Firefox 57 delays requests to tracking domains
janbambas.cz
janbambas.cz
I think of this as no more invasive than pre-caching stuff in a page when you see links that are likely to be clicked, or any other browser optimization.
I may be pounding my fist later if the results don't look great, but ultimately, I think Mozilla's heart is in the right place.
I can think of tons of ways to work around this if I thought it was a real issue, I don't. People who want to block analytics, trackers, ad networks, etc... know how, and this doesn't feel like it is targeted at those people, or even squarely at the tracking pixels.
HN-pre-emptive-defend-myself: My company doesn't share or sell data with third parties (it's in our TOS – and could obviously change in some Orwellian future, but we'd have to update the TOS), it's the customer's data, they can use it in the same way they'd use any other data they collect. We don't do cross-domain tracking, or aggregate behavioral information across customers, and the way we've built it, it makes it pretty hard to tie any two visitors together across sites if you were to hypothetically acquire our dataset. We're also working on building tools to comply with GDPR and wipe out data per-request. Anyways, I think a lot of very bad actors have made the space have a bad reputation and I don't blame anyone for blocking everything, or even for hating my company, or generally all analytics.
The ToS and Privacy Policy of an analytics company discloses what the that company may do with their client's users' data, not what the client can do with their own users' data.
There's another Privacy Policy between the client and the user where the client discloses what they may and may not do with user data and the user decides whether to become / remain a user.
There are also laws which dictate the data handling further on behalf of large groups of users, e.g. GDRP for EU citizens and, on this side of the pond, interesting Supreme Court cases being decided about what kind of data users could have property rights to: https://en.wikipedia.org/wiki/Carpenter_v._United_States
I know that's a cop-out – but I can't imagine a system where we could enforce some kind of downstream compliance.
Things like GDPR are a good way to make companies accountable and I look forward to that becoming more broadly accepted.
His example page loaded 94 scripts, which he claimed was representative of many pages.
I know this is the norm, but can we just agree that this is insane?
Some sites I go to, I just see the block badge on UBlock Origin ticking up like a Bitcoin price tracker.
Fitting comparison - we can also expect performance degradation similar to Bitcoin's.
As an example, I just loaded CNN site - it has 28(!) trackers and uses 38(!) different domains. And that's a low number because some of these scripts would load other scripts if I enabled them to run...
That's a super-mainstream site, imagine how many more shady ones have.
Are you the CEO and do you currently own controlling interest? Because if not, then everything that you are saying is worth about as much as a slice of pizza someone dropped in the NYC subway.
(a) he would be fired on the spot by the company itself ( as he is not authorized to speak on behalf of the company )
(b) he would be laughed out the room because he does not control company decisions
The same applies to every single company. Every single one.
Your comment was super rude.
With that said, I actively delete customer data on request, and a terms of service change like this _might_ (very reasonably) prompt someone to request their data to be deleted, and since terms of service are not typically immediately effective without consent, I feel strongly that I would make sure I could remove data for people who do not agree with the new terms of service. What I'm saying, is that I would fight very hard for my customers, like, ridiculously hard.
As said above – I am not the CEO – I don't have controlling interest, and there is absolutely some future where the things I said above are impossible to execute. I have not felt that way yet, and I am very conscious of the possibility if that in the future, and will stay vigilant both for my customers and for my own peace of mind to make sure we're always doing the right thing.
That's the kind of things which make me for the vision of data as liability.
Every person with access can only get it via a bastion VPN with their own key. Access is logged to an external host which they do not have access to. We are SOC2 compliant (just waiting on final certification) and we have regular pen tests both against our code as well as our employees with mock phishing.
As a total aside: it would cost a serious amount of money to exfiltrate the data in bulk, and would cause an obvious strain on our infrastructure. Assuming they get by all the above protections, and are really clever, sure, never say never, but I think we can not assume the worst but prepare for it none the less.
Google Has Dropped Ban on Personally Identifiable Web Tracking | https://news.ycombinator.com/item?id=12760003 (October 2016)
An effective opt-out may help most of the vigilant, but it is in the best interest of those changing the ToS to keep it as confusing/hush-hush as possible.
Also – really bummed you got downvoted – this point is very valid and other folks in my position should take note.
How many people here think that data is removed from BI data lakes when a user deletes the account ( or at +N months )?
[Edit: Downvotes on this one also?]
Ask what happens to customer's data used by business intelligence when customer deletes the account in your company. Do it in email so it is in writing. It would be extremely illuminating.
Ask if what when a customer or your app acting on a behalf of your customer executes a DELETE against your API your API deletes the record or:
1) sets a deleted_at to now which your ORM treats as "deleted"
2) send a message to a queue (Customer XYZ deleted record P) which has multiple subscribers, one of which executes a deletion while the other one dumps the new state into a BI lake/archive dataset/what-if-a-customer-comes-back-would-not-we-want-to-be-able-to-give-them-all-their-data-back database?
I’m not naive. I’ve been working in tech since 1996 when I managed a dial up ISP. I worked at Red Hat the day they IPOed and have been with Heap for almost four years. I was employee number 8, and personally wrote much of the code to remove data from our databases.
