8 ms·

Mozilla: *Privacy Not Included

113 points by Engineering-MD 5y ago

Wowfunhappy 5y ago
I really don't like this website. The criteria appears to be "things Mozilla thinks technology companies should be doing", and not necessarily related to privacy. For example—sites get downgraded if they don't require strong passwords. Now, maybe websites should require strong passwords, that's a completely reasonable position to take. But if you, the user, are using a strong password, whether or not others are required to use strong passwords has no impact on your privacy. Especially because privacy ≠ security.
- Engineering-MD 5y ago
  All good points, thanks for your input. I liked it as I haven’t seen a similar ones from a reptile company but agree it could be better.
  - grey_earthling 5y ago
    > I haven’t seen a similar ones from a reptile company I know this is a typo, but it's also an excellent pun.
    - RepZilla 5y ago
      Red Firefox Cult - Repzilla! Blue Oyster Cult - Godzilla.
    - yakubin 5y ago
      What is it a typo of?
      - nightcracker 5y ago
        Presumably reputable.
      - deleted 5y ago
        [deleted]
- Stampo00 5y ago
  I agree. This site seems unnecessarily inflammatory and confrontational. Purely elitist PR publicity nonsense instead of educational. It's a bad look on Mozilla and it turns me off. Talk up your own features instead of smearing other people's products. Products that aren't even your competition, I might add! It's flame bait for its own sake, trying to take advantage of outrage culture in an attention economy. Be better, Mozilla.
- CodesInChaos 5y ago
  > if you, the user, are using a strong password, whether or not others are required to use strong passwords has no impact on your privacy That only applies if the site only gives you access to your own data. If your friends grant you access to some of their data, your poor security compromises their privacy.
- dane-pgp 5y ago
  > whether or not others are required to use strong passwords has no impact on your privacy. It's worth considering, though, that attackers may target sites that don't mandate strong passwords, because the password hashes in the site's database are likely to be easier to crack (and users with simple passwords are likely to reuse those passwords). Once an attacker has chosen to target that site, that increases the chances that they find themselves able to read your data regardless of the password you used, because they'll have access to the whole database. In fact, a site which hasn't put the engineering effort into enforcing strong passwords (not even a simple regex, let alone more complex approaches like checking for compromised passwords against the haveibeenpwned database) is also likely to have undervalued security in other areas, again making them a target.
  - Wowfunhappy 5y ago
    It also works the other way though. If attackers target the site, they'll know some users have weak passwords, so if you have a strong password, they'll move on quickly to easier targets. I'd say on the whole it evens out.
    - thephyber 5y ago
      I don’t see this as even remotely “evening out” the parent comment. If a site mandates strong passwords, it is more likely to follow other best practices like throttling login attempts and locking accounts after too many failed attempts (either per account or per IP). If attackers target the site, they should only have a limited number of attempts before they start getting thwarted. It would take a lot of attempts (exact numbers will vary) just to determine if a given user’s credentials are strong or not, so the adversary has already wasted significant effort on the accounts they will eventually “move on” from. If the site has throttling and/ or account lockout, the adversary should not be able to determine who has weak versus strong passwords.
      - h_anna_h 5y ago
        > and locking accounts after too many failed attempts (either per account This is not a best practice, this is a DoS.
- Grieving 5y ago
  > sites get downgraded if they don't require strong passwords Assuming "strong", as usual, means uses upper+lower letters, numbers, symbols, etc., this directly contradicts NIST's current password recommendations. They recommend enforcing a minimum length instead, and recommend a "minimum minimum" of 8. They also recommend checking passwords against a set of the most common ones from leaks. The NCSC's top 100k list is good (pre-filtering those under your minimum helps too--only 47k remain after removing pws under 8 chars): https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt https://github.com/danielmiessler/SecLists/blob/master/Passw...
  - France_is_bacon 5y ago
