38 ms·

Firefox replaces Google Analytics with fake no-op in strict tracking protection

648 points by crazypython 6y ago

HenryBemis 6y ago
> to prevent websites from breaking Nope, nothing will break. I am blocking GA in the following ways: NoScript, PrivacyBadger, Windows HOSTS file. I see the thing being called, and nothing gets through, and websites work properly. Edit: the bugzilla article mentions both GA and googletagmanager.com, which (both) I have been successfully blocking in the above ways for many years. I never had any website not working because of those two pieces.
- fotta 6y ago
  I mean the Bugzilla literally has an example of a website that breaks.
  - HenryBemis 6y ago
    /rant Someone built the unsubscribe mechanism in a way so that they FORCE the user to be tracked by GA. That someone is... Xfinity? By Comcast? Hahahaha!! One.Website. So we should yield to those **(profanity)? That one website does not deserve our respect. Comcast: https://www.geekwire.com/2019/comcast-fined-9-1m-consumer-protection-violations-high-profile-washington-state-case/ https://www.geekwire.com/2019/comcast-fined-9-1m-consumer-pr... Edit: "we are scum. We want to ** your privacy any way we can. We just got hit with a multi-million fine, so we will continue. You want to unsubscribe? Sure, be tracked a bit more while at it." /end-rant
- postalrat 6y ago
  What are you saying? Firefox should stop doing this because no sites have broke for you when blocking the script?
- gruez 6y ago
  counter-anecdote: I encountered multiple sites that break because of blocked scripts. and this is with ublock origin, which has shims for common analytics scripts: https://github.com/gorhill/uBlock/wiki/Resources-Library#url-specific-sanitized-redirect-resources-surrogates https://github.com/gorhill/uBlock/wiki/Resources-Library#url...
- kawsper 6y ago
  Only anecdotal, and no longer happening: The top menu on https://www.easyjet.com/en/ https://www.easyjet.com/en/ used to break if you disabled Google Analytics, the submenu just wouldn't appear.
bifrost 6y ago
OMG I love this.
alisonkisk 6y ago
Is there a Mozilla source for this Mozilla news, not just Twitter?
- jefftk 6y ago
  The tweet links to https://bugzilla.mozilla.org/show_bug.cgi?id=1493602 https://bugzilla.mozilla.org/show_bug.cgi?id=1493602, which is a Mozilla source
  - jakub_g 6y ago
    And source code helpfully found by some other commenters: https://github.com/mozilla/gecko-dev/tree/master/browser/extensions/webcompat/shims https://github.com/mozilla/gecko-dev/tree/master/browser/ext...
- deleted 6y ago
  [deleted]
kevin_thibedeau 6y ago
They need to do the same for tag manager. That's the real poison pill.
- gruez 6y ago
  How would that work? You'd still need to make a request to figure out what scripts to add.
- minsc__and__boo 6y ago
  Tag manager loads more than just tracking scripts.
  - waheoo 6y ago
    Yes, thats their point, its the thing that loads all the fucking ads. Please don't suggest it loads other meaningful things. May as well claim torrenting is used for downloading Linux isos so its not a piracy problem.
    - lambda_obrien 6y ago
      Well, i personally always use the torrent when i download an iso... But I also have gtm black holed.
    - harry8 6y ago
      >May as well claim torrenting is used for downloading Linux isos so its not a piracy problem. May as well claim the internet is used for something other than piracy so it's not a piracy problem. See how silly that is?
      - waheoo 6y ago
        No because you're using the reverse of my example to make my example look silly but infact you just prove my point. May as well claim it's silly to not try to prove negatives.
Brian_K_White 6y ago
I love this. It's whack-a-mole, but better whack-a-mole to learn-to-love-the-mole. Another way to think of it besides the futility of whack-a-mole is, it's pushback, resistance, sand in the gears. It's making an undesired behavior less valuable. Yes you didn't stop sites from including analytics, yes tomorrow google will have some counter move, but that doesn't mean the effort was pointless. If you can exert a 5% pressure on some system and maybe only get a 5% reaction, that's perfectly fine.
- lhorie 6y ago
  What's really clever is that at the scale that GA is deployed, it's really really hard for Google to willy-nilly break API just to get around this because a lot of webmasters will simply not bother updating their scripts, and if Google forcefully pushes a breaking change, people might stop using GA, or worse, they get an avalanche of bad PR for breaking half the web.
  - elemos 6y ago
    I don’t think this is true. GA has at least 2 versions it doesnt support in the past decade. I imagine the opposite is true, in that they hold so much power they can do as they please.
    - lhorie 6y ago
      My understanding is they are veeery careful around rolling out changes and deprecations. The cleverness is that there's a huge asymmetry in how fast Firefox can globally deploy updated shims vs how fast Google can change GA API.
- cosmie 6y ago
  They already have a counter move, to an extent. One of the deployment models for GA is via Google Tag Manager. One of the deployment models for GTM is this[1] server-side mode deployed to an App Engine container in Google Cloud. The only browser-visible communication happens between your browser and the App Engine instance, and then you send server side calls from that to the downstream systems based on those events (GA, Facebook Conversion API, etc). It can also be used like the traditional GTM model, where it loads the primary GTM script browser-side, then that loads additional browser-side scripts based on the tags you implement (GA, Facebook, chat systems, map widgets, whatever). But the default GA support built into it avoids loading anything from Google's domains directly by the browser. And it's not even subject to the CNAME cloaking protections[2] that ITP have implemented, since it's not using the "CNAME to third party" technique that's typically common for these sorts of things to get first party access/privileges and is instead actually running on your infrastructure. [1] https://developers.google.com/tag-manager/serverside https://developers.google.com/tag-manager/serverside [2] https://webkit.org/blog/11338/cname-cloaking-and-bounce-tracking-defense/ https://webkit.org/blog/11338/cname-cloaking-and-bounce-trac...
amelius 6y ago
"Please disable your analytics blocker to view the content on this page"
- artificial 6y ago
  Sure! visits page through archive.is
  - account42 6y ago
