Hacker News Reader

Comment by kuschku | Hacker News Reader

The GDPR is only a momth away, I've already sent a complaint to the local data privacy officer about Firefox' constant violations of the requirement for explicit consent (see: CliqZ before), so let's hope the hammer swings hard this time.

If Mozilla still can't see why they shouldn't automatically transmit analytics and studies for everything, they deserve to be sued into the ground. Same with Google.

View on HN

Some people just want to see the world burn. So maybe let's delete the whole internet and get back to letters, telegrams, pidgins and encyclopaedias? No one is forcing you to use dev, nightly or anything else if it is not consistent with your faith. Especially Mozilla they made some silly things but are one of the most "privacy and shit" companies out there and they will not come to your house and beat you because you do not want to do something.

That's certainly one approach.

The other approach is that, unless explicit consent is given, people are supposed to be safe.

Nightly is often required because a lot of functionality for developers is only available there, e.g. custom xpi legacy addons even in FF61.

It's nightly or nothing for this, and as a reminder, stable also was affected by CliqZ.

You are using Nightly "wrong" because of attachment to old extensions that will perish in June when all legacy stuff will be blocked. Nightly is only for testing out new features and it's not intended to be production ready browser... but everyone has an own use case. Yet do not beat them for wanting to change something for the better after using testing technology.

I'm not using it for "old" extensions.

Even today, every new feature you want to have in the WebExtension API needs to be implemented as a legacy extension providing this API first, then it will get tested, and then it will maybe become part of core Firefox.

The official process to add apis for WebExtensions is to write a legacy extension.

Which is exactly what I'm doing to support my custom extension that replaces the entire history and bookmarking system, UI and toolbars of Firefox, for which I need a custom API.

I suggest you read the wiki on why nightly still supports legacy extensions before judging people.

I'm not judging I wrote that everyone has it's own use case. My only point is don't use test version if you don't want to be tested or opt-out of it. ;)

You should be using Aurora not Nightly for those features.

Aurora does, afaik, not allow extending the WebExtension API with a custom legacy extension, this is only available in nightly.

Extending your argument only a bit, "No one is forcing you to use Firefox stable release version if it is not consistent with your faith". "No one is forcing you to use computers and internet if they are not consistent with your faith". I see so much irony in your statement. It's not about forcing anyone. It's about taking the web forward, and data security which Mozilla says it believes in. Nightly definitely means there could be unintentional mistakes and bugs, but does not mean it has our blanket agreement to intentionally sharing all of our private data by default.

So how do you want take web forward without testing new things based on real life data? Did you even read what they want to do and how they are going to do it?

By doing things with a clearly visible message and explicit, prior, opt-in permission, perhaps? What's so difficult about that?

Seriously they have to? Isn't this obvious enough? When downloading TEST RELEASE you willingly accept that it will collect anonymous data and send it to them. If you do not want to test something, because you're opposed to it, do not do it.

A lot of companies do that and I do not see anyone complaining about it for example Apple and macOS betas.

I just received this email from my bank. Something like this would be nice:

"Below is a link to the 2018 Annual Privacy Notice. This Notice provides details on the types of information we collect, why we collect it, and with whom we may share it. Collecting and permissible sharing of your information allows us to offer you a comprehensive range of services to help you meet your financial goals. "

Yes, for stable version if they want to track something more. But we are talking about test version. You accept this when downloading "Firefox Nightly automatically sends feedback to Mozilla.": https://www.mozilla.org/en-US/privacy/firefox/#telemetry

How you want to improve something without data? Based on intuitions?

> No one is forcing you to use Firefox stable release version if it is not consistent with your faith

Nope. Debian repos (and most package managers I'd guess) do not have Nightly or Developer Edition. There's no direct link on the download page [1] that takes you to where you can download the Nightly branch. And the page for downloading it [2], to which you reach if you search for it specifically, makes it as visible as it gets that it's beta and meant for testing. I guess all of this is just lightly forcing you to download latest release. (edit: I mean this as sth. positive BTW, they're making it quite obvious which is the wiser option for the end user)

[1] https://www.mozilla.org/en-US/firefox/new/

[2] https://www.mozilla.org/en-US/firefox/channel/desktop/, "Get a sneak peek at our next generation web browser, and help us make it the best browser it can be: try Firefox Nightly."

1. google the web, e.g. using duckduckgo, for "firefox nightly ppa"

2. Go to https://launchpad.net/~ubuntu-mozilla-daily/+archive/ubuntu/...

3. apt-add-repository ppa:ubuntu-mozilla-daily/ppa

4. apt install firefox-trunk

5. firefox-trunk

At no point during this are you informed that you will be subject to illegal tracking and analytics.

No matter what way of installing you choose they inform you via official website about pre-release version witch includes notice about sending automatic feedback. You don't need to prove your point in the most bizarre way and you can inform PPA admin to add this little line for clarification.

> the most bizarre way

Installing via PPA is much more common and trusted than installing a random binary from a random website.

> to add this little line for clarification.

That’s too late anyway, from May 8 on the GDPR comes into force, and then this will require explicit opt-in from the user, and the rest of the software has to continue working even if the user does not explicitly opt-in.

So, I’ll just wait for that. Also waiting for the day that the analytics on about:addons becomes explicitly opt-in, instead of being connected to the DNT setting.

Firefox is open source software. They can not control every single person distributing their software. That PPA is probably maintained by volunteers or Ubuntu folk.

Or perhaps the developers could just request consent before taking your data?

I mean if that is just too difficult then what hope do they have of developing anything.

I can only imagine how smug your smile was when you typed out "local data privacy officer" wondering how many chills you were about to send down Mozilla's spine.

Lots of HNers are going to be let down in about one month.

The mills of bureaucracy run slow, I realize that.

But it's the office of my local data privacy officer that has in the past sued basically every website in Germany for using the Facebook/Twitter like buttons, and won (and caused them all to use a two-click share button system).

I've got trust in them that they'll act responsibly on this.

On a mailing list discussion on whether or not to add a study to a version of software put out online for testing? You're being ridiculous.

On a foreign company that has been distributing a software in this jurisdiction that does not comply with local data privacy law, specifically the requirement for explicit notification before any tracking happens, and, starting May 8, the explicit opt-in for any kind of analytics or telemetry that may contain personally identifying data.

See: about:addons using Google Analytics without cookie disclaimer or opt-out ability, CliqZ addon receiving parts of browsing history without disclaimer, or any opt-in/-out, unauthorized installation of software on a remote computer (Mr Robot case), and much more.

Just came on to say this, but also there essful have to be explicit consent to take the data outside of the EU

Reply on news.ycombinator.com