10 ms·

Mozilla Stumbler 1.0

208 points by crankycoder1975 12y ago

crankycoder1975 12y ago
Hi all! We cut a 1.0 release of the Mozilla Stumbler finally. Have at it. File the bugs. Complain about battery life. Help us make this thing not suck and build out a proper open location service.
- yzzxy 12y ago
  Any plans to gamify/add user incentives for "Stumbling?"
  - ThePinion 12y ago
    This would be an interesting addition. I realized that Google is showing off Ingress as a game, but most technical users know it's about data-mining for maps and other location based products. Mozilla is openly showing this off as something that is about gathering data.
    - cpeterso 12y ago
      We have leaderboards showing the top stumblers overall and for the last seven days. We have lots of gamification ideas inspired by Ingress or the Nintendo DS game "Treasure World", but nothing in the works yet. https://location.services.mozilla.com/leaders https://location.services.mozilla.com/leaders https://location.services.mozilla.com/leaders/weekly https://location.services.mozilla.com/leaders/weekly https://en.wikipedia.org/wiki/Treasure_World https://en.wikipedia.org/wiki/Treasure_World
- hackuser 12y ago
  Congratulations; I hope this gives us a safe, effective, open location service. The privacy policy[1] could be clarified for less technical readers, and even for others. I infer that collected data is anonymous because you write, 1) We receive publicly observable data about WiFi access points and cell towers around you, your estimated latitude and longitude, and the date -- Not associated with anything else, that may be anonymous data -- though you could guess my home network or home location by the most common/strongest wifi signals. If you track data by submitter, you also would have a good idea of their travels. 2) we may receive certain temporary data such as your IP address. This data is deleted after being used as follows ... -- You seem to be implying that you do receive non-anonymous data, and delete it after innocuous uses. 3) You can send us data anonymously or under a nickname -- Which implies anonymity is possible. If what I infer is correct, why not restate it directly and unequivocally with something like the following: Unless you choose otherwise, the data you send will be anonymous and not associated with you in any way. We will not record who you are or what phone sent the data. We do receive some non-anonymous data, but we delete it within X hours/days after using it as follows ... And add more detail after that. [1] https://location.services.mozilla.com/privacy https://location.services.mozilla.com/privacy EDIT: Clarify a bit, and a correction to #1
  - cpeterso 12y ago
    Good questions! The stumbler reports Wi-Fi and cell tower locations and an optional nickname. The location data is stored anonymously. The nickname and just the number of reported networks is stored separately, solely for display on the leaderboard [1] or other gamification in the future. The IP addresses are just a fact of life of web server logging. They are not stored in the location or leaderboard databases. [1] https://location.services.mozilla.com/leaders https://location.services.mozilla.com/leaders
    - hackuser 12y ago
      > Good questions! Thanks! My post's intention was to suggest that Mozilla revise the privacy policy to clarify it for everyone. What are your thoughts?
  - justcommenting 12y ago
    "fact of life of web server logging" = screw you, we're not even going to consider deleting our logs even as we talk a good line about how much we respect your privacy edit after downvote: also, mozilla engineering PMs will intimate on hackernews that it won't internally correlate and potentially sell any of the location and other information it most obviously could correlate about people, even though it has already announced its intention to advertise.
    - sp332 12y ago
      "2) we may receive certain temporary data such as your IP address. This data is deleted after being used as follows". So yes, they do say they delete it. Also, Mozilla has a better track record with respecting user privacy than anyone else in this space. (And where is their intention to advertise?)
      - justcommenting 12y ago
        i agree that Mozilla has a better track record than most large tech companies in most areas, but that also sets a pretty low bar. i'm more of the opinion that if Mozilla really were as committed to user privacy as they claim to be, they might not respond so flippantly to questions about server logs. If it wanted to, Mozilla could even stop logging "certain temporary data such as your IP address." regarding Mozilla's intention to advertise: http://www.zdnet.com/mozilla-clarifies-defends-firefox-ad-position-7000026335/ http://www.zdnet.com/mozilla-clarifies-defends-firefox-ad-po...
- cpeterso 12y ago
  btw, the Mozilla location database is currently used to power geolocation on the well-publicized Firefox OS "$25 smartphone"! That device does not have GPS hardware so all geolocation requires rely on Mozilla's location service and GeoIP.
- therealunreal 12y ago
