31 ms·

Rally, a novel privacy-first data sharing platform

238 points by TangerineDream 5y ago

thombles 5y ago
Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. There seems to be an assumption that users will be gleeful to throw their data at legitimate researchers from legitimate institutions doing legitimate work. What "data"? Browsing history? Identity? Something else? Why? What's in it for them? Since when was giving our data to third parties a good idea? There is literally no motivation presented here. As a nerd I can read between the lines—clearly they have come up with some sort of privacy-preserving data collection system that is useful. But at face value this whole article is just saying "hey use Firefox and give your data to scientists for reasons we don't bother to explain because obviously it's good."
- grumblenum 5y ago
  I read it as "we're protecting your privacy by increasing the number of people who can monitor your activity on our browser." Presumably, the users will be well-endowed and tax-advantaged institutions who could have just bought the information from data-aggregators anyway. I'm starting to see a theme of papering over their technology products with a lot of modern art and hyperbolic language. "Computer scientists, social scientists and other researchers will be able to launch groundbreaking studies about the web and invite you to participate." Wow. I'm about to make history with a browser add-on! "Our first study is “Political and COVID-19 News” and comes from the Princeton team that helped us develop the Rally research initiative." Groundbreaking! College students can now make sure that I am adequately fact-checked if I err from the path of truth.
  - dhimes 5y ago
    College students can now make sure that I am adequately fact-checked if I err from the path of truth. I don't think they are "making sure" as in "enforcing." It sounds like they are observing and reporting, hopefully in an aggregated fashion.
  - jonathanmayer 5y ago
    > Presumably, the users will be well-endowed and tax-advantaged institutions who could have just bought the information from data-aggregators anyway. Nope. This is an important point: the type of crowdsourced science that Rally enables is something that researchers couldn't do before. (With the exception of a very small number of teams who made massive investments in building single-purpose crowdsourcing infrastructure from the ground up.)
    - ysavir 5y ago
      Could you provide more detail on what makes it novel?
      - jonathanmayer 5y ago
        Common research methods have significant limitations. Web crawls, for instance, usually don't realistically simulate user activity and experiences. Lab studies often involve simplified systems that don't generalize to the real world. Surveys yield self-reported data, which can be very unreliable. Rally studies, by contrast, reflect real-world user activity and experiences. In science jargon, Rally enables field studies and intervention experiments with excellent ecological validity.
        ysavir 5y ago
        Thanks for clarifying! Makes sense. A few follow up questions: 1. Do you expect the opt-in nature of these studies to impact their findings? 2. To compensate for the voluntary nature of the studies, do you think researchers in general will still be incentivized to find data sources that are less respectful of people's privacy and don't require an opt-in to the study?
        jonathanmayer 5y ago
        > 1. Do you expect the opt-in nature of these studies to impact their findings? The Rally participant population is not representative of the U.S. population—these are users who run Firefox (other browsers coming soon), choose to join Rally, and choose to join a study. In research jargon, there's significant sampling bias. For some studies, that's OK, because the research doesn't depend on a representative sample. For other studies, researchers can approximate U.S. population demographics. When a user joins Rally, they can optionally provide demographic information. Researchers can then use the demographics with reweighting, matching, subsampling, and similar methods to approximate a representative population. Those methods already appear throughout social science; whether they're sufficient also depends on the study. > 2. To compensate for the voluntary nature of the studies, do you think researchers in general will still be incentivized to find data sources that are less respectful of people's privacy and don't require an opt-in to the study? Rally is designed to provide a new research capability that didn't exist before. I don't expect a substitution effect like that.
- deleted 5y ago
  [deleted]
- jonathanmayer 5y ago
  Princeton research collaborator here. Glad to answer questions about Rally. > What "data"? Browsing history? Identity? Something else? That depends on the Rally study, since research questions differ and studies are required to practice data minimization. Each study is opt in, with both short-form and long-form explanations. Academic studies also involve IRB-approved informed consent. Take a look at our launch study for an example [1]. > Why? What's in it for them? Since when was giving our data to third parties a good idea? There is literally no motivation presented here. The motivation is enabling crowdsourced scientific research that benefits society. Think Apple Research [2], NYU Ad Observatory [3], or The Markup's Citizen Browser [4]. There are many research questions at the intersection of technology and society where conventional methods like web crawls, surveys, and social media feeds aren't sufficient. That's especially true for platform accountability research; the major platforms have generally refused to facilitate independent research that might identify problems, and platform problems often involve targeting and personalization that other methods can't meaningfully examine. [1] https://rally.mozilla.org/current-studies/political-and-covid-19-news/index.html https://rally.mozilla.org/current-studies/political-and-covi... [2] https://www.apple.com/ios/research-app/ https://www.apple.com/ios/research-app/ [3] https://adobservatory.org/ https://adobservatory.org/ [4] https://themarkup.org/citizen-browser https://themarkup.org/citizen-browser
  - thombles 5y ago
    These "This Study Will Collect" and "How We Protect You" sections are really good. It probably wouldn't convince me personally to sign up, but it's as comprehensive as I would expect. It's a shame that these comments didn't make it into the blog post.
  - chobytes 5y ago
    Personally I don't think that researchers have any more business doing this kind of surveillance than Google and company do. The idea that this will benefit society seems naive to me. I feel like it will only serve to legitimize the practice by putting ostensibly trustworthy faces on the packaging.
    - splistud 5y ago
- DavideNL 5y ago
  The answers seem explained quite clearly and are simple to find by just clicking the links in the article… “what data”,for example: https://rally.mozilla.org/privacy-policy/ https://rally.mozilla.org/privacy-policy/
- JumpCrisscross 5y ago
  Mozilla strikes me as an organisation with too many resources for its own good. They keep pursuing these random side gigs with limited unifying theme other than an excuse to spend money.
  - tgsovlerkhgsel 5y ago
    Reminder that donations to Mozilla are not donations to Firefox development. The Mozilla Corp (makes Firefox) and Mozilla Foundation (gets donations) are mostly separate.
  - 9wzYQbTYsAIc 5y ago
    Additional reminder that Mozilla just recently had to go through a round of layoffs. https://news.ycombinator.com/item?id=24120336 https://news.ycombinator.com/item?id=24120336
    - errantmind 5y ago
      The fact they have significantly more than 250 employees in the first place is a bit mind boggling. As far as I can tell most of the spending is unrelated to Firefox. What do all of these people do and why are they needed?
      - Nicksil 5y ago
        >The fact they have significantly more than 250 employees in the first place is a bit mind boggling. As far as I can tell most of the spending is unrelated to Firefox. What do all of these people do and why are they needed? I sometimes have the same reaction when learning the number of people employed for what I would have otherwise thought to be some meager thing. Then I get reminded about the folks over in external/internal support; marketing; design; IT/infrastructure; legal; compliance; etc. Here's Mozilla's listing: https://careers.mozilla.org/listings/ https://careers.mozilla.org/listings/
        errantmind 5y ago
- elliekelly 5y ago
  > privacy-preserving data collection system I hate this. Viscerally. Why, why, WHY does every “privacy first” system, platform, whatever, start with the presumption that some people should get your data and it’s just a matter of vetting the “good” groups from the “bad” groups. No. That isn’t privacy. No one should get my data. And it’s ridiculous that all of these companies try to position their data grabbing projects as “privacy” oriented when what they really mean is they’re not quite as invasive and/or are slightly more transparent about their data theft compared to others. </rant>
  - jefftk 5y ago
    Rally is entirely opt-in, so I think you're off the mark here?
  - 9wzYQbTYsAIc 5y ago
    > start with the presumption that some people should get your data Some people do want others to have their data. Dropbox is a great example of a successful business that is built on the idea of sharing data.
    - Ensorceled 5y ago
      Yes, I want to use Dropbox to share my invoice with my client and my client to share the assets from their designer with me. I don't want anybody tracking what websites I visit, articles I read or facebook videos I watch. These are two VERY different definitions of "data", mingling the two is not helpful to discourse.
      - Nicksil 5y ago
        >I don't want anybody tracking what websites I visit, articles I read or facebook videos I watch. This whole thing is opt-in, is it not? If you don't want to share your information, you simply do not opt-in.
        Ensorceled 5y ago
- 9wzYQbTYsAIc 5y ago
  > Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. It does appear that this piece was written by Mozilla, themselves… on their own blog.
  - xpe 5y ago