    From my understanding, the only real way to create a password is to make it really, really long. Like, "Sometimes 10 people will get together on Friday night. Wow!" Or whatever you want. Makes it easy to remember. Personally I just usually string a bunch of random numbers and upper/lower/special characters - 40 of them. Just like this: https://www.youtube.com/watch?v=rERApU26PcA https://www.youtube.com/watch?v=rERApU26PcA
    - slapfrog 5y ago
      I tried long memorable passphrases for a time, but a few of my passphrases were not as memorable as I expected and I ended up having to reset several of them. Eventually I got fed up with it and switched to an offline FOSS password manager and use generated passwords from that. To unlock the password manager, I use a single long passphrase that I am confident I can remember. Now I worry that I'm putting all my eggs in one basket, but at least my passwords won't be guessed or forgotten.
      - France_is_bacon 5y ago
        Right. I always make sure to write them all down, as I won't remember either. But they are to make sure that random hackers don't gain access. Nobody is really going to break into my office and steal my passwords, as I am not an international spy.
- tuukkah 5y ago
  The site has a section that explains the criteria including that Mozilla didn't decide on them alone but with other non-profits. Regarding passwords: "If the product uses passwords for remote authentication, it must require that strong passwords are used, including having password strength requirements. Any non-unique default passwords must also be reset as part of the device’s initial setup. This helps protect the device from vulnerability to guessable password attacks, which could result in a compromised device." https://foundation.mozilla.org/en/privacynotincluded/about/meets-minimum-security-standards/ https://foundation.mozilla.org/en/privacynotincluded/about/m...
- ezoe 5y ago
  The most absurd claims are for the Nintendo Switch. They blame it for having a third-party software which collect real vehicle driving data and send its data to the third-party's server. https://foundation.mozilla.org/en/privacynotincluded/nintendo-switch/ https://foundation.mozilla.org/en/privacynotincluded/nintend... By the same logic, Firefox has a third-party software(Hacker News) which collect and send data to the third-party's server. Gosh I shall be scared. Or they are so lacking the technical analysis. Lego apps for example: https://foundation.mozilla.org/en/privacynotincluded/lego-hidden-side-graveyard-mystery/ https://foundation.mozilla.org/en/privacynotincluded/lego-hi... They conclude it's safe because they can use it offline... after they download and install the special smartphone apps to their smartphone. Seriously I see no smartphone that honor my privacy. By using the smartphone, it's already fail. Also, It seems they don't say that based on reverse engineering effort to make sure the app do nothing wrong. If I was a malicious app developer, I just store the data to the local storage and upload it the next convenient time the network access is available.
that_guy_iain 5y ago
One was on there because last year they didn't meet their "security standards" whatever those are but this year they do. So they improve in your eyes but you're still going to bash on them. Another one was that in the past there was a security hole. Those were the first two items I clicked. Honestly, I think this is the worst Mozilla thing I've seen. It's all preachy on things from the past.
teddyh 5y ago
For an even more strict selection, I suggest H-Node: https://h-node.org/hardware/catalogue/en https://h-node.org/hardware/catalogue/en
banana_giraffe 5y ago
The first thing I looked at, the Google Nest Protect says: Microphone: Device: Yes Tracks Location: Device: Yes Biometric: Voice recordings Huh? There's no GPS, no mic (at least, there are no voice based features, and teardowns I've seen haven't spotted a mic). There might be reasons to not want one, for sure, but inventing reasons isn't a good sign. Edit: I was wrong, ignore me.
- chewmieser 5y ago
  It does definitely have a mic but it's supposedly only used for sound checks (and audio never leaves the device): https://support.google.com/googlenest/answer/9250972?hl=en https://support.google.com/googlenest/answer/9250972?hl=en
  - banana_giraffe 5y ago
    Fair enough, that's still a long ways from recording my voice all the time. Now I need to revisit the teardowns I've seen to see how they missed this.
- auslegung 5y ago
  It might track location via Wi-Fi.
- jamesgeck0 5y ago
  The Nest device doesn't use GPS, but it does use a variety of sensors (sound, IR, etc) to try to determine if you're home or not, thus technically establishing your location.
