5 ms·

You could just turn off all studies in Firefox. It's a simple option: https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-all-studies https://support.m

You could just turn off all studies in Firefox. It's a simple option: https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-all-studies https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...

Crontab 7y ago
That's not enough. Opt-out features are wrong because organizations/companies know that most people won't pay attention or not fully appreciate the dangers of it.
- reciprocity 7y ago
  What would you propose?
  - manigandham 7y ago
    Opt-in. Firefox is all about informed choice, it seems people want them to stick to it.
pbhjpbhj 7y ago
They can just flip the option or create a version of studies called "enquiries" or force a new addon that you can't remove in the next update .. 3 years ago you'd think Mozilla wouldn't ever imagine doing things like that.
- detaro 7y ago
  3 years ago, they were in the middle of deploying the current studies system.
  - pbhjpbhj 7y ago
    I think it's actually 5 years ago, perhaps when the major management changes happened. My mistake.
tknkx 7y ago
I'm a privacy conscious person so I disabled all spyware that Firefox included. But I went to check, studies was enabled, probably because it was included and enabled by default in the last years and I didn't notice. So how long until Firefox adds something else to have remote code execution rights on my machine?
- AstralStorm 7y ago
  Studies do send telemetry which is not quite the same as being spyware. You can actually check what is sent, though there's no option to more finely disable studies requiring, say, cursor, keyboard or tab name monitoring. I haven't seen any such studies though. The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time. As for browser code itself, it is open, go read the changelog. If you're extra paranoid, you can build it yourself. Study code is also fully readable.
  - tknkx 7y ago
    >Studies do send telemetry which is not quite the same as being spyware. How is software whose sole purpose is to send my information to a third party not spyware? >The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time. JS on any webpage can't do whatever it wants, since it's restrained to the webpage itself. otoh I'm sure this "studies" thing can change my browser configuration (including my certificates, making me vulnerable to MITM) and probably even execute any command with my current user privileges.
    - AstralStorm 7y ago
      They cannot, the studies use JS available to the browser though with internal APIs available. It is potent, but not quite as much as to allow running arbitrary executables outside the browser or usually bypass file system level protection. It can read and write files the user can access. (Which may or may not include /dev on *nix.) It can also exploit your OpenGL driver. The difference between spyware and telemetry is intent - use of data - and anonymization measures. If you don't trust the company making the browser with user studies (and their toggle), you probably shouldn't use their build - and you can disable study code completely on compile time. If Mozilla decided to be evil like a certain Alphabet company, there is nothing to stop them but forking and writing another web browser.
napsterbr 7y ago
I did. The problem is: - I had never heard of "Studies" before; which leads to - I never agreed to be a part of Studies in the first place. The docs says it must be opted in, so supposedly I have to give consent to it. I don't remember doing so. For all my life, I've always rejected any survey, opt-in request and similar stuff. I do admit there is a small, unlikely chance that I did opt-in. Maybe I misclicked it? Maybe I thought I was rejecting when I was actually agreeing to? Maybe someone else was using my computer and opted-in? If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant. But I can't remember the prompt at all, and I would never consciously opt-in, hence the feeling of betrayal. For the record: I now know what Studies are. I acknowledge that companies need to run A/B experiments in order to enhance their products. I just don't want to be opted-in by default.
- tripzilch 7y ago
  > If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant. No need to apologize. It's not really an opt-in if you are certain you would never opt in if you were aware of it, and somehow you accidentally "opted in" anyway. I'm in the same boat, I would never opt in to any of this stuff. Now I had my "studies" setting turned off, so that's good. But when I looked at about:studies, it seems as though it had been on at some point in time (because it lists a plugin that it used for a study, or something). So I suppose that I actually opted out of this studies thing at some point, meaning it had been turned on without my consent either.

Crontab 7y ago

That's not enough. Opt-out features are wrong because organizations/companies know that most people won't pay attention or not fully appreciate the dangers of it.

reciprocity 7y ago
What would you propose?
- manigandham 7y ago
  Opt-in. Firefox is all about informed choice, it seems people want them to stick to it.

pbhjpbhj 7y ago

They can just flip the option or create a version of studies called "enquiries" or force a new addon that you can't remove in the next update .. 3 years ago you'd think Mozilla wouldn't ever imagine doing things like that.

detaro 7y ago
3 years ago, they were in the middle of deploying the current studies system.
- pbhjpbhj 7y ago
  I think it's actually 5 years ago, perhaps when the major management changes happened. My mistake.

tknkx 7y ago

I'm a privacy conscious person so I disabled all spyware that Firefox included. But I went to check, studies was enabled, probably because it was included and enabled by default in the last years and I didn't notice. So how long until Firefox adds something else to have remote code execution rights on my machine?

AstralStorm 7y ago
Studies do send telemetry which is not quite the same as being spyware. You can actually check what is sent, though there's no option to more finely disable studies requiring, say, cursor, keyboard or tab name monitoring. I haven't seen any such studies though. The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time. As for browser code itself, it is open, go read the changelog. If you're extra paranoid, you can build it yourself. Study code is also fully readable.
- tknkx 7y ago
  >Studies do send telemetry which is not quite the same as being spyware. How is software whose sole purpose is to send my information to a third party not spyware? >The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time. JS on any webpage can't do whatever it wants, since it's restrained to the webpage itself. otoh I'm sure this "studies" thing can change my browser configuration (including my certificates, making me vulnerable to MITM) and probably even execute any command with my current user privileges.
  - AstralStorm 7y ago
    They cannot, the studies use JS available to the browser though with internal APIs available. It is potent, but not quite as much as to allow running arbitrary executables outside the browser or usually bypass file system level protection. It can read and write files the user can access. (Which may or may not include /dev on *nix.) It can also exploit your OpenGL driver. The difference between spyware and telemetry is intent - use of data - and anonymization measures. If you don't trust the company making the browser with user studies (and their toggle), you probably shouldn't use their build - and you can disable study code completely on compile time. If Mozilla decided to be evil like a certain Alphabet company, there is nothing to stop them but forking and writing another web browser.

napsterbr 7y ago

I did. The problem is: - I had never heard of "Studies" before; which leads to - I never agreed to be a part of Studies in the first place. The docs says it must be opted in, so supposedly I have to give consent to it. I don't remember doing so. For all my life, I've always rejected any survey, opt-in request and similar stuff. I do admit there is a small, unlikely chance that I did opt-in. Maybe I misclicked it? Maybe I thought I was rejecting when I was actually agreeing to? Maybe someone else was using my computer and opted-in? If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant. But I can't remember the prompt at all, and I would never consciously opt-in, hence the feeling of betrayal. For the record: I now know what Studies are. I acknowledge that companies need to run A/B experiments in order to enhance their products. I just don't want to be opted-in by default.

tripzilch 7y ago
> If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant. No need to apologize. It's not really an opt-in if you are certain you would never opt in if you were aware of it, and somehow you accidentally "opted in" anyway. I'm in the same boat, I would never opt in to any of this stuff. Now I had my "studies" setting turned off, so that's good. But when I looked at about:studies, it seems as though it had been on at some point in time (because it lists a plugin that it used for a study, or something). So I suppose that I actually opted out of this studies thing at some point, meaning it had been turned on without my consent either.