13 ms·

Ghostery and NoScript-like add-ons frequently phone home

208 points by blueflow 12y ago

dicknuckle 12y ago
Hasnt done enough research.
- blueflow 12y ago
  They indeed do in the default settings (checked with wireshark). NoScript for example queries informaction.com to get the own WAN-IP.
  - dicknuckle 12y ago
    If you are on a VPN, who cares.
rockdoe 12y ago
So what would the author prefer? That security sensitive software doesn't check for updates? WHAT COULD POSSIBLY GO WRONG. Somewhat later there is this remark: Why are these add-ons? Why are they not designed-in and built-in to the browser? Well, this is actually built-into Firefox Nightly. It's called Tracking Protection...and it updates its lists using the exact same SafeBrowsing the original author whines about. It's hard to take these people seriously, which is bad, because privacy is a serious problem. Not worthy to be left over to whiners that offer no solutions.
- deleted 12y ago
  [deleted]
  - rockdoe 12y ago
    If you have "Update Add-Ons Automatically" checked then yes it does that. I'm not sure what your point is.
- travjones 12y ago
  It seems that the authors tone is not "whiny," but maybe that was my interpretation. He is raising a serious concern: tools that people think are keeping them safe/anonymous are actually not 100% anonymous. I think this is always important to consider. Most of us on HN are technical, and we are already aware of (even worse) privacy "violations" than those described in the article. Nonetheless, most people who use the internet are not aware of this and it will be important to keep the layman informed for his/her own sake and for the future of the net.
  - rockdoe 12y ago
    The problem is that this trade-off isn't properly explained or qualified in the original posts. Do you think I'm doing the uninformed public a favor if I go around yelling: "Vaccines frequently cause fever, pain around the injection site, and muscle aches. In rare cases, much more severe side effects can result from vaccination."? Hey, just keeping the layman informed.
    - travjones 12y ago
      I agree. The tradeoff was not properly explained or qualified. <offtopic> In regards to vaccinations, I think the uninformed public should be provided with all information possible, including scientific evidence of the utility of vaccination and potential, albeit rare, side-effects of vaccination. </offtopic> Deliberately depriving people of information is not ethical.
      - wbuckley 12y ago
        I'd say you've hit the nail squarely on the head here. As an (amusingly directly relevant to the side-discussion) example, in a college English course I took we had a group project and presentation in which we had to take a position on an issue. Despite it being dangerous territory, my group dove directly into the vaccine debate. After beginning our research (note that this was prior to the major cited paper(s) on the issue being retracted) we decided that we would work very carefully, within the guidelines of the project, to advocate that any and all possible links should be researched farther. Technically this position was not a great fit for the directions we had been given, but we wanted to be very careful to say "this might be an issue and should be investigated in more detail" rather than "this is a problem and we fix it with [x]." TL;DR: Taking the hard line is often a bad call, but calling for something to be looked into (with cause) is often wise. If you read the newsgroup post to the end, this is exactly what the author does, albeit with some important context to the issue omitted.
- toxican 12y ago
  Any idea when we can expect that feature in a regular release of FF? And any idea if it'll be enabled by default (doubt it, but I can dream)
  - rockdoe 12y ago
    It might already be in regular releases, I referred to Nightly because that's what I use, and IIRC it was added there already quite a while ago.
  - cpeterso 12y ago
    The Tracking Protection feature is available in Firefox 36, the current release channel version. It is not exposed in the preferences UI yet, but you can flip the "privacy.trackingprotection.enabled" about:config pref. To verify that Tracking Protection is working, visit cnn.com or nytimes.com and look for the shield icon in the address bar. On my laptop, cnn.com takes 18 seconds to load without tracking protection and 4 seconds with it. If you find a website that is broken by Tracking Protection, please file a bug on Bugzilla in the "Core :: DOM: Security" component. You can click the shield icon to disable Tracking Protection for individual websites. Tracking Protection is not an ad blocker, but some ads will be blocked as a side effect. Mozilla's prototype list is currently based on Disconnect's tracking list: http://services.disconnect.me/disconnect-plaintext.json http://services.disconnect.me/disconnect-plaintext.json Will Tracking Protection be enabled by default? I don't know. Mozilla must walk a narrow line between protecting user privacy and angering publishers such that they block Firefox users. (I work for Mozilla, but not on the Tracking Protection project.)
    - pbhjpbhj 12y ago
      >Mozilla must walk a narrow line between protecting user privacy and angering publishers such that they block Firefox users. // Is there any precedent for that, it sounds impossible, that publishers would block one of the major browser brands like this; wouldn't it just mean people would use UA switchers? The only reason FF wouldn't want to serve it users like this, that I can see, is so as not to annoy those they're in commercial relationships with like the company they forced the browser toolbar button on to everyone's Firefox to get sponsorship from.
- arbitrage 12y ago
  > Not worthy to be left over to whiners that offer no solutions. This is not a fair criticism. I can tell someone, "Hey dude, your house is on fire" without having to offer them either a bucket of water or a new house. This type of argument is frequently used to forestall any criticism whatsoever. Bad supervisors often say things like, "don't give me complaints without also giving me a solution." It's sloppy thinking, and rejects valuable feedback.
  - rockdoe 12y ago
