3 ms·

I'm one of the many devs who worked at one point or another on Mozilla's third-party tracking protection. We had prototypes working in ~2012, if my memory serve

by Yoric 7y ago

I'm one of the many devs who worked at one point or another on Mozilla's third-party tracking protection. We had prototypes working in ~2012, if my memory serves. Unfortunately, these prototypes broke the web badly. The web was simply not ready for such protection. Now, Apple, with their iOS monopoly, managed to strong-arm the web into a position in which third-party tracking protection was finally possible. Kudos to them, now we can finally release this technology. We're doing it slowly, because by opposition to Apple, we cannot afford to break the web. Why did Apple do this, though? If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple. So, yeah, Apple's actions have had some good impact on web-tracking, and that's great. But don't forget that they do this for strategic reasons: 1/ because they want to encourage devs to use another tracking mechanism that the competition cannot emulate; 2/ to immediately hurt the competition. Now, you are right about the double-keyed caches – although using this to track users is quite more complicated, less precise and less reliable than first-/third-party cookies, it's something we need to address. We're working on it at this very moment. Finally, yeah, first-party cookies... hard to counter. We're also working on it (is anyone else doing so?), but that will be a tough fight.

jxdxbx 7y ago
> Why did Apple do this, though? If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple. This is incredibly misleading. Apple has been mostly criticized for allowing apps to collect excessive user data--for example, apps could access contacts at first without permission. It has been slowly shutting down these methods, as the realization has sunk in the the more open environment of Macs and PCs is just not appropriate for mobile phones. For example, apps in iOS 13 cannot access bluetooth or Wifi information by default, since it was being used to infer location. Apple does of course collect some user data, e.g. for Siri or app analytics. But it's all painstakingly disclosed and its practices around differential privacy, deletion, and so on are quite good. The tracking ID was Apple throwing a bone to ad industry and app makers, when it shut down far more precise ways of tracking users.
- Yoric 7y ago
  > This is incredibly misleading. Apple has been mostly criticized for allowing apps to collect excessive user data--for example, apps could access contacts at first without permission. It has been slowly shutting down these methods, as the realization has sunk in the the more open environment of Macs and PCs is just not appropriate for mobile phones. For example, apps in iOS 13 cannot access bluetooth or Wifi information by default, since it was being used to infer location. Yep, the tech world has a short memory :) I distinctly remember Apple caught red-handed slurping GPS data from their users. > The tracking ID was Apple throwing a bone to ad industry and app makers, when it shut down far more precise ways of tracking users. Unless I'm mistaken, it's still much more precise than any form of web tracking.
  - jeromegv 7y ago
    You keep repeating that "Apple was caught red-handed" but what exactly are you referring to? What are your sources on that?
    - Yoric 7y ago
      I'm referring to this: https://www.wired.com/2011/04/apple-iphone-tracking/ https://www.wired.com/2011/04/apple-iphone-tracking/
      - vlovich123 7y ago
        Which is literally when they began to take privacy very seriously. Keep in mind that's 8 years ago & the first iPhone was released 12 years ago. I wouldn't characterize that as "recent".
        Yoric 7y ago
        Well, people still distrust Microsoft for stuff they did during the 90s :) But yeah, I'll grant you that it's not recent.
      - 7y ago
user17843 7y ago
> Now, you are right about the double-keyed caches – although using this to track users is quite more complicated, less precise and less reliable than first-/third-party cookies, it's something we need to address. We're working on it at this very moment. > Finally, yeah, first-party cookies... hard to counter. We're also working on it (is anyone else doing so?), but that will be a tough fight. That sounds awesome. Ad-tech is a burden to society. What's complicated with first-party cookies though? Didn't Apple for example just give them a limit of 7 days? I guess Apple just accepts that people have to log-in again after the 7 day period, but I haven't looked into the technical details about this feature.
- TomAnthony 7y ago
  It is only first party cookies set via document.cookie, not HTTP cookies. So login mechanisms will not be affected by this.
mevile 7y ago
Thank you for all your hard work on Firefox! Many of us Firefox users really appreciate all the work you and your team does!
- Yoric 7y ago
  \o/
vlovich123 7y ago
