Hacker News Reader

Comment by rubyn00bie | Hacker News Reader

This is literally, one among many reasons (ha!), why I use Firefox. Every other browser vendor is a for-profit entity, and as such will limit good ad-blocking measures as Safari and Chrome have done recently with their new "security" policies.

This is also why I don't use a VPN I don't run (or certainly not one that hasn't been audited with a good reputation), and I certainly would never fucking dream of using a free VPN unless all the traffic over it is absolutely worthless.

... How many of these things install root certs where even after you've canceled your subscription you're still accepting their bullshit?

On the other hand, this could make for a hilarious experiment using adversarial neural networks to troll the assholes mining data from the VPNs.

View on HN

"Every other browser vendor is a for-profit entity, ..."

Not the one that authored the text-only browser I am typing this from.

Whether Mozilla turns a profit or not makes little difference in this instance. Mozilla does not survive on donations from users. Its employees are not volunteers working for free to defend user privacy. Its generously compensated executives and staff need money from the online ad business, just like employees from the other browser vendors. If Mozilla stopped taking money from Google or some other online ad business partner, then Mozilla employees would lose their jobs.

Maybe of interest: https://dustri.org/b/mozilla-is-still-screwing-around-with-p...

I think they're talking about browsers that actually implement most of the spec.

Can you recommend one text-only browser?

https://en.wikipedia.org/wiki/Lynx_(web_browser)

https://en.wikipedia.org/wiki/Links_(web_browser)

Note I do not recommend using a text-only browser interactively for any sort of commercial or important online activity. I use it for recreational activities like reading HN and the websites posted here.

I used lynx many years ago in the early 90's. After switching to links, I would never intentionally use lynx again. It amazes me that people still mention lynx when the topic of text-only browsers comes up. I would be shocked if these people who recommend it are using it as their browser on a daily basis for decades.

> Every other browser vendor is a for-profit entity, and as such will limit good ad-blocking measures as Safari

I thought Safari introduced support for Content Blockers specifically to avoid ad blockers from phoning home and passing potentially sensitive information to the ad blocker's writer.

Lots of people then got quite cross that their favourite blocker had been blocked.

That is exactly the bullshit they want you to believe. Restricting your ability to install/modify software on your computer because bad software could harm you. You have been bamboozled.

I think, especially given events that’ve transpired since, Apple was fairly justified in not giving third party developers unfettered access to web pages and network requests running through the browser.

I am very glad that I can install an add blocker on my phone and I don’t have to trust that it’s not going to mine and sell my data.

I haven’t been bamboozled, I’ve just made a different decision with a different set of trade offs than you.

... This entire discussion IS about bad software that DOES harm you, and you rag on the measures to specifically protect against something like that? What the heck?

Yes, I'm not saying there is no harmful software, I'm saying these kind of "protections" are the wrong solution. The same people who install blindly any add-ons will also install any exe-files if the promising website tells them to because the browsers add-on-system does not provide the required mechanics.

So the next step is to disallow exe-files. But of course you can let the exe-file get signed for a "small" fee...

> The same people who install blindly any add-ons

Like Facebook?

Should installing the Facebook app on your phone allow them to intercept any network requests your web browser makes?

Sure, if the app asks for that permission and you allow it.

Users can manually choose to run unsigned executables. Please stop spreading that FUD.

They can for now. I wrote disallowing unsigned exe-files would be the logical next step in "user-protection".

> You have been bamboozled.

The dramatically reduced incidence of various non-technical family members having to go to me or Geek Squad for yet another virus infection says otherwise.

I use safari every day with content blockers and literally never see ads. I use adguard + Safaris own content blockers.

Part of the reason I enjoy Safari is that I've found its content blocking system to be very coherent

No, it was introduced so that Apple could hurt Google on iOS / mobile Safari without opening the can of worms that is browser extensions.

Keep in mind that Apple gets paid a percentage of Google ad revenue made in Safari; just like how Mozila gets paid a percentage of Google ad revenue made in Firefox.

Apple is hurting themselves too.

Apple came up with a better way to mine your personal data through its Safari browser.

They introduced a feature (Intelligent Tracking Protection - ITP) that they claim blocks ads / trackers from tracking you online on the various sites that you visit.

A simplistic explanation:

Every time you visit a website with an ad or a tracker, it leaves a cookie on your browser that identifies you. You could block many of them by telling your browser to block cookies from third-party domains. This coupled with ad blockers is one effective way to tackle online tracking.