- vetinari 5y ago
  Technically, you don't need GPS for location tracking. All you need is to scan for BSSIDs around you and then check in a database, where in the world they are. Conveniently, Google has one such database ;). (That's also the reason why Android gates wifi network scanning behind location permission).
pseudo0 5y ago
So glad Mozilla laid off all their Servo devs to focus on what's really important: IoT sex doll privacy evaluations.
- lapetitejort 5y ago
  Snark aside, were I in the market for such a device, I would absolutely want to know how privacy focused it was. I appreciate that Mozilla includes the category in the list. They exist, people will buy them. There's no sense in acting like CES and plugging their ears whenever they're brought up.
- chomp 5y ago
  This is Mozilla Foundation, not Mozilla Corp.
  - nerdponx 5y ago
    Even better: this is where your donation money goes.
  - pseudo0 5y ago
    The corporation is a wholly owned subsidiary of the foundation. It's effectively one organization structured to minimize taxes. What exactly is your point anyways?
    - chomp 5y ago
      My point is that I find it difficult to understand your comment because the Foundation does 2 things - advocacy, and holds the trademarks. The Corp is the one who built out Servo, and due to a lack of foresight on management's part, amongst other things, had to cut costs due to a dwindling browser share. You sound like the non-profit should start funneling its money into the corporation to secure its finances. Why?
      - pseudo0 5y ago
        The corporation subsidizes the foundation, not the other way around. It's just a question of how much. Here's a toy example that illustrates Mozilla's situation. Let's say you have XYZ Corp and XYZ Foundation (501c3). XYZ Corp revenue (search engine deal): $90 XYZ Foundation revenue (donations): $10 Total revenue: $100 XYZ Corp costs (browser dev): $50 XYZ Foundation costs (advocacy, etc): $50 Total costs: $100 You have to spend the 501c3 income on appropriate costs first, so the $10 from the foundation revenue gets put towards the foundation's advocacy costs. The remainder ($40) gets covered by revenue from the corporation. Now let's say you cut $10 in advocacy costs from the foundation, realizing that it's more important to have a viable browser competitor to Chrome than sex doll privacy evaluations. Now the corporation reduces its transfer to $30, and has $10 left over to, say, avoid laying off devs when the search engine deal revenue drops. Fundamentally most of the money is fungible, and wasting money on unproductive initiatives takes money away from making Firefox a viable Chrome competitor.
perryizgr8 5y ago
> Google seems to do a better job than some of the other Big Tech companies when it comes to privacy. Huh??!
- slivanes 5y ago
  Google sells access to users, but doesn't share/sell user information.
  - jesboat 5y ago
    Same with Facebook.
  - wmf 5y ago
    Technically real-time bidding doesn't sell your information... it gives your information away for free.
- rasz 5y ago
  dont bite the hand that feeds you
- slapfrog 5y ago
  Mozilla knows what side their bread is buttered on.
chris_engel 5y ago
They say sonos does a good job on privacy. Did I miss something? Did they finally drop their approach of GPS-locating each speaker, phoning home what you listen to every couple of minutes and bricking the speakers to avoid re-sales?
antisthenes 5y ago
So this was the end-game for Mozilla? An Aliexpress like shop that tries to capitalize on whatever brand value they think they have left? Does the internet really need another janky affiliate page full of IoT crap? I've said it before and I'll say it again: guys, focus on making a good browser.
paulcarroty 5y ago
Cool to know Bose got lawsuit for stealing users data: https://www.businessinsider.com/bose-lawsuit-alleged-spy-headphone-users-app-2017-4 https://www.businessinsider.com/bose-lawsuit-alleged-spy-hea...
fragileone 5y ago
I wish there was a RSS feed of some kind available. Whether it be for a changelog, a Twitter feed or blog posts.
tuukkah 5y ago
I really don't like the comments here. Why do people assume that the Mozilla foundation is a clueless scammer? Before questioning their methods and motives, how about reading what the site says: "Welcome to Mozilla’s Privacy Not Included buyer’s guide. Our goal is to help you shop smart—and safe—for products that connect to the internet. In 2017, when we first started Privacy Not Included, we didn’t know if people would be interested in a guide about the privacy and security of connected toys, gadgets, and smart home products. Turns out, they were. [--]" https://foundation.mozilla.org/en/privacynotincluded/about/why/ https://foundation.mozilla.org/en/privacynotincluded/about/w...
