6 ms·

Why don’t you give power users at the very least in about:config an option to disable ALL phoning home by Firefox upon launch and exit. As it stands even with a

Why don’t you give power users at the very least in about:config an option to disable ALL phoning home by Firefox upon launch and exit. As it stands even with all telemetry off Firefox is extremely chatty and I’ve had Mozilla developers tell me they have no intention to fix this. You can profile this yourself on macOS with Charles Proxy (GUI) or mitmproxy (CLI). Until this is fixed all I can do is roll my eyes when I see the incessant privacy marketing from Mozilla.

elashri 4y ago
While it is not a simple change, you can always modify things in about:config to turn off all (probably) telemetry on Firefox. The annoying thing is that you should keep updating the strings that is changing with updates (when they add or remove strings). Also you can keep an eye to updated to arkenfox user.js because while using it by default probably will break many websites but they keep track of privacy updates of Firefox.
- user3939382 4y ago
  That's the problem, even with every possible option disabled there is currently no way, even through about:config, to keep Firefox from phoning home at these points in its execution lifecycle. The telemetry settings they provided basically amount to, we'll phone home to Mozilla either more or less, depending on your settings.
SamuelAdams 4y ago
Is it possible to get a list of addresses and add them to a block list, in PiHole for example?
- cptskippy 4y ago
  Yes, it's already in one of the Steven Black or Peter Lowe lists: incoming.telemetry.mozilla.org
coldpie 4y ago
> As it stands even with all telemetry off Firefox is extremely chatty and I’ve had Mozilla developers tell me they have no intention to fix this. What data is being communicated? What about that data is harmful to you? (Genuinely asking for more information, not trying to convince you you're wrong.)
- Nextgrid 4y ago
  > What about that data is harmful to you? Arguments like these always reminds me of the story where some town had a population register that included religion, and then the Nazis invaded. You don't know how or when the collected data will be misused, whether by the original owner, a malicious third-party breaching their systems, or the government (and even somewhat-stable governments can quickly turn sour, see Russia or the US's recent issues on abortion for an example). Furthermore, at least in Europe, the GDPR mandates that all non-essential data collection must be strictly opt-in, so regardless of opinions, it's a law with which you have to technically comply (even though lacklustre enforcement allows offenders to get away), but doubly so if your entire selling pitch is based on privacy.
  - coldpie 4y ago
    I agree, which is why I asked what data is being collected. If it's like, "a user launched Firefox version 105.0.1 and has Pocket disabled," I've got a tough time caring. Telemetry is genuinely useful information. But if it's like, "a user with IP 123.45 opened MyFavoriteReligion.com and spent 20 minutes at that domain" then it's bad news. So, I'd like to know what's actually being transmitted.
    - EE84M3i 4y ago
      I'm not sure I follow your example, because any telemetry event will always include the IP as it's required to establish a connection.
    - sfink 4y ago
      https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/ answers that question, though admittedly it's not a quick answer that can be easily summarized. It's basically "a user at IP x.y.z.w launched Firefox version 105.0.1 and has Pocket disabled" where the IP is not collected other than in the server logs: "When Firefox sends data to us, your IP address is temporarily collected as part of our server logs." Actual URLs are treated very carefully. The only ways I know that they could be leaked: (1) there is limited exposure via the SafeBrowsing stuff, and (2) if you crash then URLs could be swept up in the crash report and visible to privileged people at Mozilla. Or if you manually submit a profile and don't anonymize it (there's a checkbox to submit URLs that is checked by default), but you have to go out of your way to do that. There very well could be other ways, but browsing history is treated as very sensitive data for both legal and moral reasons. Personally, I would not trust Mozilla to be unable to answer the question "has this IP address ever used Firefox?", especially if under subpoena. The IP is temporarily in the server logs, it's used for coarse location information, etc. I doubt anyone is all that interested in asking that question, though.
s_ting765 4y ago
> Why don’t you give power users at the very least in about:config an option to disable ALL phoning home by Firefox upon launch and exit. Biggest reason I refuse to use Firefox no matter how bad Chromium is. I sometimes use Firefox Focus for doing searches on my phone and the thing is always pinging mozilla services. Some of them location related. No way to turn any of these off on what is supposed to be an incognito browser.