    >> Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. > It does appear that this piece was written by Mozilla, themselves… on their own blog. Haha! Captain Obvious strikes again. Joking aside, I think the other commenter knew the post was written by someone at Mozilla on the Mozilla web site. Their point, I think, was that the author didn't do a good job of selling Rally.
    - 9wzYQbTYsAIc 5y ago
      Heh, nice one. Could be, yeah. My estimation is that Mozilla was making a desperately concerted effort to signal that they are not at fault in the Big Tech wars.
- throwaway81523 5y ago
  Yep. "Privacy first" and "data sharing" don't belong in the same sentence.
- joshspankit 5y ago
  I was really excited for most of the time reading thinking “A privacy-first general data store that lets us donate insights for the common good, and may even end up being a marketplace where we can choose to sell data. This is so cool! I hope they have a mobile app so I can record things like what I ate for supper or how long I looked at a screen today” But, it seems like they’re just tracking browser behaviour, and there’s absolutely zero place for people to add their own data? Why bother giving it a branded name then? Why not “crowd-sourced browser behaviour study in partnership with ____”?
swiley 5y ago
So they don't have enough manpower to maintain features people actually want (like the JavaScript toggle in settings which Chrome apparently has) but they do to make things no one will use that will get shut down in a few years?
- williamtwild 5y ago
  Odds are its funded by whomever is doing the study and is unrelated the browser at all.
  - hosteur 5y ago
    If that is the case then it should be done as an extension. And why would Mozilla use its brand capital on this?
    - bilkow 5y ago
      It is an extension: https://addons.mozilla.org/en-US/firefox/addon/mozilla-rally/ https://addons.mozilla.org/en-US/firefox/addon/mozilla-rally... https://github.com/mozilla-rally/rally-core-addon/ https://github.com/mozilla-rally/rally-core-addon/
denton-scratch 5y ago
The best way to put "privacy first" is not to share your data. This article title is arse-over-tit.
- smitty1e 5y ago
  But if your knowledge tree falls in the forest, and no one hears of it, then how do the data sound? Somewhere between hermit-style hoarding and totally wide open there may be a collaborative sweet spot.
  - m0ngr31 5y ago
    Why? Seems to me I get absolutely nothing from this other than a wink from Mozilla that my data can't identify me.
    - 9wzYQbTYsAIc 5y ago
      > The motivation is enabling crowdsourced scientific research that benefits society. https://news.ycombinator.com/item?id=27630188 https://news.ycombinator.com/item?id=27630188
WA 5y ago
Surprisingly difficult to understand what this thing is or does. Seems like you can "donate" your browsing behavior to science for doing studies in a kinda anonymous privacy protecting way.
- kevincox 5y ago
  It doesn't even sound anonymous. It sounds like they just audit that the partner aggregates the data once delivered to them. Some sort of pinky-promise.
  - 9wzYQbTYsAIc 5y ago
    > Some sort of pinky-promise. Nope. > * research partners are contractually obligated to abide by these procedures and protect your data.* https://rally.mozilla.org/how-rally-works/faqs/ https://rally.mozilla.org/how-rally-works/faqs/
    - Ensorceled 5y ago
      Lots of abuses of data are "contractually" forbidden.
      - 9wzYQbTYsAIc 5y ago
        Contracts are legal constructs that ultimately have the threat of force of violence through law enforcement as their recourse.
    - caconym_ 5y ago
      But, realistically, what recourse do users have if there's a breach? A few years ago I got a letter from Washington State University saying that they'd obtained my personal health data (which I never directly consented to, nor had I interacted with WSU in any way prior to receiving this latter) and subsequently allowed it to be stolen by unknown malicious actors. In case you're curious, they kept the data on an unencrypted hard drive in a physical safe that was then physically stolen. There was some class action pittance that meant nothing to me, and WSU does not seem to have been subject to any meaningful consequences. It seems to be viewed as a cost of doing business sort of thing. For all of us who had their data stolen, the horse has left the barn, and I see no real deterrent effect. This seems to be the norm when data breaches happen. So while "pinky promise" might be a bit hyperbolic, there is a lot of truth to it in general and I don't know how this case is supposed to be any different. If there is some paradigm-breaking accountability mechanism built in, I'd love to hear more about it.
quadrifoliate 5y ago
I like that you can run your own versions of these studies, e.g. https://github.com/mozilla-rally/rally-study-01 https://github.com/mozilla-rally/rally-study-01 to collect your own data. I think it would be a novel idea to make this the primary focus of the project, enabling users to see and understand their own data before donating it to research projects. For example, I know that the study above is called "Your Time Online and 'Doomscrolling'", but I don't have much of an idea on how they plan to quantify doomscrolling via attention or audio events. I managed to get a reasonable idea from https://rally.mozilla.org/current-studies/your-time-online-and-doomscrolling/ https://rally.mozilla.org/current-studies/your-time-online-a... and https://github.com/mozilla-rally/rally-study-01/blob/master/DATA_SCHEMA.md https://github.com/mozilla-rally/rally-study-01/blob/master/... though, so it's possible I just need to put in more effort as a user :)
- 9wzYQbTYsAIc 5y ago
  > I don't have much of an idea on how they plan to quantify doomscrolling via attention or audio events. It seems that what they’ve done is told us exactly what data they will collect but have left it unanswered as to what specific social science methodologies they will use to analyze the data. It is very likely that their intention is to not set that expectation with the data crowdsourcers so that the researchers have the flexibility to adjust their methodological approaches in an iterative fashion.
ttt0 5y ago
Mozilla, the company that says "we need more than deplatforming", wants me to contribute to the research that will be used for censoring the internet? No thanks.
- visarga 5y ago
  They were talking about Trump's attack rally, and this was published on 8th of Jan.
  - ttt0 5y ago
    It's clearly tied to this research, and the purpose of it is also pretty clear. Technology is technology. It doesn't care about morality and what's right or wrong.
    - 9wzYQbTYsAIc 5y ago
      > Technology is technology. It doesn't care about morality and what's right or wrong. That is rather uninformed. There is a growing body of research on embedding ethics into technology. https://link.springer.com/article/10.1007/s00146-020-01010-1 https://link.springer.com/article/10.1007/s00146-020-01010-1
      - ttt0 5y ago
        It doesn't mean anything. You have zero guarantees that anything like that will be actually applied. The government and its military won't ever care about it. This is just some research while we have surveillance technology and weapons controlled by the AI right now. Get real.
        9wzYQbTYsAIc 5y ago
        That’s rather nihilistic. How exactly are academic researchers supposed to guarantee that their research will be applied for the good of humanity? Government is you and me and everyone else. If you want government to care about it, write to them and tell them to care about it. They probably aren’t going to care about random comments on HN. Research on ethical machines has been taking place since the dawn of the drone age and has already guided military policy. You can find the supporting evidence of that for yourself if you search for it.
tokai 5y ago
Nothing on if studies based on this will be published as Open Access. I can see that Jonathan Mayer's latest publications are all published without OA so that doesn't bode well for the covid news study. And ironically are the 'Beyond the Paywall' researchers no better at publishing Open research.
Yaina 5y ago
It's not easy to understand, especially from the blog post alone, but as far as I understand it, the proposition is the following: Big companies have the ability to do research on users all the time, either by doing anonymous studies or by tracking you for their ad networks. This is a luxury many researchers that work outside of these big tech companies don't have, which creates a scientific power imbalance. Mozilla Rally is meant to give these capabilities to everyone, and the platform is meant to ensure that you always know what you sign up for and what data is being used. If I understand the Princeton example correctly: They want to figure out how people consume and spread misinformation. Social networks like Facebook have all that data but won't share it. Now you can opt-in to a Rally study where independent researchers can examine the data.
- 9wzYQbTYsAIc 5y ago
  > Now you can opt-in to a a Rally study where independent researchers can examine the data. It would have been great if they’d invested the resources to use Solid, here.
  - xpe 5y ago
    Thanks for mentioning this. Two questions: 1. In your experience, what is the maturity level of Solid? 2. Would you mind sketching out how you would do the integration with Solid? I'm reading over https://solidproject.org/users/get-a-pod https://solidproject.org/users/get-a-pod but haven't spend a lot of brain cycles on it yet.
    - 9wzYQbTYsAIc 5y ago
      You’re welcome! I’m in the same boat as you - haven’t spent many brain cycles on it yet. Mozilla Rally would have been the perfect proof-of-concept for putting that idea to use and giving it a shakedown. Generally, Solid seems to be pretty grounded in its attempt to resolve data sharing privacy concerns. My understanding is that the implementations would be about the same as using browser storage. I believe developers would need to approach data access from the perspective of “an infinitely sharded document database - shards are globally-uniquely identifiable - shards are remotely distributed - shards have their own IAM - for each shard, you must register as an authorized user and authenticate to access remote data”
austincheney 5y ago
If there is data going to research this isn’t completely private. I wrote a data sharing platform for the browser that is privacy focused. Privacy first means I couldn’t give any data to any third party no matter how much I want to because the platform won’t let me. https://github.com/prettydiff/share-file-systems https://github.com/prettydiff/share-file-systems