> If you recall, Apple's stance on privacy is quite recent Apple's position on privacy really started accelerating in the pro-privacy direction in 2011 due to the issue around unencrypted location backups, which was also around the time Tim Cook took over. I don't know that 8 continuous years of trying to improve privacy (2/3 of the duration of the mobile revolution & going) is fair to characterize as "recent". Having worked there 6 years ago I can tell you that not only did Apple have internal messaging about privacy being important, they walked the walk in terms of supporting initiatives to continue to push the envelope. > If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago Which instance are you referring to? (sounds like the GPS incident above which doesn't seem recent to me). > Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple. AFAIK Apple doesn't track what you do within the app. They do track things like crashes, other issues, general 3p app usage (for understanding what's important to their customers), & their own apps. All things you would expect ANY vendor to do. It's super hard to add things to collect because above the privacy impact there's also typically a battery impact.
- Yoric 7y ago
  Well, you seem to have better knowledge of Apple than me, so I'll bow to your knowledge. I had the feeling that Apple's privacy stance was privacywashing, but if it is serious, that's great. To return to the initial point, though, the reason for which Mozilla hasn't shaken the web as much as it wants in terms of privacy is that it doesn't have Apple's sole-king-of-iOS position. Whenever the web breaks on Firefox, users blame Firefox. Whenever it breaks on iOS, users blame the web. So Firefox needs to be smart and intentional. It's hard and slow work, but things improve :)
  - om2 7y ago
    Mac Safari doesn't have that kind of protection. Indeed, Firefox has higher global desktop browsing share than Safari. We found ways to add privacy without breaking the web by taking gradual steps and finding clever technical solutions. I appreciate Firefox getting on the privacy-by-default train, but it's just wrong to say that iOS gave us the ability to do something that others couldn't. Our only superpower was being willing to ignore those who said tracking protection would destroy the web economy and/or tank revenue (plus aforementioned crafty trickery).
ancorevard 7y ago
> If you recall, Apple's stance on privacy is quite recent. You should read some of the history of Steve Jobs, and you will learn that he was very serious about privacy and it seems like his values have been imbued into Apple and now Tim Cook. Here's perhaps the latest clip of Steve on privacy: https://www.youtube.com/watch?v=39iKLwlUqBo https://www.youtube.com/watch?v=39iKLwlUqBo
hawaiian 7y ago
It's hard to take anything you write seriously when you're being disingenuous. >Unfortunately, these prototypes broke the web badly. The web was simply not ready for such protection. Yet Apple was fine disabling third-party tracking since 2001 according to GP? >Now, Apple, with their iOS monopoly A monopoly over their own product? >If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. A quick Google search shows that Apple was embroiled because they enabled WiFi-assist by default, which caused some people to use more cellular data than intended. Is this the privacy-invading data "slurp" you mean? >But don't forget that they do this for strategic reasons Who doesn't? Apple is not a charity. We should rejoice that Apple is monetizing privacy, because it means the system is working. >We're also working on it (is anyone else doing so?) GP literally just mentioned expiring first-party cookies after 7-days. I don't trust Mozilla _at all_ these days. Instead Mozilla seems interested in marketing themselves as privacy-focused only enough to grow their userbase for the near future. Once at some critical mass, Mozilla seems to proceed exactly like Google. - Google Analytics tracking users on configuration page, https://github.com/mozilla/addons-frontend/issues/2785 https://github.com/mozilla/addons-frontend/issues/2785 - Firefox Focus, a tracker blocker, sending user data to third-party Adjust https://github.com/mozilla-mobile/focus-ios/wiki/Install-Tracking-in-Firefox-Focus-with-the-Adjust-SDK https://github.com/mozilla-mobile/focus-ios/wiki/Install-Tra... - Firefox installing an add-on without user consent https://news.ycombinator.com/item?id=15931730 https://news.ycombinator.com/item?id=15931730 - Targeted advertisement via Pocket - SHIELD Studies and Telemetry
martindale 7y ago
> these prototypes broke the web badly So what? The web wasn't ready to mandate JavaScript for rendering HTML, so why should we double-down on "not breaking things" now, instead of when it mattered?
- tatersolid 7y ago
  > So what? The web wasn't ready to mandate JavaScript for rendering HTML “The web” has been using JS to render HTML since Outlook Web Access in Exchange 2000 and IE5.