We have strict controls and logging around who can access our infra, as is necessary for SOC2 compliance. We have rolling backups (that are read only except by very specific individuals) so even if I got real mad one day and decided to ruin my career, we could restore the data, however, we don’t keep backups indefinitely so when data is deleted or removed with intent, it will eventually be gone in backups too.
I’m not on the board, but I do have influence as I am the head of our solutions and support team. I am a privacy advocate and take a firm stand on protecting my customers’ data and executing their own desires to protect their customers, and I do my best to not only instill these things in my team and company, but also to make policies and controls to make them real.
When I delete data, I don’t rely on a message being sent to a queue. I do not “soft” delete. When our customers ask for their data to be deleted, we delete it without delay.
I will say that sending a message in a queue would be pretty efficient and if we went that route I’d have the consumer of that message verify that the data was deleted.
Ultimately our backing store is Postgres, it’s not rocket science to understand how deleting that data works, we could get into a discussion about how it’s not really deleted until it’s been reallocated, at the DB and at the OS and hardware levels, but I don’t think you’re trying to make that argument.
Is everything perfect? No, that would be naive to say, but we don’t assume it is and work hard to remain accountable.
I’m happy to discuss this or about anything else here or over email, Skype, hangout, in person, etc, but I do want to say that you should challenge your own assumptions a bit more. Not every person or company is inherently bad, naive or ignorant. A lot of people on HN are extremely tenured, bright, and thoughtful, they just usually know better than to comment here, if anything, that is my most naive action.
Why would you do that? You are providing a service to the people that is a pure benefit for them and doesn't harm them at all. Why would anyone want to delete such helpful data?
[Yes] [Read more]
A slow and shitty experience using the web shouldn't be the accepted baseline.
People who know how to block spyware can't block everything. There is a lot that causes the page to hang if not blocked in a certain way, provided that certain way is available via some kind of tooling.
If you have time (definitely not expected) I would like to hear more specifics regarding this aspect of your statement:
> We don't do cross-domain tracking, or aggregate behavioral information across customers
vs. https://heapanalytics.com/terms
> We may also use data in an aggregated form for our own purposes
What that means right now is that we use this data to improve query performance, and for internal monitoring. We do not use that data for commercial purposes, outside of the fact that we are ourselves a business.
Google is selling your data to marketers. Facebook is one giant data-collection/data-sales empire. In theory, the HN collective hates data selling, but in practice, they love the companies that are doing it and their products.
I find it ironic that I come here and see people worshipping the big adtech companies and their tech but then when someone posts a comment about not selling user data, a thousand tin-hat naysayers jump out of the woodwork to flog them to death.
It's OK. It's why I can read the NY Times and a thousand other online newspapers - FOR FREE. It's why I can go to Google and type in "why does my butt burn when I poop" and get an answer - FOR FREE. It's why I can use dozens of adtech and user-data-supported services - FOR FREE. I pay for those things with data about me, my habits, and my browsing history.
I imagine Mozilla is in a similar situation: if too many websites block, they will have to disable the delay or start whitelisting trackers if they do not want to loose users. That is, unless other browsers follow their lead here.
Prisoner's dilemmas all around. It's going to be fun to see what we'll end up with, although I'm optimistic as I haven't heard complaints about this yet, but then again I wouldn't notice any difference myself as I'm already using NoScript.
Apparently Firefox is sitting at 6.1% market share right now[0]. Far behind Chrome and Safari but still quite significant.
[0] https://amosbbatto.wordpress.com/2017/11/21/mozilla-market-s...
Users won't know who to blame. They might blame the site but they're just as likely to blame Firefox, Microsoft, their ISP or a virus. There needs to be a display saying "hey, this site is slow because it's tracking you in 15 different ways, would you like to disable this permanently?".
Slow down pages -> more users bounce -> fewer ad impressions -> less ad revenue.
Slow down pages -> more users frustrated with Firefox -> fewer user share -> Mozilla closes and donates all code to Apache Foundation.
> Slow down pages -> more users bounce -> fewer ad impressions -> less ad revenue.
Game theory is the theory of how agents deal with each other. You left out the most crucial part of agents affecting each other!
They absolutely do care, though. The longer a page takes to load, the less time users will spend on the site, and the more likely users will give up and close the window.
I think there's a lot of interest in optimizing that initial time but less so for the full load.
If this is such an issue and can actually be a performance increase, then someone should release a script with the same functionality. Or optionally make it an opt-in option in settings.
That aside, your position is unrealistic: browsers regularly break non-spec conforming websites. They actually monitor such cases (telemetry) and try to work with popular websites to fix the issue before they ship the breaking update, but it's a tradeoff that is regularly made nonetheless.
Why downvote and no explanation? I want to know if I missed something.
The standard also defines that scripts that are not async have to be executed before later content can be parsed (because they can document.write()). They can still be loaded with any priority the browser wants; they just need to block observable DOM construction.
uBlock origin + noscript
ublock origin is a one man personal project to improve his online browsing experience that he shared with the public and has become the goto reference. It has no whitelist or acceptable ads policy, is a general purpose blocker (blocks trackers, remote fonts, etc.) coming with sane default settings. It does not have the same performance issues adblock plus has.
In short: ditch adblock plus and switch to ublock origins.