- emptyparadise 4y ago
  I find it hard to believe Chromium pings any less than Firefox. Would love to get more info on this.
  - vntok 4y ago
    Here you go: https://twitter.com/jonathansampson/status/1165858896176660480 https://twitter.com/jonathansampson/status/11658588961766604... > What I found were dozens of requests, which loaded nearly 16 MB in data. Lets break down what I saw. > I also reviewed Google Chrome, for those interested: When I launched Google Chrome for the first time (and let it sit for a minute), 32 requests were made, and 7.26 MB of data downloaded. Presumably Chromium would ping even less than Google Chrome.
    - insanitybit 4y ago
      Raw numbers mean nothing. Lots of these requests are totally benign.
  - s_ting765 4y ago
    Believe it. Firefox is kind of unbeaten in this regard. There was a study carried out on what kinds of data leaks on browsers during launch [0] but Chromium specifically wasn't measured. I can only infer Safe browsing to be a leak point available on Chromium since it is shipped by default but I have it turned off (never needed it anyway) so I have not observed any pings related to it personally. [0] https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf
nervuri 4y ago
You can disable all phoning home. Have a look at https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... Having a single setting that does all of this would indeed be nice.
- leeoniya 4y ago
  https://github.com/arkenfox/user.js https://github.com/arkenfox/user.js https://gist.github.com/ryandaniels/33e443bb401dde665fce15dd2a3959b6 https://gist.github.com/ryandaniels/33e443bb401dde665fce15dd... but yes, a single setting is necessary if you want to also opt out of any _future_ telemetry settings without always having to update your prefs.
  - pbhjpbhj 4y ago
    They just revert prefs don't they, add buttons back to your toolbars, etc. Or have they reformed?
WallyFunk 4y ago
If you don't want to configure stuff, LibreWolf[0] has all the phoning home / telemetry stuff blocked out of the box. [0] https://librewolf.net/ https://librewolf.net/
- dont__panic 4y ago
  Even better, you can manage LibreWolf updates via homebrew on Mac, and it doesn't harass you about new versions. If you browse HN routinely, you end up seeing the Firefox updates anyway, which is a good reminder to update LibreWolf. I've been really annoyed recently by software that doesn't respect my decision to update on my own schedule, or software that doesn't even let me make that decision at all in the settings. LibreWolf is a real diamond in the rough of web browsers these days.
  - easrng 4y ago
    Why don't you want the thing that has probably the largest attack surface of any program on your computer to get patches immediately?
    - dont__panic 4y ago
      I already update my browser at least once a week when I update all of my homebrew packages; sometimes more. If a vulnerability shows up that's so dangerous I need to immediately patch, I'll hear about it on HN etc. Of course it is good to keep your software up-to-date to eliminate known, patched vulnerabilities. But there are enough unknown vulnerabilities out there that you should practice good hygiene on the web anyway. Auto-updates typically happen on a 1-7 day time scale, so you're vulnerable for some time anyway. I control when my software updates because it's running on my hardware. That I control. I do not like things auto-updating and restarting when I'm trying to use them. It is a distraction from work and a sign of software doing things against my will.
mdaniel 4y ago
I realized while reading your comment they actually do have the perfect button for "I wish to disable browser telemetry": the DNT checkbox Its whole premise is "I, as a user of this browser, do not want to participate in tracking activities." I don't see why mozilla should be exempt from that intention. I'd be some top shelf :chefs_kiss: if mozilla.org honored the DNT but the browser itself didn't
- altairprime 4y ago
  The T in DNT stands for Do Not Track, not Do Not Telemetry. Telemetry and Tracking are not mutually exclusive; both can be implemented by software developers. Telemetry is unidentified software usage statistics from a random IP address somewhere on the Internet, generally without caring about whose telemetry it is. Tracking is an attempt to identify who is operating the software, in order to associate that software's activity with specific human beings in a database. DNT is Do Not Track, which means "do not attempt to identify me" — but I assume that Firefox telemetry typically isn't attempting to identify you in the first place, so making a statement about tracking with the DNT checkbox would not affect telemetry decisions.