  I used to use it a lot a few months back "mapping" my town and I had noticed that it would go at full strength even when I was staying in the same place for hours. Would it be possible to gradually slow down the collections when it detects that the user isn't moving?
  - zz1 12y ago
    There used to be a mode to geo-fence data collection, i.e. harvest only outside of a certain area, but I don't see it anymore.
    - crankycoder1975 12y ago
      geo-fencing was extremely rarely used. I think we had single digit numbers of people who enabled the feature and understood what it meant. We decided to cut out geofencing because it was confusing to most people and reducing the number of knobs and dials on a program is usually a good thing. We've got a bug filed to hook the accelerometers though: https://github.com/mozilla/MozStumbler/issues/1107 https://github.com/mozilla/MozStumbler/issues/1107
- mike-cardwell 12y ago
  Google provides an opt-out. They will ignore your AP if you append "_nomap" to the end of your SSID. Does Stumbler also support this? If not, why not? Ref: https://support.google.com/maps/answer/1725632?hl=en https://support.google.com/maps/answer/1725632?hl=en edit: Found the answer to my own question. Yes, they do support "nomap": https://github.com/mozilla/MozStumbler/issues/149 https://github.com/mozilla/MozStumbler/issues/149
  - paulojreis 12y ago
    Is this really a thing? WTF? I feel very ashamed, as someone who works in IT, everytime this happens. I mean, people can opt-out, of course - but, in order to do that, they need to know what an SSID is, and how to change it. What about people who don't? Will we just assume that they don't care or that their opinion doesn't matter?
    - zz1 12y ago
      I guess you have a better suggestion, and am curious to hear about it.
      - walterbell 12y ago
        An option during router setup when SSID is named? An organized promotion of this approach, e.g. list of routers that make it simple, list of services that honor it. A cool name other than "Do Not Track".
        zz1 12y ago
        That would require an action on the router-side, not on the mapping one. I think it could be a good option, but this doesn't apply for this case. Also, what if I agree to put my SSID into an open database but not in a locked one? Apple's and Google's location databases do not compare, for me, to Mozilla's one: I am more than glad to be in the latter, but not to be in the two formers.
      - justcommenting 12y ago
- raesene4 12y ago
  Cool stuff, always interesting to see a new entrant to the location services field, especially an open one. One question though. Will ordinary users be able to directly query the database via the API? i.e. if you want to geolocate a set of Access points and you have their MAC addresses will this service provide a direct supported API for retrieving their location? The documentation on the API page implies that this isn't really a supported application? Specifically "If you are developing a native application or library for a desktop operating system or Android, you can in principle use this service via its HTTPS API. Please refer to the development documentation for the details. On most other operating systems, you cannot access the required cell and WiFi network information required to call the service API. " and "At this stage the service is open to anyone, who wants to contribute back to the service and applications supporting the Mozilla mission. " seem a bit vague.
- towelguy 12y ago
  I see there is a leaderboard, so users have a nick, but can we contribute anonymously without signing up? Also, why do you need access to my photos?
  - cpeterso 12y ago
    Yes, anonymous is the default mode. :) The nickname is optional and only used to record a leaderboard "points". The nickname is not tied to any reported Wi-Fi or location data. Mozilla Stumbler does not need to access your photos; it just needs to read/write to your sdcard (to cache map tile graphics and export KML data). "Access your photots" is Google's unfortunate explanation of accessing the sdcard.
chdir 12y ago
Could someone explain the privacy implications of mapping Wifi networks to GPS co-ordinates. Is it an opt-out thing?
- hackuser 12y ago
  See my post below for some answers; I was writing as you posted yours ...
  - chdir 12y ago
    Thanks. As a follow-up, there are existing services that already have this database. So why build another one? Is it because the existing ones aren't open source?
    - cpeterso 12y ago
      There are a number of other location databases, such as OpenCellID and WiGLE. There are issues around incompatible data licenses for some location databases. Mozilla and OpenCellID have worked together to exchange data going forward. WiGLE's Wi-Fi and cell tower databases is only available for purchase with a commercial license, even though much of the data is collected by volunteer contributors. The combined Mozilla + OpenCellID cell tower location database is public domain and published hourly here: https://location.services.mozilla.com/downloads https://location.services.mozilla.com/downloads Mozilla's Wi-Fi location database is not currently published until we can solve the privacy concerns.
- cpeterso 12y ago
