Hacker News Reader

I'm one of the many devs who worked at one point or another on Mozilla's third-party tracking protection. We had prototypes working in ~2012, if my memory serves. Unfortunately, these prototypes broke the web badly. The web was simply not ready for such protection.

Now, Apple, with their iOS monopoly, managed to strong-arm the web into a position in which third-party tracking protection was finally possible. Kudos to them, now we can finally release this technology. We're doing it slowly, because by opposition to Apple, we cannot afford to break the web.

Why did Apple do this, though? If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple.

So, yeah, Apple's actions have had some good impact on web-tracking, and that's great. But don't forget that they do this for strategic reasons: 1/ because they want to encourage devs to use another tracking mechanism that the competition cannot emulate; 2/ to immediately hurt the competition.

Now, you are right about the double-keyed caches – although using this to track users is quite more complicated, less precise and less reliable than first-/third-party cookies, it's something we need to address. We're working on it at this very moment.

Finally, yeah, first-party cookies... hard to counter. We're also working on it (is anyone else doing so?), but that will be a tough fight.

> Why did Apple do this, though? If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago. Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple.

This is incredibly misleading. Apple has been mostly criticized for allowing apps to collect excessive user data--for example, apps could access contacts at first without permission. It has been slowly shutting down these methods, as the realization has sunk in the the more open environment of Macs and PCs is just not appropriate for mobile phones. For example, apps in iOS 13 cannot access bluetooth or Wifi information by default, since it was being used to infer location.

Apple does of course collect some user data, e.g. for Siri or app analytics. But it's all painstakingly disclosed and its practices around differential privacy, deletion, and so on are quite good.

The tracking ID was Apple throwing a bone to ad industry and app makers, when it shut down far more precise ways of tracking users.

> the more open environment of Macs and PCs is just not appropriate for mobile phones

This is changing too. The last major MacOS upgrade added iOS-style permissions for some things (contacts access comes to mind) and the latest version of MacOS (Catalina) VASTLY expands that.

We're not just talking about apps from the Mac App store either which are sandboxed. Fire up terminal and you can't access the underlying SQLite database powering contacts anymore. sudo to root and you still can't!

MacOS is gradually adopting a more iOS-style permission model in an incredible way. One which does not even remotely phase or inhibit me as an extreme shell power-user. It's a quite impressive transformation they're undertaking here.

> This is incredibly misleading. Apple has been mostly criticized for allowing apps to collect excessive user data--for example, apps could access contacts at first without permission. It has been slowly shutting down these methods, as the realization has sunk in the the more open environment of Macs and PCs is just not appropriate for mobile phones. For example, apps in iOS 13 cannot access bluetooth or Wifi information by default, since it was being used to infer location.

Yep, the tech world has a short memory :) I distinctly remember Apple caught red-handed slurping GPS data from their users.

> The tracking ID was Apple throwing a bone to ad industry and app makers, when it shut down far more precise ways of tracking users.

Unless I'm mistaken, it's still much more precise than any form of web tracking.

You keep repeating that "Apple was caught red-handed" but what exactly are you referring to? What are your sources on that?

I'm referring to this: https://www.wired.com/2011/04/apple-iphone-tracking/

Which is literally when they began to take privacy very seriously. Keep in mind that's 8 years ago & the first iPhone was released 12 years ago. I wouldn't characterize that as "recent".

Well, people still distrust Microsoft for stuff they did during the 90s :)

But yeah, I'll grant you that it's not recent.

You say “caught red handed” and other accusatory statements. The article says they had announced how (encrypted, anonymised) and why (to provide more accurate location information to users) before it was “discovered”.

It doesn’t really appear to be very nefarious, nor an advertising issue. Maybe an unintentional or neglectful privacy issue at worst, in the case of an already-stolen phone.

