, that aspect made it impractical for uncharacteristically privacy-minded companies in the space to support the header, but the vast majority of companies in the business of tracking and advertising would have ignored it anyways, because there's zero consequence for not doing so.
mehrdadn 9y ago
Does anyone know where I can find the list of sites that are affected? EDIT: Seems to be here: https://github.com/mozilla-services/shavar-prod-lists https://github.com/mozilla-services/shavar-prod-lists
- anfedorov 9y ago
  Here it is newline-separated in case you want to import it into the Adblock DNS filter for iOS: https://gist.githubusercontent.com/anfedorov/1fa7dc8871b20dab92f856f1e8bddaff/raw/9dd5f81068cac4c90129c8c2ebb218a6df03fa5b/gistfile1.txt https://gist.githubusercontent.com/anfedorov/1fa7dc8871b20da...
  - mehrdadn 9y ago
    Thanks! I wasn't but I'm sure others will find it useful.
    - anfedorov 9y ago
      Just realized the list contains facebook.com as well as mail.google.com, so perhaps a little overly broad there.
  - robszumski 9y ago
    Is there any way you can make this work for Chrome on iOS?
    - Vinnl 9y ago
      I don't think Chrome supports extensions on mobile, but Firefox does, so you could try that if you really want an adblocker.
      - dao- 9y ago
        Firefox does on Android, not on iOS. https://support.mozilla.org/en-US/kb/add-ons-firefox-ios https://support.mozilla.org/en-US/kb/add-ons-firefox-ios
abalone 9y ago
Problem here is Firefox is making big and sometimes wrong assumptions about what these so-called "tracking domains" do. That's not in any W3C spec -- that's Mozilla attaching specific assumptions to specific parts of the Internet. Case in point: > One example is Google’s Page-Hiding Snippet, which may cause a web page to be blank for whole 4 seconds... Both the analytics.js and the test script are loaded from www.google-analytics.com, a tracking domain, for which we engage the tailing delay. Clearly if a domain is serving up an A/B test script then it is doing more than tracking. > Simply said some sites may need to be fixed to be able to adopt this change in scheduling. I have a problem with the term "fixed" here. Seems like Firefox's assumptions are what's broken here.
fiatjaf 9y ago
Google search pages are taking a lot to load on Firefox sometimes, they fail altogether a lot also after some time. Does that happen with anyone else?
beedogs 9y ago
I just block tracking domains. And ad domains. My browser, my rules. The sites that can't handle it aren't worth the bother.
paulie_a 9y ago
Ive wondered if it would be possible to tumble the requests via P2P network. Completely destroy the analytics
- yjftsjthsd-h 9y ago
  Use TOR?
  - paulie_a 9y ago
    That doesn't accomplish my goal,. I don't want to hide, I want to ruin the data collected by making it innacurate and useless EDIT: Judging from the low quality of online marketing, it isn't hard to do.
    - bigbugbag 9y ago
      Something like adnauseam ? https://adnauseam.io/ https://adnauseam.io/
- thescribe 9y ago
  I don't have much to add, but I think you have an interesting idea and it is worth exploring further.
- flukus 9y ago
  Browsers leak all kinds of information that can identify you via browser finger printing (which is already widely used): https://en.wikipedia.org/wiki/Device_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint You can check out how unique you are here: https://panopticlick.eff.org/ https://panopticlick.eff.org/
codezero 9y ago
I work for an analytics company, this will affect my snippet – I don't think it is a big deal, but I'm going to benchmark it on a few sites. From what is described here, it may actually help us. When folks throw tons of tags into their site, we're all competing against each-other as well as the site's own loading – it makes sense to prioritize the site's rendering. I think of this as no more invasive than pre-caching stuff in a page when you see links that are likely to be clicked, or any other browser optimization. I may be pounding my fist later if the results don't look great, but ultimately, I think Mozilla's heart is in the right place. I can think of tons of ways to work around this if I thought it was a real issue, I don't. People who want to block analytics, trackers, ad networks, etc... know how, and this doesn't feel like it is targeted at those people, or even squarely at the tracking pixels. HN-pre-emptive-defend-myself: My company doesn't share or sell data with third parties (it's in our TOS – and could obviously change in some Orwellian future, but we'd have to update the TOS), it's the customer's data, they can use it in the same way they'd use any other data they collect. We don't do cross-domain tracking, or aggregate behavioral information across customers, and the way we've built it, it makes it pretty hard to tie any two visitors together across sites if you were to hypothetically acquire our dataset. We're also working on building tools to comply with GDPR and wipe out data per-request. Anyways, I think a lot of very bad actors have made the space have a bad reputation and I don't blame anyone for blocking everything, or even for hating my company, or generally all analytics.
- Sophistifunk 9y ago
  It's a grey area. But I am interested, do your ToS forbid your customers from on-sharing the data with cross-site aggregators?
  - jtmcmc 9y ago
    I am not the OP but from looking at their profile - https://heapanalytics.com/terms https://heapanalytics.com/terms you can check there
  - anfedorov 9y ago
    "on-sharing the data with cross-site aggregators"? The ToS and Privacy Policy of an analytics company discloses what the that company may do with their client's users' data, not what the client can do with their own users' data. There's another Privacy Policy between the client and the user where the client discloses what they may and may not do with user data and the user decides whether to become / remain a user. There are also laws which dictate the data handling further on behalf of large groups of users, e.g. GDRP for EU citizens and, on this side of the pond, interesting Supreme Court cases being decided about what kind of data users could have property rights to: https://en.wikipedia.org/wiki/Carpenter_v._United_States https://en.wikipedia.org/wiki/Carpenter_v._United_States
kevin_thibedeau 9y ago
> Google’s A/B testing initially hides the whole web page with opacity: 0 Sounds like a violation of Google's own policies.
- vim_wannabe 9y ago