    Annoyingly enough, archiv.is itself will present you with a buttflare CAPTCHA if you don't feed it enough tracking information.
    - artificial 6y ago
      Hmm, I'll take buttflare over Google. All roads lead to butt.
ketamine__ 6y ago
Doesn't Firefox get all its money from Google?
- sanxiyn 6y ago
  Yes, but Google is buying service from Firefox, Google is not donating to Firefox.
  - edoceo 6y ago
    Hm, the line between Foundation and Corporation is getting blurry from here
    - sp332 6y ago
      If only. Somehow there is no way for users to actually fund development of the browser.
  - dkarras 6y ago
    Google can afford not buying that service though. Can Mozilla afford Google not being their customer? I genuinely don't know.
    - Tijdreiziger 6y ago
      Given that the default search engine in Firefox was Yahoo for a year or so when Google decided not to pay... sure, why not?
      - exhilaration 6y ago
        I'm sure Microsoft would be happy to pay for Bing to be the default in Firefox.
    - SilasX 6y ago
      They could have, if they focused on their core mission the whole time and invested the excess in an endowment that made them independent of corporate donations.
newscracker 6y ago
If only Google Chrome would adopt this too! Sarcasm aside, sites breaking or not working when analytics scripts are blocked is nuts. Is there a Wall of Shame for such sites (it may probably be the size of a search engine index)?
- gruez 6y ago
  FWIW it's usually not malicious. What usually happens is that the analytics script provides some API for the developers to add additional logging functionality[1]. The developer then sprinkles calls to those APIs throughout their code, assuming that those functions will be available. If the scripts are blocked then you get an error like "ga is not defined" and the rest of the code doesn't execute, causing the page to be broken. [1] https://developers.google.com/analytics/devguides/collection/analyticsjs/sending-hits https://developers.google.com/analytics/devguides/collection...
  - sanxiyn 6y ago
    Not malicious but sloppy.
    - Spivak 6y ago
      I mean kinda. I wouldn’t bother to check if jQuery was defined if I explicitly included it in a script tag.
      - edoceo 6y ago
        But, we, as web-devs, know, KNOW, that blockers a) exist and b) are used by clients. It's like missing a test case that covers 15% of your user base.
        jameshart 6y ago
        Is it 15%? I have no idea. They don't show up in my analytics...
sanxiyn 6y ago
What a great idea.
pid_0 6y ago
And then every website starts doing the CNAME nonsense.
- falcolas 6y ago
  If it’s only a CNAME, you’re one DNS lookup away from continuing to block it. One DNS lookup you’re doing anyways.
  - tick_tock_tick 6y ago
    It's random CNAMEs and they use the unique cname you queried as another tracking point.
- WalterGR 6y ago
  I didn’t know what you meant, so for others equally confused, this is a decent article: https://www.theregister.com/2021/02/24/dns_cname_tracking/ https://www.theregister.com/2021/02/24/dns_cname_tracking/
  - bpodgursky 6y ago
    I don't understand the hate for this trick. It still breaks cross-site user tracking. It's just sort of a hack around installing a hypothetical Google Analytics app on-prem or pumping in data via a server-to-server integration. Google Analytics can't cross-reference data from other sites on the browser, b/c it's not a third party cookie now... what's the problem?
  - Nemo_bis 6y ago
    Work is ongoing on that front too: ttps://webkit.org/blog/8146/protecting-against-hsts-abuse/
liquidify 6y ago
That is just lovely.
SMAAART 6y ago
LOL, this is beautiful!
Zren 6y ago
Code that logged the message: https://github.com/mozilla/gecko-dev/blob/master/browser/extensions/webcompat/lib/shims.js#L391 https://github.com/mozilla/gecko-dev/blob/master/browser/ext... The GA specific shim: https://github.com/mozilla/gecko-dev/blob/master/browser/extensions/webcompat/shims/google-analytics.js https://github.com/mozilla/gecko-dev/blob/master/browser/ext...
- lhorie 6y ago
  Oh interesting, they also have shims for google analytics tag manager[0], facebook SDK[1] as well as a bunch of other things. [0] https://github.com/mozilla/gecko-dev/blob/master/browser/extensions/webcompat/shims/google-analytics-tag-manager.js https://github.com/mozilla/gecko-dev/blob/master/browser/ext... [1] https://github.com/mozilla/gecko-dev/blob/master/browser/extensions/webcompat/shims/facebook-sdk.js https://github.com/mozilla/gecko-dev/blob/master/browser/ext...
  - collinmanderson 6y ago
    Here's how they're pattern-matched: https://github.com/mozilla/gecko-dev/blob/master/browser/extensions/webcompat/data/shims.js https://github.com/mozilla/gecko-dev/blob/master/browser/ext...
harry8 6y ago
How do I effectively opt out of google tracking me?
- occz 6y ago
  I don't know that you can, entirely, but installing uBlock Origin and adding a DNS-level adblocker is a good start.
- hansel_der 6y ago
  the current state of evasion is somewhat precarious and requires a lot of knowledge and continuous manual work to reduce the tracking from big tech. you have to keep a safe distance from computers/smartphones in order to effectively avoid it.
- npteljes 6y ago
  Lots of moles to whack. You can try using a non-chromium browser, decked out with privacy addons like uBo, Decentraleyes, Temporary Containers, Privacy Settings. If you'd like a chromium browser, Iridium Browser could work. Also if you have an Android phone, you could try to install LineageOS without gapps, or go with /e/. If you use Drive, Sheets etc, you could try ONLYOFFICE. They use GA, but your decked out Firefox should already block that. For more alternatives, there are different resources that try to be helpful, like this one: https://degooglisons-internet.org/en/ https://degooglisons-internet.org/en/
deleted 6y ago
[deleted]
wtallis 6y ago
NoScript implemented this over a decade ago, as part of its surrogate scripts feature: https://hackademix.net/2009/01/25/surrogate-scripts-vs-google-analytics/ https://hackademix.net/2009/01/25/surrogate-scripts-vs-googl... This was one of my favorite examples of how there was much more to NoScript than most people assumed, and it had a depth of features that could not be matched by "alternatives" like uMatrix. But that feature was killed by the mass extension breakage in Firefox 57: https://github.com/hackademix/noscript/issues/133#issuecomment-593150495 https://github.com/hackademix/noscript/issues/133#issuecomme... So in a way, this feature can be seen as more than three years overdue.
- crazypython 6y ago
