7 ms·

Firefox Installs non-free binaries from Cisco and Google again (2018)

DyslexicAtheist 7y ago
see also this cluster-fudge: "firefox: Safe Browsing updates fail due to insufficient quota on the Google API key" https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895147 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895147 both issues are still open after more than 1 year! There seems to be a disconnect in how FF security is perceived by tech savvy users and how security/privacy critical bugs get prioritized by Mozilla. edit: Just recently I discovered DoH was activated by default now and bypassing my /etc/hosts block list without any warning. This opened me up to tracking from sites I thought I had blocked (discovered it only by accident and after several months when I actively looked into DoH and the network.trr.mode setting). In all above cases the failure-modes are insecure. It's like a firewall that suddenly switches its enforcement policy from a deny-all+whitelisting to allow-all+blacklisting without properly informing users. Totally unacceptable!
- rovek 7y ago
  My DoH in 71.0 and 72.0 is off by default, I haven't changed those settings.
  - glyxbaer 7y ago
    Seems to be automatically enabled for users in the US [1] if I understand correctly. [1] https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
- otterlicious 7y ago
  The linked bug appears to be waiting on action from the Debian maintainers. The Mozilla devs in that thread seem very responsive.
  - EwanToo 7y ago
    Yes, the linked bug (from the comment) appears to be entirely between Debian and Google (Chromium is affected too) with Mozilla offering to facilitate, with no (public at least) response from debian?
- deleted 7y ago
  [deleted]
- pbhjpbhj 7y ago
  Thank you for that note on DNS-over-HTTP .. it might explain a weird event for me recently where a blacklisted site wasn't blocked (opendns + pihole). Are FF sending all my DNS data to a private third party now then? Doesn't sound a very FOSS thing to do?
  - byuu 7y ago
    Yes, they are sending all of your DNS requests to Cloudflare. You can of course change it, but it's opt-out and not communicated to users that this is happening.
    - fourthark 7y ago
      In the name of privacy. https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs
      - byuu 7y ago
        You may trust Cloudflare, but I do not. I trust my DNS provider. It's fine for me, I keep up on these things and I have disabled DoH already (I don't care for any current DoH provider, and I also rely on /etc/hosts entries.) In any case, my post was only meant to inform. To each their own, use them if you like or if you trust their privacy promises more than I do. But people should be aware that Mozilla silently changed where all your DNS requests are routed to.
        coldpie 7y ago
        > You may trust Cloudflare, but I do not. I trust my DNS provider. For many, maybe even most, the situation is reversed. ISP-provided DNS (the default for 99% of web users) is very often intentionally mis-configured to return ad-laden "search results" instead of NXDOMAIN. The situation is more authoritarian administrative districts is even worse. You're right that trusting Cloudflare isn't ideal either, but they are at least better behaved than most ISPs, so it's the lesser of two evils, I think. Non-technical users shouldn't be expected to know how these things function, they should just get the least-bad option by default.
- mosselman 7y ago
  Thanks for this. What should I do to disable this? Set network.trr.mode in about:config to 0?
  - shakna 7y ago
    Doesn't have to be so arcane. Network Settings -> Untick "Enable DNS over HTTPS"
    - mosselman 7y ago
      Thanks
  - DyslexicAtheist 7y ago
    set network.trr.mode to 5: https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver also if you have unbound or local dnsmasq caching you could set a canary domain (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... ). To set it up with dnsmasq just add the line for the canary to /etc/dnsmasq.conf: address=/use-application-dns.net/
    - move-on-by 7y ago
      For those running a PiHole, I thought for sure that the pihole was already doing this for me. Turns out the implementations (#2915 & #2916) are still sitting in the development branch waiting for a release - they were merged to development on Sep 07, 2019. * https://github.com/pi-hole/pi-hole/pull/2915 https://github.com/pi-hole/pi-hole/pull/2915 * https://github.com/pi-hole/pi-hole/pull/2916 https://github.com/pi-hole/pi-hole/pull/2916 * https://github.com/pi-hole/pi-hole/compare/master...development https://github.com/pi-hole/pi-hole/compare/master...developm...
- esarbe 7y ago
  I guess you want your money back?
  - DyslexicAtheist 7y ago
    no I want people who call themselves "devs" to actually care about security or stay away from production code. These are violations of very basic security principles.
    - smarnach 7y ago
      What do you mean by "stay away from production code"?
      - dylan604 7y ago
        Not the person you're replying, but I read it as "If you don't know what you're doing, do not touch".
    - phatfish 7y ago