vcavallo 5y ago
What’s up with all the black flags and raised fists?
- gmb2k1 5y ago
  It's a demonstration of their political stance. Radical left.
zenlf 5y ago
I understand there is a perfectly legitimate need and reason to do what they do. However “privacy-first data sharing” sounds like doublespeak to me. In the same vein as the famous “war is peace, freedom is slavery.”
- 9wzYQbTYsAIc 5y ago
  > sounds like double speak That’s rather cynical. What’s wrong with someone wanting to share their data with certain people while also demanding that those people respect the data’s privacy?
  - errantmind 5y ago
    You keep accusing people of being nihilistic / cynical in this thread. It isn't cynical to be extremely skeptical of any company's ability to keep your data private and safe given the constant barrage of breeches and ethical violations. Maybe I'm in the minority but Mozilla's brand had been permanently tarnished in recent years and I do not think of them as a 'privacy first' organization
    - 9wzYQbTYsAIc 5y ago
      > It isn't cynical to be extremely skeptical of any company's ability to keep your data private and safe By dictionary definition, cynicism is an attitude of scornful or jaded negativity, especially a general distrust of the integrity or professed motives of others. Skepticism is defined as the doubt as to the truth of something. Extreme doubt as to the integrity of a company’s data privacy practices is the dictionary definition of cynicism.
    - 9wzYQbTYsAIc 5y ago
      > Mozilla's brand had been permanently tarnished in recent years Indeed, Google may have out-competed them on the marketing messaging front.
    - 9wzYQbTYsAIc 5y ago
      > I do not think of them as a 'privacy first' organization I won’t pry, but I suspect that you are not a web developer, by trade. It is common knowledge in the web development field that Mozilla is a, if not the, standard bearer for consumer privacy protection in the browser wars. Safari is currently taking the helm, though.
HugoDaniel 5y ago
Just do a proper browser
gopiandcode 5y ago
Looking through the FAQ, It seems like Rally requires users to send their raw data straight to the aggregation service, with the only privacy guarantees being that the data is encrypted during transport, and a "promise" that they will run internal audits to make sure private data isn't released from their servers. IMO this seems to provide worse privacy than even Google and Micro$oft's telemetry, which at least use differential privacy to make sure that each individual's privacy is somewhat protected (the data you send is randomised so even if the aggregator is compromised by a malicious third party (e.g. NSA) individuals have some degree of plausible deniability). Sure, Mozilla's intentions may be more "pure" (or is that just their propaganda speaking?), but in terms of privacy guarantees this seems like it is a strict downgrade, that abuses their goodwill to hide its deficiencies.
- jonathanmayer 5y ago
  > with the only privacy guarantees being that the data is encrypted during transport, and a "promise" that they will run internal audits to make sure private data isn't released from their servers. There's much more than that, including: privacy and security review before a study launches, a data minimization requirement, a sandboxed data analysis environment with strict access controls, and IRB oversight for academic studies. > IMO this seems to provide worse privacy than even Google and Micro$oft's telemetry, which at least use differential privacy to make sure that each individual's privacy is somewhat protected (the data you send is randomised so even if the aggregator is compromised by a malicious third party (e.g. NSA) individuals have some degree of plausible deniability). The vast majority of Google and Microsoft telemetry does not involve local differential privacy. Google, in fact, has almost entirely removed local differential privacy (RAPPOR) from Chrome telemetry [1]. We've been examining the feasibility of local differential privacy for Rally. The challenge for us—and why local differential privacy has limited deployment—is that the level of noise makes answering most (often all) research questions impossible. [1] https://bugs.chromium.org/p/chromium/issues/detail?id=1016906 https://bugs.chromium.org/p/chromium/issues/detail?id=101690...
  - skybrian 5y ago
    Interesting. I can see that RAPPOR seems to be deprecated in favor of something else called ukm (Url-keyed metrics) but not why this change is being made. Is there somewhere I can read more about it?
luke2m 5y ago
Disclaimer: will be killed in a few months
- Nicksil 5y ago
  >Disclaimer: will be killed in a few months You're thinking of Google. This is Mozilla.
  - luke2m 5y ago
    FF Send, FF Notes, Positron, FF OS, Appmaker, and Deuxdrop to name a few. They tend to keep more stuff around than Google, but still cancel things that I like frequently.
  - lawl 5y ago
    > You're thinking of Google. This is Mozilla. Well, it is really difficult to tell them apart these days. Mozilla does like to copy everything google does, if you look at firefox.
    - Nicksil 5y ago
      >Well, it is really difficult to tell them apart these days. Mozilla does like to copy everything google does, if you look at firefox. Indeed similarities exist. Still, no where close.
eitland 5y ago
For any Mozilla people here: How do you feel that this is prioritized and the Tab Strip API is not? (Edit, this issue:https://bugzilla.mozilla.org/show_bug.cgi?id=1332447 https://bugzilla.mozilla.org/show_bug.cgi?id=1332447) My background: I'm a "loyal" user, but not because of love anymore but because the alternatives are even worse in my opinion. I have given up Mozilla the non-profit the last few years but will continue to use Firefox because of ergonomics and politics for now. If someone can convince me Pale Moon is safe enough to use at work I'd switch in a heartbeat though. Same if someone starts maintaining a paid (or unpaid) fork of the latest Firefox that actually reimplements the Tab Strip API for web extensions and starts reimplementing the rest of the missing APIs. (If this triggers an idea in a brilliant hacker here then create a kickstarter and mail me about it: I'm easily in on $10 a month, maybe more. I'm looking for a work browser that won't depend on Chromium when Google finally decides it is time to kill the extension API on desktop as well.) PS: Even though I have given up Mozilla I'm still looking for a way to help fund Firefox as long as I know it is used for Firefox and not for running it into the ground.
yyyk 5y ago
This is exactly the data a modern Cambridge Analytica would want (e.g. shares, time spent on each post, all correlated to demographics). I hope this platform has controls to ensure that study data isn't misused post-study for non-study purposes, because the FAQ answer isn't so encouraging[0]. [0] https://rally.mozilla.org/how-rally-works/faqs/#what-happens-after-the-study-ends https://rally.mozilla.org/how-rally-works/faqs/#what-happens... "With Mozilla’s permission, researchers may retain aggregated or de-identified datasets for their analyses. Mozilla may also retain aggregated data sets which we may release in the public good to foster an open web." Shouldn't you ask the users for permission on using their aggregate data for purposes that could be different to the study they enrolled to?
- 9wzYQbTYsAIc 5y ago
  > Shouldn't you ask the users for permission on using their aggregate data for purposes that could be different to the study they enrolled to? They do, given that you’d have been informed of that before you provided your consent by opting in to Rally data crowdsourcing. > This is exactly the data a modern Cambridge Analytica would want Kind of nice that it’d be in the hands of Mozilla, Princeton University, other trusted research partners, and the open web, isn’t it?
  - yyyk 5y ago
    >They do, given that you’d have been informed of that before you provided your consent by opting in to Rally data crowdsourcing. I haven't tried registering for the study, but I note that an FAQ answer is not enough. Users cannot be expected to search for the FAQ. This needs to be mentioned in the consent form, and not done implicitly 'by opting in' like corporations do. >Kind of nice that it’d be in the hands of Mozilla, Princeton University, other trusted research partners, and the open web, isn’t it? The 'open web' is a bit of a nebulous concept, and the CA data was supposedly in the hands of a data scientist at the University of Cambridge.
  - lawl 5y ago
    > Kind of nice that it’d be in the hands of Mozilla, Princeton University, other trusted research partners, and the open web, isn’t it? No? It'd be much better to not collect that data at all.
deleted 5y ago
[deleted]
fnord77 5y ago
so, only approved research partners gets the ability to post studies and access data?
- 9wzYQbTYsAIc 5y ago
  > What is the criteria for becoming a partner? Currently, we are working with a small number of reputable research teams who match our commitment to your safety and trust and who also have the technical expertise to help us build Rally’s scientific capabilities. All partners are required to sign an agreement with Mozilla. This agreement upholds the researcher’s rights to independence in their research, while mandating the safeguards they must follow in order to protect our users. In the future, we will expand beyond our pilot partners. Please contact us if you are interested in becoming a partner! https://rally.mozilla.org/how-rally-works/faqs/#partner-criteria https://rally.mozilla.org/how-rally-works/faqs/#partner-crit...
alexshendi 5y ago
Am I the only one who has read "Piracy First"?
- Iwan-Zotow 5y ago
  MeToo thought, finally, us, pirates, will have good sharing platform
lykahb 5y ago
I think that it is important to create a precedent of mass data collection that reveals to the users what is collected and gives tools to manage it. The legislators can use it as a blueprint to require a similar level of disclosure from other companies that do online surveillance. However, I do not see what value Rally offers to the enrolled users.
miked85 5y ago
I am failing to see the motivation for anyone to use this. If you cared about privacy, you wouldn't share your data in the first place. If you didn't care about privacy, there is still no reason to opt in.
