15 ms·

You probably don't want to run Firefox Nightly any more

253 points by jlgaddis 9y ago

kenhwang 9y ago
This is honestly the reason I do use Nightly. I'm volunteering to provide information that I understand could be very intimate in hopes it's useful to Mozilla in making Firefox better. Data drives better decisions, and I'd rather the technically savvy volunteer their privacy than it being extracted from the general populace. So yes, kick me a bit, I'll let you know what breaks.
- exikyut 9y ago
  But in the absence of this news article, you couldn't have been more specific about the information you're volunteering without initiating further research yourself. I do think Firefox/Mozilla should be explicit about the current list of experiments.
- toflon 9y ago
  Same here. Call me naive all you want, but I do think Mozilla has our best intention. They won't sell the data, they will try to keep it as secure as possible and anonymize it. As seen they even made a deal with Cloudflare to ensure they don't log any of that data. I'm a strong advocate for privacy but if I'm going to give away my data I'd rather have it be Mozilla than Facebook or Google.
  - OskarS 9y ago
    Yeah, totally agree. Mozilla needs user data like this for their product, and I think it's a perfectly reasonable solution to collect it from Nightly users who have opted into being guinea pigs. > I'm a strong advocate for privacy but if I'm going to give away my data I'd rather have it be Mozilla than Facebook or Google. Yep. There's no company I trust more than Mozilla when it comes to handling my data in a safe and responsible manner.
  - dwild 9y ago
    Sure that's all fine if you are aware of it and agree with it. Isn't it the same as Cambridge Analytica? That was a feature of Facebook to share your friend information... it still makes it bad. The fact that Mozilla has good intention doesn't change how it was done. Secrecy isn't the solution, it only pushes toward these kinds of publications and outrage. If it was known, believe me, we wouldn't be here having that discussion, it would be a non-issue.
r00fus 9y ago
I'm ok as long as they make it up front and clear. It's not meant to have the "latest greatest" - it's meant to collect analytics to understand and respond to where changes in the nightly might have broken something critical. That said, a large chunk of the web is getting very personal. So I'm not sure Mozilla's rights to do as they please matter if the venn-diagram between nightly-users and privacy-stalwarts is anywhere near 30% overlap.
- nallerooth 9y ago
  I agree. They can send my data wherever they want - as long as they tell me about it so that I can make an informed decision. Now, nightly is nightly - you don't accidentally build and install it on your system. But if this behavior is included in other pre-release versions (such as the developer edition), the need for informing the user becomes even more important. I've installed the developer edition from the Arch linux User Repository (AUR), which means that I don't see any release notes or information boxes on the developer edition website when I'm getting the software. A small popup in a corner telling me that "There's a new way to help improve firefox" after an upgrade/install would solve this. I don't want 15 levels of confirmation and a roll of tin foil - I just want something informing me that my data will be sent to a new receiver, and why.
dahdum 9y ago
Opt-out privacy violations are not new for Mozilla, did worse than this to German users last year, discussed here: https://news.ycombinator.com/item?id=15421708 https://news.ycombinator.com/item?id=15421708
aorth 9y ago
I understand the desire for statistics, but they should make it more obvious that nightly isn't just daily builds from master. I've run Nightly from time to time and had no idea it was automatically opting in to Shield studies. Both this and the Mr. Robot extension issue a few months ago erode my trust in Mozilla a little. Counterpoint: only god knows what Google is sending itself from Chrome!
- nallerooth 9y ago
  The difference here is that you expect Google to collect -a lot- of data about you and your browsing habits. You can also be quite sure that they'll want to keep that data to themselves. When my data ends up at a third party, especially without my knowledge, I'm much more concerned about it being sold and or shared further.
  - kbenson 9y ago
    > You can also be quite sure that they'll want to keep that data to themselves. I've traditionally made the same argument. I still mostly believe it WRT Google. Facebook's current woes with Cambridge Analytica has hurt my confidence in this some.
  - caconym_ 9y ago
    > When my data ends up at a third party, especially without my knowledge, I'm much more concerned about it being sold and or shared further. That or stolen thanks to negligent data handling practices. Or maybe both (e.g. Equifax).
  - geofft 9y ago
    > When my data ends up at a third party, especially without my knowledge, I'm much more concerned about it being sold and or shared further. As stated in the mailing list thread linked in the article, Mozilla has a legal agreement with Cloudflare that the data will not be stored long-term, let alone sold or shared. My reading is that they're keeping information about DNS requests and responses, but not who made the request, for 24 hours for debugging purposes, and then getting rid of all logs. The data they're actually interested in is performance, not the DNS flow itself. You're welcome to decide that Mozilla's trust in other companies is misplaced even if they get a signed contract, and if you do, that would be a good reason to cease using Firefox (Nightly or otherwise!). But if you're not of that opinion, it doesn't make sense to worry that the data simply happens to go through a third party. (Also, what third parties see your DNS data today? Do you think your ISP is not tracking this?)
