5 ms·

It's a big leap from "makes a request" to "provides tracking data". One doesn't necessary mean the other. It's even bigger leap to say that it's done in violati

by pornel 6y ago

It's a big leap from "makes a request" to "provides tracking data". One doesn't necessary mean the other. It's even bigger leap to say that it's done in violation of stated privacy policies. For example, requests for software update have to go to Mozilla, but don't have any personal information, and are legitimately necessary.

psychoslave 6y ago
Well, shouldn’t the user decide what is legitimate to take out of its behavior? It might be done without bad intentions, but do Mozilla ask consent before asking their users data about when they are using Firefox, and so that they are (possibly) in front of their screen.
- sergeykish 6y ago
  Well, shouldn't browser be safe by default? Consent only required for personal data. Absence of visible settings suggests those who trade browser silence for safety is a minority, not target audience. It is open source, you can make own build.
inetknght 6y ago
> It's a big leap from "makes a request" to "provides tracking data" No it isn't.
- franga2000 6y ago
  Care to elaborate?
  - inetknght 6y ago
    1) make a network request 2) track IP address
    - franga2000 6y ago
      They've said many times they don't log IP addresses so if they do, it's definitely illegal. So let's look at the risk vs reward of that situation: Risk: very high because they rely on user trust to survive and they could get sued into oblivion under the GDPR. Reward: they now have a list of IP addresses with Firefox users behind them. Any big website has that so it's not valuable to third parties and it's not valuable to Mozilla because they don't do any targeted advertising or anything similar. A list of IP addresses is about the least useful thing to log if you want to track people.
- bartvk 6y ago
  C'mon, read the guidelines, linked at the bottom of every page. "Casual dismissal" is right there.
labawi 6y ago
If firefox is installed from a system package, or installed by another user, it can't really update itself¹, and updates are not legitimately necessary. ¹ except of course any updates and binaries that firefox downloads and gobbles up behind the users back.
- easton 6y ago
  If Firefox is installed by another user (or even by yourself) on Windows, the Mozilla Maintenance Service is installed to automatically update Firefox without requiring you to personally elevate the installer. I'd argue updates are legitimately necessary for 99% of users (automatic updates are a huge reason why 90% of home PCs aren't in a botnet, and were a big reason why Chrome more secure in the old days vs IE/Firefox), and if you want to disable them it's very easy to do (about:config -> app.update.auto = false). But I don't know why you would, if the browser is changing too much for you you can change to ESR which is security updates only to older versions of Firefox. https://wiki.mozilla.org/Windows_Service_Silent_Update https://wiki.mozilla.org/Windows_Service_Silent_Update
  - labawi 6y ago
    I'm on linux. Yes, automatic updates are pretty much necessary for about 90-99+% of users, but many lot of them are using system packages (which again, should not be able to update isself), and it is still not a reason why there shouldn't be a way to disable random background connections. One could argue a silent browser is legitimately necessary for security research/operations, or just severely data-constrained networks, but I have yet to find a way to make firefox quiet. Will app.update.auto disable all updates (browser, search engines, safe-browsing, user-test, blacklists.. there was at least a dozen features)? Last time I tried disabling almost everything suspicious, yet firefox wouldn't respect half of the settings.
- pornel 6y ago
  Linux distros don't handle all of the updates, such as add-ons or tracking protection blacklists. Having an option to disable them would be a footgun. Such "radio silence" serves no useful purpose to normal users, but can make the browser appear buggy, e.g. if tracking protection broke a site, and you wouldn't get a fixed blacklist in a timely manner. Someone has to host these dynamic components, and the browser has to get them somehow. IMHO it's way better if they're fetched straight from Mozilla that has strong privacy policy and a good reputation to uphold, rather than from some rando free distro mirror.

by pornel 6y ago

psychoslave 6y ago

Well, shouldn’t the user decide what is legitimate to take out of its behavior? It might be done without bad intentions, but do Mozilla ask consent before asking their users data about when they are using Firefox, and so that they are (possibly) in front of their screen.

sergeykish 6y ago
Well, shouldn't browser be safe by default? Consent only required for personal data. Absence of visible settings suggests those who trade browser silence for safety is a minority, not target audience. It is open source, you can make own build.

inetknght 6y ago

> It's a big leap from "makes a request" to "provides tracking data" No it isn't.

franga2000 6y ago
Care to elaborate?
- inetknght 6y ago
  1) make a network request 2) track IP address
  - franga2000 6y ago
    They've said many times they don't log IP addresses so if they do, it's definitely illegal. So let's look at the risk vs reward of that situation: Risk: very high because they rely on user trust to survive and they could get sued into oblivion under the GDPR. Reward: they now have a list of IP addresses with Firefox users behind them. Any big website has that so it's not valuable to third parties and it's not valuable to Mozilla because they don't do any targeted advertising or anything similar. A list of IP addresses is about the least useful thing to log if you want to track people.
bartvk 6y ago
C'mon, read the guidelines, linked at the bottom of every page. "Casual dismissal" is right there.

labawi 6y ago

If firefox is installed from a system package, or installed by another user, it can't really update itself¹, and updates are not legitimately necessary. ¹ except of course any updates and binaries that firefox downloads and gobbles up behind the users back.

easton 6y ago
If Firefox is installed by another user (or even by yourself) on Windows, the Mozilla Maintenance Service is installed to automatically update Firefox without requiring you to personally elevate the installer. I'd argue updates are legitimately necessary for 99% of users (automatic updates are a huge reason why 90% of home PCs aren't in a botnet, and were a big reason why Chrome more secure in the old days vs IE/Firefox), and if you want to disable them it's very easy to do (about:config -> app.update.auto = false). But I don't know why you would, if the browser is changing too much for you you can change to ESR which is security updates only to older versions of Firefox. https://wiki.mozilla.org/Windows_Service_Silent_Update https://wiki.mozilla.org/Windows_Service_Silent_Update
- labawi 6y ago
  I'm on linux. Yes, automatic updates are pretty much necessary for about 90-99+% of users, but many lot of them are using system packages (which again, should not be able to update isself), and it is still not a reason why there shouldn't be a way to disable random background connections. One could argue a silent browser is legitimately necessary for security research/operations, or just severely data-constrained networks, but I have yet to find a way to make firefox quiet. Will app.update.auto disable all updates (browser, search engines, safe-browsing, user-test, blacklists.. there was at least a dozen features)? Last time I tried disabling almost everything suspicious, yet firefox wouldn't respect half of the settings.
pornel 6y ago
Linux distros don't handle all of the updates, such as add-ons or tracking protection blacklists. Having an option to disable them would be a footgun. Such "radio silence" serves no useful purpose to normal users, but can make the browser appear buggy, e.g. if tracking protection broke a site, and you wouldn't get a fixed blacklist in a timely manner. Someone has to host these dynamic components, and the browser has to get them somehow. IMHO it's way better if they're fetched straight from Mozilla that has strong privacy policy and a good reputation to uphold, rather than from some rando free distro mirror.