  A stumbler user's identity or location could be revealed by tracing routes from published GPS data or maps. In areas without much stumbler data coverage, you can see clear routes along highways and some residential streets. Owners of Wi-Fi access points, including mobile phones with sharing Wi-Fi, may not want their unique BSSID/MAC address and location published. This is not exactly comparable to the Google Wi-Fi case in Germany. In addition to recording BSSID/MAC addresses, Google was (inadvertently?) logging Wi-Fi payload data that included cleartext user data. btw, here's a zoomable map of the Mozilla Location Service's data coverage. Please help fill in the blanks! :) https://location.services.mozilla.com/map https://location.services.mozilla.com/map
thristian 12y ago
No Firefox OS port?
- Clochix 12y ago
  I made a Firefox OS port: https://github.com/clochix/FxStumbler https://github.com/clochix/FxStumbler But it was my first Firefox OS app, the code is awful and it would need a complete rewrite. Nevertheless, if you have a FxOS device, don't hesitate to try this port and give me some feedback.
ChrisGranger 12y ago
Will this work with WiFi-only tablets? I'd like to contribute but my Kobo Arc device is marked incompatible. I saw in the screenshot on Google Play that there is a WiFi-only report symbol.
- icebraining 12y ago
  It works on my WiFi-only Nexus 7.
- zz1 12y ago
  I have a LTE Nexus 7, with no SIM, so it is basically a WiFi only, and yes, it works. I couldn't install it from F-Droid and I had to use an apk from github, but it worked like a charm and it auto-updates.
- crankycoder1975 12y ago
  YES. We caught that bug just before release. :) https://github.com/mozilla/MozStumbler/issues/1137 https://github.com/mozilla/MozStumbler/issues/1137
tonylemesmer 12y ago
As an Android user, is it possible to modify my phone to use this service instead of Google's? Is it possible to upload the database directly to a phone or replace an APK to achieve this?
- ganomi 12y ago
  The NOGAPPS project lists Mozilla Location Service support as an upcoming feature (http://forum.xda-developers.com/showthread.php?t=1715375 http://forum.xda-developers.com/showthread.php?t=1715375).
  - tonylemesmer 12y ago
    Great! And although that post was made June 2012 I note it has been maintained and has recent updates.
    - hannosch 12y ago
      Hanno from Mozilla here. Marvin reached out to us about a month back and we have been slow to respond. He just got an email back a week ago. So I think this is still going to happen, but no concrete timeline yet.
- cpeterso 12y ago
  You can test the Mozilla Location Service with Firefox on your desktop by changing your "geo.wifi.uri" about:config pref to: https://location.services.mozilla.com/v1/geolocate?key=test Then try using a geolocation service like Google Maps or http://html5demos.com/geo http://html5demos.com/geo . If it can't find your location, check Mozilla's zoomable coverage map to see if your neighborhood is covered: https://location.services.mozilla.com/map https://location.services.mozilla.com/map . If not, please consider installing Mozilla Stumbler to help map it. :)
lgierth 12y ago
Will 1.0 be available on the F-Droid store, like earlier versions?
- zz1 12y ago
  You can already auto-update from within MozStumbler itself.
  - privong 12y ago
    Apparently not from the current latest (0.30.0) version on f-droid. I just went through the MozStumbler menus and did not see anything about (auto-)updating.
- pserwylo 12y ago
  I believe so. crankycoder1975 was asking for some pointers on #fdroid irc a few hours back to help build 1.0 for F-Droid. Hopefully any issues will get ironed out. While I appreciate my siblings comment about the app auto-updating - I'd rather have apps managed by a central area (F-Droid on Android, package managers on desktop Linux).
- crankycoder1975 12y ago
  I'm going to try getting an F-Droid build out today, but we've got some build issues with the fdroidserver. In any case - it will get to F-Droid real-soon-now.
  - lgierth 12y ago
    Cool, very good to hear!
deleted 12y ago
[deleted]
- icebraining 12y ago
  No, Google was sued because in process of doing this, they "mistakenly vacuumed up e-mail messages, user passwords and other communication", that is, they recorded actual data packets instead of just the AP identifier.
  - justcommenting 12y ago
    does anyone really believe this occurred "mistakenly"?
    - scrollaway 12y ago
      Yes, actually. Hanlon's Razor.
      - justcommenting 12y ago
        care to elaborate? are you arguing that saving/processing the full contents of raw captures from monitor mode is somehow easier/cheaper to process than filtering out obviously extraneous information at the point of collection? that's not at all obvious to me, and and one of the reasons i didn't find google's claims credible. it seems much more reasonable that they would have realized upfront that limiting the volumes of captured data could have saved considerable time/money.... unless of course they had perceived additional value from capturing more information.
        scrollaway 12y ago