  Now try Google's sweetheart project https://www.ampproject.org/ https://www.ampproject.org/ or any amp-powered site. They contain this gem of a boilerplate hiding page content for 8 seconds or until whatever script is finally loaded that overrides it: body { animation: -amp-start 8s steps(1,end) 0s 1 normal both; } @keyframes -amp-start { from { visibility: hidden; } to { visibility: visible; } }
jjordan 9y ago
This doesn't seem like it should be built in at the browser level. The brower's job should be to process requests and render webpages as quickly as possible. If a user wants to intervene in that process, that is their prerogative, but it definitely should remain at the plugin level.
- bzbarsky 9y ago
  I agree the browser's job should be to process requests as quickly as possible. If the web page asks for 150 scripts to be loaded (e.g. that's what https://www.nytimes.com https://www.nytimes.com does right now), what is the fastest way to load them? "All in parallel" is not the right answer, so you end up prioritizing. At that point, maybe you want to prioritize the 40 non-tracking scripts (how many get loaded if I enable tracking protection in Firefox on that site) over the 110 tracking ones.
pb000 9y ago
Well, love them or hate them but tailing them is not Net Neutrality ;)
659087 9y ago
Tracking scripts should be blocked by default, not just delayed. If a user has some strange desire to be watched, give them the option to opt-in to their browser unblocking tracking scripts/domains.
- bzbarsky 9y ago
  > Tracking scripts should be blocked by default, not just delayed. There is in fact a preference to do that: Settings -> Privacy -> Tracking Protection, set to always. It breaks some reasonably popular sites, which is why it's not on by default across the board right now.
  - 659087 9y ago
    Yes, there's an option to enable blocking. I think it should be the other way around, which was kind of my whole point. That's the only way to encourage site owners to stop designing sites that break when they can't spy on users.
    - bzbarsky 9y ago
      If the tracking protection thing were being created before the sites, I agree. As things stand, it's a hard sell to have a browser do something that breaks sites that used to work. Most users tend to not be happy about it. This is definitely an area worth pushing on; the question is how best to do it.
- bigbugbag 9y ago
  Then mozilla risks losing 90% of its revenues because it comes from online tracking and ads.
- Sylos 9y ago
  Without tracking scripts, many webpage owners will be making much less money off of Firefox. If they don't make a whole lot of money off of Firefox, they won't test and optimize for Firefox much. So, we'd be seeing a lot more breakage of webpages in Firefox. Mozilla could maybe afford to pull something like that, if they had the majority marketshare, as then webpage owners would have to deal with their decisions in order to still make any revenue at all, but well, they don't.
fenier 9y ago
Any idea if a detailed notice from Mozilla will be issued about this at https://developer.mozilla.org/en-US/Firefox/Releases/57 https://developer.mozilla.org/en-US/Firefox/Releases/57 or similar?
feelin_googley 9y ago
This raises the question: Why delay instead of block? Assumption is that user wants page to load faster but does not object to tracking. What if user wants page to load faster and objects to tracking? Source of Firefox tracking protection is list at disconnect.me? credit: eco https://news.ycombinator.com/item?id=15964393 https://news.ycombinator.com/item?id=15964393 Basic gethostbyname()->HOSTS file blocking: #!/bin/sh exec curl https://disconnect.me/trackerprotection/blocked \ |sed -n '/<\/br>/!{/\./s/^/255.255.255.255 /;};/\./p' >> /etc/hosts; User may want to add these too: https://disconnect.me/trackerprotection/unblocked Beyond HOSTS file, authoritative DNS gives more flexibility, e.g. logging all requests, using wildcards, etc. For example, tinydns: #!/bin/sh curl https://disconnect.me/trackerprotection/blocked \ |sed -n '/<\/br>/!{/\./s/.*/.&\ =&:255.255.255.255:1/;};/\./p' >> _root.zone/root/data; if cd _root.zone/root/data;then exec tinydns-data;fi Or dnscache: #!/bin/sh curl https://disconnect.me/trackerprotection/blocked \ |sed -n '/<\/br>/!{ /\./s/.*/echo 255.255.255.255 > _dnscache\/root\/servers\/& /;}; /\./p' > block.sh; if sh -c ./block.sh;then exec rm block.sh;fi Note I am not recommending this particular block list. Compared to the one I use, it seems incomplete. I prefer to create own list from DNS logs from own network traffic. Use of wildcards can shorten a long list like this substantially.
- Vinnl 9y ago
  Blocking is already supported: https://support.mozilla.org/kb/tracking-protection#w_how-to-turn-tracking-protection-on https://support.mozilla.org/kb/tracking-protection#w_how-to-... Mozilla doesn't want to enable it by default because it is the funding model of the web, and no viable alternative funding model for most of the web's content has arrived yet. (At least, that's the public statement. I don't know if e.g. potential lawsuits, etc. also play a role.)
  - lucaspiller 9y ago
    It's also indirectly their funding model. The bulk of Mozilla's revenue comes from search partnerships, who earn the bulk of their revenue from advertising.
  - bigbugbag 9y ago
privacywall 9y ago
I built PrivacyWall to block all Firefox telemetry urls. It may make your browsing even faster since it blocks all unwanted data collection that happens in the background at the OS level. That means it is more effective than an extension running on top of Firefox, and Firefox cannot surreptitiously send data without your knowledge anymore. If you are working on sensitive projects and this is something you are worried about, I am making it available for free for non-commercial users at http://www.privacywall.org http://www.privacywall.org I received alot of emails from loyal Firefox users telling me they are worried about their privacy when using Firefox 57 after the Looking Glass debacle, so I decided to make it available for free. If there are tracking domains sites you you think should be blocked due to suspicious behavior, tell me the urls and I will evaluate for inclusion. Please feel free to submit it as a comment to this thread or submit it using the form submission field on the PrivacyWall homepage.
- Vinnl 9y ago
  Fun fact: you can turn off telemetry yourself in Firefox. And it's open source, so you (or someone else) can check that it's actually off.
  - privacywall 9y ago
    For the sake of Firefox users, I hope you are right. There's been complaints it flips back on after Firefox updates, so your privacy is at the whims of Firefox. Fun fact: Firefox just pushed out the Looking Glass add-on to users without notice or consent this past weekend.
