7 ms·

> Thanks to our Telemetry, we discovered that many forms contain and use embedded JavaScript code (yes, that’s a thing!). There are two disturbing things in th

> Thanks to our Telemetry, we discovered that many forms contain and use embedded JavaScript code (yes, that’s a thing!). There are two disturbing things in that sentence. At least the JavaScript I can see a reason for, it can check whether your input is correct and maybe autofill or things like that, and should of course be sandboxed. The telemetry part is more scary.

djbusby 5y ago
Scary and also helpful. Over reaching telemetry bad. But pragmatic, anonymous, usage metrics? Maybe worked this time.
jessaustin 5y ago
It would be possible to implement telemetry that would answer these questions in mostly unobjectionable fashion, but without more information one can see how this could be described as "scary". I certainly hope that forms aren't just being sent back home to Mozilla as-is. However, a monthly ping with statistics like "out of between 50 and 200 documents, between 10 and 50 of them used javascript" wouldn't harm anything. They could even add a random error to the statistics...
- ocdtrekkie 5y ago
  I often do not have a problem with the information telemetry collects: I take issue with the entitlement to it a new breed of awful app developers have. They think they have the right to use my device for information collection without my permission. If Firefox occasionally showed me a report on some metrics it collected and asked me if I was okay sending it to Mozilla, I'd probably be fine with it. However, the choice to take it without my consent will always be opposed.
  - InitialLastName 5y ago
    Do they do that? It's been a long time since I installed Firefox, but as far as I can tell there are very visible settings for controlling the telemetry that they collect.
    - ocdtrekkie 5y ago
      There are settings, however, they are enabled by default to silently send telemetry, and they also implement new ways of collecting telemetry, with new settings to opt out of it, on an "every few months" basis. So it's a constant battle of monitoring what behavior they're up to and turning it off.
- tjoff 5y ago
  It would be possible to figure this out without any sort of telemetry at all. It really feels like a forced way to try and shoe-horn something good to say about telemetry when it is something everyone that deals with PDFs have known since forever. And if that is the best they have to show for it ...
  - roca 5y ago
    How would you figure this out without telemetry? A Web crawl could tell you how many PDF documents on the Web use forms, but it won't tell you often your users encounter those documents --- many documents aren't on the public Web, and some documents will be encountered far more often than others.
    - blondin 5y ago
      > How would you figure this out without telemetry? the way the world has done it forever... a survey? it is concerning. if Firefox is doing it, they are all doing it. i am not going to be opening PDFs in browsers. this is ridiculous.
      - roca 5y ago
        A survey for this is going to be useless for getting unbiased data.
      - charcircuit 5y ago
        A survey would be heavily biased. Telemetry will have much less bias (there is still some since people who disable telemetry have their usage ignored) With better data you can make improvements that help more actual users instead of just focusing on what vocal minorities think.
    - tjoff 5y ago
      The vast majority of questions like that are quite obvious. Now what you might miss is that in some country where special circumstances led to an unusual high use of a certain feature. But this is not that case. More importantly, even with telemetry. Is the JavaScript adding something or is it solely used for tracking? Is it appreciated by the users? Maybe 80% of input validation is so broken that they only serve to block legitimate input and waste cpu-cycles. More than telemetry you need common sense. It is not apparent how the telemetry influenced this in any way.
arbitrage 5y ago
What I find disturbing is that you are complaining about the included javascript in forms at this late a date. Where have you been for like the last fifteen years?
- rudian 5y ago
  Fifteen years is a long time. I’m sure some HN users weren’t even born yet. Not everyone needs to care about everything all the time. I would complain about JS in PDF too, but I don’t have a voice anyway.
InitialLastName 5y ago
> The telemetry part is more scary. There's a nice big section in the Firefox settings called "Firefox Data Collection and Use" that has some fairly fine-grained options for what data you feed back to Firefox. I have all of mine unchecked, but I could imagine that if I were more community-minded, or if I were interested in actively contributing to FF's development day-to-day (for example running on nightly builds) I would activate those. FWIW, I do explicitly allow telemetry for the applications I buy licenses for and use for my work; it's in my best interest for those programs to be improved as efficiently as possible (and to have my use patterns be part of the corpus used to prioritize those improvements), and it makes it easier for me to report issues.
- zinekeller 5y ago
  Also, unless you dismiss it, there's a clear button to read to read their privacy policy and set telemetry (unless you're using the nightly-weekly builds, in this case they state in no ambiguous terms that you cannot disable it).
- jeroenhd 5y ago
  > that has some fairly fine-grained options for what data you feed back to Firefox I looked into these settings but I can only find 4 checkboxes. Which of the four checkboxes would this telemetry fall under? Is this a study, the result of crash report logging, or is it "data about your interactions with Firefox [..] (such as number of open tabs and windows; number of webpages visited; number and type of installed Firefox Add-ons; and session length) and Firefox features offered by Mozilla or our partners (such as interaction with Firefox search features and search partner referrals)" I know Firefox collects some technical tracking, but there is no up to date overview of what tracking is actually done. Is there a list of parameters tracked like Microsoft published [1] after the outcry about their terrible tracking? The privacy policy is vague and the documentation for developers [2] contains phrases such as "opaque prio-specific payload. Like { a: <base64 string>, b: <base64 string> }" which isn't exactly useful. [1]: https://docs.microsoft.com/en-us/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004 https://docs.microsoft.com/en-us/windows/privacy/required-wi... [2]: https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/data/prio-ping.html https://firefox-source-docs.mozilla.org/toolkit/components/t...
sildur 5y ago
Not only that. If they wanted to add form support they should have read the specs, instead of blindly relying on their (very questionable) telemetry. The fact they had to find via telemetry something that every developer who had interacted with a PDF with forms knew (that they have JS) is very worrying. I'm expecting a long long list of bug reports when they start finding the mountains of corner cases not shown by their "telemetry".