What Apple did was to deliberately take away this control from us and ask us to trust them to deicide which cookie is allowed and which is not.

They REMOVED the feature to allow us to block third-party cookies. So now you have only 2 option in Safari - allow ALL cookies or block all cookies. You cannot block all cookies as it breaks nearly all websites. Apple claims that you should allow websites to set cookies so it can research and find out which cookies track you. And so every time you visit a website, and it sets a cookie, Apple collects this information "anonymously".

So in effect, this "privacy feature" is designed to let Apple know about every website you visit.

Ofcourse, Apple claims all this data is anonymously stored (i.e. not tied to any of your personal information like Apple id). (This idea of anonymous collection of data has already been debunked and proven false as it can be "deanonymised").

Second, Apple claims that its anti-tracking feature will not work in private browsing mode because private browsing mode doesn't save cookies once you close a tab. So in effect, Apple deliberately cripples private browsing mode, in effect, advocating that all its users use normal browsing mode (so that Apple, and others, can mine more data from its users)

Third, by taking away cookie control, Apple now is in full control of deciding which cookie can stay in the browser. This means that if you visit a website regularly, Apple will decide how its cookies should be treated, regardless of whether you want it deleted it or not.

All in all, Apples anti-tracking feature is just designed to give their competitors a harder time while giving Apple the ability to mine their users data better and also taking control away from them.

Google researchers also found that Safari's anti-tracking feature was broken and quite weak:

> ... According to the Google researchers, the vulnerabilities left personal data exposed “because the ITP list implicitly stores information about the websites visited by the user”.

> ... The researchers also identified a flaw that allowed hackers to “create a persistent fingerprint that will follow the user around the web”, while others were able to reveal what individual users were searching for on search engine pages.

Apple claims to have fixed this. But the fact remains that the feature is still not quite effective because most online trackers have moved on to browser finger printing.

The developer of the popular ad-blocker uBlock Origin has also stated that Safari / webkit ad-blocking abilities leave a lot to be desired.

Source:

- https://www.theguardian.com/technology/2019/jul/23/anonymise...

- https://www.fastcompany.com/90278465/sorry-your-data-can-sti...

- https://www.nytimes.com/2019/07/23/health/data-privacy-prote...

- https://www.ft.com/content/916a766a-3d27-11ea-a01a-bae547046...

- https://www.theregister.co.uk/2020/01/22/apple_intelligent_t...

- https://github.com/el1t/uBlock-Safari/issues/158

> So now you have only 2 option in Safari - allow ALL cookies or block all cookies.

Didn't they make blocking of 3rd party cookies the default? If I browse privately and look at the cookies on my machine by going to Prefs > Privacy > Manage Web Site Data, I don't see any cookies showing up after I've closed a page.

The gist of my argument is that you have to cede control to them and trust them, for something that we could explicitly do before.

> is designed to let Apple know about every website you visit.

source?

They obviously don't explicitly say it.

Apple begins mining browsing data in Safari via differential privacy - https://macdailynews.com/2017/09/26/apple-begins-mining-brow...

> ... How many of these things install root certs where even after you've canceled your subscription you're still accepting their bullshit?

It does seem like a bit of a flaw that removing the app on iOS doesn't automatically remove the profile such apps install: https://support.apple.com/en-au/HT205347

I'm pretty sure Apple will remove the VPN profile, which is why leaving a root certificate seems dangerous for users who don't know what they're for.

There can, of course, be legitimate uses for this tech. https://www.charlesproxy.com/documentation/ios/ or maybe opting out of certificate transparency reports, but they do seem like edge cases.

> It does seem like a bit of a flaw that removing the app on iOS doesn't automatically remove the profile such apps install

AFAIK only system apps can install profiles. These apps work by getting the user to install a separate profile via Safari.

> I'm pretty sure Apple will remove the VPN profile, which is why leaving a root certificate seems dangerous for users who don't know what they're for.

If these aren't enterprise profiles then Apple may not have an easy mechanism to block them (other than blocking their semantics).

Apple has a ton of variants of profiles, I keep expecting them to deprecate swaths of types/installation methods to help this be more understandable.

If Safari has a system back button to take me back to the app, it knows enough to include the “originating app” for the profile. Similarly it could create an association between the domain the profile is hosted on and the app. Finally, Apple could indeed change how profile installation works such that profiles need to be signed and associated with either an Enterprise account or a per-app developer account, to make deleting such apps-with-profiles in future more robust. Lastly, like privacy warnings, Apple could say that Certificate Owner has installed a root certificate to monitor all communications and let you opt out. That would be ideal, to deprecate existing methods and even more explicitly support app-based root certificates in their privacy warning flows.