elashri 4y ago

While it is not a simple change, you can always modify things in about:config to turn off all (probably) telemetry on Firefox. The annoying thing is that you should keep updating the strings that is changing with updates (when they add or remove strings). Also you can keep an eye to updated to arkenfox user.js because while using it by default probably will break many websites but they keep track of privacy updates of Firefox.

user3939382 4y ago
That's the problem, even with every possible option disabled there is currently no way, even through about:config, to keep Firefox from phoning home at these points in its execution lifecycle. The telemetry settings they provided basically amount to, we'll phone home to Mozilla either more or less, depending on your settings.

SamuelAdams 4y ago

Is it possible to get a list of addresses and add them to a block list, in PiHole for example?

cptskippy 4y ago
Yes, it's already in one of the Steven Black or Peter Lowe lists: incoming.telemetry.mozilla.org

coldpie 4y ago

> As it stands even with all telemetry off Firefox is extremely chatty and I’ve had Mozilla developers tell me they have no intention to fix this. What data is being communicated? What about that data is harmful to you? (Genuinely asking for more information, not trying to convince you you're wrong.)

Nextgrid 4y ago
> What about that data is harmful to you? Arguments like these always reminds me of the story where some town had a population register that included religion, and then the Nazis invaded. You don't know how or when the collected data will be misused, whether by the original owner, a malicious third-party breaching their systems, or the government (and even somewhat-stable governments can quickly turn sour, see Russia or the US's recent issues on abortion for an example). Furthermore, at least in Europe, the GDPR mandates that all non-essential data collection must be strictly opt-in, so regardless of opinions, it's a law with which you have to technically comply (even though lacklustre enforcement allows offenders to get away), but doubly so if your entire selling pitch is based on privacy.
- coldpie 4y ago
  I agree, which is why I asked what data is being collected. If it's like, "a user launched Firefox version 105.0.1 and has Pocket disabled," I've got a tough time caring. Telemetry is genuinely useful information. But if it's like, "a user with IP 123.45 opened MyFavoriteReligion.com and spent 20 minutes at that domain" then it's bad news. So, I'd like to know what's actually being transmitted.
  - EE84M3i 4y ago
    I'm not sure I follow your example, because any telemetry event will always include the IP as it's required to establish a connection.
  - sfink 4y ago
    https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/ answers that question, though admittedly it's not a quick answer that can be easily summarized. It's basically "a user at IP x.y.z.w launched Firefox version 105.0.1 and has Pocket disabled" where the IP is not collected other than in the server logs: "When Firefox sends data to us, your IP address is temporarily collected as part of our server logs." Actual URLs are treated very carefully. The only ways I know that they could be leaked: (1) there is limited exposure via the SafeBrowsing stuff, and (2) if you crash then URLs could be swept up in the crash report and visible to privileged people at Mozilla. Or if you manually submit a profile and don't anonymize it (there's a checkbox to submit URLs that is checked by default), but you have to go out of your way to do that. There very well could be other ways, but browsing history is treated as very sensitive data for both legal and moral reasons. Personally, I would not trust Mozilla to be unable to answer the question "has this IP address ever used Firefox?", especially if under subpoena. The IP is temporarily in the server logs, it's used for coarse location information, etc. I doubt anyone is all that interested in asking that question, though.

s_ting765 4y ago

> Why don’t you give power users at the very least in about:config an option to disable ALL phoning home by Firefox upon launch and exit. Biggest reason I refuse to use Firefox no matter how bad Chromium is. I sometimes use Firefox Focus for doing searches on my phone and the thing is always pinging mozilla services. Some of them location related. No way to turn any of these off on what is supposed to be an incognito browser.