    I couldn't disagree more strongly. There IS a solution. There are even multiple ones. The critics are pointing out that a particular one they focus one isn't perfect on their arbitrary metrics, and so they claim it isn't good. "I dislike it that the user-friendly software I use (as opposed to TBB) phones home to check for updates and track metrics" isn't valuable feedback. It's stating the obvious without proper qualification. It's ignoring the trade-offs that are obvious. It's not constructive. You're the person complaining to the fire brigade because they made your house wet. Really, your post is the kind of thing that must sit framed in every Internet Troll cave. Because that sure is everybodies favorite internet hobby: complain loudly about everything, offer no solutions, and then whine even harder when the authors that are working to make things better (sometimes for free) quit in disgust. And the entitlement in the replies, you cannot be serious. Yes, you're all entitled to whine, I'm sorry, point out flaws, all day on the internet. Congrats.
    - wernercd 12y ago
      He isn't saying their isn't a solution... he's saying that you don't have to offer a problem AND a solution at the same time. He's right: There shouldn't be an "All or Nothing" mentality. There are times and places where a problem shouldn't be mentioned without a solution... There are also times and places where bring up a problem is itself important enough to warrant a talk WITHOUT a solution. Ignoring the fact that both extremes exist is a larger part of problem in having any kind of constructive conversation these days. "If you don't agree with me 100%, you're an idiot, a troll and your mom should be shot" type of attitude is a troll in of itself and a major problem blocking any kind of conversation on a multitude of topics. Why can't the problem be discussed without forcing the conversation down the "this is the solution..." path?
- makeitsuckless 12y ago
  I think the author would prefer permission and transparency. In other words informed consent.
  - ForHackernews 12y ago
    Ghostery, at least, already does a pretty good job (IMHO) of this: https://www.ghostery.com/en/faq#q5-general https://www.ghostery.com/en/faq#q5-general
    - makeitsuckless 12y ago
      The article suggests Ghostery sends data anyway. Also, the non-denial denial in the next FAQ item (https://www.ghostery.com/en/faq#q6-general https://www.ghostery.com/en/faq#q6-general) sets off all kinds of alarm bells.
      - ForHackernews 12y ago
        Huh? How is that a non-denial denial? The question is "How do I know that's all you collect?" and the answer is "You can verify it yourself by examining the source code."
- blub 12y ago
  These addons are installed from the Mozilla addons website and Firefox can check automatically for addon updates. Complaining that software is phoning home is perfectly legitimate. It should ask for consent and at a minimum tell users what information is gathered and for which purposes it is used.
- JustSomeNobody 12y ago
  I am OK with people pointing out things that are/could be wrong without offering a solution. There are usually more solutions to a problem than we need, so why muddy the waters.
- JoshTriplett 12y ago
  > So what would the author prefer? That security sensitive software doesn't check for updates? Addons should not be doing their own updates; the browser should keep them up to date.
- cpeterso 12y ago
  btw, Mozilla's Tracking Protection list doesn't use Google's SafeBrowsing service or list (which is malware list, not a tracker list). It talks to a Mozilla server, specified by in the "browser.trackingprotection.gethashURL" about:config pref: https://tracking.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%VERSION%&pver=2.2 https://tracking.services.mozilla.com/gethash?client=SAFEBRO.... Mozilla's list is currently based on Disconnect's tracking list: http://services.disconnect.me/disconnect-plaintext.json http://services.disconnect.me/disconnect-plaintext.json.
- hobarrera 12y ago
  > So what would the author prefer? That security sensitive software doesn't check for updates? Considering that we normally use the OS's distribution channels (repositories for *nix, markets for windows/os x), it's completely useless for me that any software calls home to check for updates. My OS handles this already.
Dirlewanger 12y ago
How else is one supposed to react to this other than with cynicism? This is the nature of going on the Internet, you will be tracked whether you like it or not. No one is anonymous. The Internet, while being one of the greatest inventions by mankind, has succumbed like all the others to the maladies of greed. Unless some billionaire Elon Musk-esque figure funds a private service to actually not, really, no-for-real track you, it won't happen. Personal incentives motivate people, and until this hypothetical billionaire sees an incentive other than profit, it's not happening.
- 6a68 12y ago
  > How else is one supposed to react to this other than with cynicism? How about empowerment instead of cynicism? Maybe it's possible to build browsers and advertising and mobile devices that don't relentlessly erode privacy. I work at Mozilla to help build that tech. I firmly believe the dystopian corporate future isn't the only option. You should check us out: https://www.mozilla.org/mission https://www.mozilla.org/mission
  - whoopdedo 12y ago
    > Maybe it's possible to build browsers and advertising and mobile devices that don't relentlessly erode privacy. That's nice a nice sentiment. I'd be less skeptical if Firefox didn't change my default search engine behind my back. (After updating Android from 31 to 36.)
    - rockdoe 12y ago
      If you changed the defaults, it was kept. If you never set a search engine, the shipped default was changed (and clearly mentioned as such in the release notes not to mention all over the press, so saying "behind my back" is quite funny).
      - talmand 12y ago
        Just to play devil's advocate, what if the default was the choice the user wanted?
SippinLean 12y ago
