43 ms·

For advertising, Firefox now collects user data by default

597 points by firebaze 2y ago

wkat4242 2y ago
Says the site that only offers one big button "accept" to its cookies :( :( There's no "Nope". Edit: Weird, some people seem to have received more options than me. For me there was just one option to accept (Zustimmen) and nothing else. Everything was in German but I read German anyway. I was on mobile though, perhaps this is why? I can't see it again because I already pressed it. A practice (pay or accept cookies) which was actually ruled in breach with GDPR but many German sites seem to do this somehow. I agree with the criticism on Firefox but this is very hypocritical. Heise used to be a good company. I even used to subscribe to C'T and iX.
- Semaphor 2y ago
  > A practice (pay or accept cookies) which was actually ruled in breach with GDPR but many German sites seem to do this somehow. Our Data Protection Agencies ruled it okay. There was a recent court case that called it into question again, so we’ll see how things develop. FWIW, my normal blockers manage to block the heise.de pay-or-track banner, different from, e.g. golem.
  - agos 2y ago
    what data protection agencies?
    - Semaphor 2y ago
      I used the wrong word, it’s authorities. The German word is "Datenschutzaufsichtsbehörde"
      - wkat4242 2y ago
        This is why scrabble is such a popular game in Germany :)
  - wkat4242 2y ago
    But even then, it's a bit hypocritical writing an article slamming firefox for this at least allegedly privacy-sensitive adtracking. While requiring readers to consent to tracking from your however many ad partners :P
  - deleted 2y ago
    [deleted]
- copywrong2 2y ago
  These dark patterns will prevail. However, I honestly expect their reasoning to be "every single user reading heise.de should have a cookie banner blocking enabled in their Ad Blocker". Also, I think you can accept it for free when you click "Einstellungen", this is not golem.de.
  - Semaphor 2y ago
    > Also, I think you can accept it for free when you click "Einstellungen" No, this part is mandatory: > Datenverarbeitungen von Werbeanbietern einschl. personalisierter Werbung mit Profilbildung [Zustimmung erforderlich für kostenfreie Nutzung]
    - copywrong2 2y ago
      ! Jul 3, 2024 https://www.heise.de https://www.heise.de ||cmp.heise.de/privacy-manager/index.html$subdocument ! Jul 18, 2024 https://www.heise.de https://www.heise.de ||cmp.heise.de/index.html$subdocument :)
  - bratwurst3000 2y ago
    i stopped reading golem because of this. what a shit
    - copywrong2 2y ago
      100%
  - agos 2y ago
    they will not prevail, unless we collectively let them do so. they are already probably in breach of GDPR, and I don't see the EU backing down on this stuff.
    - b112 2y ago
      Collectively? More people have no idea what the GSPR even is, what cookies are, what the question even means, and just randomly click a button. The only way to get some collective action from 99.999% of web users, would be to get multiple high profile media personalities to endlessly, repeatedly tweet about it... along with a catchy jingle. Users would still have no idea about anything privacy related, but maybe 10% would do as commanded by their idols.
- lloeki 2y ago
  Having only "accept all" and say "configure", or even a highlighted "accept all" and a very small or even just unhighlighted "deny all" is against GDPR. IIRC: - choices presented must have the same visual weight (e.g for buttons) - there must be no default choice preselected (e.g for radio/toggles) - the fallback when no choice is made (e.g a dismissal or a "failure to display" a.k.a bug or nag blocker) must be equivalent to deny all Instead we get this mess because enforcement requires litigation from users and these companies make just enough to claim "oh we thought it was Ok plus we go through a off the shelf pluggable third party so not on us" plausible deniability. from https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... > If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. > Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. from https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf https://www.edpb.europa.eu/sites/default/files/files/file1/e...: > Example 6a: A website provider puts into place a script that will block content from being visible except for a request to accept cookies and the information about which cookies are being set and for what purposes data will be processed. There is no possibility to access the content without clicking on the “Accept cookies” button. Since the data subject is not presented with a genuine choice, its consent is not freely given. > 41. This does not constitute valid consent, as the provision of the service relies on the data subject clicking the “Accept cookies” button. It is not presented with a genuine choice. > The use of pre-ticked opt-in boxes is invalid under the GDPR. Silence or inactivity on the part of the data subject, as well as merely proceeding with a service cannot be regarded as an active indication of choice. > In the digital context, many services need personal data to function, hence, data subjects receive multiple consent requests that need answers through clicks and swipes every day. This may result in a certain degree of click fatigue: when encountered too many times, the actual warning effect of consent mechanisms is diminishing. > This results in a situation where consent questions are no longer read. This is a particular risk to data subjects, as, typically, consent is asked for actions that are in principle unlawful without their consent. The GDPR places upon controllers the obligation to develop ways to tackle this issue
- amanzi 2y ago
  I get a different banner - it's a huge square with a wall of German text that I can't understand. There are three buttons, also in German, and I have no idea which button to press. Guess I won't be reading the article.
- psychoslave 2y ago
  My current process for "modal asking any consent when I just jumped in the page and don’t have any certainty there is something there I am looking for" is - does reader view toggle works? if yes, consult, end here - am I really looking for some information that might be there? if "no I just clicked a link from somewhere on the internet", then end here - still here? Hey, what about looking at the DOM, if the information looked for is not a simple small segment of text, there are good chances a few CSS/HTML tweak will reveal this. Got it? end here, though you might consider to automate this process with Greasemonkey if this domain often fall in your research. - no luck so far? It’s ok, you know Internet is vast, there are plenty of other page to visit. WTF are you doing here anyway, don’t you have a job, hobbies and people to cherish? And what about a small walk, you look like you need some fresh air, you know?
n3m4c 2y ago
https://archive.ph/RQEyA https://archive.ph/RQEyA
kwhitefoot 2y ago
So how do we turn it off? Found it. Go to settings, type privacy into the search box. The last item under "Firefox Data Collection and Use" is a check box labelled "Allow websites to perform privacy-preserving ad measurement". It was already unchecked on mine when I looked just now.
- wkat4242 2y ago
  Yeah on desktop. On mobile it's a lot harder. It's still turned on and you have to use a workaround to enable about: config because they don't bother to make this option visible in settings.
  - zaik 2y ago
    I can access the about:config page on mobile, but I can't seem to find a relevant option. Maybe it's already disabled for the Fennec app from F-Droid?
  - chrismorgan 2y ago
    > and you have to use a workaround to enable about: config I know of no workaround short of installing from the Beta or Nightly channel.
  - amne 2y ago
    chrome://geckoview/content/config.xhtml source: https://connect.mozilla.org/t5/ideas/firefox-for-android-about-config/idc-p/53769/highlight/true#M31405 https://connect.mozilla.org/t5/ideas/firefox-for-android-abo...
    - wkat4242 2y ago
      Yeah apparently you can use that to set: general.aboutConfig.enable to true And then you can go to the normal about:config and set dom.private-attribution.submission.enabled to false Only then is PPA actually off (apparently, I did not manage to test this yet but someone did confirm the default setting is true). Not cool. Especially because Mozilla provides instructions for the desktop version on their site but doesn't even mention the mobile version at all.
fuzzy2 2y ago
Already discussed quite a few times: https://news.ycombinator.com/item?id=40954535 https://news.ycombinator.com/item?id=40954535 https://news.ycombinator.com/item?id=40966312 https://news.ycombinator.com/item?id=40966312 https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40971247 https://news.ycombinator.com/item?id=40971247 https://news.ycombinator.com/item?id=40965161 https://news.ycombinator.com/item?id=40965161 ...and probably a few I missed.
- gala8y 2y ago
  Thx. Nevertheless, https://xkcd.com/1053/ https://xkcd.com/1053/ still applies. I'm one of lucky 10000 today.
toldyouso2022 2y ago
[flagged]
- deely3 2y ago
  > when instead jail time for spying like the perverts they are is what should have happened. Can you elaborate? Please?
  - toldyouso2022 2y ago
    Spyware is illegal. Jail all CEOs, managers, engineers that worked on spying features at google, ms, etc They are repleaceble and next gen will not dare to spy on users. Fines are stupid and don't work anyway. This is in full compliance with the democratic process, judicial tradition, etc so I'm not ranting, instead it is that we have been so removed by the idea of punishing the actual people that do actual crimes just because they work in megacorps that any suggestion to do so sounds like a commie rant.
eco 2y ago
The CTO of Mozilla just posted on /r/firefox about this: https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_about_private_attribution_in_firefox/ https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_abo...
- lopis 2y ago
  I think this line is very important: > First, in the absence of alternatives, there are enormous economic incentives for advertisers to try to bypass these countermeasures, leading to a perpetual arms race that we may not win. It's very likely that this arms race will lead to DRM in web publications and video feeds (which Google is already experimenting with).
  - CalRobert 2y ago
    I will begrudgingly admit he has a point here. In a few years I imagine almost all sites will refuse to serve anything without WEI, and the "open" web will be the preserve of a few hobbyists. Annoyingly you'll still need to use a compromised browser (or worse, app) to do anything with your bank, etc.
    - DaoVeles 2y ago
      It will be something like WEI or sites will just be a giant blob served via WebASM.
      - deleted 2y ago
        [deleted]
    - xk_id 2y ago
      > the "open" web will be the preserve of a few hobbyists. And maybe that will be the Web healing. If all the value extraction moves elsewhere, we might finally have a sane web of hypertext documents again.
      - setopt 2y ago
nabla9 2y ago
>But how does the PPA actually work? There is an aggregation server between the advertising provider and the users or their data, which anonymizes the information from the individual app browsers. Only then does it make the data available to the participating advertising customers.
- Ygg2 2y ago
  Question is, how do we know that? What proof do we have of that?
dpwm 2y ago