kuschku 9y ago
The GDPR is only a momth away, I've already sent a complaint to the local data privacy officer about Firefox' constant violations of the requirement for explicit consent (see: CliqZ before), so let's hope the hammer swings hard this time. If Mozilla still can't see why they shouldn't automatically transmit analytics and studies for everything, they deserve to be sued into the ground. Same with Google.
- jimnotgym 9y ago
  Just came on to say this, but also there essful have to be explicit consent to take the data outside of the EU
- dotsh 9y ago
  Some people just want to see the world burn. So maybe let's delete the whole internet and get back to letters, telegrams, pidgins and encyclopaedias? No one is forcing you to use dev, nightly or anything else if it is not consistent with your faith. Especially Mozilla they made some silly things but are one of the most "privacy and shit" companies out there and they will not come to your house and beat you because you do not want to do something.
  - kuschku 9y ago
    That's certainly one approach. The other approach is that, unless explicit consent is given, people are supposed to be safe. Nightly is often required because a lot of functionality for developers is only available there, e.g. custom xpi legacy addons even in FF61. It's nightly or nothing for this, and as a reminder, stable also was affected by CliqZ.
    - deleted 9y ago
      [deleted]
    - dotsh 9y ago
      You are using Nightly "wrong" because of attachment to old extensions that will perish in June when all legacy stuff will be blocked. Nightly is only for testing out new features and it's not intended to be production ready browser... but everyone has an own use case. Yet do not beat them for wanting to change something for the better after using testing technology.
snowpanda 9y ago
What about Firefox Beta? Does anyone know?
- TD-Linux 9y ago
  A better source is the original posting: https://groups.google.com/forum/#!topic/mozilla.dev.platform/_8OAKUHso0c https://groups.google.com/forum/#!topic/mozilla.dev.platform... Not even in Nightly yet.
bad_user 9y ago
Mozilla, wtf? I can understand mistakes like Mr. Robot, mistakes happen. But I can't understand an explicit company policy. I have opted in Firefox's data collection every time I was asked. But such data gathering should always be opt-in. Ask in a nice way and you'll get contributors. And if not, well that should give you a hint that you shouldn't do it. You're better than this, really. It's why I use Firefox. So please stop it with the mistakes.
- Vinnl 9y ago
  That's what the mail thread this article was referring to was discussing: how can they properly communicate this, and the privacy safeguards they put in place, to the user?
FrankDixon 9y ago
I don't see the problem actually, if I want a normal browser I can do my online banking in, for sure, I won't use the nightly version. To me, nightly means, anything could happen.
myfonj 9y ago
> Mozilla's apparent goal of using Nightly users as a captive pool of test dummies. I thought that it is the main purpose of Nightly, roughly paraphrased but overall accurate. I'm using it as my semi-primary ("work") browser and from the day one I live in faith that 1) it may stop working any time 2) there is some Mozillian peeking over my shoulder all the time (figuratively).
dhimes 9y ago
Well, I'm glad OP pointed out that nightly might do unexpected things with my browsing habit information in order to gather data on browser use in nightly- I admit, I hadn't really thought that through. It won't stop me from using it for development browsing and some other things, but it might give me pause before visiting some sites I suppose (so I would switch browsers). My problem with nightly is that it doesn't automatically update, so I have to reinstall every day. And I'm just too lazy (errr, "busy") to be bothered with that. Is there away around this issue on Mint (Ubuntu)? I even put a menu entry into my "shortcuts" menu on fluxbox, but it's nightly from December or something.
cpeterso 9y ago
When you first run Firefox, it shows the following page describing the types of telemetry data Firefox shares and a button to configure your telemetry options if you'd like to change them: https://www.mozilla.org/privacy/firefox/ https://www.mozilla.org/privacy/firefox/
- einr 9y ago
  The eye-catching headline in huge type, is "at Mozilla, we believe that privacy is fundamental to a healthy internet". Only later in this document -- that basically no one is going to read in detail after reading the headline -- do they detail how they intend to not respect my privacy. Let's be clear: this is a dark pattern with intention to mislead. Mozilla has serious and growing issues with respecting user privacy by default, and judging by the recent roadmap, it seems like it's going to get worse.* * https://blog.mozilla.org/data/2017/12/09/add-on-recommendations-for-firefox-users-a-prototype-recommender-system-leveraging-existing-data-sources/ https://blog.mozilla.org/data/2017/12/09/add-on-recommendati...
zaarn 9y ago
It seems people simply want to be outraged at Mozilla. The shield study isn't even running yet and several people have raised concerns over the opt-out policy in the mailing list and bugtracker but obviously that doesn't matter. What matters is that the original suggestion was opt-out. Of course, rightfully, nobody is going to send a message on the bugtracker or mailing list or otherwise participating to ensure this doesn't happen. Rather, everyone goes out and yells how terrible Mozilla is and how Google is being nice since they atleast tell you about it upfront. (Completely ignoring that Google is steering Chrome into a new IE-Era of web development) I don't think the blog post above accurately represents the current situation on the shield study nor does it reflect how several people engaged on it are trying to prevent this exact kind of PR disaster.