- slapfrog 5y ago
  > Why do people assume that the Mozilla foundation is a clueless scammer? It's not an assumption, it's an evaluation they are continuing to earn by quacking like a duck.
  - tuukkah 5y ago
    Can you point to something concrete that makes Privacy Not Included clueless or scammy? EDIT: Or if it's that the foundation did some clueless and scammy things earlier that cost them all their reputation, what were they?
    - slapfrog 5y ago
      Scammy: years of soliciting donations from the public without making it explicitly clear that none of those donations will ever fund firefox development, and instead go to BS projects like this and bloated salaries for under-performing busybodies in management.
- deleted 5y ago
  [deleted]
ursugardaddy 5y ago
Mozilla needs to drop the whole 'we need the web equivalent of a slave uprising'/'more than deplatforming' thing
alphabet9000 5y ago
site needs a copy editor, or something.. "Scroll to see how creepy people find these products!" reads like they are talking about "creepy people"
- DonHopkins 5y ago
  That man's nuts! Grab 'em!
agilob 5y ago
This page promotes companies that make it impossible or very hard to delete accounts or data https://backgroundchecks.org/justdeleteme/ https://backgroundchecks.org/justdeleteme/
schroeding 5y ago
The votes seem... pretty useless for most products? :-D For example, by the votes the Sony WF-1000XM3s[1] are 31% "half-creepy", 12% find them even "super creepy". Why? Hot take, but IMO these headphones are as "not creepy" as it gets. You don't have to use the app, they work fine as is. The app doesn't need any permissions. Still, the majority find them at least "half-creepy". Or this Canon Printer [2] here. It's... a printer? Which allows to print stuff from the cloud via your own device. (Discontinued) Google Cloud Print could be creepy for some, but the printer works fine without it, locally. The majority thinks "Yep, that's pretty creepy"? Or are they just voting with the default setting "half-creepy", without moving the slider? :-P 10%~30% "not creepy", 30% "half-creepy", 10% "very creepy" seems to be the default distribution of votes for all more or less harmless products. Maybe the default value of a vote should be "not creepy", not "half-creepy" :-D [1] https://foundation.mozilla.org/en/privacynotincluded/sony-wf-1000xm3/ https://foundation.mozilla.org/en/privacynotincluded/sony-wf... [2] https://foundation.mozilla.org/en/privacynotincluded/canon-pixma-ts5120-black/ https://foundation.mozilla.org/en/privacynotincluded/canon-p...
- slapfrog 5y ago
  Just my two cents, a product having an optional app at all makes me disinclined to buy it. It's not a strict disqualification, but it's definitely a negative to me. I really dislike when companies even suggest I install their apps, and prefer to do business with companies that don't do that. The best sort of company is one that doesn't even know what an app is.
- DavideNL 5y ago
  > Why? Hot take, but IMO these headphones are as "not creepy" as it gets. It says so in the “Can it snoop on me?” section… for example the app tracks your location…
  - agentdrtran 5y ago
    Which it has to do if you use the auto-switch modes or location modes function.
  - marcinzm 5y ago
trvz 5y ago
This is utterly phony, coming from the company that updated their browser some time back to send its users' DNS data to fucking Cloudflare unless they opted out.
ub99 5y ago
A bit off-topic: is there a law requiring that sex toys must be blurred out? Even the ones that just look like a bent piece of silicon (not dildo-like)…
klyrs 5y ago
Okay, now do Firefox's telemetry...
hutzlibu 5y ago
How about extending that list to software and add something like "Firefox mobile" to that list, that comes advertised as privacy focused, fighting all those evil ad tracking technologies - but comes bundled with their own ad-tracking enabled by default!? And telemetry. And "participating in studies". So yes, if you are a little bit tech-savy, it is easy and the first thing to disable. But it is still a very "creepy" to me, that those things are enabled by default, which means it stays enabled for the majority of users.
havelhovel 5y ago
I use a VPN and Firefox with NoScript installed. You might think I would be on board with Mozilla's privacy zealotry, but this page rubs me the wrong way. Dunking on IoT and wearables as "Super Creepy!" just seems out of touch with consumer preferences. My Amazon Halo is the first piece of technology I've been excited to use in a long time. I guess Mozilla thinks I'm creepy by association.

