10 ms·
Mozilla will be retiring the Mozilla Location Service
- onli 3y agoFuck. I just last year integrated this in a project of mine. Thinking: "Yeah, Google fucked me over here before when I used their, but it's Mozilla, it will be fine." It is not okay to stop providing a service like this. Not if you are Mozilla, with that mission and money, not something that is so deeply entrenched. Though, reading it more calmly, I can see how them being hit by a patent troll can make their investment in this project untenable. There is a comment about the Graphene Foundation maybe providing an alternative. That would be great - but having https://www.youtube.com/watch?v=4To-F6W1NT0 https://www.youtube.com/watch?v=4To-F6W1NT0 in mind, with that maintainer still active the project and foundation is a complete no-go. The organic maps comment is the one to follow instead.
- wkat4242 3y agoGrapheneOS doesn't use this though on Android. microG does but they hate microG with a passion, for some reason. They have their sandboxed Google play as an alternative.
- Yoric 3y agoWell, money can be used to power a service that (almost) nobody uses, or to power services that Mozilla hopes will be more useful. I, for one, had assumed that this service had been retired ages ago.
- onli 3y agoImho that location service is an important piece of infrastructure for web apps that need IP geolocation, especially for FOSS software given that there is no alternative, and useful for Android without Google services. Both things Mozilla should support.
- bananapub 3y ago> an important piece of infrastructure for web apps that need IP geolocation er, isn't it entirely for physical location based on wifi and mobile network towers?
- onli 3y agoMy script is calling `https://location.services.mozilla.com/v1/geolocate?key=geoclue https://location.services.mozilla.com/v1/geolocate?key=geocl...`. That's the service linked in the announcement. I assumed they would should down everything.
- dingensundso 3y agoA lot of people running degoogled androids depend on the location service: https://github.com/microg/GmsCore/issues/2237 https://github.com/microg/GmsCore/issues/2237
- pona-a 3y ago"Nobody uses"... Do you understand what you just said? Raw GPS is universally unusable, requiring up to half an hour of waving your phone under clear sky, hoping it a) will actually work; b) will not loose signal; c) will not drain the battery before you reach your destination. The only way to get reasonable estimation of location? Location services. Guess who are the only providers? About 5 or something companies, all with expensive licenses and weird terms of use. And here comes Mozilla, providing this same expensive exclusive service for free as a convenient API. Just send some WiFi SSIDs and signal strength, cell towers, and Bluetooth devices, and without even having to turn on the actual GPS, you get a faster, more accurate estimate of geolocation, down to a few meters. This service is vital to mobile Linux or even deGoogled Android or non-Chrome browsers. In its time Canonical had to plead with Here maps for years to give their devices proper GPS. To say a project unique in its entire domain on which hinges the existence of entire ecosystems is less important than a yet VPN or email alias service seems downright silly. Besides, it's not like Mozilla did it on their own volition. A patent troll had come to destroy their competitor on shaky legal footing, knowing they won't fight back...
- traceroute66 3y ago> Raw GPS is universally unusable, requiring up to half an hour of waving your phone under clear sky, Sigh. The increasing amount of unsubstantiated FUD finding its way on to HN recently is depressing. Two glaringly obvious points to make at your nonsense: 1. What you describe is ancient history. It applied to old previous-generation devices with single-frequency chipsets (L1 GPS signals). However, effectively 100% of devices released within the last 3–5 years (and more in the case of certain manufacturers !) (a) have L1,L2,L5 GPS chipsets and (b) have multi-frequency GPS chipsets whch work not only with the "original" GPS but also Galileo, QZSS and others. 2. Even if we accept your argument, which we should not, then the rapid adoption of Apple's FindMy network (and the equivalent for Google) surely cannot have escaped your attention ? These serve to increase accuracy. The reality is there is fast becoming no need for a third-party service such as the one Mozilla provided, because there is now first-class support for sufficiently robust high-accuracy positioning.
- 3y ago
- tehbeard 3y ago> ...power services that Mozilla hopes will be more useful. Hmm, more likely to end up as another C-level bonus/salary bump.