Ghostery has addressed this elsewhere: http://www.reddit.com/r/IAmA/comments/1c4wjz/we_are_the_ghostery_team_askusanything_especially/c9d1chg http://www.reddit.com/r/IAmA/comments/1c4wjz/we_are_the_ghos... >Ghostery is supported by Ghostrank, our 100% opt-in feature that collects information about the trackers you see and the sites on which you see them. Our parent company, Evidon, packages that information and sells it back to sites who use it for privacy, performance, and security audits; and also ad tech companies who use it for competitive intelligence about each other. >That information is totally anonymous - it's all intelligence about the tracking industry, none about our users. And Ghostery works exactly the same whether you choose to share that with us or not.
- samspot 12y ago
  According to the article this phone home feature activates even when you uncheck all the share options.
  - talmand 12y ago
    But at that point, what exactly is it phoning home about? If it's still sharing the data you explicitly refused to share, then that's one thing. If it's simply asking home if there's an update, then that's something totally different.
    - bsder 12y ago
      No, it's not. Firefox is managing extension updates already. As an app developer, you don't need to know this data. As a security surface, you really don't want this data in real-time. It makes you a target. I presume the problem is that Firefox isn't sharing this install/update data with the extension developers. So, they're trying to collect it themselves.
      - talmand 12y ago
        So, you are saying that every single extension in existence uses Mozilla's update feature and doesn't have an internal system for updating? Because it seems to me I've seen a few that seem to update themselves with no involvement of the add-on panel of Firefox.
wiggumz 12y ago
To me the key question is whether these checks are anonymous. If not -- if Firefox or a plug-in is sending a unique ID, than any advertiser or government agency could pay for that tracking information and then your privacy would be toast, at least until you can reset that ID.
- kpcyrd 12y ago
  Even if there's no unique ID, if you've installed a lot of plugins this combination can uniquely identify you. If you query addon updates daily, they could associate your IP of the day with your "I have installed these addons"-fingerprint. A debian style update mechanism could solve this, but this would be really bandwidth expensive.
  - hackuser 12y ago
    > Even if there's no unique ID, if you've installed a lot of plugins this combination can uniquely identify you This is a good thing to remember, but I'm not sure it undermines the parent's point. No matter what security you use for anything, you always are exposed to another threat; that doesn't make all security useless. The value of security is to make attacks more difficult.
- rockdoe 12y ago
  I don't understand your post because it's full of blanket meaningless statements. A government agency doesn't need to pay anything, they could use legal means to extract the information. I don't think there's anything stopping plug-ins from sending unique IDs. SafeBrowsing uses a cookie that makes up a unqiue ID. (The latter discussion is well documented in Mozilla's Bugzilla) But what tracking information would make your privacy toast? Privacy has levels. SafeBrowsing leaks your WAN IP to Google. (You already leak this to every site you visit) Plug-ins likely leak details about the plugin configuration (as Ghostery does). What's the value there?
- aw3c2 12y ago
  I consider my IP address to be private information. If I chose to disclose it to a site, ok, but I don't mean to tell third-parties about it.
ikeboy 12y ago
What exactly is the problem here? If you care about security, use the TBB, each session is still unique because private browsing. If you really care and use tails or whonix, this still won't de-anonymize you. If you aren't doing that, any website you visit gets your ip. I'm trying to figure out what attack model you'd have a reasonable basis to think you were protected against, except for the fact that these plugins "phone" home. If you're using a setup in which that matters, you've already lost.
- rockdoe 12y ago
  You've articulated this better than I have. By default, combinations like Firefox+SafeBrowsing+Ghostery+Adblock make an uninformed user (or informed users who prefers convenience) safer against a given adversary: advertising agencies, trackers, malicious sites. They do not protect you from the government, and they won't protect you from Google. To reach this level of protection and user-friendliness, they rely on automated updates, and the use of metrics to improve the software. If your thread model is different, and your adversary includes Google or the government, there are solutions too like TBB. But you will give up on the convenience that (drumroll) companies like Google provide.
  - rockboe 12y ago
    TBB offers a speedy and modern browsing experience. I use it for everything, and wouldn't hesitate to recommend it. You can watch Youtube videos, download large files, and browse most websites without a hitch. You could sign up for G+ over Tor and get most of the purported benefits of being tracked by Google without tying your browsing activity to your real name or IP.
    - ikeboy 12y ago
      Doesn't Google now require a phone verification to sign up, thus tying everything to a real id? And you don't get Cloudflare bs all the time on tor? And have you ever compared speed on downloading large files, or latency? It's bad enough to make me only use it when really needed and not everyday usage.
- 12y ago
JoergR 12y ago
Oh god the paranoia in this email...how is someone wanting to improve their tool capitalism or a business model. Maybe it's just someone trying to ... oh I don't know ... making their product better by understanding how it's used?
godgod 12y ago
Is there anything we can trust these days? My god...everything we do is tracked.
Animats 12y ago
Several popular Firefox privacy/security add-ons have become much worse in the last year. BlockSite added ads and full tracking of user browsing. (That one is really bad.) AdBlock Plus added a "whitelist" of ads they let through. (The advertisers pay AdBlock) Firefox itself reports installed add-ons to Mozilla AMO each day for tracking and update purposes. Add-ons don't need to check for updates themselves.
- flanbiscuit 12y ago