I really don't like this website. The criteria appears to be "things Mozilla thinks technology companies should be doing", and not necessarily related to privacy. For example—sites get downgraded if they don't require strong passwords. Now, maybe websites should require strong passwords, that's a completely reasonable position to take. But if you, the user, are using a strong password, whether or not others are required to use strong passwords has no impact on your privacy. Especially because privacy ≠ security.

Engineering-MD 5y ago
All good points, thanks for your input. I liked it as I haven’t seen a similar ones from a reptile company but agree it could be better.
- grey_earthling 5y ago
  > I haven’t seen a similar ones from a reptile company I know this is a typo, but it's also an excellent pun.
  - RepZilla 5y ago
    Red Firefox Cult - Repzilla! Blue Oyster Cult - Godzilla.
  - yakubin 5y ago
    What is it a typo of?
    - nightcracker 5y ago
      Presumably reputable.
    - deleted 5y ago
      [deleted]
Stampo00 5y ago
I agree. This site seems unnecessarily inflammatory and confrontational. Purely elitist PR publicity nonsense instead of educational. It's a bad look on Mozilla and it turns me off. Talk up your own features instead of smearing other people's products. Products that aren't even your competition, I might add! It's flame bait for its own sake, trying to take advantage of outrage culture in an attention economy. Be better, Mozilla.
CodesInChaos 5y ago
> if you, the user, are using a strong password, whether or not others are required to use strong passwords has no impact on your privacy That only applies if the site only gives you access to your own data. If your friends grant you access to some of their data, your poor security compromises their privacy.
dane-pgp 5y ago
> whether or not others are required to use strong passwords has no impact on your privacy. It's worth considering, though, that attackers may target sites that don't mandate strong passwords, because the password hashes in the site's database are likely to be easier to crack (and users with simple passwords are likely to reuse those passwords). Once an attacker has chosen to target that site, that increases the chances that they find themselves able to read your data regardless of the password you used, because they'll have access to the whole database. In fact, a site which hasn't put the engineering effort into enforcing strong passwords (not even a simple regex, let alone more complex approaches like checking for compromised passwords against the haveibeenpwned database) is also likely to have undervalued security in other areas, again making them a target.
- Wowfunhappy 5y ago
  It also works the other way though. If attackers target the site, they'll know some users have weak passwords, so if you have a strong password, they'll move on quickly to easier targets. I'd say on the whole it evens out.
  - thephyber 5y ago
    I don’t see this as even remotely “evening out” the parent comment. If a site mandates strong passwords, it is more likely to follow other best practices like throttling login attempts and locking accounts after too many failed attempts (either per account or per IP). If attackers target the site, they should only have a limited number of attempts before they start getting thwarted. It would take a lot of attempts (exact numbers will vary) just to determine if a given user’s credentials are strong or not, so the adversary has already wasted significant effort on the accounts they will eventually “move on” from. If the site has throttling and/ or account lockout, the adversary should not be able to determine who has weak versus strong passwords.
    - h_anna_h 5y ago
      > and locking accounts after too many failed attempts (either per account This is not a best practice, this is a DoS.
Grieving 5y ago
> sites get downgraded if they don't require strong passwords Assuming "strong", as usual, means uses upper+lower letters, numbers, symbols, etc., this directly contradicts NIST's current password recommendations. They recommend enforcing a minimum length instead, and recommend a "minimum minimum" of 8. They also recommend checking passwords against a set of the most common ones from leaks. The NCSC's top 100k list is good (pre-filtering those under your minimum helps too--only 47k remain after removing pws under 8 chars): https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt https://github.com/danielmiessler/SecLists/blob/master/Passw...
- France_is_bacon 5y ago
  From my understanding, the only real way to create a password is to make it really, really long. Like, "Sometimes 10 people will get together on Friday night. Wow!" Or whatever you want. Makes it easy to remember. Personally I just usually string a bunch of random numbers and upper/lower/special characters - 40 of them. Just like this: https://www.youtube.com/watch?v=rERApU26PcA https://www.youtube.com/watch?v=rERApU26PcA
  - slapfrog 5y ago
    I tried long memorable passphrases for a time, but a few of my passphrases were not as memorable as I expected and I ended up having to reset several of them. Eventually I got fed up with it and switched to an offline FOSS password manager and use generated passwords from that. To unlock the password manager, I use a single long passphrase that I am confident I can remember. Now I worry that I'm putting all my eggs in one basket, but at least my passwords won't be guessed or forgotten.
    - France_is_bacon 5y ago
      Right. I always make sure to write them all down, as I won't remember either. But they are to make sure that random hackers don't gain access. Nobody is really going to break into my office and steal my passwords, as I am not an international spy.
tuukkah 5y ago
The site has a section that explains the criteria including that Mozilla didn't decide on them alone but with other non-profits. Regarding passwords: "If the product uses passwords for remote authentication, it must require that strong passwords are used, including having password strength requirements. Any non-unique default passwords must also be reset as part of the device’s initial setup. This helps protect the device from vulnerability to guessable password attacks, which could result in a compromised device." https://foundation.mozilla.org/en/privacynotincluded/about/meets-minimum-security-standards/ https://foundation.mozilla.org/en/privacynotincluded/about/m...
ezoe 5y ago
The most absurd claims are for the Nintendo Switch. They blame it for having a third-party software which collect real vehicle driving data and send its data to the third-party's server. https://foundation.mozilla.org/en/privacynotincluded/nintendo-switch/ https://foundation.mozilla.org/en/privacynotincluded/nintend... By the same logic, Firefox has a third-party software(Hacker News) which collect and send data to the third-party's server. Gosh I shall be scared. Or they are so lacking the technical analysis. Lego apps for example: https://foundation.mozilla.org/en/privacynotincluded/lego-hidden-side-graveyard-mystery/ https://foundation.mozilla.org/en/privacynotincluded/lego-hi... They conclude it's safe because they can use it offline... after they download and install the special smartphone apps to their smartphone. Seriously I see no smartphone that honor my privacy. By using the smartphone, it's already fail. Also, It seems they don't say that based on reverse engineering effort to make sure the app do nothing wrong. If I was a malicious app developer, I just store the data to the local storage and upload it the next convenient time the network access is available.

