Hacker News Reader

Comment by car_analogy | Hacker News Reader

Suppose you want to do something anonymously.

1. Download installer from Mozilla from your home network - Mozilla now has your home IP and installer ID.

2. Transfer it via USB key to a secure, anonymous computer - one not linked to you, on a network not associated with you, such as public WiFi.

3. Install Firefox using that installer on said computer. It transmits the installer ID to Mozilla, which matches the one given to your home IP, thereby deanonymizing you.

4. Mozilla receives a warrant for this information, or it is hacked, or the organization is infiltrated by a single government or corporate spy.

Edit: It gets worse. Suppose a newspaper IT department takes care of providing Firefox and other trusted software installers to their reporters. Now Mozilla can determine who that newspaper helped with IT, such as journalists or sources. Or if you provide trusted software to your friends, Mozilla gets part of your social graph.

View on HN

You know I let a lot of important things in Firefox slide (like the poor Webspeech API support, bad text-to-speech, some missing extensions and a lot of other things) but I still make it a habit to use it over Chrome (and recommend it to everybody) as somewhere in my mind it feels like a small revolt against the giant evil Google corp.

But stuff like this and other shenanigans in the past (like Mr.robot, misuse of funding, etc) is really off-putting sometimes. It really makes me feel naive and just drinking the support open-source kool-aid.

I switched to Brave - no regrets

I'm almost certain Brave would have something like this too as advertising is their business model, right?

It does: https://spyware.neocities.org/articles/brave.html

Suggest everyone here read up on Brave - internally the care for privacy is much higher than Mozilla [I have worked for both] and things like P3A liked here are carefully designed to avoid leaking PII and implemented honestly somewhat begrudgingly.

I did, too. All I can tell you is that when I have Brave running on an M1 with four tabs open, it's consistently using 240MB of memory. When I fire up Firefox Developer Edition with the same tabs open, it starts at 660MB and quickly balloons up to 1.05GB of memory usage.

My experience also. I’ve slowly edged away from Firefox and have primarily been using Brave and Safari for the last 6mos or so. Brave just feels snappier, and it’s close enough to Chrome that most work required websites aren’t broken.

Ive made the opposite switch, many sites were broken in brave (eg google docs, google sheets) and aren’t in firefox

I currently have a number of Google Docs and Sheets open in Brave. Because of your comment, I started poking around. Try as I might, I couldn't break anything. That probably doesn't mean there's absolutely no way anything could be broken, but just anecdotal—I couldn't find anything.

They are still broken, you just can’t see it.

How are the devtools in Brave?

Same as Chrome

They're comparable to Chromium's, if not identical: https://github.com/brave/brave-browser

Because Brave (and chrome, edge, opera) runs on Blink, and Firefox runs on Gecko

People complain about firefox doing shady stuff and then use Brave lmao. Just leaving these here: https://github.com/brave/brave-browser/issues/19125#issuecom...

https://github.com/brave/brave-browser/issues/16611#issuecom...

> Steps to Reproduce

> 1. Open Brave

This is way too funny for me.

The first bug is because of daylight savings the was also in chrome. People mistakenly thought it was to do with brave servers being down.

The second one is people trying to install plugins from the chrome web store, apparently it has to do this through brave servers. I don't think it's entirely unreasonable that when installing a plugin from your browser that your browser has to connect to a server to do so.

Trying to present bugs as some sort of malware is dishonest, the source code is open if it was really phoning home why not just link that code?

>High CPU usage

I have that problem all the time in Firefox

But probably I just opened too many tabs

I'd suggest the Auto Tab Discard extension. It's wonderful.

I tend to open multiple thousands of tabs because Firefox lets me, and it hasn't been a cpu issue on desktop or Android.

Eats battery like Hell on my Android phone.

little snitch pops up more here for updates checks and others i assume for brave (idle, not browsing) than chrome does.

Interestingly this is likely for privacy reasons in a roundabout way. Brave doesn't connect to Google and so had to implement much of the serverside functionality (updates, sync etc) itself.