  Is this there an open source alternative to Adblock plus?
  - rockdoe 12y ago
    uBlock is getting popular fast, but note AdBlock Plus itself is also open source.
    - flanbiscuit 12y ago
      I didn't realize that. I'm going to check out the source to see just which sites that are whitelisting
      - lewisje 12y ago
        It's not in the source code, but instead in a subscription that ABP uses by default (it remembers if you unchecked "Allow some non-intrusive advertising" so it doesn't re-enable this list on every update): https://adblockplus.org/en/acceptable-ads https://adblockplus.org/en/acceptable-ads This is the subscription, which was originally linked from that page (but it now links to the Acceptable Ads subforum, which has a sticky that links to this subscription): https://easylist-downloads.adblockplus.org/exceptionrules.txt https://easylist-downloads.adblockplus.org/exceptionrules.tx...
  - UntitledNo4 12y ago
    I don't know if disconnect.me is an exact alternative to AdBlock since I have never used AdBlock, but I like what it's doing and it's open source. https://disconnect.me/opensource https://disconnect.me/opensource
longsleep 12y ago
Check out Iridium Browser. We try hard to build a Chromium which does not phone home (to Google). It's work in progress but completely open and transparent. https://iridiumbrowser.de/about https://iridiumbrowser.de/about
xorcist 12y ago
Move to uBlock already! It's faster, on less resources, does what Adblock and Ghostery does, and is so far void of any dubious business model. Back on topic, I believe the author points out things that you need to be aware of, especially if you use tor. They made the Tor Browser for a reason. Use it!
- ikeboy 12y ago
  Last I heard the person controlling the repo was doing funny stuff like removing the info of the creators and there was some dispute over control. Any idea what's up?
  - meikj 12y ago
    The original author now maintains "uBlock Origin" because of this funny business (see https://github.com/gorhill/uBlock/ https://github.com/gorhill/uBlock/).
  - gorhill 12y ago
    > removing the info of the creators More accurately it was about importing code changes manually without attribution, thus forfeiting authorship info in the commits. I believe it's all resolved now. The person is a kid (to me), I had no idea, so when I learned this I see this differently now, he was just being misguided. I originally thought I was dealing with a fully grown adult, so I did not hold back on the criticism. My own mistake was to not consider I was maybe dealing with such a young person.
  - XzetaU8 12y ago
    Chris's (chrisaljoudi) video response on the issue https://www.youtube.com/watch?v=_D1TpddtVUA https://www.youtube.com/watch?v=_D1TpddtVUA More here: https://github.com/gorhill/uBlock/issues/130# https://github.com/gorhill/uBlock/issues/130#
brudgers 12y ago
The fundamental dilemma in privacy is the same as for security and Ken Thompson nailed it thirty years ago.[1] You have to trust somebody. If I didn't trust the folks at Mozilla and Ghostery and NoScript more than Google, I'd run Chrome and leave JavaScript and Cookies on by default. If I trusted Facebook and LinkedIn more, I'd stay logged in. I don't so I don't. [1]: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html
raintrees 12y ago
Possibly a naive question: Wouldn't hosts entries block this? i.e. informaction.com 127.0.0.1, etc. If so, then one would only comment out the entries when specifically after updates, otherwise they run as-is, and no phone home problem. Although this depends on a browser using the host system's specified DNS: I seem to have caught Chrome ignoring my entries in favor of Goggle's DNS (on Linux) whilst doing web design for a client. :(
- oldmanjay 12y ago
  Useless comment, downvote/ignore at will; If this were Slashdot, you would have just made a friend for life in APK.
  - raintrees 12y ago
    Thanks for the reference, I had never run into APK as a meme/topic. As to the HOSTS question, I am currently working through Terpstra's SAMBA-3 By Example, and after spending enough time on small business networks chasing down odd stuff every time a Microsoft Small Business Server goes down (runs its own DNS and DHCP servers for the LANs in question), I am beginning to consider static mapping some of these smaller networks for better resiliency, which seems to be a frequent consideration of that author. I apologize for the naivete, but I did specifically label my comment as such, and my question was an honest one with a simplistic security model in mind, when it comes to specific outside resources that may be untrustworthy. edit: And that search for APK derived my answer at pineight.com, so again, thanks.
    - oldmanjay 12y ago
      Just to be clear, I was saying my comment was useless, not yours.
      - raintrees 12y ago
        Thank you, I did misunderstand and was a bit disappointed my comment was taken as useless. It concerns me when I misunderstand protocol...
wsha 12y ago
Reading the source code, I find this: function recordInstall() { if (utils.prefs('install_recorded')) { return; } sendReq('install'); } So the if statement that the OP highlights does not actually phone every time it is called like the OP claims, but only on the first install. The message that the add-on sends to ghostery.com includes the Ghostrank preference, the version of Ghostery, the OS, and the Firefox version (Android or desktop). That said, it does appear that the add-on phones home on each upgrade, and I don't see anything in the Ghostery Privacy Policy about this (it only discusses GhostRank).
- nijiko 12y ago
  Yes, its an ongoing issue that people are increasingly unable to read simple if statements. The world has been plagued with academics attempting to analyze the simplest of statements without success. This is what led us to form the "Leave No Academic Behind" (LNAB) group. To inform academics in the err of their ways and show them the path to success. There have been increase in tin-foil theories about these scripts even when the source is available and very easy to read through. It honestly blows my mind.
ddp 12y ago
So Ghostery phones home. Until someone tells me that it doesn't block what it purports to block, the alternative is worse.