    - Vinnl 9y ago
      In the case of it flipping back on, you're at the whims of bugs - just like with all software. If there's any organisation I'd trust, it's Mozilla - if only because if they make mistakes, there is a lot of pressure for them to correct this (case in point: Looking Glass). Note that Mozilla pushes code without explicit consent for all parts of it all the time - they're called software updates. The problem in this case was that it was for a potential feature that very few people cared for, and that it showed up as a scary extension in the extension list. That definitely should not have happened, but it's not a privacy violation.
ariana82 9y ago
This is not something new as I use chains of local proxy and cache proxy (Privoxy and Squid) on my PC with Firefox to block ads and tracker. The problem is Firefox has memory leak issue as it consumes ~2GB RAM while browsing Facebook or using addons like Ghostery or Adblock.
- bigbugbag 9y ago
  Why would you use ghostery which was a tool to study people who want to black ads so they can be better served ads ? Why would you use adblock which is outdated when ublock origin has been available for a while ? It's strange that you take extra steps to block ads and tracker but peruse facebook whose sole purpose is tracking and profiling you and your family, friends, acquaintances through you.
  - ariana82 9y ago
    I don't use Ghostery and AdBlock. I see my friends using it and how Firefox consume tons of his PC memory. I use different browser to access different category websites. Brave browser for social media and Firefox for news reading or researching. Both of that browsers using the same local proxy connection in my PC. I installed Privoxy and Squid on the same PC with that browsers and so they are appear as the same user agents (e.g. Chrome). When I access http://www.janbambas.cz http://www.janbambas.cz, of course my browser loading faster as my Privoxy allow/block these domains: 2017-12-21 00:55:32.780 00000f04 Request: www.janbambas.cz:443/ 2017-12-21 00:55:34.632 00001194 Crunch: Blocked: fonts.googleapis.com:443 2017-12-21 00:55:34.670 00000e3c Crunch: Blocked: secure.gravatar.com:443 2017-12-21 00:55:34.697 00000e8c Crunch: Blocked: www.google.com:443 2017-12-21 00:55:34.711 000013e8 Crunch: Blocked: secure.gravatar.com:443 2017-12-21 00:55:34.741 000012cc Crunch: Blocked: secure.gravatar.com:443 2017-12-21 00:55:35.680 00000ce4 Crunch: Blocked: secure.gravatar.com:443 2017-12-21 00:55:35.721 00000978 Crunch: Blocked: secure.gravatar.com:443 2017-12-21 00:55:35.736 000010e0 Crunch: Blocked: www.google.com:443 2017-12-21 00:55:35.759 00000104 Crunch: Blocked: secure.gravatar.com:443 You see that, my Privoxy blocked 9 connections and 3 domains. What makes me sick is this person #Honza Bambas# doesn't give a real solution to our browsing problems. He only makes us die slowly.
b0rsuk 9y ago
Unfortunately this can give ammunition to the anti-neutrality lobbyists. "See, everyone is doing it anyway."
sundarurfriend 9y ago
> To conclude on how useful the tailing feature is – unfortunately, at the moment I don’t have enough data to provide (it’s on its way, though.) I wonder if this post was rushed to publication, to manage Mozilla's public image and reestablish it as a friend to user privacy, after the 'Looking Glass' fiasco a few days ago. (I'm not exactly opposed to such PR efforts, as long as they're accompanied by actual internal change in the company.)
- bigbugbag 9y ago
  Much of mozilla communication is PR and marketing. Maybe this is damage control, but somehow I think they are not well organized enough to have this kind of thing happen. Besides how is this helping with privacy ? Trackers are still loaded and tracking.
  - ta12348765 9y ago
    "By Deeds, Not Words", Mozilla. They've had a few too many strikes lately. Their actions seem particularly greedy and tone-deaf given their supporters, and no longer aligned with what I want out of a company. Despite their constant words and apologies, they keep pulling this stuff; as a 10+ year user of Firefox I'm pulling the plug on it, just can't be trusted any longer. Silently installing a plugin and doing an end-run around any policies in place etc. is just clown-school level.
- bzbarsky 9y ago
  This post is on the personal blog of an engineer. I somewhat doubt it was posted in response to the Looking Glass thing.
jrochkind1 9y ago
Much of this discussion is missing the point that the stated goal of this change is actually to _help_ sites that use lots of tracking scripts, not to penalize them. It has become common to use so many tracking scripts that the perceived page load time (time to display/interactivity) is actually significantly slowed down. I actually first installed an ad-blocker myself when I realized some sites were taking like 5+ seconds to load, and loaded quicker with the ad-blocker. (But this change isn't a _blocker_ of scripts, it's trying to change order and timing of execution to speed up page load while _keeping_ the scripts). The intent of this change is to delay load of those scripts (which are already being loaded with code that loads them async, that is, without spec guarantees of load order or timing) until after the page UI is loaded and operative, to _improve_ perceived load time. I'm not sure if people are missing this point, or don't believe the stated goal and think it's secretly a plan to hurt these sites instead. I believe the stated goal. (whether they like or hate that idea!) As the OP says though, there are certain pages that _may_ be unintentionally harmed by the change, if they were relying on quick load of scripts that they should not have been relying on because they were already being loaded async (that is, with no guarantees of load order or timing, already). If this ends up being a non-trivial number of pages, and those pages/tracking frameworks don't fix themselves to accomodate, then I predict the change will be considered unsuccessful and unfortunately rolled back. It is meant to _help_ pages that use a lot of tracking scripts, not hurt them. Although I guess the assumption is that actual load time of interactivity is prioritized over making sure your tracking scripts are in immediately. If site owners actually prefer to slow down their pages non-trivially in order to guarantee tracking scripts immediately, then I guess they wouldn't see it as help. shrug. I think the OP author is probably regretting his post title. It maybe should have been "Firefox 57 speeds up load time to interactivity of pages with lots of tracking scripts", heh.