- geofft 9y ago
  This is, of course, the danger with running a project in public: you don't get to have a private discussion about whether a certain thing is a good idea, and you certainly don't get to have a private discussion about how to phrase it. Views of some individual proposing a thing get attributed to the organization. I can think of no better way to encourage closed development processes than to get upset at a "statement by a Mozilla person" and use it as a reason to write off the entire project. You have no idea what Google is saying about your privacy behind closed doors.
  - mandelbulb 9y ago
    You're giving Mozilla a bit too much due. This was not just a statement or suggestion but an announcement for the next Monday. With an internal policy that all opt-out proposals requiring the transfer of personalized data must be discussed with the rest of the team (incl. PR) and publicly, the post would have sounded quite differently. By the way, in less than three hours, there will be an AMA on /r/firefox with the Project Manager of the User Advocacy team at Mozilla: https://www.reddit.com/r/firefox/comments/84xe7m/well_be_hosting_an_ama_on_friday_march_23rd_one/ https://www.reddit.com/r/firefox/comments/84xe7m/well_be_hos...
    - 9y ago
geofft 9y ago
> (although at the moment I'm still using Firefox 56) There are unpatched security holes in Firefox 56. If you're really mad about the extensions change, downgrade to Firefox 52 ESR. Running Firefox 56 and worrying about the security of your DNS data is a nonsensical threat model.
- bugmen0t 9y ago
  Can't stress this enough. Using outdates browsers is a liability. You're provoking harm to your network, your computer, your personal data.
  - Freak_NL 9y ago
    Your comment is somewhat out of place in this case; Firefox ESR 52 is the current up-to-date ESR¹ release. Firefox ESR is kept up-to-date with security patches, just like the vanilla evergreen Firefox. The difference is that the ESR is branched yearly from the main-line, and leaves out all functional patches — only security patches get applied. This helps organizations who want to test all their tools before moving to a new version. The next ESR release (Firefox ESR 60) will be this summer. 1: https://www.mozilla.org/en-US/firefox/organizations/ https://www.mozilla.org/en-US/firefox/organizations/
    - deleted 9y ago
      [deleted]
    - geofft 9y ago
      I think that comment was agreeing with my comment, which was written with the understanding that 52 ESR would be better than 56 because the ESR is not out of date the way 56 is.
- jwilk 9y ago
  Make backup copy of your profile before you downgrade. Unsurprisingly, older Firefox doesn't fully understand profiles from newer Firefox. (I don't remember the details, sorry!)
- 9y ago
ggm 9y ago
explain to me why DOH is worse than 8.8.8.8 or even your ISPs DNS? why isn't DOH possibly more protecting of your privacy than these other services?
- gsnedders 9y ago
  Plenty of people are concerned about any US based company having access to their DNS logs; even with the pro-privacy agreement CloudFlare have in place with Mozilla, the US government has past form of doing bulk data collection from US based companies. Your ISP's DNS may well be covered by relatively strong data protection laws (versus those in the US) and don't lead to a foreign government gaining access to all your browsing history, even if in principle they could be MitM'd.
  - ggm 9y ago
    so again, how does this make DOH worse than 8.8.8.8?
    - Macha 9y ago
      You manually opt in to 8.8.8.8. You may be using something with stronger legal protections than Cloudflare and will not be aware you need to opt out of this. The strength of encryption on the network is irrelevant if you don't trust the recipient.
ppbutt 9y ago
User intrusion seems to be a pattern with Mozilla now.
- digi_owl 9y ago
  Frankly big name FOSS projects have developed a massive paternalist streak over the last decade or so. This in complete ignorance that what attracted people to them in the first place was to escape the paternalism (and black box nature of proprietary software) from the likes of Microsoft.
Sean1708 9y ago
The full quote, since I think that the author of this post cherry-picked unfairly: >> As one of the folks who brought up the initial concern let me be clear that at this point my only real concern here is one of optics. The DoH service we're using is likely more private than anything the user is currently using. > It isn't explicit right now that using nightly means opting in to participating in studies like this, and I think the text of the download page antedates our ability to do those studies. The text of the Firefox privacy page says that prerelease products "may contain different privacy characteristics" than release, but doesn't enumerate them. I also can't find a public-facing description of how we handle, secure and audit PII data in experiments involving partner organizations. > In both cases I'm confident we have solid policies and protocols there, I just don't see a way to point a concerned user to that information. > I'm working on that now.
JepZ 9y ago