Lol; this isn't something you should boast about.

You don't regret supporting a guy who wants to ban same sex marriage and pushes covid misinfo?

All people are fallible — by this logic, you should stop buying anything at all. Someone associated with anything you purchase or use just might have a scary opinion you can't tolerate, and we can't have that, can we now? Oh the agony!

Does he use the browser for that? If not, how is it relevant?

From Wikipedia:

> On 6 June 2020, a Twitter user pointed out that Brave inserts affiliate referral codes when users type a URL of Binance into the address bar, which earns Brave money. Further research revealed that Brave redirects the URLs of other cryptocurrency exchange websites, too. In response to the backlash from the users, Brave's CEO apologized and called it a "mistake" and said "we're correcting". [0]

[0] https://en.wikipedia.org/wiki/Brave_(web_browser)#Insertion_...

a browser who does not develop their own code base but reuse google's, with a business model based on monetizing users attention to ads network while pretending to protect privacy and block ads.

I wonder what could go wrong here ? maybe their history of misbehaving with money and injecting affiliate links in users browsing or the security issues and leaks could give us a pointer or two.

I changed my default browser few days ago back to Safari. In Firefox, I would usually click the first two items on the home page which would be photopea or reddit. That day, they put 2 sponsored items for Amazon and Trivago instead at the first 2 spots and I accidentally clicked the amazon one without realizing because that first item was supposed to be Photopea. That was enough to piss me off:

https://i.imgur.com/s7NIfCX.png

Advertising inside of Firefox is going insane, even if it’s just ads for Mozilla. Tabs that opens when you open FF, little lines on the home page, “Big browser takes care of your privacy” starts looking very creepy.

They're desperate. The whole organization is dying.

The whole organization is dying while the CEO gets raises.

Well, they did fire the Christian CEO.

The asshole homophobe who was CEO for like a week? Yeah, he deserved that. If you're going to try to tell people who they can fuck, don't be surprised if they say fuck you right back. He deserved it.

Mozilla was on its downhill slide long before him anyway.

Well he did step down, he still didn't deserve all the ridiculousness that went on, though. glad he was able to make something good out of it.

You can disable the sponsored links.

Yeah, by using a better browser... Mozilla is kinda incompetent these days and shouldn't be trusted with stewardship. All they do is posture and market. All the real engineering seemingly stopped a long time ago.

Arguably Google can't either but at least they provide the engineering talent, if not the ethical leadership. Mozilla just offers spam.

In what areas do you think Chrome demonstrates engineering talent where Firefox is lacking?

Sorry but that's not good enough for a browser whose main selling point is "privacy". You don't get to play the good guy underdog and pull any shit.

These ads are not targeted ones, one may find them intrusive, but they supposedly respect your privacy.

More information about this (and how to disable these ads) can be found here: https://support.mozilla.org/en-US/kb/sponsor-privacy

What do you use for adblocking on safari?

I switched to AdGuard after Safari stopped supporting uBlock Origin.

I use Adblock Pro. I got it for free a while back and it’s perfect. AdGuard is another good one.

/etc/hosts

1Blocker is pretty good, especially if you use iOS (syncs rules, etc). Not free, though. Worth it to turn off annoyances IMHO.

Firefox has no real competitive pressure and no need to improve. Google is their sugar daddy and Mozilla stopped innovating a decade ago. It's just constantly playing catchup while suckling on Google teats, desperately clinging onto relevance. Without Google nobody would pay for their browser.

At this point it'd be better for the web if we standardized on Blink and moved on, cleaning up some of the invasive tracking in Chrome but leaving the renderer intact. Gecko and Safari/Webkit are just holding back the web.

Firefox provides nothing but a bunch of incompatibilities these days and some warm fuzzies that honestly haven't been deserved for years and years. Modern Firefox is slow, bloated spamware.

Modern firefox is called librewolf or waterfox.

It respects privacy and works quite well (Actually much better than chrome based browser on my machine).

Mozilla management seems to be the issue, not firefox itself.

