6 ms·

Meanwhile firefox is the browser that calls home the most (at least on the first run) https://twitter.com/jonathansampson/status/1165858896176660480 https://twi

Meanwhile firefox is the browser that calls home the most (at least on the first run) https://twitter.com/jonathansampson/status/1165858896176660480 https://twitter.com/jonathansampson/status/11658588961766604... On every single release they add new hidden options regarding tracking by mozilla (see Normandy and shield for example, which you have to go to about:config to disable). In addition to that about:addons uses google analitics and does not allow for it to be blocked by extensions, plus mozilla sites use tracking scripts (googletagmanager etc) that need modifications in about:config to be blocked (extensions.webextensions.restrictedDomains). Finally mozilla does not seem to be taking any measures to make firefox more resilient to tracking - in fact they support more and more technologies that diminish it. (web fonts, webgl, geolocation, user agent mentioning the version language and OS, etc) Edit: Sorry, by "web fonts" I meant the ability for sites to read the fonts that you have installed. I do not know if actual web fonts can be used for tracking.

inetknght 7y ago
Pocket too
Santosh83 7y ago
Correct me if I am wrong but aren't they including built-in tracker blocking with a 'strict' list that can be chosen, plus they are working on site-level isolation that is behind a config flag for now (1st party isolation) and as far as I know, they're the only browser that has multiple anti-fingerprinting measures that can be toggled by the resistFingerprinting config flag? If they default disabled web fonts, geolocation etc., they'd lose whatever little market share they have as those have become important web tech already. You can still disable all of them either by means of about:config toggles or through simple extensions like uMatrix. Not sure if Chrome even allows disabling any/all of them.
- monadic2 7y ago
  > If they default disabled web fonts, geolocation etc., they'd lose whatever little market share they have as those have become important web tech already. I doubt people would even notice the font side of things.
  - imgabe 7y ago
    They'd notice. Maybe they wouldn't notice that they notice, but they'd get a general feel that things look worse.
    - robolange 7y ago
      Agreed. I used panopticlick and it showed me that web fonts were one of the biggest discriminators. I disabled them and tested on a sample of normal end user type Web sites. The web got real ugly looking real fast. If Mozilla disabled web fonts by default, normal end users would draw the conclusion that Firefox couldn't properly render the web, and would flock back into the arms of Chrome.
      - zzzcpan 7y ago
        They could ship web browser with all common web fonts to render them from disk without fetching. This would allow disabling of fetching of web fonts without breaking websites. Also could eliminate fonts as a fingerprinting vector altogether if system fonts were ignored as well.
        snazz 7y ago
        That’s actually not a bad idea. Lots of sites do have custom fonts, so maybe it would be a good idea to still put some icon in the address bar when the site has web fonts that didn’t come with the browser.
        robolange 7y ago
        What about fonts which are not licensed under an open source compatible license. What about fonts that are not "common" but are used by some popular Web site? Your request is doomed to failure. Like it or not, Web authors have been given the power by Web fonts to have total control of the fonts on their Web pages, and they ARE using that power. Any attempt by a low market share browser to change that fact is doomed to blow back on that browser.
- dependenttypes 7y ago
  > aren't they including built-in tracker blocking with a 'strict' list that can be chosen This is not in any way better than ublock origin. Anyone who knows to select the strict list also knows how to install an adblocker. > If they default disabled web fonts, geolocation etc., they'd lose whatever little market share they have as those have become important web tech already I am not saying that they should disable them by default, but they should at least make it easier for people who care about their privacy to disable them. (Although I do not think that any desktop user is going to miss geolocation) In addition to that I am annoyed that they keep supporting such technologies that can be used for tracking in the working groups rather than push back on them.
