11 ms·

Loopholes in Google’s data safety labels

191 points by nemoniac 4y ago

stuff4ben 4y ago
Glad to see someone trying to keep Google accountable! They're a long way from their Do No Evil mantra these days.
- GoToRO 4y ago
  Today's google would be banned by 15 years ago's google. One rule they had was that the style of the ads on your website should not match the style of the website (clearly visible ads). Today most people do not realize that the first page on google.com is mostly ads.
  - obituary_latte 4y ago
    Unfortunately, as is almost always the case, the almighty dollar skews ideals. Is it even technically possible for a public company to be "good" these days?
    - fendy3002 4y ago
      Logically no, when the overly optimized and less secured options are rewarded. There's a story of a car company which calculate the cost needed to recall a defective model (safety-wise), versus the fines needed to pay times the possibility that the error may occur. There's cheaper on the later so they don't do the recall. And the recent train derailments, many people said that if the fines are lower than the reduced cost they get for lowering the safety, they'll keep doing it again.
    - reaperducer 4y ago
      Is it even technically possible for a public company to be "good" these days? Yes, there are many companies that do good things, and some that exist solely to do good things. The difference is that they focus on doing those good things, so they don't show up in headlines very often.
    - samman 4y ago
      Perhaps: https://www.bcorporation.net/en-us/ https://www.bcorporation.net/en-us/
    - frankfrankfrank 4y ago
      There is this fixation on “the dollar” or even “capitalism”, but in reality both of those are essentially just abstractions for the underlying human behaviors, which is mostly greed and the lying and deception used to obfuscate greed. Neither the dollar as the object of transaction nor the system of accounting (accounting for resource allocation) called capitalism, have any real connection to the underlying drivers. The same problems existed in many other means of transacting (currency) and economic systems (communism notoriously being a sprint towards corruption). Unfortunately, people have forgotten or have intentionally been misled from realizing the tacit type of self-regulating controls of a system like actual capitalism (you lose money when making bad decisions, you aren’t rewarded by thieving friends in government) and even aristocracy, where you had to maintain a certain balance of relationships even with the peasants in order to prevent being made a foot shorter. Ironically, the rather tyrannical caste that has we emerged on Mt Davos is forgetting that sometimes the dumb and easily manipulated peasantry the technocrats see themselves as being benevolent demigod leaders of, don’t take so kindly to their shenanigans, with dire consequences for all. I mean what are you, a bigot, racist, sexism homophobe for questioning the beneficent and glorious, exhaled rule of the Ruling Gods over your life and limitations on what you can do, say, and think? You better. Don’t get any ideas or your gods on Mt Davos will strike you down with ban hammers.
      - giraffe_lady 4y ago
        > Neither the dollar as the object of transaction nor the system of accounting (accounting for resource allocation) called capitalism, have any real connection to the underlying drivers. The same problems existed in many other means of transacting (currency) and economic systems (communism notoriously being a sprint towards corruption). Capitalism provides a moral justification for the actions of greed, it makes responding to those incentives seem inevitable and necessary and so not the responsibility of the person actually doing it. Neither of those is necessarily inherent to capitalism, I guess, but they are certainly part of the structure of the capitalism we live with so shouldn't be dismissed either.
      - edgyquant 4y ago
        Capitalism isn’t a form of accounting it’s a mode of production
    - bogwog 4y ago
      That's why regulation is needed. Efficient corporations will (and must) do the most profitable and legal thing always. What would the economy look like if corporations behaved irrationally, by doing unprofitable things based on unpredictable/fickle human emotions? It might be a cynical way to look at it, but overall I don't think it's sustainable to place the responsibility of caring for society on corporations. Saying that Google or their employees are evil for doing the thing they're supposed to do is pointless. If they don't do <evil thing>, a competitor will do <evil thing>. The only way to save the world from <evil thing> is to make it illegal (and preferably with criminal penalties, not just small fines), so that corporations can avoid doing it without worrying about the competitive risks. (although Google and all of big tech are evil monopolists and they need to be broken up)
      - photochemsyn 4y ago
        Governmental regulatory agencies are largely captured by the likes of Google and Apple, and if not completely captured there's a very large influence that prevents regulators from taking any actions that would actually threaten profits of monopolistic corporations. There has been a little push back recently, in terms of preventing more mergers and a push towards breaking up conglomerates, but not without a lot of political resistance: https://mattstoller.substack.com/p/on-lina-khan-derangement-syndrome https://mattstoller.substack.com/p/on-lina-khan-derangement-...
      - akaij 4y ago
        > It might be a cynical way to look at it, but overall I don't think it's sustainable to place the responsibility of caring for society on corporations. This line of thinking bothers me more than it probably should. How can corporations be thought of as separate entities from the people it consists of, in any context except legal? I wrote a lot more, but decided to distill it into one question: How can they be, in good conscience, allowed to get a pass?
        bogwog 4y ago
        Because corporations aren’t people, they’re machines that happen to be powered by human labor. There’s some wiggle room for individuals to make a difference, but ultimately the market will win in the long run. Consider the CEO of Google growing a conscience (hypothetically ofc). If he decides to cut back on <evil things> for the good of society, then society will benefit, but Google shareholders will lose. The impact will be measurable in financial statements, and when the board meets to vote on a new CEO, they’ll replace him with someone who will do a better job of making those numbers go up (aka someone without that conscience). The system self-corrects in the long run! The CEO has a legal obligation to protect the interests of share holders (“fiduciary duty”). So from that perspective, a CEO acting in the interests of society rather than shareholders is breaking the law, and could be personally liable. The incentives in the system are not set up in such a way that corporations could be reasonably expected to “self police” in a way that benefits society at the expense of shareholders. Sure, in some cases it’s possible to have a win-win scenario, where everyone benefits, but those are extremely rare. IMO this is a good system because it leads to the primary producers to perform at peak efficiency, but it doesn’t work unless it’s balanced by government regulation, which is something that the government has been miserably failing at for the past two decades (at least)
    - photochemsyn 4y ago