472 points by bzbarsky 9y ago

Interesting approach. I hope more browser vendors will adopt it. It comes with an additional advantage: if a website still needs to function when tracking domains are delayed a second or so, they likely will function too with said domain completely disabled (e.g. using extensions). Sounds like a win from a user perspective.

michaelmior 9y ago
Do you mean that browsers implementing this will force website owners to make their sites work with tracking domains delayed? This does seem like a nice side benefit.
- zAy0LfpBZLC8mAC 9y ago
  With tracking domains disabled!? Website operators will be annoyed by the delays, so they have an incentive to make the display of their website independent from tracking, which then also should make the website work just fine if tracking is blocked completely.
- marten-de-vries 9y ago
  Yes, that's my hope. For the income of website owners it is better if they all collectively block their site until the trackers are fully loaded. But if only a few do so, users might avoid their site, so individuals are still encouraged to support delayed loading. I imagine Mozilla is in a similar situation: if too many websites block, they will have to disable the delay or start whitelisting trackers if they do not want to loose users. That is, unless other browsers follow their lead here. Prisoner's dilemmas all around. It's going to be fun to see what we'll end up with, although I'm optimistic as I haven't heard complaints about this yet, but then again I wouldn't notice any difference myself as I'm already using NoScript.
  - yjftsjthsd-h 9y ago
    I think it's not quite a normal prisoner's dilemma, because it's not boolean. The browser can be less aggressive initially, pushing against only the worst cases, then become more aggressive over time to make site behave better.
- bigbugbag 9y ago
  He meant that no browser with a significant market share will implement thi, the sites will remain broken which will only be evident in firefox. The side effect will be people visiting those sites will switch a different browser.
  - michaelmior 9y ago
    Given the OP's reply, I don't think that's what he meant so I would be careful about making statements on behalf of others. Apparently Firefox is sitting at 6.1% market share right now[0]. Far behind Chrome and Safari but still quite significant. [0] https://amosbbatto.wordpress.com/2017/11/21/mozilla-market-share/ https://amosbbatto.wordpress.com/2017/11/21/mozilla-market-s...
OnlyRepliesToBS 9y ago
So the identified trackers' requests are.. merely delayed? Wowwie! It's a great justification for building a database of perceived trackers though. Lots of useful info to slurp. A better idea: DO NOT LOAD TRACKERS PERIOD. EDIT: Look how the crowd treats alternative opinions. Can't have that, can we?
- xeromal 9y ago
  You write like an old grandma
- mquander 9y ago
  There's an opt-in "tracking protection" checkbox in Firefox you can click that doesn't load them at all.
  - zaphirplane 9y ago
    Hmm doesn’t it send a do not track cookie, tracker JS is still loaded and discretionary
    - jonchang 9y ago
      No, it's basically a content blocker like Adblock or noscript.
      - bigbugbag 9y ago
        I'm convinced it's not. noscript is blocking scripts and xss and does all kinds of things, while mozilla intently removed the option to disable scripts in firefox. I do not know about adblock as I stopped using it a long time ago and now use ublock origin a general purpose blocker, but I certainly remember how mozilla was vocal about never adding a blocker in firefox as this would be contrary to <insert BS PR> (actually their business model).
        Sylos 9y ago
flukus 9y ago
Trouble is the amount of popular websites that simply don't care how long the page takes to load, 30 seconds would be acceptable to many as long as they get their advertising dollars. Users won't know who to blame. They might blame the site but they're just as likely to blame Firefox, Microsoft, their ISP or a virus. There needs to be a display saying "hey, this site is slow because it's tracking you in 15 different ways, would you like to disable this permanently?".
- thephyber 9y ago
  You're not thinking about this from a game theory perspective. Slow down pages -> more users bounce -> fewer ad impressions -> less ad revenue.
  - coolspot 9y ago
    Also possible scenario is Slow down pages -> more users frustrated with Firefox -> fewer user share -> Mozilla closes and donates all code to Apache Foundation.
    - zaphirplane 9y ago
      Or eclipse which gets unloved projects
    - bigbugbag 9y ago
      That would be great ! Where do I sign for this ? I cannot wait for this to happen.
  - nyolfen 9y ago
    how is this game theory?
  - mehrdadn 9y ago
    > You're not thinking about this from a game theory perspective. > Slow down pages -> more users bounce -> fewer ad impressions -> less ad revenue. Game theory is the theory of how agents deal with each other. You left out the most crucial part of agents affecting each other!
legohead 9y ago
This shouldn't be up to the browser. He even notes edge cases where this performs unexpectedly -- unacceptable. If this is such an issue and can actually be a performance increase, then someone should release a script with the same functionality. Or optionally make it an opt-in option in settings.
- marten-de-vries 9y ago
  They do not violate the relevant specification. They just implement it in a way that has not been done before with the user's convenience in mind. That aside, your position is unrealistic: browsers regularly break non-spec conforming websites. They actually monitor such cases (telemetry) and try to work with popular websites to fix the issue before they ship the breaking update, but it's a tradeoff that is regularly made nonetheless.
  - xg15 9y ago
    While the actions were beneficial in this case, that argument would be more convincing if the spec itself weren't a constantly moving "Living standard" maintained by the exact same organisations that also develop the browsers. And even that spec is sometimes consciously broken in an "intervention".
- testvox 9y ago
  It shouldn't be up to the browser to implement web standards? What should browsers be doing then?
  - legohead 9y ago
    What is the web standard about delaying scripts deliberately encoded into the page? Why downvote and no explanation? I want to know if I missed something.
    - bzbarsky 9y ago
      Per the standards, scheduling and prioritization of downloads is up to browsers. The standard also defines that scripts that are not async have to be executed before later content can be parsed (because they can document.write()). They can still be loaded with any priority the browser wants; they just need to block observable DOM construction.
sometimes42 9y ago
It seems short-sighted to me. It's penalizing vendors who went through the trouble to make their scripts load asynchronously - which is done specifically to help page load performance. The worst offenders, who block the page with sync scripts, actually gain a competitive advantage from this change.
notyourday 9y ago
I have an even better approach: uBlock origin + noscript
- fishmeat 9y ago
  Is there much different between uBlock origin vs Ad Block Plus?
  - marcoperaza 9y ago
    Yes, Adblock Plus lets website operators pay them money to be whitelisted, if the ads comply with the "Acceptable Ads" policy.
  - XzetaU8 9y ago
    "Unexpected results: Adblock plus does not help with system resource utilisation" https://twitter.com/adildean/status/936183316134416384 https://twitter.com/adildean/status/936183316134416384
  - bigbugbag 9y ago
    adblock plus is commercial operated and is paid by advertisers to get whitelisted, akin to an extorsion mafia business. It's an ad blocker coming with tainted default settings. It used to significantly impact performances (not sure if this is still the case). ublock origin is a one man personal project to improve his online browsing experience that he shared with the public and has become the goto reference. It has no whitelist or acceptable ads policy, is a general purpose blocker (blocks trackers, remote fonts, etc.) coming with sane default settings. It does not have the same performance issues adblock plus has. In short: ditch adblock plus and switch to ublock origins. You'll find more details here: https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
- acobster 9y ago
  uMatrix is also great. It does a lot of the same things NoScript does, but at a greater granularity. I still use NoScript for its XSS protection features but have the main JS-blocking feature disabled because it's redundant.
Feniks 9y ago
I block ads, analytics and 3rd party fonts. Almost every site works just fine.
- cabaalis 9y ago
  As I'm sure you're aware, many content creators that you are reading the work of fund their efforts via ads. I think this is a happy medium to attempt to improve performance of these pages without denying them compensation.
  - jstarfish 9y ago
    I used to feel bad about it, but it has become evident that any content creator still primarily funding themselves through third-party ads in 2017 is the digital equivalent of a streetwalker. It's a low-class business model that is rife with disease. There's no barrier to entry-- literally anybody can do it, there is no filtering of who they'll do business with, and it's a race to the bottom to earn pennies at the expense of their integrity. Despite having actual content of value, they share a business model with a blog farm full of Markov-generated malware-laden shitposts. Given the now-well-known threats to health and safety that third-party ads present, one does not have the right to get upset when clients insist on using protection when dealing with them. Set up a Patreon for donations, set up affiliate links or offer subscriber perks if adblocking is cutting into revenue. Either option is far more lucrative, ethical and honest than whoring oneself out for the benefit of some shady ad firm that leaves the user with a nasty case of Bonzi.
  - Sammi 9y ago
    If the ads didn't feel abusive then I might feel bad. But they do.
  - xaldir 9y ago
    Fine. Except figuring out a business model is the content creator responsibility not the user's. Business models that involve hostile 3rd party adds/tracking are bad and if your users are trying to evade those, you need to figure out something better. Blaming the user reaction won't help.

fooyc 9y ago

Is this net neutrality compliant ?

iscoelho 9y ago
Net neutrality is in regards to the internet carrier, not the browser (or client). The browser is irrelevant to net neutrality.
- pbhjpbhj 9y ago
  >The browser is irrelevant to net neutrality. // It's not the currently spoken of Net Neutrality, but it's relevant to the neutral carriage of data over the internet. If browser companies pick and choose whose data to delay (or otherwise alter) then they have the power to bias the web - Firefox could always delay scripts from other companies than Google, for example, in order to preference their business associate. They presumably aren't informing users, or requiring users to enable the function. In short it seems highly pertinent in the net neutrality debate, to me, despite perhaps not having reached problematic levels and despite not being the specific form of neutrality that has erstwhile been grabbing the headlines.
  - notatoad 9y ago
    it's an issue with similar consequences to net neutrality, but it's very much not the same issue. The network is one layer, the client is a different layer. Let's not start forcing clients to conform to network rules, or vice versa. additionally, the reason net neutrality is so important is because there is no consumer choice in the ISP market for many users. Even when one browser is dominant, there's a lot more choice among browser vendors, so pushing out regulation to them is less important. But let's not muddy the waters of net neutrality by injecting separate issues into the debate. Yes, browsers should treat all traffic equally, but that isn't net neutrality.
    - nasredin 9y ago
      I think the anti-net-neutrality people are running out of fresh, not yet discredited arguments. In OSI model IIRC: Application (software) is layer 7. Physical connection is layer 1. I am sure somebody will correct me.