that_guy_iain 5y ago

One was on there because last year they didn't meet their "security standards" whatever those are but this year they do. So they improve in your eyes but you're still going to bash on them. Another one was that in the past there was a security hole. Those were the first two items I clicked. Honestly, I think this is the worst Mozilla thing I've seen. It's all preachy on things from the past.

teddyh 5y ago

For an even more strict selection, I suggest H-Node: https://h-node.org/hardware/catalogue/en https://h-node.org/hardware/catalogue/en

banana_giraffe 5y ago

The first thing I looked at, the Google Nest Protect says: Microphone: Device: Yes Tracks Location: Device: Yes Biometric: Voice recordings Huh? There's no GPS, no mic (at least, there are no voice based features, and teardowns I've seen haven't spotted a mic). There might be reasons to not want one, for sure, but inventing reasons isn't a good sign. Edit: I was wrong, ignore me.

chewmieser 5y ago
It does definitely have a mic but it's supposedly only used for sound checks (and audio never leaves the device): https://support.google.com/googlenest/answer/9250972?hl=en https://support.google.com/googlenest/answer/9250972?hl=en
- banana_giraffe 5y ago
  Fair enough, that's still a long ways from recording my voice all the time. Now I need to revisit the teardowns I've seen to see how they missed this.
auslegung 5y ago
It might track location via Wi-Fi.
jamesgeck0 5y ago
The Nest device doesn't use GPS, but it does use a variety of sensors (sound, IR, etc) to try to determine if you're home or not, thus technically establishing your location.
vetinari 5y ago
Technically, you don't need GPS for location tracking. All you need is to scan for BSSIDs around you and then check in a database, where in the world they are. Conveniently, Google has one such database ;). (That's also the reason why Android gates wifi network scanning behind location permission).

pseudo0 5y ago

So glad Mozilla laid off all their Servo devs to focus on what's really important: IoT sex doll privacy evaluations.