        > saving/processing This data was recorded. It was not processed, it was not saved, and it was not filed under "lets-take-a-look-at-the-passwords-in-this-log.txt". The engineers thought "Hey, let's capture wifi data in aggregate and do cool geolocation stuff!" and ran with it without considering the fact that, in such data would probably be cleartext passwords. As for time and money, those are two things Google has an indefinite supply of, so they aren't really relevant.
Aissen 12y ago
Is the wifi AP database downloadable somewhere (OSM/Wikipedia style) or is it "cloudlocked" (we can only query it through the API) ?
- zz1 12y ago
  https://location.services.mozilla.com/downloads https://location.services.mozilla.com/downloads
  - Aissen 12y ago
    > wifi AP database You linked to the download page where there's only the Cell Networks database.
    - hannosch 12y ago
      Good question, I added a ticket to get this addressed: https://github.com/mozilla/ichnaea/issues/330 https://github.com/mozilla/ichnaea/issues/330 I wrote about some of the topics a while back. Not all of it is up-to-date but it gives the broader context: http://blog.hannosch.eu/2013/12/mozilla-location-service-what-why-and.html http://blog.hannosch.eu/2013/12/mozilla-location-service-wha...
    - crankycoder1975 12y ago
      We're going to put some more information there on why we don't publish wifi at this point. https://github.com/mozilla/ichnaea/issues/330 https://github.com/mozilla/ichnaea/issues/330 In a nutshell though, we don't know how to do this yet without creating a privacy nightmare.
- pornel 12y ago
  I can't find the post, but I remember reading that they'd rather not expose full raw data because of privacy concerns — there could be a way to mine this data to de-anonymize users. I'd love to play with the raw data too, but I understand their concern. So far many "anonymous" large data dumps ended up exposing too much (e.g. recently NY taxi data).
wooptoo 12y ago
This is a lot like the Wigle wardrive app: https://play.google.com/store/apps/details?id=net.wigle.wigleandroid https://play.google.com/store/apps/details?id=net.wigle.wigl...
- ZirconCode 12y ago
  Wardriving is also the first thing I thought off (Wigle also being my app of choice). Massive co-ordinated wardriving. I can't help but feel that this is a bad idea.
Icybee 12y ago
This seems similar to what Google did to receive massive fines a few years back.
- pserwylo 12y ago
  Correct me if I'm wrong, bug I believe the issue with Googles wifi collection was because they had code which intentionally read (and stored?) all data being transmitted over open wifi networks.
  - mdellabitta 12y ago
    http://www.engadget.com/2013/03/12/google-street-view-settlement/ http://www.engadget.com/2013/03/12/google-street-view-settle...
- _almosnow 12y ago
  It's the same thing, but Mozilla is cool and everything they do is good :), while Google is evil <:[ Remember that public opinion is an extremely mutable thing [1]. [1] Henrik Ibsen
  - _almosnow 12y ago
    ... At least state why you feel that my opinion is not valuable.
millzlane 12y ago
Will this still collect hidden SSID's?
- st3fan 12y ago
  Correct me if I'm wrong, but I'm pretty sure hidden SSID's do not broadcast their network name and thus will not be found by a scanner.
  - hackuser 12y ago
    Networks with hidden SSIDs can be detected many other ways. A little searching quickly will turn up methods.
- hannosch 12y ago
  It won't, see code here -> https://github.com/mozilla/MozStumbler/blob/dev/android/src/main/java/org/mozilla/mozstumbler/service/stumblerthread/blocklist/SSIDBlockList.java#L23 https://github.com/mozilla/MozStumbler/blob/dev/android/src/... The first check is "if we don't get a SSID, we don't collect". That's what happens with hidden networks.
bajsejohannes 12y ago
I've been waiting for something like this. Most other location services I know about also crowd source data (after initially seeding it), but don't give the data back to the user. Kudos for giving back what people gave you.
towolf 12y ago
Any info about how multiple fixes are integrated to approximate the true location of a fix? I remember reading how Wigle Wardriving calculated fixes and the method seemed unsophisticated and lame. For example, if I bike down a street then fixes would be detected 100m ahead of me and always pinned to the road at my current location. If I bike down the road in the other direction the next time, will be fix become more accurate? Normally higher SNR fixes should have more weight than weak fixes. Do they?
- cpeterso 12y ago
  The server code is on GitHub, but I don't know offhand where the offline geolocation scripts are. The Stumbler app's map will show your phone's GPS position (blue dots) and Mozilla Location Service's estimate (red dots) so you can compare the difference. https://github.com/mozilla/ichnaea https://github.com/mozilla/ichnaea We store signal strength for possible future use, but our current location algorithms don't use it. Wireless signal strength is notoriously flaky. From some reports I've read, signal strength is more highly correlated with the user's orientation (i.e. is their body blocking the signal to the source) than with distance to the source.
diaz 12y ago
Tried this all of today and I don't think it is working on my Jolla phone.

