3 ms·

Firefox users who prefer to download the browser without the unique identifier may do so in the following two ways: Download the Firefox installer from Mozil

Firefox users who prefer to download the browser without the unique identifier may do so in the following two ways: Download the Firefox installer from Mozilla's HTTPS repository (formerly the FTP repository). Download Firefox from third-party download sites that host the installer, e.g., from Softonic. It's nuts and another indication Mozilla doesn't understand the reason they exist, but it's not that hard to get around... if you're one of the 0.1% that hears about this.

deleted 5y ago
[deleted]
d110af5ccf 5y ago
Use a reputable Linux distro and install from the official repos, problem solved. To date the Debian maintainers have proven more trustworthy than 99.99% of the software vendors out there. They also appear to have better security practices than most commercial shops.
- 8bitsrule 5y ago
  That's a little difficult for 'official repo's that don't include ESR versions.
- 5ESS 5y ago
  It’s a shame debian flushed their reputation down the drain recently.
- lmm 5y ago
  Debian has a deliberate policy of extensively modifying upstream code, including security-critical code, without any dedicated security review. This (predictably) resulted in quite possibly the worst general-purpose software security bug of all time, where SSH and TLS keys generated on Debian machines were effectively blank and supposedly encrypted communications were readable by anyone. Debian has not changed its practices to prevent a reoccurrence and continues to follow the same policy. I agree that most Debian maintainers are trustworthy and have good intentions, but I would not consider them as having good security practices.
  - jraph 5y ago
    How many times did this happen since Debian's inception? How much time did it take to fix it when it happened? Because "few" and "not much" would be fantastic. Nothing is perfect.
    - lmm 5y ago
      That particular outstandingly bad security bug, once. (There are other cases of bugs in Debian that aren't present in upstream - in particular, Debian packagers introduced enough bugs in cdrecord that the maintainer made future versions non-open-source as he felt that these bugs that were not his fault were hurting his reputation - but I don't have any stats, and I don't feel that the rate of bugs in Debian is particularly high compared to other projects if we set aside the security-specific aspects). Regarding time to fix it, the bug was fixed about 2 weeks after it was reported, but it had been present for about 20 months (affecting all DSA keys generated on Debian systems during that time) - since security audits and researchers only look at the original upstream source, the bug was only spotted when a user noticed that two of the servers they were logging into had the same SSH key.
panarky 5y ago
3) Install Firefox from your operating system's repository instead of from Mozilla
- dhx 5y ago
  These builds still have distribution-specific in-built API keys for some of the built-in services such as Google Safebrowsing, Google Location Services and Mozilla Location Services. See [1], [2], [3], [4], [5] and [6] for details and examples. Additionally, upon first launch of Firefox, a unique client identifier is created, and this is sent to Mozilla by default probably before you get a chance to disable telemetry features within the preferences dialogs. See [2], [7], [8] and [9]. As these privacy impacting features are enabled by default, before first launch of Firefox on Linux, you should disable these third party and telemetry features and also lock down other security and privacy settings. See [10] and [11] for the method of doing so, and an example user.js that contains decent documentation on well over a 100+ recommended configuration changes to make Firefox more respectful of privacy and security. If you don't reconfigure a user.js before first launch, at least the "New Profile" event will be notified to Mozilla with the unique client ID after a delay of only 30 minutes from creation of the first Firefox profile[9] (first launch). [1] https://glandium.org/blog/?p=3923 https://glandium.org/blog/?p=3923 [2] https://github.com/mozilla/gecko-dev/blob/HEAD/build/moz.configure/keyfiles.configure https://github.com/mozilla/gecko-dev/blob/HEAD/build/moz.con... [3] resource://gre/modules/URLFormatter.jsm (use within Firefox URI bar) [4] resource://gre/modules/AppConstants.jsm (use within Firefox URI bar) [5] https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/firefox/firefox-98.0.1.ebuild https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/fi... [6] https://github.com/archlinux/svntogit-packages/blob/packages/firefox/trunk/PKGBUILD https://github.com/archlinux/svntogit-packages/blob/packages... [7] resource://gre/modules/ClientID.jsm (use within Firefox URI bar) [8] resource:///modules/BrowserUsageTelemetry.jsm (use within Firefox URI bar) [9] https://github.com/mozilla/gecko-dev/blob/c3ec016fafa4cea6a019736ae48400bdccacac08/toolkit/components/telemetry/app/TelemetryControllerParent.jsm#L40 https://github.com/mozilla/gecko-dev/blob/c3ec016fafa4cea6a0... [10] https://kb.mozillazine.org/User.js_file https://kb.mozillazine.org/User.js_file [11] https://github.com/arkenfox/user.js/ https://github.com/arkenfox/user.js/
ttctciyf 5y ago
As of testing 2 minutes ago, downloading from the canonical "latest" location [1] vs. navigating the directory structure of the mentioned repository[2] result in identical files, which (assuming the above info is correct) means my scripted ffox upgrades have omitted the unique id, I guess? (In my case:) 1: https://download.mozilla.org/?product=firefox-latest-ssl&os=linux64&lang=en-GB https://download.mozilla.org/?product=firefox-latest-ssl&os=... 2: https://ftp.mozilla.org/pub/firefox/releases/98.0.1/linux-x86_64/en-GB/firefox-98.0.1.tar.bz2 https://ftp.mozilla.org/pub/firefox/releases/98.0.1/linux-x8...

deleted 5y ago

[deleted]

d110af5ccf 5y ago

Use a reputable Linux distro and install from the official repos, problem solved. To date the Debian maintainers have proven more trustworthy than 99.99% of the software vendors out there. They also appear to have better security practices than most commercial shops.