emptyparadise 4y ago
I find it hard to believe Chromium pings any less than Firefox. Would love to get more info on this.
- vntok 4y ago
  Here you go: https://twitter.com/jonathansampson/status/1165858896176660480 https://twitter.com/jonathansampson/status/11658588961766604... > What I found were dozens of requests, which loaded nearly 16 MB in data. Lets break down what I saw. > I also reviewed Google Chrome, for those interested: When I launched Google Chrome for the first time (and let it sit for a minute), 32 requests were made, and 7.26 MB of data downloaded. Presumably Chromium would ping even less than Google Chrome.
  - insanitybit 4y ago
    Raw numbers mean nothing. Lots of these requests are totally benign.
- s_ting765 4y ago
  Believe it. Firefox is kind of unbeaten in this regard. There was a study carried out on what kinds of data leaks on browsers during launch [0] but Chromium specifically wasn't measured. I can only infer Safe browsing to be a leak point available on Chromium since it is shipped by default but I have it turned off (never needed it anyway) so I have not observed any pings related to it personally. [0] https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf

nervuri 4y ago

You can disable all phoning home. Have a look at https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... Having a single setting that does all of this would indeed be nice.

leeoniya 4y ago
https://github.com/arkenfox/user.js https://github.com/arkenfox/user.js https://gist.github.com/ryandaniels/33e443bb401dde665fce15dd2a3959b6 https://gist.github.com/ryandaniels/33e443bb401dde665fce15dd... but yes, a single setting is necessary if you want to also opt out of any _future_ telemetry settings without always having to update your prefs.
- pbhjpbhj 4y ago
  They just revert prefs don't they, add buttons back to your toolbars, etc. Or have they reformed?

WallyFunk 4y ago

If you don't want to configure stuff, LibreWolf[0] has all the phoning home / telemetry stuff blocked out of the box. [0] https://librewolf.net/ https://librewolf.net/

dont__panic 4y ago
Even better, you can manage LibreWolf updates via homebrew on Mac, and it doesn't harass you about new versions. If you browse HN routinely, you end up seeing the Firefox updates anyway, which is a good reminder to update LibreWolf. I've been really annoyed recently by software that doesn't respect my decision to update on my own schedule, or software that doesn't even let me make that decision at all in the settings. LibreWolf is a real diamond in the rough of web browsers these days.
- easrng 4y ago
  Why don't you want the thing that has probably the largest attack surface of any program on your computer to get patches immediately?
  - dont__panic 4y ago
    I already update my browser at least once a week when I update all of my homebrew packages; sometimes more. If a vulnerability shows up that's so dangerous I need to immediately patch, I'll hear about it on HN etc. Of course it is good to keep your software up-to-date to eliminate known, patched vulnerabilities. But there are enough unknown vulnerabilities out there that you should practice good hygiene on the web anyway. Auto-updates typically happen on a 1-7 day time scale, so you're vulnerable for some time anyway. I control when my software updates because it's running on my hardware. That I control. I do not like things auto-updating and restarting when I'm trying to use them. It is a distraction from work and a sign of software doing things against my will.

mdaniel 4y ago

I realized while reading your comment they actually do have the perfect button for "I wish to disable browser telemetry": the DNT checkbox Its whole premise is "I, as a user of this browser, do not want to participate in tracking activities." I don't see why mozilla should be exempt from that intention. I'd be some top shelf :chefs_kiss: if mozilla.org honored the DNT but the browser itself didn't

altairprime 4y ago
The T in DNT stands for Do Not Track, not Do Not Telemetry. Telemetry and Tracking are not mutually exclusive; both can be implemented by software developers. Telemetry is unidentified software usage statistics from a random IP address somewhere on the Internet, generally without caring about whose telemetry it is. Tracking is an attempt to identify who is operating the software, in order to associate that software's activity with specific human beings in a database. DNT is Do Not Track, which means "do not attempt to identify me" — but I assume that Firefox telemetry typically isn't attempting to identify you in the first place, so making a statement about tracking with the DNT checkbox would not affect telemetry decisions.