      Ah yes, the entitled belligerent type that wants their high standards met or you get insults thrown at you. Feel free to develop your own browser, or use an alternative. Having my DNS queries go in plain text over the public internet is crazy. The fact that ISPs are moaning about it so loudly should be a big clue DoH is a good idea.
    - esarbe 7y ago
      What basic security principles would that be?
- deleted 7y ago
  [deleted]
- AnIdiotOnTheNet 7y ago
  Mozilla likes to talk a good game about caring about privacy and user control, but it's mostly just marketing. These are the same people who integrated Pocket and did that stupid Mr. Robot thing.
- zaarn 7y ago
  DoH is only activated by default in the US and if you use PiHole or similar there is a DNS canary that prevents FF from using DoH. Additionally it shouldn't be ignoring your /etc/hosts block list as DoH simply replaces DNS not the host list.
- judge2020 7y ago
  > Just recently I discovered DoH was activated by default now and bypassing my /etc/hosts block list without any warning It reads your /etc/hosts before going to DoH I believe.
T3RMINATED 7y ago
Boycott Firefox
vmchale 7y ago
that's why I use chrome
- SmellyGeekBoy 7y ago
  This doesn't even make sense, Chrome is non-free to begin with.
  - pedrogpimenta 7y ago
    It's a joke.
    - ncmncm 7y ago
      It's two jokes!
paulintrognon 7y ago
Can someone here please explain to me what the issue is? Firefox downloads non-free binaries in order to read some codecs by default, and this issue states that firefox should not download the codec by default because it is non-free, which is against debian's philosophy, is that correct?
- Wowfunhappy 7y ago
  Yes, although notably this is about black-box DRM systems, not just your run-of-the-mill video codecs. Standard versions of Firefox include non-free components by default because most users expect Netflix to work. ("Free" means "open source" in this context.) Debian repositories (that aren't named "non-free") are supposed to contain only free software, so the Debian-packaged version of Firefox needs to be stripped of any non-free components. Should any slip through, that's a critical bug as far as Debian is concerned. I don't think there's an issue here, it's just two projects with different goals proceeding as they're supposed to. We can have a discussion about all the things wrong with Encrypted Media Extensions and the like, but it's somewhat beside the point unless Firefox gains way more marketshare.
  - suprfsat 7y ago
    What technical reason is there for Firefox to dynamically download these libraries instead of bundling them at built time? It leads to bugs such as this one.
    - jaas 7y ago
      Licensing. Cisco has an all you can eat distribution license for the codec, so Firefox downloads from Cisco to piggyback on the Cisco license. If Firefox bundled it Mozilla would need a distribution license, and that's expensive.
    - zaarn 7y ago
      Because if the user doesn't use netflix, you don't have to bother them with widevine or EME, it's not even installed. It only gets installed if necessary and Mozilla can ship the occassional update without having to wait for distro maintainers, preventing Netflix from not working.
romaaeterna 7y ago
It's worse than that. Firefox will download non-free javascript and html from pretty much every website you visit. Debian team needs to get on it, fast!
- nikeee 7y ago
  Actually there is an extension for that: https://www.gnu.org/software/librejs https://www.gnu.org/software/librejs
- bobongo 7y ago
  I do not think the sarcasm is deserved here. Debian is committed to free software. You can find a set of guidelines they implement in their social contract website under the heading "The Debian Free Software Guidelines (DFSG)" at https://www.debian.org/social_contract#guidelines https://www.debian.org/social_contract#guidelines A substantial user and developer base prefers Debian precisely because of these Guidelines. Inclusion of free software (as-is) that automatically installs non-free binaries would violate almost all of these guidelines.
  - romaaeterna 7y ago
    I'm not sure that these guidelines make a distinction between a call to install a codec on-demand versus a call to download and run (and even cache) a minified Javascript library.
    - dTal 7y ago
      The difference is whether the user has explicitly asked for it. If I point my web browser at a url, I am instructing it to download and execute whatever it finds there. However, if the browser decides to download a codec on-demand, it is making an executive decision as to what code should run on the machine - and to select non-free code without user interaction is a violation of trust. An analogous situation would be the non-free NVidia blob. Debian fully supports installing it, but it would be very much verboten to do so by default, automatically.
madacol 7y ago
Why is this relevant if it's from DEC 2018?
paulie_a 7y ago
Next week will be entertaining when someone takes a baseball bat to the pinata and 50;security vulnerablities fall out. thanks Cisco for your continued dangerous and terrible software. I wonder if the devs get a bonus for everyone they fix.

