Comment by abdullahkhalids | Hacker News Reader

Comment by abdullahkhalids | Hacker News Reader

abdullahkhalids

Not taking sides on this, but this is what Mozilla has to say about this. About "hidden addons" [1]:

> It is true that we're now releasing some features internally as something we call "System Extension", which technically is the same as an addon you could install on addons.mozilla.org, with the difference that these come pre-installed with Firefox and there is no way to disable them. We mainly do this to be able to ship updates faster, but it's also nice that we have some features totally separated, which makes the development process easier for us!

And about these particular addons [2]:

> we will measure Telemetry Coverage, which is the percentage of all Firefox users who report telemetry. The Telemetry Coverage measurement will sample a portion of all Firefox clients and report whether telemetry is enabled. This measurement will not include a client identifier and will not be associated with our standard telemetry.

[1] https://superuser.com/questions/1117062/what-is-the-web-comp...

[2] https://medium.com/@neothefox/firefox-installs-add-ons-into-...

>we will measure Telemetry Coverage, which is the percentage of all Firefox users who report telemetry. The Telemetry Coverage measurement will sample a portion of all Firefox clients and report whether telemetry is enabled. This measurement will not include a client identifier and will not be associated with our standard telemetry.

Telemetry for telemetry. Nice.

> Telemetry for telemetry. Nice.

It's just a matter of time until some developer poses the question:

"Are people who opt out of telemetry more likely to use Linux? Or live in Europe? Or have NVidia GPUs? Or... "

and gosh darn everyone else at Mozilla begins to wonder the same thing, and the best way to answer that question is to include it in your "totally not telemetry" telemetry reports, and then we're back to Square One.

> This measurement will not include a client identifier

That cannot be correct unless they have figured out a way to transfer the user's data without using IP. The Source Address and other fields in the IP header can easily be enough to fingerprint the user[1]. Mozilla may not be storing the data in the current version, but they are still collecting a de fact client identifier.

(it wouldn't surprise me if the data is submitted over HTTPS, which might include headers with additional bits fingerprintable entropy)

> and will not be associated with our standard telemetry

Just because they are not currently intending to correlate the databases doesn't prevent them (or others) from doing so in the future. This kind of claim isn't worth much without a Ulysses Contract[2][3] binding their future actions.

[1] https://news.ycombinator.com/item?id=17170468

[2] https://en.wikipedia.org/wiki/Ulysses_pact

[3] https://www.youtube.com/watch?v=zlN6wjeCJYk

Mozilla's answer is clearly some PR attempt again. Anyone with basic technical understanding knows that any form of communication includes ways ot identifying and tracking.

The dishonesty of silently installing telemetry to monitor people who disable telemetry is a telltale sign of this attitude.

Once again it is weakening the leftover trust in mozilla and pushes long time supporter away to alternatives such as waterfox. It raises the question again of mozilla " making far-reaching and very short-sighted decisions in a vacuum." taking control away from users, not respecting privacy and user choice.

http://forums.mozillazine.org/viewtopic.php?f=7&t=2970749

Reply on news.ycombinator.com