The article links to Mozilla’s press release / blog entry about the acquisition of Anonym [0]. It’s pretty dystopian reading. The last three paragraphs and the summary of Anonym are more worrying than anything else I’ve read on this so far: > This acquisition marks a significant step in addressing the urgent need for privacy-preserving advertising solutions. By combining Mozilla’s scale and trusted reputation with Anonym’s cutting-edge technology, we can enhance user privacy and advertising effectiveness, leveling the playing field for all stakeholders. I can only interpret this as the urgent need is money, and wants to sell its "scale and trusted reputation". Mozilla has been down this road before. It was not good for them. > Anonym was founded with two core beliefs: First, that people have a fundamental right to privacy in online interactions and second, that digital advertising is critical for the sustainability of free content, services and experiences. Mozilla and Anonym share the belief that advanced technologies can enable relevant and measurable advertising while still preserving user privacy. This is some pretty weak wording for a press release. The economics of the situation are that advertising will always trump privacy. Researchers have successfully de-anonymized anonymised data sets, including medical records. Why would these data be any different? > As we integrate Anonym into the Mozilla family, we are excited about the possibilities this partnership brings. While Anonym will continue to serve its customer base, together, we are poised to lead the industry toward a future where privacy and effective advertising go hand in hand, supporting a free and open internet. Anonym’s customers are advertisers, right? The same people who for decades poured money into eroding that free and open internet that we had… > About Anonym: Anonym was founded in 2022 by former Meta executives Brad Smallwood and Graham Mudd. The company was backed by Griffin Gaming Partners, Norwest Venture Partners, Heracles Capital as well as a number of strategic individual investors. Well, it seems Anonym, Smallwood and Mudd had a nice piece about them written in the Wall Street Journal [1]. From the second paragraph: > Graham Mudd and Brad Smallwood each spent more than a decade building Meta’s advertising system, which allowed the company to offer granular data about how ad campaigns worked with individual users, often by tracking their web and mobile activity. [0] https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-the-bar-for-privacy-preserving-digital-advertising/ https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-t... [1] https://archive.is/17c0f#selection-5751.0-5751.246 https://archive.is/17c0f#selection-5751.0-5751.246
- 2y ago
tomaytotomato 2y ago
[flagged]
DaoVeles 2y ago
So where can I donate to Ladybird browser development? Before anyone tries to respond with it. It is https://donorbox.org/ladybird https://donorbox.org/ladybird
- prox 2y ago
  They really need to start adding windows as a build target at some near point in the future. As a webdev, that’s the only way I can convince the public to switch.
  - DaoVeles 2y ago
    I mean for a long while even the GNU project provided Windows builds for Icecat browser. Probably to much Stallman grumbling. EDIT : Actually they still update it. Last version is 115.
    - actionfromafar 2y ago
      First time I hear about Icecat browser. It seems like something that should be much more known!
      - DaoVeles 2y ago
        Because of the whole culture of GNU/FSF/Stallman, it can be a little funky at times. It has been a while but I think it still comes bundled with LibreJS, an addon that checks every Java script for Libre licensing. And yes it can be disabled. I get it and I like the idea but it does make for a difficult up front experience.
  - lukan 2y ago
    "that’s the only way I can convince the public to switch." It is not ready, to be a public browser.
  - master-lincoln 2y ago
    Maybe Ladybird can be a good reason to convince the "public" to switch away from Windows in the near future
sph 2y ago
What do you expect from a company indirectly owned and controlled by Google money? I can't wait for Ladybird to get good, in a decade realistically, swimming against a massive current of Google pushing its unstandardised nonsense on Chrome, and web developers jumping on the bandwagon, making web standards more and more complex by the day so no one ever is able to catch up. You can add to the dead internet theory the fact that the Web is now maliciously impossible to recreate and access from scratch if you are unable to compete with the billions Google spend to maintain their hegemony. Heck, even Microsoft found it was more efficient to join Google rather than to try and direct what they laughably call "an open standard." There is more competition to build reusable space rockets than in web browsers. A sad day, and sadder days await us. Shame of Mozilla, and on the CTO trying to sell this feature as a good thing.
- berkes 2y ago
  They aren't owned nor controlled by Google. And certainly not directly. I presume you refer to the fact that most income of Mozilla comes from Google paying a fee to have their search be the default. While that is worrysome, it's not control nor ownership. Let alone direct control. At most it gives Google leverage.
  - cdrini 2y ago
    The previous post said "indirectly" controls; maybe a misread?
- newzisforsukas 2y ago
  > I can't wait for Ladybird to get good I don't see that happening in a decade. What makes you so optimistic?
thinkingemote 2y ago
A user in another thread said that disabling this via config made their user agent also change. Can anyone confirm? Seems unrelated I imagine? https://news.ycombinator.com/item?id=40959723 https://news.ycombinator.com/item?id=40959723
JonChesterfield 2y ago
Firefox mobile also won't let me into about:config. So I guess that's the end. Opera? Other recommendations?
- justinclift 2y ago
  Which OS are you using?
  - Ygg2 2y ago
    Firefox mobile is only on Android. The iOS version is a reskin, so it's not affected.
- DaoVeles 2y ago
  Elinks via Termux? /jk For those that don't know, Elinks is a text only terminal browser.
  - brettermeier 2y ago
    Lol, nobody wants that. Recommend Mull or something else sensible. Edit: Whoopsy, oversaw your /jk
    - DaoVeles 2y ago
      All good! That said I do like the genuine recommendation. Will look at that.
  - mrweasel 2y ago
    While the jokes is appreciated, I'm also half-serious in considering just using Links/Elinks or w3m and just use whatever is the default browser on my OS for those cases where I need to book ticket or do banking. I'm sadly falling out of love with the web. So much fun and enjoyment have left the web in the past 20 years and I don't enjoy or to some extend even benefit from the modern hellscape of modern commercial web.
justinclift 2y ago
As an alternative, if you're using macOS (or iOS) then Kagi's Orion Browser seems decent: https://kagi.com/orion/ https://kagi.com/orion/
ranguna 2y ago
https://librewolf.net/ https://librewolf.net/ And fallback to Firefox when things don't work. Which is usually on sketchy websites, websites that have heavy bot protection and fingerprinting or ones that use gpu APIs.
- MrAlex94 2y ago
  A few criticisms of LibreWolf: * There is no legal entity behind the project. Should anything ever happen with the project (it can happen, even if unlikely), there are no legal ramifications. * The binaries aren't signed. Yes, code signing is a bit of a racket, but there is some merit in it. * There is no auto-update mechanism. Might not seem like a big deal, but IMO it is, especially on Windows where you're recommended to rely on 3rd party client to update the browser for you. You've now added a middle man, and since the binaries are not signed... well there's no guarantee you aren't downloading a malicious binary.
  - MiddleEndian 2y ago
    >There is no auto-update mechanism. Might not seem like a big deal, but IMO it is, especially on Windows where you're recommended to rely on 3rd party client to update the browser for you. You've now added a middle man, and since the binaries are not signed... well there's no guarantee you aren't downloading a malicious binary. To me, this seems like a plus. If you want users to update, provide them with something worth updating to. This tracking suddenly being enabled for a ton of users is the very result of automatic updates.
    - kees99 2y ago
      Also, for some software vendors, frequent/automatic upgrades are a great place to hide silent reconfiguration. Mozilla has been repeatedly resetting "Always check if Firefox is your default browser" option to "yes" with upgrades. I don't see why "private-attribution submission enabled" wouldn't be reset in future in the same way.
      - 2y ago
INTPenis 2y ago
I wish the article showed us how to disable PPA.[1] 1. https://support.mozilla.org/en-US/kb/privacy-preserving-attribution https://support.mozilla.org/en-US/kb/privacy-preserving-attr...
xyproto 2y ago
Will we see a comeback from IceWeasel?
- whoisthemachine 2y ago
  I recently became aware of LibreWolf (https://librewolf.net/installation/linux/ https://librewolf.net/installation/linux/), going to see how it works. So far I like that I can install it via AppImage!
st_goliath 2y ago
While the Wikimedia Foundation is often quoted as having cancer[1], I guess the Mozilla Foundation has Alzheimer's, constantly forgetting who they are and why they are here in the first place. [1] https://en.wikipedia.org/wiki/User:Guy_Macon/Wikipedia_has_Cancer https://en.wikipedia.org/wiki/User:Guy_Macon/Wikipedia_has_C...
- jeltz 2y ago
  And the scandals they have been involved in the past. Cliqz was another attempt by Mozilla to invest in privacy preserving technology (that time search, this time ads) where they did a stealth launch without user consent.
hulk_ 2y ago
Just installed Chrome again. I loved everything about the idea behind Mozilla but the browser is quite not useable these days. Really sad.
- moontear 2y ago
  How is your personal story related to the story? I don’t believe Chrome is better than Firefox on terms of ad tracking.
- linuxandrew 2y ago
  Out of the frying pan and into the fire. With regards to privacy and tracking Chrome/Chromium is so much worse than Firefox. Whether it be terrible defaults, exceptions which allow Google to see your system info, or an incognito mode which is a misnomer, Chrome just doesn't do privacy at all. I can sympathise about general usability concerns but they don't really relate to the OP. I personally run Ungoogled Chromium for anything that doesn't work in LibreWolf, which is fortunately not too much.
TimCTRL 2y ago
Do you guys like or trust Vivaldi?
- mrweasel 2y ago
  I've been looking at it and they are fortunately very open about how they are funded (search engines and bookmarks). Opera was my browser of choice, back in the days of Presto, so I trust the Vivaldi CEO/CTO who also ran Opera. My main annoyance with Vivaldi is that it's Chromium based, I really don't like the idea of a monoculture of rendering engines.
- toofy 2y ago
  vivaldi is not open source, they’re almost certainly more invasive than Mozilla.
silcoon 2y ago
> By offering sites a non-invasive alternative to cross-site tracking, we hope to achieve a significant reduction in this harmful practice across the web. The value of words is leaving the web.
qwertox 2y ago
Firefox should integrate a tracker-blocker which blocks all ads which rely on executing Javascript as well as profiling-related 3rd-party code snippets, but leaves ad images which are integrated into the page, served exclusively by the owner of the page, and are based on the content offered by the page. Like magazine ads. Everything else is just agreeing with the advertising industry on their idea that profile-building is fine. These advertisers nowadays think they have they are entitled to everything, and Firefox just helped them.
- alex_duf 2y ago
  By this logic wikipedia wouldn't be able to load any image
  - qwertox 2y ago
