6 ms·

> As it stands even with all telemetry off Firefox is extremely chatty and I’ve had Mozilla developers tell me they have no intention to fix this. What data is

> As it stands even with all telemetry off Firefox is extremely chatty and I’ve had Mozilla developers tell me they have no intention to fix this. What data is being communicated? What about that data is harmful to you? (Genuinely asking for more information, not trying to convince you you're wrong.)

Nextgrid 4y ago
> What about that data is harmful to you? Arguments like these always reminds me of the story where some town had a population register that included religion, and then the Nazis invaded. You don't know how or when the collected data will be misused, whether by the original owner, a malicious third-party breaching their systems, or the government (and even somewhat-stable governments can quickly turn sour, see Russia or the US's recent issues on abortion for an example). Furthermore, at least in Europe, the GDPR mandates that all non-essential data collection must be strictly opt-in, so regardless of opinions, it's a law with which you have to technically comply (even though lacklustre enforcement allows offenders to get away), but doubly so if your entire selling pitch is based on privacy.
- coldpie 4y ago
  I agree, which is why I asked what data is being collected. If it's like, "a user launched Firefox version 105.0.1 and has Pocket disabled," I've got a tough time caring. Telemetry is genuinely useful information. But if it's like, "a user with IP 123.45 opened MyFavoriteReligion.com and spent 20 minutes at that domain" then it's bad news. So, I'd like to know what's actually being transmitted.
  - EE84M3i 4y ago
    I'm not sure I follow your example, because any telemetry event will always include the IP as it's required to establish a connection.
  - sfink 4y ago
    https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/ answers that question, though admittedly it's not a quick answer that can be easily summarized. It's basically "a user at IP x.y.z.w launched Firefox version 105.0.1 and has Pocket disabled" where the IP is not collected other than in the server logs: "When Firefox sends data to us, your IP address is temporarily collected as part of our server logs." Actual URLs are treated very carefully. The only ways I know that they could be leaked: (1) there is limited exposure via the SafeBrowsing stuff, and (2) if you crash then URLs could be swept up in the crash report and visible to privileged people at Mozilla. Or if you manually submit a profile and don't anonymize it (there's a checkbox to submit URLs that is checked by default), but you have to go out of your way to do that. There very well could be other ways, but browsing history is treated as very sensitive data for both legal and moral reasons. Personally, I would not trust Mozilla to be unable to answer the question "has this IP address ever used Firefox?", especially if under subpoena. The IP is temporarily in the server logs, it's used for coarse location information, etc. I doubt anyone is all that interested in asking that question, though.
- zuhsetaqi 4y ago
  Do you have any source for that story? I also heard of it but don’t know if it’s made up or not and couldn’t find a source
  - jjulius 4y ago
    I was as curious as you, and found this: >While the fact that the census 1939 inquired Jewish ancestry is a well known fact in historiography its significance for the identification of individual Jews in the context of the Shoah has been disputed. The thesis argues that a population register introduced in 1939 - the People's Card Index (Volkskartei) - was essential in the identification of German Jews. Consulting new sources it shows that the collation of the census data on ancestry with the Volkskartei was ordered in March 1941 to facilitate the identification and localisation of German Jews in the context of the deportations. https://sro.sussex.ac.uk/id/eprint/95623/ https://sro.sussex.ac.uk/id/eprint/95623/
    - b112 4y ago
      My understanding, is it wasn't a census, but just info at local town halls. The purpose was only so you could be buried where you wanted, in a preferred cemetery, Catholics in a Catholic cemetery for example, people wanted, and cared about that, back then. But if you died without relatives... the town had to know.
    - marcosdumay 4y ago
      So, the information that killed people was actually one that people overlook even in hindsight? That puts the comments around here saying "what use can they make of X and Y?" on a new light.
- godelski 4y ago