      This is the central problem with investment capitalism, as distinguished from what I'd call industrial capitalism. Once you put the shareholder associations in the driver's seat, and eliminate most input from the people who work for the corporation, you always find the company trending towards monopolistic behavior, eventually leading to poor-quality products with various safety issues, because that's a way of reducing costs once you have a captive market. With Google and Apple, ownership is somewhat diffuse but the top tiers are the usual suspects: Vanguard, Blackrock, FMR, State Street, Berkshire-Hathaway, etc. https://finance.yahoo.com/quote/GOOGL/holders/ https://finance.yahoo.com/quote/GOOGL/holders/ https://finance.yahoo.com/quote/AAPL/holders/ https://finance.yahoo.com/quote/AAPL/holders/ The only real solution is to give the employees of the corporation the degree of power when it comes to selecting the executive cohort as the shareholders of the corporation have - i.e. a 1 : 1 ratio. Germany does this to some extent. The other option is more radical - eliminate the shareholder system of devolved liability entirely, and only allow the people who work within a corporation to own shares in that corporation. (Note that the traditional communist-socialist approach would be to simply replace the shareholders with a governmental central committee while keeping the structure essentially the same.)
  - Razengan 4y ago
    > Today most people do not realize that the first page on google.com is mostly ads. Ugh this. Trying to search for almost any generic phrase or term just floods the results with links to shops and "TOP 10 BEST thingYouSearched" Google Search feels almost useless now for anything other than shortcuts [in]to websites you already know about.
    - raincole 4y ago
      Google feels like an index engine of Reddit (and sometimes HN) to me.
    - jjav 4y ago
      > Google Search feels almost useless now for anything other than shortcuts [in]to websites you already know about. In my experience, not even that. I used to be lazy and use google search to get to websites I knew, but it can no longer find them even if I type it in exactly! So I've mostly had to revert to making sure I bookmark the sites and go in that way. (And of course I've switched to ddg for search.)
    - reaperducer 4y ago
      Trying to search for almost any generic phrase or term just floods the results with links to shops and "TOP 10 BEST thingYouSearched" eBay is the worst for this. "Pancreatic cancer now on sale at eBay!" "The best Libertarian Morals now on sale at eBay!" "Buy discount Rings of Saturn now at eBay!"
      - Razengan 4y ago
        I would gladly pay for one of these.
- hgsgm 4y ago
  It was "Don't Be Evil".
jqpabc123 4y ago
Take away facts: Google's business model is built around privacy invasion and data collection. Mozilla's business model is built around Google. Process these as you see fit.
- cassianoleal 4y ago
  You're not entirely wrong, but how do you reconcile that with the OP? Genuine question.
  - deleted 4y ago
    [deleted]
  - jqpabc123 4y ago
    In the same way you reconcile "Don't Be Evil" with Google. In the same way you reconcile Mozilla's privacy concerns with the fact that every Firefox install gets tagged with a unique digital fingerprint and keeps a persistent websocket connection open in the background.
    - cassianoleal 4y ago
      > In the same way you reconcile "Don't Be Evil" with Google. I don't think that's fair, especially since they have already dropped it. > In the same way you reconcile Mozilla's privacy concerns with the fact that every Firefox install gets tagged with a unique digital fingerprint I'm not sure what you're on about here. Care to elaborate? > and keeps a persistent websocket connection open in the background. Hadn't heard of this one before. Do you have sources?
      - jqpabc123 4y ago
        I don't think that's fair, especially since they have already dropped it. Dropping it doesn't change the duplicity that existed for almost 2 decades. Hadn't heard of this one before. Do you have sources? https://borncity.com/win/2022/03/22/firefox-installer-weist-dem-browser-eine-eindeutige-kennung-zu/ https://borncity.com/win/2022/03/22/firefox-installer-weist-... https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf
theK 4y ago
> we found discrepancies between the apps’ privacy policies and the information they reported to consumers on Google’s Data Safety form. So its like a "sue yourself" system? :-D
lerela 4y ago
Funny coincidence that I have received a notification from the Play store this morning saying that analysis of my app (with super tiny outreach) showed that my Data Safety Form was inaccurate and asking me to fix it asap. Seems like letting the user enter an email address to recover his password counts as email collection (he cannot subscribe, provide or see his email using the app, hence the initial form I submitted).
- warp 4y ago
  If you're sending the email address to a server (which is presumably needed to recover a password), I think this makes sense. Apple/Google has no way of knowing or verifying what the the server is doing with that data.
  - lerela 4y ago
    Absolutely, I meant that the app is not used to collect the email address since it is already in our system but it is true they have no way of knowing.
denton-scratch 4y ago
> The form includes significant loopholes, like failing to require the apps to report data sharing with “service providers.” > As we’ve noted, data sharing with “service providers” is exempt from disclosure requirements. > Many different companies act as service providers, including Google itself Well, whaddya know. Apps don't have to report whether they share data with Google. I found it striking that in the list of four questions that Mozilla asked Google, not one of them elicited a straight answer. I don't mean just evasive or slippery; they failed to answer the question, instead answering a different question, one that wasn't asked.
- reaperducer 4y ago
  they failed to answer the question, instead answering a different question, one that wasn't asked. Politicians do this all the time. Constantly. They do it because the PR firms taught them to do this, and those same PR people work for tech companies now. (It's awful that journalists these days let politicians get away with it. When I went to journalism school, we would get a failing grade if we allowed an interview subject to dodge a question like that, but that's a rant for another day.)
  - frankfrankfrank 4y ago
    [flagged]
  - nrook 4y ago
    There's a funny passage in one of Al Franken's books about this. Franken was a comedian who ran for the U.S. Senate and was successfully elected. (He later escaped in celestial disgrace, but that's unrelated.) He talks about how he was trained to do this by his PR folks, thought it was stupid, tried it out in a few interviews to get them off his back, and then was amazed that it worked every time.
    - hgsgm 4y ago
      The documentary "Thank You For Smoking" illustrates this.
dmingod666 4y ago
I don't have specific views on what they've written.. but 90% of donations to Firefox come from Google. The 3 year contract ends in 2023.. If Google decides to not fund it next year it's bad management on FFs part. Putting all your eggs in one basket is very risky and puts you in a place where you may have an ugly compromises Vs face bad consequences..
- Razengan 4y ago
  > 90% of donations to Firefox come from Google. Why? What does Google get from it? How do they justify this expense internally?
  - not_your_vase 4y ago
    They pay to be the default search engine. It's just the cherry on top, that as long as Firefox survives, Google can deflect browser-monopoly accusations.
    - boomboomsubban 4y ago
      Google is currently facing a search engine monopoly case where their purchase of the default search in other browsers is being used against them. Being the default search has value. It's why Google pays Apple billions a year for the same thing.