Yeah, but those projects are forever downstream of Firefox, no? Like they still depend on Mozilla to build new features and such, but then remove the Mozilla-y stuff before publishing?

I think the Chromium model has them forking from a shared base, and Google adds their own Chrome bits after that...? Or am I wrong?

Firefox has fixed a lot of issues in their Quantum release. It removed a lot of what you called bloat as well. In tests it uses a lot less memory on average compared to Chrome. The privacy settings have been extended even further in recent years. Chrome’s settings come not even close to it. The extension system is still more flexible than Chrome’s. It has some built-in features such as autoplay stop and audio control that Chrome lacks. I also think you’re vastly overstating the incompatibilities on Firefox.

Finally, isn’t it better if there are multiple browser engines instead of just one? This allows for more innovation and has done so in the past too. The past pretty much proves that Firefox has and still can innovate despite your assertion.

I also wonder why you are stating all this in such a polemic and vulgar fashion. “ suckling on Google teats”, “bloated spamware”. None of this is even remotely accurate. But anyhow, what’s the point?

Sure, you go ahead and believe that. Every release of Firefox I've tried, including the recent ones, have sucked and been full of spam.

I'm angry at them because how the hell did we get here from the beauty of early Firefox and Phoenix? They've become the monster they were trying to fight.

You don't agree with my assertions, that's fine. Its marketshare speaks for itself. People don't trust Mozilla anymore, with good reason.

It's not about trust. It's about convenience. Chrome comes with Android, so it's more convenient to use. Most people already use Google as search engine, and Google spams you to get Chrome, so it's more convenient to just use Chrome since you're also using Google, somehow using both products from the same house should be better, right?

If that's the case, Edge would be clear winner and it's still not. No, Firefox just... isn't good anymore.

I'm old enough to remember the news of a "young kid" taking on Mozilla, IE and Netscape with their super lean Firefox browser, that was 20 years ago. It was meant to be lean, with the ability to install additional optional functionality through Plugins.

Now Firefox is old and bloated (Pocket?). It never got to be "lean" (always struggling with memory leaks, bad performance, etc) and poor compatibility (not Firefox fault, but still Firefox problem).

Yeah, exactly. Somewhere along the way leadership lost their way and made Firefox into bloated adware and kept uglifying it and mutating its interface to be worse and worse every iteration, all while posting flamboyant front-page news that they've made some major innovation. They haven't, they just... sucked even more.

So Google is keeping Firefox alive as a way to stave off anti-trust scrutiny, but crippling it to keep Chrome dominance...?

I honestly don't know why Google keeps funding Mozilla. Maybe it's a "useful fool" type of situation where having an inferior browser they can financially puppeteer helps them set their own standards (via WHATWG), since Firefox tries to keep parity with Chrome. Having another browser toe that line maybe helps legitimize those standards such that Google can remain in control and not worry as much about W3C/Microsoft/Apple domination? I dunno. Just speculating here.

It matters less these days since Microsoft gave up and went Chromium and Apple just doesn't care about its browser. Maybe Google already won and Firefox is on its last breaths?

I hope you don’t use the internet at all if this is your threat model.

The threat model is reasonable behavior + a single warrant or data leak. It may not be the most likely way of compromise, but it's very possible, and such small insecurities add up. Mozilla should be making such compromise less likely, not more.

How do they add up? Having your IP address 10 times won’t make anyone ever of your medical history. It is not cumulative.

They add up in the sense that each increases the likelihood you will be compromised, and reduces the set of activities that you may safely and privately perform.

I can't believe the apologists commenting on this.

Firefox put a lot of effort into tracking download to install behavior. Maybe this is the only violation you know about. There's no reason to continue to believe in Mozilla's good faith. They've been captured, and are 90% dependent on Google revenue.

Discussion here: https://news.ycombinator.com/item?id=28954390

Firefox is dead. It's time to move past denial. It doesn't stand for anything you think it does. I'm sad, too. Time to bury the putrid, rotting corpse.