> If you recall, Apple's stance on privacy is quite recent

Apple's position on privacy really started accelerating in the pro-privacy direction in 2011 due to the issue around unencrypted location backups, which was also around the time Tim Cook took over. I don't know that 8 continuous years of trying to improve privacy (2/3 of the duration of the mobile revolution & going) is fair to characterize as "recent". Having worked there 6 years ago I can tell you that not only did Apple have internal messaging about privacy being important, they walked the walk in terms of supporting initiatives to continue to push the envelope.

> If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago

Which instance are you referring to? (sounds like the GPS incident above which doesn't seem recent to me).

> Also, unless things have changed (honestly, I haven't followed), Apple tracks users through their native apps, because you're pretty much obligated to go through Apple's SDKs for many things, and they require a tracking ID, which brings revenue to Apple.

AFAIK Apple doesn't track what you do within the app. They do track things like crashes, other issues, general 3p app usage (for understanding what's important to their customers), & their own apps. All things you would expect ANY vendor to do. It's super hard to add things to collect because above the privacy impact there's also typically a battery impact.

Well, you seem to have better knowledge of Apple than me, so I'll bow to your knowledge. I had the feeling that Apple's privacy stance was privacywashing, but if it is serious, that's great.

To return to the initial point, though, the reason for which Mozilla hasn't shaken the web as much as it wants in terms of privacy is that it doesn't have Apple's sole-king-of-iOS position. Whenever the web breaks on Firefox, users blame Firefox. Whenever it breaks on iOS, users blame the web.

So Firefox needs to be smart and intentional. It's hard and slow work, but things improve :)

Mac Safari doesn't have that kind of protection. Indeed, Firefox has higher global desktop browsing share than Safari.

We found ways to add privacy without breaking the web by taking gradual steps and finding clever technical solutions.

I appreciate Firefox getting on the privacy-by-default train, but it's just wrong to say that iOS gave us the ability to do something that others couldn't. Our only superpower was being willing to ignore those who said tracking protection would destroy the web economy and/or tank revenue (plus aforementioned crafty trickery).

> Mac Safari doesn't have that kind of protection.

It doesn't, but it has a brother that does (iOS Safari). So the leverage Apple has web is very strong, much stronger than that of Firefox.

> Now, you are right about the double-keyed caches – although using this to track users is quite more complicated, less precise and less reliable than first-/third-party cookies, it's something we need to address. We're working on it at this very moment.

> Finally, yeah, first-party cookies... hard to counter. We're also working on it (is anyone else doing so?), but that will be a tough fight.

That sounds awesome. Ad-tech is a burden to society.

What's complicated with first-party cookies though? Didn't Apple for example just give them a limit of 7 days? I guess Apple just accepts that people have to log-in again after the 7 day period, but I haven't looked into the technical details about this feature.

It is only first party cookies set via document.cookie, not HTTP cookies. So login mechanisms will not be affected by this.

Thank you for all your hard work on Firefox! Many of us Firefox users really appreciate all the work you and your team does!

\o/

> If you recall, Apple's stance on privacy is quite recent.

You should read some of the history of Steve Jobs, and you will learn that he was very serious about privacy and it seems like his values have been imbued into Apple and now Tim Cook.

Here's perhaps the latest clip of Steve on privacy: https://www.youtube.com/watch?v=39iKLwlUqBo

> these prototypes broke the web badly

So what? The web wasn't ready to mandate JavaScript for rendering HTML, so why should we double-down on "not breaking things" now, instead of when it mattered?

> So what? The web wasn't ready to mandate JavaScript for rendering HTML

“The web” has been using JS to render HTML since Outlook Web Access in Exchange 2000 and IE5.

It's hard to take anything you write seriously when you're being disingenuous.

>Unfortunately, these prototypes broke the web badly. The web was simply not ready for such protection.

Yet Apple was fine disabling third-party tracking since 2001 according to GP?

>Now, Apple, with their iOS monopoly

A monopoly over their own product?

>If you recall, Apple's stance on privacy is quite recent. The tech world has a short memory, but I remember Apple being caught red-handed slurping data from user's iPhones not so long ago.