    - hbn 4y ago
      I would think the monopoly deflection is much more valuable to Google than being Firefox's default search engine. 3% marketshare, comprised primarily of, if I had to guess, people who are the most likely userbase of any browser to know how to change their default search engine.
  - i_am_proteus 4y ago
    Google is the default search engine for official FF binaries.
    - 4y ago
Nextgrid 4y ago
It is the same situation with Apple's App Store privacy labels.
- Bloating 4y ago
  shush...
  - LoganDark 4y ago
    :)
sylware 4y ago
[flagged]
deleted 4y ago
[deleted]
dao- 4y ago
Anyone else irritated by the "Executive Summary" heading for what I think most would call an abstract? As a non-native speaker I had to look up the term to confirm it meant what I guessed it would mean: summary meant for executives as in a corporation's "executive officers". Always breaks my heart to see corporate speak creep into normal speak :( Btw, "Executive Summary" being listed under "Summary" also seems weird. I'd call that a table of contents. Feeling particularly nitpicky today.
- xnyan 4y ago
  "Executive Summary" is an inoffensive way to say "Look, I know you cannot understand this and/or will not read this, so here's a small amount of text written simply that you can use to make a decision."
  - marcosdumay 4y ago
    Yeah... That's called a "summary". But people made trouble by calling the table of contents a summary, and the name is now ambiguous.
    - xnyan 4y ago
      Not exactly. Say for example you’re in a situation where an executive has to approve the budget of an engineering project they are not able to understand. A summary would do no good, because it would be incomprehensible to them. In other words, an executive summary is the summary for a non-expert stakeholder. In practice you use this to tell the executive what you want them to think.
      - LoganDark 4y ago
        > In other words, an executive summary is the summary for a non-expert stakeholder. In practice you use this to tell the executive what you want them to think. ...no, an executive summary is not "a summary for a clueless executive". An executive summary provides enough information to act on the material... that is, a summary that promotes executive function[0], otherwise known as decision-making based on what it is summarizing. The "executive" here is not a noun, it's the same "executive" as in "executive function" and "executive decision". And yes, it's also where the job role gets its name. [0]: https://en.wikipedia.org/wiki/Executive_functions https://en.wikipedia.org/wiki/Executive_functions
Kukumber 4y ago
Well, they don't mind selling their users to Google or Pocket, so are they really loopholes? or is that a PR stunt? i'm leaning towards the later, what about you?
- dao- 4y ago
  In what way is Mozilla selling their users to Pocket? Do you realize that Mozilla acquired Pocket years ago?
  - Kukumber 4y ago
    Mozilla didn't acquire it, Mozilla is a non profit Mozilla Corporation did, and they put it in Firefox and you can't opt-out
    - LoganDark 4y ago
      > you can't opt-out You sort of can, but you need to manually dig through tens of hidden options in about:config.
      - dao- 4y ago
        You can remove the button from the toolbar and disable pocket stuff on the new tab page. What other touchpoints are there that average users should care about and that can only be disabled in about:config?
      - jszymborski 4y ago
        It's just one option in about:config https://support.mozilla.org/en-US/kb/disable-or-re-enable-pocket-for-firefox https://support.mozilla.org/en-US/kb/disable-or-re-enable-po...
    - dao- 4y ago
      The Mozilla Foundation owns the Mozilla Corporation, so no matter how you slice it, yes, Mozilla acquired Pocket.
jasonhong 4y ago
Somewhat related to the original post, our research team at Carnegie Mellon University has been investigating how well developers can fill out these kinds of privacy nutrition labels. This paper looks at iOS developers. We found that there was a lot of misconceptions and misunderstandings that led to under-reporting as well as over-reporting of behaviors. For example, on iOS, "tracking" is defined only in the context of advertising. A lot of people also misunderstood what "Data Linked to Users" means https://dl.acm.org/doi/fullHtml/10.1145/3491102.3502012 https://dl.acm.org/doi/fullHtml/10.1145/3491102.3502012 Our research team has also been crawling these labels on both Apple App Store and Google Play to understand changes in labels over time. One early result is that these nutrition labels are not updated very often. https://dl.acm.org/doi/fullHtml/10.1145/3491101.3519739 https://dl.acm.org/doi/fullHtml/10.1145/3491101.3519739 Lastly, we've developed an IDE plugin for JetBrains to help developers fill out labels more accurately (and hopefully more easily too) for Google Play. The key idea is to have developers add privacy annotations (in the form of Java annotations) directly into their code. The plugin uses a bunch of heuristics to flag where you might need an annotation, and helps you fill out those annotations. These annotations are then used to generate a CSV file that can be uploaded to Google Play. https://matcha-ide.github.io/ https://matcha-ide.github.io/ I also have a talk called Helping Developers with Privacy. It summarizes the last decade of our team's research on this topic. (Note that Slideshare has become a bit spammy, inserting ads in between slides, sorry about that) https://www.slideshare.net/jas0nh0ng/helping-developers-with-privacy-253988827 https://www.slideshare.net/jas0nh0ng/helping-developers-with... Stepping back, our team has been looking at two big ideas for privacy. One is these privacy annotations. I think annotations has the potential to be transformative for the privacy ecosystem. They can help developers, they can be assisted with IDE tools, they can be embedded into compiled code, they can be used to help auto-generate privacy user interfaces, and can also be used as a major hint to check the behavior of the apps (by app stores, by auditors, by journalists, and by researchers). The second is that every app should have a simple manifest that whitelists an app's privacy-related behaviors. The manifest describes what data will be used and a chain of transformations, similar to Unix pipes. In the context of smart homes, an example might be: get access to microphone -> transform to loudness -> send to sleep.com. While we don't know exactly what sleep.com will do with the data, we can have more assurance that it's not sending raw microphone data. Here's a paper at Oakland Security that describes our ideas. An interesting part of our initial analysis is that the vast majority of apps don't need raw data (raw microphone data, GPS data, logs, etc). Rather, they need a processed and more granular form of it (e.g. loudness, what city you are in, etc). http://haojianj.in/resource/pdf/peekaboo-preprint.pdf http://haojianj.in/resource/pdf/peekaboo-preprint.pdf Happy to chat more about these topics, we've been working on privacy for quite a while and have had some successes with industry and with the US Federal Trade Commission.
photochemsyn 4y ago
Google's and Apple's central rationale for limiting app developers to working through their app stores is that they're screening apps for security reasons. If they're doing such a poor job of it, then there's no reason for such limitations, other than as another rent-seeking monopoly effort. > "Additionally, a new Commerce Department report cited Apple and Google as “gatekeepers” of mobile app stores, leaving consumers at the mercy of their pricing and selection. The report calls for new legislation that would boost competition in the mobile app market, which would help both consumers and app developers." To extend the FDA analogy, we don't really require stores that sell products to be held responsible for flaws in or problems with those products, e.g. contaminated baby formula. The onus should be on the manufacturer (or the app developer) - but this also means that if a store sells a certain brand (e.g. Whole Foods 365 brand) then they are directly responsible for any issues with that product.