  > Arguments like these always reminds me of the story where some town had a population register that included religion, and then the Nazis invaded. I agree that these questions often are asked by those being deceitful, but the reason that works is because it is a dog whistle. Something that hides in normal speech. But we can't presume that someone asking a question like this is in fact dog whistling. If we do, we only enable to whistlers because honest askers will be put off by pretentious and arrogant responses. It is better to answer in good faith until they show their true colors. Even if it is a dog whistle, others will read this public forum and go "why are they attacking someone who is just asking a question?" That gives them power. So let's be honest here.
freediver 4y ago
All telemetry at the very least transfers your IP address which is legally considered personal information. A browser can not therefore be considered privacy-respecting if it has telemetry turned on by default. Respecting users' privacy at a fundamental level is important for a tool that is our most intimate window to the web (a web browser) even if you personally have 'nothing to hide'.
- coldpie 4y ago
  Can you please describe a theoretical attack on your privacy by Mozilla learning that your IP address launched a Firefox instance?
  - freediver 4y ago
    Burden of proof is not on the user. Burden is on Mozilla (and any browser vendor with telemetry ON by default) to prove that: 1) They are not misusing collected information in any way 2) They need it so badly that telemetry is ON by default, without the explicit consent of the user Both of these are simply addressed by having no telemetry by default and all browser telemetry being completely opt-in. Given that IP address is legally considered private information and Mozilla claims that Firefox is privacy respecting, becoming a zero-telemetry browser by default should be a no-brainer move to substantiate that claim, othwerise it is just empty words that further detoriate the trust in Mozilla. It should also be noted that every browser with telemetry ON by default (which is almost every mainstream browser) is also directly or indirectly monetized by ad-tech, which does not help their case at all.
    - sfink 4y ago
      I'm sympathetic to your point of view, but I disagree. Telemetry is a bit like DRM. Firefox strenuously avoided DRM for a long time, losing a lot of market share in the process, until it became clear that it could not stay relevant without being able to display DRM video. The pragmatic decision was either to (1) stay pure, forbid DRM, and disappear; or (2) give in and support DRM, accept that the battle was lost, and continue to survive in order to influence the battles that had not yet been lost. The same could be said for telemetry, though it has less impact in either direction (it causes less harm, and not having it is less of an existential threat). And we (I work for Mozilla) did resist it for a long time, longer than was probably healthy for the market share, and eventually gave in. At least with telemetry it could be a somewhat principled capitulation—we are much more careful about avoiding tying together different measures that could be correlated to identify users, and we have a strict approval process when adding new telemetry (I've gone through it several times). Telemetry is sadly necessary to stay competitive in today's landscape. For example, speed is the #1 reason that people report for switching browsers. Relying on either benchmarks or user reports for performance tuning simply isn't good enough. The signal is slow and massively lossy. We need to know what our actual users are experiencing, and whether a change had a positive impact on real-world usage or not. It's easy to come up with a change that improves benchmarks, at least a little. It's much harder to move the needle on what our users are experiencing. Without telemetry, we would make lots of changes that would overfit for benchmark behavior, adding complexity and producing very little benefit. The other important piece: opt-in telemetry isn't telemetry. The sampling bias results in massive distortion. Being able to say "this change improves performance *for users who have opted in to telemetry*" is mostly useless. Users who opt in are going to have wildly different hardware, on average. Opt out is much less problematic, even though it also introduces sampling bias, because in practice not that many people bother to opt out. It's definitely reasonable to argue that the opt out mechanisms should be simpler and more clear. Though at the end of the day, it's much more important that we collect telemetry in a way that does not compromise the privacy of people who don't opt out, and (imho) we're doing pretty well there. https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/ gives a decent high-level overview. https://wiki.mozilla.org/Data_Collection https://wiki.mozilla.org/Data_Collection gives more of the nitty gritty detail than you'd probably want.

