3 ms·

> I don't understand how trading one ISP for another (Cloudflare?) is an improvement long-run. The system itself needs to be resilient, not just depend on the k

by comex 7y ago

> I don't understand how trading one ISP for another (Cloudflare?) is an improvement long-run. The system itself needs to be resilient, not just depend on the kindness of the upstream gods. Mozilla and Cloudflare negotiated a special privacy policy for Firefox DoH requests [1] that limits what Cloudflare can do with the data – in particular, most information must be deleted after 24 hours. There is no technical measure holding them to that policy, but it’s a contract enforceable through the courts. Nothing similar applies to your average American consumer ISP. [1] https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

xorcist 7y ago
Oh, they promised not to be evil, did they? That link isn't very reassuring. Who are parties to the contract? Who can enforce it? What does it cost to breach?
- comex 7y ago
  The parties to the contract are presumably Cloudflare and Mozilla, since that page keeps mentioning their "agreement with Firefox" and "agreement with Mozilla". Therefore Mozilla can enforce it. As for costs to breach, that would be determined by a judge or jury based on damages suffered by Mozilla. Depends to some extent on the actual text of the contract, which hasn't been published. That's the main mechanism for enforcement, but there are a few additional ways it could theoretically be enforced: - The FTC and state attorneys general can sue companies for violations of their own privacy policies, as "unfair and deceptive acts and practices". For example, they sued Cambridge Analytica recently. [1] - The California attorney general in particular would also be able to sue under the California Consumer Privacy Act once it goes into force. - As for ways for individual consumer to sue... well, it's more difficult, but possible. For instance, a class action suit against Facebook on a grab bag of claims, also related to Cambridge Analytica, recently survived a motion to dismiss. Among other things, the judge held that users could sue for breach of contract if Facebook violated its privacy policy. [2] [1] https://www.ftc.gov/news-events/media-resources/protecting-consumer-privacy/privacy-security-enforcement https://www.ftc.gov/news-events/media-resources/protecting-c... [2] https://www.cand.uscourts.gov/filelibrary/3755/Order-re-Motion-to-Dismiss.pdf https://www.cand.uscourts.gov/filelibrary/3755/Order-re-Moti...

by comex 7y ago

xorcist 7y ago

Oh, they promised not to be evil, did they? That link isn't very reassuring. Who are parties to the contract? Who can enforce it? What does it cost to breach?

comex 7y ago
The parties to the contract are presumably Cloudflare and Mozilla, since that page keeps mentioning their "agreement with Firefox" and "agreement with Mozilla". Therefore Mozilla can enforce it. As for costs to breach, that would be determined by a judge or jury based on damages suffered by Mozilla. Depends to some extent on the actual text of the contract, which hasn't been published. That's the main mechanism for enforcement, but there are a few additional ways it could theoretically be enforced: - The FTC and state attorneys general can sue companies for violations of their own privacy policies, as "unfair and deceptive acts and practices". For example, they sued Cambridge Analytica recently. [1] - The California attorney general in particular would also be able to sue under the California Consumer Privacy Act once it goes into force. - As for ways for individual consumer to sue... well, it's more difficult, but possible. For instance, a class action suit against Facebook on a grab bag of claims, also related to Cambridge Analytica, recently survived a motion to dismiss. Among other things, the judge held that users could sue for breach of contract if Facebook violated its privacy policy. [2] [1] https://www.ftc.gov/news-events/media-resources/protecting-consumer-privacy/privacy-security-enforcement https://www.ftc.gov/news-events/media-resources/protecting-c... [2] https://www.cand.uscourts.gov/filelibrary/3755/Order-re-Motion-to-Dismiss.pdf https://www.cand.uscourts.gov/filelibrary/3755/Order-re-Moti...