Hacker News Reader

I was hoping mozilla would have their users' back, but a default install of Firefox also makes multiple connections to mozilla, google and other domains when started.

Firefox checks for updates, and will update the malware/phishing databases a bit after startup. That's actually the same SafeBrowsing the OP mentions. All of this can be toggled. I'm not sure what your vague "other domains" is.

I'm a bit puzzled at the extreme shortsightedness of a browser checking for security updates being branded as "not having their users' back".

Isn't also shortsighted to expect every application to implement its own system for checking for security updates? Wouldn't it be more secure to have this managed by the OS or a package manager instead of hoping every application does it correctly?

That depends on whether the OS or package manager does a better job of providing security updates, or the application does.

Historically, browsers -- because of their enormous potential risk (easy to exploit) -- have done a better job of providing security updates quickly than have other tools.

That's only true if the OS has a solid, secure and open package manager. Linux users have had that since the mid-90s but it still doesn't exist for Windows or OS X users unless you count their respective app stores or are talking about a few niches (Flash, drivers) where Microsoft is willing to distribute things through Windows Update.

At least Mozilla documents every connection made and explains why they're made, and how to disable them:

https://support.mozilla.org/en-US/kb/how-stop-firefox-making...

This is about Chromium, not Chrome. A lot of people assume that Chromium is safer because things like this should get caught by the community.

I think the lesson to be learned here is that FOSS can be just as dangerous as commercial software if not enough people are inspecting the code and following development. It seems there are a lot of people who unconditionally trust anything that's open-source.

I have been told that I am perhaps being unfair to Mozilla...For reference, here are the connections that Firefox tries to establish immediately after startup

So: It connects to Mozilla itself and to Google (specifically their server for the malware/phishing DB). The fact that Ghostery is in there is because you have third party addons installed.

FWIW shavar.prod.mozaws.net is a Mozilla server which updates the blocklist for Tracking Protection. Somewhat ironic you're complaining about it given the context.

The flipside: https://groups.google.com/d/msg/mozilla.dev.planning/wBgLRXC...

"That said, the fact that Linux distros might switch off Telemetry and [Firefox Health Report] by default causes issues right in that way: they are undercounted and [Mozilla] may disregard them completely in data-driven decisions. If you are a Linux distro package manager, think about that."

These requests are trivial to detect and block with a proper gateway firewall like pfsense or others. Consumer grade firewalls just don't have enough options, or resources to support those options.

Trust, but verify.

They do have the user's back. That means not wearing a tin foil hat. In order for a modern browser to work in a halfway decent manner, they need to ensure that things are reasonably up to date, that developers see crash reports so they can discover bugs and security flaws before someone malicious does, and that lists of malicious sites get updated. Not checking for updates, not providing bug reports is the opposite of good software hygiene.

> Some extensions (notably NoScript and Ghostery) ping the mothership.

could you explain what this means? Been using uBlockOrigin+NoScript+Ghostery combo for quite a some time now and never realized how NoScript might be unsafe

I'm going to guess they use lists of exceptions (NoScript) or of trackers (Ghostery) that need to be updated.

I guess it's a cost benefit. Does noscript block more than it leaks? Given the noscript is integrated into the tor browser bundle it can't be that bad... Right? We hope...

NoScript is unfortunately quite sketchy, I don't use it any more.

It has a whitelist supposedly to not break "top websites", but this list contained IMO some questionable choices last I checked it. It also tries to connect to the dev's website for no reason at all (addons are updated directly from Firefox) and after updates, "to show the release notes".

Last but not least, this is the same dev which got involved in a scandal for trying to underhandedly whitelist the said website into an ad-blocking addon.

What list is that? I'm looking at it and I'm pretty sure I personally whitelisted all of those domains. The only ones that seem to have come from NoScript are the about:... ones

I reinstalled it to check again and it seems you are correct, there's nothing except about:* links. I remember it had some big portal websites I hadn't visited and would not enable JS for, however I am willing to accept I was wrong. Unfortunately, I can't edit my initial comment any more.

