Hacker News Reader

Comment by bigbugbag | Hacker News Reader

Maybe, but Mozilla has a quite a record for using firefox for surveillance and spying purpose, the early versions of firefox had a proprietary modules just for this purpose and the recent version have 'telemetry'.

AFAIK f-droid always had a warning about firefox containing and promoting non free in addition of tracking users

from https://f-droid.org/wiki/page/org.mozilla.firefox :

This app has the NonFreeAdd Antifeature. This app has the Tracking Antifeature. This app has the UpstreamNonFree Antifeature.

View on HN

It is not surveillance or spying ffs!!!! It is telemetry, which is anonymized data for the purpose of statistics and crash analysis.

remember, you can check the source code. You can build your own version. Telemetry helps people. Telemetry helps Mozilla deliver better firefox. STOP SPREADING FUD.

Im sure ad companies claim much the same thing, tracking is just telemetry for statistical anonymized bulk purposes, that is really just benefiting the user!

The point is you cant have it both ways, both decrying tracking of users and then actively enaging in it, and agressively defending it when it comes to light.

Except for the part where you completely ignored their point that you and anyone else with security concerns can conduct their own audit of the code and verify whether or not the telemetry functionality is performing in the manner described.

show me where i can audit the google play store analytics code, or what is running on their servers.

Focus and Klar do not use the Google Play Store Analytics. Mozilla has their own Telemetry service. This documentation is a good start: https://github.com/mozilla-mobile/focus-android/wiki/Telemet...

You have to understand how extremely strict Mozilla is with using third-party services for things like crash reporting and telemetry. It is extremely difficult to find services that meet our very high standard for privacy.

Yet this thread is about how the firefox APKs contain google analytics code....

My guess is that it is a dependency of the Adjust SDK that Focus uses. See https://github.com/adjust/android_sdk/blob/master/README.md

Wait... Focus doesn't use Google Analytics because they don't meet your very high standards for privacy. But it does use Adjust, which means Adjust does meet your very high standards, even though it uses Google Analytics?

But Adjust only comes into play when the app is installed by clicking on a Google ad campaign. So at that point, Google already knows you've clicked on the ad and installed the app (because that's how they bill Mozilla).

I don’t think Adjust is for Google ad campaigns actually. It is used for links we put in our emails or in Firefox desktop. Or for ads that we buy on Facebook. I don’t think there is any connection to google.

This is a misunderstanding. Adjust does not use google analytics. You are connecting unrelated things. The existence of a library, which actually is not a google analytics library, does not mean at all this app talks to google servers.

AFAIK Focus and Adjust make no connections to google. Check the source?

Focus is an open source project with no secrets. It is easy to verify your claims by looking at the code.

The telemetry is documented in detail at https://github.com/mozilla-mobile/focus-android/wiki/Telemet...

We also include Adjust in Focus (not in Klar) for attribution tracking - to understand where the install came from. (This is useful if you are spending money on campaigns and you would like to understand what campaigns are the most effective)

If you have questions or suggestions, check the https://github.com/mozilla-mobile/focus-android/blob/master/... for ways to reach the team.

Mozilla can solve this problem the right way by doing what debian does when it wants to collect statistics: Ask users if they want to donate their information to Mozilla on first run or during the installer.

Recording users' behavior by default with informing the user clearly and giving him the option to opt-out is abhorrent, regardless of the benignity of the reason behind it.

Disclosure: I use firefox, but periodically strip all relevant hidden add-ons and disable all information sending possible.

> Mozilla can solve this problem the right way by doing what debian does when it wants to collect statistics: Ask users if they want to donate their information to Mozilla on first run or during the installer.

> Recording users' behavior by default with informing the user clearly and giving him the option to opt-out is abhorrent, regardless of the benignity of the reason behind it.