  I thought NoScript was a single-purpose extension for disabling scripts. Naming and messaging matters, I guess. "JSControl" would've been a better name.
  - wtallis 6y ago
    The full name as shown on addons.mozilla.org is "NoScript Security Suite", which more accurately conveys its purpose. Some of the features it provided really had nothing to do with JavaScript, such as NoScript's implementation of Strict Transport Security about 1.5 years before Firefox itself implemented that feature.
    - z77dj3kl 6y ago
      > "NoScript Security Suite", which more accurately conveys its purpose. No, that just makes the name more confusing!
    - dividedbyzero 6y ago
      Still sounds like a JavaScript blocker, that doesn't clarify anything for me. I've never even looked at it as I've somehow associated it with "block all Javascript", seems like I missed out.
      - 6y ago
azhenley 6y ago
What should I use in replace of Google Analytics for basic web traffic analytics?
- anthony514 6y ago
  Matomo https://matomo.org/ https://matomo.org/
  - sgtfrankieboy 6y ago
    The only real free alternative to Google Analytics tbh.
- ssddanbrown 6y ago
  I've been using plausible (https://plausible.io/ https://plausible.io/) recently and I've been really happy with it. I've written about the move from GA to plausible, for my use-case, here: https://www.bookstackapp.com/blog/replacing-ga-and-mailchimp/ https://www.bookstackapp.com/blog/replacing-ga-and-mailchimp...
  - azhenley 6y ago
    I switched! Thank you.
- tristor 6y ago
  GoatCounter[1] or Plausible[2] [1]: https://www.goatcounter.com/ https://www.goatcounter.com/ [2]: https://plausible.io/ https://plausible.io/
- cemerick 6y ago
  Zoho's Pagesense is great: https://www.zoho.com/pagesense/ https://www.zoho.com/pagesense/
  - azhenley 6y ago
    Wow, that is expensive! $16 a month for analytics.
deleted 6y ago
[deleted]
userbinator 6y ago
I have mixed feelings about this. From the privacy angle I am pleased (I've been blocking GA ever since I knew it existed, via HOSTS), but from the "neutral browser" angle, not so much. Then again, FF is already not neutral with things like "safe browsing" and extension blacklists...
- pseudalopex 6y ago
  You can turn it off.
- stjohnswarts 6y ago
  It's not on by default. It's in the "strict settings" not the "standard settings" so it's opt in.
- Nicksil 6y ago
  Browsers aren't supposed to be neutral. Browsers are the user's agent; they're supposed to serve the user and nothing else.
  - symlinkk 6y ago
    Yeah somehow I think you would have a different opinion if Chrome offered users a performance boost only on Google owned websites.
    - wtallis 6y ago
      If Chrome didn't allow the user to configure that same performance boost to work on other websites, then Chrome would be failing to operate as a user agent.
    - jannes 6y ago
      They literally did that already when they came up with QUIC (before it was public). They had private implementations only supported by Google webservers and Chrome.
    - Nemo_bis 6y ago
paulie_a 6y ago
Why isn't there more effort to subvert tracking vs trying to block it. Ruin the data and they can collect as much as they want
- juiyout 6y ago
  There is a Chrome extension named Ad Nauseam. Was arguably but ultimately blocked by Google extension store. I still manually install and use it.
beervirus 6y ago
Fantastic. There is no excuse for using Chrome nowadays.
- mippenhappen 6y ago
  Thankfully we don't need an excuse.
crazygringo 6y ago
I'm confused. I thought Google Analytics tracked you within a site, and that it's fundamentally not really any different from analyzing server logs except the logs are simply hosted in Google's cloud and visualized using Google's tools. I realize it uses cookies but that's to build analytics around sequences of user actions, since many users can be collapsed into a single IP. Privately hosted analytics software needs to use cookies to achieve the same thing as well. Google Analytics doesn't have anything to do with building an advertising profile around users, correct? I know it's popular to hate on Google but does this achieve anything against tracking users across sites in order to build advertising profiles? I was under the impression all the profile-building people object to was done via the pages with ads themselves. Is Google Analytics actually an evil tool? Or is just "evil by association" because Google ads track users across sites, and Google Analytics also does "tracking" albeit a different kind? I'm just wondering if this is actually anything substantive, or if it's more symbolic. Edit: wow those were some FAST downvotes. I'm just asking some basic questions to understand how meaningful this is, folks. Hopefully nobody's taking offense.
- GrayShade 6y ago
  Google Analytics tracks you across different sites AFAIK. Mozilla supposedly has a special option in GA to not correlate data gathered on their sites with what GA gathers on others. Even if it didn't, it still tells Google what you're visiting: with so many sites using it, they can get a pretty much complete view of your browsing history, just like Google Fonts.
  - crazygringo 6y ago
    > Google Analytics tracks you across different sites AFAIK. See that's the thing, I keep seeing this asserted but when I search for any evidence, I can't find a single article that demonstrates this to be true. If you own multiple sites you can enable analytics across them, but that's all. And if Google wants to know what you're visiting to build advertising profiles, they have so many options -- not just Fonts, but DNS, Chrome, ads... it's not like GA by itself is making any substantive difference. But again, just because it could be used for this doesn't mean it is. So I don't get how this is actually helping. I worry it's a distraction from actual achievements.
lsh123 6y ago
I like ads tracking as much as the next guy. However, I am not comfortable with a browser modifying content in any way. I am fine to have extensions that do that, but the browser itself shouldn’t do it “by default” without user explicitly enabling it.
- stjohnswarts 6y ago
  It's not on by default, you have to turn it off by going from "standard" to "strict" settings so there's not really anything to complain about.
jve 6y ago
Won't Firefox shoot themselves in the foot here? I mean devs will see that Firefox market share is way lower due to this than it is actually true. And will stop bothering about FF? Ir am I misunderstanding about what this feature does?
- unglaublich 6y ago