crankycoder1975 12y ago

Hi all! We cut a 1.0 release of the Mozilla Stumbler finally. Have at it. File the bugs. Complain about battery life. Help us make this thing not suck and build out a proper open location service.

yzzxy 12y ago
Any plans to gamify/add user incentives for "Stumbling?"
- ThePinion 12y ago
  This would be an interesting addition. I realized that Google is showing off Ingress as a game, but most technical users know it's about data-mining for maps and other location based products. Mozilla is openly showing this off as something that is about gathering data.
  - cpeterso 12y ago
    We have leaderboards showing the top stumblers overall and for the last seven days. We have lots of gamification ideas inspired by Ingress or the Nintendo DS game "Treasure World", but nothing in the works yet. https://location.services.mozilla.com/leaders https://location.services.mozilla.com/leaders https://location.services.mozilla.com/leaders/weekly https://location.services.mozilla.com/leaders/weekly https://en.wikipedia.org/wiki/Treasure_World https://en.wikipedia.org/wiki/Treasure_World
hackuser 12y ago
Congratulations; I hope this gives us a safe, effective, open location service. The privacy policy[1] could be clarified for less technical readers, and even for others. I infer that collected data is anonymous because you write, 1) We receive publicly observable data about WiFi access points and cell towers around you, your estimated latitude and longitude, and the date -- Not associated with anything else, that may be anonymous data -- though you could guess my home network or home location by the most common/strongest wifi signals. If you track data by submitter, you also would have a good idea of their travels. 2) we may receive certain temporary data such as your IP address. This data is deleted after being used as follows ... -- You seem to be implying that you do receive non-anonymous data, and delete it after innocuous uses. 3) You can send us data anonymously or under a nickname -- Which implies anonymity is possible. If what I infer is correct, why not restate it directly and unequivocally with something like the following: Unless you choose otherwise, the data you send will be anonymous and not associated with you in any way. We will not record who you are or what phone sent the data. We do receive some non-anonymous data, but we delete it within X hours/days after using it as follows ... And add more detail after that. [1] https://location.services.mozilla.com/privacy https://location.services.mozilla.com/privacy EDIT: Clarify a bit, and a correction to #1
- cpeterso 12y ago
  Good questions! The stumbler reports Wi-Fi and cell tower locations and an optional nickname. The location data is stored anonymously. The nickname and just the number of reported networks is stored separately, solely for display on the leaderboard [1] or other gamification in the future. The IP addresses are just a fact of life of web server logging. They are not stored in the location or leaderboard databases. [1] https://location.services.mozilla.com/leaders https://location.services.mozilla.com/leaders
  - hackuser 12y ago
    > Good questions! Thanks! My post's intention was to suggest that Mozilla revise the privacy policy to clarify it for everyone. What are your thoughts?
- justcommenting 12y ago
  "fact of life of web server logging" = screw you, we're not even going to consider deleting our logs even as we talk a good line about how much we respect your privacy edit after downvote: also, mozilla engineering PMs will intimate on hackernews that it won't internally correlate and potentially sell any of the location and other information it most obviously could correlate about people, even though it has already announced its intention to advertise.
  - sp332 12y ago
    "2) we may receive certain temporary data such as your IP address. This data is deleted after being used as follows". So yes, they do say they delete it. Also, Mozilla has a better track record with respecting user privacy than anyone else in this space. (And where is their intention to advertise?)
    - justcommenting 12y ago
      i agree that Mozilla has a better track record than most large tech companies in most areas, but that also sets a pretty low bar. i'm more of the opinion that if Mozilla really were as committed to user privacy as they claim to be, they might not respond so flippantly to questions about server logs. If it wanted to, Mozilla could even stop logging "certain temporary data such as your IP address." regarding Mozilla's intention to advertise: http://www.zdnet.com/mozilla-clarifies-defends-firefox-ad-position-7000026335/ http://www.zdnet.com/mozilla-clarifies-defends-firefox-ad-po...
cpeterso 12y ago
btw, the Mozilla location database is currently used to power geolocation on the well-publicized Firefox OS "$25 smartphone"! That device does not have GPS hardware so all geolocation requires rely on Mozilla's location service and GeoIP.
therealunreal 12y ago
I used to use it a lot a few months back "mapping" my town and I had noticed that it would go at full strength even when I was staying in the same place for hours. Would it be possible to gradually slow down the collections when it detects that the user isn't moving?
- zz1 12y ago
  There used to be a mode to geo-fence data collection, i.e. harvest only outside of a certain area, but I don't see it anymore.
  - crankycoder1975 12y ago
    geo-fencing was extremely rarely used. I think we had single digit numbers of people who enabled the feature and understood what it meant. We decided to cut out geofencing because it was confusing to most people and reducing the number of knobs and dials on a program is usually a good thing. We've got a bug filed to hook the accelerometers though: https://github.com/mozilla/MozStumbler/issues/1107 https://github.com/mozilla/MozStumbler/issues/1107
mike-cardwell 12y ago
Google provides an opt-out. They will ignore your AP if you append "_nomap" to the end of your SSID. Does Stumbler also support this? If not, why not? Ref: https://support.google.com/maps/answer/1725632?hl=en https://support.google.com/maps/answer/1725632?hl=en edit: Found the answer to my own question. Yes, they do support "nomap": https://github.com/mozilla/MozStumbler/issues/149 https://github.com/mozilla/MozStumbler/issues/149
- paulojreis 12y ago
  Is this really a thing? WTF? I feel very ashamed, as someone who works in IT, everytime this happens. I mean, people can opt-out, of course - but, in order to do that, they need to know what an SSID is, and how to change it. What about people who don't? Will we just assume that they don't care or that their opinion doesn't matter?
  - zz1 12y ago
    I guess you have a better suggestion, and am curious to hear about it.
    - walterbell 12y ago
      An option during router setup when SSID is named? An organized promotion of this approach, e.g. list of routers that make it simple, list of services that honor it. A cool name other than "Do Not Track".
      - zz1 12y ago
        That would require an action on the router-side, not on the mapping one. I think it could be a good option, but this doesn't apply for this case. Also, what if I agree to put my SSID into an open database but not in a locked one? Apple's and Google's location databases do not compare, for me, to Mozilla's one: I am more than glad to be in the latter, but not to be in the two formers.
    - justcommenting 12y ago
raesene4 12y ago
Cool stuff, always interesting to see a new entrant to the location services field, especially an open one. One question though. Will ordinary users be able to directly query the database via the API? i.e. if you want to geolocate a set of Access points and you have their MAC addresses will this service provide a direct supported API for retrieving their location? The documentation on the API page implies that this isn't really a supported application? Specifically "If you are developing a native application or library for a desktop operating system or Android, you can in principle use this service via its HTTPS API. Please refer to the development documentation for the details. On most other operating systems, you cannot access the required cell and WiFi network information required to call the service API. " and "At this stage the service is open to anyone, who wants to contribute back to the service and applications supporting the Mozilla mission. " seem a bit vague.
towelguy 12y ago
I see there is a leaderboard, so users have a nick, but can we contribute anonymously without signing up? Also, why do you need access to my photos?
- cpeterso 12y ago
  Yes, anonymous is the default mode. :) The nickname is optional and only used to record a leaderboard "points". The nickname is not tied to any reported Wi-Fi or location data. Mozilla Stumbler does not need to access your photos; it just needs to read/write to your sdcard (to cache map tile graphics and export KML data). "Access your photots" is Google's unfortunate explanation of accessing the sdcard.