codazoda 4y ago
Consumers don’t read privacy policies so they shouldn’t be a major part of this. Something more akin to the nutrition label example they use is needed.
danpalmer 4y ago
> The form includes significant loopholes, like failing to require the apps to report data sharing with “service providers.” Mozilla is taking a principled stance that _all_ sharing of data should fall into the same category of "we gave your data to someone else", but I think there's a much more pragmatic breakdown. Data can either be not-shared, shared to service providers with contractual obligations to treat that data as owned by the original service, or shared to service providers who may then use and further share that data for their own purposes. Examples of the latter two would be the difference between sending crash reports to a crash reporting service that doesn't interpret user data in any way and is only a mechanism used by the original service, vs, say, sending it to Facebook to report an advertisement conversion, where it will be used to further the Facebook ad modelling. As a privacy conscious user I typically don't mind the former, but despise the latter. Mozilla does not appear to distinguish between these two cases. One could argue that the former is still increasing the scope of data being hacked, or that companies might breach their contracts and use it anyway, but if you assume illegality then most of this breaks down anyway, we have to assume that companies stick to the law and their contracts for any of this to be of any use (and I think that's mostly reasonable for us to do). I work closely to this area at Google so I don't want to comment on how this fits with Google's data safety labels and the privacy policies of apps. I think people should read the documentation and draw their own conclusions. I personally think that this issue sits at the intersection of principles and pragmatism – making information correct but conveying a less immediately useful message, vs making information accessible and actionable for the majority of users. Google (and Apple) also still need to appeal to developers to get them to build for their platforms, and that again may require pragmatism.
- lmkg 4y ago
  > Data can either be not-shared, shared to service providers with contractual obligations [...], or shared to service providers who may then use [...]. To follow up, this distinction is also made by both GDPR in Europe, and CCPA in California. (In fact, CCPA uses the same term "Service Provider" and I wouldn't be surprised if that's where Google got it from.) Still, both GDPR and CCPA require disclosure of Processors/Service Providers. Transfers to a Processor/Service Provider have restrictions, and that's significant. Such third parties are treated differently under the law, with those restrictions removing the need for other safeguards. But the don't entirely remove any risk. Ultimately one of the goals of these disclosures is letting the user take control over how their data is used and distributed. Some users (including you, and including myself) are comfortable with data transfers that are protected by legal safeguards rather than technical ones. Some are not comfortable with that, and have valid reasons to be. Some users reasonably want to know their full security risk exposure, which means being aware of which parties are handling their data. Some users simply don't want to do business with certain platform providers, even indirectly. I'll also point out that the EU has found that US safeguards about transfers to Service Providers are inadequate, because if a third party has your data that means US law enforcement can get your data from that third party. So there are very valid concerns that the safeguards Google considers adequate for a Service Provider may not satisfy all users. All of which is to say, I agree that the distinction about Service Providers is useful and meaningful, but I think it is the wrong decision to exempt Service Providers from being listed altogether.
andreygrehov 4y ago
When it comes to Google, here is another anecdote (loophole?) that I personally experienced once in my life. I worked for a company whose business Google account was somehow deleted. The access to Gmail was entirely lost, which was super critical for the company. One of our employees spent hours dealing with Google customer support. If I'm not being mistaken here, the response that they kept getting from Google was something along the lines of "due to our data safety and data retention policies, we are not able to recover your Google account". That same phrase was repeated again and again by various Google reps. Long story short, the company recovered everything. The solution was to email one of the investors and ask them if they can help in any way. It was hilarious. The mail thread was something like: Company: > Hey Joe, due to xxxxx, we lost access to yyyyy@yyyyy.com. Google customer support cannot do anything. Any ideas what shall we do? Joe forwards the email to an internal Google employee with just two words: > Handle this. The account is fully back online within 30 minutes.
- marcellus23 4y ago
  Curious, what was Joe's relationship to Google? How was he able to exercise that kind of authority?
  - andreygrehov 4y ago
    AFAIK, Joe does not have any direct relationships with Google. I suppose, he's just a powerful venture capitalist.
    - hgsgm 4y ago
      Who happens to know the random engineer who controls accounts?
      - falcolas 4y ago
        Probably a C level. They don’t need control over accounts to get an account recovered.
awinter-py 4y ago
yeah this stuff is meaningless until it's asserted from a linter or runtime firewall I'm not sure why mozilla is wasting their time criticizing detail mismatches -- the self-report system only creates accountability for relatively well meaning players who are large enough to 1) be worth auditing and 2) have reputational risk little snitch everywhere
gerash 4y ago
> Our research closely mirrors the 2021 Washington Post investigation into the accuracy of the Apple App Store’s new data privacy labels for apps. The investigation found that not only were many of the labels confusing and incomplete - they were also false Apple came up with this "nutrition label" idea for app usages of data that is self reported by developers. Everyone assumed "increase in privacy". Google copied the practice and it's full of "loopholes" now. This whole data privacy, unlike cryptography, has become more of a marketing tactic and media loves to create super villains and super-heros out of it. There's no substance here.
- marcellus23 4y ago
  Is there really a double standard here? The subhead of the wapo article is: > Apple’s plan to make iPhone apps be transparent about the data they take falls short of being helpful — or even accurate
rantee 4y ago
While privacy policies are increasingly tailored to an app's actual data usage,* there are still FAR too many out there full of the same copypasta allowing a company to do whatever they want with your data. With that in mind, it's hardly a surprise that there's a disconnect between what engineers self-report and what's buried in the policies. * Based on my own experience over the years actually reading them as someone who both cares about this stuff and works in the space.
vfclists 4y ago
Perhaps if they had focused on developing Firefox OS they wouldn't have to put up this.

