I didn't experience faster Firefox on: high end desktop, laptop, mobile. UI changed, promotion of features like Pocket that I don't use. But not performance. Chromium is still faster in everything sadly.
And regarding performance, I find it rather unlikely that you didn't experience a performance improvement, especially on mobile. Seriously try downloading the last build of Fennec and load the same webpage on it, then on Fenix (the new Firefox for Android). I've seen 2x load time improvements on plently of sites and the speedup seems to be proportional to how heavy the page is. Yes, Chrome still beats it at anything using JS, but even horribly slow things like GDrive are now completely usable on FF, even with many tabs.
Would it be better if we talk about leanplum and firebase analytics, or say mozilla's telemetry service, or how google safebrowsing is implemented?
I mean, if you comment on Chrome for integrating Google services, you gotta do the same when Mozilla does it, too.
If you don't believe me, run an MITMproxy to check for yourself.
I'd rather recommend Ungoogled Chromium, even on mobile, due to Fenix's lack of privacy.
Also, the OP comment is hilarious because they clearly seem to have forgotten why people bitched about Pocket in the first place. It wasn’t because it was an integration of Mozilla’s services. It was exactly the opposite. It was the fact that Pocket was NOT a Mozilla service at the time the integration happened that people bitched about it.
Which just goes to show that it wasn’t a real concern, but a Twitter net pointless and baseless moral crusade.
Yes! Talk about the things that actually have anything to do with privacy, security, experience...
- Leanplum seems to be there for A/B testing and doesn't have access to anything sensitive.
- Firebase is partially unavoidable (GCM) and as far as I can tell, the only usage of it that impacts privacy is in Rocket (FF Lite) which barely exists anymore.
- Google Safe Browsing seems to be designed in a way that makes it nearly impossible to violate privacy, even if you wanted to. On top of that, FF takes extra measures to protect privacy "just in case".
So where's the problem? Yeah, Mozilla has done some dumb shit (like auto-installing some weird extensions and basically anything upper management does) in the last few years, and they aren't the Stallman* utopia some people want them to be, but they never really claimed to be. Just like DDG, they give you the best privacy level they can while staying sustainable enough to survive.
> - Leanplum seems to be there for A/B testing and doesn't have access to anything sensitive.
Leanplum has access to at least geolocation and the device id (See [1]), due to their geofencing A/B testing feature. Combine that with an IP and you can uniquely identify any user. Additionally, Leanplum sends its messages via their own Firebase Provider [2].
> - Firebase is partially unavoidable (GCM)
Firebase Push Notifications are necessary since Android 10, and only if your application consistently runs in the background. If you have e.g. a download notification with a high priority displayed, your app is allowed to continue to run without any firebase, at all. Source: The Telegram FOSS fork does this, actually. See [3] for details
> - Google Safe Browsing seems to be designed in a way that makes it nearly impossible to violate privacy, even if you wanted to.
Okay, now it's time to refine this in context of "Firefox Klar", "Firefox Focus" or say, the Fenix codebase(s). I'm focussing on Fenix here only, because all current Firefox products for mobile rely on it as an engine.
(Usually the same metrics are included in Firefox for Desktop, too, but this post would explode this comment; see spywarewatchdog or similar audits for more details on it, which still hasn't been improved over the years by mozilla.)
- Mozilla implemented their own ads distribution system that hijacks google ads on pages and replaces the id with the one that was specifically generated for the web browser (after first opening the web browser) [4].
- Mozilla's Safebrowsing uses a generated hash, that is used specifically to identify a single device [5].
- The server for both of those hash URLs is hosted by Alibaba in CHINA, which is certainly a GDPR "violation by the book", as the server is contacted for everyone, not only people that live within China; every time the Browser is online again; even in an interval. (also [5])
- Fenix also adds Tab interactions and sends the data to their telemetry service; including the URL and history of that specific tab [6]
> On top of that, FF takes extra measures to protect privacy "just in case".
