3 ms·

> In the same way you reconcile "Don't Be Evil" with Google. I don't think that's fair, especially since they have already dropped it. > In the same way you r

> In the same way you reconcile "Don't Be Evil" with Google. I don't think that's fair, especially since they have already dropped it. > In the same way you reconcile Mozilla's privacy concerns with the fact that every Firefox install gets tagged with a unique digital fingerprint I'm not sure what you're on about here. Care to elaborate? > and keeps a persistent websocket connection open in the background. Hadn't heard of this one before. Do you have sources?

jqpabc123 4y ago
I don't think that's fair, especially since they have already dropped it. Dropping it doesn't change the duplicity that existed for almost 2 decades. Hadn't heard of this one before. Do you have sources? https://borncity.com/win/2022/03/22/firefox-installer-weist-dem-browser-eine-eindeutige-kennung-zu/ https://borncity.com/win/2022/03/22/firefox-installer-weist-... https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf
- cassianoleal 4y ago
  > Dropping it doesn't change the duplicity that existed for almost 2 decades. It was dropped in 2015, 17 years after Google's foundation. Are you saying they were evil from the beginning? I couldn't tell but at least for their first decade or so they seemed to be trying to do good. In any case, it's very different to be Google and evil vs. Mozilla/Firefox having a unique ID in some downloads. Why do I say some downloads? Because that ID is assigned when you click the link on their website's downloads page. If you get it from your package manager, which I suspect a very large portion of their user base does, you don't get uniquely identified. If you download from any mirror or otherwise free software download store, you don't get uniquely identified.
  - jqpabc123 4y ago
    If you download from any mirror or otherwise free software download store, you don't get uniquely identified. What you are downloading in most cases is just an installer executable -- no software included. The installer pulls the actual software from Mozilla's server. Each copied served is given a unique ID and is unlike any other -- easily proven by hash or checksum (Mozilla calls this a "dltoken", see my reference above).
    - cassianoleal 4y ago
      I've just sampled some mirror sites. - https://mozilla-firefox.fileplanet.com/ https://mozilla-firefox.fileplanet.com/ - Indeed it downloads a download manager. - https://download.cnet.com/Mozilla-Firefox/3000-2356_4-10208565.html https://download.cnet.com/Mozilla-Firefox/3000-2356_4-102085... - Downloads an installer. It's for an older version but shouldn't have the unique ID, and it should be able to update itself but I haven't tested. - https://techviral.net/firefox-offline-installer/ https://techviral.net/firefox-offline-installer/ - Also the installer, and for the latest version. That's 2 out of 3 without an unique ID. You have also conveniently glossed over the package manager angle, which I suspect is a pretty large slice of their user base.
Karunamon 4y ago
Google replaced "don't be evil" with "do the right thing", which is entirely fair to hold them to. Firefox install fingerprinting: https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/ https://www.ghacks.net/2022/03/17/each-firefox-download-has-... Persistent web socket connections: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf (page 8-9) In both cases this "telemetry" is something that the user did not ask for or authorize, nor is it disclosed prominently.
- cassianoleal 4y ago
  > Google replaced "don't be evil" with "do the right thing", which is entirely fair to hold them to. That's fair, but "the right thing" for whom? If it's for their shareholders, which apparently by law is in fact not only the right thing but a requirement, then it's hard to argue they're not good on their word. > Firefox install fingerprinting: https://www.ghacks.net/2022/03/17/each-firefox-download-has- https://www.ghacks.net/2022/03/17/each-firefox-download-has-... I commented on the sibling. This is only true if you download it directly from their website. Firefox is acquired from many other sources - package managers, FTP sites, other free software distributors... > Persistent web socket connections Thanks, this does seem less than ideal. There seems to be zero evidence of any breach of anonimity via this mechanism though. Just to be clear, I agree that it shouldn't be this way. > In both cases this "telemetry" is something that the user did not ask for or authorize, nor is it disclosed prominently. No argument here. I both agree with your assessment and that this is a bad thing.

jqpabc123 4y ago

I don't think that's fair, especially since they have already dropped it. Dropping it doesn't change the duplicity that existed for almost 2 decades. Hadn't heard of this one before. Do you have sources? https://borncity.com/win/2022/03/22/firefox-installer-weist-dem-browser-eine-eindeutige-kennung-zu/ https://borncity.com/win/2022/03/22/firefox-installer-weist-... https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf

cassianoleal 4y ago
> Dropping it doesn't change the duplicity that existed for almost 2 decades. It was dropped in 2015, 17 years after Google's foundation. Are you saying they were evil from the beginning? I couldn't tell but at least for their first decade or so they seemed to be trying to do good. In any case, it's very different to be Google and evil vs. Mozilla/Firefox having a unique ID in some downloads. Why do I say some downloads? Because that ID is assigned when you click the link on their website's downloads page. If you get it from your package manager, which I suspect a very large portion of their user base does, you don't get uniquely identified. If you download from any mirror or otherwise free software download store, you don't get uniquely identified.
- jqpabc123 4y ago
  If you download from any mirror or otherwise free software download store, you don't get uniquely identified. What you are downloading in most cases is just an installer executable -- no software included. The installer pulls the actual software from Mozilla's server. Each copied served is given a unique ID and is unlike any other -- easily proven by hash or checksum (Mozilla calls this a "dltoken", see my reference above).
  - cassianoleal 4y ago
    I've just sampled some mirror sites. - https://mozilla-firefox.fileplanet.com/ https://mozilla-firefox.fileplanet.com/ - Indeed it downloads a download manager. - https://download.cnet.com/Mozilla-Firefox/3000-2356_4-10208565.html https://download.cnet.com/Mozilla-Firefox/3000-2356_4-102085... - Downloads an installer. It's for an older version but shouldn't have the unique ID, and it should be able to update itself but I haven't tested. - https://techviral.net/firefox-offline-installer/ https://techviral.net/firefox-offline-installer/ - Also the installer, and for the latest version. That's 2 out of 3 without an unique ID. You have also conveniently glossed over the package manager angle, which I suspect is a pretty large slice of their user base.

Karunamon 4y ago

Google replaced "don't be evil" with "do the right thing", which is entirely fair to hold them to. Firefox install fingerprinting: https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/ https://www.ghacks.net/2022/03/17/each-firefox-download-has-... Persistent web socket connections: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf (page 8-9) In both cases this "telemetry" is something that the user did not ask for or authorize, nor is it disclosed prominently.

cassianoleal 4y ago
> Google replaced "don't be evil" with "do the right thing", which is entirely fair to hold them to. That's fair, but "the right thing" for whom? If it's for their shareholders, which apparently by law is in fact not only the right thing but a requirement, then it's hard to argue they're not good on their word. > Firefox install fingerprinting: https://www.ghacks.net/2022/03/17/each-firefox-download-has- https://www.ghacks.net/2022/03/17/each-firefox-download-has-... I commented on the sibling. This is only true if you download it directly from their website. Firefox is acquired from many other sources - package managers, FTP sites, other free software distributors... > Persistent web socket connections Thanks, this does seem less than ideal. There seems to be zero evidence of any breach of anonimity via this mechanism though. Just to be clear, I agree that it shouldn't be this way. > In both cases this "telemetry" is something that the user did not ask for or authorize, nor is it disclosed prominently. No argument here. I both agree with your assessment and that this is a bad thing.