You'll find more details here: https://github.com/gorhill/uBlock
Keep the blacklists up to date, and have scripting completely off by default. You get granular control on a wholly different levet than offered by NoScript (which I really no longer see a need for).
Does this mean you have the "scripts" column red and turn them on for individual sites?
Probably Pi-Hole running on. Raspberry Pi. https://pi-hole.net
# before: 0.0.0.0 evil.biz
# after: address=/evil.biz/0.0.0.0
sed 's#^0\.0\.0\.0[[:space:]]*\([^:]*\)$#address=/\1/0.0.0.0#'
conf-dir=/etc/dnsmasq.d
Related discussions (click the 'comments' links): https://hn.algolia.com/?query=netguard&sort=byDate&type=comm...
I run a dedicated pfsense machine (old optiplex 755 with an old ssd) I added a nic to it. All network traffic must physically flow through it (1 nic goes to lan 1 goes directly to the cable modem). It's running pfblockerng and DNSBL with a bunch of sources. It's amazing. I can watch youtube videos on my smart tv in the living room streaming with 0 ads.
It's a low-class business model that is rife with disease. There's no barrier to entry-- literally anybody can do it, there is no filtering of who they'll do business with, and it's a race to the bottom to earn pennies at the expense of their integrity. Despite having actual content of value, they share a business model with a blog farm full of Markov-generated malware-laden shitposts.
Given the now-well-known threats to health and safety that third-party ads present, one does not have the right to get upset when clients insist on using protection when dealing with them.
Set up a Patreon for donations, set up affiliate links or offer subscriber perks if adblocking is cutting into revenue. Either option is far more lucrative, ethical and honest than whoring oneself out for the benefit of some shady ad firm that leaves the user with a nasty case of Bonzi.
Not our problem if they bet on a brittle business model and don't want to adapt. Even more: the web ecosystem was fun and a with a lot more freedom before the invasion of ad based companies. I don't see any problem with some culling of the politically correct parasites.
I cannot make myself care about that, at all.
I am not the person responsible for finding a viable revenue model, that is the responsibility of the content creator. I refuse all ads and tracking, because I value my own attention span, my time, my bandwidth and my privacy.
I am not obligated to watch ads online, just as I am not obligated to stay on a TV channel and stay in the room while ads are running, just as I am not obligated to pay any attention at all to ad billboards.
As an aside, I support several high-quality content creators through Patreon, and several open source projects through donations.
I think you are aware that ads are the emerged part of the iceberg, the big part is the profiling, tracking and data collection going hand in hand with ads.
If ads were unintrusive and not gobbling privacy, then I would not block them as I would not mind them.
Excuse me but I have to go now, local girls want to give me a free ipad that I won by clicking the fart button after subscribing to the newsletter that was blocking the content of the page I finally chose not to read because fk it.
It's just lazy design, or possibly malicious, I'm not sure.
I think we need to standardize the sarcasm tag on the Internet.
Not one of those RFC that no one implements, but something concrete, perhaps baked into the HTML standard. (If the W3C include DRM, they can include sarcasm).
Or maybe something like ISO, but people ignore them too.
/S
There was recently a NYT article on trying to get a ballet shoe emoji (high heel shoes & sexism related) into Unicode.
Sarcasm should be in Unicode!
---
>Sarcasm, Inc. was formed in 2006 to pursue this idea, and with a great deal of effort and undying support from family and friends, the punctuation mark for sarcasm came to life.
This is why America is the greatest country in the world!
Sarcasm Inc even has (sarcastic?) shareholders and apps!
And we all know what is meant by "X, er, that is, Y"; it's even used intentionally in verbal language.
I think it's more that effective sarcasm in text requires the audience to know the viewpoint of the author. So, sarcasm among friends over email can work. Sarcasm in the concluding paragraph of an article can work.
Sarcasm between strangers in comment sections, less so.
This database is already being maintained and used for private browsing. I find it unlikely that an analytics CDN will play cat and mouse with Mozilla just so it's script will load a few milliseconds sooner.
Sounds like a violation of Google's own policies.
body {
animation: -amp-start 8s steps(1,end) 0s 1 normal both;
}
@keyframes -amp-start {
from { visibility: hidden; }
to { visibility: visible; }
}On the other hand, if it silently influences internet traffic, it does in a way censor content and could influence their bottom line.
I would expect this to be an explicit switch.
Edit: clarity
(Edit: I should add that I think you're asking a very valid philosophical question that my opinion as a user of Firefox doesn't fully address)
This seems to imply that doNotTrack would have been successful for its intended purpose had it not been a default setting at one point, which feels like wishful thinking.
Sure, that aspect made it impractical for uncharacteristically privacy-minded companies in the space to support the header, but the vast majority of companies in the business of tracking and advertising would have ignored it anyways, because there's zero consequence for not doing so.
Anyways 95% of the time you just have to disable scripts from the websites to unbreak them.
do not track was never a good idea as respecting it was on a voluntary basis, meaning it was mostly an additional metrics to use to track and profile people who do not want to be tracked. It's a no brainer really that if you did not want to be tracked you should not enable it. Remember ghostery ? same thing all over again.