    They could offer a deal to Toyota and tell them they're offering image-only ad space on all car-related pages. For example images with deals. Toyota would know from the referrer that the click came from Wikipedia. All the other images are hosted by Wikipedia themselves and are not ad-related, so I don't see where's the issue here.
    - alex_duf 2y ago
      I'm just saying that the domain that hosts the page and the domain that hosts the image are often not the same. Wikipedia hosts the articles, wikimedia hosts the images. If a browser wants to be strict about what it loads, most of the web would appear broken. Maybe google could have the weight to force such change, but no way could mozilla impose such a strict rule.
  - deleted 2y ago
    [deleted]
albeva 2y ago
And there goes my trust in Firefox out the window... Safari seems to be the only decent, privacy-focused browser left on the market. Until the Ladybird arrives.
- sumuyuda 2y ago
  The fact that Apple killed any real third party extensions ended my use of Safari.
- MrAlex94 2y ago
  > Safari seems to be the only decent, privacy-focused browser left on the market. Safari has Private Click Measurement: https://webkit.org/blog/11529/introducing-private-click-measurement-pcm/ https://webkit.org/blog/11529/introducing-private-click-meas... And AFAICT, Mozilla's implementation is technically superior?
  - Tarq0n 2y ago
    Safari also has attestation, as far as I know without user consent.
    - MrAlex94 2y ago
      Does MPC, which PPA uses, use attestation? I'm under the impression it doesn't (at least currently): https://github.com/patcg-individual-drafts/ipa/issues/22 https://github.com/patcg-individual-drafts/ipa/issues/22
stebalien 2y ago
This works by adding noise. Can't an attacker bypass it by boosting the signal? Assuming the attacker can create sybil advertisers/browsers, this should be totally doable: 1. Define some baseline set of M impressions with various ad identifiers and from various sybil advertisers. 2. For each target user, define some set of M marker impressions, also with various ad identifiers and from various and sybil advertisers. 3. Save all impressions (marker + baseline) on a bunch of sybil browsers to get above the reporting baseline with some probability. 4. If/when a target user visits a target website, request a conversion report for each ad/advertiser. You now have a baseline signal (from the baseline ads/advertisers) and a marker signal (from the marker ads/advertisers). If this is one of your target users, you'd expect their "marker" signal signal to be stronger than the baseline.
- MrAlex94 2y ago
  Technical docs are here: https://github.com/patcg-individual-drafts/ipa/blob/main/IPA-End-to-End.md https://github.com/patcg-individual-drafts/ipa/blob/main/IPA... Might be worth opening an issue if you believe there's merit to the attack?
  - stebalien 2y ago
    I can try. But I'm pretty sure what they're trying to do is fundamentally impossible without some kind of sybil protection.
  - stebalien 2y ago
    Those docs look out of date and appear to be designed for "app" ecosystems. The latest proposal from Mozilla is https://docs.google.com/document/d/1QMHkAQ4JiuJkNcyGjAkOikPKNXAzNbQKILqgvSNIAKw/edit#heading=h.5wiflfzeuvfm https://docs.google.com/document/d/1QMHkAQ4JiuJkNcyGjAkOikPK... And I'm now quite sure this system is insecure. Fundamentally, either: 1. There is some magical sybil protection: An attacker can only spend their own privacy budget without affecting the rest of the system. 2. The system can be saturated: An attacker can spend everyone's privacy budget. 3. The system is not private: An attacker can exceed the "safe" privacy budget by combining information from multiple sybils.
Piraty 2y ago
If 1% of regular Firefox users just donated the equivalent of 10USD per year to mozilla, they would not have the need to find ...eyebrow-raising... ways to earn money.
- n_plus_1_acc 2y ago
  On the other hand, people would be more inclined to donate money if they could trust Mozilla to value the privacy of their users, which is one of the biggest reasons people choose FF in the first place.
  - deleted 2y ago
    [deleted]
- lawn 2y ago
  Nah, they'd just increase the already ridiculous salary to their CEO.
  - justinclift 2y ago
    Mozilla CEO Salary was US$7 million in 2022. It's beyond taking the piss: https://en.wikipedia.org/wiki/Mitchell_Baker#Negative_salary-performance_correlation https://en.wikipedia.org/wiki/Mitchell_Baker#Negative_salary... No idea how much the new CEO is being paid. Probably just as bad.
- bondarchuk 2y ago
  Only if they'd also spin off the browser from all the political activism and NGO cash grabbing, and let people choose themselves to which of the two their money goes.
- mardifoufs 2y ago
  0% of donations go towards financing the Firefox project. Donations to Mozilla are explicitly not used for Firefox, they say so in the donation page.
slowhadoken 2y ago
An app that alerts you to invasive content in updates like this would be cool.
uyzstvqs 2y ago
What's dumb is that Firefox is not the freedom browser people think it is. Mozilla is a crappy organization. Firefox has extension signing, it's as restrictive as installing apps on iOS where only approved apps can be installed, without a setting to easily disable it. Mozilla can also remotely install extensions by default (opt out) called "experiments" or something. Their anti-tracking is purposefully weak because of their dealings with Google. Now this data collection for ads. They didn't enable DNS-over-HTTPS by default specifically in the UK. And Mozilla leadership is associated with radical left politics, just as an extra. Maybe check out Brave Browser, LibreWolf or Vivaldi.
- kiviuq 2y ago
  communists and anarchists have been dominating the ad industry for decades :p
- 3l3ktr4 2y ago
  >And Mozilla leadership is associated with radical left politics, just as an extra. Do you have proof for this? I'd be curious. I also fail to see how is that related to the collecting data by default thing. Is that a leftist thing now?
  - bawolff 2y ago
    Personally i'd rather judge people by the things they do (or fail to do), not who they are associated with.
  - V__ 2y ago
    Maybe they mean this statement, however I don't see why their proposed changes are radical. [1] https://blog.mozilla.org/en/mozilla/we-need-more-than-deplatforming/ https://blog.mozilla.org/en/mozilla/we-need-more-than-deplat...
  - mightyham 2y ago
    Whether you agree or disagree with what the Mozilla foundation does, it seems fairly matter of fact to say that they are pursuing liberal policies and that posts from the leadership, like the couple below, employ a good bit of leftist rhetoric. https://blog.mozilla.org/en/mozilla/first-steps-toward-lasting-change/ https://blog.mozilla.org/en/mozilla/first-steps-toward-lasti... https://blog.mozilla.org/en/mozilla/leadership/mozilla-racial-justice-commitments-one-year-in/ https://blog.mozilla.org/en/mozilla/leadership/mozilla-racia...
ManBeardPc 2y ago
Maybe I don't fully understand the technical implementation, but as far as I have read about the implementation this gives personal information to a third-party. This should automatically mean that Firefox would violate European GDPR laws, they clearly need to get consent from the user before collecting anything. Not just a moral issue, but can quickly become a legal one as well.
genezeta 2y ago
I've been wondering about this whole affair. The thing that got me wondering is this: Is this really interesting for advertisers? I mean, let's imagine this works as explained -whatever, let's imagine it does and with no downsides even-. Now as far as I can understand this aggregate information ends up producing something like "this particular ad placed here ends up producing this number of conversions". Is this really something an advertiser wants to know? Maybe to some extent, but to me it sounds a lot more like something an advertising platform would want to know. Which is why I'm not surprised by Meta's interest. To me this feels like a good tool to avoid paying small websites at all for just having ads. Impressions would be finally and completely discarded as something payable. Now for the ads on your site to earn you something at all you need conversions that you can now reliably track. For a site owner to be paid, they'd need to increase the CTR; they can't just "provide ad space", they have to work to earn clicks. So maybe -probably- I'm way off here. Maybe someone can correct me. But as I see this, this tool seems very specifically made for the big advertising platforms.
temporarely 2y ago
Enough of this waiting for virtuous entities to address legitimate concerns of the public. The "ad industry" is a cancer and we need legal protection against this "industry". The solution is political not technical and definitely can not be left to "the market". Haven't you had enough?
- 8jef 2y ago
  Yes, that's why I've donated to the LadyBird project.
  - ajdude 2y ago
    It's just weird that ladybird is picking ideological hills to die on, such as "no gender neutral pronouns"[1] [1] https://github.com/SerenityOS/serenity/pull/6814 https://github.com/SerenityOS/serenity/pull/6814
    - Workaccount2 2y ago
      You're not gonna die pissing off 0.1% of the population.
    - ZhongXina 2y ago
      It's an understandable reaction against a loud and aggressive (political) minority we've been seeing for the past four years. Thanks for the link, this finally pushed me to support the developer.
- berkes 2y ago
  How would that legal "protection" work in practice? What would it protect against? Who would it protect? What you say sounds reasonable. And I'm not trying to say "well, it's impossible because of some current status quo", because we could change that. What I'm trying to say is that we need this "industry" to work out the practicalities. Otherwise we are "protected" in a same way the GDPR protects us against 3rd part trackers (you don't need a cookie banner if you don't allow 3rd parties to track your users. Yet here we are...)
SonjaHinton 2y ago
[dead]
3l3ktr4 2y ago
I wonder why they claim they need this... Tor seems to be doing fine as an organization without collecting user data? Why maintaining Firefox is much more expensive? I guess the codebase for Firefox is much larger and in the end Tor is a fork of Firefox, right? So maybe they do need much more resources? Not to say I'm not disappointed with Mozilla once again.
- berkes 2y ago
  Tor is (was?) heavily subsidised by secret services in a.o. the US. > likewise, agencies within the U.S. government variously fund Tor (the U.S. State Department, the National Science Foundation, and – through the Broadcasting Board of Governors, which itself partially funded Tor until October 2012 https://en.wikipedia.org/wiki/Tor_%28network%29?wprov=sfla1 https://en.wikipedia.org/wiki/Tor_%28network%29?wprov=sfla1
  - toofy 2y ago
    While it has had funding from some sources we don’t necessarily trust, it’s still entirely open source and the code has been combed through repeatedly. When it comes to privacy apps, I’d place significantly more trust in something like that than literally anything closed source or unscrutinized to that degree.
    - berkes 2y ago
      Sorry, I wasn't trying to imply that we should not trust it. I was merely implying that there's a major difference between the model behind TOR and that of Firefox. And also similarities: if TOR is funded by entitities we don't trust and it turns out to work fine, then Firefox, being "funded" by Google should not have to be a severe problem either.
8jef 2y ago
Please give to LadyBird project and be done with it.
anordal 2y ago