- 9wzYQbTYsAIc 5y ago
  > The motivation is enabling crowdsourced scientific research that benefits society. https://news.ycombinator.com/item?id=27630188 https://news.ycombinator.com/item?id=27630188
  - lawl 5y ago
    > crowdsourced scientific research that benefits society. how, in your words, would the covid19 news misinformation study benefit society?
    - 9wzYQbTYsAIc 5y ago
      One example, without having read further into that particular study, but knowing what misinformation research tries to do, generally, would be the following: Identifying the specific mechanisms behind the dark patterns of social engineering. There is a body of research, for example, that considers the spread of rumors by making use of the same mathematical models that epidemiology uses to model the spread of infectious disease (virality, in particular). As I recall, that body of research led to the conclusion that the best weapon against misinformation may be the liberal and broad application of truth-telling.
- errantmind 5y ago
  Agreed. I'm in the former group. You aren't getting my data, stop trying. That may seem harsh, but that is where I'm at. I'm really put off by the idea of sharing my data these days. I don't trust Mozilla's internal audit process to keep it safe, but it isn't specific to them. Outside of maybe a two companies who are 'encryption-first', I don't trust any of them
- renewiltord 5y ago
notjustanymike 5y ago
Corporate Memphis strikes again!
chobytes 5y ago
This is an awfully generous way to present what looks like yet another in-browser advertising platform.
hndirect 5y ago
Sorry if this is too off topic, but is there a name for the art style they are using in the illustrations? It seems to be all over corporate sites these days.
- caseyohara 5y ago
  That design style is called "Corporate Memphis" (https://en.wikipedia.org/wiki/Corporate_Memphis https://en.wikipedia.org/wiki/Corporate_Memphis) and you're right it is pervasive. Here's a YouTube video about it if you're curious: Why do "Corporate Art styles" Feel Fake? https://www.youtube.com/watch?v=lFb7BOI_QFc https://www.youtube.com/watch?v=lFb7BOI_QFc
- Nicksil 5y ago
  "Corporate Memphis," perhaps? Previous HN discussion: https://news.ycombinator.com/item?id=27107820 https://news.ycombinator.com/item?id=27107820 Wikipedia: https://en.wikipedia.org/wiki/Corporate_Memphis https://en.wikipedia.org/wiki/Corporate_Memphis Edit: I had this open in a tab for ~20 mins. which is why I didn't see caseyohara's reply before submitting mine. Please excuse the redundancy.
- alphabet9000 5y ago
  used to be a nice twitter blog documenting the style, but it got suspended at some point: https://web.archive.org/web/20190426022335if_/https://twitter.com/humansofflat https://web.archive.org/web/20190426022335if_/https://twitte...
bjt2n3904 5y ago
Whenever someone says they want to study anything relating to "misinformation", it's almost a guarantee they're looking to solve human problems with technical solutions. Oh look: "Rally has the potential to help address societal problems we could not solve before." No, I don't think it does. Especially when the first thing you tout is a study on "misinformation about COVID". The fact that American's are locked in a bitter political cold war with each other is not a technological problem, and does not have a technological solution. It's like trying to help a couples on the brink of divorce by updating their phones with new firmware, and changing how Facebook's algorithm works. The reason the couple is threatening divorce is 1% what happens ON their phones, and 99% what happens off their phones. We have to break away from this stupid idea that if only we studied what was happening on Twitter and Facebook we could fix our problems.
- 9wzYQbTYsAIc 5y ago
  > We have to break away from this stupid idea that if only we studied what was happening on Twitter and Facebook we could fix our problems. Analogously, to demonstrate absurdity, consider this statement: we have to break away from this stupid idea that if we studied what was happening on our crop fields and our roads we could fix our problems with agriculture and traffic.
- xpe 5y ago
  > Whenever someone says they want to study anything relating to "misinformation", it's almost a guarantee they're looking to solve human problems with technical solutions. What in your experience motivates you to say this?
  - errantmind 5y ago
    Not the OP but I think it is because of a lack of trust in institutions, due to an escalating culture war and tribalism. As an educated person interested in facts and science, there is a surprising lack of due diligence in the media around a lot of the current hot topic issues (not going to name them). Every time I do my own research on one of these issues, it is obvious the media and our institutions are more interested in supporting an official narrative than diving deep into the facts. Opposing opinions are just not 'allowed' anymore in some areas. I personally don't even trust people using the word 'misinformation' anymore, as it has been so abused
grawprog 5y ago
>Your data is valuable. Yet again though we're being asked to give it up for free... >But for too long, online services have pilfered, swapped, and exploited your data without your awareness. Privacy violations and filter bubbles are all consequences of a surveillance data economy. But what if, instead of companies taking your data without giving you a say, you could select who gets access to your data and put it to work for public good? So taking and benefitting from my data is alright as long as I'm aware of it? >But, being “data-empowered” also requires the ability to choose who you want to access your data. No...being data empowered would mean I'm profitting off my own data, not giving it to companies to profit off of. >We’re kickstarting the Mozilla Rally research initiative with our first two research collaborator studies. Our first study is “Political and COVID-19 News” and comes from the Princeton team that helped us develop the Rally research initiative. This study examines how people engage with news and misinformation about politics and COVID-19 across online services. And the first study in this is about politics, that great word again 'misinformation' that gets tossed around everywhere. So, the first study will be using user data on the news they read and how they interact on social media in regards to politics for what purpose exactly? This makes the world better how? >Soon, we’ll also be launching our second academic study, “Beyond the Paywall”, a study, in partnership with Shoshana Vasserman and Greg Martin of the Stanford University Graduate School of Business. It aims to better understand news consumption, what people value in news and the economics that could build a more sustainable ecosystem for newspapers in the online marketplace. So, the second study is 'how do we make news organizations more money?" I'm kind of noticing a pattern here... >With Rally, we’ve built an innovative, consent-driven data sharing platform that puts power back into the hands of people. No, you've found a way to convince people they should give you their data for 'research that benefits the world' that's in reality thinly veiled market research. It would be nice if a company could just be fucking honest for once. This whole blog post should just be: "Look, at Mozilla we realized we can make money collecting data, we're going to pretend we couldn't just take it from you and give you the option to opt in to make us money." Seriously, just fucking say it straight.
errantmind 5y ago
>What if, instead of companies taking your data without giving you a say, you could select who gets access to your data and put it to work for public good? Implied false dichotomy. What if I refuse to use companies that do not fully encrypt my data in such a a way as to them not having any access to it. Also, Mozilla isn't going even half this far. They are relying on a contractual obligation with their partners and internal audits to protect my identity. I'm skeptical of their ability to protect my data to the point I will never use this service.
grayrest 5y ago
Is this Mozilla Test Pilot with data sharing with outside researchers?
mhalle 5y ago
I think this is an interesting idea, but I don't know how well it scales.i think it is a high bar for individuals to explicitly manage every single donation of personal data. What I have thought might work is that individuals could donate their data to a non-profit entity that would have a legal responsibility to protect contributors' data. The non-profit would act as a data broker for researchers. It could sell aggregate data, but the sales would go to charitable causes. Contributors could opt out of specific research or specify specific charities. The result is a little like a non-profit data brokerage. It would put experts in charge of data protection and confidentiality, and it explicitly acknowledges that data has value. The broker would have legal recourse and financial means to track down data abuse.
Iwan-Zotow 5y ago
read it as "piracy-first data sharing platform"
RileyJames 5y ago
Interesting. I spent the past two days building a prototype which solves this problem for a specific use case “sharing search results”. Going to Show HN in a few days. This article is light on technical details, or even a high level how it works. I wonder how they solve the authenticity / validity of the data. Funnily enough the solution I’ve come up with isn’t compatible with Firefox due to api limitations.
brynjolf 5y ago
So they are practising on collecting more data but with the motivation that it is somehow for the good of society? It is still doing the one thing I don't want Mozilla to do, embrace data collecting, no matte the banner or motivation. Also universities through history have done numerous unethical studies, they don't automatically gain my trust or data because they pinky promise.
renewiltord 5y ago
Whatever. You can have my data for scientific purposes but if you fuck this up I will hunt down the PI and smear shit on nis door. You better keep the PI in America because I’m not doing an intercontinental to smear shit. I’m not reading your long ass blog post though. Make it a Chrome extension and stick the CTA in the first two sentences.
neighbour 5y ago
Tried reading through the page. No idea why it exists or what it even does. Why would anyone use this?

Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. There seems to be an assumption that users will be gleeful to throw their data at legitimate researchers from legitimate institutions doing legitimate work. What "data"? Browsing history? Identity? Something else? Why? What's in it for them? Since when was giving our data to third parties a good idea? There is literally no motivation presented here. As a nerd I can read between the lines—clearly they have come up with some sort of privacy-preserving data collection system that is useful. But at face value this whole article is just saying "hey use Firefox and give your data to scientists for reasons we don't bother to explain because obviously it's good."

grumblenum 5y ago
I read it as "we're protecting your privacy by increasing the number of people who can monitor your activity on our browser." Presumably, the users will be well-endowed and tax-advantaged institutions who could have just bought the information from data-aggregators anyway. I'm starting to see a theme of papering over their technology products with a lot of modern art and hyperbolic language. "Computer scientists, social scientists and other researchers will be able to launch groundbreaking studies about the web and invite you to participate." Wow. I'm about to make history with a browser add-on! "Our first study is “Political and COVID-19 News” and comes from the Princeton team that helped us develop the Rally research initiative." Groundbreaking! College students can now make sure that I am adequately fact-checked if I err from the path of truth.
- dhimes 5y ago
  College students can now make sure that I am adequately fact-checked if I err from the path of truth. I don't think they are "making sure" as in "enforcing." It sounds like they are observing and reporting, hopefully in an aggregated fashion.
- jonathanmayer 5y ago
  > Presumably, the users will be well-endowed and tax-advantaged institutions who could have just bought the information from data-aggregators anyway. Nope. This is an important point: the type of crowdsourced science that Rally enables is something that researchers couldn't do before. (With the exception of a very small number of teams who made massive investments in building single-purpose crowdsourcing infrastructure from the ground up.)
  - ysavir 5y ago
    Could you provide more detail on what makes it novel?
    - jonathanmayer 5y ago
      Common research methods have significant limitations. Web crawls, for instance, usually don't realistically simulate user activity and experiences. Lab studies often involve simplified systems that don't generalize to the real world. Surveys yield self-reported data, which can be very unreliable. Rally studies, by contrast, reflect real-world user activity and experiences. In science jargon, Rally enables field studies and intervention experiments with excellent ecological validity.
      - ysavir 5y ago
        Thanks for clarifying! Makes sense. A few follow up questions: 1. Do you expect the opt-in nature of these studies to impact their findings? 2. To compensate for the voluntary nature of the studies, do you think researchers in general will still be incentivized to find data sources that are less respectful of people's privacy and don't require an opt-in to the study?
        jonathanmayer 5y ago
        > 1. Do you expect the opt-in nature of these studies to impact their findings? The Rally participant population is not representative of the U.S. population—these are users who run Firefox (other browsers coming soon), choose to join Rally, and choose to join a study. In research jargon, there's significant sampling bias. For some studies, that's OK, because the research doesn't depend on a representative sample. For other studies, researchers can approximate U.S. population demographics. When a user joins Rally, they can optionally provide demographic information. Researchers can then use the demographics with reweighting, matching, subsampling, and similar methods to approximate a representative population. Those methods already appear throughout social science; whether they're sufficient also depends on the study. > 2. To compensate for the voluntary nature of the studies, do you think researchers in general will still be incentivized to find data sources that are less respectful of people's privacy and don't require an opt-in to the study? Rally is designed to provide a new research capability that didn't exist before. I don't expect a substitution effect like that.
deleted 5y ago
[deleted]
jonathanmayer 5y ago
Princeton research collaborator here. Glad to answer questions about Rally. > What "data"? Browsing history? Identity? Something else? That depends on the Rally study, since research questions differ and studies are required to practice data minimization. Each study is opt in, with both short-form and long-form explanations. Academic studies also involve IRB-approved informed consent. Take a look at our launch study for an example [1]. > Why? What's in it for them? Since when was giving our data to third parties a good idea? There is literally no motivation presented here. The motivation is enabling crowdsourced scientific research that benefits society. Think Apple Research [2], NYU Ad Observatory [3], or The Markup's Citizen Browser [4]. There are many research questions at the intersection of technology and society where conventional methods like web crawls, surveys, and social media feeds aren't sufficient. That's especially true for platform accountability research; the major platforms have generally refused to facilitate independent research that might identify problems, and platform problems often involve targeting and personalization that other methods can't meaningfully examine. [1] https://rally.mozilla.org/current-studies/political-and-covid-19-news/index.html https://rally.mozilla.org/current-studies/political-and-covi... [2] https://www.apple.com/ios/research-app/ https://www.apple.com/ios/research-app/ [3] https://adobservatory.org/ https://adobservatory.org/ [4] https://themarkup.org/citizen-browser https://themarkup.org/citizen-browser
- thombles 5y ago
  These "This Study Will Collect" and "How We Protect You" sections are really good. It probably wouldn't convince me personally to sign up, but it's as comprehensive as I would expect. It's a shame that these comments didn't make it into the blog post.
- chobytes 5y ago
  Personally I don't think that researchers have any more business doing this kind of surveillance than Google and company do. The idea that this will benefit society seems naive to me. I feel like it will only serve to legitimize the practice by putting ostensibly trustworthy faces on the packaging.
  - splistud 5y ago
DavideNL 5y ago
The answers seem explained quite clearly and are simple to find by just clicking the links in the article… “what data”,for example: https://rally.mozilla.org/privacy-policy/ https://rally.mozilla.org/privacy-policy/
JumpCrisscross 5y ago
Mozilla strikes me as an organisation with too many resources for its own good. They keep pursuing these random side gigs with limited unifying theme other than an excuse to spend money.
- tgsovlerkhgsel 5y ago
  Reminder that donations to Mozilla are not donations to Firefox development. The Mozilla Corp (makes Firefox) and Mozilla Foundation (gets donations) are mostly separate.
- 9wzYQbTYsAIc 5y ago
  Additional reminder that Mozilla just recently had to go through a round of layoffs. https://news.ycombinator.com/item?id=24120336 https://news.ycombinator.com/item?id=24120336
  - errantmind 5y ago
    The fact they have significantly more than 250 employees in the first place is a bit mind boggling. As far as I can tell most of the spending is unrelated to Firefox. What do all of these people do and why are they needed?
    - Nicksil 5y ago
      >The fact they have significantly more than 250 employees in the first place is a bit mind boggling. As far as I can tell most of the spending is unrelated to Firefox. What do all of these people do and why are they needed? I sometimes have the same reaction when learning the number of people employed for what I would have otherwise thought to be some meager thing. Then I get reminded about the folks over in external/internal support; marketing; design; IT/infrastructure; legal; compliance; etc. Here's Mozilla's listing: https://careers.mozilla.org/listings/ https://careers.mozilla.org/listings/
      - errantmind 5y ago
elliekelly 5y ago
> privacy-preserving data collection system I hate this. Viscerally. Why, why, WHY does every “privacy first” system, platform, whatever, start with the presumption that some people should get your data and it’s just a matter of vetting the “good” groups from the “bad” groups. No. That isn’t privacy. No one should get my data. And it’s ridiculous that all of these companies try to position their data grabbing projects as “privacy” oriented when what they really mean is they’re not quite as invasive and/or are slightly more transparent about their data theft compared to others. </rant>
- jefftk 5y ago
  Rally is entirely opt-in, so I think you're off the mark here?
- 9wzYQbTYsAIc 5y ago
  > start with the presumption that some people should get your data Some people do want others to have their data. Dropbox is a great example of a successful business that is built on the idea of sharing data.
  - Ensorceled 5y ago
    Yes, I want to use Dropbox to share my invoice with my client and my client to share the assets from their designer with me. I don't want anybody tracking what websites I visit, articles I read or facebook videos I watch. These are two VERY different definitions of "data", mingling the two is not helpful to discourse.
    - Nicksil 5y ago
      >I don't want anybody tracking what websites I visit, articles I read or facebook videos I watch. This whole thing is opt-in, is it not? If you don't want to share your information, you simply do not opt-in.
      - Ensorceled 5y ago
9wzYQbTYsAIc 5y ago
> Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. It does appear that this piece was written by Mozilla, themselves… on their own blog.
- xpe 5y ago
  >> Whoever wrote this piece is way too close to... whatever it is Mozilla is doing here. > It does appear that this piece was written by Mozilla, themselves… on their own blog. Haha! Captain Obvious strikes again. Joking aside, I think the other commenter knew the post was written by someone at Mozilla on the Mozilla web site. Their point, I think, was that the author didn't do a good job of selling Rally.
  - 9wzYQbTYsAIc 5y ago
    Heh, nice one. Could be, yeah. My estimation is that Mozilla was making a desperately concerted effort to signal that they are not at fault in the Big Tech wars.
throwaway81523 5y ago
Yep. "Privacy first" and "data sharing" don't belong in the same sentence.
joshspankit 5y ago
I was really excited for most of the time reading thinking “A privacy-first general data store that lets us donate insights for the common good, and may even end up being a marketplace where we can choose to sell data. This is so cool! I hope they have a mobile app so I can record things like what I ate for supper or how long I looked at a screen today” But, it seems like they’re just tracking browser behaviour, and there’s absolutely zero place for people to add their own data? Why bother giving it a branded name then? Why not “crowd-sourced browser behaviour study in partnership with ____”?