Firefox marketing is effective but to be clear they have begun changing direction, pursuing a more practical "attracting the masses" approach (a la Signal) rather than paranoid/hyper-vigilant/engineer-style idealism (something some misinterpret Firefox marketing as still claiming), and as a result Firefox has been forced to course-correct several times due to public outcry.
https://news.ycombinator.com/item?id=15940144
A recent eye-opener for me personally was discovering telemetry's switch from opt-in to opt-out as of September.
https://www.mozilla.org/en-US/privacy/firefox/#firefox-by-de... (3 months ago) vs. https://wiki.mozilla.org/Telemetry/FAQ#Is_Telemetry_enabled_... (3 years ago)
Telemetry has been held as one of the main justification for the change as it supposedly showed only a fraction of users used ALSA. It turned out to be a combination of misinterpretation of collected data (installed libpulse does not mean not using ALSA) and a complete ignorance of the real world (most linux distros disable telemetry because privacy, people using ALSA are often the same that take extra measures to protect their privacy hence disabling mozilla spying mechanisms).
As a consequence mozilla pushed hard for package maintainers to enable telemetry in linux distros and sadly most did, see: https://bugzilla.mozilla.org/show_bug.cgi?id=1233687 https://bugzilla.mozilla.org/show_bug.cgi?id=1285195 https://bugzilla.mozilla.org/show_bug.cgi?id=1285201 http://pkgs.fedoraproject.org/cgit/rpms/firefox.git/commit/?...
Compare to this from 7 years ago: https://bugzilla.mozilla.org/show_bug.cgi?id=667577
The fun part was when mozilla people started patronizing users for protecting their privacy and told them that it's their fault if ALSA got dropped and that they should relinquish their privacy instead or they will be ignored:
Second, continuing to opt out of telemetry will just make problems
like this worse. As was stated in this thread, one of the
justifications for removing ALSA support was that the telemetry
numbers showed a very little ALSA usage. If more ALSA users had
telemetry enabled, perhaps the outcome would have been different.
In any case, running without telemetry means not having a say in
data-driven decisions about what configurations Mozilla should
support. It's OK to disable telemetry (that's why it's
user-controllable), but both users and distros that make decisions on
users' behalf should to take into account that if don't let Firefox
send info about your system config to Mozilla, your system config is
invisible to Mozilla's decision making about what to support.
There was no course correction here, ALSA is still out despite the issue being entirely to mozilla implementation and not ALSA abilities, despite this being an edge case for linux netflix users with a specific 5.1 setup and despite someone coming forward to offer to fix and maintain their broken code.
Did I mention that they failed to mention this change in release notes, that firefox displayed a message inviting people to click a link to learn why their browser suddenly lost the ability to play sound but the link was broken and that this was an ESR release?
So when I read some mozilla marketing PR about them pretending to champion user privacy, I'm nonplussed at best.
Thanks for taking the time to document the details of this particular situation which I've never heard about before. I wonder how many other mildly upsetting (?? - per "nonplussed at best") decisions are currently accumulating under the radar. Each time another pops up I'm amazed at how much Mozilla has successfully swept under the rug.
The two I knew of are including Paper by default for some time (after taking heat for this, then acquiring it a year later... though I didn't see it when I just checked) and sticking with opt-_out_ for Google Analytics on the add-ins page. After digging recently thanks to the Mr. Robot stuff I discovered the opt-out Cliqz add-on for Germany and now your anecdote.
Actually it is to be the dominant browser on the market, mozilla name means mosaic killer, as in dethrone NCSA Mosaic and take its place as the n°1 browser by market share and was the internal name for netscape.
They kept the name for the continuation of the effort though the target had moved to IE who actually took over Mosaic. Now the target is google chrome and the historical meaning is lost on most people but the intent is still to have the bigger market share because monies.
Your browser is no longer imposed on you, so switching to Firefox IS doing that thing yourself.
(Honest question, this is a very tricky area)
If Comcast decides to "block" 3rd party tracking and analytics content, would it be ok?
by this argument ad-blockers violate net-neutrality.
Not exactly, network neutrality can mean almost anything. The way it is discussed in the FCC regards ISPs, but you can expand it to anything.
> by this argument ad-blockers violate net-neutrality.
No. And ad-blocker isn't any different from a child filter. It is a tool specifically designed to block certain content explicitly enabled by the user.
And to expand: by your logic, it would be ok then for Chrome to block all links to Firefox?
Or for Microsoft to block all links to other browsers?
No, that wouldn't be OK. But not everything that is not OK is a network neutrality violation.
If you consider browsers an integral part of the internet infrastructure, it is. If not, it isn't. Happy to discuss naming, but it will mostly be useless.
But glad that you agree that Firefox preemptively delaying those sites is not OK.
that kind of snarky comment is not helpful
No, it simply doesn't have anything to do with whether it is internet infrastructure. Prioritizing stuff according to the user's wishes/under the user's control without price discrimination is not a neutrality violation, even when network operators do it.
> But glad that you agree that Firefox preemptively delaying those sites is not OK.
Idiot.
i think your definition muddies the waters. if firefox shipped with a built-in default-on child filter would that be a net neutrality violation in your eyes? if it just slowed down adult content would it violate net neutrality? where even is the line here and is the line meaningful?