I see this as an attempt at a lesser evil, and I would support that (see my EME DRM comment), but I have one concern: Does this new "privacy preserving attribution" feature respect multi-account containers? Or is it somehow not considered necessary, because it's meant to be less invasive than the tracking cookies it's supposed to replace? Call me skeptical for now. I'm a happy user of multi-account containers, which lets me separate my cookie identities in Firefox. Before, I had to use different browsers for work and private, and yes, it solves this problem, but the best part is that I don't have to worry about tracking cookies, because they aren't tied to my personal accounts: In my experience, I can to a great extent escape the echo chamber I'm in, and the ads I see in it, by just deleting the cookies of my sacrificial default container. Other than that, considering the status quo – that the web is already an unfriendly GDPR nightmare, I'm positive to the initiative. And because of the power of the default, I can understand that the feature wouldn't likely take off if it was opt-in, so I won't criticize Mozilla for that move either.
eleveriven 2y ago
I think Mozilla Firefox has long been positioned as a browser focused on user privacy and data protection... This decision is indeed a significant breach of trust
southernplaces7 2y ago
One of the few things about Firefox that made me attempt to tolerate its repeatedly slow, shitty performance and tendency to slow my whole device down, was the privacy angle. With that gone, why bother? Might as well use Chrome. At least it's light and fairly quick.
- rc_mob 2y ago
  Eh? Chrome is famously bulky and a memory hog
  - lolinder 2y ago
    There are a lot of people who still think of Firefox from 5 years ago. Whatever else you can say about Mozilla (and I have a lot to say about Mozilla) they have actually really improved performance to where I'm not convinced it's any worse than Chrome. Browsers are just doing more than they used to.
  - acdha 2y ago
    Firefox’s reputation got hit a decade or so ago by performance problems in popular extensions like AdBlock Plus, and it was common to see people mistake switching to a new browser as the reason for the speed up because the initial performance would be notably better before they loaded the new one up with extensions, too.
  - southernplaces7 2y ago
    Sorry folks but though i'm just speaking from personal experience, it's what I noticed time and time again. I've given Firefox multiple chances as my default browser over several years right up until maybe a year ago and the same problem presented itself across different laptops and FF versions (many after in those cases someone told me that FF was FINALLY fixed, oops). Were these laptops heavy duty models with serious CPU, GPU, RAM and etc power? Nope, but they shouldn't have to be for just running a browser. Chrome on the other hand (and believe me I despise Google in so many different ways) has consistently been okay. Not great, but okay, and certainly better than Firefox. This while having the same browsing, tab and extension habits in both browsers. With comments like my original above I've always seen a bunch of people come out with all sorts of caveats defending or justifying FF, but personal experience has consistently shown me differently.
deleted 2y ago
[deleted]
pfzero 2y ago
I wish there was a serious conversation on how a browser can be productivized and make actual profits. I think that model has the best chances of working out over the long-term in guarding user's privacy - at least for those users willing to pay for it. Most (all?) companies which developed a browser have lax policies on data privacy. At most those are inline with major directives like GDPR. However, it's not in their best interest to protect / not leverage user data. So the real discussion should've been about the set of features that would attract a sufficiently large user base who would pay ~10$ per month subscription in order to make the model sustainable on the long-term.
alabhyajindal 2y ago
Greeted by a cookie banner in a different language when I open. I swear cookie banners are the biggest problem facing the internet. We need to do something about this!
- lexicality 2y ago
  honestly it's got to the point that any time I get a cookie banner more complicated than yes/no I immediately revoke JS privileges for that website. At least ublock origin makes that easy, but it's still ridiculous. On the bright side, French courts have ruled that this kind of cookie popup is illegal under the GDPR so maybe they'll slowly be destroyed
- belorn 2y ago
  EU created a task force in 2021 to address the cookie banner, which gave a report last year that basically said that all current form of cookie banners are practically not legal in terms of giving consent. As with this kind of regulations, we now have to wait for the law suits to target a few select large companies, then the courts to reconfirm that the regulations says what it says, and then appeals, and then finally the large companies will pay a large fine and then comply, followed then by the industry in large. Delay, delay and then delay some more has been the response from the data collection industry for the past 10 years. Same for right to repair regulations and smartphones.
matheusmoreira 2y ago
Reminder: Mozilla has billions of dollars in the bank. They don't need to do this. They want to.
seanhunter 2y ago
If you want to disable this, instructions are given here[1] but 1) Hamburger menu -> Settings -> Privacy & Security 2) scroll down to the new section entitled "Web Site Advertising Preferences". 3) Make sure the box marked "Allow web sites to perform privacy-preserving ad measurement" is not checked. [1] https://support.mozilla.org/en-US/kb/privacy-preserving-attribution https://support.mozilla.org/en-US/kb/privacy-preserving-attr...
- kevincox 2y ago
  And of course this setting doesn't sync to new devices by default. So you need to remember to opt-out on every device. The underlying pref is dom.private-attribution.submission.enabled. I'm going to force this off in my policies.
  - blueflow 2y ago
    How do you sync these settings across devices? I need such a thing, too.
    - kevincox 2y ago
      If you want to use Firefox sync IIUC you can define a new pref services.sync.prefs.sync.dom.private-attribution.submission.enabled. However this has always been flakey in the past for me. (I think maybe the sync prefs themselves don't sync?) Now I install an organizational policy that sets the prefs. I use NixOS to apply this and it looks like this: environment.systemPackages = [(pkgs.firefox.override { extraPrefs = '' lockPref("dom.private-attribution.submission.enabled", false); '' })]; I think this is just creating a `prefs.js` file under the hood, so you should be able to replicate on other systems that you manage. Edit: This is creating a lib/firefox/mozilla.cfg. IDK how exactly this applies to other distros.
    - ringer 2y ago
      Basically, you need to create a `user.js` file in the root folder of your profile, you can find/open the profile folder using about:profiles or about:support (default path is `~/.mozilla/firefox/${profile-name}/user.js`). You can sync it however you like, e.g. upload it to your dotfiles repo and symlink with stow, etc. The syntax is: user_pref("dom.private-attribution.submission.enabled", false); // Disable Privacy-Preserving Attribution You can find a lot of examples and "documentation" on https://github.com/arkenfox/user.js https://github.com/arkenfox/user.js
tiffanyh 2y ago
Firefox needs to update their Mission. Because it's very confusing now.
account42 2y ago
I always think it's ironic when these things are reported on by websites that force you into accepting their ad tracking which really should be illegal under the GDPR.
sotix 2y ago
Can companies not see how their ads are performing by looking at their income statements? An ad campaign costs x dollars. Widget sales increase by y dollars. Companies were able to run this method for a long time. I think ads have gone way too far. It’s shocking we’ve gotten to the point of this discussion on data collection to fuel ads.
- tyree731 2y ago
  In the aggregate, yes, but in the specific, no. Companies nowadays want to see which advertising channels and specific ads, over a given period of time, are performing, so as to decide how to better invest their ad spend
EADDRINUSE 2y ago
`sudo echo "127.0.0.1 push.services.mozilla.com incoming.telemetry.mozilla.org" >> /etc/hosts`
irq-1 2y ago
> Our hope is that if we develop a good attribution solution, it will offer a real alternative to more objectionable practices like tracking. There is no negotiating with the advertising industry. No system will stop them from acting unethically to gain an edge. -- My idea for such a system: random GUID added to each ad. Browser plugin collects GUIDs. Client protects itself with random GUIDs removed and new random GUIDs added. Client sends GUIDs to a Collector they choose. Collectors run client GUIDs against Advertisers lists (bloom filters). Advertisers pay Collectors, and Collectors give to orgs. Edit: replace GUIDs with 6 random bytes, so the existence of an id is not proof of it's being viewed. it needs to be plausible that the client added an id randomly, and that's not the case with a GUID.
- deleted 2y ago
  [deleted]
Archelaos 2y ago
Years ago I had a "Download Firefox" button on my Web-site. I have removed it because of similar incidents in the past. And I stopped recommending Firefox to friends and relatives, because I can no longer do it wholeheartedly. I am not even sure myself, whether it makes a big difference which browser you use nowadays. More out of tradition I am still using Firefox myself, but I know other technologically competent people who shifted away from it. I can only assume that this was for similar reasons: It is felt that Firefox gives no less cause for annoyance than other browsers. When Firefox gradually loses more and more dedicated supporters who become indifferent, I see a rather bleak future for it.
ChrisArchitect 2y ago
[dupe] More discussion among others: https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40966312 https://news.ycombinator.com/item?id=40966312 https://news.ycombinator.com/item?id=40954535 https://news.ycombinator.com/item?id=40954535
Dwedit 2y ago
How does using uBlock Origin affect this?
deleted 2y ago
[deleted]
peanut_worm 2y ago
I don’t think Mozilla is trustworthy anymore.
Timber-6539 2y ago
At this point Firefox is just a brand for Mozilla to do with as they please. All the talk about a non-Chrome browser with defacto privacy features was just bait to get loyal followers and later on down the road sell them something. Seems ads is just their newest offering.
AlecSchueler 2y ago
Anyone else feel done with the web? I can't remember the last time I enjoyed a browsing experience. I think this new default might be the end for me.
jandrusk 2y ago
Not a good strategy for keeping an already very small user base.
ChrisArchitect 2y ago
[dupe] Since this is days old news with lots of discussion (https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40952330 and more) the more recent development is Firefox CTO posting thoughts: https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_about_private_attribution_in_firefox/ https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_abo... (https://news.ycombinator.com/item?id=40971247 https://news.ycombinator.com/item?id=40971247)
Yawrehto 2y ago
I kind of like how this has dominated the 'active' section ever since it started and it's, barely a news story everywhere else. Honestly I don't have much to add to the conversation. Mozilla made a bad move, Firefox's big thing was privacy and not being Chromium and it's lost the first thing.
eburuschkin 2y ago
Apple enabled the same thing in Safari. Settings -> Advanced -> Allow Privacy-Preserving Measurement of Ad Effectiveness
yamumsahoe 2y ago
how do i donate to the mozilla foundation to support this amazing development?
SonjaHinton 2y ago
[dead]
r3db34rd 2y ago
[dead]