lapetitejort 5y ago
Snark aside, were I in the market for such a device, I would absolutely want to know how privacy focused it was. I appreciate that Mozilla includes the category in the list. They exist, people will buy them. There's no sense in acting like CES and plugging their ears whenever they're brought up.
chomp 5y ago
This is Mozilla Foundation, not Mozilla Corp.
- nerdponx 5y ago
  Even better: this is where your donation money goes.
- pseudo0 5y ago
  The corporation is a wholly owned subsidiary of the foundation. It's effectively one organization structured to minimize taxes. What exactly is your point anyways?
  - chomp 5y ago
    My point is that I find it difficult to understand your comment because the Foundation does 2 things - advocacy, and holds the trademarks. The Corp is the one who built out Servo, and due to a lack of foresight on management's part, amongst other things, had to cut costs due to a dwindling browser share. You sound like the non-profit should start funneling its money into the corporation to secure its finances. Why?
    - pseudo0 5y ago
      The corporation subsidizes the foundation, not the other way around. It's just a question of how much. Here's a toy example that illustrates Mozilla's situation. Let's say you have XYZ Corp and XYZ Foundation (501c3). XYZ Corp revenue (search engine deal): $90 XYZ Foundation revenue (donations): $10 Total revenue: $100 XYZ Corp costs (browser dev): $50 XYZ Foundation costs (advocacy, etc): $50 Total costs: $100 You have to spend the 501c3 income on appropriate costs first, so the $10 from the foundation revenue gets put towards the foundation's advocacy costs. The remainder ($40) gets covered by revenue from the corporation. Now let's say you cut $10 in advocacy costs from the foundation, realizing that it's more important to have a viable browser competitor to Chrome than sex doll privacy evaluations. Now the corporation reduces its transfer to $30, and has $10 left over to, say, avoid laying off devs when the search engine deal revenue drops. Fundamentally most of the money is fungible, and wasting money on unproductive initiatives takes money away from making Firefox a viable Chrome competitor.

perryizgr8 5y ago

> Google seems to do a better job than some of the other Big Tech companies when it comes to privacy. Huh??!

slivanes 5y ago
Google sells access to users, but doesn't share/sell user information.
- jesboat 5y ago
  Same with Facebook.
- wmf 5y ago
  Technically real-time bidding doesn't sell your information... it gives your information away for free.
rasz 5y ago
dont bite the hand that feeds you
slapfrog 5y ago
Mozilla knows what side their bread is buttered on.

chris_engel 5y ago

They say sonos does a good job on privacy. Did I miss something? Did they finally drop their approach of GPS-locating each speaker, phoning home what you listen to every couple of minutes and bricking the speakers to avoid re-sales?

antisthenes 5y ago

So this was the end-game for Mozilla? An Aliexpress like shop that tries to capitalize on whatever brand value they think they have left? Does the internet really need another janky affiliate page full of IoT crap? I've said it before and I'll say it again: guys, focus on making a good browser.

paulcarroty 5y ago

Cool to know Bose got lawsuit for stealing users data: https://www.businessinsider.com/bose-lawsuit-alleged-spy-headphone-users-app-2017-4 https://www.businessinsider.com/bose-lawsuit-alleged-spy-hea...

fragileone 5y ago

I wish there was a RSS feed of some kind available. Whether it be for a changelog, a Twitter feed or blog posts.

tuukkah 5y ago

I really don't like the comments here. Why do people assume that the Mozilla foundation is a clueless scammer? Before questioning their methods and motives, how about reading what the site says: "Welcome to Mozilla’s Privacy Not Included buyer’s guide. Our goal is to help you shop smart—and safe—for products that connect to the internet. In 2017, when we first started Privacy Not Included, we didn’t know if people would be interested in a guide about the privacy and security of connected toys, gadgets, and smart home products. Turns out, they were. [--]" https://foundation.mozilla.org/en/privacynotincluded/about/why/ https://foundation.mozilla.org/en/privacynotincluded/about/w...