I don't know (that's why I'm asking). On one side, you could argue that they are providing a service to users, on the other hand, they become a content gatekeeper if they do it by default.
Chrome, for example, blocks suspicious sites, but that's a very clear line you're drawing. With ads and tracking, it becomes muddled.
It would be similar to adult content in the UK, where AFAIK you have to proactively enable it through your ISP, it comes blocked by default.
it's hard enough to get the public to understand this concept without also waffling over the meaning in the tech community.
Also I think tracking protection is off by default except in private browsing mode, and if it's something you need to explicitly enable that's no different from the "neutrality" issues caused by installing an adblocker (there are no issues).
This also ties into the whole concept of "a browser is a user agent" (http://words.steveklabnik.com/user-agent-moz-a), i.e. it advocates for you. Here it's trying to get the actual content loaded faster. ISPs are not user agents, they are more like a utility.
But on the principle, yep, FF shouldn't have a neutral treatment for everything. And that, of course, is impossible to define : what is "neutral" ?
It has become common to use so many tracking scripts that the perceived page load time (time to display/interactivity) is actually significantly slowed down. I actually first installed an ad-blocker myself when I realized some sites were taking like 5+ seconds to load, and loaded quicker with the ad-blocker. (But this change isn't a _blocker_ of scripts, it's trying to change order and timing of execution to speed up page load while _keeping_ the scripts).
The intent of this change is to delay load of those scripts (which are already being loaded with code that loads them async, that is, without spec guarantees of load order or timing) until after the page UI is loaded and operative, to _improve_ perceived load time.
I'm not sure if people are missing this point, or don't believe the stated goal and think it's secretly a plan to hurt these sites instead. I believe the stated goal. (whether they like or hate that idea!) As the OP says though, there are certain pages that _may_ be unintentionally harmed by the change, if they were relying on quick load of scripts that they should not have been relying on because they were already being loaded async (that is, with no guarantees of load order or timing, already).
If this ends up being a non-trivial number of pages, and those pages/tracking frameworks don't fix themselves to accomodate, then I predict the change will be considered unsuccessful and unfortunately rolled back.
It is meant to _help_ pages that use a lot of tracking scripts, not hurt them. Although I guess the assumption is that actual load time of interactivity is prioritized over making sure your tracking scripts are in immediately. If site owners actually prefer to slow down their pages non-trivially in order to guarantee tracking scripts immediately, then I guess they wouldn't see it as help. shrug.
I think the OP author is probably regretting his post title. It maybe should have been "Firefox 57 speeds up load time to interactivity of pages with lots of tracking scripts", heh.
EDIT: Seems to be here: https://github.com/mozilla-services/shavar-prod-lists
This does point to some problematic directions though.
If web standards were simpler and it were easier to build competing browsers (and/or if we could trust plugins more), then it wouldn't be much of a concern if some browsers choose to experiment with these kinds of protections.
Assumption is that user wants page to load faster but does not object to tracking.
What if user wants page to load faster and objects to tracking?
Source of Firefox tracking protection is list at disconnect.me?
credit: eco https://news.ycombinator.com/item?id=15964393
Basic gethostbyname()->HOSTS file blocking:
#!/bin/sh
exec curl https://disconnect.me/trackerprotection/blocked \
|sed -n '/<\/br>/!{/\./s/^/255.255.255.255 /;};/\./p' >> /etc/hosts;
User may want to add these too:
https://disconnect.me/trackerprotection/unblocked
#!/bin/sh
curl https://disconnect.me/trackerprotection/blocked \
|sed -n '/<\/br>/!{/\./s/.*/.&\
=&:255.255.255.255:1/;};/\./p' >> _root.zone/root/data;
if cd _root.zone/root/data;then exec tinydns-data;fi
#!/bin/sh
curl https://disconnect.me/trackerprotection/blocked \
|sed -n '/<\/br>/!{
/\./s/.*/echo 255.255.255.255 > _dnscache\/root\/servers\/& /;};
/\./p' > block.sh;
if sh -c ./block.sh;then exec rm block.sh;fi
Mozilla doesn't want to enable it by default because it is the funding model of the web, and no viable alternative funding model for most of the web's content has arrived yet. (At least, that's the public statement. I don't know if e.g. potential lawsuits, etc. also play a role.)
the web was exclusively non commercial and later was opened to commercial activity and later advertising which added tracking because their business model was broken and they needed something to show their customers and investors to gein/keep their trust that online advertising was not a total scam as physical world mostly is.
The unexpected side effect is the creation of a global totalitarian surveillance state just to show ads: https://www.hooktube.com/watch?v=iFTWM7HV2UI
sed -n '/<\/br>/!{
/\./s/.*/.&\
=&:255.255.255.255:1\
=*.&:255.255.255.255:1/;};/\./p'EDIT: Judging from the low quality of online marketing, it isn't hard to do.
You can check out how unique you are here: https://panopticlick.eff.org/
There is in fact a preference to do that: Settings -> Privacy -> Tracking Protection, set to always.
It breaks some reasonably popular sites, which is why it's not on by default across the board right now.
As things stand, it's a hard sell to have a browser do something that breaks sites that used to work. Most users tend to not be happy about it. This is definitely an area worth pushing on; the question is how best to do it.