  This feature only applies if you are already blocking GA with Firefox. The change is that now the GA JS API will stay available for the website so that it can keep calling GA functions. The stub won't actually send any info to Google though.
zaphirplane 6y ago
Talk about bitting the hand that feeds you Power to the people
axelfontaine 6y ago
Firefox should really double down on this. All this strict privacy protection could be branded as Firefox Pro and they could charge for it. This would make for a nice revenue stream as more and more people begin to see the value of this. If Hey can do it for email, Firefox Pro Can do it for browsers!
- probably_wrong 6y ago
  Counterpoint: this would destroy Firefox' credibility. I use Firefox because of their strong pro-privacy stance. If they started charging for "real" privacy, it would damage that image - "privacy for those who can afford it" would be a bad slogan. Also, Firefox has made it clear that they don't want our money, as seen in their continuous refusal to accept donations.
guerrilla 6y ago
Being that Google funds Firefox, how long can this kind of thing last?
panta82 6y ago
I don't mind blocking ads, but analytics? That seems like the taking the desire for privacy too far. Why shouldn't site owner know you've visited their site? How will they do their job if they don't know where people come from, what content they enjoy, what devices they should optimized for, general demographic of their audience, etc. These are all the things a restourant owner would know about their customers, for example. But no one seems to have a problem with that.
- jerrre 6y ago
  Perhaps I'm old fashioned but I would not expect a restaurant owner to track where I come from, my demographics etc?
  - jannes 6y ago
    They wouldn’t have to “track” it scientifically in a database. They would just know implicitly by observing their customers who are right in front of their eyes. (At least pre-covid)
    - Vhano 6y ago
      would they know which car I drive from looking at me?
  - izacus 6y ago
    Restaurant owners do exactly that - just by looking at you sitting in there (and other customers).
    - Vhano 6y ago
      not my underwear colour, type, size. What they see is what I offer to show
- cmod 6y ago
  Less about stopping analytics and more about stopping privacy-malicious analytics (which google analytics could arguably be defined as). Install a privacy friendly analytics package and I suspect it won’t be much blocked.
ashneo76 6y ago
This perfect. I don't have all the storess following me around and where I came from, what my tendencies are etc. They also forget about me, generally when I leave the store. This tracking is not okay and nobody, absolutely nobody, gets to decide for me. Google doesn't own the internet
nindalf 6y ago
People use analytics to decide where to focus there efforts. For example, if most of your users are on mobile, invest more in the mobile experience. The unintended consequence of this change is people looking at which browsers are hitting their website, finding that it’s mostly Chrome and therefore testing only with Chrome. This would degrade the experience for Firefox users as subtle breakages start appearing. Folks advocating for the use of hosted analytics instead of GA are correct ... but that’s not what most people will do. It’s just simpler to add a one line GA tracker to your code and call it a day. And these people will see Firefox usage drop to 0. We have already seen “this site works best/only on Chrome”, especially on Google products like Inbox. Expect to see more of that as the web becomes a Chromium/Safari duopoly, according to analytics.
- onion2k 6y ago
  The unintended consequence of this change is people looking at which browsers are hitting their website, finding that it’s mostly Chrome and therefore testing only with Chrome. Bad developers already only test in Chrome regardless of what GA is telling them. This won't have much impact there.
  - nindalf 6y ago
    It’s harder for good developers to justify effort if it seems like that effort has no impact.
- elric 6y ago
  You don't need Google Analytics to figure out what browser your audience is using. That information is literally embedded in every single request to your website. There's no need to siphon requests over to Google for something so trivial. I get that people would like you know as much as possible about who visits their website. Sometimes even for legitimate reasons and not just out of an obsession with collection as much data as possible. But this analytics madness has gone too far. Pretty much every website you visit ships a bunch of data about you to multiple third parties. Often without consent. Just stop doing that. It's not a hard thing to do.
tinus_hn 6y ago
Next weeks stats are in, Firefox’s market share has dropped 50%!
currysausage 6y ago
Maybe a dumb question: Why isn't it enough to simply block the Analytics JS, why is it necessary to substitute it with a "fake no-op" script? Does blocking GA regularly break sites?
- rsstack 6y ago
  Yes. Many sites assume that GA is there, and for example clicks on buttons may fail to work if the GA click call fails. It isn't great engineering from the site but Firefox wants its users to still be able to browse the web.
- XCSme 6y ago
  One use case I noticed: Don't render the site until Google Tag Manager is loaded. Because of this, when using an adblocker that blocks GTM, the site will never load. I guess the reason to block GTM until load it use it show some personalized ads/pricing/buttons.
eternalny1 6y ago
I've been using Firefox since the Phoenix/Firebird days, and I fear the day that Google ends their search funding to the project. They are absolutely on the right track with Mozilla improving the actual -browser- with all of these new privacy features and core improvements. This could put them in a position to create a revenue stream independent of Google, where people would actually be willing to pay to have a browser wholly decoupled from these ad companies.
- jakub_g 6y ago
  There's some risk there indeed, but there would be also big anti-monopoly scrutiny risk from Google's side doing that if they indirectly kill alternative browsers. Right now there's some kind of equilibrium by having alternative browsers/engines, on Windows especially, plus Google still gets traffic from millions of Firefox users by being default search engine, which makes them $$$.
- account42 6y ago
  > I fear the day that Google ends their search funding to the project I look forward to that day - until then, all decisions Mozilla makes are impacted by that fear.
pgcj_poster 6y ago
Have they replaced the Google Analytics on the add-ons site with this yet?