by Yoric 7y ago

jxdxbx 7y ago

> Why did Apple do this, though? If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple. This is incredibly misleading. Apple has been mostly criticized for allowing apps to collect excessive user data--for example, apps could access contacts at first without permission. It has been slowly shutting down these methods, as the realization has sunk in the the more open environment of Macs and PCs is just not appropriate for mobile phones. For example, apps in iOS 13 cannot access bluetooth or Wifi information by default, since it was being used to infer location. Apple does of course collect some user data, e.g. for Siri or app analytics. But it's all painstakingly disclosed and its practices around differential privacy, deletion, and so on are quite good. The tracking ID was Apple throwing a bone to ad industry and app makers, when it shut down far more precise ways of tracking users.

Yoric 7y ago
> This is incredibly misleading. Apple has been mostly criticized for allowing apps to collect excessive user data--for example, apps could access contacts at first without permission. It has been slowly shutting down these methods, as the realization has sunk in the the more open environment of Macs and PCs is just not appropriate for mobile phones. For example, apps in iOS 13 cannot access bluetooth or Wifi information by default, since it was being used to infer location. Yep, the tech world has a short memory :) I distinctly remember Apple caught red-handed slurping GPS data from their users. > The tracking ID was Apple throwing a bone to ad industry and app makers, when it shut down far more precise ways of tracking users. Unless I'm mistaken, it's still much more precise than any form of web tracking.
- jeromegv 7y ago
  You keep repeating that "Apple was caught red-handed" but what exactly are you referring to? What are your sources on that?
  - Yoric 7y ago
    I'm referring to this: https://www.wired.com/2011/04/apple-iphone-tracking/ https://www.wired.com/2011/04/apple-iphone-tracking/
    - vlovich123 7y ago
      Which is literally when they began to take privacy very seriously. Keep in mind that's 8 years ago & the first iPhone was released 12 years ago. I wouldn't characterize that as "recent".
      - Yoric 7y ago
        Well, people still distrust Microsoft for stuff they did during the 90s :) But yeah, I'll grant you that it's not recent.
    - 7y ago

user17843 7y ago

> Now, you are right about the double-keyed caches – although using this to track users is quite more complicated, less precise and less reliable than first-/third-party cookies, it's something we need to address. We're working on it at this very moment. > Finally, yeah, first-party cookies... hard to counter. We're also working on it (is anyone else doing so?), but that will be a tough fight. That sounds awesome. Ad-tech is a burden to society. What's complicated with first-party cookies though? Didn't Apple for example just give them a limit of 7 days? I guess Apple just accepts that people have to log-in again after the 7 day period, but I haven't looked into the technical details about this feature.

TomAnthony 7y ago
It is only first party cookies set via document.cookie, not HTTP cookies. So login mechanisms will not be affected by this.

mevile 7y ago

Thank you for all your hard work on Firefox! Many of us Firefox users really appreciate all the work you and your team does!