Mozilla could maybe afford to pull something like that, if they had the majority marketshare, as then webpage owners would have to deal with their decisions in order to still make any revenue at all, but well, they don't.
I wonder if this post was rushed to publication, to manage Mozilla's public image and reestablish it as a friend to user privacy, after the 'Looking Glass' fiasco a few days ago.
(I'm not exactly opposed to such PR efforts, as long as they're accompanied by actual internal change in the company.)
Maybe this is damage control, but somehow I think they are not well organized enough to have this kind of thing happen.
Besides how is this helping with privacy ? Trackers are still loaded and tracking.
Silently installing a plugin and doing an end-run around any policies in place etc. is just clown-school level.
Why would you use adblock which is outdated when ublock origin has been available for a while ?
It's strange that you take extra steps to block ads and tracker but peruse facebook whose sole purpose is tracking and profiling you and your family, friends, acquaintances through you.
I use different browser to access different category websites. Brave browser for social media and Firefox for news reading or researching. Both of that browsers using the same local proxy connection in my PC. I installed Privoxy and Squid on the same PC with that browsers and so they are appear as the same user agents (e.g. Chrome).
When I access http://www.janbambas.cz, of course my browser loading faster as my Privoxy allow/block these domains:
2017-12-21 00:55:32.780 00000f04 Request: www.janbambas.cz:443/
2017-12-21 00:55:34.632 00001194 Crunch: Blocked: fonts.googleapis.com:443
2017-12-21 00:55:34.670 00000e3c Crunch: Blocked: secure.gravatar.com:443
2017-12-21 00:55:34.697 00000e8c Crunch: Blocked: www.google.com:443
2017-12-21 00:55:34.711 000013e8 Crunch: Blocked: secure.gravatar.com:443
2017-12-21 00:55:34.741 000012cc Crunch: Blocked: secure.gravatar.com:443
2017-12-21 00:55:35.680 00000ce4 Crunch: Blocked: secure.gravatar.com:443
2017-12-21 00:55:35.721 00000978 Crunch: Blocked: secure.gravatar.com:443
2017-12-21 00:55:35.736 000010e0 Crunch: Blocked: www.google.com:443
2017-12-21 00:55:35.759 00000104 Crunch: Blocked: secure.gravatar.com:443
What makes me sick is this person #Honza Bambas# doesn't give a real solution to our browsing problems. He only makes us die slowly.
Or google fonts?
No, I don't know what the settings do. I was just searching for "delay" and found the tailing settings.
Does that happen with anyone else?
Its a bit naive, because we technical people can switch willy-nilly from one browser to the next, to assume everyone can.
I don't think that's true.
It's not the currently spoken of Net Neutrality, but it's relevant to the neutral carriage of data over the internet. If browser companies pick and choose whose data to delay (or otherwise alter) then they have the power to bias the web - Firefox could always delay scripts from other companies than Google, for example, in order to preference their business associate. They presumably aren't informing users, or requiring users to enable the function.
In short it seems highly pertinent in the net neutrality debate, to me, despite perhaps not having reached problematic levels and despite not being the specific form of neutrality that has erstwhile been grabbing the headlines.
additionally, the reason net neutrality is so important is because there is no consumer choice in the ISP market for many users. Even when one browser is dominant, there's a lot more choice among browser vendors, so pushing out regulation to them is less important.
But let's not muddy the waters of net neutrality by injecting separate issues into the debate. Yes, browsers should treat all traffic equally, but that isn't net neutrality.
In OSI model IIRC:
Application (software) is layer 7.
Physical connection is layer 1.
I am sure somebody will correct me.
See my other comment in thread, but in short I don't think a user cares really that action is at a different level of the conceptual OSI model, they care if they can consume given media, if NN legislation shifts things so that the browser blocks the media from a particular server instead of that servers upstream ISP I don't think users are going to be applauding too much.
Does this pertain only to browsers, or is it to all applications/clients that have a connection to the internet? What about my XMPP clients, or my IRC clients? Do they have to follow net neutrality as well? On top of that, does a FOSS project like Firefox where the user defines what is in the packaged binary have to follow it?
Net neutrality or the law in general overreaching like that could jeopardize support, especially when it is not easy to find an answer to any of the questions I listed above.
Software freedom is important.
My opinion.
They are two separate, important issues, but confusing them serves no one.
Because of the possibility of such an equivalence it strikes me that the issues are not _separate_, though obviously not identical either. If Firefox blocked/throttled sites but allowed others [in the same category] for money, then Mozilla through my client would be enacting the same effects as net non-neutrality. They could charge for an add-on to remove all/some blocks, or charge the server endpoint company to remove the block just for them.
The point is that for a user the important endpoint is their sensory input, and that a browser manufacture can filter/throttle/block that consumption in the way that an ISP can.
Legislation could be written that would encompass preventing a browser manufacturer from covertly interfering in data transfer, whilst equally demanding ISPs carry data regardless of origin. Equally poorly drafted legislation targeting ISPs could impact browser makers ability to implement black-/grey-/white-listing of malware, etc..