648 points by crazypython 6y ago

> to prevent websites from breaking Nope, nothing will break. I am blocking GA in the following ways: NoScript, PrivacyBadger, Windows HOSTS file. I see the thing being called, and nothing gets through, and websites work properly. Edit: the bugzilla article mentions both GA and googletagmanager.com, which (both) I have been successfully blocking in the above ways for many years. I never had any website not working because of those two pieces.

fotta 6y ago
I mean the Bugzilla literally has an example of a website that breaks.
- HenryBemis 6y ago
  /rant Someone built the unsubscribe mechanism in a way so that they FORCE the user to be tracked by GA. That someone is... Xfinity? By Comcast? Hahahaha!! One.Website. So we should yield to those **(profanity)? That one website does not deserve our respect. Comcast: https://www.geekwire.com/2019/comcast-fined-9-1m-consumer-protection-violations-high-profile-washington-state-case/ https://www.geekwire.com/2019/comcast-fined-9-1m-consumer-pr... Edit: "we are scum. We want to ** your privacy any way we can. We just got hit with a multi-million fine, so we will continue. You want to unsubscribe? Sure, be tracked a bit more while at it." /end-rant
postalrat 6y ago
What are you saying? Firefox should stop doing this because no sites have broke for you when blocking the script?
gruez 6y ago
counter-anecdote: I encountered multiple sites that break because of blocked scripts. and this is with ublock origin, which has shims for common analytics scripts: https://github.com/gorhill/uBlock/wiki/Resources-Library#url-specific-sanitized-redirect-resources-surrogates https://github.com/gorhill/uBlock/wiki/Resources-Library#url...
kawsper 6y ago
Only anecdotal, and no longer happening: The top menu on https://www.easyjet.com/en/ https://www.easyjet.com/en/ used to break if you disabled Google Analytics, the submenu just wouldn't appear.

bifrost 6y ago

OMG I love this.

alisonkisk 6y ago

Is there a Mozilla source for this Mozilla news, not just Twitter?

jefftk 6y ago
The tweet links to https://bugzilla.mozilla.org/show_bug.cgi?id=1493602 https://bugzilla.mozilla.org/show_bug.cgi?id=1493602, which is a Mozilla source
- jakub_g 6y ago
  And source code helpfully found by some other commenters: https://github.com/mozilla/gecko-dev/tree/master/browser/extensions/webcompat/shims https://github.com/mozilla/gecko-dev/tree/master/browser/ext...
deleted 6y ago
[deleted]

kevin_thibedeau 6y ago

They need to do the same for tag manager. That's the real poison pill.

gruez 6y ago
How would that work? You'd still need to make a request to figure out what scripts to add.
minsc__and__boo 6y ago
Tag manager loads more than just tracking scripts.
- waheoo 6y ago
  Yes, thats their point, its the thing that loads all the fucking ads. Please don't suggest it loads other meaningful things. May as well claim torrenting is used for downloading Linux isos so its not a piracy problem.
  - lambda_obrien 6y ago
    Well, i personally always use the torrent when i download an iso... But I also have gtm black holed.
  - harry8 6y ago
    >May as well claim torrenting is used for downloading Linux isos so its not a piracy problem. May as well claim the internet is used for something other than piracy so it's not a piracy problem. See how silly that is?
    - waheoo 6y ago
      No because you're using the reverse of my example to make my example look silly but infact you just prove my point. May as well claim it's silly to not try to prove negatives.

Brian_K_White 6y ago

I love this. It's whack-a-mole, but better whack-a-mole to learn-to-love-the-mole. Another way to think of it besides the futility of whack-a-mole is, it's pushback, resistance, sand in the gears. It's making an undesired behavior less valuable. Yes you didn't stop sites from including analytics, yes tomorrow google will have some counter move, but that doesn't mean the effort was pointless. If you can exert a 5% pressure on some system and maybe only get a 5% reaction, that's perfectly fine.

lhorie 6y ago
What's really clever is that at the scale that GA is deployed, it's really really hard for Google to willy-nilly break API just to get around this because a lot of webmasters will simply not bother updating their scripts, and if Google forcefully pushes a breaking change, people might stop using GA, or worse, they get an avalanche of bad PR for breaking half the web.
- elemos 6y ago
  I don’t think this is true. GA has at least 2 versions it doesnt support in the past decade. I imagine the opposite is true, in that they hold so much power they can do as they please.
  - lhorie 6y ago
    My understanding is they are veeery careful around rolling out changes and deprecations. The cleverness is that there's a huge asymmetry in how fast Firefox can globally deploy updated shims vs how fast Google can change GA API.
cosmie 6y ago
They already have a counter move, to an extent. One of the deployment models for GA is via Google Tag Manager. One of the deployment models for GTM is this[1] server-side mode deployed to an App Engine container in Google Cloud. The only browser-visible communication happens between your browser and the App Engine instance, and then you send server side calls from that to the downstream systems based on those events (GA, Facebook Conversion API, etc). It can also be used like the traditional GTM model, where it loads the primary GTM script browser-side, then that loads additional browser-side scripts based on the tags you implement (GA, Facebook, chat systems, map widgets, whatever). But the default GA support built into it avoids loading anything from Google's domains directly by the browser. And it's not even subject to the CNAME cloaking protections[2] that ITP have implemented, since it's not using the "CNAME to third party" technique that's typically common for these sorts of things to get first party access/privileges and is instead actually running on your infrastructure. [1] https://developers.google.com/tag-manager/serverside https://developers.google.com/tag-manager/serverside [2] https://webkit.org/blog/11338/cname-cloaking-and-bounce-tracking-defense/ https://webkit.org/blog/11338/cname-cloaking-and-bounce-trac...