8bitsrule 5y ago
That's a little difficult for 'official repo's that don't include ESR versions.
5ESS 5y ago
It’s a shame debian flushed their reputation down the drain recently.
lmm 5y ago
Debian has a deliberate policy of extensively modifying upstream code, including security-critical code, without any dedicated security review. This (predictably) resulted in quite possibly the worst general-purpose software security bug of all time, where SSH and TLS keys generated on Debian machines were effectively blank and supposedly encrypted communications were readable by anyone. Debian has not changed its practices to prevent a reoccurrence and continues to follow the same policy. I agree that most Debian maintainers are trustworthy and have good intentions, but I would not consider them as having good security practices.
- jraph 5y ago
  How many times did this happen since Debian's inception? How much time did it take to fix it when it happened? Because "few" and "not much" would be fantastic. Nothing is perfect.
  - lmm 5y ago
    That particular outstandingly bad security bug, once. (There are other cases of bugs in Debian that aren't present in upstream - in particular, Debian packagers introduced enough bugs in cdrecord that the maintainer made future versions non-open-source as he felt that these bugs that were not his fault were hurting his reputation - but I don't have any stats, and I don't feel that the rate of bugs in Debian is particularly high compared to other projects if we set aside the security-specific aspects). Regarding time to fix it, the bug was fixed about 2 weeks after it was reported, but it had been present for about 20 months (affecting all DSA keys generated on Debian systems during that time) - since security audits and researchers only look at the original upstream source, the bug was only spotted when a user noticed that two of the servers they were logging into had the same SSH key.

panarky 5y ago

3) Install Firefox from your operating system's repository instead of from Mozilla

dhx 5y ago
These builds still have distribution-specific in-built API keys for some of the built-in services such as Google Safebrowsing, Google Location Services and Mozilla Location Services. See [1], [2], [3], [4], [5] and [6] for details and examples. Additionally, upon first launch of Firefox, a unique client identifier is created, and this is sent to Mozilla by default probably before you get a chance to disable telemetry features within the preferences dialogs. See [2], [7], [8] and [9]. As these privacy impacting features are enabled by default, before first launch of Firefox on Linux, you should disable these third party and telemetry features and also lock down other security and privacy settings. See [10] and [11] for the method of doing so, and an example user.js that contains decent documentation on well over a 100+ recommended configuration changes to make Firefox more respectful of privacy and security. If you don't reconfigure a user.js before first launch, at least the "New Profile" event will be notified to Mozilla with the unique client ID after a delay of only 30 minutes from creation of the first Firefox profile[9] (first launch). [1] https://glandium.org/blog/?p=3923 https://glandium.org/blog/?p=3923 [2] https://github.com/mozilla/gecko-dev/blob/HEAD/build/moz.configure/keyfiles.configure https://github.com/mozilla/gecko-dev/blob/HEAD/build/moz.con... [3] resource://gre/modules/URLFormatter.jsm (use within Firefox URI bar) [4] resource://gre/modules/AppConstants.jsm (use within Firefox URI bar) [5] https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/firefox/firefox-98.0.1.ebuild https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/fi... [6] https://github.com/archlinux/svntogit-packages/blob/packages/firefox/trunk/PKGBUILD https://github.com/archlinux/svntogit-packages/blob/packages... [7] resource://gre/modules/ClientID.jsm (use within Firefox URI bar) [8] resource:///modules/BrowserUsageTelemetry.jsm (use within Firefox URI bar) [9] https://github.com/mozilla/gecko-dev/blob/c3ec016fafa4cea6a019736ae48400bdccacac08/toolkit/components/telemetry/app/TelemetryControllerParent.jsm#L40 https://github.com/mozilla/gecko-dev/blob/c3ec016fafa4cea6a0... [10] https://kb.mozillazine.org/User.js_file https://kb.mozillazine.org/User.js_file [11] https://github.com/arkenfox/user.js/ https://github.com/arkenfox/user.js/

ttctciyf 5y ago

As of testing 2 minutes ago, downloading from the canonical "latest" location [1] vs. navigating the directory structure of the mentioned repository[2] result in identical files, which (assuming the above info is correct) means my scripted ffox upgrades have omitted the unique id, I guess? (In my case:) 1: https://download.mozilla.org/?product=firefox-latest-ssl&os=linux64&lang=en-GB https://download.mozilla.org/?product=firefox-latest-ssl&os=... 2: https://ftp.mozilla.org/pub/firefox/releases/98.0.1/linux-x86_64/en-GB/firefox-98.0.1.tar.bz2 https://ftp.mozilla.org/pub/firefox/releases/98.0.1/linux-x8...