(Even as a Firefox/Mozilla fan,) I completely agree that this behavior is what Mozilla should follow everywhere. I always choose to enable telemetry for Firefox because I want to help Mozilla and trust it. But defaults need to be sensible and protective of the user, first and foremost. If most people choose to turn it off on first run when asked for, then the actions to be taken would be educating users (in simple language) on the scope of data collection and improving the reputation of the organization/company behind it.

I dunno. The stats are really super useful for insight into how REAL PEOPLE (not self-selected do-gooders) use the software, and also how new things (like Stylo!) interact with the many unique hardware, driver, software environments people run Firefox on.

Then let's record video and audio from everyone who has installed Firefox to understand even better how the real users use the browser. Let's also record all the sites they visit and all the keys they press on a virtual keyboard.

Is this FUD or serious? Because they are certainly claiming to be the opposite of that these days.

They just recently had a PR disaster because Firefox included Google Analytics in the Addon menu.

https://news.ycombinator.com/item?id=14753546

I don’t think that was a “pr disaster” - vocal minority is loud but not that loud.

This is simply history.

The proprietary module (now long removed) is among the reasons the iceweasel project was born (not the debian one but the GNU one that has been renamed icecat when debian took over the iceweasel name).

It is a known fact that for years 90% or more of mozilla money came from google in exchange for making its search engine the default including tracking through an additional parameter in the URL.

There is waterfox a project to build a firefox version free of the mozilla tracking and crap: https://www.waterfoxproject.org/

    Disabled Encrypted Media Extensions (EME)
    Disabled Web Runtime (deprecated as of 2015)
    Removed Pocket
    Removed Telemetry
    Removed data collection
    Removed startup profiling
    Allow running of all 64-Bit NPAPI plugins
    Allow running of unsigned extensions
    Removal of Sponsored Tiles on New Tab Page
    Addition of Duplicate Tab option
    Locale selector in about:preferences > General

For the android version, the f-droid page does not exist anymore since firefox has been removed from f-droid, but there the wiki archive I linked earlier: https://f-droid.org/wiki/page/org.mozilla.firefox

There used to be a collection of privacy patches to remove all the tracking, leaking and privacy issues but I can't find it through web search, it seems to have been replaced by https://github.com/williex/firefox-privacy

Mozilla insist it is health report, analytics and telemetry which is marketing words for tracking and spying.

> The proprietary module (now long removed) is among the reasons the iceweasel project was born (not the debian one but the GNU one that has been renamed icecat when debian took over the iceweasel name).

Do you have a reference for this? The Wiki page, and the project application, seem just to refer to a desire to avoid non-free plug-ins:

> ALL GNUzilla Programs will basically BE Mozilla Source Builds, with the major exception being the implementation of NO proprietary softwares, including plug-ins, according and adhereing to the GPL.

(http://savannah.gnu.org/task/?4529). That's certainly not inconsistent with what you said, but it seems a stretch to deduce what you said without some other reference.

Iceweasel was born out of trademark issues not telemetry.

https://en.m.wikipedia.org/wiki/GNU_IceCat#history

Mozilla have used various telemetry tools over time to assist with product development. It's possible they're trying to covertly track users but unlikely. It should certainly be known and public but does not necessarily equate to spying.

> It's possible they're trying to covertly track users but unlikely.

No, it's not possible.

Mozilla employees and community members are very talented and capable people, but they are not capable for keeping a nefarious secret :) hehe

Intent makes absolutely no difference. If an application is sending any information, anywhere that is not controlled by the user, and only the user, even if the user can clearly see all of it, it is, by definition, not private. No matter what Mozilla says, anonymity cannot be guaranteed. If they want feedback, they should ask for permission after a crash is detected locally. It should offer the options "No"; "No, never ask again"; and "Yes, ask again for future errors". It should explicitly not offer "Yes, always send" and "Always send" sure as hell should not be the default in a "private browser". The only way you can truly trust someone is when you don't have to.

Reply on news.ycombinator.com