I wonder why Mozilla is lately so fond of collecting user data. Do they have a new data mining department which is looking for work? Did someone tell them to do data driven development/marketing? If they really want to know more about what we are doing, they could just ask us, don't they? I mean, something like building a FF extension which offers to participate in a monthly survey and at the end of each survey it can ask which data the user wants to attach to his survey responses this one time. And if they ask the users for all hosts they have visited during the last month, many people will ask what Mozilla wants to do with that data and Mozilla can explain their intent so that everybody can decide if he wants to support that cause. Yes, that would probably yield much less data and would be more cumbersome for Mozilla, but in the end it would be a fair way of letting your users participate in the development process. As users we want a product which we can trust 100% that it will keep our data on our computer as long as we don't explicitly say otherwise.
- monsieurbanana 9y ago
  > Yes, that would probably yield much less data So in other words, probably not much better than doing nothing at all.
sergiosgc 9y ago
Mozilla should be careful about EU's GDPR. Under GDPR, explicit user authorization is needed for every use of personal data. An opt-out does not comply with the law. Nor does a blanket TOS or Privacy Policy. The law comes into effect in May.
- loa_in_ 9y ago
  One doesn't download FF Nightly by accident though.
orf 9y ago
Man running an old, insecure version of Firefox with several unpatched critical security issues is outraged at DNS hostnames being sent to a US company (in a more secure manner no less). Ok.
discreditable 9y ago
I trust Mozilla has done the diligence to handle the data correctly. If I didn't trust Mozilla I wouldn't use Nightly or even Firefox. I use Nightly because I want to help Mozilla test and make Firefox better. For me that includes opting-in to studies, reporting bugs, and helping test about:config flags they mention in their Nightly blog.
HugoDaniel 9y ago
Are container tabs already available outside of Nightly ?
- seba_dos1 9y ago
  I'm using them on Developer Edition, although I think I had to install an extension that makes use of them (in my case, Tab Center Redux) in order to enable them.
gkya 9y ago
Firefox profiles are a hard thing to discover. When you start Developer Edition Firefox up by default it starts in its own profile. I'd guess Nightly does the same too. Regardless, it'd be nice of Mozilla to make profiles more accessible through the default UI. I've set up my FF to start with the profile selector every time I start it up, but in firefox in order to switch profiles one has to go to about:profiles.
campuscodi 9y ago
Sorry for the language, but the authors of this article are morons. It's true. Firefox Studies is off by default. They enable this feature and they get outraged. The definition of a moron.
jchw 9y ago
DNS over HTTPS being skewed into a bad thing is a new one for me. How could this be worse than sending it in plain text to any other entity? At least in this case it's going to be limited to Cloudflare and not whoever's watching in between. If this is part of what it takes to get this technology rolled out, then do what it takes imo.
neoeldex 9y ago
Hmm, it's not great they intend to send this information to the great firewall in the sky. If it were mozilla's own servers, I'd re-enable the usage collection on nightly. Bit more of the same with the screencapture features, it's a shame we can't host and configure our own services....
jamiesonbecker 9y ago
Seems like multiple issues with Firefox (Cliqz and now this). FF's new privacy policy has so many exceptions that it makes it challenging to read: https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/ The Brave browser seems to be carrying the torch for privacy these days: Brave is not in the business of selling personal information. We believe the best way to ensure your private personal information is protected is to make every effort to ensure we are not receiving your private personal information in the first place. https://www.brave.com/privacy/ https://www.brave.com/privacy/ https://www.brave.com/ https://www.brave.com/
tradesmanhelix 9y ago
IMO, this blog post is needlessly alarmist and even misleading. On the pre-release FF downloads page [1] it says, "Firefox Nightly automatically sends feedback to Mozilla." Not sure how the author of this post got the impression that Nightly _doesn't_ collect user metrics and analytics, but this is its explicit purpose. If the author really cares about privacy, he should just use the main Firefox release or, even better, something like Waterfox or PaleMoon. But please - don't slam Mozilla for creating dedicated analytics and tracking release channels and then using those channels for, you know, analytics and tracking. [1] https://www.mozilla.org/en-US/firefox/channel/desktop/ https://www.mozilla.org/en-US/firefox/channel/desktop/
AnarchistNode7 9y ago
Hate me for that, but my opinion is that there is no reason for using Firefox at all anymore. Mozilla as company have decided that honesty, dignity and loyalty towards their origin user base was less important than the hopeless try to defeat Google Chrome and take their place in market share. All what Mozilla does is simplifying the browser, removing every single bit of more advanced customization features to be most attractive to the typical mainstream user who thinks that customization, features and choice is bloat and should have no part inside the product. How should i as wary user ever have faith in Mozilla as i see what they have been doing since 2013? If they want to be so badly like Google Chrome, then i can also use the original instead. I - as being loosely connected to the Anonymous collective - value morality most. And that morality... Mozilla has thrown over board without thinking twice about it.