Whilst we're focussing on such bias that can interfere in our web/internet consumption I think it's the perfect time to make sure we don't solve the problem in one place only to leave a gaping hole that allows the same corporations to enact the same controls.
This or some similar proposal could open up competitiveness and options in the browser space, which I think would go a long way toward solving some of these issues.
If the web page asks for 150 scripts to be loaded (e.g. that's what https://www.nytimes.com does right now), what is the fastest way to load them? "All in parallel" is not the right answer, so you end up prioritizing. At that point, maybe you want to prioritize the 40 non-tracking scripts (how many get loaded if I enable tracking protection in Firefox on that site) over the 110 tracking ones.
> One example is Google’s Page-Hiding Snippet, which may cause a web page to be blank for whole 4 seconds... Both the analytics.js and the test script are loaded from www.google-analytics.com, a tracking domain, for which we engage the tailing delay.
Clearly if a domain is serving up an A/B test script then it is doing more than tracking.
> Simply said some sites may need to be fixed to be able to adopt this change in scheduling.
I have a problem with the term "fixed" here. Seems like Firefox's assumptions are what's broken here.
I received alot of emails from loyal Firefox users telling me they are worried about their privacy when using Firefox 57 after the Looking Glass debacle, so I decided to make it available for free. If there are tracking domains sites you you think should be blocked due to suspicious behavior, tell me the urls and I will evaluate for inclusion. Please feel free to submit it as a comment to this thread or submit it using the form submission field on the PrivacyWall homepage.
Fun fact: Firefox just pushed out the Looking Glass add-on to users without notice or consent this past weekend.
Note that Mozilla pushes code without explicit consent for all parts of it all the time - they're called software updates. The problem in this case was that it was for a potential feature that very few people cared for, and that it showed up as a scary extension in the extension list. That definitely should not have happened, but it's not a privacy violation.
With Facebook code intruding into every nook and cranny of the web via React and Google's position as digital Sauron, monitoring and parsing out your search history, watch history, all phone activity, emails, SMSes, and more, user identity resellers are a formidable foe, and Mozilla is in its familiar position as the David of noble, non-moneyed interests challenging the user-hostile Goliath.
Firefox may find unlikely allies in Microsoft and Apple, since these two companies still make at least some money selling an actual product instead of just slurping up information about their users and repackaging it. The best thing Mozilla could do is convince Apple and Microsoft to give up their independent lackluster browser implementations and ship Firefox as the default instead.
> The best thing Mozilla could do is convince Apple and Microsoft to give up their independent lackluster browser implementations and ship Firefox as the default instead.
Multiple independent implementations are of vital importance to the web. We've seen it with IE6 before, and having two browsers is cutting it too close.
Combining IE/Edge, Safari, and Firefox still leaves Firefox at half of the market share of Google, and that's still a distinct disadvantage, but it's a much stronger fighting position than single-digit market share. Google and Facebook are not naive upstarts and it won't be easy to quash them, especially not when little old Mozilla is running on comparative fumes compared to a couple of the best-capitalized companies on the planet.
Google and Facebook's interests are aligned as both base their business model on profiling and reselling data derived from user behavior, so it's unlikely that Google will feel inclined to implement desired user protections against that business model.
It's very important that we have strong competition representing a diversity of interests, especially when the dominant player's business model is just "slick spyware". Without a competitor in the same league, consumers don't really have an option.
[0] https://www.w3counter.com/globalstats.php?year=2017&month=11
The continuing value added to Facebook's bottom line by React is in granting influence far outside of their natural scope. Could they counter Mozilla's move by introducing new React "features" that Mozilla simply "can't support" yet, even though they "really super duper hope the new featureset can come to Gecko-based browsers next year"? Even more insidiously, could there possibly be some little snafus in their QA process that let bugs that affect Gecko-based browsers go unnoticed?
That's their leverage, that's their retaliation against Apple and Mozilla's moves to stymie their flow of user behavioral data. But, I'm sure a company whose revenue stream is wholly predicated upon reselling user identity would never do something "shady" like this to prevent competitors from blocking their access to the data that forms the lifeblood of their product, right?
... Right?
Mozilla is in its familiar position of only existing because Goliath gives back a small fraction of its tracking/advertising earnings in exchange for sending users its way. The exact opposite on non-moneyed interests.
Do you remember how Apple considered using mozilla code to buld their browser but rejected the idea because the code quality was much too low for their standard so they went to KHTML to build webkit ? Yeah vendor lock-in walled garden Apple ditching safari for firefox, not happening.
What's to gain for microsoft by switching to firefox ? Chance are this is not happening either.
I respect this position and admit that it's relevant. However, under this hypothetical, they may not need such sponsorship anymore, and they're clearly currently taking actions that will help protect users from it.
IMO this is only a serious issue if you believe that Mozilla's survival is predicated upon the continued flow of search sponsorship dollars. While their budgets may change and they may come out the end looking much different, I don't think that Mozilla or a spiritual successor serving substantially the same purpose (like OpenSolaris -> illumos) will cease to exist, no matter what Google et al do to them.
>What's to gain for microsoft by switching to firefox ?
Apple and Microsoft's interest would be defensive, blocking Google's dominance over the browser platform. They'd be interested in this because Google is currently a serious threat to both companies' major lines of business.
