Hacker News Reader

Comment by napsterbr | Hacker News Reader

> why am I opted-in to a Studies program in Firefox's default state? (With no explicit information about what it is)

I came here to mention exactly this. I don't mind the certificate issue (as long as there is a post mortem and they learn something from it).

I was wondering how my addons came back automatically (without me having to upgrade to 66.0.4) and I found out about this studies thing, which I never consented to. I feel violated. And the problem is, what browser am I supposed to use from now on? Lynx? Sigh

ETA: I am (was) a proud Firefox user since it was called Firebird, and changing browsers never crossed my mind before (even if Chrome felt faster some times). At this exact moment, I have zero trust on Mozilla, just like I have zero trust on Google (Chrome). Extremely frustrated and disappointed.

View on HN

> what browser am I supposed to use from now on?

There's actually quite a few. This Wikipedia list [0] might not be the best curation, but it carries my point, somewhat. For example, I've really enjoyed the power-user browsers, like surf, luakit or uzbl.

I know you were expressing the fact that we're stuck between Firefox and Chromium, because they're the only browsers able to keep up with the rapidly moving web stack and provide a fluid user experience at the same time. My point is if you're willing to compromise on that, you actually have other choices.

Oh I do hope to see the day when there's a variety of browsers, all equally compatible with the day's web. Doesn't seem like we're moving in that direction though.

Personally, I tolerate Firefox, because I want some of the extensions, namely Dark Reader and ublock. Dark Reader doesn't really have alternatives, as far as I know, and I find that network level blocking isn't effective or ergonomic enough to replace something like ublock origin. If I solved these two problems, I'd jump ship to surf immediately.

Just to finish my rant; the other day I was experimenting with text browsers for rendering simple sites like thefreedictionary or HN. Their ability to do that is quite abysmal. I think that says a bit about the state of web's accessibility.

[0] https://en.wikipedia.org/wiki/List_of_web_browsers

> keep up with the rapidly moving web stack

Yeah, exactly. I mean, not even EdgeHTML could keep up!

> surf, luakit or uzbl.

Thanks for the suggestions. I had never heard of any of those three, but they look awesome! The only extension I need is Vixen (or any Vimperator-like addon), and they all seem to be keyboard-first. The only browsers I had used before were Lynx and w3m, which were way too hardcore for me. I'll give a shot with luakit. Seems to be an ideal middle ground between functionality and privacy.

>I don't mind the certificate issue

For me, it's the other way around.

They should have forseen the certificate issues and never implemented the system as it is, i.e. disabling addons that have been installed with a valid cert. At most there should be a warning. Addons are losing their configuration because of this and we have yet to see how they fix old FF versions. All of this indicates a total lack of foresight.

However, I see the value in having studies enabled and being able to test features and fixes with certain hardware configurations. Almost every software does it, because it's very useful. Maybe Mozilla, being an advocate for privacy, should be more transparent about it though.

You could just turn off all studies in Firefox. It's a simple option:

https://support.mozilla.org/en-US/kb/shield#w_to-opt-out-of-...

I'm a privacy conscious person so I disabled all spyware that Firefox included. But I went to check, studies was enabled, probably because it was included and enabled by default in the last years and I didn't notice. So how long until Firefox adds something else to have remote code execution rights on my machine?

Studies do send telemetry which is not quite the same as being spyware.

You can actually check what is sent, though there's no option to more finely disable studies requiring, say, cursor, keyboard or tab name monitoring. I haven't seen any such studies though.

The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time.

As for browser code itself, it is open, go read the changelog. If you're extra paranoid, you can build it yourself. Study code is also fully readable.

>Studies do send telemetry which is not quite the same as being spyware.

How is software whose sole purpose is to send my information to a third party not spyware?

>The "remote code execution" thing is already there, it is called JavaScript. Almost every browser has it. Add-ons use it all the time.

JS on any webpage can't do whatever it wants, since it's restrained to the webpage itself. otoh I'm sure this "studies" thing can change my browser configuration (including my certificates, making me vulnerable to MITM) and probably even execute any command with my current user privileges.