  - cptskippy 7y ago
    > web fonts I installed NoScript recently and was surprised to see so many sites linking to typekit or other centralized repos for JS related to rendering fonts. Why do sites using webfonts have JS dependencies? Is it something to do with licensing? Between products like DTM and typekit, Adobe has been quietly positioning itself to be a tracking/advert power house.
    - whelming_wave 7y ago
      For paid fonts where you license them for web use (sometimes by the view/download!), it isn’t unusual for them to require you to use their css/js/etc to embed the font so they can track where your license is being used, by how many people, etc. That’s the justification they present, at least.
ymolodtsov 7y ago
When I wanted to quickly add some analytics to my website to see if anyone's reading it and from where, I had a hard time with Google Analytics because neither Firefox nor Safari allowed me to check if it works. Had to open Chrome to ensure it does log viewers.
fenwick67 7y ago
Perfect is the enemy of good. Firefox is pushing the Overton window in the right direction, which is good enough for me. Some of your complaints are legitimate but that doesn't mean Firefox isn't the best option for most people right now.
- dependenttypes 7y ago
  Certainly, I am using firefox as well right now, but this does not mean that we should give up in our objective to privacy and just trust mozilla.
- jshevek 7y ago
  If your main concern is privacy, Firefox is not the best browser for most people right now: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf
  - fenwick67 7y ago
    Brave's integrated ponzi scheme (magic Brave dollars) and fundamental dependency on Google's Chromium make it a no-go for me.
    - jshevek 7y ago
      >Brave's integrated ponzi scheme (magic Brave dollars) "Ponzi" and "magic" are not descriptors one would use if discussing this [objectively]. Fortunately, BAT is opt in, and you can get all of the superior privacy benefits of Brave without BAT playing any role in your browser experience.
      - fenwick67 7y ago
        I appreciate your point about BAT being opt-in. Maybe the language is a bit inflammatory for HN standards, but BAT has always seemed crummy to me.
mfer 7y ago
And Chrome tracks individual users by Chrome installation ID. It's sent to certain Google domains like Doubleclick [1]. All browsers are tracking us. It has to do with when, where, and what they do with it. We're not dealing with a perfect world. Some of this has to do with intents and privacy protections outside of technology (i.e., policy). At least that's Mozilla's stance. For example, the analytics Mozilla collects on Firefox cannot be legally used by the analytics service for other things. We need to be careful to not let perfect be the enemy of good in the way we praise the the _direction_ we want to go. [1] https://news.ycombinator.com/item?id=22236106 https://news.ycombinator.com/item?id=22236106 Note, IANAL.
deleted 7y ago
[deleted]
Angeo34 7y ago
The problem isn't analytics the problem is tracking. Brave is the perfect example. It may have no built in analytics but at the same time it is easier to track than Google Chrome due to fingerprinting. Do you care more about testing which features of a product are actually used (Firefox) or do you care about a company giving out your entire browsing history through a side.channel (Brave).
- dependenttypes 7y ago
  > The problem isn't analytics the problem is tracking Both are an issue. > it is easier to track than Google Chrome due to fingerprinting > or do you care about a company giving out your entire browsing history through a side.channel (Brave). I do not use Brave but [citation needed].
jshevek 7y ago
Indeed. Firefox is not the best browser if your main concern is privacy: https://news.ycombinator.com/item?id=22419284 https://news.ycombinator.com/item?id=22419284