253 points by jlgaddis 9y ago

This is honestly the reason I do use Nightly. I'm volunteering to provide information that I understand could be very intimate in hopes it's useful to Mozilla in making Firefox better. Data drives better decisions, and I'd rather the technically savvy volunteer their privacy than it being extracted from the general populace. So yes, kick me a bit, I'll let you know what breaks.

exikyut 9y ago
But in the absence of this news article, you couldn't have been more specific about the information you're volunteering without initiating further research yourself. I do think Firefox/Mozilla should be explicit about the current list of experiments.
toflon 9y ago
Same here. Call me naive all you want, but I do think Mozilla has our best intention. They won't sell the data, they will try to keep it as secure as possible and anonymize it. As seen they even made a deal with Cloudflare to ensure they don't log any of that data. I'm a strong advocate for privacy but if I'm going to give away my data I'd rather have it be Mozilla than Facebook or Google.
- OskarS 9y ago
  Yeah, totally agree. Mozilla needs user data like this for their product, and I think it's a perfectly reasonable solution to collect it from Nightly users who have opted into being guinea pigs. > I'm a strong advocate for privacy but if I'm going to give away my data I'd rather have it be Mozilla than Facebook or Google. Yep. There's no company I trust more than Mozilla when it comes to handling my data in a safe and responsible manner.
- dwild 9y ago
  Sure that's all fine if you are aware of it and agree with it. Isn't it the same as Cambridge Analytica? That was a feature of Facebook to share your friend information... it still makes it bad. The fact that Mozilla has good intention doesn't change how it was done. Secrecy isn't the solution, it only pushes toward these kinds of publications and outrage. If it was known, believe me, we wouldn't be here having that discussion, it would be a non-issue.

r00fus 9y ago

I'm ok as long as they make it up front and clear. It's not meant to have the "latest greatest" - it's meant to collect analytics to understand and respond to where changes in the nightly might have broken something critical. That said, a large chunk of the web is getting very personal. So I'm not sure Mozilla's rights to do as they please matter if the venn-diagram between nightly-users and privacy-stalwarts is anywhere near 30% overlap.

nallerooth 9y ago
I agree. They can send my data wherever they want - as long as they tell me about it so that I can make an informed decision. Now, nightly is nightly - you don't accidentally build and install it on your system. But if this behavior is included in other pre-release versions (such as the developer edition), the need for informing the user becomes even more important. I've installed the developer edition from the Arch linux User Repository (AUR), which means that I don't see any release notes or information boxes on the developer edition website when I'm getting the software. A small popup in a corner telling me that "There's a new way to help improve firefox" after an upgrade/install would solve this. I don't want 15 levels of confirmation and a roll of tin foil - I just want something informing me that my data will be sent to a new receiver, and why.

dahdum 9y ago

Opt-out privacy violations are not new for Mozilla, did worse than this to German users last year, discussed here: https://news.ycombinator.com/item?id=15421708 https://news.ycombinator.com/item?id=15421708

aorth 9y ago

I understand the desire for statistics, but they should make it more obvious that nightly isn't just daily builds from master. I've run Nightly from time to time and had no idea it was automatically opting in to Shield studies. Both this and the Mr. Robot extension issue a few months ago erode my trust in Mozilla a little. Counterpoint: only god knows what Google is sending itself from Chrome!

nallerooth 9y ago
The difference here is that you expect Google to collect -a lot- of data about you and your browsing habits. You can also be quite sure that they'll want to keep that data to themselves. When my data ends up at a third party, especially without my knowledge, I'm much more concerned about it being sold and or shared further.
- kbenson 9y ago
  > You can also be quite sure that they'll want to keep that data to themselves. I've traditionally made the same argument. I still mostly believe it WRT Google. Facebook's current woes with Cambridge Analytica has hurt my confidence in this some.
- caconym_ 9y ago
  > When my data ends up at a third party, especially without my knowledge, I'm much more concerned about it being sold and or shared further. That or stolen thanks to negligent data handling practices. Or maybe both (e.g. Equifax).
- geofft 9y ago
  > When my data ends up at a third party, especially without my knowledge, I'm much more concerned about it being sold and or shared further. As stated in the mailing list thread linked in the article, Mozilla has a legal agreement with Cloudflare that the data will not be stored long-term, let alone sold or shared. My reading is that they're keeping information about DNS requests and responses, but not who made the request, for 24 hours for debugging purposes, and then getting rid of all logs. The data they're actually interested in is performance, not the DNS flow itself. You're welcome to decide that Mozilla's trust in other companies is misplaced even if they get a signed contract, and if you do, that would be a good reason to cease using Firefox (Nightly or otherwise!). But if you're not of that opinion, it doesn't make sense to worry that the data simply happens to go through a third party. (Also, what third parties see your DNS data today? Do you think your ISP is not tracking this?)

