3 ms·

This pretty much confirms that this is what everyone thought the change was about. So we get clarity, but no actual change in course from Mozilla. Good. We now

by hysan 2y ago

This pretty much confirms that this is what everyone thought the change was about. So we get clarity, but no actual change in course from Mozilla. Good. We now know very clearly where Mozilla and Firefox stand on privacy.

KennyBlanken 2y ago
Yup. This is almost a year exactly after they announced a "pivot" to "privacy." At least the most useless, overpaid person in SV is finally gone and no longer collecting her $7M salary. Not like money has ever been a problem at Mozilla - they're sitting on over $1.5B in assets, $500M or so in cash alone. That's despite a plunging market share...
wesapien 2y ago
If one opted out of all the possible data collection and privacy related options, are they still able to collect your data? If yes, how does it work? Is this called client-side scanning?
- st3fan 2y ago
  Yes. Any software you installed including your operating system can turn evil and copy anything off your drive. This doomsday scenario thinking really doesn’t help the discussion.
- userbinator 2y ago
  Companies have been long concerned about exfiltration of data and ran MITM proxies to stop it, which ironically has been the target of propaganda about "privacy" by the browser makers. Every home network needs a MITM proxy too.
  - 1vuio0pswjnm7 2y ago
    "Every home network needs a MITM proxy too." I have been running one for long time now. I depend on it so much that I cannot imagine using the internet without it. It is much smaller and easier to compile than a graphical browser. Others will have different opinions but I personally remain skeptical that TLS provides internet users with more value than it provides so-called "tech" companies that profit from data collection, surveillance and online advertising services, and the CDNs that collaborate with them. While it can be used to protect a computer owner's sensitive data from eavesdroppers as it transits across the open internet, e.g., during "e-commerce", in practice TLS is used to conceal data exfiltration from the computer owner for commercial purposes by so-called "tech" companies. Not to mention the issue of "Certificate Authorities". IMO, this is analogous to the situation with Javascript. It has the potential to provide value to www users, e.g., as a language computer owners can use to extend and control a graphical browser,^1 but in practice it provides the most value to so-called tech "companies" that are using it to control _someone else's_ browser to allow unauthorised and/or concealed data collection and surveillance. 1. https://raw.githubusercontent.com/bambax/hntitles/refs/heads/master/hntitles.user.js https://raw.githubusercontent.com/bambax/hntitles/refs/heads...
    - Wowfunhappy 2y ago
      > I personally remain skeptical that TLS provides internet users with more value than it provides so-called "tech" companies that profit from data collection, surveillance and online advertising services, and the CDNs that collaborate with them. While it can be used to protect a computer owners' data from eavesdroppers as it transits across the open internet, e.g., during "e-commerce", in practice TLS is used to conceal data exfiltration from the computer owner for commercial purposes by so-called "tech" companies. Not to meniton the issue of "Certificate Authorities". I agree completely. Google pushed HTTPS because it ensures that they are the only ones who can spy on users.
    - zzo38computer 2y ago