slapfrog 5y ago
> Why do people assume that the Mozilla foundation is a clueless scammer? It's not an assumption, it's an evaluation they are continuing to earn by quacking like a duck.
- tuukkah 5y ago
  Can you point to something concrete that makes Privacy Not Included clueless or scammy? EDIT: Or if it's that the foundation did some clueless and scammy things earlier that cost them all their reputation, what were they?
  - slapfrog 5y ago
    Scammy: years of soliciting donations from the public without making it explicitly clear that none of those donations will ever fund firefox development, and instead go to BS projects like this and bloated salaries for under-performing busybodies in management.
deleted 5y ago
[deleted]

ursugardaddy 5y ago

Mozilla needs to drop the whole 'we need the web equivalent of a slave uprising'/'more than deplatforming' thing

alphabet9000 5y ago

site needs a copy editor, or something.. "Scroll to see how creepy people find these products!" reads like they are talking about "creepy people"

DonHopkins 5y ago
That man's nuts! Grab 'em!

agilob 5y ago

This page promotes companies that make it impossible or very hard to delete accounts or data https://backgroundchecks.org/justdeleteme/ https://backgroundchecks.org/justdeleteme/

schroeding 5y ago

The votes seem... pretty useless for most products? :-D For example, by the votes the Sony WF-1000XM3s[1] are 31% "half-creepy", 12% find them even "super creepy". Why? Hot take, but IMO these headphones are as "not creepy" as it gets. You don't have to use the app, they work fine as is. The app doesn't need any permissions. Still, the majority find them at least "half-creepy". Or this Canon Printer [2] here. It's... a printer? Which allows to print stuff from the cloud via your own device. (Discontinued) Google Cloud Print could be creepy for some, but the printer works fine without it, locally. The majority thinks "Yep, that's pretty creepy"? Or are they just voting with the default setting "half-creepy", without moving the slider? :-P 10%~30% "not creepy", 30% "half-creepy", 10% "very creepy" seems to be the default distribution of votes for all more or less harmless products. Maybe the default value of a vote should be "not creepy", not "half-creepy" :-D [1] https://foundation.mozilla.org/en/privacynotincluded/sony-wf-1000xm3/ https://foundation.mozilla.org/en/privacynotincluded/sony-wf... [2] https://foundation.mozilla.org/en/privacynotincluded/canon-pixma-ts5120-black/ https://foundation.mozilla.org/en/privacynotincluded/canon-p...

slapfrog 5y ago
Just my two cents, a product having an optional app at all makes me disinclined to buy it. It's not a strict disqualification, but it's definitely a negative to me. I really dislike when companies even suggest I install their apps, and prefer to do business with companies that don't do that. The best sort of company is one that doesn't even know what an app is.
DavideNL 5y ago
> Why? Hot take, but IMO these headphones are as "not creepy" as it gets. It says so in the “Can it snoop on me?” section… for example the app tracks your location…
- agentdrtran 5y ago
  Which it has to do if you use the auto-switch modes or location modes function.
- marcinzm 5y ago

trvz 5y ago

This is utterly phony, coming from the company that updated their browser some time back to send its users' DNS data to fucking Cloudflare unless they opted out.

ub99 5y ago

A bit off-topic: is there a law requiring that sex toys must be blurred out? Even the ones that just look like a bent piece of silicon (not dildo-like)…

klyrs 5y ago

Okay, now do Firefox's telemetry...

hutzlibu 5y ago

How about extending that list to software and add something like "Firefox mobile" to that list, that comes advertised as privacy focused, fighting all those evil ad tracking technologies - but comes bundled with their own ad-tracking enabled by default!? And telemetry. And "participating in studies". So yes, if you are a little bit tech-savy, it is easy and the first thing to disable. But it is still a very "creepy" to me, that those things are enabled by default, which means it stays enabled for the majority of users.

havelhovel 5y ago

I use a VPN and Firefox with NoScript installed. You might think I would be on board with Mozilla's privacy zealotry, but this page rubs me the wrong way. Dunking on IoT and wearables as "Super Creepy!" just seems out of touch with consumer preferences. My Amazon Halo is the first piece of technology I've been excited to use in a long time. I guess Mozilla thinks I'm creepy by association.