3 ms·

(I used to work for Mozilla, and spent a few years on the team that at the time owned the telemetry component.) The way Mozilla does telemetry is different fro

(I used to work for Mozilla, and spent a few years on the team that at the time owned the telemetry component.) The way Mozilla does telemetry is different from how most places do. I think that the biggest issue with these discussions is that there always seems to be this assumption that there is only one way to do telemetry, it always contains super invasive PII, Mozilla's telemetry must do the same, and therefore Mozilla's telemetry is just as evil as anybody else's. Mozilla is remarkably open about how its telemetry works, beyond just being open source. Maybe this is more a problem of that information not being surfaced well, I dunno. I get that some people are philosophically opposed to telemetry no matter what, but I have seen enough cases of, "Wow, I didn't know it worked that way, and I'm actually okay with this," to know that informed users are not universally opposed to it.

wolverine876 5y ago
Could you share a link?
- dblohm7 5y ago
  I can share several! If you're running Firefox, you can go to `about:telemetry` and see what data is there. Note that some of that data might be populated even if you have telemetry turned off. Don't reach for your pitchfork quite yet: I assure you that the data isn't being sent. You can go to https://telemetry.mozilla.org https://telemetry.mozilla.org to see various analyses involving telemetry data. In the source tree, telemetry probes must be defined in one of a few places. Here are their locations: https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/Histograms.json https://searchfox.org/mozilla-central/source/toolkit/compone... https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/Scalars.yaml https://searchfox.org/mozilla-central/source/toolkit/compone... https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/Events.yaml https://searchfox.org/mozilla-central/source/toolkit/compone... https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/geckoview/streaming/metrics.yaml https://searchfox.org/mozilla-central/source/toolkit/compone...
  - wolverine876 5y ago
    I meant something documenting how telemetry works, though perhaps the source tree is the source for that? > Don't reach for your pitchfork quite yet No need to assume people are out of their minds or even critical. I am curious about how it's done on a technical level, with the old local ad system in mind (which I thought was a brilliant solution to Internet commerce and privacy). I've supported and contributed to Mozilla since before Firefox.
    - dblohm7 5y ago
      Yeah, please don't take the pitchfork thing personally, that was more intended for anybody reading that comment who immediately assumes the worst. As for high level docs about how it works, I haven't been involved in quite a few years, so I'm not 100% sure about the best source, but this link looks like a good place to start: https://docs.telemetry.mozilla.org/concepts/history.html https://docs.telemetry.mozilla.org/concepts/history.html
account42 5y ago
All network requests share at least the IP address, which is PII, and should only happen after obtaining informed consent unless they are required for the requested user action. Since telemetry would be pointless if its the same for everyone there will inevitably be more information that can ultimately be used to identify users. You can argue as much as you want that you are doing it "better" than others (there is always someone worse and the software industry's disregard for user rights is well known) or that it is useful (many unethical actions can be useful but the ends do not justify the means, especially when alternatives like bug reports often go ignored) but that does not change the fact that you are sharing PII without informed consent.
- dblohm7 5y ago
  IP addresses are uniquely identifiable, sure, but not personally identifiable.
  - account42 5y ago
    You should not be so sure about that. For example see this recent judgement: https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ HN discussion: https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264 More importantly Mozilla knows that there are people who do not want them to upload this information yet they continue to do it anyway by default without ever asking for consent. Worse, Mozilla keeps adding new leaks that concerned users will have to watch out for and disable after each update. This is of course by no means a problem unique to Mozilla - the software industry as a whole has not yet learned that no means no - but it is also a Mozilla problem and as long as they want to use privacy to market their software they will rightfully receive the loudest criticism. Thankfully laws are beginning to catch up with the digital age and people will have better recourse than asking software vendors nicely to not be mistreated.

wolverine876 5y ago

Could you share a link?

dblohm7 5y ago
I can share several! If you're running Firefox, you can go to `about:telemetry` and see what data is there. Note that some of that data might be populated even if you have telemetry turned off. Don't reach for your pitchfork quite yet: I assure you that the data isn't being sent. You can go to https://telemetry.mozilla.org https://telemetry.mozilla.org to see various analyses involving telemetry data. In the source tree, telemetry probes must be defined in one of a few places. Here are their locations: https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/Histograms.json https://searchfox.org/mozilla-central/source/toolkit/compone... https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/Scalars.yaml https://searchfox.org/mozilla-central/source/toolkit/compone... https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/Events.yaml https://searchfox.org/mozilla-central/source/toolkit/compone... https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/geckoview/streaming/metrics.yaml https://searchfox.org/mozilla-central/source/toolkit/compone...
- wolverine876 5y ago
  I meant something documenting how telemetry works, though perhaps the source tree is the source for that? > Don't reach for your pitchfork quite yet No need to assume people are out of their minds or even critical. I am curious about how it's done on a technical level, with the old local ad system in mind (which I thought was a brilliant solution to Internet commerce and privacy). I've supported and contributed to Mozilla since before Firefox.
  - dblohm7 5y ago
    Yeah, please don't take the pitchfork thing personally, that was more intended for anybody reading that comment who immediately assumes the worst. As for high level docs about how it works, I haven't been involved in quite a few years, so I'm not 100% sure about the best source, but this link looks like a good place to start: https://docs.telemetry.mozilla.org/concepts/history.html https://docs.telemetry.mozilla.org/concepts/history.html

account42 5y ago

All network requests share at least the IP address, which is PII, and should only happen after obtaining informed consent unless they are required for the requested user action. Since telemetry would be pointless if its the same for everyone there will inevitably be more information that can ultimately be used to identify users. You can argue as much as you want that you are doing it "better" than others (there is always someone worse and the software industry's disregard for user rights is well known) or that it is useful (many unethical actions can be useful but the ends do not justify the means, especially when alternatives like bug reports often go ignored) but that does not change the fact that you are sharing PII without informed consent.

dblohm7 5y ago
IP addresses are uniquely identifiable, sure, but not personally identifiable.
- account42 5y ago
  You should not be so sure about that. For example see this recent judgement: https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ HN discussion: https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264 More importantly Mozilla knows that there are people who do not want them to upload this information yet they continue to do it anyway by default without ever asking for consent. Worse, Mozilla keeps adding new leaks that concerned users will have to watch out for and disable after each update. This is of course by no means a problem unique to Mozilla - the software industry as a whole has not yet learned that no means no - but it is also a Mozilla problem and as long as they want to use privacy to market their software they will rightfully receive the loudest criticism. Thankfully laws are beginning to catch up with the digital age and people will have better recourse than asking software vendors nicely to not be mistreated.