Nextgrid 4y ago

> What about that data is harmful to you? Arguments like these always reminds me of the story where some town had a population register that included religion, and then the Nazis invaded. You don't know how or when the collected data will be misused, whether by the original owner, a malicious third-party breaching their systems, or the government (and even somewhat-stable governments can quickly turn sour, see Russia or the US's recent issues on abortion for an example). Furthermore, at least in Europe, the GDPR mandates that all non-essential data collection must be strictly opt-in, so regardless of opinions, it's a law with which you have to technically comply (even though lacklustre enforcement allows offenders to get away), but doubly so if your entire selling pitch is based on privacy.

coldpie 4y ago
I agree, which is why I asked what data is being collected. If it's like, "a user launched Firefox version 105.0.1 and has Pocket disabled," I've got a tough time caring. Telemetry is genuinely useful information. But if it's like, "a user with IP 123.45 opened MyFavoriteReligion.com and spent 20 minutes at that domain" then it's bad news. So, I'd like to know what's actually being transmitted.
- EE84M3i 4y ago
  I'm not sure I follow your example, because any telemetry event will always include the IP as it's required to establish a connection.
- sfink 4y ago
  https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/ answers that question, though admittedly it's not a quick answer that can be easily summarized. It's basically "a user at IP x.y.z.w launched Firefox version 105.0.1 and has Pocket disabled" where the IP is not collected other than in the server logs: "When Firefox sends data to us, your IP address is temporarily collected as part of our server logs." Actual URLs are treated very carefully. The only ways I know that they could be leaked: (1) there is limited exposure via the SafeBrowsing stuff, and (2) if you crash then URLs could be swept up in the crash report and visible to privileged people at Mozilla. Or if you manually submit a profile and don't anonymize it (there's a checkbox to submit URLs that is checked by default), but you have to go out of your way to do that. There very well could be other ways, but browsing history is treated as very sensitive data for both legal and moral reasons. Personally, I would not trust Mozilla to be unable to answer the question "has this IP address ever used Firefox?", especially if under subpoena. The IP is temporarily in the server logs, it's used for coarse location information, etc. I doubt anyone is all that interested in asking that question, though.
zuhsetaqi 4y ago
Do you have any source for that story? I also heard of it but don’t know if it’s made up or not and couldn’t find a source
- jjulius 4y ago
  I was as curious as you, and found this: >While the fact that the census 1939 inquired Jewish ancestry is a well known fact in historiography its significance for the identification of individual Jews in the context of the Shoah has been disputed. The thesis argues that a population register introduced in 1939 - the People's Card Index (Volkskartei) - was essential in the identification of German Jews. Consulting new sources it shows that the collation of the census data on ancestry with the Volkskartei was ordered in March 1941 to facilitate the identification and localisation of German Jews in the context of the deportations. https://sro.sussex.ac.uk/id/eprint/95623/ https://sro.sussex.ac.uk/id/eprint/95623/
  - b112 4y ago
    My understanding, is it wasn't a census, but just info at local town halls. The purpose was only so you could be buried where you wanted, in a preferred cemetery, Catholics in a Catholic cemetery for example, people wanted, and cared about that, back then. But if you died without relatives... the town had to know.
  - marcosdumay 4y ago
    So, the information that killed people was actually one that people overlook even in hindsight? That puts the comments around here saying "what use can they make of X and Y?" on a new light.
godelski 4y ago
> Arguments like these always reminds me of the story where some town had a population register that included religion, and then the Nazis invaded. I agree that these questions often are asked by those being deceitful, but the reason that works is because it is a dog whistle. Something that hides in normal speech. But we can't presume that someone asking a question like this is in fact dog whistling. If we do, we only enable to whistlers because honest askers will be put off by pretentious and arrogant responses. It is better to answer in good faith until they show their true colors. Even if it is a dog whistle, others will read this public forum and go "why are they attacking someone who is just asking a question?" That gives them power. So let's be honest here.

freediver 4y ago

All telemetry at the very least transfers your IP address which is legally considered personal information. A browser can not therefore be considered privacy-respecting if it has telemetry turned on by default. Respecting users' privacy at a fundamental level is important for a tool that is our most intimate window to the web (a web browser) even if you personally have 'nothing to hide'.

coldpie 4y ago
Can you please describe a theoretical attack on your privacy by Mozilla learning that your IP address launched a Firefox instance?
- freediver 4y ago
  Burden of proof is not on the user. Burden is on Mozilla (and any browser vendor with telemetry ON by default) to prove that: 1) They are not misusing collected information in any way 2) They need it so badly that telemetry is ON by default, without the explicit consent of the user Both of these are simply addressed by having no telemetry by default and all browser telemetry being completely opt-in. Given that IP address is legally considered private information and Mozilla claims that Firefox is privacy respecting, becoming a zero-telemetry browser by default should be a no-brainer move to substantiate that claim, othwerise it is just empty words that further detoriate the trust in Mozilla. It should also be noted that every browser with telemetry ON by default (which is almost every mainstream browser) is also directly or indirectly monetized by ad-tech, which does not help their case at all.
  - sfink 4y ago
    I'm sympathetic to your point of view, but I disagree. Telemetry is a bit like DRM. Firefox strenuously avoided DRM for a long time, losing a lot of market share in the process, until it became clear that it could not stay relevant without being able to display DRM video. The pragmatic decision was either to (1) stay pure, forbid DRM, and disappear; or (2) give in and support DRM, accept that the battle was lost, and continue to survive in order to influence the battles that had not yet been lost. The same could be said for telemetry, though it has less impact in either direction (it causes less harm, and not having it is less of an existential threat). And we (I work for Mozilla) did resist it for a long time, longer than was probably healthy for the market share, and eventually gave in. At least with telemetry it could be a somewhat principled capitulation—we are much more careful about avoiding tying together different measures that could be correlated to identify users, and we have a strict approval process when adding new telemetry (I've gone through it several times). Telemetry is sadly necessary to stay competitive in today's landscape. For example, speed is the #1 reason that people report for switching browsers. Relying on either benchmarks or user reports for performance tuning simply isn't good enough. The signal is slow and massively lossy. We need to know what our actual users are experiencing, and whether a change had a positive impact on real-world usage or not. It's easy to come up with a change that improves benchmarks, at least a little. It's much harder to move the needle on what our users are experiencing. Without telemetry, we would make lots of changes that would overfit for benchmark behavior, adding complexity and producing very little benefit. The other important piece: opt-in telemetry isn't telemetry. The sampling bias results in massive distortion. Being able to say "this change improves performance *for users who have opted in to telemetry*" is mostly useless. Users who opt in are going to have wildly different hardware, on average. Opt out is much less problematic, even though it also introduces sampling bias, because in practice not that many people bother to opt out. It's definitely reasonable to argue that the opt out mechanisms should be simpler and more clear. Though at the end of the day, it's much more important that we collect telemetry in a way that does not compromise the privacy of people who don't opt out, and (imho) we're doing pretty well there. https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/ gives a decent high-level overview. https://wiki.mozilla.org/Data_Collection https://wiki.mozilla.org/Data_Collection gives more of the nitty gritty detail than you'd probably want.