korethr 9y ago

While I like the idea, a potential problem comes to mind. A list of what domains are tracking domains will need to be maintained. The need to maintain that list will possibly move the cat-and-mouse game of ads vs ad-blockers to the tracking list as well. I could totally see Alphabet paying Mozilla to remove analytics.google.com from the tracking domain list (because "it's just analytics; it doesn't track you or infringe on your privacy at all") similar to advertisers paying to be on Adblock Plus' "Acceptable Ads" list.

user5994461 9y ago
Google analytics tracks you and infringes on your privacy.
- korethr 9y ago
  That's the reason I put that statement in quotes. A </sarcastic> tag seemed like it set an unduly negative tone to the rest of the post.
  - nasredin 9y ago
    OT. I think we need to standardize the sarcasm tag on the Internet. Not one of those RFC that no one implements, but something concrete, perhaps baked into the HTML standard. (If the W3C include DRM, they can include sarcasm). Or maybe something like ISO, but people ignore them too. /S
    - ovao 9y ago
      There’s actually a special character for this, unfortunately not in Unicode, called SarcMark. http://www.sarcmark.com http://www.sarcmark.com
      - nasredin 9y ago
        Thanks. There was recently a NYT article on trying to get a ballet shoe emoji (high heel shoes & sexism related) into Unicode. Sarcasm should be in Unicode! --- >Sarcasm, Inc. was formed in 2006 to pursue this idea, and with a great deal of effort and undying support from family and friends, the punctuation mark for sarcasm came to life. This is why America is the greatest country in the world! Sarcasm Inc even has (sarcastic?) shareholders and apps!

peterwwillis 9y ago

Well, <expletive>. Looks like I can't rely on either Chrome or Firefox not to <expletive> with websites. I would really love to just stop using the web entirely and go back to Gopher.

marten-de-vries 9y ago
From the article: > Scripts are delayed only when added dynamically or as async. Tracking images are always delayed. This is legal according all HTML specifications and it’s assumed that well built sites will not be affected regarding functionality. (emphasis mine)
- peterwwillis 9y ago
  I don't know about you, but I don't browse the World Wide Implements-The-Specification-Perfectly Web.
  - TeMPOraL 9y ago
    You should expect it, though.
    - peterwwillis 9y ago
      I have both written software for standards-based protocols, and used software written to standards-based protocols, so no, I would not expect it. Not breaking backwards compatibility for existing users is the golden rule of software support. When an unfortunate pull-requester attempts to break backwards compatibility with Linus Torvalds' software, he has some very choice language to complain about the practice. If they were attempting to break backwards compatibility just because they dis-liked some particular app or service or use case, he might even use foul language. Fortunately, I am a very well behaved and good little HN user, so I will not repeat that language here. But imagine what Linus would have said, really loudly, with all capital letters. There. That's better.
      - 9y ago

cookiecaper 9y ago

This is the ground on which the war against Google, Facebook, et al is fought, but open-source solutions like Firefox are going to need to find a better way to monetize if they want to win. All this does is firm up the resolve of user identity resellers like FB and Google to see that Firefox gets destroyed, and it demonstrates why tech eventually all boils down to platform control. With Facebook code intruding into every nook and cranny of the web via React and Google's position as digital Sauron, monitoring and parsing out your search history, watch history, all phone activity, emails, SMSes, and more, user identity resellers are a formidable foe, and Mozilla is in its familiar position as the David of noble, non-moneyed interests challenging the user-hostile Goliath. Firefox may find unlikely allies in Microsoft and Apple, since these two companies still make at least some money selling an actual product instead of just slurping up information about their users and repackaging it. The best thing Mozilla could do is convince Apple and Microsoft to give up their independent lackluster browser implementations and ship Firefox as the default instead.

marten-de-vries 9y ago
I agree it would be great if other browsers implemented this as well, but you lose me at: > The best thing Mozilla could do is convince Apple and Microsoft to give up their independent lackluster browser implementations and ship Firefox as the default instead. Multiple independent implementations are of vital importance to the web. We've seen it with IE6 before, and having two browsers is cutting it too close.
- cookiecaper 9y ago
  The "independent implementations" aren't worth much if nobody uses them. Chrome already has a majority of the market share at ~60%, with Safari, its nearest competitor, trailing far behind at ~15%. Firefox is sitting at 9.3%. [0] Combining IE/Edge, Safari, and Firefox still leaves Firefox at half of the market share of Google, and that's still a distinct disadvantage, but it's a much stronger fighting position than single-digit market share. Google and Facebook are not naive upstarts and it won't be easy to quash them, especially not when little old Mozilla is running on comparative fumes compared to a couple of the best-capitalized companies on the planet. Google and Facebook's interests are aligned as both base their business model on profiling and reselling data derived from user behavior, so it's unlikely that Google will feel inclined to implement desired user protections against that business model. It's very important that we have strong competition representing a diversity of interests, especially when the dominant player's business model is just "slick spyware". Without a competitor in the same league, consumers don't really have an option. [0] https://www.w3counter.com/globalstats.php?year=2017&month=11 https://www.w3counter.com/globalstats.php?year=2017&month=11

jancsika 9y ago

Is there a config setting for the delay period in double precision units? :)

stesch 9y ago
Search for "network.http.tailing" on about:config. No, I don't know what the settings do. I was just searching for "delay" and found the tailing settings.
TD-Linux 9y ago
If you're alluding to setting the delay to infinitely large, you can do that by going to Settings -> Privacy -> Tracking Protection and setting it to "always".

dewiz 9y ago

I’d prefer to be paid to be tracked. Eg the browser should send my wallet address as a signed header, and upon payment verification the delay (or any other penalty) lifted for 60 minutes

bo1024 9y ago

I love to see software that is actually acting on behalf of the users running the code rather than companies serving it. This does point to some problematic directions though. If web standards were simpler and it were easier to build competing browsers (and/or if we could trust plugins more), then it wouldn't be much of a concern if some browsers choose to experiment with these kinds of protections.

rotrux 9y ago

:[ I'm afraid this might be a "too-little-too-late" attempt to stave-off the downfall of net-neutrality. Net-Neutrality means that the finance of the internet is driven by site-owners receiving funds from advertisers (or from subscriptions...but that seems comparatively negligible) Getting rid of net-neutrality will mean ISPs (despite their common-carrier designation) will control this whole model^...meaning they will control the internet. The largest argument in support of repealing net-neutrality involves taking power away from advertisers...so does this Mozilla policy.