Being a foundation does not entirely remove the incentives to do shady shit, it just reduces them a bit. Look at ISOC's sale of .org or for Mozilla when they gave Cliqz the browsing histories of a random sample of all German Firefox users.

Mozilla is a for profit entity with some history of selling out their users (Remember Pocket).

The Mozilla foundation is a non-profit.

The Mozilla Corporation is a for-profit entity with hundreds of millions of dollars in revenue.

The Mozilla Corporation is wholly owned by the Mozilla Foundation and bound by its charter. The split structure is an artifact of corpotations being better-understood legal entities than foundations, and thus easier to deal with in various situations (hiring, contracts, etc). See also the Signal Foundation and Signal Messenger, LLC.

What happened with Pocket?

It was forced into FF as a non-removable extension.

After Mozilla bought Pocket.

No, two years after.

The integration happened in 2015. The acquisition was not until 2017.

They have some history of selling out their users... by literally selling their history: https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

This was an experiment (2017), not sure what became of it.

> Less than one percent of users in Germany installing Firefox from our main download page will receive a version of Firefox with Cliqz recommendations enabled out of the box.

> This experiment also includes the data collection tool Cliqz uses to build its recommendation engine. Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit. Cliqz uses several techniques to attempt to remove sensitive information from this browsing data before it is sent from Firefox. Cliqz does not build browsing profiles for individual users and discards the user’s IP address once the data is collected.

Firefox is like that really ugly flower that blooms once every hundred years, they leapfrog the competition briefly and then eventually degrade back to being crap for regular users. I'm aware of the technical politics around what causes this but that only really matters for people who choose browsers based on cyber politics. Quantum was good for six months, now we're back to the same situation where almost everyone outside the tech bubble is using Chrome.

You'd think that maybe this would cause them to exercise some strategy, like rushing to conquer mobile since Chrome's mobile ui is trash, but nope. Hell, Brave of all things is doing better at mobile than Firefox.

Firefox mobile can't even render pages reliably. That matter more than the UI.

>Quantum was good for six months, now we're back to the same situation where almost everyone outside the tech bubble is using Chrome.

Did Quantum became worse or you're basically saying Mozilla is bad at marketing (and having huge vertically integrated ecosystem)?

It's hard to move browsers permanently if you're not prepared. I moved to FF Quantom for a bit, but had to regularly open Chrome to get passwords etc. And the Chrome assholes removed the password export (or at least I could not for the life of me get it to work at the time)

I ended up going back for a bit and added a password manager, and now I can move between browsers easily - but as I said, it's not always straightforward, especially for _most_ non-tech users.

Firefox has a built in import of browser data from other browsers such as Chrome. Does this no longer work?

It doesn't exist on Linux. When I moved from Chrome to Firefox, I used https://github.com/louisabraham/ffpass.

> It's hard to move browsers permanently if you're not prepared.

I find it rather easy, at least in my case. Passwords are all managed via a password manager, I barely use bookmarks, so most of the work is re-installing and configuring a few plugins, which I also don't use many of

> And the Chrome assholes removed the password export (or at least I could not for the life of me get it to work at the time)

Chrome Settings > Passwords > "Export passwords..." (under the three-dots menu).

Not sure when you last checked but the option has been available since at least Chrome 66, which was released almost two years ago: https://www.ghacks.net/2018/04/18/google-chrome-66-password-...

I distinctly recall the option to manually import passwords being harder to find (solution is to either import them from another browser or enable a flag to import passwords from a CSV file).

Ironically Firefox currently still lacks the native ability to manually export passwords, relying on add-ons or third-party tools: https://www.nytimes.com/2018/07/20/technology/personaltech/f...

I install firefox + ublock origin + https everywhere whenever I can weather it's friends, family or colleagues. After a bit of explanation they usually understand the matter. It's all about user education.

I have had zero "relapses" back to safari or chrome so far, they all seem to like browsing without ads and tracking.

Indeed. It only takes about 45 seconds to remove almost all ads from someone's online experience. Not getting ads on youtube is by itself a game changer for alot of people. Many people happily pay for blessings from monks and priests that take about the same time, except this actually improves lives in a concrete way and is free. Spread the gospel of FOSS

>Firefox is like that really ugly flower that blooms once every hundred years, they leapfrog the competition briefly and then eventually degrade back to being crap for regular users.

Firefox is the AMD of browsers.

Reply on news.ycombinator.com