As my links prove: No, they don't. For example, they activate Leanplum's device id specific tracking even if the user is outside the geofences, so they track users even if they already know it's unnecessary. [7]
=========
[1] https://github.com/Leanplum/Leanplum-Android-SDK (especially the AndroidSdkCore is relevant here, assuming the discussion of the "most privacy respecting" featureset)
[2] https://github.com/Leanplum/Leanplum-Android-SDK/blob/master...
[3] https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/mas...
[4] https://github.com/mozilla-mobile/fenix/blob/5ad714db864bce7...
[5] https://github.com/mozilla-mobile/fenix/blob/686f7bd7c65cbaa...
[6] https://github.com/mozilla-mobile/fenix/blob/556fea5591acbde...
[7] https://github.com/mozilla-mobile/fenix/blob/41a92a8d8b31644...
Doesn't have access to location and the unique id is specific to leanplum so it can't be tied to anything else. See [1] for an explanation (the source seems to match from my quick look)
> GCM
Firefox has certain real-time features (like sending tabs) that wouldn't be feasible without cloud messaging. Telegram FOSS and many other apps use workarounds that are less reliable, worse UX and drain battery anywhere from a bit more to HOLY SHIT WHERE DID THOSE 4500mAh GO? (source: Telegram FOSS on my OP3T) If you want to propose a better solution, I'm sure the 3 remaining devs at Mozilla would love to hear it.
> Okay, now it's time to refine this in context of "Firefox Klar", "Firefox Focus" or say, the Fenix codebase(s). ...
Sure, let's talk about Fenix - what is now available in G Play as the standard "Firefox for Android". I don't use Klar or Focus, but they use much of the same code, so all of this is quite general.
> - Mozilla implemented their own ads distribution system that hijacks google ads on pages and replaces the id with the one that was specifically generated for the web browser
The link you provided doesn't make that clear and neither do you. What "id" are you referring to? What is its significance and where in the code is it replaced?
> - Mozilla's Safebrowsing uses a generated hash, that is used specifically to identify a single device
The link you give makes no sense. The URL at the marked line is the URL from which hashes of unsafe URLs are fetched (for China). The hashes are (anonymized) URLs, not devices, and they are received, not sent. If what you're concerned about is "SAFEBROWSIND_ID" in that string, it is mapped to an implementation-specific not instance-specific identifier, as is clearly required by Google's API [2] and is in fact taken from a the about:config entry "browser.safebrowsing.id" that you can check for yourself only contains something generic like "navclient-auto-ffox".
> - The server for both of those hash URLs is hosted by Alibaba in CHINA ...
Only for Chinese builds of the engine. See the if statement at [3] and explanation of the config option at [4]. The code you linked simply overrides the default SafeBrowsing API URL for the Chinese market as the original URL is not available there. The browsers treats it identically as the original, so all the client-side privacy guarantees are still there.
> > On top of that, FF takes extra measures to protect privacy "just in case". > As my links prove: No, they don't
That part of my post was still referring to SafeBrowsing, specifically the part where they separate the cookie jar and inject some extra noise. [5] explains the whole process quite well (it's similar to how HaveIBeenPwned works)
> For example, they activate Leanplum's device id specific tracking even if the user is outside the geofences, so they track users even if they already know it's unnecessary. [7]
But they're not "tracking" them in any significant way. My first link outlines this quite well. As for why those locales are hard-coded, It's probably because those are the biggest markets and will usually be the first in A/B any rollouts, so using geofences would just be wasteful as they'd always return true anyways. Either way, nothing nefarious there.
[1] https://github.com/mozilla-mobile/fenix/blob/b8de7079a963efb...
[2] https://developers.google.com/safe-browsing/v4/reference/res...
[3] https://github.com/mozilla-mobile/fenix/blob/master/app/src/...
[4] https://github.com/mozilla-mobile/fenix/blob/baaa85db804a096...
[5] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...