- thayne 3y agoOr another project that nobody wants that gets shut down after a couple years.
- deprecative 3y agoMozilla is funded by Google. Mozilla doesn't seem to have much of a clue what it ought to be doing, either. I use Firefox, but I wouldn't trust anything else to last unfortunately.
- berkes 3y ago> Mozilla is funded by Google You aren't saying it, but it is implied or can easily misread as such. But Google is not directly funding Mozilla. Mozilla gets its funds from many places, and one of them is Google; paying for being the default search engine. It's by far the largest amount. But not the only, nor a direct funding.
- eganist 3y ago> But not the only, nor a direct funding. Being paid directly for a service by a company (Google paying for the privilege of being the default) is to be directly funded by that company. You're right that it's not the only source of revenue, but it's absolutely a direct source of funding.
- malfist 3y agoIf I go buy a box of crackers at Walmart, am I funding Walmart? Is Walmart now beholden to me?
- 1over137 3y agoDoes your cracker purchase represent the majority of Walmart's revenue? Not the same thing.
- smashed 3y agoNo but if Walmart distributes 81% of the production of that particular cracker brand, it could suddenly find itself in a huge crisis if Walmart decided to cease distributing it and fill the shelves with great value crackers.
- 3y ago
- lxgr 3y agoCan you summarize the concerns addressed in that video, or is there a text source?
- onli 3y agoEasy to write a summary that would risk being banned for ;) But that basically says it all, the user hostile and insulting behavior and his vendetta against projects he hallucinates at somehow being hostile to him - completely delusional - makes the project something that never should be on anyone's hardware, especially not something security relevant. That guy would have root. But best to watch the video, there are a plethora of sources. Last time I wrote something like that here someone else from GrapheneOS accused me of being unfair, since he is out by now - now I see the old maintainer writing in the name of the foundation and that he still commits to the project.
- codethief 3y ago> since he is out by now - now I see the old maintainer writing in the name of the foundation and that he still commits to the project. What do you mean? At least to me knowledge, Daniel Micay has been the maintainer of GrapheneOS throughout (from day 1 until now).
- onli 3y agoNo, that changed, see https://news.ycombinator.com/item?id=36089104 https://news.ycombinator.com/item?id=36089104
- aesh2Xa1 3y agoHow would GrapheneOS target a specific person? You said "that guy would have root." To be frank, I do not think that's true. He is definitely not "out by now." He said he would step down, but I am under the impression that gesture (and the original Twitter post) was retracted. He's still listed as a director with the Canadian Business Registry record on GrapheneOS Foundation: https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577 https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&cor... The GrapheneOS project, and its sub-projects, are a net positive. You can dislike any individual person or aspect of the project and still take from its success. "Don't throw the baby out with the bathwater." That said, you and I might just have differing views on the project and its management. I feel the project itself should be assessed/characterized on its security-focused initiatives first and foremost.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- miduil 3y agoThank you Skyhook Holdings, Inc.
- cebert 3y agoIt looks like Skyhook Holdings was recently acquired by Qualcomm according to their website. I wonder if this was more for their IP and patents rather than product(s). [1] https://www.skyhook.com/ https://www.skyhook.com/
- sapiosenses 3y agoI think it was for products too (eg Qualcomm is currently doing a heavy push of their IoT products where Skyhook is a central piece) but I'd also like to know if the legal landscape changed after the acquisition. Especially considering Qualcomm's relationship with many device makers and the OS platforms.
- andybak 3y agoAnyone know where on the spectrum of "Fair enough. That's clever" to "Oh come on! FFS..." these patents fall?
- michaelt 3y agoI'm not surprised this drifted into disuse. Both Apple and Android smartphones come with a built in location service, which also has GPS. Firefox OS, which might have needed this service, is no longer around. Desktops and laptops are rarely used for navigation - the only uses of the geolocation api for desktop web browsers I've encountered are when you go to a retailer's store finder page, and they have a button to use your current location. And even then, the geolocation api is competing with IP geolocation (which doesn't show the user an ominous consent popup) And I don't imagine it was easy for Mozilla to get quality data - if their service is mostly used by the most privacy-focussed users, I don't imagine those users were lining up to submit their geolocation and wifi data to a public database.
