7 ms·

Even with all reporting and telemetry disabled Firefox sends network requests to Mozilla’s domains upon launch, providing Mozilla with usage tracking data. It w

Even with all reporting and telemetry disabled Firefox sends network requests to Mozilla’s domains upon launch, providing Mozilla with usage tracking data. It would be nice if users who care about this could get Mozilla to honor its privacy claims and configuration settings.

pornel 6y ago
It's a big leap from "makes a request" to "provides tracking data". One doesn't necessary mean the other. It's even bigger leap to say that it's done in violation of stated privacy policies. For example, requests for software update have to go to Mozilla, but don't have any personal information, and are legitimately necessary.
- psychoslave 6y ago
  Well, shouldn’t the user decide what is legitimate to take out of its behavior? It might be done without bad intentions, but do Mozilla ask consent before asking their users data about when they are using Firefox, and so that they are (possibly) in front of their screen.
  - sergeykish 6y ago
    Well, shouldn't browser be safe by default? Consent only required for personal data. Absence of visible settings suggests those who trade browser silence for safety is a minority, not target audience. It is open source, you can make own build.
- inetknght 6y ago
  > It's a big leap from "makes a request" to "provides tracking data" No it isn't.
  - franga2000 6y ago
    Care to elaborate?
    - inetknght 6y ago
      1) make a network request 2) track IP address
      - franga2000 6y ago
        They've said many times they don't log IP addresses so if they do, it's definitely illegal. So let's look at the risk vs reward of that situation: Risk: very high because they rely on user trust to survive and they could get sued into oblivion under the GDPR. Reward: they now have a list of IP addresses with Firefox users behind them. Any big website has that so it's not valuable to third parties and it's not valuable to Mozilla because they don't do any targeted advertising or anything similar. A list of IP addresses is about the least useful thing to log if you want to track people.
  - bartvk 6y ago
    C'mon, read the guidelines, linked at the bottom of every page. "Casual dismissal" is right there.
- labawi 6y ago
  If firefox is installed from a system package, or installed by another user, it can't really update itself¹, and updates are not legitimately necessary. ¹ except of course any updates and binaries that firefox downloads and gobbles up behind the users back.
  - easton 6y ago
    If Firefox is installed by another user (or even by yourself) on Windows, the Mozilla Maintenance Service is installed to automatically update Firefox without requiring you to personally elevate the installer. I'd argue updates are legitimately necessary for 99% of users (automatic updates are a huge reason why 90% of home PCs aren't in a botnet, and were a big reason why Chrome more secure in the old days vs IE/Firefox), and if you want to disable them it's very easy to do (about:config -> app.update.auto = false). But I don't know why you would, if the browser is changing too much for you you can change to ESR which is security updates only to older versions of Firefox. https://wiki.mozilla.org/Windows_Service_Silent_Update https://wiki.mozilla.org/Windows_Service_Silent_Update
    - labawi 6y ago
      I'm on linux. Yes, automatic updates are pretty much necessary for about 90-99+% of users, but many lot of them are using system packages (which again, should not be able to update isself), and it is still not a reason why there shouldn't be a way to disable random background connections. One could argue a silent browser is legitimately necessary for security research/operations, or just severely data-constrained networks, but I have yet to find a way to make firefox quiet. Will app.update.auto disable all updates (browser, search engines, safe-browsing, user-test, blacklists.. there was at least a dozen features)? Last time I tried disabling almost everything suspicious, yet firefox wouldn't respect half of the settings.
  - pornel 6y ago
    Linux distros don't handle all of the updates, such as add-ons or tracking protection blacklists. Having an option to disable them would be a footgun. Such "radio silence" serves no useful purpose to normal users, but can make the browser appear buggy, e.g. if tracking protection broke a site, and you wouldn't get a fixed blacklist in a timely manner. Someone has to host these dynamic components, and the browser has to get them somehow. IMHO it's way better if they're fetched straight from Mozilla that has strong privacy policy and a good reputation to uphold, rather than from some rando free distro mirror.
kaba0 6y ago
Come on, you guys are in every thread nitpicking tiny tiny things like this, while the alternative is literally incomparably worse, and the only thing you achieve by this is making firefox’s case harder for those who don’t look up your ridiculous claims... First of all, all of these things can be turned off; second, checking if you are using an outdated, potentially insecure browser is essential - if there is a vulnerability, the least of your problem will be that one goddamn ping to a mozilla domain...
- user3939382 6y ago
  > First of all, all of these things can be turned off; They cannot. Reporting off, telemetry off, automatic updates off, every related setting in about:config off -- Firefox still transacts data with not one but several Mozilla domains upon launching. Mozilla can't ethically constantly talk about privacy out of one side of its mouth while collecting data that can be used to track users who have explicitly requested them not to do that out of the other side.
  - kaba0 6y ago
    Then feel free to look it up in the source code, or even patch it.
    - user3939382 6y ago
      If I could afford the time to learn Rust, the frameworks used by Firefox, the associated toolchain, and the Firefox codebase, and the time to maintain a fork, I would love to do that.
  - franga2000 6y ago
    > Mozilla can't ethically constantly talk about privacy out of one side of its mouth while collecting data that can be used to track users who have explicitly requested them not to do that out of the other side. 1. They can if they're an order of magnitude better than everyone else, just like electric car makers can talk about being environmentally friendly despite the fact lithium isn't renewable 2. Are you sure it's tracking? What data is actually sent? Crash reports, update checks, network tests, motd fetching, cache preloading... don't count as "tracking users". Hell, even reporting on statistics (version, OS, platform, region...) isn't actually tracking users, but FF lets you disable that regardless because they know some people don't like it.
juloo 6y ago
These requests are used to detect WIFI portals.
- account42 6y ago
  Which many computers never encounter. No excuse to have that on by default.
- user3939382 6y ago
  That's one out of about 6 or 7, which is clear from the request path
sergeykish 6y ago
Why don't you check what it sends instead of shooting "tracking data"?