What're the alternatives to Firefox? The only ones that come to mind are Opera and Brave, and Brave had some controversy too.

What is controversial about Brave? Seems like the best alternative at the moment IMHO

One of many controversies: https://www.techworm.net/2020/06/brave-browser-cryptocurrenc...

Some folks object to the Brave Rewards system and the embedded crypto wallet.

I just disabled all of that. No Chromium browser is my main browser but when I need one, Brave seems like the best option.

If you were to pick between Brave, Vivaldi and I dunno, maybe Edge, just for when you need Chrome-compatibility and pretty much no other reason, which one would you pick and why?

Ungoogled Chromium.

Ungoogled chromium is the most google-less you can go when it comes to using chromium engine.

Honestly forgot this existed. I’ll look into it.

Vivaldi. Like Firefox, it has cross-system syncing (Windows, MacOS, Linux -- including Android & Raspberry Pi).

It is opt-in and also extremely easy to enable/disable.

It also comes with a built-in ad blocker that works really good.

It's fast and doesn't eat your CPU/RAM.

Recommended, 100%.

Disclaimer: Not a Brave shill.

Even without all the controversies, Brave is still Chrome.

Brave is still Chromium you mean. Chrome is a browser by Google. Chromium is the open-source engine.

this: https://spyware.neocities.org/articles/brave.html

this: https://github.com/brave/browser-laptop/blob/master/app/trac...

also this: https://en.wikipedia.org/wiki/Brave_(web_browser)#Controvers...

then this: https://teddit.net/r/FoamList/comments/q4z5js/brave_browser_...

They report anonymised data that can be turned off. They also connect to servers for auto updates and safe browsing checks, everything you would expect of a modern secure browser.

The people upset with brave for auto updates also consider tor browser spyware because it checks for updates LOL.

I read about librewolf the other day which is a fork of firefox.

Edit: BTW what happens if I download Firefox from site like Softpedia.All the people who downloaded Firefox from this website have same identifier?

Yes, the article mentions Mozilla's http repository[0] and some other third party as ways to download it without a unique identifier.

[0] https://ftp.mozilla.org/pub/firefox/releases/

I've been using librewolf for a while after experiencing issue with waterfox.

it is not really a full fork of firefox, it's firefox with a few patches applied and sane default configuration.

I see Vivaldi is good browser, operated by former opera people

I've been using Vivaldi ever since reintroduced tab stacking which I loved from the Opera days. Solid browser, no complaints.

It's closed source, right?

The UI stuff on top of Chromium is closed. They don't want it ripped off I guess. Vivaldi an awesome browser for those who like to customize.

Vivaldi is still Chrome though

Yes, I'm in Vivaldi as well. For now! We need to avoid making software/product choices part of our identity.

A true firefox fan would've raised the alarm years ago, and voted with their feet when it kept moving in the wrong direction and stopped being the best option on the market.

Loving a brand no matter what they do is suboptimal.

Lynx is the only one I trust, but it's quite limited. Everything else has my suspicion.

https://en.m.wikipedia.org/wiki/Lynx_(web_browser)

w3m too.

What's the lynx-but-graphical alternative?

I just want a minimal web view and input a URL. Why doesn't this exist

> What's the lynx-but-graphical alternative?

Dillo or elinks

> I just want a minimal web view and input a URL.

Surf (suckless project)

Also thanks, TIL alternatives do exist

Elinks looks like it hasn't had an update in years. There's a fork of it called Felinks [0] which seems pretty actively maintained. The last release was on December 24, 2021.

[0] https://github.com/rkd77/elinks

It does exist, it's called netsurf[0].

[0]: http://www.netsurf-browser.org/

oh! Thanks

Maybe Min [0] works for you.

[0] https://minbrowser.org/

Opera was sold off to Chinese investors, and I recall stories about it offering sketchy banking/bitcoin services.

LibreWolf is one alternative.

https://librewolf.net/

https://privacytests.org/

Looks great, but their only focus is desktop it seems (ie, no android solution)

Well, to be fair if you run Android that’s another bag of privacy problems. But phones are a whole different discussion. We need more Linux phones!