- eek2121 3y agoLocation is used for far more than simple Navigation.
- edude03 3y agoCan you provide some examples then?
- bongobingo1 3y agoBroadly auto-picking the correct language and currency? Populating from a regional feed for news or alerts?
- michaelt 3y agoThat's usually done with IP geolocation, which can be done without a user consent popup. If you don't see [1] then the site hasn't used the browser's location API. [1] https://assets-prod.sumo.prod.webservices.mozgcp.net/media/uploads/images/2018-10-17-17-35-58-086f5b.png https://assets-prod.sumo.prod.webservices.mozgcp.net/media/u...
- extraduder_ire 3y agoPicking language using geolocation is kind of dumb, I hate when google does it and I have to put "&hl=en"into the URL somewhere, often twice before it'll stick. Did everyone forget there's a standard for this? e.g. my browser sent a "Accept-Language en-US,en;q=0.5" header when it loaded this page.
- ktosobcy 3y agoWho the F is Skyhook) Holdings? :-\
- raybb 3y agoReminds me of a problem I had in NYC back in 2019. There was one station in Manhattan and when I went in there my phone always though I was somewhere out in Brooklyn. Even with WiFi off. It only happened on Android no IOS. It was like this for a long time and I tried many times reporting it as an issue on Google maps. Confirmed the issue with many friends who used Android. I don't know exactly how these things work but I always suspected that some WiFi AP got repaired and moved to a new location and was broadcasting an SSID that used to be somewhere else for a long time. Or could it be caused by something else?
- dfc 3y agoTurning wi-fi off on android devices does not stop it from being used for location services.
- lxgr 3y agoIt was probably using mobile network base stations. These can sometimes span quite large physical areas underground. Additionally I'd assume they're quite hard to automatically update: The crowdsourced updates these databases depend on only work when at least one device has both a GPS signal and can see a cell or Wi-Fi base station, which is obviously quite hard underground.
- jeroenhd 3y agoThere's a separate "WiFi scanning" setting that's enabled even when WiFi is switched off. Same with Bluetooth. This passive scanning is quite power efficient, so in practice you probably wouldn't notice that the WiFi is still powered. I've experience this when a company I worked for switched offices. As soon as I got into range of the WiFi access points, my phone got confused. I'm pretty sure it was the WiFi access points + the IP address of the work WiFi's IP address. It takes a while for location services to heal themselves. I run a VPN server at home, so ever since I took my phone and tablet to Amsterdam for a day, Google associated my IP address with that city, probably because my phone and tablet got so many data points there. I've seen it happen before, but that'll switch back eventually too.
- thisislife2 3y ago
- Angostura 3y agoPretty sure Apple use Skyhook - or at least they used to for geolocation
- BuckGup 3y agoSo how does Skyhook still work for iPhones? Apple made the mac addresses private on IOS14 and they rotate every 24hrs to prevent wifi tracking. So did Apple make the data private to then be able to sell themselves to Skyhook? Seems like it
- Angostura 3y agoApple uses/used Skyhook to geolocate where a Wifi network was- that's it.
- lxgr 3y agoI suspect it's by now a crowdsourced database as well: Updates seem to happen way too frequently to make manual car-based tracking plausible. Skyhook might still be running the actual database and augmenting it with their own manual scans, though, but I strongly suspect that any Apple device with GPS is contributing its location data back to it.
- kevin_b_er 3y agoSkyhook apparently threatens companies that try to crowdsource such things, case in point Mozilla. So, you're either paying off the patent troll or using their services.
- lxgr 3y agoWhat I mean by crowdsourcing here isn't Apple bootstrapping a parallel database, either using Skyhook or their own GPS-only data, but rather them feeding into Skyhook. I'd be very surprised if Skyhook was opposed to that. Given the ubiquity of Apple devices, I wouldn't even be surprised if Skyhook paid Apple at this point.
- demurgos 3y agoReally sad to see it go. It powers KDE Plasma's geolocation for its Night Colors feature among other FOSS projects.