chdir 12y ago

Could someone explain the privacy implications of mapping Wifi networks to GPS co-ordinates. Is it an opt-out thing?

hackuser 12y ago
See my post below for some answers; I was writing as you posted yours ...
- chdir 12y ago
  Thanks. As a follow-up, there are existing services that already have this database. So why build another one? Is it because the existing ones aren't open source?
  - cpeterso 12y ago
    There are a number of other location databases, such as OpenCellID and WiGLE. There are issues around incompatible data licenses for some location databases. Mozilla and OpenCellID have worked together to exchange data going forward. WiGLE's Wi-Fi and cell tower databases is only available for purchase with a commercial license, even though much of the data is collected by volunteer contributors. The combined Mozilla + OpenCellID cell tower location database is public domain and published hourly here: https://location.services.mozilla.com/downloads https://location.services.mozilla.com/downloads Mozilla's Wi-Fi location database is not currently published until we can solve the privacy concerns.
cpeterso 12y ago
A stumbler user's identity or location could be revealed by tracing routes from published GPS data or maps. In areas without much stumbler data coverage, you can see clear routes along highways and some residential streets. Owners of Wi-Fi access points, including mobile phones with sharing Wi-Fi, may not want their unique BSSID/MAC address and location published. This is not exactly comparable to the Google Wi-Fi case in Germany. In addition to recording BSSID/MAC addresses, Google was (inadvertently?) logging Wi-Fi payload data that included cleartext user data. btw, here's a zoomable map of the Mozilla Location Service's data coverage. Please help fill in the blanks! :) https://location.services.mozilla.com/map https://location.services.mozilla.com/map

thristian 12y ago

No Firefox OS port?

