Hacker News Reader

Comment by johnnydoebk | Hacker News Reader

Well, sending some user files to Ukrainian server is a bug.

But sending hashes of your downloads to Google [1][2] is a feature, right?

1. https://support.mozilla.org/en-US/kb/how-does-phishing-and-m... 2. https://bugzilla.mozilla.org/show_bug.cgi?id=1138721

View on HN

The first page says: "There are two times when Firefox will communicate with Mozilla’s partners while using Phishing and Malware Protection. The first is during the regular updates to the lists of reporting phishing and malware sites. No information about you or the sites you visit is communicated during list updates. The second is in the event that you encounter a reported phishing or malware site. Before blocking the site, Firefox will request a double-check to ensure that the reported site has not been removed from the list since your last update." That seems pretty reasonable. But the second one looks like it checks every executable file you download. Why isn't that mentioned on the FAQ?

It is? Same FAQ page you listed:

"When you download an application file, Firefox will verify the signature. If it is signed, Firefox then compares the signature with a list of known safe publishers. For files that are not identified by the lists as “safe” (allowed) or as “malware” (blocked), Firefox asks Google’s Safe Browsing service if the software is safe by sending it some of the download’s metadata."

I don't suppose I could just disable that part, without disabling the part I quoted above?

You can in about:config, just Google for it.

Is this the list?

https://dxr.mozilla.org/mozilla-central/source/toolkit/compo...

Just executables, identified by file extension and if you are on Windows, .zip files as well.

How can I disable this.

https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...

Reply on news.ycombinator.com