208 points by blueflow 12y ago

dicknuckle 12y ago

Hasnt done enough research.

blueflow 12y ago
They indeed do in the default settings (checked with wireshark). NoScript for example queries informaction.com to get the own WAN-IP.
- dicknuckle 12y ago
  If you are on a VPN, who cares.

rockdoe 12y ago

So what would the author prefer? That security sensitive software doesn't check for updates? WHAT COULD POSSIBLY GO WRONG. Somewhat later there is this remark: Why are these add-ons? Why are they not designed-in and built-in to the browser? Well, this is actually built-into Firefox Nightly. It's called Tracking Protection...and it updates its lists using the exact same SafeBrowsing the original author whines about. It's hard to take these people seriously, which is bad, because privacy is a serious problem. Not worthy to be left over to whiners that offer no solutions.

deleted 12y ago
[deleted]
- rockdoe 12y ago
  If you have "Update Add-Ons Automatically" checked then yes it does that. I'm not sure what your point is.
travjones 12y ago
It seems that the authors tone is not "whiny," but maybe that was my interpretation. He is raising a serious concern: tools that people think are keeping them safe/anonymous are actually not 100% anonymous. I think this is always important to consider. Most of us on HN are technical, and we are already aware of (even worse) privacy "violations" than those described in the article. Nonetheless, most people who use the internet are not aware of this and it will be important to keep the layman informed for his/her own sake and for the future of the net.
- rockdoe 12y ago
  The problem is that this trade-off isn't properly explained or qualified in the original posts. Do you think I'm doing the uninformed public a favor if I go around yelling: "Vaccines frequently cause fever, pain around the injection site, and muscle aches. In rare cases, much more severe side effects can result from vaccination."? Hey, just keeping the layman informed.
  - travjones 12y ago
    I agree. The tradeoff was not properly explained or qualified. <offtopic> In regards to vaccinations, I think the uninformed public should be provided with all information possible, including scientific evidence of the utility of vaccination and potential, albeit rare, side-effects of vaccination. </offtopic> Deliberately depriving people of information is not ethical.
    - wbuckley 12y ago
      I'd say you've hit the nail squarely on the head here. As an (amusingly directly relevant to the side-discussion) example, in a college English course I took we had a group project and presentation in which we had to take a position on an issue. Despite it being dangerous territory, my group dove directly into the vaccine debate. After beginning our research (note that this was prior to the major cited paper(s) on the issue being retracted) we decided that we would work very carefully, within the guidelines of the project, to advocate that any and all possible links should be researched farther. Technically this position was not a great fit for the directions we had been given, but we wanted to be very careful to say "this might be an issue and should be investigated in more detail" rather than "this is a problem and we fix it with [x]." TL;DR: Taking the hard line is often a bad call, but calling for something to be looked into (with cause) is often wise. If you read the newsgroup post to the end, this is exactly what the author does, albeit with some important context to the issue omitted.
toxican 12y ago
Any idea when we can expect that feature in a regular release of FF? And any idea if it'll be enabled by default (doubt it, but I can dream)
- rockdoe 12y ago
  It might already be in regular releases, I referred to Nightly because that's what I use, and IIRC it was added there already quite a while ago.
- cpeterso 12y ago
  The Tracking Protection feature is available in Firefox 36, the current release channel version. It is not exposed in the preferences UI yet, but you can flip the "privacy.trackingprotection.enabled" about:config pref. To verify that Tracking Protection is working, visit cnn.com or nytimes.com and look for the shield icon in the address bar. On my laptop, cnn.com takes 18 seconds to load without tracking protection and 4 seconds with it. If you find a website that is broken by Tracking Protection, please file a bug on Bugzilla in the "Core :: DOM: Security" component. You can click the shield icon to disable Tracking Protection for individual websites. Tracking Protection is not an ad blocker, but some ads will be blocked as a side effect. Mozilla's prototype list is currently based on Disconnect's tracking list: http://services.disconnect.me/disconnect-plaintext.json http://services.disconnect.me/disconnect-plaintext.json Will Tracking Protection be enabled by default? I don't know. Mozilla must walk a narrow line between protecting user privacy and angering publishers such that they block Firefox users. (I work for Mozilla, but not on the Tracking Protection project.)
  - pbhjpbhj 12y ago
    >Mozilla must walk a narrow line between protecting user privacy and angering publishers such that they block Firefox users. // Is there any precedent for that, it sounds impossible, that publishers would block one of the major browser brands like this; wouldn't it just mean people would use UA switchers? The only reason FF wouldn't want to serve it users like this, that I can see, is so as not to annoy those they're in commercial relationships with like the company they forced the browser toolbar button on to everyone's Firefox to get sponsorship from.
arbitrage 12y ago
> Not worthy to be left over to whiners that offer no solutions. This is not a fair criticism. I can tell someone, "Hey dude, your house is on fire" without having to offer them either a bucket of water or a new house. This type of argument is frequently used to forestall any criticism whatsoever. Bad supervisors often say things like, "don't give me complaints without also giving me a solution." It's sloppy thinking, and rejects valuable feedback.
- rockdoe 12y ago
  I couldn't disagree more strongly. There IS a solution. There are even multiple ones. The critics are pointing out that a particular one they focus one isn't perfect on their arbitrary metrics, and so they claim it isn't good. "I dislike it that the user-friendly software I use (as opposed to TBB) phones home to check for updates and track metrics" isn't valuable feedback. It's stating the obvious without proper qualification. It's ignoring the trade-offs that are obvious. It's not constructive. You're the person complaining to the fire brigade because they made your house wet. Really, your post is the kind of thing that must sit framed in every Internet Troll cave. Because that sure is everybodies favorite internet hobby: complain loudly about everything, offer no solutions, and then whine even harder when the authors that are working to make things better (sometimes for free) quit in disgust. And the entitlement in the replies, you cannot be serious. Yes, you're all entitled to whine, I'm sorry, point out flaws, all day on the internet. Congrats.
  - wernercd 12y ago
    He isn't saying their isn't a solution... he's saying that you don't have to offer a problem AND a solution at the same time. He's right: There shouldn't be an "All or Nothing" mentality. There are times and places where a problem shouldn't be mentioned without a solution... There are also times and places where bring up a problem is itself important enough to warrant a talk WITHOUT a solution. Ignoring the fact that both extremes exist is a larger part of problem in having any kind of constructive conversation these days. "If you don't agree with me 100%, you're an idiot, a troll and your mom should be shot" type of attitude is a troll in of itself and a major problem blocking any kind of conversation on a multitude of topics. Why can't the problem be discussed without forcing the conversation down the "this is the solution..." path?
makeitsuckless 12y ago
I think the author would prefer permission and transparency. In other words informed consent.
- ForHackernews 12y ago
  Ghostery, at least, already does a pretty good job (IMHO) of this: https://www.ghostery.com/en/faq#q5-general https://www.ghostery.com/en/faq#q5-general
  - makeitsuckless 12y ago
    The article suggests Ghostery sends data anyway. Also, the non-denial denial in the next FAQ item (https://www.ghostery.com/en/faq#q6-general https://www.ghostery.com/en/faq#q6-general) sets off all kinds of alarm bells.
    - ForHackernews 12y ago
      Huh? How is that a non-denial denial? The question is "How do I know that's all you collect?" and the answer is "You can verify it yourself by examining the source code."
blub 12y ago
These addons are installed from the Mozilla addons website and Firefox can check automatically for addon updates. Complaining that software is phoning home is perfectly legitimate. It should ask for consent and at a minimum tell users what information is gathered and for which purposes it is used.
JustSomeNobody 12y ago
I am OK with people pointing out things that are/could be wrong without offering a solution. There are usually more solutions to a problem than we need, so why muddy the waters.
JoshTriplett 12y ago
> So what would the author prefer? That security sensitive software doesn't check for updates? Addons should not be doing their own updates; the browser should keep them up to date.
cpeterso 12y ago
btw, Mozilla's Tracking Protection list doesn't use Google's SafeBrowsing service or list (which is malware list, not a tracker list). It talks to a Mozilla server, specified by in the "browser.trackingprotection.gethashURL" about:config pref: https://tracking.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%VERSION%&pver=2.2 https://tracking.services.mozilla.com/gethash?client=SAFEBRO.... Mozilla's list is currently based on Disconnect's tracking list: http://services.disconnect.me/disconnect-plaintext.json http://services.disconnect.me/disconnect-plaintext.json.
hobarrera 12y ago
> So what would the author prefer? That security sensitive software doesn't check for updates? Considering that we normally use the OS's distribution channels (repositories for *nix, markets for windows/os x), it's completely useless for me that any software calls home to check for updates. My OS handles this already.