Clochix 12y ago
I made a Firefox OS port: https://github.com/clochix/FxStumbler https://github.com/clochix/FxStumbler But it was my first Firefox OS app, the code is awful and it would need a complete rewrite. Nevertheless, if you have a FxOS device, don't hesitate to try this port and give me some feedback.

ChrisGranger 12y ago

Will this work with WiFi-only tablets? I'd like to contribute but my Kobo Arc device is marked incompatible. I saw in the screenshot on Google Play that there is a WiFi-only report symbol.

icebraining 12y ago
It works on my WiFi-only Nexus 7.
zz1 12y ago
I have a LTE Nexus 7, with no SIM, so it is basically a WiFi only, and yes, it works. I couldn't install it from F-Droid and I had to use an apk from github, but it worked like a charm and it auto-updates.
crankycoder1975 12y ago
YES. We caught that bug just before release. :) https://github.com/mozilla/MozStumbler/issues/1137 https://github.com/mozilla/MozStumbler/issues/1137

tonylemesmer 12y ago

As an Android user, is it possible to modify my phone to use this service instead of Google's? Is it possible to upload the database directly to a phone or replace an APK to achieve this?

ganomi 12y ago
The NOGAPPS project lists Mozilla Location Service support as an upcoming feature (http://forum.xda-developers.com/showthread.php?t=1715375 http://forum.xda-developers.com/showthread.php?t=1715375).
- tonylemesmer 12y ago
  Great! And although that post was made June 2012 I note it has been maintained and has recent updates.
  - hannosch 12y ago
    Hanno from Mozilla here. Marvin reached out to us about a month back and we have been slow to respond. He just got an email back a week ago. So I think this is still going to happen, but no concrete timeline yet.
cpeterso 12y ago
You can test the Mozilla Location Service with Firefox on your desktop by changing your "geo.wifi.uri" about:config pref to: https://location.services.mozilla.com/v1/geolocate?key=test Then try using a geolocation service like Google Maps or http://html5demos.com/geo http://html5demos.com/geo . If it can't find your location, check Mozilla's zoomable coverage map to see if your neighborhood is covered: https://location.services.mozilla.com/map https://location.services.mozilla.com/map . If not, please consider installing Mozilla Stumbler to help map it. :)

lgierth 12y ago

Will 1.0 be available on the F-Droid store, like earlier versions?

zz1 12y ago
You can already auto-update from within MozStumbler itself.
- privong 12y ago
  Apparently not from the current latest (0.30.0) version on f-droid. I just went through the MozStumbler menus and did not see anything about (auto-)updating.
pserwylo 12y ago
I believe so. crankycoder1975 was asking for some pointers on #fdroid irc a few hours back to help build 1.0 for F-Droid. Hopefully any issues will get ironed out. While I appreciate my siblings comment about the app auto-updating - I'd rather have apps managed by a central area (F-Droid on Android, package managers on desktop Linux).
crankycoder1975 12y ago
I'm going to try getting an F-Droid build out today, but we've got some build issues with the fdroidserver. In any case - it will get to F-Droid real-soon-now.
- lgierth 12y ago
  Cool, very good to hear!

deleted 12y ago

[deleted]

icebraining 12y ago
No, Google was sued because in process of doing this, they "mistakenly vacuumed up e-mail messages, user passwords and other communication", that is, they recorded actual data packets instead of just the AP identifier.
- justcommenting 12y ago
  does anyone really believe this occurred "mistakenly"?
  - scrollaway 12y ago
    Yes, actually. Hanlon's Razor.
    - justcommenting 12y ago
      care to elaborate? are you arguing that saving/processing the full contents of raw captures from monitor mode is somehow easier/cheaper to process than filtering out obviously extraneous information at the point of collection? that's not at all obvious to me, and and one of the reasons i didn't find google's claims credible. it seems much more reasonable that they would have realized upfront that limiting the volumes of captured data could have saved considerable time/money.... unless of course they had perceived additional value from capturing more information.
      - scrollaway 12y ago
        > saving/processing This data was recorded. It was not processed, it was not saved, and it was not filed under "lets-take-a-look-at-the-passwords-in-this-log.txt". The engineers thought "Hey, let's capture wifi data in aggregate and do cool geolocation stuff!" and ran with it without considering the fact that, in such data would probably be cleartext passwords. As for time and money, those are two things Google has an indefinite supply of, so they aren't really relevant.