A quick Google search shows that Apple was embroiled because they enabled WiFi-assist by default, which caused some people to use more cellular data than intended. Is this the privacy-invading data "slurp" you mean?

>But don't forget that they do this for strategic reasons

Who doesn't? Apple is not a charity. We should rejoice that Apple is monetizing privacy, because it means the system is working.

>We're also working on it (is anyone else doing so?)

GP literally just mentioned expiring first-party cookies after 7-days.

I don't trust Mozilla _at all_ these days. Instead Mozilla seems interested in marketing themselves as privacy-focused only enough to grow their userbase for the near future. Once at some critical mass, Mozilla seems to proceed exactly like Google.

- Google Analytics tracking users on configuration page, https://github.com/mozilla/addons-frontend/issues/2785

- Firefox Focus, a tracker blocker, sending user data to third-party Adjust https://github.com/mozilla-mobile/focus-ios/wiki/Install-Tra...

- Firefox installing an add-on without user consent https://news.ycombinator.com/item?id=15931730

- Targeted advertisement via Pocket

- SHIELD Studies and Telemetry

Firefox announced a couple of weeks back [1] that they would be blocking 3rd party cookies in a fashion quite similar to Safari's ITP.

Furthermore, they seem to be experimenting with the same 7 day limit for first party cookies [2].

Neither of these approaches is perfect, but it seems better than Chrome with regards to preventing tracking.

[1] https://blog.mozilla.org/blog/2019/06/04/firefox-now-availab...

[2] https://groups.google.com/forum/m/#!topic/mozilla.dev.platfo...

Bookmark and password syncing is very important to me. As far as I know Safari is unusable on Linux and Windows so it’s not an option. I’ve settled on Firefox Developer edition after finally getting sick of chrome a couple of years ago. Also had good success with Brave and Vivaldi but Brave isn’t quite there yet and Vivaldi needs syncing and a mobile app.

All of Safari syncing is possible on Windows with the (recent) iCloud client on the Windows Store. In fact, with more browsers than on Mac or iOS!

https://support.apple.com/en-us/HT204283

It is true, on Linux no joy.

>(recent) iCloud client on the Windows Store

I've been using iCloud for Windows for many years now, are there new features on the Windows Store client? AFAIK only bookmarks are synced

Even tho I never use Safari I will always give its dues for blocking 3rd party cookies out of the box.

This is a great explanation of the range of Safari privacy protections. Besides cache, it's also necessary to partition or restrict all other storage mechanisms and communication channels. This includes IndexedDB, Web Storage, Service Workers and HSTS state(!), among the various things we've had to address.

>The author probably had the conclusion of the article in mind (setting up good Firefox against evil Chrome) before looking for supporting arguments.

This is a phenomenon known as “journalism”.

> Firefox doesn't play much of a role in this fight. In fact, Firefox never did anything pro-actively to make ad-tech sweat. The decision by Mozilla to block all third-party cookies in 2013 [7] was reverted in fear of Ad-Tech.

This is the problem I have with Mozilla -- they claim to be defending the internet, but they clearly have no leverage or power to effect change because their market share is so small.

I can't name a single bad thing that Mozilla has prevented from happening to the internet in the past decade or so.

I also cannot think of a single good thing that happened only because of Mozilla's support. A lot of this do-not-track stuff, for example, was pushed by other browser vendors and would have happened whether Mozilla wanted it or not.

> I also cannot think of a single good thing that happened only because of Mozilla's support.

Some examples I can think of:

- asm.js, which led to WebAssembly: http://asmjs.org/

- Rust: https://www.rust-lang.org/

- One half of Opus: https://www.opus-codec.org/

- Firefox Send: https://send.firefox.com/

- MDN: https://developer.mozilla.org/en-US/

Don't forget Let's Encrypt!

Just providing an alternative browser to Chrome is a good thing, in my opinion. Especially now that Microsoft also has caved in. I think it would be bad if Chrome where to have even less competition than it has today. So, I put Firefox down as a good thing for the Internet, on the whole.