6 ms·

Cloudflare is an US company, their privacy statement is worth zero to most Firefox users.

Xylakant 8y ago
Most Firefox users are absolutely unaffected by this. Literally all people that don’t explicitly enable this. All those who do might want to make up their mind if they want to participate in this and if they want CF to be their provider of trust. Keep in mind that CF will see a substantial chunk of the traffic anyways. Mozilla seems to be confident in that agreement and I have a certain amount of trust in Mozilla which factors into my decision. Yours might be different, so don’t enable that feature or use a different provider.
- _Codemonkeyism 8y ago
  FF will turn this on for everybody and Cloudflare will be the default 2018? Don't know. 2019? For sure. All FF browsing meta data flows into the US, the country with the most spies and no legal framework to go to court. So your argument is an obvious straw man and one wonders about your motivations to support getting all the browsing meta data into the US by default. Moving my data from Germany to the US will not make me more secure in any way. And talking about repressed countries is like "think about the children!" for the rest of us - a nice lever to sell this massive data vacuuming.
  - Xylakant 8y ago
    Why do you believe that this will be default on at any time in the near future without a reasonable configuration UI and without a reasonable set of DoH-capable nameservers? Especially given that this would break a substantial number of existing setupts? If you have this little faith into the FF/Mozilla folks, why do you keep using FF? If you’re not using Firefox, what are you concerned about?
    - mrob 8y ago
      If they don't turn it on by default, only a small number of people will use it. If only a small number of people use it, why bother implementing it?
      - Xylakant 8y ago
        The section of people that use it might benefit to a very large degree. Or they can make the switch prominent to push adoption. There are a lot of features implemented and hidden behind “about:config” where you could ask the same question. Many of them are for the security and privacy conscious but come with a few strings attached, for example some advanced cookie settings such as third party isolation. That said: I fully expect that at some point Mozilla will want to push adoption of this feature, but not in its most extreme form. I’d expect that a default configuration would use soft fallback.
      - kiriakasis 8y ago
        Maybe to see if it works? Which I think is the purpose of almost all experimental feature. In the blog it is clearly stated that they hope DoH implementations will become standard and common, maybe that even some ISP start offering their own.
  - kiriakasis 8y ago
    Why does so many people distrust every single step done by mozzilla!? Sorry, this got me emotional, but since I started following tech news few years ago the amount of fake news on mozzilla I read is astounding. And proper fake news. Many, as this article does, do no claim that a new feature dangerous per se, but falsely (I don't think with purpose, that is what I find astounding) quote mozzilla blogs to build an apocalyptic scenario
    - jplayer01 8y ago
      In today's world, it's important to remain skeptical of companies who are responsible for how our data and usage statistics are used or shared. Companies have generally shown themselves to be untrustworthy and it's not enough for a company to have been 'good' so far. We need to stay vigilant, even if it is Mozilla.
      - kiriakasis 8y ago
        Totally agree! it is also important to mozzilla to know the won't be easily forgiven bad choices. I'm wondering why the constant and maybe not even ill-intentioned misinformation about the word they say. I don't want to accuse anyone, I believe that both side value the truth, but it really looks like as if there was a fake news factory against mozzilla
jopsen 8y ago
I believe Mozillas goal is to use the collective bargaining power of it's user-base to get favorable terms and conditions from vendors like cloudflare. This could include 3rd party reviews, etc.. Who knows?
- Xylakant 8y ago
  Cloudflare agreed to having the DNS infrastructure audited, something that does set it apart from a lot of ISPs. So that seems to be working.
- nickpsecurity 8y ago
  That wouldn't stop legal threats. Per Core Secrets leak, NSA/FBI both pay for and force backdoors in U.S. companies' products. They also share that information with other enforcement organizations per other leaks. Cloudfare are in a position to monitor lots of network activity. I'd be quie surprised if they weren't already backdoored. If NSA/FBI aren't in one's threat profile, one might also be concerned about a court order over something having to do with copyright or patents. Damages for those can be huge. There's both legal and technical firms dedicated to pouring through data for evidence of patent infringements. Many licensing "agreements" start with evidence they find. I don't know much more about this. My wild guess is that they often start with tips from disgruntled workers or maybe those leaving for competitors. These are main, three threats I'd be concerned about if sharing what I did with a U.S.-based provider. Double true for me given I'm in the jurisdiction of the enforcement agencies.
  - vavrusa 8y ago
    Cloudflare publishes transparency reports https://www.cloudflare.com/transparency/ https://www.cloudflare.com/transparency/ It also promises not to store your IP associated with the DNS requests https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... so the law enforcement would have to ask Cloudflare to install a wiretap device. If you're this worried about being traced, it's probably best not to disclose your IP address at all https://blog.cloudflare.com/welcome-hidden-resolver/ https://blog.cloudflare.com/welcome-hidden-resolver/

Most Firefox users are absolutely unaffected by this. Literally all people that don’t explicitly enable this. All those who do might want to make up their mind if they want to participate in this and if they want CF to be their provider of trust. Keep in mind that CF will see a substantial chunk of the traffic anyways. Mozilla seems to be confident in that agreement and I have a certain amount of trust in Mozilla which factors into my decision. Yours might be different, so don’t enable that feature or use a different provider.