Dirlewanger 12y ago

How else is one supposed to react to this other than with cynicism? This is the nature of going on the Internet, you will be tracked whether you like it or not. No one is anonymous. The Internet, while being one of the greatest inventions by mankind, has succumbed like all the others to the maladies of greed. Unless some billionaire Elon Musk-esque figure funds a private service to actually not, really, no-for-real track you, it won't happen. Personal incentives motivate people, and until this hypothetical billionaire sees an incentive other than profit, it's not happening.

6a68 12y ago
> How else is one supposed to react to this other than with cynicism? How about empowerment instead of cynicism? Maybe it's possible to build browsers and advertising and mobile devices that don't relentlessly erode privacy. I work at Mozilla to help build that tech. I firmly believe the dystopian corporate future isn't the only option. You should check us out: https://www.mozilla.org/mission https://www.mozilla.org/mission
- whoopdedo 12y ago
  > Maybe it's possible to build browsers and advertising and mobile devices that don't relentlessly erode privacy. That's nice a nice sentiment. I'd be less skeptical if Firefox didn't change my default search engine behind my back. (After updating Android from 31 to 36.)
  - rockdoe 12y ago
    If you changed the defaults, it was kept. If you never set a search engine, the shipped default was changed (and clearly mentioned as such in the release notes not to mention all over the press, so saying "behind my back" is quite funny).
    - talmand 12y ago
      Just to play devil's advocate, what if the default was the choice the user wanted?