191 points by nemoniac 4y ago

stuff4ben 4y ago

Glad to see someone trying to keep Google accountable! They're a long way from their Do No Evil mantra these days.

GoToRO 4y ago
Today's google would be banned by 15 years ago's google. One rule they had was that the style of the ads on your website should not match the style of the website (clearly visible ads). Today most people do not realize that the first page on google.com is mostly ads.
- obituary_latte 4y ago
  Unfortunately, as is almost always the case, the almighty dollar skews ideals. Is it even technically possible for a public company to be "good" these days?
  - fendy3002 4y ago
    Logically no, when the overly optimized and less secured options are rewarded. There's a story of a car company which calculate the cost needed to recall a defective model (safety-wise), versus the fines needed to pay times the possibility that the error may occur. There's cheaper on the later so they don't do the recall. And the recent train derailments, many people said that if the fines are lower than the reduced cost they get for lowering the safety, they'll keep doing it again.
  - reaperducer 4y ago
    Is it even technically possible for a public company to be "good" these days? Yes, there are many companies that do good things, and some that exist solely to do good things. The difference is that they focus on doing those good things, so they don't show up in headlines very often.
  - samman 4y ago
    Perhaps: https://www.bcorporation.net/en-us/ https://www.bcorporation.net/en-us/
  - frankfrankfrank 4y ago
    There is this fixation on “the dollar” or even “capitalism”, but in reality both of those are essentially just abstractions for the underlying human behaviors, which is mostly greed and the lying and deception used to obfuscate greed. Neither the dollar as the object of transaction nor the system of accounting (accounting for resource allocation) called capitalism, have any real connection to the underlying drivers. The same problems existed in many other means of transacting (currency) and economic systems (communism notoriously being a sprint towards corruption). Unfortunately, people have forgotten or have intentionally been misled from realizing the tacit type of self-regulating controls of a system like actual capitalism (you lose money when making bad decisions, you aren’t rewarded by thieving friends in government) and even aristocracy, where you had to maintain a certain balance of relationships even with the peasants in order to prevent being made a foot shorter. Ironically, the rather tyrannical caste that has we emerged on Mt Davos is forgetting that sometimes the dumb and easily manipulated peasantry the technocrats see themselves as being benevolent demigod leaders of, don’t take so kindly to their shenanigans, with dire consequences for all. I mean what are you, a bigot, racist, sexism homophobe for questioning the beneficent and glorious, exhaled rule of the Ruling Gods over your life and limitations on what you can do, say, and think? You better. Don’t get any ideas or your gods on Mt Davos will strike you down with ban hammers.
    - giraffe_lady 4y ago
      > Neither the dollar as the object of transaction nor the system of accounting (accounting for resource allocation) called capitalism, have any real connection to the underlying drivers. The same problems existed in many other means of transacting (currency) and economic systems (communism notoriously being a sprint towards corruption). Capitalism provides a moral justification for the actions of greed, it makes responding to those incentives seem inevitable and necessary and so not the responsibility of the person actually doing it. Neither of those is necessarily inherent to capitalism, I guess, but they are certainly part of the structure of the capitalism we live with so shouldn't be dismissed either.
    - edgyquant 4y ago
      Capitalism isn’t a form of accounting it’s a mode of production
  - bogwog 4y ago
    That's why regulation is needed. Efficient corporations will (and must) do the most profitable and legal thing always. What would the economy look like if corporations behaved irrationally, by doing unprofitable things based on unpredictable/fickle human emotions? It might be a cynical way to look at it, but overall I don't think it's sustainable to place the responsibility of caring for society on corporations. Saying that Google or their employees are evil for doing the thing they're supposed to do is pointless. If they don't do <evil thing>, a competitor will do <evil thing>. The only way to save the world from <evil thing> is to make it illegal (and preferably with criminal penalties, not just small fines), so that corporations can avoid doing it without worrying about the competitive risks. (although Google and all of big tech are evil monopolists and they need to be broken up)
    - photochemsyn 4y ago
      Governmental regulatory agencies are largely captured by the likes of Google and Apple, and if not completely captured there's a very large influence that prevents regulators from taking any actions that would actually threaten profits of monopolistic corporations. There has been a little push back recently, in terms of preventing more mergers and a push towards breaking up conglomerates, but not without a lot of political resistance: https://mattstoller.substack.com/p/on-lina-khan-derangement-syndrome https://mattstoller.substack.com/p/on-lina-khan-derangement-...
    - akaij 4y ago
      > It might be a cynical way to look at it, but overall I don't think it's sustainable to place the responsibility of caring for society on corporations. This line of thinking bothers me more than it probably should. How can corporations be thought of as separate entities from the people it consists of, in any context except legal? I wrote a lot more, but decided to distill it into one question: How can they be, in good conscience, allowed to get a pass?
      - bogwog 4y ago
        Because corporations aren’t people, they’re machines that happen to be powered by human labor. There’s some wiggle room for individuals to make a difference, but ultimately the market will win in the long run. Consider the CEO of Google growing a conscience (hypothetically ofc). If he decides to cut back on <evil things> for the good of society, then society will benefit, but Google shareholders will lose. The impact will be measurable in financial statements, and when the board meets to vote on a new CEO, they’ll replace him with someone who will do a better job of making those numbers go up (aka someone without that conscience). The system self-corrects in the long run! The CEO has a legal obligation to protect the interests of share holders (“fiduciary duty”). So from that perspective, a CEO acting in the interests of society rather than shareholders is breaking the law, and could be personally liable. The incentives in the system are not set up in such a way that corporations could be reasonably expected to “self police” in a way that benefits society at the expense of shareholders. Sure, in some cases it’s possible to have a win-win scenario, where everyone benefits, but those are extremely rare. IMO this is a good system because it leads to the primary producers to perform at peak efficiency, but it doesn’t work unless it’s balanced by government regulation, which is something that the government has been miserably failing at for the past two decades (at least)
  - photochemsyn 4y ago
    This is the central problem with investment capitalism, as distinguished from what I'd call industrial capitalism. Once you put the shareholder associations in the driver's seat, and eliminate most input from the people who work for the corporation, you always find the company trending towards monopolistic behavior, eventually leading to poor-quality products with various safety issues, because that's a way of reducing costs once you have a captive market. With Google and Apple, ownership is somewhat diffuse but the top tiers are the usual suspects: Vanguard, Blackrock, FMR, State Street, Berkshire-Hathaway, etc. https://finance.yahoo.com/quote/GOOGL/holders/ https://finance.yahoo.com/quote/GOOGL/holders/ https://finance.yahoo.com/quote/AAPL/holders/ https://finance.yahoo.com/quote/AAPL/holders/ The only real solution is to give the employees of the corporation the degree of power when it comes to selecting the executive cohort as the shareholders of the corporation have - i.e. a 1 : 1 ratio. Germany does this to some extent. The other option is more radical - eliminate the shareholder system of devolved liability entirely, and only allow the people who work within a corporation to own shares in that corporation. (Note that the traditional communist-socialist approach would be to simply replace the shareholders with a governmental central committee while keeping the structure essentially the same.)
- Razengan 4y ago
  > Today most people do not realize that the first page on google.com is mostly ads. Ugh this. Trying to search for almost any generic phrase or term just floods the results with links to shops and "TOP 10 BEST thingYouSearched" Google Search feels almost useless now for anything other than shortcuts [in]to websites you already know about.
  - raincole 4y ago
    Google feels like an index engine of Reddit (and sometimes HN) to me.
  - jjav 4y ago
    > Google Search feels almost useless now for anything other than shortcuts [in]to websites you already know about. In my experience, not even that. I used to be lazy and use google search to get to websites I knew, but it can no longer find them even if I type it in exactly! So I've mostly had to revert to making sure I bookmark the sites and go in that way. (And of course I've switched to ddg for search.)
  - reaperducer 4y ago
    Trying to search for almost any generic phrase or term just floods the results with links to shops and "TOP 10 BEST thingYouSearched" eBay is the worst for this. "Pancreatic cancer now on sale at eBay!" "The best Libertarian Morals now on sale at eBay!" "Buy discount Rings of Saturn now at eBay!"
    - Razengan 4y ago
      I would gladly pay for one of these.
hgsgm 4y ago
It was "Don't Be Evil".