_Codemonkeyism 8y ago
FF will turn this on for everybody and Cloudflare will be the default 2018? Don't know. 2019? For sure. All FF browsing meta data flows into the US, the country with the most spies and no legal framework to go to court. So your argument is an obvious straw man and one wonders about your motivations to support getting all the browsing meta data into the US by default. Moving my data from Germany to the US will not make me more secure in any way. And talking about repressed countries is like "think about the children!" for the rest of us - a nice lever to sell this massive data vacuuming.
- Xylakant 8y ago
  Why do you believe that this will be default on at any time in the near future without a reasonable configuration UI and without a reasonable set of DoH-capable nameservers? Especially given that this would break a substantial number of existing setupts? If you have this little faith into the FF/Mozilla folks, why do you keep using FF? If you’re not using Firefox, what are you concerned about?
  - mrob 8y ago
    If they don't turn it on by default, only a small number of people will use it. If only a small number of people use it, why bother implementing it?
    - Xylakant 8y ago
      The section of people that use it might benefit to a very large degree. Or they can make the switch prominent to push adoption. There are a lot of features implemented and hidden behind “about:config” where you could ask the same question. Many of them are for the security and privacy conscious but come with a few strings attached, for example some advanced cookie settings such as third party isolation. That said: I fully expect that at some point Mozilla will want to push adoption of this feature, but not in its most extreme form. I’d expect that a default configuration would use soft fallback.
    - kiriakasis 8y ago
      Maybe to see if it works? Which I think is the purpose of almost all experimental feature. In the blog it is clearly stated that they hope DoH implementations will become standard and common, maybe that even some ISP start offering their own.
- kiriakasis 8y ago
  Why does so many people distrust every single step done by mozzilla!? Sorry, this got me emotional, but since I started following tech news few years ago the amount of fake news on mozzilla I read is astounding. And proper fake news. Many, as this article does, do no claim that a new feature dangerous per se, but falsely (I don't think with purpose, that is what I find astounding) quote mozzilla blogs to build an apocalyptic scenario
  - jplayer01 8y ago
    In today's world, it's important to remain skeptical of companies who are responsible for how our data and usage statistics are used or shared. Companies have generally shown themselves to be untrustworthy and it's not enough for a company to have been 'good' so far. We need to stay vigilant, even if it is Mozilla.
    - kiriakasis 8y ago
      Totally agree! it is also important to mozzilla to know the won't be easily forgiven bad choices. I'm wondering why the constant and maybe not even ill-intentioned misinformation about the word they say. I don't want to accuse anyone, I believe that both side value the truth, but it really looks like as if there was a fake news factory against mozzilla

jopsen 8y ago

I believe Mozillas goal is to use the collective bargaining power of it's user-base to get favorable terms and conditions from vendors like cloudflare. This could include 3rd party reviews, etc.. Who knows?

Xylakant 8y ago
Cloudflare agreed to having the DNS infrastructure audited, something that does set it apart from a lot of ISPs. So that seems to be working.
nickpsecurity 8y ago
That wouldn't stop legal threats. Per Core Secrets leak, NSA/FBI both pay for and force backdoors in U.S. companies' products. They also share that information with other enforcement organizations per other leaks. Cloudfare are in a position to monitor lots of network activity. I'd be quie surprised if they weren't already backdoored. If NSA/FBI aren't in one's threat profile, one might also be concerned about a court order over something having to do with copyright or patents. Damages for those can be huge. There's both legal and technical firms dedicated to pouring through data for evidence of patent infringements. Many licensing "agreements" start with evidence they find. I don't know much more about this. My wild guess is that they often start with tips from disgruntled workers or maybe those leaving for competitors. These are main, three threats I'd be concerned about if sharing what I did with a U.S.-based provider. Double true for me given I'm in the jurisdiction of the enforcement agencies.
- vavrusa 8y ago
  Cloudflare publishes transparency reports https://www.cloudflare.com/transparency/ https://www.cloudflare.com/transparency/ It also promises not to store your IP associated with the DNS requests https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... so the law enforcement would have to ask Cloudflare to install a wiretap device. If you're this worried about being traced, it's probably best not to disclose your IP address at all https://blog.cloudflare.com/welcome-hidden-resolver/ https://blog.cloudflare.com/welcome-hidden-resolver/