amelius 6y ago

"Please disable your analytics blocker to view the content on this page"

artificial 6y ago
Sure! visits page through archive.is
- account42 6y ago
  Annoyingly enough, archiv.is itself will present you with a buttflare CAPTCHA if you don't feed it enough tracking information.
  - artificial 6y ago
    Hmm, I'll take buttflare over Google. All roads lead to butt.

ketamine__ 6y ago

Doesn't Firefox get all its money from Google?

sanxiyn 6y ago
Yes, but Google is buying service from Firefox, Google is not donating to Firefox.
- edoceo 6y ago
  Hm, the line between Foundation and Corporation is getting blurry from here
  - sp332 6y ago
    If only. Somehow there is no way for users to actually fund development of the browser.
- dkarras 6y ago
  Google can afford not buying that service though. Can Mozilla afford Google not being their customer? I genuinely don't know.
  - Tijdreiziger 6y ago
    Given that the default search engine in Firefox was Yahoo for a year or so when Google decided not to pay... sure, why not?
    - exhilaration 6y ago
      I'm sure Microsoft would be happy to pay for Bing to be the default in Firefox.
  - SilasX 6y ago
    They could have, if they focused on their core mission the whole time and invested the excess in an endowment that made them independent of corporate donations.

newscracker 6y ago

If only Google Chrome would adopt this too! Sarcasm aside, sites breaking or not working when analytics scripts are blocked is nuts. Is there a Wall of Shame for such sites (it may probably be the size of a search engine index)?

gruez 6y ago
FWIW it's usually not malicious. What usually happens is that the analytics script provides some API for the developers to add additional logging functionality[1]. The developer then sprinkles calls to those APIs throughout their code, assuming that those functions will be available. If the scripts are blocked then you get an error like "ga is not defined" and the rest of the code doesn't execute, causing the page to be broken. [1] https://developers.google.com/analytics/devguides/collection/analyticsjs/sending-hits https://developers.google.com/analytics/devguides/collection...
- sanxiyn 6y ago
  Not malicious but sloppy.
  - Spivak 6y ago
    I mean kinda. I wouldn’t bother to check if jQuery was defined if I explicitly included it in a script tag.
    - edoceo 6y ago
      But, we, as web-devs, know, KNOW, that blockers a) exist and b) are used by clients. It's like missing a test case that covers 15% of your user base.
      - jameshart 6y ago
        Is it 15%? I have no idea. They don't show up in my analytics...

sanxiyn 6y ago

What a great idea.

pid_0 6y ago

And then every website starts doing the CNAME nonsense.

falcolas 6y ago
If it’s only a CNAME, you’re one DNS lookup away from continuing to block it. One DNS lookup you’re doing anyways.
- tick_tock_tick 6y ago
  It's random CNAMEs and they use the unique cname you queried as another tracking point.
WalterGR 6y ago
I didn’t know what you meant, so for others equally confused, this is a decent article: https://www.theregister.com/2021/02/24/dns_cname_tracking/ https://www.theregister.com/2021/02/24/dns_cname_tracking/
- bpodgursky 6y ago
  I don't understand the hate for this trick. It still breaks cross-site user tracking. It's just sort of a hack around installing a hypothetical Google Analytics app on-prem or pumping in data via a server-to-server integration. Google Analytics can't cross-reference data from other sites on the browser, b/c it's not a third party cookie now... what's the problem?
- Nemo_bis 6y ago
  Work is ongoing on that front too: ttps://webkit.org/blog/8146/protecting-against-hsts-abuse/

liquidify 6y ago

That is just lovely.

SMAAART 6y ago

LOL, this is beautiful!

Zren 6y ago

Code that logged the message: https://github.com/mozilla/gecko-dev/blob/master/browser/extensions/webcompat/lib/shims.js#L391 https://github.com/mozilla/gecko-dev/blob/master/browser/ext... The GA specific shim: https://github.com/mozilla/gecko-dev/blob/master/browser/extensions/webcompat/shims/google-analytics.js https://github.com/mozilla/gecko-dev/blob/master/browser/ext...

lhorie 6y ago
Oh interesting, they also have shims for google analytics tag manager[0], facebook SDK[1] as well as a bunch of other things. [0] https://github.com/mozilla/gecko-dev/blob/master/browser/extensions/webcompat/shims/google-analytics-tag-manager.js https://github.com/mozilla/gecko-dev/blob/master/browser/ext... [1] https://github.com/mozilla/gecko-dev/blob/master/browser/extensions/webcompat/shims/facebook-sdk.js https://github.com/mozilla/gecko-dev/blob/master/browser/ext...
- collinmanderson 6y ago
  Here's how they're pattern-matched: https://github.com/mozilla/gecko-dev/blob/master/browser/extensions/webcompat/data/shims.js https://github.com/mozilla/gecko-dev/blob/master/browser/ext...

harry8 6y ago

How do I effectively opt out of google tracking me?

occz 6y ago
I don't know that you can, entirely, but installing uBlock Origin and adding a DNS-level adblocker is a good start.
hansel_der 6y ago
the current state of evasion is somewhat precarious and requires a lot of knowledge and continuous manual work to reduce the tracking from big tech. you have to keep a safe distance from computers/smartphones in order to effectively avoid it.
npteljes 6y ago
Lots of moles to whack. You can try using a non-chromium browser, decked out with privacy addons like uBo, Decentraleyes, Temporary Containers, Privacy Settings. If you'd like a chromium browser, Iridium Browser could work. Also if you have an Android phone, you could try to install LineageOS without gapps, or go with /e/. If you use Drive, Sheets etc, you could try ONLYOFFICE. They use GA, but your decked out Firefox should already block that. For more alternatives, there are different resources that try to be helpful, like this one: https://degooglisons-internet.org/en/ https://degooglisons-internet.org/en/

deleted 6y ago

[deleted]

wtallis 6y ago

NoScript implemented this over a decade ago, as part of its surrogate scripts feature: https://hackademix.net/2009/01/25/surrogate-scripts-vs-google-analytics/ https://hackademix.net/2009/01/25/surrogate-scripts-vs-googl... This was one of my favorite examples of how there was much more to NoScript than most people assumed, and it had a depth of features that could not be matched by "alternatives" like uMatrix. But that feature was killed by the mass extension breakage in Firefox 57: https://github.com/hackademix/noscript/issues/133#issuecomment-593150495 https://github.com/hackademix/noscript/issues/133#issuecomme... So in a way, this feature can be seen as more than three years overdue.