see also this cluster-fudge: "firefox: Safe Browsing updates fail due to insufficient quota on the Google API key" https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895147 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895147 both issues are still open after more than 1 year! There seems to be a disconnect in how FF security is perceived by tech savvy users and how security/privacy critical bugs get prioritized by Mozilla. edit: Just recently I discovered DoH was activated by default now and bypassing my /etc/hosts block list without any warning. This opened me up to tracking from sites I thought I had blocked (discovered it only by accident and after several months when I actively looked into DoH and the network.trr.mode setting). In all above cases the failure-modes are insecure. It's like a firewall that suddenly switches its enforcement policy from a deny-all+whitelisting to allow-all+blacklisting without properly informing users. Totally unacceptable!

rovek 7y ago
My DoH in 71.0 and 72.0 is off by default, I haven't changed those settings.
- glyxbaer 7y ago
  Seems to be automatically enabled for users in the US [1] if I understand correctly. [1] https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
otterlicious 7y ago
The linked bug appears to be waiting on action from the Debian maintainers. The Mozilla devs in that thread seem very responsive.
- EwanToo 7y ago
  Yes, the linked bug (from the comment) appears to be entirely between Debian and Google (Chromium is affected too) with Mozilla offering to facilitate, with no (public at least) response from debian?
deleted 7y ago
[deleted]
pbhjpbhj 7y ago
Thank you for that note on DNS-over-HTTP .. it might explain a weird event for me recently where a blacklisted site wasn't blocked (opendns + pihole). Are FF sending all my DNS data to a private third party now then? Doesn't sound a very FOSS thing to do?
- byuu 7y ago
  Yes, they are sending all of your DNS requests to Cloudflare. You can of course change it, but it's opt-out and not communicated to users that this is happening.
  - fourthark 7y ago
    In the name of privacy. https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs
    - byuu 7y ago
      You may trust Cloudflare, but I do not. I trust my DNS provider. It's fine for me, I keep up on these things and I have disabled DoH already (I don't care for any current DoH provider, and I also rely on /etc/hosts entries.) In any case, my post was only meant to inform. To each their own, use them if you like or if you trust their privacy promises more than I do. But people should be aware that Mozilla silently changed where all your DNS requests are routed to.
      - coldpie 7y ago
        > You may trust Cloudflare, but I do not. I trust my DNS provider. For many, maybe even most, the situation is reversed. ISP-provided DNS (the default for 99% of web users) is very often intentionally mis-configured to return ad-laden "search results" instead of NXDOMAIN. The situation is more authoritarian administrative districts is even worse. You're right that trusting Cloudflare isn't ideal either, but they are at least better behaved than most ISPs, so it's the lesser of two evils, I think. Non-technical users shouldn't be expected to know how these things function, they should just get the least-bad option by default.
mosselman 7y ago
Thanks for this. What should I do to disable this? Set network.trr.mode in about:config to 0?
- shakna 7y ago
  Doesn't have to be so arcane. Network Settings -> Untick "Enable DNS over HTTPS"
  - mosselman 7y ago
    Thanks
- DyslexicAtheist 7y ago
  set network.trr.mode to 5: https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver also if you have unbound or local dnsmasq caching you could set a canary domain (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... ). To set it up with dnsmasq just add the line for the canary to /etc/dnsmasq.conf: address=/use-application-dns.net/
  - move-on-by 7y ago
    For those running a PiHole, I thought for sure that the pihole was already doing this for me. Turns out the implementations (#2915 & #2916) are still sitting in the development branch waiting for a release - they were merged to development on Sep 07, 2019. * https://github.com/pi-hole/pi-hole/pull/2915 https://github.com/pi-hole/pi-hole/pull/2915 * https://github.com/pi-hole/pi-hole/pull/2916 https://github.com/pi-hole/pi-hole/pull/2916 * https://github.com/pi-hole/pi-hole/compare/master...development https://github.com/pi-hole/pi-hole/compare/master...developm...
esarbe 7y ago
I guess you want your money back?
- DyslexicAtheist 7y ago
  no I want people who call themselves "devs" to actually care about security or stay away from production code. These are violations of very basic security principles.
  - smarnach 7y ago
    What do you mean by "stay away from production code"?
    - dylan604 7y ago
      Not the person you're replying, but I read it as "If you don't know what you're doing, do not touch".
  - phatfish 7y ago
    Ah yes, the entitled belligerent type that wants their high standards met or you get insults thrown at you. Feel free to develop your own browser, or use an alternative. Having my DNS queries go in plain text over the public internet is crazy. The fact that ISPs are moaning about it so loudly should be a big clue DoH is a good idea.
  - esarbe 7y ago
    What basic security principles would that be?
deleted 7y ago
[deleted]
AnIdiotOnTheNet 7y ago
Mozilla likes to talk a good game about caring about privacy and user control, but it's mostly just marketing. These are the same people who integrated Pocket and did that stupid Mr. Robot thing.
zaarn 7y ago
DoH is only activated by default in the US and if you use PiHole or similar there is a DNS canary that prevents FF from using DoH. Additionally it shouldn't be ignoring your /etc/hosts block list as DoH simply replaces DNS not the host list.
judge2020 7y ago
> Just recently I discovered DoH was activated by default now and bypassing my /etc/hosts block list without any warning It reads your /etc/hosts before going to DoH I believe.