      > Others will have different opinions but I personally remain skeptical that TLS provides internet users with more value than it provides so-called "tech" companies ... I think TLS can be helpful (for both sides of a communication), but the browser should not require it, and most servers also should not require it (but should allow it, if you deliberately choose to connect with TLS). HSTS is especially bad (I managed to disable it on my computer by using a hex editor so that the browser would no longer recognize the Strict-Transport-Security header). Certificates can be helpful if you actually know which ones you specifically trust for a specific purpose (rather than being automatic), and if they will tell you information about a business (although as far as I know, Let's Encrypt does not do this and only verifies the domain name). However, sometimes if a certificate is changed or superseded, due to expiry, or change in ownership, etc, and it does not prevent the server operator from sending you malware; it only prevents spies from doing so. If a domain name is sold to someone else, that does not prevent cookies and other stuff from being sent, or from them adding malware, etc; however, it would be possible for end users to know the certificate to trust and avoid this problem (if a browser can be programmed to do this). Client certificates could be helpful for authentication too, but this is rare with HTTPS (but it is commonly used with Gemini protocol). But, it does prevent someone who takes over the domain name from being able to use your information to log in, since a private key is required in order to use a client certificate. Furthermore, the browser really should allow unencrypted proxies for encrypted connections, in order that if you deliberately want MITM then you do not need to encrypt and decrypt the data multiple times. > IMO, this is analogous to the situation with Javascript. It has the potential to provide value to www users, e.g., as a language computer owners can use to extend and control a graphical browser ... Yes, as well as other programming languages (if a browser supports it, which most don't). (I disable JavaScripts on my computer, except for the scripts that I wrote by myself. I did write scripts to replace GitHub's UI (in much less lines of code than GitHub uses themself), and other things.)
  - wtallis 2y ago
    Don't forget the push for browsers to ignore your DHCP-provided DNS server and instead get their DNS from a server outside your control over an encrypted tunnel. It's an obvious attack on stuff like PiHole, with little to no real upside for users.
    - WhyNotHugo 2y ago
      I avoid DHCP-provided DNS and use a local copy of unbound which does DNSSEC validation. A home I control the DHCP, but everywhere else, you can get any sort of custom crap.
    - 1vuio0pswjnm7 2y ago
      If this is in reference to DoH then I found an upside. Generally, DoH servers allow HTTP/1.1 pipelining by default. This allows one to fetch DNS data in bulk over a single TCP connection. The DNS specification RFC 1035 suggests that computer users would be able to send multiple queries in a single _packet_: QDCOUNT is any unsigned 16-bit integer. The implementation of servers that can handle QDCOUNT greater than 1 has not happened. But at least with DoH I can send multiple queries over a single TCP connnection. Once retrieved, I load the DNS data into the memmory of the "MITM proxy". This eliminates the need for DNS queries to be immediately proceeding associated HTTP requests for web pages, etc., or within some DNS cache duration period. When I use other sources of DNS data^1, I eliminate the need for remote DNS queries altogether. 1. For example, I extract DNS data from Common Crawl data. Indeed, it does not seem like DoH was implemented to improve life for computer users but, at least for me, it can be useful. It can also be useful for example to computer users who use remote DNS servers where their ISP is hijacking port 53.
    - 1vuio0pswjnm7 2y ago
      One point to support this is that any "privacy" offered by DoH is generally defeated by the TLS SNI extension exposing cleartext domain names on the wire. (Exception being use of ECH-enabled browsers^1 to access Cloudflare-hosted websites that support ECH. But even then, there is no privacy from Cloudflare. HN commenters have historically acknowledged Cloudflare is itself a "MITM".) 1. Test: https://defo.ie https://defo.ie
  - wesapien 2y ago
    Silly me, I just realized its mostly a concern for users using their "Sync" service. *Even a host file from filterlists.com won't block that unless you stop using their service.* A host file will stop you from using the service that's a better way to word this. Haha. Don't use their services.