swiley 5y ago

So they don't have enough manpower to maintain features people actually want (like the JavaScript toggle in settings which Chrome apparently has) but they do to make things no one will use that will get shut down in a few years?

williamtwild 5y ago
Odds are its funded by whomever is doing the study and is unrelated the browser at all.
- hosteur 5y ago
  If that is the case then it should be done as an extension. And why would Mozilla use its brand capital on this?
  - bilkow 5y ago
    It is an extension: https://addons.mozilla.org/en-US/firefox/addon/mozilla-rally/ https://addons.mozilla.org/en-US/firefox/addon/mozilla-rally... https://github.com/mozilla-rally/rally-core-addon/ https://github.com/mozilla-rally/rally-core-addon/

denton-scratch 5y ago

The best way to put "privacy first" is not to share your data. This article title is arse-over-tit.

smitty1e 5y ago
But if your knowledge tree falls in the forest, and no one hears of it, then how do the data sound? Somewhere between hermit-style hoarding and totally wide open there may be a collaborative sweet spot.
- m0ngr31 5y ago
  Why? Seems to me I get absolutely nothing from this other than a wink from Mozilla that my data can't identify me.
  - 9wzYQbTYsAIc 5y ago
    > The motivation is enabling crowdsourced scientific research that benefits society. https://news.ycombinator.com/item?id=27630188 https://news.ycombinator.com/item?id=27630188

WA 5y ago

Surprisingly difficult to understand what this thing is or does. Seems like you can "donate" your browsing behavior to science for doing studies in a kinda anonymous privacy protecting way.

kevincox 5y ago
It doesn't even sound anonymous. It sounds like they just audit that the partner aggregates the data once delivered to them. Some sort of pinky-promise.
- 9wzYQbTYsAIc 5y ago
  > Some sort of pinky-promise. Nope. > * research partners are contractually obligated to abide by these procedures and protect your data.* https://rally.mozilla.org/how-rally-works/faqs/ https://rally.mozilla.org/how-rally-works/faqs/
  - Ensorceled 5y ago
    Lots of abuses of data are "contractually" forbidden.
    - 9wzYQbTYsAIc 5y ago
      Contracts are legal constructs that ultimately have the threat of force of violence through law enforcement as their recourse.
  - caconym_ 5y ago
    But, realistically, what recourse do users have if there's a breach? A few years ago I got a letter from Washington State University saying that they'd obtained my personal health data (which I never directly consented to, nor had I interacted with WSU in any way prior to receiving this latter) and subsequently allowed it to be stolen by unknown malicious actors. In case you're curious, they kept the data on an unencrypted hard drive in a physical safe that was then physically stolen. There was some class action pittance that meant nothing to me, and WSU does not seem to have been subject to any meaningful consequences. It seems to be viewed as a cost of doing business sort of thing. For all of us who had their data stolen, the horse has left the barn, and I see no real deterrent effect. This seems to be the norm when data breaches happen. So while "pinky promise" might be a bit hyperbolic, there is a lot of truth to it in general and I don't know how this case is supposed to be any different. If there is some paradigm-breaking accountability mechanism built in, I'd love to hear more about it.

quadrifoliate 5y ago

I like that you can run your own versions of these studies, e.g. https://github.com/mozilla-rally/rally-study-01 https://github.com/mozilla-rally/rally-study-01 to collect your own data. I think it would be a novel idea to make this the primary focus of the project, enabling users to see and understand their own data before donating it to research projects. For example, I know that the study above is called "Your Time Online and 'Doomscrolling'", but I don't have much of an idea on how they plan to quantify doomscrolling via attention or audio events. I managed to get a reasonable idea from https://rally.mozilla.org/current-studies/your-time-online-and-doomscrolling/ https://rally.mozilla.org/current-studies/your-time-online-a... and https://github.com/mozilla-rally/rally-study-01/blob/master/DATA_SCHEMA.md https://github.com/mozilla-rally/rally-study-01/blob/master/... though, so it's possible I just need to put in more effort as a user :)

9wzYQbTYsAIc 5y ago
> I don't have much of an idea on how they plan to quantify doomscrolling via attention or audio events. It seems that what they’ve done is told us exactly what data they will collect but have left it unanswered as to what specific social science methodologies they will use to analyze the data. It is very likely that their intention is to not set that expectation with the data crowdsourcers so that the researchers have the flexibility to adjust their methodological approaches in an iterative fashion.

ttt0 5y ago

Mozilla, the company that says "we need more than deplatforming", wants me to contribute to the research that will be used for censoring the internet? No thanks.

visarga 5y ago
They were talking about Trump's attack rally, and this was published on 8th of Jan.
- ttt0 5y ago
  It's clearly tied to this research, and the purpose of it is also pretty clear. Technology is technology. It doesn't care about morality and what's right or wrong.
  - 9wzYQbTYsAIc 5y ago
    > Technology is technology. It doesn't care about morality and what's right or wrong. That is rather uninformed. There is a growing body of research on embedding ethics into technology. https://link.springer.com/article/10.1007/s00146-020-01010-1 https://link.springer.com/article/10.1007/s00146-020-01010-1
    - ttt0 5y ago
      It doesn't mean anything. You have zero guarantees that anything like that will be actually applied. The government and its military won't ever care about it. This is just some research while we have surveillance technology and weapons controlled by the AI right now. Get real.
      - 9wzYQbTYsAIc 5y ago
        That’s rather nihilistic. How exactly are academic researchers supposed to guarantee that their research will be applied for the good of humanity? Government is you and me and everyone else. If you want government to care about it, write to them and tell them to care about it. They probably aren’t going to care about random comments on HN. Research on ethical machines has been taking place since the dawn of the drone age and has already guided military policy. You can find the supporting evidence of that for yourself if you search for it.

tokai 5y ago

Nothing on if studies based on this will be published as Open Access. I can see that Jonathan Mayer's latest publications are all published without OA so that doesn't bode well for the covid news study. And ironically are the 'Beyond the Paywall' researchers no better at publishing Open research.

Yaina 5y ago

It's not easy to understand, especially from the blog post alone, but as far as I understand it, the proposition is the following: Big companies have the ability to do research on users all the time, either by doing anonymous studies or by tracking you for their ad networks. This is a luxury many researchers that work outside of these big tech companies don't have, which creates a scientific power imbalance. Mozilla Rally is meant to give these capabilities to everyone, and the platform is meant to ensure that you always know what you sign up for and what data is being used. If I understand the Princeton example correctly: They want to figure out how people consume and spread misinformation. Social networks like Facebook have all that data but won't share it. Now you can opt-in to a Rally study where independent researchers can examine the data.

9wzYQbTYsAIc 5y ago
> Now you can opt-in to a a Rally study where independent researchers can examine the data. It would have been great if they’d invested the resources to use Solid, here.
- xpe 5y ago
  Thanks for mentioning this. Two questions: 1. In your experience, what is the maturity level of Solid? 2. Would you mind sketching out how you would do the integration with Solid? I'm reading over https://solidproject.org/users/get-a-pod https://solidproject.org/users/get-a-pod but haven't spend a lot of brain cycles on it yet.
  - 9wzYQbTYsAIc 5y ago
    You’re welcome! I’m in the same boat as you - haven’t spent many brain cycles on it yet. Mozilla Rally would have been the perfect proof-of-concept for putting that idea to use and giving it a shakedown. Generally, Solid seems to be pretty grounded in its attempt to resolve data sharing privacy concerns. My understanding is that the implementations would be about the same as using browser storage. I believe developers would need to approach data access from the perspective of “an infinitely sharded document database - shards are globally-uniquely identifiable - shards are remotely distributed - shards have their own IAM - for each shard, you must register as an authorized user and authenticate to access remote data”

austincheney 5y ago

If there is data going to research this isn’t completely private. I wrote a data sharing platform for the browser that is privacy focused. Privacy first means I couldn’t give any data to any third party no matter how much I want to because the platform won’t let me. https://github.com/prettydiff/share-file-systems https://github.com/prettydiff/share-file-systems

vcavallo 5y ago

What’s up with all the black flags and raised fists?

gmb2k1 5y ago
It's a demonstration of their political stance. Radical left.

zenlf 5y ago

I understand there is a perfectly legitimate need and reason to do what they do. However “privacy-first data sharing” sounds like doublespeak to me. In the same vein as the famous “war is peace, freedom is slavery.”

