3 ms·

Package manager installations wouldn't have this problem because everybody gets the same copy of the same binary and associated files, rights?

pxeger1 5y ago
Package manager installations are normally built from source by the distribution maintainers, not downloaded as binaries from the Mozilla website. So they wouldn't have any "download identifier", unique or not, in them.
Arnavion 5y ago
Yes. Just like with the Audacity kerfuffle some time ago, it's not a problem for distro packages, only when you get your binaries from upstream.
- GekkePrutser 5y ago
  Which is what 95% of users would do though.. the average user will use Windows or Mac and has never heard of Chocolatey. Firefox is not in the Mac app store and I guess not on Windows either.
  - PascLeRasc 5y ago
    Windows actually knows about the Firefox installer tracker and blocks it: https://www.techradar.com/news/microsoft-edge-blocks-firefox-installer-says-itll-hurt-your-pc https://www.techradar.com/news/microsoft-edge-blocks-firefox...
  - 0xBAADA555 5y ago
    It is on the Windows Store. https://www.microsoft.com/en-us/p/mozilla-firefox-browser/9nzvdkpmr9rd https://www.microsoft.com/en-us/p/mozilla-firefox-browser/9n...
politelemon 5y ago
Correct and it's just one of many reasons why checksums and signatures are so important in package managers. There's an automatic enforcement of privacy and integrity.
- gary_0 5y ago
  Reproducible builds are important as well.
Tijdreiziger 5y ago
Chocolatey and WinGet don’t. Looks like Chocolatey gets the binary from download.mozilla.org [1], while WinGet gets it from download-installer.cdn.mozilla.net [2] (which looks to be the HTTPS repository mentioned in the article, thus being exempt from tracking?) [1] https://community.chocolatey.org/packages/Firefox#files https://community.chocolatey.org/packages/Firefox#files [2] https://github.com/microsoft/winget-pkgs/blob/master/manifests/m/Mozilla/Firefox/98.0/Mozilla.Firefox.installer.yaml https://github.com/microsoft/winget-pkgs/blob/master/manifes...
- eikenberry 5y ago
  This is the difference between a distribution and a simple package manager. Linux distributions have a more holistic approach to this and enforce it with checksums, signatures, reproducible builds, etc. A package manager really only cares about managing the packages installation, dependencies, etc. Not the integrity of the packages themselves.
- easton 5y ago
  Hey, I did that commit to winget-pkgs! It doesn’t look to me like the tracking stuff is on the HTTPS repo links, so they’re probably telling the truth about that. They also ship a version in the Microsoft Store, that should be safe too (I don’t think Microsoft shares user identities for free apps with the developers, maybe I’m wrong?)

pxeger1 5y ago

Package manager installations are normally built from source by the distribution maintainers, not downloaded as binaries from the Mozilla website. So they wouldn't have any "download identifier", unique or not, in them.

Arnavion 5y ago

Yes. Just like with the Audacity kerfuffle some time ago, it's not a problem for distro packages, only when you get your binaries from upstream.

GekkePrutser 5y ago
Which is what 95% of users would do though.. the average user will use Windows or Mac and has never heard of Chocolatey. Firefox is not in the Mac app store and I guess not on Windows either.
- PascLeRasc 5y ago
  Windows actually knows about the Firefox installer tracker and blocks it: https://www.techradar.com/news/microsoft-edge-blocks-firefox-installer-says-itll-hurt-your-pc https://www.techradar.com/news/microsoft-edge-blocks-firefox...
- 0xBAADA555 5y ago
  It is on the Windows Store. https://www.microsoft.com/en-us/p/mozilla-firefox-browser/9nzvdkpmr9rd https://www.microsoft.com/en-us/p/mozilla-firefox-browser/9n...

politelemon 5y ago

Correct and it's just one of many reasons why checksums and signatures are so important in package managers. There's an automatic enforcement of privacy and integrity.

gary_0 5y ago
Reproducible builds are important as well.

Tijdreiziger 5y ago

Chocolatey and WinGet don’t. Looks like Chocolatey gets the binary from download.mozilla.org [1], while WinGet gets it from download-installer.cdn.mozilla.net [2] (which looks to be the HTTPS repository mentioned in the article, thus being exempt from tracking?) [1] https://community.chocolatey.org/packages/Firefox#files https://community.chocolatey.org/packages/Firefox#files [2] https://github.com/microsoft/winget-pkgs/blob/master/manifests/m/Mozilla/Firefox/98.0/Mozilla.Firefox.installer.yaml https://github.com/microsoft/winget-pkgs/blob/master/manifes...

eikenberry 5y ago
This is the difference between a distribution and a simple package manager. Linux distributions have a more holistic approach to this and enforce it with checksums, signatures, reproducible builds, etc. A package manager really only cares about managing the packages installation, dependencies, etc. Not the integrity of the packages themselves.
easton 5y ago
Hey, I did that commit to winget-pkgs! It doesn’t look to me like the tracking stuff is on the HTTPS repo links, so they’re probably telling the truth about that. They also ship a version in the Microsoft Store, that should be safe too (I don’t think Microsoft shares user identities for free apps with the developers, maybe I’m wrong?)