Rudism 9y ago
I'm not sure what article you read, but this change in Firefox is simply a change in the timing of requests to certain domains that are known to be for tracking/analytics in an attempt to improve the load time of websites. If anything this move is anti-Net Neutrality since it's prioritizing non-tracking domains over tracking domains as opposed to treating all domains equally.
- rotrux 9y ago
  A good point, although I read the article that this comment-chain is geared towards. Be more forthright with your condescension please ^_^. The article was put out by mozilla, so of course their stated point is to make everyone's experience better. I'm in marketing, so I tend to ignore a good portion of the text in marketing/PR-blogs such as this one. Aside from that, I hadn't thought of this. You're right that if anything, this will increase the load-times of companies who rely on advertising revenue. Perhaps it's preparation?
  - jrochkind1 9y ago
    > You're right that if anything, this will increase the load-times of companies who rely on advertising revenue. Perhaps it's preparation? The _intention_, if we believe the statement (I understand you may not) is actually the opposite of this. To _improve_ perceived load times (time to display/interactability) of sites that use lots and lots of tracking scripts. If a site does not use many or any tracking scripts, it actually won't effect it at all. There are sites that use lots and lots of tracking scripts, and it actually slows down UI. The intent of this change is to _speed it up_ again. If it doesn't do that, and instead makes lots of sites load more slowly to the user's perception, it will not have been succesful at it's claimed goal.

qwerty456127 9y ago

Isn't it anti-net-neutrality? Is it ok to build it into a major browser? I actually block all the tracking, malware, ads, social networks, fraud, gambling, porn (except a couple of porn sites I like :-)) etc domains I could find information about but this is my personal conscious choice, I have manually installed extensions for this and built the lists. Shouldn't other people do the same themselves too if they choose to or leave everything as is if they don't actually feel they need to change anything?

andrei_says_ 9y ago
This is a good question. I’d say it is not net-neutrality related as it doesn’t influence the “pipes.” On the other hand, if it silently influences internet traffic, it does in a way censor content and could influence their bottom line. I would expect this to be an explicit switch. Edit: clarity
paulgb 9y ago
For me, using Firefox is the personal conscious choice you refer to. Their brand is that the browser is on your side, I'm happy to have the defaults set accordingly. (Edit: I should add that I think you're asking a very valid philosophical question that my opinion as a user of Firefox doesn't fully address)
- qwerty456127 9y ago
  From the practical point of view, I am afraid the trackers will respond a way if such a move is made on such a global level. Nobody was fighting AdBlock+ when it was only used by geeks and now as is it has gained so much attention there are a lot of sites that won't work if you use AdBlock+. Introducing te "do-not-track" header was a great idea but it has been completely ruined by major browsers turning it on by default so the trackers have legitimately chosen to ignore it.
  - fro0116 9y ago
    > Introducing te "do-not-track" header was a great idea but it has been completely ruined by major browsers turning it on by default so the trackers have legitimately chosen to ignore it. This seems to imply that doNotTrack would have been successful for its intended purpose had it not been a default setting at one point, which feels like wishful thinking. Sure, that aspect made it impractical for uncharacteristically privacy-minded companies in the space to support the header, but the vast majority of companies in the business of tracking and advertising would have ignored it anyways, because there's zero consequence for not doing so.

mehrdadn 9y ago

Does anyone know where I can find the list of sites that are affected? EDIT: Seems to be here: https://github.com/mozilla-services/shavar-prod-lists https://github.com/mozilla-services/shavar-prod-lists

anfedorov 9y ago
Here it is newline-separated in case you want to import it into the Adblock DNS filter for iOS: https://gist.githubusercontent.com/anfedorov/1fa7dc8871b20dab92f856f1e8bddaff/raw/9dd5f81068cac4c90129c8c2ebb218a6df03fa5b/gistfile1.txt https://gist.githubusercontent.com/anfedorov/1fa7dc8871b20da...
- mehrdadn 9y ago
  Thanks! I wasn't but I'm sure others will find it useful.
  - anfedorov 9y ago
    Just realized the list contains facebook.com as well as mail.google.com, so perhaps a little overly broad there.
- robszumski 9y ago
  Is there any way you can make this work for Chrome on iOS?
  - Vinnl 9y ago
    I don't think Chrome supports extensions on mobile, but Firefox does, so you could try that if you really want an adblocker.
    - dao- 9y ago
      Firefox does on Android, not on iOS. https://support.mozilla.org/en-US/kb/add-ons-firefox-ios https://support.mozilla.org/en-US/kb/add-ons-firefox-ios

abalone 9y ago

Problem here is Firefox is making big and sometimes wrong assumptions about what these so-called "tracking domains" do. That's not in any W3C spec -- that's Mozilla attaching specific assumptions to specific parts of the Internet. Case in point: > One example is Google’s Page-Hiding Snippet, which may cause a web page to be blank for whole 4 seconds... Both the analytics.js and the test script are loaded from www.google-analytics.com, a tracking domain, for which we engage the tailing delay. Clearly if a domain is serving up an A/B test script then it is doing more than tracking. > Simply said some sites may need to be fixed to be able to adopt this change in scheduling. I have a problem with the term "fixed" here. Seems like Firefox's assumptions are what's broken here.

fiatjaf 9y ago

Google search pages are taking a lot to load on Firefox sometimes, they fail altogether a lot also after some time. Does that happen with anyone else?

beedogs 9y ago

I just block tracking domains. And ad domains. My browser, my rules. The sites that can't handle it aren't worth the bother.

paulie_a 9y ago

Ive wondered if it would be possible to tumble the requests via P2P network. Completely destroy the analytics

yjftsjthsd-h 9y ago
Use TOR?
- paulie_a 9y ago
  That doesn't accomplish my goal,. I don't want to hide, I want to ruin the data collected by making it innacurate and useless EDIT: Judging from the low quality of online marketing, it isn't hard to do.
  - bigbugbag 9y ago
    Something like adnauseam ? https://adnauseam.io/ https://adnauseam.io/
thescribe 9y ago
I don't have much to add, but I think you have an interesting idea and it is worth exploring further.
flukus 9y ago
Browsers leak all kinds of information that can identify you via browser finger printing (which is already widely used): https://en.wikipedia.org/wiki/Device_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint You can check out how unique you are here: https://panopticlick.eff.org/ https://panopticlick.eff.org/

codezero 9y ago

I work for an analytics company, this will affect my snippet – I don't think it is a big deal, but I'm going to benchmark it on a few sites. From what is described here, it may actually help us. When folks throw tons of tags into their site, we're all competing against each-other as well as the site's own loading – it makes sense to prioritize the site's rendering. I think of this as no more invasive than pre-caching stuff in a page when you see links that are likely to be clicked, or any other browser optimization. I may be pounding my fist later if the results don't look great, but ultimately, I think Mozilla's heart is in the right place. I can think of tons of ways to work around this if I thought it was a real issue, I don't. People who want to block analytics, trackers, ad networks, etc... know how, and this doesn't feel like it is targeted at those people, or even squarely at the tracking pixels. HN-pre-emptive-defend-myself: My company doesn't share or sell data with third parties (it's in our TOS – and could obviously change in some Orwellian future, but we'd have to update the TOS), it's the customer's data, they can use it in the same way they'd use any other data they collect. We don't do cross-domain tracking, or aggregate behavioral information across customers, and the way we've built it, it makes it pretty hard to tie any two visitors together across sites if you were to hypothetically acquire our dataset. We're also working on building tools to comply with GDPR and wipe out data per-request. Anyways, I think a lot of very bad actors have made the space have a bad reputation and I don't blame anyone for blocking everything, or even for hating my company, or generally all analytics.