- 1oooqooq 3y agoThose features requiring geolocation to give tune 2min away from the system time is ridiculous and overkill
- demurgos 3y agoOn a laptop, it avoids forgetting to update it when travelling.
- 1oooqooq 3y agoyou don't update your clock? also, it will set the wrong light when using a vpn. even your extremely obscure use case cames sort trying to justify this nonsense.
- demurgos 3y agoFirst of all I agree that it's no big deal. But it's also a nice convenience feature; I'm pretty happy that my computer works for me automatically. Then to reply to your points. I don't use a VPN, but I regularly travel between south-western Europe and north-eastern Europe. The timezone is CET everywhere, but the actual solar time differs by about 2 hours. It may be a niche case for you, but can't I enjoy that it just works (for now)? (Reasonable people may also disagree that traveling with your laptop with night colors is an "extremely obscure use case". It's a builtin feature on KDE. The night time also depends on the latitude which is not something captured by the timezone)
- KoftaBob 3y agoFor those wondering, Skyhook is a "location technology company" that was acquired by Qualcomm https://www.skyhook.com/ https://www.skyhook.com/
- lioeters 3y agoSome context: https://en.wikipedia.org/wiki/Skyhook_Wireless https://en.wikipedia.org/wiki/Skyhook_Wireless
- jijijijij 3y agoWow. I don't know what's exactly protected in their patent, but I have a suspicion they shouldn't have gotten it in the first place. Looks like their business model is mostly trolling, or rather keeping everyone else hostage by their overreaching IP. Also: > In 2016, Skyhook introduced a range of innovative [sic] products tailored for the advertising technology sector: Retailer Personas, Power Personas, and On-Demand Personas. Leveraging Skyhook's vast processing capabilities handling billions of location data points, these solutions empower marketers to finely tune consumer targeting by analyzing past locations, enabling personalized mobile marketing campaigns. Lovely.
- sapiosenses 3y agoI struggle to understand how a company whose IP essentially amounts to using RF emitters as geolocation sources based on simultaneous correlation with GPS data and other known geolocated RF sources can amass apparently between 600 and 700 patents on this "innovation". I know that they sued Google over their Android NLP implementation and Google lost on almost all of the enumerated complaints, Apple started using Skyhook beginning with early versions of iOS, and Microsoft apparently also uses them. What they have seemingly done with the assistance of an absurd number of patents that they apparently keep getting granted by the USPTO (which is known for issuing boatloads of junk patents), is take a fairly obvious tactic which amounts to one of the earliest examples of crowdsourcing - the WiFi "wardriving" practice - and find ways to patent-encumber that technique that they did not invent until they have engineered what appears to be a complete monopoly on it. I'm also curious how the legal landscape of that business may have changed after the Qualcomm acquisition. IIRC at one point in time Qualcomm was licensing Skyhook data.
- rcMgD2BwE72F 3y agoWhat service can replace this in microG? Most Android ROM relies on it for location services :(
- wkat4242 3y agoThere's a plugin for apple's but I think it's unmaintained :(
- rcMgD2BwE72F 3y agoAlso proprietary.
- wkat4242 3y agoWell yes but better than Google. The plugin is open source though https://github.com/microg/AppleWifiNlpBackend https://github.com/microg/AppleWifiNlpBackend
- RealStickman_ 3y agoNewer versions of microg (I think from 0.28 onwards) are rewriting the location stack and remove the UnifiedNLP interface. Currently only Mozilla Location Services is built into the new stack.
- wkat4242 3y agoCrap. This was so great with microG :(
- nanis 3y agoThe rather troubling part of this announcement in a GitHub issue is that this nugget comes out in a seemingly innocuous comment[1]: >> Firefox still uses MLS for `browser.region.network.url`; will that also move to Google Location Services? > This endpoint will be migrated to another service (classify-client) that will return the expected response. We'll adjust DNS entries when it's time to make that move so firefox won't see any difference. What exactly is this "classify-client" service? Note also this led me to discover for the first time that this is a thing[2]: > Geolocation for default search engine > In order to set the right default search engine for your location, Firefox will perform a geolocation lookup once by contacting Mozilla's servers and store the country-level result locally. This connection happens on the first start of Firefox – in case you want to prohibit that, you will have to preconfigure the browser and set the browser.search.geoip.url preference to a blank string. Also related is [3]. [1]: https://github.com/mozilla/ichnaea/issues/2065#issuecomment-1995897836 https://github.com/mozilla/ichnaea/issues/2065#issuecomment-... [2]: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine https://support.mozilla.org/en-US/kb/how-stop-firefox-making... [3]: https://old.reddit.com/r/firefox/comments/iq27wa/disabling_location_services_on_firefox_8001/g4x7ka6/ https://old.reddit.com/r/firefox/comments/iq27wa/disabling_l...