597 points by firebaze 2y ago

Says the site that only offers one big button "accept" to its cookies :( :( There's no "Nope". Edit: Weird, some people seem to have received more options than me. For me there was just one option to accept (Zustimmen) and nothing else. Everything was in German but I read German anyway. I was on mobile though, perhaps this is why? I can't see it again because I already pressed it. A practice (pay or accept cookies) which was actually ruled in breach with GDPR but many German sites seem to do this somehow. I agree with the criticism on Firefox but this is very hypocritical. Heise used to be a good company. I even used to subscribe to C'T and iX.

Semaphor 2y ago
> A practice (pay or accept cookies) which was actually ruled in breach with GDPR but many German sites seem to do this somehow. Our Data Protection Agencies ruled it okay. There was a recent court case that called it into question again, so we’ll see how things develop. FWIW, my normal blockers manage to block the heise.de pay-or-track banner, different from, e.g. golem.
- agos 2y ago
  what data protection agencies?
  - Semaphor 2y ago
    I used the wrong word, it’s authorities. The German word is "Datenschutzaufsichtsbehörde"
    - wkat4242 2y ago
      This is why scrabble is such a popular game in Germany :)
- wkat4242 2y ago
  But even then, it's a bit hypocritical writing an article slamming firefox for this at least allegedly privacy-sensitive adtracking. While requiring readers to consent to tracking from your however many ad partners :P
- deleted 2y ago
  [deleted]
copywrong2 2y ago
These dark patterns will prevail. However, I honestly expect their reasoning to be "every single user reading heise.de should have a cookie banner blocking enabled in their Ad Blocker". Also, I think you can accept it for free when you click "Einstellungen", this is not golem.de.
- Semaphor 2y ago
  > Also, I think you can accept it for free when you click "Einstellungen" No, this part is mandatory: > Datenverarbeitungen von Werbeanbietern einschl. personalisierter Werbung mit Profilbildung [Zustimmung erforderlich für kostenfreie Nutzung]
  - copywrong2 2y ago
    ! Jul 3, 2024 https://www.heise.de https://www.heise.de ||cmp.heise.de/privacy-manager/index.html$subdocument ! Jul 18, 2024 https://www.heise.de https://www.heise.de ||cmp.heise.de/index.html$subdocument :)
- bratwurst3000 2y ago
  i stopped reading golem because of this. what a shit
  - copywrong2 2y ago
    100%
- agos 2y ago
  they will not prevail, unless we collectively let them do so. they are already probably in breach of GDPR, and I don't see the EU backing down on this stuff.
  - b112 2y ago
    Collectively? More people have no idea what the GSPR even is, what cookies are, what the question even means, and just randomly click a button. The only way to get some collective action from 99.999% of web users, would be to get multiple high profile media personalities to endlessly, repeatedly tweet about it... along with a catchy jingle. Users would still have no idea about anything privacy related, but maybe 10% would do as commanded by their idols.
lloeki 2y ago
Having only "accept all" and say "configure", or even a highlighted "accept all" and a very small or even just unhighlighted "deny all" is against GDPR. IIRC: - choices presented must have the same visual weight (e.g for buttons) - there must be no default choice preselected (e.g for radio/toggles) - the fallback when no choice is made (e.g a dismissal or a "failure to display" a.k.a bug or nag blocker) must be equivalent to deny all Instead we get this mess because enforcement requires litigation from users and these companies make just enough to claim "oh we thought it was Ok plus we go through a off the shelf pluggable third party so not on us" plausible deniability. from https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... > If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. > Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. from https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf https://www.edpb.europa.eu/sites/default/files/files/file1/e...: > Example 6a: A website provider puts into place a script that will block content from being visible except for a request to accept cookies and the information about which cookies are being set and for what purposes data will be processed. There is no possibility to access the content without clicking on the “Accept cookies” button. Since the data subject is not presented with a genuine choice, its consent is not freely given. > 41. This does not constitute valid consent, as the provision of the service relies on the data subject clicking the “Accept cookies” button. It is not presented with a genuine choice. > The use of pre-ticked opt-in boxes is invalid under the GDPR. Silence or inactivity on the part of the data subject, as well as merely proceeding with a service cannot be regarded as an active indication of choice. > In the digital context, many services need personal data to function, hence, data subjects receive multiple consent requests that need answers through clicks and swipes every day. This may result in a certain degree of click fatigue: when encountered too many times, the actual warning effect of consent mechanisms is diminishing. > This results in a situation where consent questions are no longer read. This is a particular risk to data subjects, as, typically, consent is asked for actions that are in principle unlawful without their consent. The GDPR places upon controllers the obligation to develop ways to tackle this issue
amanzi 2y ago
I get a different banner - it's a huge square with a wall of German text that I can't understand. There are three buttons, also in German, and I have no idea which button to press. Guess I won't be reading the article.
psychoslave 2y ago
My current process for "modal asking any consent when I just jumped in the page and don’t have any certainty there is something there I am looking for" is - does reader view toggle works? if yes, consult, end here - am I really looking for some information that might be there? if "no I just clicked a link from somewhere on the internet", then end here - still here? Hey, what about looking at the DOM, if the information looked for is not a simple small segment of text, there are good chances a few CSS/HTML tweak will reveal this. Got it? end here, though you might consider to automate this process with Greasemonkey if this domain often fall in your research. - no luck so far? It’s ok, you know Internet is vast, there are plenty of other page to visit. WTF are you doing here anyway, don’t you have a job, hobbies and people to cherish? And what about a small walk, you look like you need some fresh air, you know?

n3m4c 2y ago

https://archive.ph/RQEyA https://archive.ph/RQEyA

kwhitefoot 2y ago

So how do we turn it off? Found it. Go to settings, type privacy into the search box. The last item under "Firefox Data Collection and Use" is a check box labelled "Allow websites to perform privacy-preserving ad measurement". It was already unchecked on mine when I looked just now.

wkat4242 2y ago
Yeah on desktop. On mobile it's a lot harder. It's still turned on and you have to use a workaround to enable about: config because they don't bother to make this option visible in settings.
- zaik 2y ago
  I can access the about:config page on mobile, but I can't seem to find a relevant option. Maybe it's already disabled for the Fennec app from F-Droid?
- chrismorgan 2y ago
  > and you have to use a workaround to enable about: config I know of no workaround short of installing from the Beta or Nightly channel.
- amne 2y ago
  chrome://geckoview/content/config.xhtml source: https://connect.mozilla.org/t5/ideas/firefox-for-android-about-config/idc-p/53769/highlight/true#M31405 https://connect.mozilla.org/t5/ideas/firefox-for-android-abo...
  - wkat4242 2y ago
    Yeah apparently you can use that to set: general.aboutConfig.enable to true And then you can go to the normal about:config and set dom.private-attribution.submission.enabled to false Only then is PPA actually off (apparently, I did not manage to test this yet but someone did confirm the default setting is true). Not cool. Especially because Mozilla provides instructions for the desktop version on their site but doesn't even mention the mobile version at all.

fuzzy2 2y ago

Already discussed quite a few times: https://news.ycombinator.com/item?id=40954535 https://news.ycombinator.com/item?id=40954535 https://news.ycombinator.com/item?id=40966312 https://news.ycombinator.com/item?id=40966312 https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40971247 https://news.ycombinator.com/item?id=40971247 https://news.ycombinator.com/item?id=40965161 https://news.ycombinator.com/item?id=40965161 ...and probably a few I missed.

gala8y 2y ago
Thx. Nevertheless, https://xkcd.com/1053/ https://xkcd.com/1053/ still applies. I'm one of lucky 10000 today.

toldyouso2022 2y ago

[flagged]

deely3 2y ago
> when instead jail time for spying like the perverts they are is what should have happened. Can you elaborate? Please?
- toldyouso2022 2y ago
  Spyware is illegal. Jail all CEOs, managers, engineers that worked on spying features at google, ms, etc They are repleaceble and next gen will not dare to spy on users. Fines are stupid and don't work anyway. This is in full compliance with the democratic process, judicial tradition, etc so I'm not ranting, instead it is that we have been so removed by the idea of punishing the actual people that do actual crimes just because they work in megacorps that any suggestion to do so sounds like a commie rant.

eco 2y ago

The CTO of Mozilla just posted on /r/firefox about this: https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_about_private_attribution_in_firefox/ https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_abo...

lopis 2y ago
I think this line is very important: > First, in the absence of alternatives, there are enormous economic incentives for advertisers to try to bypass these countermeasures, leading to a perpetual arms race that we may not win. It's very likely that this arms race will lead to DRM in web publications and video feeds (which Google is already experimenting with).
- CalRobert 2y ago
  I will begrudgingly admit he has a point here. In a few years I imagine almost all sites will refuse to serve anything without WEI, and the "open" web will be the preserve of a few hobbyists. Annoyingly you'll still need to use a compromised browser (or worse, app) to do anything with your bank, etc.
  - DaoVeles 2y ago
    It will be something like WEI or sites will just be a giant blob served via WebASM.
    - deleted 2y ago
      [deleted]
  - xk_id 2y ago
    > the "open" web will be the preserve of a few hobbyists. And maybe that will be the Web healing. If all the value extraction moves elsewhere, we might finally have a sane web of hypertext documents again.
    - setopt 2y ago

nabla9 2y ago

>But how does the PPA actually work? There is an aggregation server between the advertising provider and the users or their data, which anonymizes the information from the individual app browsers. Only then does it make the data available to the participating advertising customers.