kuschku 9y ago

The GDPR is only a momth away, I've already sent a complaint to the local data privacy officer about Firefox' constant violations of the requirement for explicit consent (see: CliqZ before), so let's hope the hammer swings hard this time. If Mozilla still can't see why they shouldn't automatically transmit analytics and studies for everything, they deserve to be sued into the ground. Same with Google.

jimnotgym 9y ago
Just came on to say this, but also there essful have to be explicit consent to take the data outside of the EU
dotsh 9y ago
Some people just want to see the world burn. So maybe let's delete the whole internet and get back to letters, telegrams, pidgins and encyclopaedias? No one is forcing you to use dev, nightly or anything else if it is not consistent with your faith. Especially Mozilla they made some silly things but are one of the most "privacy and shit" companies out there and they will not come to your house and beat you because you do not want to do something.
- kuschku 9y ago
  That's certainly one approach. The other approach is that, unless explicit consent is given, people are supposed to be safe. Nightly is often required because a lot of functionality for developers is only available there, e.g. custom xpi legacy addons even in FF61. It's nightly or nothing for this, and as a reminder, stable also was affected by CliqZ.
  - deleted 9y ago
    [deleted]
  - dotsh 9y ago
    You are using Nightly "wrong" because of attachment to old extensions that will perish in June when all legacy stuff will be blocked. Nightly is only for testing out new features and it's not intended to be production ready browser... but everyone has an own use case. Yet do not beat them for wanting to change something for the better after using testing technology.

snowpanda 9y ago

What about Firefox Beta? Does anyone know?

TD-Linux 9y ago
A better source is the original posting: https://groups.google.com/forum/#!topic/mozilla.dev.platform/_8OAKUHso0c https://groups.google.com/forum/#!topic/mozilla.dev.platform... Not even in Nightly yet.

bad_user 9y ago

Mozilla, wtf? I can understand mistakes like Mr. Robot, mistakes happen. But I can't understand an explicit company policy. I have opted in Firefox's data collection every time I was asked. But such data gathering should always be opt-in. Ask in a nice way and you'll get contributors. And if not, well that should give you a hint that you shouldn't do it. You're better than this, really. It's why I use Firefox. So please stop it with the mistakes.

Vinnl 9y ago
That's what the mail thread this article was referring to was discussing: how can they properly communicate this, and the privacy safeguards they put in place, to the user?

FrankDixon 9y ago

I don't see the problem actually, if I want a normal browser I can do my online banking in, for sure, I won't use the nightly version. To me, nightly means, anything could happen.

myfonj 9y ago

> Mozilla's apparent goal of using Nightly users as a captive pool of test dummies. I thought that it is the main purpose of Nightly, roughly paraphrased but overall accurate. I'm using it as my semi-primary ("work") browser and from the day one I live in faith that 1) it may stop working any time 2) there is some Mozillian peeking over my shoulder all the time (figuratively).

dhimes 9y ago

Well, I'm glad OP pointed out that nightly might do unexpected things with my browsing habit information in order to gather data on browser use in nightly- I admit, I hadn't really thought that through. It won't stop me from using it for development browsing and some other things, but it might give me pause before visiting some sites I suppose (so I would switch browsers). My problem with nightly is that it doesn't automatically update, so I have to reinstall every day. And I'm just too lazy (errr, "busy") to be bothered with that. Is there away around this issue on Mint (Ubuntu)? I even put a menu entry into my "shortcuts" menu on fluxbox, but it's nightly from December or something.

cpeterso 9y ago

When you first run Firefox, it shows the following page describing the types of telemetry data Firefox shares and a button to configure your telemetry options if you'd like to change them: https://www.mozilla.org/privacy/firefox/ https://www.mozilla.org/privacy/firefox/

einr 9y ago
The eye-catching headline in huge type, is "at Mozilla, we believe that privacy is fundamental to a healthy internet". Only later in this document -- that basically no one is going to read in detail after reading the headline -- do they detail how they intend to not respect my privacy. Let's be clear: this is a dark pattern with intention to mislead. Mozilla has serious and growing issues with respecting user privacy by default, and judging by the recent roadmap, it seems like it's going to get worse.* * https://blog.mozilla.org/data/2017/12/09/add-on-recommendations-for-firefox-users-a-prototype-recommender-system-leveraging-existing-data-sources/ https://blog.mozilla.org/data/2017/12/09/add-on-recommendati...