inetknght 7y ago

Pocket too

Santosh83 7y ago

Correct me if I am wrong but aren't they including built-in tracker blocking with a 'strict' list that can be chosen, plus they are working on site-level isolation that is behind a config flag for now (1st party isolation) and as far as I know, they're the only browser that has multiple anti-fingerprinting measures that can be toggled by the resistFingerprinting config flag? If they default disabled web fonts, geolocation etc., they'd lose whatever little market share they have as those have become important web tech already. You can still disable all of them either by means of about:config toggles or through simple extensions like uMatrix. Not sure if Chrome even allows disabling any/all of them.

monadic2 7y ago
> If they default disabled web fonts, geolocation etc., they'd lose whatever little market share they have as those have become important web tech already. I doubt people would even notice the font side of things.
- imgabe 7y ago
  They'd notice. Maybe they wouldn't notice that they notice, but they'd get a general feel that things look worse.
  - robolange 7y ago
    Agreed. I used panopticlick and it showed me that web fonts were one of the biggest discriminators. I disabled them and tested on a sample of normal end user type Web sites. The web got real ugly looking real fast. If Mozilla disabled web fonts by default, normal end users would draw the conclusion that Firefox couldn't properly render the web, and would flock back into the arms of Chrome.
    - zzzcpan 7y ago
      They could ship web browser with all common web fonts to render them from disk without fetching. This would allow disabling of fetching of web fonts without breaking websites. Also could eliminate fonts as a fingerprinting vector altogether if system fonts were ignored as well.
      - snazz 7y ago
        That’s actually not a bad idea. Lots of sites do have custom fonts, so maybe it would be a good idea to still put some icon in the address bar when the site has web fonts that didn’t come with the browser.
      - robolange 7y ago
        What about fonts which are not licensed under an open source compatible license. What about fonts that are not "common" but are used by some popular Web site? Your request is doomed to failure. Like it or not, Web authors have been given the power by Web fonts to have total control of the fonts on their Web pages, and they ARE using that power. Any attempt by a low market share browser to change that fact is doomed to blow back on that browser.
dependenttypes 7y ago
> aren't they including built-in tracker blocking with a 'strict' list that can be chosen This is not in any way better than ublock origin. Anyone who knows to select the strict list also knows how to install an adblocker. > If they default disabled web fonts, geolocation etc., they'd lose whatever little market share they have as those have become important web tech already I am not saying that they should disable them by default, but they should at least make it easier for people who care about their privacy to disable them. (Although I do not think that any desktop user is going to miss geolocation) In addition to that I am annoyed that they keep supporting such technologies that can be used for tracking in the working groups rather than push back on them.
- cptskippy 7y ago
  > web fonts I installed NoScript recently and was surprised to see so many sites linking to typekit or other centralized repos for JS related to rendering fonts. Why do sites using webfonts have JS dependencies? Is it something to do with licensing? Between products like DTM and typekit, Adobe has been quietly positioning itself to be a tracking/advert power house.
  - whelming_wave 7y ago
    For paid fonts where you license them for web use (sometimes by the view/download!), it isn’t unusual for them to require you to use their css/js/etc to embed the font so they can track where your license is being used, by how many people, etc. That’s the justification they present, at least.

ymolodtsov 7y ago

When I wanted to quickly add some analytics to my website to see if anyone's reading it and from where, I had a hard time with Google Analytics because neither Firefox nor Safari allowed me to check if it works. Had to open Chrome to ensure it does log viewers.

fenwick67 7y ago

Perfect is the enemy of good. Firefox is pushing the Overton window in the right direction, which is good enough for me. Some of your complaints are legitimate but that doesn't mean Firefox isn't the best option for most people right now.

dependenttypes 7y ago
Certainly, I am using firefox as well right now, but this does not mean that we should give up in our objective to privacy and just trust mozilla.
jshevek 7y ago
If your main concern is privacy, Firefox is not the best browser for most people right now: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf
- fenwick67 7y ago
  Brave's integrated ponzi scheme (magic Brave dollars) and fundamental dependency on Google's Chromium make it a no-go for me.
  - jshevek 7y ago
    >Brave's integrated ponzi scheme (magic Brave dollars) "Ponzi" and "magic" are not descriptors one would use if discussing this [objectively]. Fortunately, BAT is opt in, and you can get all of the superior privacy benefits of Brave without BAT playing any role in your browser experience.
    - fenwick67 7y ago
      I appreciate your point about BAT being opt-in. Maybe the language is a bit inflammatory for HN standards, but BAT has always seemed crummy to me.

mfer 7y ago

And Chrome tracks individual users by Chrome installation ID. It's sent to certain Google domains like Doubleclick [1]. All browsers are tracking us. It has to do with when, where, and what they do with it. We're not dealing with a perfect world. Some of this has to do with intents and privacy protections outside of technology (i.e., policy). At least that's Mozilla's stance. For example, the analytics Mozilla collects on Firefox cannot be legally used by the analytics service for other things. We need to be careful to not let perfect be the enemy of good in the way we praise the the _direction_ we want to go. [1] https://news.ycombinator.com/item?id=22236106 https://news.ycombinator.com/item?id=22236106 Note, IANAL.

deleted 7y ago

[deleted]

Angeo34 7y ago

The problem isn't analytics the problem is tracking. Brave is the perfect example. It may have no built in analytics but at the same time it is easier to track than Google Chrome due to fingerprinting. Do you care more about testing which features of a product are actually used (Firefox) or do you care about a company giving out your entire browsing history through a side.channel (Brave).

dependenttypes 7y ago
> The problem isn't analytics the problem is tracking Both are an issue. > it is easier to track than Google Chrome due to fingerprinting > or do you care about a company giving out your entire browsing history through a side.channel (Brave). I do not use Brave but [citation needed].

jshevek 7y ago

Indeed. Firefox is not the best browser if your main concern is privacy: https://news.ycombinator.com/item?id=22419284 https://news.ycombinator.com/item?id=22419284