Ygg2 2y ago
Question is, how do we know that? What proof do we have of that?

dpwm 2y ago

The article links to Mozilla’s press release / blog entry about the acquisition of Anonym [0]. It’s pretty dystopian reading. The last three paragraphs and the summary of Anonym are more worrying than anything else I’ve read on this so far: > This acquisition marks a significant step in addressing the urgent need for privacy-preserving advertising solutions. By combining Mozilla’s scale and trusted reputation with Anonym’s cutting-edge technology, we can enhance user privacy and advertising effectiveness, leveling the playing field for all stakeholders. I can only interpret this as the urgent need is money, and wants to sell its "scale and trusted reputation". Mozilla has been down this road before. It was not good for them. > Anonym was founded with two core beliefs: First, that people have a fundamental right to privacy in online interactions and second, that digital advertising is critical for the sustainability of free content, services and experiences. Mozilla and Anonym share the belief that advanced technologies can enable relevant and measurable advertising while still preserving user privacy. This is some pretty weak wording for a press release. The economics of the situation are that advertising will always trump privacy. Researchers have successfully de-anonymized anonymised data sets, including medical records. Why would these data be any different? > As we integrate Anonym into the Mozilla family, we are excited about the possibilities this partnership brings. While Anonym will continue to serve its customer base, together, we are poised to lead the industry toward a future where privacy and effective advertising go hand in hand, supporting a free and open internet. Anonym’s customers are advertisers, right? The same people who for decades poured money into eroding that free and open internet that we had… > About Anonym: Anonym was founded in 2022 by former Meta executives Brad Smallwood and Graham Mudd. The company was backed by Griffin Gaming Partners, Norwest Venture Partners, Heracles Capital as well as a number of strategic individual investors. Well, it seems Anonym, Smallwood and Mudd had a nice piece about them written in the Wall Street Journal [1]. From the second paragraph: > Graham Mudd and Brad Smallwood each spent more than a decade building Meta’s advertising system, which allowed the company to offer granular data about how ad campaigns worked with individual users, often by tracking their web and mobile activity. [0] https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-the-bar-for-privacy-preserving-digital-advertising/ https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-t... [1] https://archive.is/17c0f#selection-5751.0-5751.246 https://archive.is/17c0f#selection-5751.0-5751.246

2y ago

tomaytotomato 2y ago

[flagged]

DaoVeles 2y ago

So where can I donate to Ladybird browser development? Before anyone tries to respond with it. It is https://donorbox.org/ladybird https://donorbox.org/ladybird

prox 2y ago
They really need to start adding windows as a build target at some near point in the future. As a webdev, that’s the only way I can convince the public to switch.
- DaoVeles 2y ago
  I mean for a long while even the GNU project provided Windows builds for Icecat browser. Probably to much Stallman grumbling. EDIT : Actually they still update it. Last version is 115.
  - actionfromafar 2y ago
    First time I hear about Icecat browser. It seems like something that should be much more known!
    - DaoVeles 2y ago
      Because of the whole culture of GNU/FSF/Stallman, it can be a little funky at times. It has been a while but I think it still comes bundled with LibreJS, an addon that checks every Java script for Libre licensing. And yes it can be disabled. I get it and I like the idea but it does make for a difficult up front experience.
- lukan 2y ago
  "that’s the only way I can convince the public to switch." It is not ready, to be a public browser.
- master-lincoln 2y ago
  Maybe Ladybird can be a good reason to convince the "public" to switch away from Windows in the near future

sph 2y ago

What do you expect from a company indirectly owned and controlled by Google money? I can't wait for Ladybird to get good, in a decade realistically, swimming against a massive current of Google pushing its unstandardised nonsense on Chrome, and web developers jumping on the bandwagon, making web standards more and more complex by the day so no one ever is able to catch up. You can add to the dead internet theory the fact that the Web is now maliciously impossible to recreate and access from scratch if you are unable to compete with the billions Google spend to maintain their hegemony. Heck, even Microsoft found it was more efficient to join Google rather than to try and direct what they laughably call "an open standard." There is more competition to build reusable space rockets than in web browsers. A sad day, and sadder days await us. Shame of Mozilla, and on the CTO trying to sell this feature as a good thing.

berkes 2y ago
They aren't owned nor controlled by Google. And certainly not directly. I presume you refer to the fact that most income of Mozilla comes from Google paying a fee to have their search be the default. While that is worrysome, it's not control nor ownership. Let alone direct control. At most it gives Google leverage.
- cdrini 2y ago
  The previous post said "indirectly" controls; maybe a misread?
newzisforsukas 2y ago
> I can't wait for Ladybird to get good I don't see that happening in a decade. What makes you so optimistic?

thinkingemote 2y ago

A user in another thread said that disabling this via config made their user agent also change. Can anyone confirm? Seems unrelated I imagine? https://news.ycombinator.com/item?id=40959723 https://news.ycombinator.com/item?id=40959723

JonChesterfield 2y ago

Firefox mobile also won't let me into about:config. So I guess that's the end. Opera? Other recommendations?

justinclift 2y ago
Which OS are you using?
- Ygg2 2y ago
  Firefox mobile is only on Android. The iOS version is a reskin, so it's not affected.
DaoVeles 2y ago
Elinks via Termux? /jk For those that don't know, Elinks is a text only terminal browser.
- brettermeier 2y ago
  Lol, nobody wants that. Recommend Mull or something else sensible. Edit: Whoopsy, oversaw your /jk
  - DaoVeles 2y ago
    All good! That said I do like the genuine recommendation. Will look at that.
- mrweasel 2y ago
  While the jokes is appreciated, I'm also half-serious in considering just using Links/Elinks or w3m and just use whatever is the default browser on my OS for those cases where I need to book ticket or do banking. I'm sadly falling out of love with the web. So much fun and enjoyment have left the web in the past 20 years and I don't enjoy or to some extend even benefit from the modern hellscape of modern commercial web.

justinclift 2y ago

As an alternative, if you're using macOS (or iOS) then Kagi's Orion Browser seems decent: https://kagi.com/orion/ https://kagi.com/orion/

ranguna 2y ago

https://librewolf.net/ https://librewolf.net/ And fallback to Firefox when things don't work. Which is usually on sketchy websites, websites that have heavy bot protection and fingerprinting or ones that use gpu APIs.

MrAlex94 2y ago
A few criticisms of LibreWolf: * There is no legal entity behind the project. Should anything ever happen with the project (it can happen, even if unlikely), there are no legal ramifications. * The binaries aren't signed. Yes, code signing is a bit of a racket, but there is some merit in it. * There is no auto-update mechanism. Might not seem like a big deal, but IMO it is, especially on Windows where you're recommended to rely on 3rd party client to update the browser for you. You've now added a middle man, and since the binaries are not signed... well there's no guarantee you aren't downloading a malicious binary.
- MiddleEndian 2y ago
  >There is no auto-update mechanism. Might not seem like a big deal, but IMO it is, especially on Windows where you're recommended to rely on 3rd party client to update the browser for you. You've now added a middle man, and since the binaries are not signed... well there's no guarantee you aren't downloading a malicious binary. To me, this seems like a plus. If you want users to update, provide them with something worth updating to. This tracking suddenly being enabled for a ton of users is the very result of automatic updates.
  - kees99 2y ago
    Also, for some software vendors, frequent/automatic upgrades are a great place to hide silent reconfiguration. Mozilla has been repeatedly resetting "Always check if Firefox is your default browser" option to "yes" with upgrades. I don't see why "private-attribution submission enabled" wouldn't be reset in future in the same way.
    - 2y ago

INTPenis 2y ago

I wish the article showed us how to disable PPA.[1] 1. https://support.mozilla.org/en-US/kb/privacy-preserving-attribution https://support.mozilla.org/en-US/kb/privacy-preserving-attr...

xyproto 2y ago

Will we see a comeback from IceWeasel?

whoisthemachine 2y ago
I recently became aware of LibreWolf (https://librewolf.net/installation/linux/ https://librewolf.net/installation/linux/), going to see how it works. So far I like that I can install it via AppImage!

st_goliath 2y ago

While the Wikimedia Foundation is often quoted as having cancer[1], I guess the Mozilla Foundation has Alzheimer's, constantly forgetting who they are and why they are here in the first place. [1] https://en.wikipedia.org/wiki/User:Guy_Macon/Wikipedia_has_Cancer https://en.wikipedia.org/wiki/User:Guy_Macon/Wikipedia_has_C...

jeltz 2y ago
And the scandals they have been involved in the past. Cliqz was another attempt by Mozilla to invest in privacy preserving technology (that time search, this time ads) where they did a stealth launch without user consent.

hulk_ 2y ago

Just installed Chrome again. I loved everything about the idea behind Mozilla but the browser is quite not useable these days. Really sad.

moontear 2y ago
How is your personal story related to the story? I don’t believe Chrome is better than Firefox on terms of ad tracking.
linuxandrew 2y ago
Out of the frying pan and into the fire. With regards to privacy and tracking Chrome/Chromium is so much worse than Firefox. Whether it be terrible defaults, exceptions which allow Google to see your system info, or an incognito mode which is a misnomer, Chrome just doesn't do privacy at all. I can sympathise about general usability concerns but they don't really relate to the OP. I personally run Ungoogled Chromium for anything that doesn't work in LibreWolf, which is fortunately not too much.