9wzYQbTYsAIc 5y ago
> sounds like double speak That’s rather cynical. What’s wrong with someone wanting to share their data with certain people while also demanding that those people respect the data’s privacy?
- errantmind 5y ago
  You keep accusing people of being nihilistic / cynical in this thread. It isn't cynical to be extremely skeptical of any company's ability to keep your data private and safe given the constant barrage of breeches and ethical violations. Maybe I'm in the minority but Mozilla's brand had been permanently tarnished in recent years and I do not think of them as a 'privacy first' organization
  - 9wzYQbTYsAIc 5y ago
    > It isn't cynical to be extremely skeptical of any company's ability to keep your data private and safe By dictionary definition, cynicism is an attitude of scornful or jaded negativity, especially a general distrust of the integrity or professed motives of others. Skepticism is defined as the doubt as to the truth of something. Extreme doubt as to the integrity of a company’s data privacy practices is the dictionary definition of cynicism.
  - 9wzYQbTYsAIc 5y ago
    > Mozilla's brand had been permanently tarnished in recent years Indeed, Google may have out-competed them on the marketing messaging front.
  - 9wzYQbTYsAIc 5y ago
    > I do not think of them as a 'privacy first' organization I won’t pry, but I suspect that you are not a web developer, by trade. It is common knowledge in the web development field that Mozilla is a, if not the, standard bearer for consumer privacy protection in the browser wars. Safari is currently taking the helm, though.

HugoDaniel 5y ago

Just do a proper browser

gopiandcode 5y ago

Looking through the FAQ, It seems like Rally requires users to send their raw data straight to the aggregation service, with the only privacy guarantees being that the data is encrypted during transport, and a "promise" that they will run internal audits to make sure private data isn't released from their servers. IMO this seems to provide worse privacy than even Google and Micro$oft's telemetry, which at least use differential privacy to make sure that each individual's privacy is somewhat protected (the data you send is randomised so even if the aggregator is compromised by a malicious third party (e.g. NSA) individuals have some degree of plausible deniability). Sure, Mozilla's intentions may be more "pure" (or is that just their propaganda speaking?), but in terms of privacy guarantees this seems like it is a strict downgrade, that abuses their goodwill to hide its deficiencies.

jonathanmayer 5y ago
> with the only privacy guarantees being that the data is encrypted during transport, and a "promise" that they will run internal audits to make sure private data isn't released from their servers. There's much more than that, including: privacy and security review before a study launches, a data minimization requirement, a sandboxed data analysis environment with strict access controls, and IRB oversight for academic studies. > IMO this seems to provide worse privacy than even Google and Micro$oft's telemetry, which at least use differential privacy to make sure that each individual's privacy is somewhat protected (the data you send is randomised so even if the aggregator is compromised by a malicious third party (e.g. NSA) individuals have some degree of plausible deniability). The vast majority of Google and Microsoft telemetry does not involve local differential privacy. Google, in fact, has almost entirely removed local differential privacy (RAPPOR) from Chrome telemetry [1]. We've been examining the feasibility of local differential privacy for Rally. The challenge for us—and why local differential privacy has limited deployment—is that the level of noise makes answering most (often all) research questions impossible. [1] https://bugs.chromium.org/p/chromium/issues/detail?id=1016906 https://bugs.chromium.org/p/chromium/issues/detail?id=101690...
- skybrian 5y ago
  Interesting. I can see that RAPPOR seems to be deprecated in favor of something else called ukm (Url-keyed metrics) but not why this change is being made. Is there somewhere I can read more about it?

luke2m 5y ago

Disclaimer: will be killed in a few months

Nicksil 5y ago
>Disclaimer: will be killed in a few months You're thinking of Google. This is Mozilla.
- luke2m 5y ago
  FF Send, FF Notes, Positron, FF OS, Appmaker, and Deuxdrop to name a few. They tend to keep more stuff around than Google, but still cancel things that I like frequently.
- lawl 5y ago
  > You're thinking of Google. This is Mozilla. Well, it is really difficult to tell them apart these days. Mozilla does like to copy everything google does, if you look at firefox.
  - Nicksil 5y ago
    >Well, it is really difficult to tell them apart these days. Mozilla does like to copy everything google does, if you look at firefox. Indeed similarities exist. Still, no where close.

eitland 5y ago

For any Mozilla people here: How do you feel that this is prioritized and the Tab Strip API is not? (Edit, this issue:https://bugzilla.mozilla.org/show_bug.cgi?id=1332447 https://bugzilla.mozilla.org/show_bug.cgi?id=1332447) My background: I'm a "loyal" user, but not because of love anymore but because the alternatives are even worse in my opinion. I have given up Mozilla the non-profit the last few years but will continue to use Firefox because of ergonomics and politics for now. If someone can convince me Pale Moon is safe enough to use at work I'd switch in a heartbeat though. Same if someone starts maintaining a paid (or unpaid) fork of the latest Firefox that actually reimplements the Tab Strip API for web extensions and starts reimplementing the rest of the missing APIs. (If this triggers an idea in a brilliant hacker here then create a kickstarter and mail me about it: I'm easily in on $10 a month, maybe more. I'm looking for a work browser that won't depend on Chromium when Google finally decides it is time to kill the extension API on desktop as well.) PS: Even though I have given up Mozilla I'm still looking for a way to help fund Firefox as long as I know it is used for Firefox and not for running it into the ground.

yyyk 5y ago

This is exactly the data a modern Cambridge Analytica would want (e.g. shares, time spent on each post, all correlated to demographics). I hope this platform has controls to ensure that study data isn't misused post-study for non-study purposes, because the FAQ answer isn't so encouraging[0]. [0] https://rally.mozilla.org/how-rally-works/faqs/#what-happens-after-the-study-ends https://rally.mozilla.org/how-rally-works/faqs/#what-happens... "With Mozilla’s permission, researchers may retain aggregated or de-identified datasets for their analyses. Mozilla may also retain aggregated data sets which we may release in the public good to foster an open web." Shouldn't you ask the users for permission on using their aggregate data for purposes that could be different to the study they enrolled to?

9wzYQbTYsAIc 5y ago
> Shouldn't you ask the users for permission on using their aggregate data for purposes that could be different to the study they enrolled to? They do, given that you’d have been informed of that before you provided your consent by opting in to Rally data crowdsourcing. > This is exactly the data a modern Cambridge Analytica would want Kind of nice that it’d be in the hands of Mozilla, Princeton University, other trusted research partners, and the open web, isn’t it?
- yyyk 5y ago
  >They do, given that you’d have been informed of that before you provided your consent by opting in to Rally data crowdsourcing. I haven't tried registering for the study, but I note that an FAQ answer is not enough. Users cannot be expected to search for the FAQ. This needs to be mentioned in the consent form, and not done implicitly 'by opting in' like corporations do. >Kind of nice that it’d be in the hands of Mozilla, Princeton University, other trusted research partners, and the open web, isn’t it? The 'open web' is a bit of a nebulous concept, and the CA data was supposedly in the hands of a data scientist at the University of Cambridge.
- lawl 5y ago
  > Kind of nice that it’d be in the hands of Mozilla, Princeton University, other trusted research partners, and the open web, isn’t it? No? It'd be much better to not collect that data at all.

deleted 5y ago

[deleted]

fnord77 5y ago

so, only approved research partners gets the ability to post studies and access data?

9wzYQbTYsAIc 5y ago
> What is the criteria for becoming a partner? Currently, we are working with a small number of reputable research teams who match our commitment to your safety and trust and who also have the technical expertise to help us build Rally’s scientific capabilities. All partners are required to sign an agreement with Mozilla. This agreement upholds the researcher’s rights to independence in their research, while mandating the safeguards they must follow in order to protect our users. In the future, we will expand beyond our pilot partners. Please contact us if you are interested in becoming a partner! https://rally.mozilla.org/how-rally-works/faqs/#partner-criteria https://rally.mozilla.org/how-rally-works/faqs/#partner-crit...

alexshendi 5y ago

Am I the only one who has read "Piracy First"?