Check out Mull on Android.

Nyxt,"the hacker's power-browser"?! https://nyxt.atlas.engineer/

Librefox https://github.com/intika/Librefox/

As pointed out elsewhere, this is unmaintained, and you should instead use https://librewolf.net/

Does not work with 1password for me. Seems I'm not the only one: https://www.reddit.com/r/LibreWolf/comments/qom9br/1password...

Careful, Opera is owned by a Chinese company that is controlled by the CCP.

What you want is Vivaldi.

waterfox and librewolf.

then otter, seamonkey, falkon, k-meleon, srware iron, qutebrowser, comodo dragon and comodo icedragon, dooble, midori, epic.

not sure if maxthon and Avant Browser are still a thing

I always thought Otter was just a mobile browser! Thanks for sharing! I love hearing about obscure browsers!

How about we try and fix this rather than walking away? All the alternatives are even worse.

I still often use Lynx, and eww when I am in Emacs.

NetSurf GTK and w3m are still on the list for me

Useless alternatives. you might as well suggest we use gopher. frankly they'd be better as gopher browsers.

Somebody's never been on low-end systems or stuck without a working video driver and can be happy most wikis work through TUI

Ok then how do you plan to fix this? The only outside entity who has any say what direction Mozilla takes Firefox in is the one paying them: Google.

I can. I'd still rather use Firefox than Chrome or Edge when it comes to privacy. "Firefox is dead ... Time to bury the putrid, rotting corpse" is ridiculously dramatic.

Mozilla as an org is a husk of it's former self. They're constantly playing catch up with Firefox, almost abandonwared thunderbird, and have little actual usable innovation. What part of Firefox is "open source" when you can't integrate in your own projects? What's the point when the tech is non portable? Chromium is the clear OS winner, so open and modular you can just make your own browsers.

> What part of Firefox is "open source" when you can't integrate in your own projects?

Let's not mix everything up. For a good debate we need clear ideas. Firefox can be built from sources available under open source licenses, it is sufficient to makes it open source. Being embeddable and modular may be desirable features but it isn't a requirement to be open source.

> What part of Firefox is "open source" when you can't integrate in your own projects?

AFAIK, all of it; there are even full independent forks running around. Just because you can't bend the code to your particular use doesn't make it not FOSS.

> What's the point when the tech is non portable

I know that you meant something else with this, but the wording amused me as currently Firefox is the only up-to-date "portable" browser that lets you carry around your browser profile in a usb stick.

Anything with Chromium deletes your extensions, passwords etc. whenever you open it in a new computer.

You are wrong, portable chromium exists.

https://chromium.woolyss.com/

Yes, they exist and the application is portable. It works when you open it.

But your profile is not fully portable. They have a page explaining exactly what I mean.

https://chromium.woolyss.com/#secure-preferences

What about Vivaldi or Brave?

"What about unmaintained Chrome or Chrome with ads?"

What do you mean with unmaintained Chrome?

Your post makes no sense. No idea what you are trying to say.

I like the idea of Vivaldi and honestly probably would use it, but I've been using Firefox as my primary browser for the last 7 years or so and just don't have a reason to switch.

I also think competition is good and am concerned if Blink became the only browser engine.

You say all this as if Chrome is somehow not even worse

Chrome is worse. Chromium is the open-source engine which is fine until someone like Google turns it into their minion.

You make it sound like Google took Chromium and created Chrome out of it.

It's the other way round.

The two are separate things. Chrome is built on top of the chromium base. I guess technically chromium and chrome v1 were developed and released about the same time so chicken and egg thing.

ever heard of waterfox or librewolf ?

> Firefox is dead. It's time to move past denial. It doesn't stand for anything you think it does. I'm sad, too. Time to bury the putrid, rotting corpse.

I don't disagree, it's just that I need a browser, and there's no real alternatives.

Looking a lot at Librewolf. Have there been any independent audits of it?

I wonder if the Tor people know about this?