zaarn 9y ago

It seems people simply want to be outraged at Mozilla. The shield study isn't even running yet and several people have raised concerns over the opt-out policy in the mailing list and bugtracker but obviously that doesn't matter. What matters is that the original suggestion was opt-out. Of course, rightfully, nobody is going to send a message on the bugtracker or mailing list or otherwise participating to ensure this doesn't happen. Rather, everyone goes out and yells how terrible Mozilla is and how Google is being nice since they atleast tell you about it upfront. (Completely ignoring that Google is steering Chrome into a new IE-Era of web development) I don't think the blog post above accurately represents the current situation on the shield study nor does it reflect how several people engaged on it are trying to prevent this exact kind of PR disaster.

geofft 9y ago
This is, of course, the danger with running a project in public: you don't get to have a private discussion about whether a certain thing is a good idea, and you certainly don't get to have a private discussion about how to phrase it. Views of some individual proposing a thing get attributed to the organization. I can think of no better way to encourage closed development processes than to get upset at a "statement by a Mozilla person" and use it as a reason to write off the entire project. You have no idea what Google is saying about your privacy behind closed doors.
- mandelbulb 9y ago
  You're giving Mozilla a bit too much due. This was not just a statement or suggestion but an announcement for the next Monday. With an internal policy that all opt-out proposals requiring the transfer of personalized data must be discussed with the rest of the team (incl. PR) and publicly, the post would have sounded quite differently. By the way, in less than three hours, there will be an AMA on /r/firefox with the Project Manager of the User Advocacy team at Mozilla: https://www.reddit.com/r/firefox/comments/84xe7m/well_be_hosting_an_ama_on_friday_march_23rd_one/ https://www.reddit.com/r/firefox/comments/84xe7m/well_be_hos...
  - 9y ago

geofft 9y ago

> (although at the moment I'm still using Firefox 56) There are unpatched security holes in Firefox 56. If you're really mad about the extensions change, downgrade to Firefox 52 ESR. Running Firefox 56 and worrying about the security of your DNS data is a nonsensical threat model.

bugmen0t 9y ago
Can't stress this enough. Using outdates browsers is a liability. You're provoking harm to your network, your computer, your personal data.
- Freak_NL 9y ago
  Your comment is somewhat out of place in this case; Firefox ESR 52 is the current up-to-date ESR¹ release. Firefox ESR is kept up-to-date with security patches, just like the vanilla evergreen Firefox. The difference is that the ESR is branched yearly from the main-line, and leaves out all functional patches — only security patches get applied. This helps organizations who want to test all their tools before moving to a new version. The next ESR release (Firefox ESR 60) will be this summer. 1: https://www.mozilla.org/en-US/firefox/organizations/ https://www.mozilla.org/en-US/firefox/organizations/
  - deleted 9y ago
    [deleted]
  - geofft 9y ago
    I think that comment was agreeing with my comment, which was written with the understanding that 52 ESR would be better than 56 because the ESR is not out of date the way 56 is.
jwilk 9y ago
Make backup copy of your profile before you downgrade. Unsurprisingly, older Firefox doesn't fully understand profiles from newer Firefox. (I don't remember the details, sorry!)
9y ago

ggm 9y ago

explain to me why DOH is worse than 8.8.8.8 or even your ISPs DNS? why isn't DOH possibly more protecting of your privacy than these other services?

gsnedders 9y ago
Plenty of people are concerned about any US based company having access to their DNS logs; even with the pro-privacy agreement CloudFlare have in place with Mozilla, the US government has past form of doing bulk data collection from US based companies. Your ISP's DNS may well be covered by relatively strong data protection laws (versus those in the US) and don't lead to a foreign government gaining access to all your browsing history, even if in principle they could be MitM'd.
- ggm 9y ago
  so again, how does this make DOH worse than 8.8.8.8?
  - Macha 9y ago
    You manually opt in to 8.8.8.8. You may be using something with stronger legal protections than Cloudflare and will not be aware you need to opt out of this. The strength of encryption on the network is irrelevant if you don't trust the recipient.

ppbutt 9y ago

User intrusion seems to be a pattern with Mozilla now.

digi_owl 9y ago
Frankly big name FOSS projects have developed a massive paternalist streak over the last decade or so. This in complete ignorance that what attracted people to them in the first place was to escape the paternalism (and black box nature of proprietary software) from the likes of Microsoft.

Sean1708 9y ago

The full quote, since I think that the author of this post cherry-picked unfairly: >> As one of the folks who brought up the initial concern let me be clear that at this point my only real concern here is one of optics. The DoH service we're using is likely more private than anything the user is currently using. > It isn't explicit right now that using nightly means opting in to participating in studies like this, and I think the text of the download page antedates our ability to do those studies. The text of the Firefox privacy page says that prerelease products "may contain different privacy characteristics" than release, but doesn't enumerate them. I also can't find a public-facing description of how we handle, secure and audit PII data in experiments involving partner organizations. > In both cases I'm confident we have solid policies and protocols there, I just don't see a way to point a concerned user to that information. > I'm working on that now.