Iwan-Zotow 5y ago
MeToo thought, finally, us, pirates, will have good sharing platform

lykahb 5y ago

I think that it is important to create a precedent of mass data collection that reveals to the users what is collected and gives tools to manage it. The legislators can use it as a blueprint to require a similar level of disclosure from other companies that do online surveillance. However, I do not see what value Rally offers to the enrolled users.

miked85 5y ago

I am failing to see the motivation for anyone to use this. If you cared about privacy, you wouldn't share your data in the first place. If you didn't care about privacy, there is still no reason to opt in.

9wzYQbTYsAIc 5y ago
> The motivation is enabling crowdsourced scientific research that benefits society. https://news.ycombinator.com/item?id=27630188 https://news.ycombinator.com/item?id=27630188
- lawl 5y ago
  > crowdsourced scientific research that benefits society. how, in your words, would the covid19 news misinformation study benefit society?
  - 9wzYQbTYsAIc 5y ago
    One example, without having read further into that particular study, but knowing what misinformation research tries to do, generally, would be the following: Identifying the specific mechanisms behind the dark patterns of social engineering. There is a body of research, for example, that considers the spread of rumors by making use of the same mathematical models that epidemiology uses to model the spread of infectious disease (virality, in particular). As I recall, that body of research led to the conclusion that the best weapon against misinformation may be the liberal and broad application of truth-telling.
errantmind 5y ago
Agreed. I'm in the former group. You aren't getting my data, stop trying. That may seem harsh, but that is where I'm at. I'm really put off by the idea of sharing my data these days. I don't trust Mozilla's internal audit process to keep it safe, but it isn't specific to them. Outside of maybe a two companies who are 'encryption-first', I don't trust any of them
renewiltord 5y ago

notjustanymike 5y ago

Corporate Memphis strikes again!

chobytes 5y ago

This is an awfully generous way to present what looks like yet another in-browser advertising platform.

hndirect 5y ago

Sorry if this is too off topic, but is there a name for the art style they are using in the illustrations? It seems to be all over corporate sites these days.

caseyohara 5y ago
That design style is called "Corporate Memphis" (https://en.wikipedia.org/wiki/Corporate_Memphis https://en.wikipedia.org/wiki/Corporate_Memphis) and you're right it is pervasive. Here's a YouTube video about it if you're curious: Why do "Corporate Art styles" Feel Fake? https://www.youtube.com/watch?v=lFb7BOI_QFc https://www.youtube.com/watch?v=lFb7BOI_QFc
Nicksil 5y ago
"Corporate Memphis," perhaps? Previous HN discussion: https://news.ycombinator.com/item?id=27107820 https://news.ycombinator.com/item?id=27107820 Wikipedia: https://en.wikipedia.org/wiki/Corporate_Memphis https://en.wikipedia.org/wiki/Corporate_Memphis Edit: I had this open in a tab for ~20 mins. which is why I didn't see caseyohara's reply before submitting mine. Please excuse the redundancy.
alphabet9000 5y ago
used to be a nice twitter blog documenting the style, but it got suspended at some point: https://web.archive.org/web/20190426022335if_/https://twitter.com/humansofflat https://web.archive.org/web/20190426022335if_/https://twitte...

bjt2n3904 5y ago

Whenever someone says they want to study anything relating to "misinformation", it's almost a guarantee they're looking to solve human problems with technical solutions. Oh look: "Rally has the potential to help address societal problems we could not solve before." No, I don't think it does. Especially when the first thing you tout is a study on "misinformation about COVID". The fact that American's are locked in a bitter political cold war with each other is not a technological problem, and does not have a technological solution. It's like trying to help a couples on the brink of divorce by updating their phones with new firmware, and changing how Facebook's algorithm works. The reason the couple is threatening divorce is 1% what happens ON their phones, and 99% what happens off their phones. We have to break away from this stupid idea that if only we studied what was happening on Twitter and Facebook we could fix our problems.

9wzYQbTYsAIc 5y ago
> We have to break away from this stupid idea that if only we studied what was happening on Twitter and Facebook we could fix our problems. Analogously, to demonstrate absurdity, consider this statement: we have to break away from this stupid idea that if we studied what was happening on our crop fields and our roads we could fix our problems with agriculture and traffic.
xpe 5y ago
> Whenever someone says they want to study anything relating to "misinformation", it's almost a guarantee they're looking to solve human problems with technical solutions. What in your experience motivates you to say this?
- errantmind 5y ago
  Not the OP but I think it is because of a lack of trust in institutions, due to an escalating culture war and tribalism. As an educated person interested in facts and science, there is a surprising lack of due diligence in the media around a lot of the current hot topic issues (not going to name them). Every time I do my own research on one of these issues, it is obvious the media and our institutions are more interested in supporting an official narrative than diving deep into the facts. Opposing opinions are just not 'allowed' anymore in some areas. I personally don't even trust people using the word 'misinformation' anymore, as it has been so abused

grawprog 5y ago

>Your data is valuable. Yet again though we're being asked to give it up for free... >But for too long, online services have pilfered, swapped, and exploited your data without your awareness. Privacy violations and filter bubbles are all consequences of a surveillance data economy. But what if, instead of companies taking your data without giving you a say, you could select who gets access to your data and put it to work for public good? So taking and benefitting from my data is alright as long as I'm aware of it? >But, being “data-empowered” also requires the ability to choose who you want to access your data. No...being data empowered would mean I'm profitting off my own data, not giving it to companies to profit off of. >We’re kickstarting the Mozilla Rally research initiative with our first two research collaborator studies. Our first study is “Political and COVID-19 News” and comes from the Princeton team that helped us develop the Rally research initiative. This study examines how people engage with news and misinformation about politics and COVID-19 across online services. And the first study in this is about politics, that great word again 'misinformation' that gets tossed around everywhere. So, the first study will be using user data on the news they read and how they interact on social media in regards to politics for what purpose exactly? This makes the world better how? >Soon, we’ll also be launching our second academic study, “Beyond the Paywall”, a study, in partnership with Shoshana Vasserman and Greg Martin of the Stanford University Graduate School of Business. It aims to better understand news consumption, what people value in news and the economics that could build a more sustainable ecosystem for newspapers in the online marketplace. So, the second study is 'how do we make news organizations more money?" I'm kind of noticing a pattern here... >With Rally, we’ve built an innovative, consent-driven data sharing platform that puts power back into the hands of people. No, you've found a way to convince people they should give you their data for 'research that benefits the world' that's in reality thinly veiled market research. It would be nice if a company could just be fucking honest for once. This whole blog post should just be: "Look, at Mozilla we realized we can make money collecting data, we're going to pretend we couldn't just take it from you and give you the option to opt in to make us money." Seriously, just fucking say it straight.

errantmind 5y ago

>What if, instead of companies taking your data without giving you a say, you could select who gets access to your data and put it to work for public good? Implied false dichotomy. What if I refuse to use companies that do not fully encrypt my data in such a a way as to them not having any access to it. Also, Mozilla isn't going even half this far. They are relying on a contractual obligation with their partners and internal audits to protect my identity. I'm skeptical of their ability to protect my data to the point I will never use this service.

grayrest 5y ago

Is this Mozilla Test Pilot with data sharing with outside researchers?

mhalle 5y ago

I think this is an interesting idea, but I don't know how well it scales.i think it is a high bar for individuals to explicitly manage every single donation of personal data. What I have thought might work is that individuals could donate their data to a non-profit entity that would have a legal responsibility to protect contributors' data. The non-profit would act as a data broker for researchers. It could sell aggregate data, but the sales would go to charitable causes. Contributors could opt out of specific research or specify specific charities. The result is a little like a non-profit data brokerage. It would put experts in charge of data protection and confidentiality, and it explicitly acknowledges that data has value. The broker would have legal recourse and financial means to track down data abuse.

Iwan-Zotow 5y ago

read it as "piracy-first data sharing platform"

RileyJames 5y ago

Interesting. I spent the past two days building a prototype which solves this problem for a specific use case “sharing search results”. Going to Show HN in a few days. This article is light on technical details, or even a high level how it works. I wonder how they solve the authenticity / validity of the data. Funnily enough the solution I’ve come up with isn’t compatible with Firefox due to api limitations.

brynjolf 5y ago

So they are practising on collecting more data but with the motivation that it is somehow for the good of society? It is still doing the one thing I don't want Mozilla to do, embrace data collecting, no matte the banner or motivation. Also universities through history have done numerous unethical studies, they don't automatically gain my trust or data because they pinky promise.

renewiltord 5y ago

Whatever. You can have my data for scientific purposes but if you fuck this up I will hunt down the PI and smear shit on nis door. You better keep the PI in America because I’m not doing an intercontinental to smear shit. I’m not reading your long ass blog post though. Make it a Chrome extension and stick the CTA in the first two sentences.

neighbour 5y ago

Tried reading through the page. No idea why it exists or what it even does. Why would anyone use this?