Firefox to my eye jumped the shark a long, long time ago, when they took to using deliberate deception during the install process to get people to sign up to a Mozilla account.

Pretty much everything they've introduced for years I've not wanted or disliked.

The saving grace has been that pretty much everything can be turned off in about::config.

I may be wrong, but I think Moz has become a typical larger company, wholly divorced from its users, unable to know what users want, let alone respond.

What Moz as a large company wants is really completely different to what users want, and a unique tracking ID is a shining example of this.

I'll be using Tor, but I my secondary browser now has to change, as this is intolerable.

The mistake is at step 1 when you downloaded Firefox instead of Tor Browser.

Some people use Tor within Firefox via a SOCKS proxy. This might defeat the protection given by Tor.

Right which is why the Tor FAQ says using a browser besides Tor Browser is dangerous and not recommended: https://support.torproject.org/tbb/tbb-9/

It's like how when you're baking a cake, the easiest way to do it is to buy a cake mix and follow the directions on the back. Yes, maybe you can make a tastier cake by changing the directions or using better ingredients, but you also introduced the possibility of the cake exploding. Particularly with anonymity, the trick is to do what everyone else who wants to be anonymous is doing.

...what ingredients are you putting in your cakes?

Flour?

https://daisyflour.com/flour-explosions/

Lmao

Tor is banned in countries where you are most likely to get in trouble for your online activities like China, or more recently, Russia.

Tor supports many kinds of bridges to serve as unlisted "inproxies" to enter the Tor network in an environment that blocks Tor.

> 1. Download installer from Mozilla from your home network - Mozilla now has your home IP and installer ID.

The Apple’s icloud private relay should prevent Mozilla knowing the IP.

Great! And what about all those non-Apple users? Or all those Apple users not on a paid iCloud plan?

> non-Apple users?

Don’t know.. perhaps they might consider to get a gadget with that goddamn safari:-)

> not on a paid iCloud plan

It’s $0.99/month.

Have they tried not being poor?

> Suppose you want to do something anonymously.

> 1. Download installer from Mozilla from your home network - Mozilla now has your home IP and installer ID.

Compile from source?

Of course the "attack" is easy to avoid. But you first have to know about it. Mozilla should not be planting such landmines.

This isn't a landmine in any normal threat model. The average person is concerned with identity theft and perhaps their local law enforcement, not the full weight of domestic or foreign intelligence services.

The average person fears the domestic intelligence service and is not as concerned with local police.

The thousands of people a year murdered by local police (many of whom are unarmed and innocent) would probably disagree.

you’re only off by whatever number of thousands over a thousand you are implying here.

I don’t know whether the OP was thinking of it, but world-wide, it is thousands (https://worldpopulationreview.com/country-rankings/police-ki.... Numbers “include those killed by security forces such as military police and intelligence agents”, but I think removing those would easily keep it ‘thousands’)

You should at least attempt to use real statistics in your comments.

Nothing I said requires a statistic, it is common knowledge US police officers kill roughly 1000 civilians a year on average.

It is also clear from investigative reporting that many police departments have a long history of colluding with local coroners to cover up many additional deaths.

Colin Kaepernick didn't recently start a multimillion dollar fund to aid families of victims in getting secondary independent coroner/autopsy reports without reason.

If the fact that this is necessary doesnt terrify you or the people in your community, then I don't know what to say.

Real statistics that aren't limited to your own jaundiced view of reality I mean.

I haven't seen reliable polling data proving the parent's or my claim. Either of us could be right.

Although, we also haven't seen tens of millions of people protest/petition to defund or reform intelligence services recently.

Without definite data, the fact that we've seen that urgency around local police reform seems like a decent alternate public sentiment indicator.

It may not concern the "average person", but it contributes to the omnipresent surveillance endangering the extraordinary people we rely on to keep an eye on our governments and corporations.

If we only care about the average person, we may as well have Firefox snitch to the NSA and their Russian, Chinese, Indian, etc. equivalents, plus Microsoft, Google, Raytheon, General Electric,..