pornel 6y ago

It's a big leap from "makes a request" to "provides tracking data". One doesn't necessary mean the other. It's even bigger leap to say that it's done in violation of stated privacy policies. For example, requests for software update have to go to Mozilla, but don't have any personal information, and are legitimately necessary.

psychoslave 6y ago
Well, shouldn’t the user decide what is legitimate to take out of its behavior? It might be done without bad intentions, but do Mozilla ask consent before asking their users data about when they are using Firefox, and so that they are (possibly) in front of their screen.
- sergeykish 6y ago
  Well, shouldn't browser be safe by default? Consent only required for personal data. Absence of visible settings suggests those who trade browser silence for safety is a minority, not target audience. It is open source, you can make own build.
inetknght 6y ago
> It's a big leap from "makes a request" to "provides tracking data" No it isn't.
- franga2000 6y ago
  Care to elaborate?
  - inetknght 6y ago
    1) make a network request 2) track IP address
    - franga2000 6y ago
      They've said many times they don't log IP addresses so if they do, it's definitely illegal. So let's look at the risk vs reward of that situation: Risk: very high because they rely on user trust to survive and they could get sued into oblivion under the GDPR. Reward: they now have a list of IP addresses with Firefox users behind them. Any big website has that so it's not valuable to third parties and it's not valuable to Mozilla because they don't do any targeted advertising or anything similar. A list of IP addresses is about the least useful thing to log if you want to track people.
- bartvk 6y ago
  C'mon, read the guidelines, linked at the bottom of every page. "Casual dismissal" is right there.
labawi 6y ago
If firefox is installed from a system package, or installed by another user, it can't really update itself¹, and updates are not legitimately necessary. ¹ except of course any updates and binaries that firefox downloads and gobbles up behind the users back.
- easton 6y ago
  If Firefox is installed by another user (or even by yourself) on Windows, the Mozilla Maintenance Service is installed to automatically update Firefox without requiring you to personally elevate the installer. I'd argue updates are legitimately necessary for 99% of users (automatic updates are a huge reason why 90% of home PCs aren't in a botnet, and were a big reason why Chrome more secure in the old days vs IE/Firefox), and if you want to disable them it's very easy to do (about:config -> app.update.auto = false). But I don't know why you would, if the browser is changing too much for you you can change to ESR which is security updates only to older versions of Firefox. https://wiki.mozilla.org/Windows_Service_Silent_Update https://wiki.mozilla.org/Windows_Service_Silent_Update
  - labawi 6y ago
    I'm on linux. Yes, automatic updates are pretty much necessary for about 90-99+% of users, but many lot of them are using system packages (which again, should not be able to update isself), and it is still not a reason why there shouldn't be a way to disable random background connections. One could argue a silent browser is legitimately necessary for security research/operations, or just severely data-constrained networks, but I have yet to find a way to make firefox quiet. Will app.update.auto disable all updates (browser, search engines, safe-browsing, user-test, blacklists.. there was at least a dozen features)? Last time I tried disabling almost everything suspicious, yet firefox wouldn't respect half of the settings.
- pornel 6y ago
  Linux distros don't handle all of the updates, such as add-ons or tracking protection blacklists. Having an option to disable them would be a footgun. Such "radio silence" serves no useful purpose to normal users, but can make the browser appear buggy, e.g. if tracking protection broke a site, and you wouldn't get a fixed blacklist in a timely manner. Someone has to host these dynamic components, and the browser has to get them somehow. IMHO it's way better if they're fetched straight from Mozilla that has strong privacy policy and a good reputation to uphold, rather than from some rando free distro mirror.

kaba0 6y ago

Come on, you guys are in every thread nitpicking tiny tiny things like this, while the alternative is literally incomparably worse, and the only thing you achieve by this is making firefox’s case harder for those who don’t look up your ridiculous claims... First of all, all of these things can be turned off; second, checking if you are using an outdated, potentially insecure browser is essential - if there is a vulnerability, the least of your problem will be that one goddamn ping to a mozilla domain...

user3939382 6y ago
> First of all, all of these things can be turned off; They cannot. Reporting off, telemetry off, automatic updates off, every related setting in about:config off -- Firefox still transacts data with not one but several Mozilla domains upon launching. Mozilla can't ethically constantly talk about privacy out of one side of its mouth while collecting data that can be used to track users who have explicitly requested them not to do that out of the other side.
- kaba0 6y ago
  Then feel free to look it up in the source code, or even patch it.
  - user3939382 6y ago
    If I could afford the time to learn Rust, the frameworks used by Firefox, the associated toolchain, and the Firefox codebase, and the time to maintain a fork, I would love to do that.
- franga2000 6y ago
  > Mozilla can't ethically constantly talk about privacy out of one side of its mouth while collecting data that can be used to track users who have explicitly requested them not to do that out of the other side. 1. They can if they're an order of magnitude better than everyone else, just like electric car makers can talk about being environmentally friendly despite the fact lithium isn't renewable 2. Are you sure it's tracking? What data is actually sent? Crash reports, update checks, network tests, motd fetching, cache preloading... don't count as "tracking users". Hell, even reporting on statistics (version, OS, platform, region...) isn't actually tracking users, but FF lets you disable that regardless because they know some people don't like it.

juloo 6y ago

These requests are used to detect WIFI portals.

account42 6y ago
Which many computers never encounter. No excuse to have that on by default.
user3939382 6y ago
That's one out of about 6 or 7, which is clear from the request path

sergeykish 6y ago

Why don't you check what it sends instead of shooting "tracking data"?