SippinLean 12y ago

Ghostery has addressed this elsewhere: http://www.reddit.com/r/IAmA/comments/1c4wjz/we_are_the_ghostery_team_askusanything_especially/c9d1chg http://www.reddit.com/r/IAmA/comments/1c4wjz/we_are_the_ghos... >Ghostery is supported by Ghostrank, our 100% opt-in feature that collects information about the trackers you see and the sites on which you see them. Our parent company, Evidon, packages that information and sells it back to sites who use it for privacy, performance, and security audits; and also ad tech companies who use it for competitive intelligence about each other. >That information is totally anonymous - it's all intelligence about the tracking industry, none about our users. And Ghostery works exactly the same whether you choose to share that with us or not.

samspot 12y ago
According to the article this phone home feature activates even when you uncheck all the share options.
- talmand 12y ago
  But at that point, what exactly is it phoning home about? If it's still sharing the data you explicitly refused to share, then that's one thing. If it's simply asking home if there's an update, then that's something totally different.
  - bsder 12y ago
    No, it's not. Firefox is managing extension updates already. As an app developer, you don't need to know this data. As a security surface, you really don't want this data in real-time. It makes you a target. I presume the problem is that Firefox isn't sharing this install/update data with the extension developers. So, they're trying to collect it themselves.
    - talmand 12y ago
      So, you are saying that every single extension in existence uses Mozilla's update feature and doesn't have an internal system for updating? Because it seems to me I've seen a few that seem to update themselves with no involvement of the add-on panel of Firefox.

wiggumz 12y ago

To me the key question is whether these checks are anonymous. If not -- if Firefox or a plug-in is sending a unique ID, than any advertiser or government agency could pay for that tracking information and then your privacy would be toast, at least until you can reset that ID.

kpcyrd 12y ago
Even if there's no unique ID, if you've installed a lot of plugins this combination can uniquely identify you. If you query addon updates daily, they could associate your IP of the day with your "I have installed these addons"-fingerprint. A debian style update mechanism could solve this, but this would be really bandwidth expensive.
- hackuser 12y ago
  > Even if there's no unique ID, if you've installed a lot of plugins this combination can uniquely identify you This is a good thing to remember, but I'm not sure it undermines the parent's point. No matter what security you use for anything, you always are exposed to another threat; that doesn't make all security useless. The value of security is to make attacks more difficult.
rockdoe 12y ago
I don't understand your post because it's full of blanket meaningless statements. A government agency doesn't need to pay anything, they could use legal means to extract the information. I don't think there's anything stopping plug-ins from sending unique IDs. SafeBrowsing uses a cookie that makes up a unqiue ID. (The latter discussion is well documented in Mozilla's Bugzilla) But what tracking information would make your privacy toast? Privacy has levels. SafeBrowsing leaks your WAN IP to Google. (You already leak this to every site you visit) Plug-ins likely leak details about the plugin configuration (as Ghostery does). What's the value there?
aw3c2 12y ago
I consider my IP address to be private information. If I chose to disclose it to a site, ok, but I don't mean to tell third-parties about it.

ikeboy 12y ago

What exactly is the problem here? If you care about security, use the TBB, each session is still unique because private browsing. If you really care and use tails or whonix, this still won't de-anonymize you. If you aren't doing that, any website you visit gets your ip. I'm trying to figure out what attack model you'd have a reasonable basis to think you were protected against, except for the fact that these plugins "phone" home. If you're using a setup in which that matters, you've already lost.

rockdoe 12y ago
You've articulated this better than I have. By default, combinations like Firefox+SafeBrowsing+Ghostery+Adblock make an uninformed user (or informed users who prefers convenience) safer against a given adversary: advertising agencies, trackers, malicious sites. They do not protect you from the government, and they won't protect you from Google. To reach this level of protection and user-friendliness, they rely on automated updates, and the use of metrics to improve the software. If your thread model is different, and your adversary includes Google or the government, there are solutions too like TBB. But you will give up on the convenience that (drumroll) companies like Google provide.
- rockboe 12y ago
  TBB offers a speedy and modern browsing experience. I use it for everything, and wouldn't hesitate to recommend it. You can watch Youtube videos, download large files, and browse most websites without a hitch. You could sign up for G+ over Tor and get most of the purported benefits of being tracked by Google without tying your browsing activity to your real name or IP.
  - ikeboy 12y ago
    Doesn't Google now require a phone verification to sign up, thus tying everything to a real id? And you don't get Cloudflare bs all the time on tor? And have you ever compared speed on downloading large files, or latency? It's bad enough to make me only use it when really needed and not everyday usage.
12y ago

JoergR 12y ago

Oh god the paranoia in this email...how is someone wanting to improve their tool capitalism or a business model. Maybe it's just someone trying to ... oh I don't know ... making their product better by understanding how it's used?

godgod 12y ago

Is there anything we can trust these days? My god...everything we do is tracked.