Yoric 7y ago
\o/

vlovich123 7y ago

> If you recall, Apple's stance on privacy is quite recent Apple's position on privacy really started accelerating in the pro-privacy direction in 2011 due to the issue around unencrypted location backups, which was also around the time Tim Cook took over. I don't know that 8 continuous years of trying to improve privacy (2/3 of the duration of the mobile revolution & going) is fair to characterize as "recent". Having worked there 6 years ago I can tell you that not only did Apple have internal messaging about privacy being important, they walked the walk in terms of supporting initiatives to continue to push the envelope. > If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago Which instance are you referring to? (sounds like the GPS incident above which doesn't seem recent to me). > Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple. AFAIK Apple doesn't track what you do within the app. They do track things like crashes, other issues, general 3p app usage (for understanding what's important to their customers), & their own apps. All things you would expect ANY vendor to do. It's super hard to add things to collect because above the privacy impact there's also typically a battery impact.

Yoric 7y ago
Well, you seem to have better knowledge of Apple than me, so I'll bow to your knowledge. I had the feeling that Apple's privacy stance was privacywashing, but if it is serious, that's great. To return to the initial point, though, the reason for which Mozilla hasn't shaken the web as much as it wants in terms of privacy is that it doesn't have Apple's sole-king-of-iOS position. Whenever the web breaks on Firefox, users blame Firefox. Whenever it breaks on iOS, users blame the web. So Firefox needs to be smart and intentional. It's hard and slow work, but things improve :)
- om2 7y ago
  Mac Safari doesn't have that kind of protection. Indeed, Firefox has higher global desktop browsing share than Safari. We found ways to add privacy without breaking the web by taking gradual steps and finding clever technical solutions. I appreciate Firefox getting on the privacy-by-default train, but it's just wrong to say that iOS gave us the ability to do something that others couldn't. Our only superpower was being willing to ignore those who said tracking protection would destroy the web economy and/or tank revenue (plus aforementioned crafty trickery).

ancorevard 7y ago

> If you recall, Apple's stance on privacy is quite recent. You should read some of the history of Steve Jobs, and you will learn that he was very serious about privacy and it seems like his values have been imbued into Apple and now Tim Cook. Here's perhaps the latest clip of Steve on privacy: https://www.youtube.com/watch?v=39iKLwlUqBo https://www.youtube.com/watch?v=39iKLwlUqBo

hawaiian 7y ago

It's hard to take anything you write seriously when you're being disingenuous. >Unfortunately, these prototypes broke the web badly. The web was simply not ready for such protection. Yet Apple was fine disabling third-party tracking since 2001 according to GP? >Now, Apple, with their iOS monopoly A monopoly over their own product? >If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. A quick Google search shows that Apple was embroiled because they enabled WiFi-assist by default, which caused some people to use more cellular data than intended. Is this the privacy-invading data "slurp" you mean? >But don't forget that they do this for strategic reasons Who doesn't? Apple is not a charity. We should rejoice that Apple is monetizing privacy, because it means the system is working. >We're also working on it (is anyone else doing so?) GP literally just mentioned expiring first-party cookies after 7-days. I don't trust Mozilla _at all_ these days. Instead Mozilla seems interested in marketing themselves as privacy-focused only enough to grow their userbase for the near future. Once at some critical mass, Mozilla seems to proceed exactly like Google. - Google Analytics tracking users on configuration page, https://github.com/mozilla/addons-frontend/issues/2785 https://github.com/mozilla/addons-frontend/issues/2785 - Firefox Focus, a tracker blocker, sending user data to third-party Adjust https://github.com/mozilla-mobile/focus-ios/wiki/Install-Tracking-in-Firefox-Focus-with-the-Adjust-SDK https://github.com/mozilla-mobile/focus-ios/wiki/Install-Tra... - Firefox installing an add-on without user consent https://news.ycombinator.com/item?id=15931730 https://news.ycombinator.com/item?id=15931730 - Targeted advertisement via Pocket - SHIELD Studies and Telemetry

martindale 7y ago

> these prototypes broke the web badly So what? The web wasn't ready to mandate JavaScript for rendering HTML, so why should we double-down on "not breaking things" now, instead of when it mattered?

tatersolid 7y ago
> So what? The web wasn't ready to mandate JavaScript for rendering HTML “The web” has been using JS to render HTML since Outlook Web Access in Exchange 2000 and IE5.