jqpabc123 4y ago

Take away facts: Google's business model is built around privacy invasion and data collection. Mozilla's business model is built around Google. Process these as you see fit.

cassianoleal 4y ago
You're not entirely wrong, but how do you reconcile that with the OP? Genuine question.
- deleted 4y ago
  [deleted]
- jqpabc123 4y ago
  In the same way you reconcile "Don't Be Evil" with Google. In the same way you reconcile Mozilla's privacy concerns with the fact that every Firefox install gets tagged with a unique digital fingerprint and keeps a persistent websocket connection open in the background.
  - cassianoleal 4y ago
    > In the same way you reconcile "Don't Be Evil" with Google. I don't think that's fair, especially since they have already dropped it. > In the same way you reconcile Mozilla's privacy concerns with the fact that every Firefox install gets tagged with a unique digital fingerprint I'm not sure what you're on about here. Care to elaborate? > and keeps a persistent websocket connection open in the background. Hadn't heard of this one before. Do you have sources?
    - jqpabc123 4y ago
      I don't think that's fair, especially since they have already dropped it. Dropping it doesn't change the duplicity that existed for almost 2 decades. Hadn't heard of this one before. Do you have sources? https://borncity.com/win/2022/03/22/firefox-installer-weist-dem-browser-eine-eindeutige-kennung-zu/ https://borncity.com/win/2022/03/22/firefox-installer-weist-... https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf

theK 4y ago

> we found discrepancies between the apps’ privacy policies and the information they reported to consumers on Google’s Data Safety form. So its like a "sue yourself" system? :-D

lerela 4y ago

Funny coincidence that I have received a notification from the Play store this morning saying that analysis of my app (with super tiny outreach) showed that my Data Safety Form was inaccurate and asking me to fix it asap. Seems like letting the user enter an email address to recover his password counts as email collection (he cannot subscribe, provide or see his email using the app, hence the initial form I submitted).

warp 4y ago
If you're sending the email address to a server (which is presumably needed to recover a password), I think this makes sense. Apple/Google has no way of knowing or verifying what the the server is doing with that data.
- lerela 4y ago
  Absolutely, I meant that the app is not used to collect the email address since it is already in our system but it is true they have no way of knowing.

denton-scratch 4y ago

> The form includes significant loopholes, like failing to require the apps to report data sharing with “service providers.” > As we’ve noted, data sharing with “service providers” is exempt from disclosure requirements. > Many different companies act as service providers, including Google itself Well, whaddya know. Apps don't have to report whether they share data with Google. I found it striking that in the list of four questions that Mozilla asked Google, not one of them elicited a straight answer. I don't mean just evasive or slippery; they failed to answer the question, instead answering a different question, one that wasn't asked.

reaperducer 4y ago
they failed to answer the question, instead answering a different question, one that wasn't asked. Politicians do this all the time. Constantly. They do it because the PR firms taught them to do this, and those same PR people work for tech companies now. (It's awful that journalists these days let politicians get away with it. When I went to journalism school, we would get a failing grade if we allowed an interview subject to dodge a question like that, but that's a rant for another day.)
- frankfrankfrank 4y ago
  [flagged]
- nrook 4y ago
  There's a funny passage in one of Al Franken's books about this. Franken was a comedian who ran for the U.S. Senate and was successfully elected. (He later escaped in celestial disgrace, but that's unrelated.) He talks about how he was trained to do this by his PR folks, thought it was stupid, tried it out in a few interviews to get them off his back, and then was amazed that it worked every time.
  - hgsgm 4y ago
    The documentary "Thank You For Smoking" illustrates this.

dmingod666 4y ago

I don't have specific views on what they've written.. but 90% of donations to Firefox come from Google. The 3 year contract ends in 2023.. If Google decides to not fund it next year it's bad management on FFs part. Putting all your eggs in one basket is very risky and puts you in a place where you may have an ugly compromises Vs face bad consequences..

Razengan 4y ago
> 90% of donations to Firefox come from Google. Why? What does Google get from it? How do they justify this expense internally?
- not_your_vase 4y ago
  They pay to be the default search engine. It's just the cherry on top, that as long as Firefox survives, Google can deflect browser-monopoly accusations.
  - boomboomsubban 4y ago
    Google is currently facing a search engine monopoly case where their purchase of the default search in other browsers is being used against them. Being the default search has value. It's why Google pays Apple billions a year for the same thing.
  - hbn 4y ago
    I would think the monopoly deflection is much more valuable to Google than being Firefox's default search engine. 3% marketshare, comprised primarily of, if I had to guess, people who are the most likely userbase of any browser to know how to change their default search engine.
- i_am_proteus 4y ago
  Google is the default search engine for official FF binaries.
  - 4y ago

Nextgrid 4y ago

It is the same situation with Apple's App Store privacy labels.