- codethief 3y agoclassify-client is probably this project: https://github.com/mozilla/classify-client https://github.com/mozilla/classify-client Looks like it depends on a GeoIP database.
- joveian 3y agoSearching for the file name the default database seems to be MaxMind's free database: https://dev.maxmind.com/geoip/geolite2-free-geolocation-data https://dev.maxmind.com/geoip/geolite2-free-geolocation-data They are the comany that infamously set the default US location to a farm in Kansas, causing all sorts of trouble for the people who live there. From the file name it sounds like classify-client is by default only trying to identify the country you are in. I'm not seeing a browser.search.geoip.url setting, however I have geo.enabled set to false and various other setting that might cause that to not be present.
- daedalus_j 3y agoThe service has indeed been getting worse and worse over the last few years. In the tools I've got that use it the number of inaccurate hits I've gotten has been increasing. People who move and keep their same wifi gear seem to be the cause of it. Then it happened to me when I moved, and I tried to find a way to update MLS and couldn't, so my Linux laptops can no longer be set to automatic time zone mode, or they revert back to my old time zone whenever I'm at home... I very much hope they release the information about which patents are a problem so that future attempts at a service like it can hopefully avoid that problem, but considering the state it's been in I'm not terribly upset that it'll be shutting down.
- seba_dos1 3y ago> and I tried to find a way to update MLS and couldn't Up until a few days ago when the submission service was turned off on MLS side, it was just a matter of setting `submit-data=true` in geoclue.conf and going for a walk.
- daedalus_j 3y agoTrue, I do recall that! But you'd have a buy a usb/Bluetooth GPS to plug in to your laptop I think, there was no android option. In the end I just decided it wasn't worth it, my laptops can just be manually placed in my home timezone.
- seba_dos1 3y agoGeoclue works on phones too (which is how I contributed data about my neighborhood, which resulted in instant massive improvement for all my devices), and for Android there are apps like Tower Collector that let you do it as well [edit: though on second look, it seems like it only collects cellular stations and not WiFi APs]
- NelsonMinar 3y agoKey part of the article: a patent claim from Skyhook forced Mozilla to alter the service in a way they couldn't keep it working.
- ikekkdcjkfke 3y agoSo skyhook lays claim to an aggregate of wifi and gps, both technologies of which they have no chance developing.. Patents involving other advanced technologies should have much stricter requitements
- 0xFF0123 3y agoHow does Google get around this? Or do they license?
- deely3 3y agoHow you differentiate between advanced technologies and not?
- crankycoder1975 3y agoYou can't. Skyhook basically owns triangulation of rf. It's absurd.
- Animats 3y agoWill that break Mozilla UnifiedNip Backend on Android?
- sapiosenses 3y agoYep. But it's academic at this point. The MLS data had been going stale for 2-3 years now, I stopped using it ~2 years ago because of how inaccurate it had become. If you're using microG GMSCore prior to 0.2.28.xxxx, you can use various other UNLP backends that can still give good results. But for 0.3.0.xxxx and newer, it relies solely on the MLS db as well as some more obscure methods that don't help most people. Many in the microG community are hoping that gets greatly improved going forward.