Aissen 12y ago

Is the wifi AP database downloadable somewhere (OSM/Wikipedia style) or is it "cloudlocked" (we can only query it through the API) ?

zz1 12y ago
https://location.services.mozilla.com/downloads https://location.services.mozilla.com/downloads
- Aissen 12y ago
  > wifi AP database You linked to the download page where there's only the Cell Networks database.
  - hannosch 12y ago
    Good question, I added a ticket to get this addressed: https://github.com/mozilla/ichnaea/issues/330 https://github.com/mozilla/ichnaea/issues/330 I wrote about some of the topics a while back. Not all of it is up-to-date but it gives the broader context: http://blog.hannosch.eu/2013/12/mozilla-location-service-what-why-and.html http://blog.hannosch.eu/2013/12/mozilla-location-service-wha...
  - crankycoder1975 12y ago
    We're going to put some more information there on why we don't publish wifi at this point. https://github.com/mozilla/ichnaea/issues/330 https://github.com/mozilla/ichnaea/issues/330 In a nutshell though, we don't know how to do this yet without creating a privacy nightmare.
pornel 12y ago
I can't find the post, but I remember reading that they'd rather not expose full raw data because of privacy concerns — there could be a way to mine this data to de-anonymize users. I'd love to play with the raw data too, but I understand their concern. So far many "anonymous" large data dumps ended up exposing too much (e.g. recently NY taxi data).

wooptoo 12y ago

This is a lot like the Wigle wardrive app: https://play.google.com/store/apps/details?id=net.wigle.wigleandroid https://play.google.com/store/apps/details?id=net.wigle.wigl...

ZirconCode 12y ago
Wardriving is also the first thing I thought off (Wigle also being my app of choice). Massive co-ordinated wardriving. I can't help but feel that this is a bad idea.

Icybee 12y ago

This seems similar to what Google did to receive massive fines a few years back.

pserwylo 12y ago
Correct me if I'm wrong, bug I believe the issue with Googles wifi collection was because they had code which intentionally read (and stored?) all data being transmitted over open wifi networks.
- mdellabitta 12y ago
  http://www.engadget.com/2013/03/12/google-street-view-settlement/ http://www.engadget.com/2013/03/12/google-street-view-settle...
_almosnow 12y ago
It's the same thing, but Mozilla is cool and everything they do is good :), while Google is evil <:[ Remember that public opinion is an extremely mutable thing [1]. [1] Henrik Ibsen
- _almosnow 12y ago
  ... At least state why you feel that my opinion is not valuable.

millzlane 12y ago

Will this still collect hidden SSID's?

st3fan 12y ago
Correct me if I'm wrong, but I'm pretty sure hidden SSID's do not broadcast their network name and thus will not be found by a scanner.
- hackuser 12y ago
  Networks with hidden SSIDs can be detected many other ways. A little searching quickly will turn up methods.
hannosch 12y ago
It won't, see code here -> https://github.com/mozilla/MozStumbler/blob/dev/android/src/main/java/org/mozilla/mozstumbler/service/stumblerthread/blocklist/SSIDBlockList.java#L23 https://github.com/mozilla/MozStumbler/blob/dev/android/src/... The first check is "if we don't get a SSID, we don't collect". That's what happens with hidden networks.

bajsejohannes 12y ago

I've been waiting for something like this. Most other location services I know about also crowd source data (after initially seeding it), but don't give the data back to the user. Kudos for giving back what people gave you.

towolf 12y ago

Any info about how multiple fixes are integrated to approximate the true location of a fix? I remember reading how Wigle Wardriving calculated fixes and the method seemed unsophisticated and lame. For example, if I bike down a street then fixes would be detected 100m ahead of me and always pinned to the road at my current location. If I bike down the road in the other direction the next time, will be fix become more accurate? Normally higher SNR fixes should have more weight than weak fixes. Do they?

cpeterso 12y ago
The server code is on GitHub, but I don't know offhand where the offline geolocation scripts are. The Stumbler app's map will show your phone's GPS position (blue dots) and Mozilla Location Service's estimate (red dots) so you can compare the difference. https://github.com/mozilla/ichnaea https://github.com/mozilla/ichnaea We store signal strength for possible future use, but our current location algorithms don't use it. Wireless signal strength is notoriously flaky. From some reports I've read, signal strength is more highly correlated with the user's orientation (i.e. is their body blocking the signal to the source) than with distance to the source.

diaz 12y ago

Tried this all of today and I don't think it is working on my Jolla phone.