At present, with a fragmented competitive landscape, it's unlikely anyone will be able to stand up to Chrome. And however good or bad we believe Google or Chrome are, it's never good to lack a peer that can keep the company accountable (that is, monopolies are bad).
> Chance are this is not happening either.
I agree completely, I don't think this is a likely scenario. I just think it's an interesting and positive one.
I would really love to just stop using the web entirely and go back to Gopher.
> Scripts are delayed only when added dynamically or as async. Tracking images are always delayed. This is legal according all HTML specifications and it’s assumed that well built sites will not be affected regarding functionality.
(emphasis mine)
Not breaking backwards compatibility for existing users is the golden rule of software support. When an unfortunate pull-requester attempts to break backwards compatibility with Linus Torvalds' software, he has some very choice language to complain about the practice. If they were attempting to break backwards compatibility just because they dis-liked some particular app or service or use case, he might even use foul language.
Fortunately, I am a very well behaved and good little HN user, so I will not repeat that language here. But imagine what Linus would have said, really loudly, with all capital letters. There. That's better.
https://github.com/torvalds/linux/blob/e7aa8c2eb11ba69b1b690...
If the kernel's user interface just started blocking on open for 4000 milliseconds for no apparent reason, people would not be happy. Firefox expects users to demand that app writers edit, recompile, test, and ship them a new app to prevent the block. This is <insert lots of not very nice adjectives>.
Apps have to handle it. If they don't, because for example, they access the disk while also trying to be a display compositor, then they are simply broken. It does not matter if the kernel is usually fast enough. Because sometimes it isn't.
This is like if the compiler generated loops with 4000ms sleeps because the app links a library the compiler thinks is annoying.
Technically the compiler never said it wouldn't add random sleeps into loops. It's totally in spec! What's the big deal?
Meanwhile, my app is slow now. Or in the case of some apps, actually broken for active use cases where it used to work fine. Which, again, is totally regression by any QA standard.
The bazillion tracking scripts loaded by pages is slowing down time to view/interaction on the page. Firefox is taking scripts that are _already_ being marked as loadable asynchronously/delayed, and delaying them until the page is otherwise loaded. That's it. It's not an arbitrary 'sleep', it's an attempt to prioritize UI responsiveness over tracking scripts.
To the extent it breaks or _slows down_ pages, that's an undesired side effect, not the goal. If it does that to a lot of pages, the feature won't be succesful and will be rolled back, I bet.
You make it sound like Firefox is just adding a wait for no reason.
The reality is that the page is asking Firefox to download dozens or hundreds of scripts [1]. Firefox needs to prioritize those loads somehow, because it generally doesn't want to open that many connections to the server in parallel. So it prioritizes the non-tracking bits over the tracking ones. If all the non-tracking bits are done loading, the trackers start loading at that point.
> This is like if the compiler generated loops with 4000ms sleeps
No, it's more like if your OS scheduler decided to prioritize some applications over others based on how much it thinks you care about them (e.g. based on whether they're showing any UI, or based on whether they're being detected as viruses by the virus scanner).
[1] For example, http://www.cnn.com/ shows 93 requests for scripts in the network panel in Firefox. If I enable tracking protection, that drops to 37 requests.
Or for another example, http://www.bbc.co.uk/news has 67 script requests and only 20 with tracking protection enabled.
Or for another example, https://www.nytimes.com/ has 150 script requests and only 40 with tracking protection enabled.
According to the article, they're only delaying these resources when loaded dynamically or async - so developers should be able to "fix" this by loading tracking scripts synchronously, which is what they are effectively doing already if this new FF behavior causes any noticeable impact.
It's hard to feel much sympathy for devs who have _explicitly_ prioritized the sending of their users' info to external parties, over their sites being baseline usable.
Net-Neutrality means that the finance of the internet is driven by site-owners receiving funds from advertisers (or from subscriptions...but that seems comparatively negligible)
Getting rid of net-neutrality will mean ISPs (despite their common-carrier designation) will control this whole model^...meaning they will control the internet.
The largest argument in support of repealing net-neutrality involves taking power away from advertisers...so does this Mozilla policy.
If anything this move is anti-Net Neutrality since it's prioritizing non-tracking domains over tracking domains as opposed to treating all domains equally.
The article was put out by mozilla, so of course their stated point is to make everyone's experience better. I'm in marketing, so I tend to ignore a good portion of the text in marketing/PR-blogs such as this one.
Aside from that, I hadn't thought of this. You're right that if anything, this will increase the load-times of companies who rely on advertising revenue. Perhaps it's preparation?
The _intention_, if we believe the statement (I understand you may not) is actually the opposite of this. To _improve_ perceived load times (time to display/interactability) of sites that use lots and lots of tracking scripts. If a site does not use many or any tracking scripts, it actually won't effect it at all.
There are sites that use lots and lots of tracking scripts, and it actually slows down UI. The intent of this change is to _speed it up_ again.
If it doesn't do that, and instead makes lots of sites load more slowly to the user's perception, it will not have been succesful at it's claimed goal.
Latency is additive...regardless of what layer we're talking about. increases in transport latency can be compensated for at the physical or application layer...time is time, the OSI model isn't involved.