by hysan 2y ago

KennyBlanken 2y ago

Yup. This is almost a year exactly after they announced a "pivot" to "privacy." At least the most useless, overpaid person in SV is finally gone and no longer collecting her $7M salary. Not like money has ever been a problem at Mozilla - they're sitting on over $1.5B in assets, $500M or so in cash alone. That's despite a plunging market share...

wesapien 2y ago

If one opted out of all the possible data collection and privacy related options, are they still able to collect your data? If yes, how does it work? Is this called client-side scanning?

st3fan 2y ago
Yes. Any software you installed including your operating system can turn evil and copy anything off your drive. This doomsday scenario thinking really doesn’t help the discussion.
userbinator 2y ago
Companies have been long concerned about exfiltration of data and ran MITM proxies to stop it, which ironically has been the target of propaganda about "privacy" by the browser makers. Every home network needs a MITM proxy too.
- 1vuio0pswjnm7 2y ago
  "Every home network needs a MITM proxy too." I have been running one for long time now. I depend on it so much that I cannot imagine using the internet without it. It is much smaller and easier to compile than a graphical browser. Others will have different opinions but I personally remain skeptical that TLS provides internet users with more value than it provides so-called "tech" companies that profit from data collection, surveillance and online advertising services, and the CDNs that collaborate with them. While it can be used to protect a computer owner's sensitive data from eavesdroppers as it transits across the open internet, e.g., during "e-commerce", in practice TLS is used to conceal data exfiltration from the computer owner for commercial purposes by so-called "tech" companies. Not to mention the issue of "Certificate Authorities". IMO, this is analogous to the situation with Javascript. It has the potential to provide value to www users, e.g., as a language computer owners can use to extend and control a graphical browser,^1 but in practice it provides the most value to so-called tech "companies" that are using it to control _someone else's_ browser to allow unauthorised and/or concealed data collection and surveillance. 1. https://raw.githubusercontent.com/bambax/hntitles/refs/heads/master/hntitles.user.js https://raw.githubusercontent.com/bambax/hntitles/refs/heads...
  - Wowfunhappy 2y ago
    > I personally remain skeptical that TLS provides internet users with more value than it provides so-called "tech" companies that profit from data collection, surveillance and online advertising services, and the CDNs that collaborate with them. While it can be used to protect a computer owners' data from eavesdroppers as it transits across the open internet, e.g., during "e-commerce", in practice TLS is used to conceal data exfiltration from the computer owner for commercial purposes by so-called "tech" companies. Not to meniton the issue of "Certificate Authorities". I agree completely. Google pushed HTTPS because it ensures that they are the only ones who can spy on users.
  - zzo38computer 2y ago
    > Others will have different opinions but I personally remain skeptical that TLS provides internet users with more value than it provides so-called "tech" companies ... I think TLS can be helpful (for both sides of a communication), but the browser should not require it, and most servers also should not require it (but should allow it, if you deliberately choose to connect with TLS). HSTS is especially bad (I managed to disable it on my computer by using a hex editor so that the browser would no longer recognize the Strict-Transport-Security header). Certificates can be helpful if you actually know which ones you specifically trust for a specific purpose (rather than being automatic), and if they will tell you information about a business (although as far as I know, Let's Encrypt does not do this and only verifies the domain name). However, sometimes if a certificate is changed or superseded, due to expiry, or change in ownership, etc, and it does not prevent the server operator from sending you malware; it only prevents spies from doing so. If a domain name is sold to someone else, that does not prevent cookies and other stuff from being sent, or from them adding malware, etc; however, it would be possible for end users to know the certificate to trust and avoid this problem (if a browser can be programmed to do this). Client certificates could be helpful for authentication too, but this is rare with HTTPS (but it is commonly used with Gemini protocol). But, it does prevent someone who takes over the domain name from being able to use your information to log in, since a private key is required in order to use a client certificate. Furthermore, the browser really should allow unencrypted proxies for encrypted connections, in order that if you deliberately want MITM then you do not need to encrypt and decrypt the data multiple times. > IMO, this is analogous to the situation with Javascript. It has the potential to provide value to www users, e.g., as a language computer owners can use to extend and control a graphical browser ... Yes, as well as other programming languages (if a browser supports it, which most don't). (I disable JavaScripts on my computer, except for the scripts that I wrote by myself. I did write scripts to replace GitHub's UI (in much less lines of code than GitHub uses themself), and other things.)
- wtallis 2y ago
  Don't forget the push for browsers to ignore your DHCP-provided DNS server and instead get their DNS from a server outside your control over an encrypted tunnel. It's an obvious attack on stuff like PiHole, with little to no real upside for users.
  - WhyNotHugo 2y ago
    I avoid DHCP-provided DNS and use a local copy of unbound which does DNSSEC validation. A home I control the DHCP, but everywhere else, you can get any sort of custom crap.
  - 1vuio0pswjnm7 2y ago
    If this is in reference to DoH then I found an upside. Generally, DoH servers allow HTTP/1.1 pipelining by default. This allows one to fetch DNS data in bulk over a single TCP connection. The DNS specification RFC 1035 suggests that computer users would be able to send multiple queries in a single _packet_: QDCOUNT is any unsigned 16-bit integer. The implementation of servers that can handle QDCOUNT greater than 1 has not happened. But at least with DoH I can send multiple queries over a single TCP connnection. Once retrieved, I load the DNS data into the memmory of the "MITM proxy". This eliminates the need for DNS queries to be immediately proceeding associated HTTP requests for web pages, etc., or within some DNS cache duration period. When I use other sources of DNS data^1, I eliminate the need for remote DNS queries altogether. 1. For example, I extract DNS data from Common Crawl data. Indeed, it does not seem like DoH was implemented to improve life for computer users but, at least for me, it can be useful. It can also be useful for example to computer users who use remote DNS servers where their ISP is hijacking port 53.
  - 1vuio0pswjnm7 2y ago
    One point to support this is that any "privacy" offered by DoH is generally defeated by the TLS SNI extension exposing cleartext domain names on the wire. (Exception being use of ECH-enabled browsers^1 to access Cloudflare-hosted websites that support ECH. But even then, there is no privacy from Cloudflare. HN commenters have historically acknowledged Cloudflare is itself a "MITM".) 1. Test: https://defo.ie https://defo.ie
- wesapien 2y ago
  Silly me, I just realized its mostly a concern for users using their "Sync" service. *Even a host file from filterlists.com won't block that unless you stop using their service.* A host file will stop you from using the service that's a better way to word this. Haha. Don't use their services.