Animats 12y ago

Several popular Firefox privacy/security add-ons have become much worse in the last year. BlockSite added ads and full tracking of user browsing. (That one is really bad.) AdBlock Plus added a "whitelist" of ads they let through. (The advertisers pay AdBlock) Firefox itself reports installed add-ons to Mozilla AMO each day for tracking and update purposes. Add-ons don't need to check for updates themselves.

flanbiscuit 12y ago
Is this there an open source alternative to Adblock plus?
- rockdoe 12y ago
  uBlock is getting popular fast, but note AdBlock Plus itself is also open source.
  - flanbiscuit 12y ago
    I didn't realize that. I'm going to check out the source to see just which sites that are whitelisting
    - lewisje 12y ago
      It's not in the source code, but instead in a subscription that ABP uses by default (it remembers if you unchecked "Allow some non-intrusive advertising" so it doesn't re-enable this list on every update): https://adblockplus.org/en/acceptable-ads https://adblockplus.org/en/acceptable-ads This is the subscription, which was originally linked from that page (but it now links to the Acceptable Ads subforum, which has a sticky that links to this subscription): https://easylist-downloads.adblockplus.org/exceptionrules.txt https://easylist-downloads.adblockplus.org/exceptionrules.tx...
- UntitledNo4 12y ago
  I don't know if disconnect.me is an exact alternative to AdBlock since I have never used AdBlock, but I like what it's doing and it's open source. https://disconnect.me/opensource https://disconnect.me/opensource

longsleep 12y ago

Check out Iridium Browser. We try hard to build a Chromium which does not phone home (to Google). It's work in progress but completely open and transparent. https://iridiumbrowser.de/about https://iridiumbrowser.de/about

xorcist 12y ago

Move to uBlock already! It's faster, on less resources, does what Adblock and Ghostery does, and is so far void of any dubious business model. Back on topic, I believe the author points out things that you need to be aware of, especially if you use tor. They made the Tor Browser for a reason. Use it!

ikeboy 12y ago
Last I heard the person controlling the repo was doing funny stuff like removing the info of the creators and there was some dispute over control. Any idea what's up?
- meikj 12y ago
  The original author now maintains "uBlock Origin" because of this funny business (see https://github.com/gorhill/uBlock/ https://github.com/gorhill/uBlock/).
- gorhill 12y ago
  > removing the info of the creators More accurately it was about importing code changes manually without attribution, thus forfeiting authorship info in the commits. I believe it's all resolved now. The person is a kid (to me), I had no idea, so when I learned this I see this differently now, he was just being misguided. I originally thought I was dealing with a fully grown adult, so I did not hold back on the criticism. My own mistake was to not consider I was maybe dealing with such a young person.
- XzetaU8 12y ago
  Chris's (chrisaljoudi) video response on the issue https://www.youtube.com/watch?v=_D1TpddtVUA https://www.youtube.com/watch?v=_D1TpddtVUA More here: https://github.com/gorhill/uBlock/issues/130# https://github.com/gorhill/uBlock/issues/130#

brudgers 12y ago

The fundamental dilemma in privacy is the same as for security and Ken Thompson nailed it thirty years ago.[1] You have to trust somebody. If I didn't trust the folks at Mozilla and Ghostery and NoScript more than Google, I'd run Chrome and leave JavaScript and Cookies on by default. If I trusted Facebook and LinkedIn more, I'd stay logged in. I don't so I don't. [1]: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html

raintrees 12y ago

Possibly a naive question: Wouldn't hosts entries block this? i.e. informaction.com 127.0.0.1, etc. If so, then one would only comment out the entries when specifically after updates, otherwise they run as-is, and no phone home problem. Although this depends on a browser using the host system's specified DNS: I seem to have caught Chrome ignoring my entries in favor of Goggle's DNS (on Linux) whilst doing web design for a client. :(

oldmanjay 12y ago
Useless comment, downvote/ignore at will; If this were Slashdot, you would have just made a friend for life in APK.
- raintrees 12y ago
  Thanks for the reference, I had never run into APK as a meme/topic. As to the HOSTS question, I am currently working through Terpstra's SAMBA-3 By Example, and after spending enough time on small business networks chasing down odd stuff every time a Microsoft Small Business Server goes down (runs its own DNS and DHCP servers for the LANs in question), I am beginning to consider static mapping some of these smaller networks for better resiliency, which seems to be a frequent consideration of that author. I apologize for the naivete, but I did specifically label my comment as such, and my question was an honest one with a simplistic security model in mind, when it comes to specific outside resources that may be untrustworthy. edit: And that search for APK derived my answer at pineight.com, so again, thanks.
  - oldmanjay 12y ago
    Just to be clear, I was saying my comment was useless, not yours.
    - raintrees 12y ago
      Thank you, I did misunderstand and was a bit disappointed my comment was taken as useless. It concerns me when I misunderstand protocol...

wsha 12y ago

Reading the source code, I find this: function recordInstall() { if (utils.prefs('install_recorded')) { return; } sendReq('install'); } So the if statement that the OP highlights does not actually phone every time it is called like the OP claims, but only on the first install. The message that the add-on sends to ghostery.com includes the Ghostrank preference, the version of Ghostery, the OS, and the Firefox version (Android or desktop). That said, it does appear that the add-on phones home on each upgrade, and I don't see anything in the Ghostery Privacy Policy about this (it only discusses GhostRank).

nijiko 12y ago
Yes, its an ongoing issue that people are increasingly unable to read simple if statements. The world has been plagued with academics attempting to analyze the simplest of statements without success. This is what led us to form the "Leave No Academic Behind" (LNAB) group. To inform academics in the err of their ways and show them the path to success. There have been increase in tin-foil theories about these scripts even when the source is available and very easy to read through. It honestly blows my mind.

ddp 12y ago

So Ghostery phones home. Until someone tells me that it doesn't block what it purports to block, the alternative is worse.