Now let's think about how much users can trust Firefox's VPN service. Multipurpose telemetry being utilized there too?

Good point. Isn’t their VPN just a rebranded Mullvad VPN with a higher price?

The application at least on macOS appears bespoke as it was missing connect on startup and a few other things I rely on so switched to Mullvad.

Checking the bug tracker, it only does something if you have Firefox Data Collection turned on in the settings. Personally, the first thing I do is turning that off on a fresh install.

considering it sends your unique ID (or download token) during installation, when you disable settings after installation, it's already too late.

it seems there's actually a way to turn it off before installation using enterprise policies, but I have not tried it as I left mozilla's firefox long ago first for waterfox and now librewolf.

I tried that, and it is a time consuming and tedious process which I eventually failed.

I can't remember exactly but Apple also does this with apps. "Downloaded from ...".

Isn't that just storing the domain name from which served the file? I actually find this useful for those times when I can't remember where a file came from but need to use the site again. Having that data in a Get Info windo has been useful and faster than web searching.

Except this is an attribute saved on the file locally on your system, added by your browser when you download it, not something that Apple stores on their servers and tracks.

That's a slight bit different because that file metadata is being assigned on the receiving client side and not from the distributor of the file. Likewise, that info is stored in your Spotlight index, not the file itself and isn't moved with the file (you can look at the raw metadata with the `mdls` command on a Mac and see that it is lost when you move something to a USB stick, or upload it to your own server or something)

That is also annoying but two wrongs don't make a right.

Also Apple seems to just track this to show a prompt as to why they need approval for the install. And it's just stored locally in the metadata.

But yes I wish this prompt could be completely turned off. This isn't just security for the user though, they have a clear financial motive in promoting their app store as an easier option. After all the app store is a huge revenue driver for them on mobile but not on Mac.

Also Apple has done a lot worse things like checking the notarisation online every time an app was launched. They have now cut this back to once every few days since the outcry about it but still it's something you should be able to turn off IMO.

But what do you expect from a closed source OS (yes it is, only the kernel is open). And again, the fact that Apple does it too does not make Mozilla's action less questionable.

I have a hard time viewing Apple's Spotlight metadata as a wrong. It's locally created and stored, it's transparently shown in File info and mdls. It can be purged and edited with xattrs. It doesn't follow the file across computers and you can outright disable file metadata and indexing if you really care enough and I've never seen or heard of any evidence of Apple sending this local data outside your computer. Windows indexes files and creates metadata, even popular Linux desktop distros do it, because it's a usability improvement for most people.

>But yes I wish this prompt could be completely turned off.

defaults write com.apple.LaunchServices LSQuarantine -bool NO

> Mozilla now has your home IP

Since when does Mozilla collect IP addresses?

Any connection to Mozilla's servers reveals your IP to them. Given the amount of telemetry in Firefox, it's foolish to assume they don't log these IPs. And in either case, they could be legally compelled to. But afaik, under US law, they cannot be compelled to subvert their software, e.g. to add such spyware features if they were not already present.

Why would Mozilla need the IP address? It doesn’t seem useful for their telemetry.

What part of Mozilla's behavior makes you assume they don't? It's easy to come up with some dubious internal justification to store IPs (like to determine where to focus internationalization efforts).

It's not even internal justification, it's just plainly the default for practically any web server that does logging. You would have to go out of your way to disable it.

Not logging IPs or establishing controls on it is table-stakes for anyone doing anything serious about privacy.

Yeah, kind of like not embedding each download with a unique ID. Oops...

Yeah, it definitely is. But that doesn't automatically mean they actually did it.

"Best practices" are moot unless they're implemented, and since the default is to log these things, then something (even a blog post from them claiming it's been done) has to exist to show it's there and doing the right thing.

Even if they don't (currently) feel that they need them, they could be compelled by law enforcement to retain logs and forbidden from revealing this fact publicly. Or their network could get infiltrated.