Sophistifunk 9y ago
It's a grey area. But I am interested, do your ToS forbid your customers from on-sharing the data with cross-site aggregators?
- jtmcmc 9y ago
  I am not the OP but from looking at their profile - https://heapanalytics.com/terms https://heapanalytics.com/terms you can check there
- anfedorov 9y ago
  "on-sharing the data with cross-site aggregators"? The ToS and Privacy Policy of an analytics company discloses what the that company may do with their client's users' data, not what the client can do with their own users' data. There's another Privacy Policy between the client and the user where the client discloses what they may and may not do with user data and the user decides whether to become / remain a user. There are also laws which dictate the data handling further on behalf of large groups of users, e.g. GDRP for EU citizens and, on this side of the pond, interesting Supreme Court cases being decided about what kind of data users could have property rights to: https://en.wikipedia.org/wiki/Carpenter_v._United_States https://en.wikipedia.org/wiki/Carpenter_v._United_States

kevin_thibedeau 9y ago

> Google’s A/B testing initially hides the whole web page with opacity: 0 Sounds like a violation of Google's own policies.

vim_wannabe 9y ago
Now try Google's sweetheart project https://www.ampproject.org/ https://www.ampproject.org/ or any amp-powered site. They contain this gem of a boilerplate hiding page content for 8 seconds or until whatever script is finally loaded that overrides it: body { animation: -amp-start 8s steps(1,end) 0s 1 normal both; } @keyframes -amp-start { from { visibility: hidden; } to { visibility: visible; } }

jjordan 9y ago

This doesn't seem like it should be built in at the browser level. The brower's job should be to process requests and render webpages as quickly as possible. If a user wants to intervene in that process, that is their prerogative, but it definitely should remain at the plugin level.

bzbarsky 9y ago
I agree the browser's job should be to process requests as quickly as possible. If the web page asks for 150 scripts to be loaded (e.g. that's what https://www.nytimes.com https://www.nytimes.com does right now), what is the fastest way to load them? "All in parallel" is not the right answer, so you end up prioritizing. At that point, maybe you want to prioritize the 40 non-tracking scripts (how many get loaded if I enable tracking protection in Firefox on that site) over the 110 tracking ones.

pb000 9y ago

Well, love them or hate them but tailing them is not Net Neutrality ;)

659087 9y ago

Tracking scripts should be blocked by default, not just delayed. If a user has some strange desire to be watched, give them the option to opt-in to their browser unblocking tracking scripts/domains.

bzbarsky 9y ago
> Tracking scripts should be blocked by default, not just delayed. There is in fact a preference to do that: Settings -> Privacy -> Tracking Protection, set to always. It breaks some reasonably popular sites, which is why it's not on by default across the board right now.
- 659087 9y ago
  Yes, there's an option to enable blocking. I think it should be the other way around, which was kind of my whole point. That's the only way to encourage site owners to stop designing sites that break when they can't spy on users.
  - bzbarsky 9y ago
    If the tracking protection thing were being created before the sites, I agree. As things stand, it's a hard sell to have a browser do something that breaks sites that used to work. Most users tend to not be happy about it. This is definitely an area worth pushing on; the question is how best to do it.
bigbugbag 9y ago
Then mozilla risks losing 90% of its revenues because it comes from online tracking and ads.
Sylos 9y ago
Without tracking scripts, many webpage owners will be making much less money off of Firefox. If they don't make a whole lot of money off of Firefox, they won't test and optimize for Firefox much. So, we'd be seeing a lot more breakage of webpages in Firefox. Mozilla could maybe afford to pull something like that, if they had the majority marketshare, as then webpage owners would have to deal with their decisions in order to still make any revenue at all, but well, they don't.

fenier 9y ago

Any idea if a detailed notice from Mozilla will be issued about this at https://developer.mozilla.org/en-US/Firefox/Releases/57 https://developer.mozilla.org/en-US/Firefox/Releases/57 or similar?

feelin_googley 9y ago

This raises the question: Why delay instead of block? Assumption is that user wants page to load faster but does not object to tracking. What if user wants page to load faster and objects to tracking? Source of Firefox tracking protection is list at disconnect.me? credit: eco https://news.ycombinator.com/item?id=15964393 https://news.ycombinator.com/item?id=15964393 Basic gethostbyname()->HOSTS file blocking: #!/bin/sh exec curl https://disconnect.me/trackerprotection/blocked \ |sed -n '/<\/br>/!{/\./s/^/255.255.255.255 /;};/\./p' >> /etc/hosts; User may want to add these too: https://disconnect.me/trackerprotection/unblocked Beyond HOSTS file, authoritative DNS gives more flexibility, e.g. logging all requests, using wildcards, etc. For example, tinydns: #!/bin/sh curl https://disconnect.me/trackerprotection/blocked \ |sed -n '/<\/br>/!{/\./s/.*/.&\ =&:255.255.255.255:1/;};/\./p' >> _root.zone/root/data; if cd _root.zone/root/data;then exec tinydns-data;fi Or dnscache: #!/bin/sh curl https://disconnect.me/trackerprotection/blocked \ |sed -n '/<\/br>/!{ /\./s/.*/echo 255.255.255.255 > _dnscache\/root\/servers\/& /;}; /\./p' > block.sh; if sh -c ./block.sh;then exec rm block.sh;fi Note I am not recommending this particular block list. Compared to the one I use, it seems incomplete. I prefer to create own list from DNS logs from own network traffic. Use of wildcards can shorten a long list like this substantially.

Vinnl 9y ago
Blocking is already supported: https://support.mozilla.org/kb/tracking-protection#w_how-to-turn-tracking-protection-on https://support.mozilla.org/kb/tracking-protection#w_how-to-... Mozilla doesn't want to enable it by default because it is the funding model of the web, and no viable alternative funding model for most of the web's content has arrived yet. (At least, that's the public statement. I don't know if e.g. potential lawsuits, etc. also play a role.)
- lucaspiller 9y ago
  It's also indirectly their funding model. The bulk of Mozilla's revenue comes from search partnerships, who earn the bulk of their revenue from advertising.
- bigbugbag 9y ago

privacywall 9y ago

I built PrivacyWall to block all Firefox telemetry urls. It may make your browsing even faster since it blocks all unwanted data collection that happens in the background at the OS level. That means it is more effective than an extension running on top of Firefox, and Firefox cannot surreptitiously send data without your knowledge anymore. If you are working on sensitive projects and this is something you are worried about, I am making it available for free for non-commercial users at http://www.privacywall.org http://www.privacywall.org I received alot of emails from loyal Firefox users telling me they are worried about their privacy when using Firefox 57 after the Looking Glass debacle, so I decided to make it available for free. If there are tracking domains sites you you think should be blocked due to suspicious behavior, tell me the urls and I will evaluate for inclusion. Please feel free to submit it as a comment to this thread or submit it using the form submission field on the PrivacyWall homepage.