Bloating 4y ago
shush...
- LoganDark 4y ago
  :)

sylware 4y ago

[flagged]

deleted 4y ago

[deleted]

dao- 4y ago

Anyone else irritated by the "Executive Summary" heading for what I think most would call an abstract? As a non-native speaker I had to look up the term to confirm it meant what I guessed it would mean: summary meant for executives as in a corporation's "executive officers". Always breaks my heart to see corporate speak creep into normal speak :( Btw, "Executive Summary" being listed under "Summary" also seems weird. I'd call that a table of contents. Feeling particularly nitpicky today.

xnyan 4y ago
"Executive Summary" is an inoffensive way to say "Look, I know you cannot understand this and/or will not read this, so here's a small amount of text written simply that you can use to make a decision."
- marcosdumay 4y ago
  Yeah... That's called a "summary". But people made trouble by calling the table of contents a summary, and the name is now ambiguous.
  - xnyan 4y ago
    Not exactly. Say for example you’re in a situation where an executive has to approve the budget of an engineering project they are not able to understand. A summary would do no good, because it would be incomprehensible to them. In other words, an executive summary is the summary for a non-expert stakeholder. In practice you use this to tell the executive what you want them to think.
    - LoganDark 4y ago
      > In other words, an executive summary is the summary for a non-expert stakeholder. In practice you use this to tell the executive what you want them to think. ...no, an executive summary is not "a summary for a clueless executive". An executive summary provides enough information to act on the material... that is, a summary that promotes executive function[0], otherwise known as decision-making based on what it is summarizing. The "executive" here is not a noun, it's the same "executive" as in "executive function" and "executive decision". And yes, it's also where the job role gets its name. [0]: https://en.wikipedia.org/wiki/Executive_functions https://en.wikipedia.org/wiki/Executive_functions

Kukumber 4y ago

Well, they don't mind selling their users to Google or Pocket, so are they really loopholes? or is that a PR stunt? i'm leaning towards the later, what about you?

dao- 4y ago
In what way is Mozilla selling their users to Pocket? Do you realize that Mozilla acquired Pocket years ago?
- Kukumber 4y ago
  Mozilla didn't acquire it, Mozilla is a non profit Mozilla Corporation did, and they put it in Firefox and you can't opt-out
  - LoganDark 4y ago
    > you can't opt-out You sort of can, but you need to manually dig through tens of hidden options in about:config.
    - dao- 4y ago
      You can remove the button from the toolbar and disable pocket stuff on the new tab page. What other touchpoints are there that average users should care about and that can only be disabled in about:config?
    - jszymborski 4y ago
      It's just one option in about:config https://support.mozilla.org/en-US/kb/disable-or-re-enable-pocket-for-firefox https://support.mozilla.org/en-US/kb/disable-or-re-enable-po...
  - dao- 4y ago
    The Mozilla Foundation owns the Mozilla Corporation, so no matter how you slice it, yes, Mozilla acquired Pocket.

jasonhong 4y ago

Somewhat related to the original post, our research team at Carnegie Mellon University has been investigating how well developers can fill out these kinds of privacy nutrition labels. This paper looks at iOS developers. We found that there was a lot of misconceptions and misunderstandings that led to under-reporting as well as over-reporting of behaviors. For example, on iOS, "tracking" is defined only in the context of advertising. A lot of people also misunderstood what "Data Linked to Users" means https://dl.acm.org/doi/fullHtml/10.1145/3491102.3502012 https://dl.acm.org/doi/fullHtml/10.1145/3491102.3502012 Our research team has also been crawling these labels on both Apple App Store and Google Play to understand changes in labels over time. One early result is that these nutrition labels are not updated very often. https://dl.acm.org/doi/fullHtml/10.1145/3491101.3519739 https://dl.acm.org/doi/fullHtml/10.1145/3491101.3519739 Lastly, we've developed an IDE plugin for JetBrains to help developers fill out labels more accurately (and hopefully more easily too) for Google Play. The key idea is to have developers add privacy annotations (in the form of Java annotations) directly into their code. The plugin uses a bunch of heuristics to flag where you might need an annotation, and helps you fill out those annotations. These annotations are then used to generate a CSV file that can be uploaded to Google Play. https://matcha-ide.github.io/ https://matcha-ide.github.io/ I also have a talk called Helping Developers with Privacy. It summarizes the last decade of our team's research on this topic. (Note that Slideshare has become a bit spammy, inserting ads in between slides, sorry about that) https://www.slideshare.net/jas0nh0ng/helping-developers-with-privacy-253988827 https://www.slideshare.net/jas0nh0ng/helping-developers-with... Stepping back, our team has been looking at two big ideas for privacy. One is these privacy annotations. I think annotations has the potential to be transformative for the privacy ecosystem. They can help developers, they can be assisted with IDE tools, they can be embedded into compiled code, they can be used to help auto-generate privacy user interfaces, and can also be used as a major hint to check the behavior of the apps (by app stores, by auditors, by journalists, and by researchers). The second is that every app should have a simple manifest that whitelists an app's privacy-related behaviors. The manifest describes what data will be used and a chain of transformations, similar to Unix pipes. In the context of smart homes, an example might be: get access to microphone -> transform to loudness -> send to sleep.com. While we don't know exactly what sleep.com will do with the data, we can have more assurance that it's not sending raw microphone data. Here's a paper at Oakland Security that describes our ideas. An interesting part of our initial analysis is that the vast majority of apps don't need raw data (raw microphone data, GPS data, logs, etc). Rather, they need a processed and more granular form of it (e.g. loudness, what city you are in, etc). http://haojianj.in/resource/pdf/peekaboo-preprint.pdf http://haojianj.in/resource/pdf/peekaboo-preprint.pdf Happy to chat more about these topics, we've been working on privacy for quite a while and have had some successes with industry and with the US Federal Trade Commission.