crazypython 6y ago
I thought NoScript was a single-purpose extension for disabling scripts. Naming and messaging matters, I guess. "JSControl" would've been a better name.
- wtallis 6y ago
  The full name as shown on addons.mozilla.org is "NoScript Security Suite", which more accurately conveys its purpose. Some of the features it provided really had nothing to do with JavaScript, such as NoScript's implementation of Strict Transport Security about 1.5 years before Firefox itself implemented that feature.
  - z77dj3kl 6y ago
    > "NoScript Security Suite", which more accurately conveys its purpose. No, that just makes the name more confusing!
  - dividedbyzero 6y ago
    Still sounds like a JavaScript blocker, that doesn't clarify anything for me. I've never even looked at it as I've somehow associated it with "block all Javascript", seems like I missed out.
    - 6y ago

azhenley 6y ago

What should I use in replace of Google Analytics for basic web traffic analytics?

anthony514 6y ago
Matomo https://matomo.org/ https://matomo.org/
- sgtfrankieboy 6y ago
  The only real free alternative to Google Analytics tbh.
ssddanbrown 6y ago
I've been using plausible (https://plausible.io/ https://plausible.io/) recently and I've been really happy with it. I've written about the move from GA to plausible, for my use-case, here: https://www.bookstackapp.com/blog/replacing-ga-and-mailchimp/ https://www.bookstackapp.com/blog/replacing-ga-and-mailchimp...
- azhenley 6y ago
  I switched! Thank you.
tristor 6y ago
GoatCounter[1] or Plausible[2] [1]: https://www.goatcounter.com/ https://www.goatcounter.com/ [2]: https://plausible.io/ https://plausible.io/
cemerick 6y ago
Zoho's Pagesense is great: https://www.zoho.com/pagesense/ https://www.zoho.com/pagesense/
- azhenley 6y ago
  Wow, that is expensive! $16 a month for analytics.

deleted 6y ago

[deleted]

userbinator 6y ago

I have mixed feelings about this. From the privacy angle I am pleased (I've been blocking GA ever since I knew it existed, via HOSTS), but from the "neutral browser" angle, not so much. Then again, FF is already not neutral with things like "safe browsing" and extension blacklists...

pseudalopex 6y ago
You can turn it off.
stjohnswarts 6y ago
It's not on by default. It's in the "strict settings" not the "standard settings" so it's opt in.
Nicksil 6y ago
Browsers aren't supposed to be neutral. Browsers are the user's agent; they're supposed to serve the user and nothing else.
- symlinkk 6y ago
  Yeah somehow I think you would have a different opinion if Chrome offered users a performance boost only on Google owned websites.
  - wtallis 6y ago
    If Chrome didn't allow the user to configure that same performance boost to work on other websites, then Chrome would be failing to operate as a user agent.
  - jannes 6y ago
    They literally did that already when they came up with QUIC (before it was public). They had private implementations only supported by Google webservers and Chrome.
  - Nemo_bis 6y ago

paulie_a 6y ago

Why isn't there more effort to subvert tracking vs trying to block it. Ruin the data and they can collect as much as they want

juiyout 6y ago
There is a Chrome extension named Ad Nauseam. Was arguably but ultimately blocked by Google extension store. I still manually install and use it.

beervirus 6y ago

Fantastic. There is no excuse for using Chrome nowadays.

mippenhappen 6y ago
Thankfully we don't need an excuse.

crazygringo 6y ago

I'm confused. I thought Google Analytics tracked you within a site, and that it's fundamentally not really any different from analyzing server logs except the logs are simply hosted in Google's cloud and visualized using Google's tools. I realize it uses cookies but that's to build analytics around sequences of user actions, since many users can be collapsed into a single IP. Privately hosted analytics software needs to use cookies to achieve the same thing as well. Google Analytics doesn't have anything to do with building an advertising profile around users, correct? I know it's popular to hate on Google but does this achieve anything against tracking users across sites in order to build advertising profiles? I was under the impression all the profile-building people object to was done via the pages with ads themselves. Is Google Analytics actually an evil tool? Or is just "evil by association" because Google ads track users across sites, and Google Analytics also does "tracking" albeit a different kind? I'm just wondering if this is actually anything substantive, or if it's more symbolic. Edit: wow those were some FAST downvotes. I'm just asking some basic questions to understand how meaningful this is, folks. Hopefully nobody's taking offense.

GrayShade 6y ago
Google Analytics tracks you across different sites AFAIK. Mozilla supposedly has a special option in GA to not correlate data gathered on their sites with what GA gathers on others. Even if it didn't, it still tells Google what you're visiting: with so many sites using it, they can get a pretty much complete view of your browsing history, just like Google Fonts.
- crazygringo 6y ago
  > Google Analytics tracks you across different sites AFAIK. See that's the thing, I keep seeing this asserted but when I search for any evidence, I can't find a single article that demonstrates this to be true. If you own multiple sites you can enable analytics across them, but that's all. And if Google wants to know what you're visiting to build advertising profiles, they have so many options -- not just Fonts, but DNS, Chrome, ads... it's not like GA by itself is making any substantive difference. But again, just because it could be used for this doesn't mean it is. So I don't get how this is actually helping. I worry it's a distraction from actual achievements.

lsh123 6y ago

I like ads tracking as much as the next guy. However, I am not comfortable with a browser modifying content in any way. I am fine to have extensions that do that, but the browser itself shouldn’t do it “by default” without user explicitly enabling it.