- cpeterso 3y agoI helped stand up MLS and worked on the Android "stumbler" submission app. The original motivation for MLS was to provide a free location service for carriers that would potentially ship Firefox OS devices but not want to pay for Google's or Qualcomm's location services. We always wished we could release the Wi-Fi location data, but there were privacy and safety concerns. Google was sued in Germany for recording Wi-Fi access points' locations and some data packets. And we were considering publishing similar location data, which would be an even bigger liability. The Google lawsuit lead to a lame opt-out system: to opt out of Google's Wi-Fi mapping, you're supposed to append "_nomap" to your SSID. To opt out of Microsoft's Wi-Fi mapping, you're supposed to append "_optout" to your SSID. I'm not sure how you're supposed to do both. MLS honored both "_nomap" and "_outopt" anywhere in the SSID string, filtering out those access points from submissions and lookup requests on both Mozilla's clients and server side. A potential safety concern for releasing the MLS location data was the "stalker scenario": if you knew someone's access point MAC address and they moved, you might be able to find their new location by looking up their MAC address in the location database. This scenario was less of concern for lookup requests to the MLS server server because lookups include a list of MAC addresses that the client sees. The server returns an average of those neighboring MAC addresses' locations, but shouldn't return the location of an individual MAC address. (I don't know if MLS currently implements this restriction.) Another protection (not implemented, AFAIK) could be to require lookups to include the SSID that matches a known MAC address and SSID pair. This would allow an access point's owner to change their SSID so lookups using the old SSID don't return the new location. I thought we might be able to release the location database leveraging that restriction of requiring multiple MAC addresses. Instead of releasing a database mapping raw MAC addresses to locations, the database would map hashes of MAC1 + SSID1 + MAC2 + SSID2 to locations. Offline database lookups would need to know the MAC addresses and current SSIDs of two access points that had previously been seen together. I'm not a cryptographer, so there's probably some hole in this idea. :) It would also significantly increase the size of the database. Requiring lookups to include multiple MAC addresses and matching SSIDs could also reduce the impact of poisoned location submissions because lookups (online or offline) would only see poisoned data if they included multiple poisoned MAC addresses and valid matching SSIDs pairs that can previously been submitted as neighbors. Poisoned data in the database doesn't affect clients that don't fetch it. :) Another way to reduce the impact of poisoned location submissions could be to filter out submitting clients' new access point locations outside the submitting client's GeoIP region. A neat trick from lookups including multiple access points is that the service can learn about new access points and their locations. If the service has seen MAC1 and MAC2 before and a client's lookup says they see MAC1, MAC2, and MAC3, the service can return the location average of MAC1 and MAC2 and tentatively record that new MAC3 exists at that average location and is a neighbor of MAC1 and MAC2.
- vrinsd 3y agoI think this is a good thing in the long-run. Relying on WiFi access points to geolocation was always a bit of a hack and in my experience it's allowed phone manufacturers to roll back on the quality of their satellite-based GPS implementations and worsened phone battery life ; now the phone is constantly scanning for WiFi access points and Bluetooth and shuffling that data back to the mothership(s) on the user's data plan. My old Samsung S4 could get a GPS lock (sans Internet, WiFI, in airplane mode) in doors usually in < 30s. I had a few different iPhones, 6, 6S, 7 and XS where GPS wouldn't reliably work unless it had "network" (Internet) connectivity due to the reliance on WiFi-geolocation. Similar experience with Pixel 3's, with noticable improvements on Pixel 4s satellite GPS acquisition time. For Android phone users, if you can use a slightly older version of microG (due to some recent unfortunate change microG made making the use of other backends more difficult), I found this backend to consistently be the best: https://f-droid.org/en/packages/org.fitchfamily.android.gsmlocation/ https://f-droid.org/en/packages/org.fitchfamily.android.gsml... The above backend lets you use a database of CELL TOWER IDs to speed up location acquisition. As you might expect, cell phone towers rarely (ever?) move and even without a SIM card or celluar connectivity, a phone can scan for CELL IDs. The other cool thing about this backend is it can create the database from the phone, or you can do it offline on a PC and push a sqlite.db file to phone. I suggest the PC route, the script is pretty simple to understand and you can filter out countries that might not be relevant to you. And f** Skyhook.
- 1oooqooq 3y agowe all know that feature only existed because it was the bundle of things google feared getting in trouble for. mozilla was google henchman for over a decade. and nobody here will even grasp the size of the impact.