How do you propose to prevent a user from leaking their home IP address to Mozilla without undermining the ability to: * Download the browser * implement a safe browsing mechanism * support automatic updates (which are a critical security feature)

If the updates are signed, then there is no danger in downloading them from a third party mirror. As for finding a mirror, Mozilla could put locations as TXT records in the DNS.

There would still be the problem that someone would have a log of your IP address downloading a Firefox update, but it wouldn't be Mozilla. Also, with a big enough list of mirrors, across 100 different jurisdictions, the probability of any given mirror being subpoenaed and having data on any given user is very small.

As for how to bootstrap the whole thing by letting the user securely download Firefox in the first place, that is of course difficult, but it should be an infinitesimally rare event compared to checking for browser updates. A user could therefore take special care to use public Wi-Fi when doing the initial download.

They had to serve you the file, for which they needed your IP. If they're willing to assign each downloaded client a unique ID what are the odds they are not storing the IP address associated with that unique ID?

Why would Mozilla need the IP address?

Why would they need installer IDs? The question is if they collect it, not if they need it, and all their other behavior suggests that they do collect it.

The article explains why: to figure out why there are more installs than downloads.

Playing your game, why would Mozilla need to know this?

They can probably reach the same conclusions about why there might be more installs than downloads by thinking about it for maybe 5 seconds instead of tracking people.

Easiest explanation off the top of my head, without reading the article, would be IT departments including Firefox in their base image they use on all their standard issue computers, resulting in hundreds and possibly thousands of different installs having the same download ID. That alone by itself would cause an absolutely massive discrepancy between download and install numbers. My company includes Firefox in our base image and it's on at least 200,000 different laptops and desktops, with a handful of different download IDs between them depending on when they got issued the computer.

Not just companies. I somtimes do this at home to save bandwidth / download time and then install software from usb stick.

I wonder of they are confused by apt-get install firefox.

(Joking, but only a little.)

The reasons are easily seen though. Corporate IT departments autodeploying, Linux packaging repos, people compiling from source.

Also, they could just ask, instead of adding more spyware. Like a survey.

Also, if they don't collect it, what's the point in even having it?

...to respond to requests to their server? you can't establish a tcp connection without both ends.

To figure out locale of users.

You seem to be unaware that intelligence services have been hoovering up internet traffic wholesale for decades, and that telcos do it internally as well. Verizon's "supercookie" is a great example.

But Mozilla is not a government agency or a telco.

Are government agencies somehow restricted to compromise telcos but not any other organization?

On the other hand, if intelligence agencies are personally targeting you it's already over. This might help them, but even they can probably get everything they need on you with way less effort.

Are you suggesting in good faith that Mozilla would implement and transmit a unique ID without linking you to your download session? I've never come so close to breaking hacker news etiquette.

What’s your point, that someone can attempt to do something anonymously and fail?

My point is that they failed only because they were betrayed by the free software tool they thought they could trust.

Mozilla has never advertised that their software was designed to keep you anonymous.

They have whole campaigns against Facebook railing against intrusions into privacy.

No, but they advertise that "Firefox automatically protects your privacy while you browse".

https://support.mozilla.org/en-US/kb/enhanced-tracking-prote...

technically they did not lie. “While you browse” is clearly excluding the time whilst installing the browser.

They promote their product by claiming that it protects people's privacy. They do something that can be reasonably interpreted as tracking (which it is, whether it is download/installation tracking as they claim, or user tracking as some people claim).

For the most part, privacy is based upon trust. Trust is earned. You don't earn trust by doing things behind people's backs or claiming that they are technically telling the truth.

Taken straight out of the "terms and conditions apply" fine print playbook :)

It's possible that they are tracking how many times an installer gets used without violating your privacy. Installers can be shared online or you can install it on someone else's computer. It's not like they are specific to a person.

True but why? There just be a really heavy reason to introduce something like this. I don't see it.

They never advertised either they were tracking every download...

No the point is that Mozilla is dishonest about their causes and consistently take actions that are hostile to user's privacy.

Reply on news.ycombinator.com