stjohnswarts 6y ago
It's not on by default, you have to turn it off by going from "standard" to "strict" settings so there's not really anything to complain about.

jve 6y ago

Won't Firefox shoot themselves in the foot here? I mean devs will see that Firefox market share is way lower due to this than it is actually true. And will stop bothering about FF? Ir am I misunderstanding about what this feature does?

unglaublich 6y ago
This feature only applies if you are already blocking GA with Firefox. The change is that now the GA JS API will stay available for the website so that it can keep calling GA functions. The stub won't actually send any info to Google though.

zaphirplane 6y ago

Talk about bitting the hand that feeds you Power to the people

axelfontaine 6y ago

Firefox should really double down on this. All this strict privacy protection could be branded as Firefox Pro and they could charge for it. This would make for a nice revenue stream as more and more people begin to see the value of this. If Hey can do it for email, Firefox Pro Can do it for browsers!

probably_wrong 6y ago
Counterpoint: this would destroy Firefox' credibility. I use Firefox because of their strong pro-privacy stance. If they started charging for "real" privacy, it would damage that image - "privacy for those who can afford it" would be a bad slogan. Also, Firefox has made it clear that they don't want our money, as seen in their continuous refusal to accept donations.

guerrilla 6y ago

Being that Google funds Firefox, how long can this kind of thing last?

panta82 6y ago

I don't mind blocking ads, but analytics? That seems like the taking the desire for privacy too far. Why shouldn't site owner know you've visited their site? How will they do their job if they don't know where people come from, what content they enjoy, what devices they should optimized for, general demographic of their audience, etc. These are all the things a restourant owner would know about their customers, for example. But no one seems to have a problem with that.

jerrre 6y ago
Perhaps I'm old fashioned but I would not expect a restaurant owner to track where I come from, my demographics etc?
- jannes 6y ago
  They wouldn’t have to “track” it scientifically in a database. They would just know implicitly by observing their customers who are right in front of their eyes. (At least pre-covid)
  - Vhano 6y ago
    would they know which car I drive from looking at me?
- izacus 6y ago
  Restaurant owners do exactly that - just by looking at you sitting in there (and other customers).
  - Vhano 6y ago
    not my underwear colour, type, size. What they see is what I offer to show
cmod 6y ago
Less about stopping analytics and more about stopping privacy-malicious analytics (which google analytics could arguably be defined as). Install a privacy friendly analytics package and I suspect it won’t be much blocked.

ashneo76 6y ago

This perfect. I don't have all the storess following me around and where I came from, what my tendencies are etc. They also forget about me, generally when I leave the store. This tracking is not okay and nobody, absolutely nobody, gets to decide for me. Google doesn't own the internet

nindalf 6y ago

People use analytics to decide where to focus there efforts. For example, if most of your users are on mobile, invest more in the mobile experience. The unintended consequence of this change is people looking at which browsers are hitting their website, finding that it’s mostly Chrome and therefore testing only with Chrome. This would degrade the experience for Firefox users as subtle breakages start appearing. Folks advocating for the use of hosted analytics instead of GA are correct ... but that’s not what most people will do. It’s just simpler to add a one line GA tracker to your code and call it a day. And these people will see Firefox usage drop to 0. We have already seen “this site works best/only on Chrome”, especially on Google products like Inbox. Expect to see more of that as the web becomes a Chromium/Safari duopoly, according to analytics.

onion2k 6y ago
The unintended consequence of this change is people looking at which browsers are hitting their website, finding that it’s mostly Chrome and therefore testing only with Chrome. Bad developers already only test in Chrome regardless of what GA is telling them. This won't have much impact there.
- nindalf 6y ago
  It’s harder for good developers to justify effort if it seems like that effort has no impact.
elric 6y ago
You don't need Google Analytics to figure out what browser your audience is using. That information is literally embedded in every single request to your website. There's no need to siphon requests over to Google for something so trivial. I get that people would like you know as much as possible about who visits their website. Sometimes even for legitimate reasons and not just out of an obsession with collection as much data as possible. But this analytics madness has gone too far. Pretty much every website you visit ships a bunch of data about you to multiple third parties. Often without consent. Just stop doing that. It's not a hard thing to do.

tinus_hn 6y ago

Next weeks stats are in, Firefox’s market share has dropped 50%!

currysausage 6y ago

Maybe a dumb question: Why isn't it enough to simply block the Analytics JS, why is it necessary to substitute it with a "fake no-op" script? Does blocking GA regularly break sites?

rsstack 6y ago
Yes. Many sites assume that GA is there, and for example clicks on buttons may fail to work if the GA click call fails. It isn't great engineering from the site but Firefox wants its users to still be able to browse the web.
XCSme 6y ago
One use case I noticed: Don't render the site until Google Tag Manager is loaded. Because of this, when using an adblocker that blocks GTM, the site will never load. I guess the reason to block GTM until load it use it show some personalized ads/pricing/buttons.

eternalny1 6y ago

I've been using Firefox since the Phoenix/Firebird days, and I fear the day that Google ends their search funding to the project. They are absolutely on the right track with Mozilla improving the actual -browser- with all of these new privacy features and core improvements. This could put them in a position to create a revenue stream independent of Google, where people would actually be willing to pay to have a browser wholly decoupled from these ad companies.

jakub_g 6y ago
There's some risk there indeed, but there would be also big anti-monopoly scrutiny risk from Google's side doing that if they indirectly kill alternative browsers. Right now there's some kind of equilibrium by having alternative browsers/engines, on Windows especially, plus Google still gets traffic from millions of Firefox users by being default search engine, which makes them $$$.
account42 6y ago
> I fear the day that Google ends their search funding to the project I look forward to that day - until then, all decisions Mozilla makes are impacted by that fear.

pgcj_poster 6y ago

Have they replaced the Google Analytics on the add-ons site with this yet?