T3RMINATED 7y ago

Boycott Firefox

vmchale 7y ago

that's why I use chrome

SmellyGeekBoy 7y ago
This doesn't even make sense, Chrome is non-free to begin with.
- pedrogpimenta 7y ago
  It's a joke.
  - ncmncm 7y ago
    It's two jokes!

paulintrognon 7y ago

Can someone here please explain to me what the issue is? Firefox downloads non-free binaries in order to read some codecs by default, and this issue states that firefox should not download the codec by default because it is non-free, which is against debian's philosophy, is that correct?

Wowfunhappy 7y ago
Yes, although notably this is about black-box DRM systems, not just your run-of-the-mill video codecs. Standard versions of Firefox include non-free components by default because most users expect Netflix to work. ("Free" means "open source" in this context.) Debian repositories (that aren't named "non-free") are supposed to contain only free software, so the Debian-packaged version of Firefox needs to be stripped of any non-free components. Should any slip through, that's a critical bug as far as Debian is concerned. I don't think there's an issue here, it's just two projects with different goals proceeding as they're supposed to. We can have a discussion about all the things wrong with Encrypted Media Extensions and the like, but it's somewhat beside the point unless Firefox gains way more marketshare.
- suprfsat 7y ago
  What technical reason is there for Firefox to dynamically download these libraries instead of bundling them at built time? It leads to bugs such as this one.
  - jaas 7y ago
    Licensing. Cisco has an all you can eat distribution license for the codec, so Firefox downloads from Cisco to piggyback on the Cisco license. If Firefox bundled it Mozilla would need a distribution license, and that's expensive.
  - zaarn 7y ago
    Because if the user doesn't use netflix, you don't have to bother them with widevine or EME, it's not even installed. It only gets installed if necessary and Mozilla can ship the occassional update without having to wait for distro maintainers, preventing Netflix from not working.

romaaeterna 7y ago

It's worse than that. Firefox will download non-free javascript and html from pretty much every website you visit. Debian team needs to get on it, fast!

nikeee 7y ago
Actually there is an extension for that: https://www.gnu.org/software/librejs https://www.gnu.org/software/librejs
bobongo 7y ago
I do not think the sarcasm is deserved here. Debian is committed to free software. You can find a set of guidelines they implement in their social contract website under the heading "The Debian Free Software Guidelines (DFSG)" at https://www.debian.org/social_contract#guidelines https://www.debian.org/social_contract#guidelines A substantial user and developer base prefers Debian precisely because of these Guidelines. Inclusion of free software (as-is) that automatically installs non-free binaries would violate almost all of these guidelines.
- romaaeterna 7y ago
  I'm not sure that these guidelines make a distinction between a call to install a codec on-demand versus a call to download and run (and even cache) a minified Javascript library.
  - dTal 7y ago
    The difference is whether the user has explicitly asked for it. If I point my web browser at a url, I am instructing it to download and execute whatever it finds there. However, if the browser decides to download a codec on-demand, it is making an executive decision as to what code should run on the machine - and to select non-free code without user interaction is a violation of trust. An analogous situation would be the non-free NVidia blob. Debian fully supports installing it, but it would be very much verboten to do so by default, automatically.

madacol 7y ago

Why is this relevant if it's from DEC 2018?

paulie_a 7y ago

Next week will be entertaining when someone takes a baseball bat to the pinata and 50;security vulnerablities fall out. thanks Cisco for your continued dangerous and terrible software. I wonder if the devs get a bonus for everyone they fix.