JepZ 9y ago

I wonder why Mozilla is lately so fond of collecting user data. Do they have a new data mining department which is looking for work? Did someone tell them to do data driven development/marketing? If they really want to know more about what we are doing, they could just ask us, don't they? I mean, something like building a FF extension which offers to participate in a monthly survey and at the end of each survey it can ask which data the user wants to attach to his survey responses this one time. And if they ask the users for all hosts they have visited during the last month, many people will ask what Mozilla wants to do with that data and Mozilla can explain their intent so that everybody can decide if he wants to support that cause. Yes, that would probably yield much less data and would be more cumbersome for Mozilla, but in the end it would be a fair way of letting your users participate in the development process. As users we want a product which we can trust 100% that it will keep our data on our computer as long as we don't explicitly say otherwise.

monsieurbanana 9y ago
> Yes, that would probably yield much less data So in other words, probably not much better than doing nothing at all.

sergiosgc 9y ago

Mozilla should be careful about EU's GDPR. Under GDPR, explicit user authorization is needed for every use of personal data. An opt-out does not comply with the law. Nor does a blanket TOS or Privacy Policy. The law comes into effect in May.

loa_in_ 9y ago
One doesn't download FF Nightly by accident though.

orf 9y ago

Man running an old, insecure version of Firefox with several unpatched critical security issues is outraged at DNS hostnames being sent to a US company (in a more secure manner no less). Ok.

discreditable 9y ago

I trust Mozilla has done the diligence to handle the data correctly. If I didn't trust Mozilla I wouldn't use Nightly or even Firefox. I use Nightly because I want to help Mozilla test and make Firefox better. For me that includes opting-in to studies, reporting bugs, and helping test about:config flags they mention in their Nightly blog.

HugoDaniel 9y ago

Are container tabs already available outside of Nightly ?

seba_dos1 9y ago
I'm using them on Developer Edition, although I think I had to install an extension that makes use of them (in my case, Tab Center Redux) in order to enable them.

gkya 9y ago

Firefox profiles are a hard thing to discover. When you start Developer Edition Firefox up by default it starts in its own profile. I'd guess Nightly does the same too. Regardless, it'd be nice of Mozilla to make profiles more accessible through the default UI. I've set up my FF to start with the profile selector every time I start it up, but in firefox in order to switch profiles one has to go to about:profiles.

campuscodi 9y ago

Sorry for the language, but the authors of this article are morons. It's true. Firefox Studies is off by default. They enable this feature and they get outraged. The definition of a moron.

jchw 9y ago

DNS over HTTPS being skewed into a bad thing is a new one for me. How could this be worse than sending it in plain text to any other entity? At least in this case it's going to be limited to Cloudflare and not whoever's watching in between. If this is part of what it takes to get this technology rolled out, then do what it takes imo.

neoeldex 9y ago

Hmm, it's not great they intend to send this information to the great firewall in the sky. If it were mozilla's own servers, I'd re-enable the usage collection on nightly. Bit more of the same with the screencapture features, it's a shame we can't host and configure our own services....

jamiesonbecker 9y ago

Seems like multiple issues with Firefox (Cliqz and now this). FF's new privacy policy has so many exceptions that it makes it challenging to read: https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/ The Brave browser seems to be carrying the torch for privacy these days: Brave is not in the business of selling personal information. We believe the best way to ensure your private personal information is protected is to make every effort to ensure we are not receiving your private personal information in the first place. https://www.brave.com/privacy/ https://www.brave.com/privacy/ https://www.brave.com/ https://www.brave.com/

tradesmanhelix 9y ago

IMO, this blog post is needlessly alarmist and even misleading. On the pre-release FF downloads page [1] it says, "Firefox Nightly automatically sends feedback to Mozilla." Not sure how the author of this post got the impression that Nightly _doesn't_ collect user metrics and analytics, but this is its explicit purpose. If the author really cares about privacy, he should just use the main Firefox release or, even better, something like Waterfox or PaleMoon. But please - don't slam Mozilla for creating dedicated analytics and tracking release channels and then using those channels for, you know, analytics and tracking. [1] https://www.mozilla.org/en-US/firefox/channel/desktop/ https://www.mozilla.org/en-US/firefox/channel/desktop/

AnarchistNode7 9y ago

Hate me for that, but my opinion is that there is no reason for using Firefox at all anymore. Mozilla as company have decided that honesty, dignity and loyalty towards their origin user base was less important than the hopeless try to defeat Google Chrome and take their place in market share. All what Mozilla does is simplifying the browser, removing every single bit of more advanced customization features to be most attractive to the typical mainstream user who thinks that customization, features and choice is bloat and should have no part inside the product. How should i as wary user ever have faith in Mozilla as i see what they have been doing since 2013? If they want to be so badly like Google Chrome, then i can also use the original instead. I - as being loosely connected to the Anonymous collective - value morality most. And that morality... Mozilla has thrown over board without thinking twice about it.