Vinnl 9y ago
Fun fact: you can turn off telemetry yourself in Firefox. And it's open source, so you (or someone else) can check that it's actually off.
- privacywall 9y ago
  For the sake of Firefox users, I hope you are right. There's been complaints it flips back on after Firefox updates, so your privacy is at the whims of Firefox. Fun fact: Firefox just pushed out the Looking Glass add-on to users without notice or consent this past weekend.
  - Vinnl 9y ago
    In the case of it flipping back on, you're at the whims of bugs - just like with all software. If there's any organisation I'd trust, it's Mozilla - if only because if they make mistakes, there is a lot of pressure for them to correct this (case in point: Looking Glass). Note that Mozilla pushes code without explicit consent for all parts of it all the time - they're called software updates. The problem in this case was that it was for a potential feature that very few people cared for, and that it showed up as a scary extension in the extension list. That definitely should not have happened, but it's not a privacy violation.

ariana82 9y ago

This is not something new as I use chains of local proxy and cache proxy (Privoxy and Squid) on my PC with Firefox to block ads and tracker. The problem is Firefox has memory leak issue as it consumes ~2GB RAM while browsing Facebook or using addons like Ghostery or Adblock.

bigbugbag 9y ago
Why would you use ghostery which was a tool to study people who want to black ads so they can be better served ads ? Why would you use adblock which is outdated when ublock origin has been available for a while ? It's strange that you take extra steps to block ads and tracker but peruse facebook whose sole purpose is tracking and profiling you and your family, friends, acquaintances through you.
- ariana82 9y ago
  I don't use Ghostery and AdBlock. I see my friends using it and how Firefox consume tons of his PC memory. I use different browser to access different category websites. Brave browser for social media and Firefox for news reading or researching. Both of that browsers using the same local proxy connection in my PC. I installed Privoxy and Squid on the same PC with that browsers and so they are appear as the same user agents (e.g. Chrome). When I access http://www.janbambas.cz http://www.janbambas.cz, of course my browser loading faster as my Privoxy allow/block these domains: 2017-12-21 00:55:32.780 00000f04 Request: www.janbambas.cz:443/ 2017-12-21 00:55:34.632 00001194 Crunch: Blocked: fonts.googleapis.com:443 2017-12-21 00:55:34.670 00000e3c Crunch: Blocked: secure.gravatar.com:443 2017-12-21 00:55:34.697 00000e8c Crunch: Blocked: www.google.com:443 2017-12-21 00:55:34.711 000013e8 Crunch: Blocked: secure.gravatar.com:443 2017-12-21 00:55:34.741 000012cc Crunch: Blocked: secure.gravatar.com:443 2017-12-21 00:55:35.680 00000ce4 Crunch: Blocked: secure.gravatar.com:443 2017-12-21 00:55:35.721 00000978 Crunch: Blocked: secure.gravatar.com:443 2017-12-21 00:55:35.736 000010e0 Crunch: Blocked: www.google.com:443 2017-12-21 00:55:35.759 00000104 Crunch: Blocked: secure.gravatar.com:443 You see that, my Privoxy blocked 9 connections and 3 domains. What makes me sick is this person #Honza Bambas# doesn't give a real solution to our browsing problems. He only makes us die slowly.

b0rsuk 9y ago

Unfortunately this can give ammunition to the anti-neutrality lobbyists. "See, everyone is doing it anyway."

sundarurfriend 9y ago

> To conclude on how useful the tailing feature is – unfortunately, at the moment I don’t have enough data to provide (it’s on its way, though.) I wonder if this post was rushed to publication, to manage Mozilla's public image and reestablish it as a friend to user privacy, after the 'Looking Glass' fiasco a few days ago. (I'm not exactly opposed to such PR efforts, as long as they're accompanied by actual internal change in the company.)

bigbugbag 9y ago
Much of mozilla communication is PR and marketing. Maybe this is damage control, but somehow I think they are not well organized enough to have this kind of thing happen. Besides how is this helping with privacy ? Trackers are still loaded and tracking.
- ta12348765 9y ago
  "By Deeds, Not Words", Mozilla. They've had a few too many strikes lately. Their actions seem particularly greedy and tone-deaf given their supporters, and no longer aligned with what I want out of a company. Despite their constant words and apologies, they keep pulling this stuff; as a 10+ year user of Firefox I'm pulling the plug on it, just can't be trusted any longer. Silently installing a plugin and doing an end-run around any policies in place etc. is just clown-school level.
bzbarsky 9y ago
This post is on the personal blog of an engineer. I somewhat doubt it was posted in response to the Looking Glass thing.

jrochkind1 9y ago

Much of this discussion is missing the point that the stated goal of this change is actually to _help_ sites that use lots of tracking scripts, not to penalize them. It has become common to use so many tracking scripts that the perceived page load time (time to display/interactivity) is actually significantly slowed down. I actually first installed an ad-blocker myself when I realized some sites were taking like 5+ seconds to load, and loaded quicker with the ad-blocker. (But this change isn't a _blocker_ of scripts, it's trying to change order and timing of execution to speed up page load while _keeping_ the scripts). The intent of this change is to delay load of those scripts (which are already being loaded with code that loads them async, that is, without spec guarantees of load order or timing) until after the page UI is loaded and operative, to _improve_ perceived load time. I'm not sure if people are missing this point, or don't believe the stated goal and think it's secretly a plan to hurt these sites instead. I believe the stated goal. (whether they like or hate that idea!) As the OP says though, there are certain pages that _may_ be unintentionally harmed by the change, if they were relying on quick load of scripts that they should not have been relying on because they were already being loaded async (that is, with no guarantees of load order or timing, already). If this ends up being a non-trivial number of pages, and those pages/tracking frameworks don't fix themselves to accomodate, then I predict the change will be considered unsuccessful and unfortunately rolled back. It is meant to _help_ pages that use a lot of tracking scripts, not hurt them. Although I guess the assumption is that actual load time of interactivity is prioritized over making sure your tracking scripts are in immediately. If site owners actually prefer to slow down their pages non-trivially in order to guarantee tracking scripts immediately, then I guess they wouldn't see it as help. shrug. I think the OP author is probably regretting his post title. It maybe should have been "Firefox 57 speeds up load time to interactivity of pages with lots of tracking scripts", heh.