Thanks for checking and sorry for my confusing initial post...

Wow, didn't know that. Any suggestions for NoScript alternatives?

Perfect is the enemy of better. As long as you stay away from browsers with strong for-profit origins, especially Google who thrives on data mining, you'll be better off.

Yeah hold on let me fire up Opera. No. What do you suggest? Compile Chromium from source?

Firefox. Explorer. Safari. All three don't make their money off of data-mining / ad revenue.

Not that I'm advocating for them (I use Chrome myself), but those fit what the parent suggested.

You should really read up on where Mozilla's money comes from. See the financing section of https://en.m.wikipedia.org/wiki/Mozilla_Foundation

From selling its "default search engine" spot -- I'm on this web business professionally since 1995, I know that.

That's not direct ad sales and Mozilla wasn't created with the specific purposes to sell ads or collect private information, nor is owned by an ad-selling company.

Besides you can change the default search engine in a heartbeat.

I certainly consider that funding by direct ad sales. It's like any other affiliate model: your contribution is to get their product to be sold.

Someone said that that all of those call home as well. I need a browser that just lets me browse instead of filling me with constant "1984-esque" anxiety and paranoia for every URL I go to, and apparently all the extensions I run ALSO call home and leave a uniquely identifying finger print.

Honestly I'm moving to backend work and using a terminal browser. This is so fucking stupid. Wish there was at least one program on my computer that isn't trying to constantly stab me in the back.

>Someone said that that all of those call home as well

Obviously, since all have update-check (and auto-update) features, live content (e.g. intro page), etc.

That's not the same as mining your every search, and they don't own an add company or anything.

>I need a browser that just lets me browse instead of filling me with constant "1984-esque" anxiety and paranoia for every URL I go to, and apparently all the extensions I run ALSO call home and leave a uniquely identifying finger print.

It's even worse: EVERY IP (and/or page) you visit is registered on your ISP.

About apps phoning home specifically, you can install an application firewall like Little Snitch and be warned and in control of any such attempt.

It's not something that you should trust on the browser vendors not to do, anyway...

Browsers don't make money at all, not directly, as you know.

Microsoft pulls in 11 figures a year in online advertising revenue. As of earlier this year, Apple was still earning more mobile ad revenue than any other firm. And Mozilla is funded almost entirely by companies that earn billions in online ad revenue like Yahoo and Google.

>Browsers don't make money at all, not directly, as you know.

Which is neither here, not there. As I wrote those three browsers don't make money off of ad revenue and/or private data. Chrome does.

Whether the money are made directly or indirectly is beside the point for the purposes of the discussion.

>Microsoft pulls in 11 figures a year in online advertising revenue. As of earlier this year, Apple was still earning more mobile ad revenue than any other firm. And Mozilla is funded almost entirely by companies that earn billions in online ad revenue like Yahoo and Google.

Not that relevant either. Apple sells display ads (iAds etc) and that's it. They don't deal in personal data. Mozilla even less -- whether Yahoo/Google pays it to be the default search engine or not.

Apple sells targeted advertising and their T&C say they may use data for targeting.

Opera 12 still works for most web sites (including HN).

True, but it will need someone with magic touch soon to binary patch OpenSSL, more and more websites require ECDSA (cloudflare giving out free certs)

Im seeing more and more Error 40 every week :(

Other than elliptic curve BS Opera 12 is a perfect browser for me.

It would be nice if there was an extension/script that enabled "max privacy mode" by frobbing all these config bits.

Where do you think Mozilla makes most of its money? Hint: it ain't donations.

They get money from Yahoo for putting it as their default search engine in the USA.

What was your point exactly? I fail to see any relation here.

Is it Yahoo again? I thought it was Bing now. But it's advertising. It's advertising for whomever gets their shitty search engine in the prime real estate.

I believe yahoo search is bing.

...and don't forget: WGET is a "hacker tool"