TimCTRL 2y ago

Do you guys like or trust Vivaldi?

mrweasel 2y ago
I've been looking at it and they are fortunately very open about how they are funded (search engines and bookmarks). Opera was my browser of choice, back in the days of Presto, so I trust the Vivaldi CEO/CTO who also ran Opera. My main annoyance with Vivaldi is that it's Chromium based, I really don't like the idea of a monoculture of rendering engines.
toofy 2y ago
vivaldi is not open source, they’re almost certainly more invasive than Mozilla.

silcoon 2y ago

> By offering sites a non-invasive alternative to cross-site tracking, we hope to achieve a significant reduction in this harmful practice across the web. The value of words is leaving the web.

qwertox 2y ago

Firefox should integrate a tracker-blocker which blocks all ads which rely on executing Javascript as well as profiling-related 3rd-party code snippets, but leaves ad images which are integrated into the page, served exclusively by the owner of the page, and are based on the content offered by the page. Like magazine ads. Everything else is just agreeing with the advertising industry on their idea that profile-building is fine. These advertisers nowadays think they have they are entitled to everything, and Firefox just helped them.

alex_duf 2y ago
By this logic wikipedia wouldn't be able to load any image
- qwertox 2y ago
  They could offer a deal to Toyota and tell them they're offering image-only ad space on all car-related pages. For example images with deals. Toyota would know from the referrer that the click came from Wikipedia. All the other images are hosted by Wikipedia themselves and are not ad-related, so I don't see where's the issue here.
  - alex_duf 2y ago
    I'm just saying that the domain that hosts the page and the domain that hosts the image are often not the same. Wikipedia hosts the articles, wikimedia hosts the images. If a browser wants to be strict about what it loads, most of the web would appear broken. Maybe google could have the weight to force such change, but no way could mozilla impose such a strict rule.
- deleted 2y ago
  [deleted]

albeva 2y ago

And there goes my trust in Firefox out the window... Safari seems to be the only decent, privacy-focused browser left on the market. Until the Ladybird arrives.

sumuyuda 2y ago
The fact that Apple killed any real third party extensions ended my use of Safari.
MrAlex94 2y ago
> Safari seems to be the only decent, privacy-focused browser left on the market. Safari has Private Click Measurement: https://webkit.org/blog/11529/introducing-private-click-measurement-pcm/ https://webkit.org/blog/11529/introducing-private-click-meas... And AFAICT, Mozilla's implementation is technically superior?
- Tarq0n 2y ago
  Safari also has attestation, as far as I know without user consent.
  - MrAlex94 2y ago
    Does MPC, which PPA uses, use attestation? I'm under the impression it doesn't (at least currently): https://github.com/patcg-individual-drafts/ipa/issues/22 https://github.com/patcg-individual-drafts/ipa/issues/22

stebalien 2y ago

This works by adding noise. Can't an attacker bypass it by boosting the signal? Assuming the attacker can create sybil advertisers/browsers, this should be totally doable: 1. Define some baseline set of M impressions with various ad identifiers and from various sybil advertisers. 2. For each target user, define some set of M marker impressions, also with various ad identifiers and from various and sybil advertisers. 3. Save all impressions (marker + baseline) on a bunch of sybil browsers to get above the reporting baseline with some probability. 4. If/when a target user visits a target website, request a conversion report for each ad/advertiser. You now have a baseline signal (from the baseline ads/advertisers) and a marker signal (from the marker ads/advertisers). If this is one of your target users, you'd expect their "marker" signal signal to be stronger than the baseline.

MrAlex94 2y ago
Technical docs are here: https://github.com/patcg-individual-drafts/ipa/blob/main/IPA-End-to-End.md https://github.com/patcg-individual-drafts/ipa/blob/main/IPA... Might be worth opening an issue if you believe there's merit to the attack?
- stebalien 2y ago
  I can try. But I'm pretty sure what they're trying to do is fundamentally impossible without some kind of sybil protection.
- stebalien 2y ago
  Those docs look out of date and appear to be designed for "app" ecosystems. The latest proposal from Mozilla is https://docs.google.com/document/d/1QMHkAQ4JiuJkNcyGjAkOikPKNXAzNbQKILqgvSNIAKw/edit#heading=h.5wiflfzeuvfm https://docs.google.com/document/d/1QMHkAQ4JiuJkNcyGjAkOikPK... And I'm now quite sure this system is insecure. Fundamentally, either: 1. There is some magical sybil protection: An attacker can only spend their own privacy budget without affecting the rest of the system. 2. The system can be saturated: An attacker can spend everyone's privacy budget. 3. The system is not private: An attacker can exceed the "safe" privacy budget by combining information from multiple sybils.

Piraty 2y ago

If 1% of regular Firefox users just donated the equivalent of 10USD per year to mozilla, they would not have the need to find ...eyebrow-raising... ways to earn money.

n_plus_1_acc 2y ago
On the other hand, people would be more inclined to donate money if they could trust Mozilla to value the privacy of their users, which is one of the biggest reasons people choose FF in the first place.
- deleted 2y ago
  [deleted]
lawn 2y ago
Nah, they'd just increase the already ridiculous salary to their CEO.
- justinclift 2y ago
  Mozilla CEO Salary was US$7 million in 2022. It's beyond taking the piss: https://en.wikipedia.org/wiki/Mitchell_Baker#Negative_salary-performance_correlation https://en.wikipedia.org/wiki/Mitchell_Baker#Negative_salary... No idea how much the new CEO is being paid. Probably just as bad.
bondarchuk 2y ago
Only if they'd also spin off the browser from all the political activism and NGO cash grabbing, and let people choose themselves to which of the two their money goes.
mardifoufs 2y ago
0% of donations go towards financing the Firefox project. Donations to Mozilla are explicitly not used for Firefox, they say so in the donation page.

slowhadoken 2y ago

An app that alerts you to invasive content in updates like this would be cool.

uyzstvqs 2y ago

What's dumb is that Firefox is not the freedom browser people think it is. Mozilla is a crappy organization. Firefox has extension signing, it's as restrictive as installing apps on iOS where only approved apps can be installed, without a setting to easily disable it. Mozilla can also remotely install extensions by default (opt out) called "experiments" or something. Their anti-tracking is purposefully weak because of their dealings with Google. Now this data collection for ads. They didn't enable DNS-over-HTTPS by default specifically in the UK. And Mozilla leadership is associated with radical left politics, just as an extra. Maybe check out Brave Browser, LibreWolf or Vivaldi.

kiviuq 2y ago
communists and anarchists have been dominating the ad industry for decades :p
3l3ktr4 2y ago
>And Mozilla leadership is associated with radical left politics, just as an extra. Do you have proof for this? I'd be curious. I also fail to see how is that related to the collecting data by default thing. Is that a leftist thing now?
- bawolff 2y ago
  Personally i'd rather judge people by the things they do (or fail to do), not who they are associated with.
- V__ 2y ago
  Maybe they mean this statement, however I don't see why their proposed changes are radical. [1] https://blog.mozilla.org/en/mozilla/we-need-more-than-deplatforming/ https://blog.mozilla.org/en/mozilla/we-need-more-than-deplat...
- mightyham 2y ago
  Whether you agree or disagree with what the Mozilla foundation does, it seems fairly matter of fact to say that they are pursuing liberal policies and that posts from the leadership, like the couple below, employ a good bit of leftist rhetoric. https://blog.mozilla.org/en/mozilla/first-steps-toward-lasting-change/ https://blog.mozilla.org/en/mozilla/first-steps-toward-lasti... https://blog.mozilla.org/en/mozilla/leadership/mozilla-racial-justice-commitments-one-year-in/ https://blog.mozilla.org/en/mozilla/leadership/mozilla-racia...

ManBeardPc 2y ago

Maybe I don't fully understand the technical implementation, but as far as I have read about the implementation this gives personal information to a third-party. This should automatically mean that Firefox would violate European GDPR laws, they clearly need to get consent from the user before collecting anything. Not just a moral issue, but can quickly become a legal one as well.

genezeta 2y ago

I've been wondering about this whole affair. The thing that got me wondering is this: Is this really interesting for advertisers? I mean, let's imagine this works as explained -whatever, let's imagine it does and with no downsides even-. Now as far as I can understand this aggregate information ends up producing something like "this particular ad placed here ends up producing this number of conversions". Is this really something an advertiser wants to know? Maybe to some extent, but to me it sounds a lot more like something an advertising platform would want to know. Which is why I'm not surprised by Meta's interest. To me this feels like a good tool to avoid paying small websites at all for just having ads. Impressions would be finally and completely discarded as something payable. Now for the ads on your site to earn you something at all you need conversions that you can now reliably track. For a site owner to be paid, they'd need to increase the CTR; they can't just "provide ad space", they have to work to earn clicks. So maybe -probably- I'm way off here. Maybe someone can correct me. But as I see this, this tool seems very specifically made for the big advertising platforms.

temporarely 2y ago

Enough of this waiting for virtuous entities to address legitimate concerns of the public. The "ad industry" is a cancer and we need legal protection against this "industry". The solution is political not technical and definitely can not be left to "the market". Haven't you had enough?

8jef 2y ago
Yes, that's why I've donated to the LadyBird project.
- ajdude 2y ago
  It's just weird that ladybird is picking ideological hills to die on, such as "no gender neutral pronouns"[1] [1] https://github.com/SerenityOS/serenity/pull/6814 https://github.com/SerenityOS/serenity/pull/6814
  - Workaccount2 2y ago
    You're not gonna die pissing off 0.1% of the population.
  - ZhongXina 2y ago
    It's an understandable reaction against a loud and aggressive (political) minority we've been seeing for the past four years. Thanks for the link, this finally pushed me to support the developer.
berkes 2y ago
How would that legal "protection" work in practice? What would it protect against? Who would it protect? What you say sounds reasonable. And I'm not trying to say "well, it's impossible because of some current status quo", because we could change that. What I'm trying to say is that we need this "industry" to work out the practicalities. Otherwise we are "protected" in a same way the GDPR protects us against 3rd part trackers (you don't need a cookie banner if you don't allow 3rd parties to track your users. Yet here we are...)

SonjaHinton 2y ago

[dead]

3l3ktr4 2y ago

I wonder why they claim they need this... Tor seems to be doing fine as an organization without collecting user data? Why maintaining Firefox is much more expensive? I guess the codebase for Firefox is much larger and in the end Tor is a fork of Firefox, right? So maybe they do need much more resources? Not to say I'm not disappointed with Mozilla once again.

berkes 2y ago
Tor is (was?) heavily subsidised by secret services in a.o. the US. > likewise, agencies within the U.S. government variously fund Tor (the U.S. State Department, the National Science Foundation, and – through the Broadcasting Board of Governors, which itself partially funded Tor until October 2012 https://en.wikipedia.org/wiki/Tor_%28network%29?wprov=sfla1 https://en.wikipedia.org/wiki/Tor_%28network%29?wprov=sfla1
- toofy 2y ago
  While it has had funding from some sources we don’t necessarily trust, it’s still entirely open source and the code has been combed through repeatedly. When it comes to privacy apps, I’d place significantly more trust in something like that than literally anything closed source or unscrutinized to that degree.
  - berkes 2y ago
    Sorry, I wasn't trying to imply that we should not trust it. I was merely implying that there's a major difference between the model behind TOR and that of Firefox. And also similarities: if TOR is funded by entitities we don't trust and it turns out to work fine, then Firefox, being "funded" by Google should not have to be a severe problem either.