djbusby 5y ago

Scary and also helpful. Over reaching telemetry bad. But pragmatic, anonymous, usage metrics? Maybe worked this time.

jessaustin 5y ago

It would be possible to implement telemetry that would answer these questions in mostly unobjectionable fashion, but without more information one can see how this could be described as "scary". I certainly hope that forms aren't just being sent back home to Mozilla as-is. However, a monthly ping with statistics like "out of between 50 and 200 documents, between 10 and 50 of them used javascript" wouldn't harm anything. They could even add a random error to the statistics...

ocdtrekkie 5y ago
I often do not have a problem with the information telemetry collects: I take issue with the entitlement to it a new breed of awful app developers have. They think they have the right to use my device for information collection without my permission. If Firefox occasionally showed me a report on some metrics it collected and asked me if I was okay sending it to Mozilla, I'd probably be fine with it. However, the choice to take it without my consent will always be opposed.
- InitialLastName 5y ago
  Do they do that? It's been a long time since I installed Firefox, but as far as I can tell there are very visible settings for controlling the telemetry that they collect.
  - ocdtrekkie 5y ago
    There are settings, however, they are enabled by default to silently send telemetry, and they also implement new ways of collecting telemetry, with new settings to opt out of it, on an "every few months" basis. So it's a constant battle of monitoring what behavior they're up to and turning it off.
tjoff 5y ago
It would be possible to figure this out without any sort of telemetry at all. It really feels like a forced way to try and shoe-horn something good to say about telemetry when it is something everyone that deals with PDFs have known since forever. And if that is the best they have to show for it ...
- roca 5y ago
  How would you figure this out without telemetry? A Web crawl could tell you how many PDF documents on the Web use forms, but it won't tell you often your users encounter those documents --- many documents aren't on the public Web, and some documents will be encountered far more often than others.
  - blondin 5y ago
    > How would you figure this out without telemetry? the way the world has done it forever... a survey? it is concerning. if Firefox is doing it, they are all doing it. i am not going to be opening PDFs in browsers. this is ridiculous.
    - roca 5y ago
      A survey for this is going to be useless for getting unbiased data.
    - charcircuit 5y ago
      A survey would be heavily biased. Telemetry will have much less bias (there is still some since people who disable telemetry have their usage ignored) With better data you can make improvements that help more actual users instead of just focusing on what vocal minorities think.
  - tjoff 5y ago
    The vast majority of questions like that are quite obvious. Now what you might miss is that in some country where special circumstances led to an unusual high use of a certain feature. But this is not that case. More importantly, even with telemetry. Is the JavaScript adding something or is it solely used for tracking? Is it appreciated by the users? Maybe 80% of input validation is so broken that they only serve to block legitimate input and waste cpu-cycles. More than telemetry you need common sense. It is not apparent how the telemetry influenced this in any way.

arbitrage 5y ago

What I find disturbing is that you are complaining about the included javascript in forms at this late a date. Where have you been for like the last fifteen years?

rudian 5y ago
Fifteen years is a long time. I’m sure some HN users weren’t even born yet. Not everyone needs to care about everything all the time. I would complain about JS in PDF too, but I don’t have a voice anyway.

InitialLastName 5y ago

> The telemetry part is more scary. There's a nice big section in the Firefox settings called "Firefox Data Collection and Use" that has some fairly fine-grained options for what data you feed back to Firefox. I have all of mine unchecked, but I could imagine that if I were more community-minded, or if I were interested in actively contributing to FF's development day-to-day (for example running on nightly builds) I would activate those. FWIW, I do explicitly allow telemetry for the applications I buy licenses for and use for my work; it's in my best interest for those programs to be improved as efficiently as possible (and to have my use patterns be part of the corpus used to prioritize those improvements), and it makes it easier for me to report issues.

zinekeller 5y ago
Also, unless you dismiss it, there's a clear button to read to read their privacy policy and set telemetry (unless you're using the nightly-weekly builds, in this case they state in no ambiguous terms that you cannot disable it).
jeroenhd 5y ago
> that has some fairly fine-grained options for what data you feed back to Firefox I looked into these settings but I can only find 4 checkboxes. Which of the four checkboxes would this telemetry fall under? Is this a study, the result of crash report logging, or is it "data about your interactions with Firefox [..] (such as number of open tabs and windows; number of webpages visited; number and type of installed Firefox Add-ons; and session length) and Firefox features offered by Mozilla or our partners (such as interaction with Firefox search features and search partner referrals)" I know Firefox collects some technical tracking, but there is no up to date overview of what tracking is actually done. Is there a list of parameters tracked like Microsoft published [1] after the outcry about their terrible tracking? The privacy policy is vague and the documentation for developers [2] contains phrases such as "opaque prio-specific payload. Like { a: <base64 string>, b: <base64 string> }" which isn't exactly useful. [1]: https://docs.microsoft.com/en-us/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004 https://docs.microsoft.com/en-us/windows/privacy/required-wi... [2]: https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/data/prio-ping.html https://firefox-source-docs.mozilla.org/toolkit/components/t...

sildur 5y ago

Not only that. If they wanted to add form support they should have read the specs, instead of blindly relying on their (very questionable) telemetry. The fact they had to find via telemetry something that every developer who had interacted with a PDF with forms knew (that they have JS) is very worrying. I'm expecting a long long list of bug reports when they start finding the mountains of corner cases not shown by their "telemetry".