photochemsyn 4y ago

Google's and Apple's central rationale for limiting app developers to working through their app stores is that they're screening apps for security reasons. If they're doing such a poor job of it, then there's no reason for such limitations, other than as another rent-seeking monopoly effort. > "Additionally, a new Commerce Department report cited Apple and Google as “gatekeepers” of mobile app stores, leaving consumers at the mercy of their pricing and selection. The report calls for new legislation that would boost competition in the mobile app market, which would help both consumers and app developers." To extend the FDA analogy, we don't really require stores that sell products to be held responsible for flaws in or problems with those products, e.g. contaminated baby formula. The onus should be on the manufacturer (or the app developer) - but this also means that if a store sells a certain brand (e.g. Whole Foods 365 brand) then they are directly responsible for any issues with that product.

codazoda 4y ago

Consumers don’t read privacy policies so they shouldn’t be a major part of this. Something more akin to the nutrition label example they use is needed.

danpalmer 4y ago

> The form includes significant loopholes, like failing to require the apps to report data sharing with “service providers.” Mozilla is taking a principled stance that _all_ sharing of data should fall into the same category of "we gave your data to someone else", but I think there's a much more pragmatic breakdown. Data can either be not-shared, shared to service providers with contractual obligations to treat that data as owned by the original service, or shared to service providers who may then use and further share that data for their own purposes. Examples of the latter two would be the difference between sending crash reports to a crash reporting service that doesn't interpret user data in any way and is only a mechanism used by the original service, vs, say, sending it to Facebook to report an advertisement conversion, where it will be used to further the Facebook ad modelling. As a privacy conscious user I typically don't mind the former, but despise the latter. Mozilla does not appear to distinguish between these two cases. One could argue that the former is still increasing the scope of data being hacked, or that companies might breach their contracts and use it anyway, but if you assume illegality then most of this breaks down anyway, we have to assume that companies stick to the law and their contracts for any of this to be of any use (and I think that's mostly reasonable for us to do). I work closely to this area at Google so I don't want to comment on how this fits with Google's data safety labels and the privacy policies of apps. I think people should read the documentation and draw their own conclusions. I personally think that this issue sits at the intersection of principles and pragmatism – making information correct but conveying a less immediately useful message, vs making information accessible and actionable for the majority of users. Google (and Apple) also still need to appeal to developers to get them to build for their platforms, and that again may require pragmatism.

lmkg 4y ago
> Data can either be not-shared, shared to service providers with contractual obligations [...], or shared to service providers who may then use [...]. To follow up, this distinction is also made by both GDPR in Europe, and CCPA in California. (In fact, CCPA uses the same term "Service Provider" and I wouldn't be surprised if that's where Google got it from.) Still, both GDPR and CCPA require disclosure of Processors/Service Providers. Transfers to a Processor/Service Provider have restrictions, and that's significant. Such third parties are treated differently under the law, with those restrictions removing the need for other safeguards. But the don't entirely remove any risk. Ultimately one of the goals of these disclosures is letting the user take control over how their data is used and distributed. Some users (including you, and including myself) are comfortable with data transfers that are protected by legal safeguards rather than technical ones. Some are not comfortable with that, and have valid reasons to be. Some users reasonably want to know their full security risk exposure, which means being aware of which parties are handling their data. Some users simply don't want to do business with certain platform providers, even indirectly. I'll also point out that the EU has found that US safeguards about transfers to Service Providers are inadequate, because if a third party has your data that means US law enforcement can get your data from that third party. So there are very valid concerns that the safeguards Google considers adequate for a Service Provider may not satisfy all users. All of which is to say, I agree that the distinction about Service Providers is useful and meaningful, but I think it is the wrong decision to exempt Service Providers from being listed altogether.

andreygrehov 4y ago

When it comes to Google, here is another anecdote (loophole?) that I personally experienced once in my life. I worked for a company whose business Google account was somehow deleted. The access to Gmail was entirely lost, which was super critical for the company. One of our employees spent hours dealing with Google customer support. If I'm not being mistaken here, the response that they kept getting from Google was something along the lines of "due to our data safety and data retention policies, we are not able to recover your Google account". That same phrase was repeated again and again by various Google reps. Long story short, the company recovered everything. The solution was to email one of the investors and ask them if they can help in any way. It was hilarious. The mail thread was something like: Company: > Hey Joe, due to xxxxx, we lost access to yyyyy@yyyyy.com. Google customer support cannot do anything. Any ideas what shall we do? Joe forwards the email to an internal Google employee with just two words: > Handle this. The account is fully back online within 30 minutes.

marcellus23 4y ago
Curious, what was Joe's relationship to Google? How was he able to exercise that kind of authority?
- andreygrehov 4y ago
  AFAIK, Joe does not have any direct relationships with Google. I suppose, he's just a powerful venture capitalist.
  - hgsgm 4y ago
    Who happens to know the random engineer who controls accounts?
    - falcolas 4y ago
      Probably a C level. They don’t need control over accounts to get an account recovered.

awinter-py 4y ago

yeah this stuff is meaningless until it's asserted from a linter or runtime firewall I'm not sure why mozilla is wasting their time criticizing detail mismatches -- the self-report system only creates accountability for relatively well meaning players who are large enough to 1) be worth auditing and 2) have reputational risk little snitch everywhere

gerash 4y ago

> Our research closely mirrors the 2021 Washington Post investigation into the accuracy of the Apple App Store’s new data privacy labels for apps. The investigation found that not only were many of the labels confusing and incomplete - they were also false Apple came up with this "nutrition label" idea for app usages of data that is self reported by developers. Everyone assumed "increase in privacy". Google copied the practice and it's full of "loopholes" now. This whole data privacy, unlike cryptography, has become more of a marketing tactic and media loves to create super villains and super-heros out of it. There's no substance here.

marcellus23 4y ago
Is there really a double standard here? The subhead of the wapo article is: > Apple’s plan to make iPhone apps be transparent about the data they take falls short of being helpful — or even accurate

rantee 4y ago

While privacy policies are increasingly tailored to an app's actual data usage,* there are still FAR too many out there full of the same copypasta allowing a company to do whatever they want with your data. With that in mind, it's hardly a surprise that there's a disconnect between what engineers self-report and what's buried in the policies. * Based on my own experience over the years actually reading them as someone who both cares about this stuff and works in the space.

vfclists 4y ago

Perhaps if they had focused on developing Firefox OS they wouldn't have to put up this.