8jef 2y ago

Please give to LadyBird project and be done with it.

anordal 2y ago

I see this as an attempt at a lesser evil, and I would support that (see my EME DRM comment), but I have one concern: Does this new "privacy preserving attribution" feature respect multi-account containers? Or is it somehow not considered necessary, because it's meant to be less invasive than the tracking cookies it's supposed to replace? Call me skeptical for now. I'm a happy user of multi-account containers, which lets me separate my cookie identities in Firefox. Before, I had to use different browsers for work and private, and yes, it solves this problem, but the best part is that I don't have to worry about tracking cookies, because they aren't tied to my personal accounts: In my experience, I can to a great extent escape the echo chamber I'm in, and the ads I see in it, by just deleting the cookies of my sacrificial default container. Other than that, considering the status quo – that the web is already an unfriendly GDPR nightmare, I'm positive to the initiative. And because of the power of the default, I can understand that the feature wouldn't likely take off if it was opt-in, so I won't criticize Mozilla for that move either.

eleveriven 2y ago

I think Mozilla Firefox has long been positioned as a browser focused on user privacy and data protection... This decision is indeed a significant breach of trust

southernplaces7 2y ago

One of the few things about Firefox that made me attempt to tolerate its repeatedly slow, shitty performance and tendency to slow my whole device down, was the privacy angle. With that gone, why bother? Might as well use Chrome. At least it's light and fairly quick.

rc_mob 2y ago
Eh? Chrome is famously bulky and a memory hog
- lolinder 2y ago
  There are a lot of people who still think of Firefox from 5 years ago. Whatever else you can say about Mozilla (and I have a lot to say about Mozilla) they have actually really improved performance to where I'm not convinced it's any worse than Chrome. Browsers are just doing more than they used to.
- acdha 2y ago
  Firefox’s reputation got hit a decade or so ago by performance problems in popular extensions like AdBlock Plus, and it was common to see people mistake switching to a new browser as the reason for the speed up because the initial performance would be notably better before they loaded the new one up with extensions, too.
- southernplaces7 2y ago
  Sorry folks but though i'm just speaking from personal experience, it's what I noticed time and time again. I've given Firefox multiple chances as my default browser over several years right up until maybe a year ago and the same problem presented itself across different laptops and FF versions (many after in those cases someone told me that FF was FINALLY fixed, oops). Were these laptops heavy duty models with serious CPU, GPU, RAM and etc power? Nope, but they shouldn't have to be for just running a browser. Chrome on the other hand (and believe me I despise Google in so many different ways) has consistently been okay. Not great, but okay, and certainly better than Firefox. This while having the same browsing, tab and extension habits in both browsers. With comments like my original above I've always seen a bunch of people come out with all sorts of caveats defending or justifying FF, but personal experience has consistently shown me differently.

deleted 2y ago

[deleted]

pfzero 2y ago

I wish there was a serious conversation on how a browser can be productivized and make actual profits. I think that model has the best chances of working out over the long-term in guarding user's privacy - at least for those users willing to pay for it. Most (all?) companies which developed a browser have lax policies on data privacy. At most those are inline with major directives like GDPR. However, it's not in their best interest to protect / not leverage user data. So the real discussion should've been about the set of features that would attract a sufficiently large user base who would pay ~10$ per month subscription in order to make the model sustainable on the long-term.

alabhyajindal 2y ago

Greeted by a cookie banner in a different language when I open. I swear cookie banners are the biggest problem facing the internet. We need to do something about this!

lexicality 2y ago
honestly it's got to the point that any time I get a cookie banner more complicated than yes/no I immediately revoke JS privileges for that website. At least ublock origin makes that easy, but it's still ridiculous. On the bright side, French courts have ruled that this kind of cookie popup is illegal under the GDPR so maybe they'll slowly be destroyed
belorn 2y ago
EU created a task force in 2021 to address the cookie banner, which gave a report last year that basically said that all current form of cookie banners are practically not legal in terms of giving consent. As with this kind of regulations, we now have to wait for the law suits to target a few select large companies, then the courts to reconfirm that the regulations says what it says, and then appeals, and then finally the large companies will pay a large fine and then comply, followed then by the industry in large. Delay, delay and then delay some more has been the response from the data collection industry for the past 10 years. Same for right to repair regulations and smartphones.

matheusmoreira 2y ago

Reminder: Mozilla has billions of dollars in the bank. They don't need to do this. They want to.

seanhunter 2y ago

If you want to disable this, instructions are given here[1] but 1) Hamburger menu -> Settings -> Privacy & Security 2) scroll down to the new section entitled "Web Site Advertising Preferences". 3) Make sure the box marked "Allow web sites to perform privacy-preserving ad measurement" is not checked. [1] https://support.mozilla.org/en-US/kb/privacy-preserving-attribution https://support.mozilla.org/en-US/kb/privacy-preserving-attr...

kevincox 2y ago
And of course this setting doesn't sync to new devices by default. So you need to remember to opt-out on every device. The underlying pref is dom.private-attribution.submission.enabled. I'm going to force this off in my policies.
- blueflow 2y ago
  How do you sync these settings across devices? I need such a thing, too.
  - kevincox 2y ago
    If you want to use Firefox sync IIUC you can define a new pref services.sync.prefs.sync.dom.private-attribution.submission.enabled. However this has always been flakey in the past for me. (I think maybe the sync prefs themselves don't sync?) Now I install an organizational policy that sets the prefs. I use NixOS to apply this and it looks like this: environment.systemPackages = [(pkgs.firefox.override { extraPrefs = '' lockPref("dom.private-attribution.submission.enabled", false); '' })]; I think this is just creating a `prefs.js` file under the hood, so you should be able to replicate on other systems that you manage. Edit: This is creating a lib/firefox/mozilla.cfg. IDK how exactly this applies to other distros.
  - ringer 2y ago
    Basically, you need to create a `user.js` file in the root folder of your profile, you can find/open the profile folder using about:profiles or about:support (default path is `~/.mozilla/firefox/${profile-name}/user.js`). You can sync it however you like, e.g. upload it to your dotfiles repo and symlink with stow, etc. The syntax is: user_pref("dom.private-attribution.submission.enabled", false); // Disable Privacy-Preserving Attribution You can find a lot of examples and "documentation" on https://github.com/arkenfox/user.js https://github.com/arkenfox/user.js

tiffanyh 2y ago

Firefox needs to update their Mission. Because it's very confusing now.

account42 2y ago

I always think it's ironic when these things are reported on by websites that force you into accepting their ad tracking which really should be illegal under the GDPR.

sotix 2y ago

Can companies not see how their ads are performing by looking at their income statements? An ad campaign costs x dollars. Widget sales increase by y dollars. Companies were able to run this method for a long time. I think ads have gone way too far. It’s shocking we’ve gotten to the point of this discussion on data collection to fuel ads.

tyree731 2y ago
In the aggregate, yes, but in the specific, no. Companies nowadays want to see which advertising channels and specific ads, over a given period of time, are performing, so as to decide how to better invest their ad spend

EADDRINUSE 2y ago

`sudo echo "127.0.0.1 push.services.mozilla.com incoming.telemetry.mozilla.org" >> /etc/hosts`

irq-1 2y ago

> Our hope is that if we develop a good attribution solution, it will offer a real alternative to more objectionable practices like tracking. There is no negotiating with the advertising industry. No system will stop them from acting unethically to gain an edge. -- My idea for such a system: random GUID added to each ad. Browser plugin collects GUIDs. Client protects itself with random GUIDs removed and new random GUIDs added. Client sends GUIDs to a Collector they choose. Collectors run client GUIDs against Advertisers lists (bloom filters). Advertisers pay Collectors, and Collectors give to orgs. Edit: replace GUIDs with 6 random bytes, so the existence of an id is not proof of it's being viewed. it needs to be plausible that the client added an id randomly, and that's not the case with a GUID.

deleted 2y ago
[deleted]

Archelaos 2y ago

Years ago I had a "Download Firefox" button on my Web-site. I have removed it because of similar incidents in the past. And I stopped recommending Firefox to friends and relatives, because I can no longer do it wholeheartedly. I am not even sure myself, whether it makes a big difference which browser you use nowadays. More out of tradition I am still using Firefox myself, but I know other technologically competent people who shifted away from it. I can only assume that this was for similar reasons: It is felt that Firefox gives no less cause for annoyance than other browsers. When Firefox gradually loses more and more dedicated supporters who become indifferent, I see a rather bleak future for it.

ChrisArchitect 2y ago

[dupe] More discussion among others: https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40966312 https://news.ycombinator.com/item?id=40966312 https://news.ycombinator.com/item?id=40954535 https://news.ycombinator.com/item?id=40954535

Dwedit 2y ago

How does using uBlock Origin affect this?

deleted 2y ago

[deleted]

peanut_worm 2y ago

I don’t think Mozilla is trustworthy anymore.

Timber-6539 2y ago

At this point Firefox is just a brand for Mozilla to do with as they please. All the talk about a non-Chrome browser with defacto privacy features was just bait to get loyal followers and later on down the road sell them something. Seems ads is just their newest offering.

AlecSchueler 2y ago

Anyone else feel done with the web? I can't remember the last time I enjoyed a browsing experience. I think this new default might be the end for me.

jandrusk 2y ago

Not a good strategy for keeping an already very small user base.

ChrisArchitect 2y ago

[dupe] Since this is days old news with lots of discussion (https://news.ycombinator.com/item?id=40952330 https://news.ycombinator.com/item?id=40952330 and more) the more recent development is Firefox CTO posting thoughts: https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_about_private_attribution_in_firefox/ https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_abo... (https://news.ycombinator.com/item?id=40971247 https://news.ycombinator.com/item?id=40971247)

Yawrehto 2y ago

I kind of like how this has dominated the 'active' section ever since it started and it's, barely a news story everywhere else. Honestly I don't have much to add to the conversation. Mozilla made a bad move, Firefox's big thing was privacy and not being Chromium and it's lost the first thing.

eburuschkin 2y ago

Apple enabled the same thing in Safari. Settings -> Advanced -> Allow Privacy-Preserving Measurement of Ad Effectiveness

yamumsahoe 2y ago

how do i donate to the mozilla foundation to support this amazing development?

SonjaHinton 2y ago

[dead]

r3db34rd 2y ago

[dead]