They cannot, the studies use JS available to the browser though with internal APIs available. It is potent, but not quite as much as to allow running arbitrary executables outside the browser or usually bypass file system level protection. It can read and write files the user can access. (Which may or may not include /dev on *nix.) It can also exploit your OpenGL driver.

The difference between spyware and telemetry is intent - use of data - and anonymization measures.

If you don't trust the company making the browser with user studies (and their toggle), you probably shouldn't use their build - and you can disable study code completely on compile time.

If Mozilla decided to be evil like a certain Alphabet company, there is nothing to stop them but forking and writing another web browser.

Sounds like you're arguing against a very specific meaning of the term "spyware". One that I'm unfamiliar with. It's not even the historical meaning of the term. I remember when it used to mean any application that "phones home" for any reason whatsoever--when apps ran locally.

It's pretty clear what they are worried about. That's not really arguing in good faith. And "intent" has nothing to do with it--also there is no singular intent from an organisation, if it goes wrong it's just stuff that happened but nobody to point a finger at whose intent it was.

Also, anonymization measures are a joke. It just shows an "intent" to anonymize. But when it turns out that the data is in fact easily de-anonymized somewhere between the browser and the aggregation unit, or in combination with the newest "opt in" monitoring feature, again no fingers to point and your only recourse is better having been safe than sorry.

Sensitivity of data? I'd associate "spyware" with "collects personal information", whereas studies that do not require explicit opt-in are only allowed to collect things on a level of "how many tabs are open", "has the user enabled this feature", and things like web browsing history or data derived from the history are explicitly excluded. If you don't trust Mozilla to hold that standard, then yes, you probably shouldn't use their product.

(Which apparently played part in the Mr Robot idiocy: since it didn't collect any data, it was easy to get it through the process...)

I don't like lots of stuff Mozilla is doing, but I trust them more than the alternatives to actually do what they claim privacy-wise.

That's not enough. Opt-out features are wrong because organizations/companies know that most people won't pay attention or not fully appreciate the dangers of it.

What would you propose?

Opt-in. Firefox is all about informed choice, it seems people want them to stick to it.

They can just flip the option or create a version of studies called "enquiries" or force a new addon that you can't remove in the next update .. 3 years ago you'd think Mozilla wouldn't ever imagine doing things like that.

3 years ago, they were in the middle of deploying the current studies system.

I think it's actually 5 years ago, perhaps when the major management changes happened. My mistake.

I did. The problem is:

- I had never heard of "Studies" before; which leads to

- I never agreed to be a part of Studies in the first place.

The docs says it must be opted in, so supposedly I have to give consent to it. I don't remember doing so. For all my life, I've always rejected any survey, opt-in request and similar stuff. I do admit there is a small, unlikely chance that I did opt-in. Maybe I misclicked it? Maybe I thought I was rejecting when I was actually agreeing to? Maybe someone else was using my computer and opted-in?

If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant. But I can't remember the prompt at all, and I would never consciously opt-in, hence the feeling of betrayal.

For the record: I now know what Studies are. I acknowledge that companies need to run A/B experiments in order to enhance their products. I just don't want to be opted-in by default.

> If this is indeed opt-in, and this unlikely scenario did happen, then I apologize for the rant.

No need to apologize. It's not really an opt-in if you are certain you would never opt in if you were aware of it, and somehow you accidentally "opted in" anyway.

I'm in the same boat, I would never opt in to any of this stuff. Now I had my "studies" setting turned off, so that's good. But when I looked at about:studies, it seems as though it had been on at some point in time (because it lists a plugin that it used for a study, or something). So I suppose that I actually opted out of this studies thing at some point, meaning it had been turned on without my consent either.

I've switchted to qutebrowser, but not sure if it will fit your needs.

> And the problem is, what browser am I supposed to use from now on? Lynx? Sigh

You can try Firefox from your distribution's repositories. eg. Debian disables this sort of things.

>what browser am I supposed to use from now on? Lynx?

w3m is a pretty fun terminal based browser with modern enhancements

Reply on news.ycombinator.com