Mozilla rewrites Firefox's Terms of Use after user backlash
techcrunch.com
techcrunch.com
Those who care very deeply about very tight privacy have enough niche options.
But I want there to be browser that has enough privacy to be sustainable so there’s a reliable option for me to recommend to family members etc which is holds enough market share for websites to test against.
If Firefox’s market share dips any lower website makers won’t support it - testing only against the homogeneity of chrome/edge/safari and then it will become a death spiral and humanity will have taken a step backwards.
It’s a case of use it lose it.
Mozilla has little enthusiasm for developing its actual web browser, and doesn't seem to like its users very much.
For the past decade, Mozilla has made one bad choice after another, and every time it blows up in their faces, their takeaway is that they failed to properly 'educate the customer'.
Mozilla should just get out of the way. If Google Legal didn't need them, they already would be out of the way.
Ladybird is also not ideologically captured by anti freedom extremists with self contradictory beliefs. Mozilla refuses to allow anyone to donate to firefox development because they demand the right to redirect funds you give them towards discriminating against people they don't like.
Can you expand on this? This feels wildly editorialized.
>they demand the right to redirect funds you give them towards discriminating against people they don't like.
It sounds _incredibly_ suspect, frankly.
[1] https://blog.mozilla.org/en/mozilla/mozilla-brand-next-era-o...
[2] https://blog.mozilla.org/blogarchive/blog/2021/01/08/we-need...
and servo please ...
> that has enough privacy to be sustainable
These are the key phrases. Mozilla has hitched its wagon to advertising. Behind all the bluster over last week, the underlying direction is clear. They bought Anonym [0] and Ajit Varma, the new VP of Product for Firefox and source of the updates, is ex-Meta. It's reasonable to assume that he's there, in part, because of advertising expertise.
Some will see Anonym's "privacy-powered advertising" as "enough privacy" and the only viable way to sustain Firefox without Google's annual cash injection.
Others won't buy that, believing that a browser can be built without relying on advertising. Ladybird is taking this approach - so we'll find out.
> If Firefox’s market share dips any lower website makers won’t support it
This is the risk the exec team must know they've taken. Specifically: what proportion of the current Firefox user base exists because of the historic pro-privacy stance, and what percentage of that will leave because of the advertising-based future?
--
EDIT: addedd missing reference
I'm afraid that we'll find out indeed and end up with no Ladybird and no Firefox either.
If you make a move like this you need to announce it in advance. You announce it loudly! You need you recognize that users concerned with privacy are looking for canaries. So when you have to put a canary down you fucking tell people before and don't just wait for them to find a dead canary. Of course people are going to freak out, that's what canaries are for.
No we need to get rid of Mozilla (the org and the company), transform/fork Firefox and Thunderbird to a community project with (maybe?) a Foundation behind like FreeBSD or Blender.
Mozilla's CEO's and Manifesto writers did nothing to support Firefox but fill their own pockets and hype the AI train, I really wonder how much money goes directly into the development of Firefox, if we compare it to the Linux Foundation supporting Linux (the Kernel) it's about 3%, it's probably even less for Mozilla.
side note, thunderbird is already independent and democratically-managed by the community (as of a few years ago). the way I understand it is that they effectively just use mozilla's resources for legal, logistical stuff
I really don't think so, have a look at the ladybird browser:
https://ladybird.org/#sponsors
Or even Servo:
True because the real cost to support a "a fully featured browser" is at least a 1/4 billion dollars....because OpenSource needs to make money, not for the Dev's but the MBA's ;)
With the current board and directors and focus I don't see any ways Firefox will gain share in the future (or not any that I really care about), and I certainly have no interest to support the current goals ...
For the privacy part Mozilla has been sitting on features like containers for years with no improvements. At this point I believe Mozilla ending might be better since it would shake things up ...
That's some bizarre upside-down-world Stockholm Syndrome thinking on display here. That or you are a paid PR influencer working on behalf of Mozilla. Just absolutely astonishingly weird psychological behavior.
Mozilla is violating user privacy. They are the bad guy. You don't ask the bad guy for help. You punch them in the face. These guys are making it worse, not better, and helping them will only make privacy worse, not better.
There are already multiple forks for Firefox and destroying Mozilla as an organization would greatly help one or more of them take off and carry the banner of true enabling privacy for the user, which Mozilla is not doing.
ALMOST EVERYONE is voilating user privacy to some extent. That's the price to pay for free software. It sucks, but how do we climb out of that reality?
Punch the bad guy in the face if you like, YOU have options, but once FF is sunk, the the only provider most people can turn to for the stuff they need is Chrome.
If Mozilla/FF is the bad guy in your analogy then Chrome must be an atroticy-committing omni-cidal megalomaniac, which correct me if i'm wrong, is not better.
If you understand the privacy landscape and don't want to get involved you don't have to. I'm on a multi-container, multi-privacy extension, private-search setup because I roughly understand the environment. But I'm certainly not recommending that setup to my parents.
In my view MZ/FF is the least worst of the VIABLE alternatives and has the best chance of success. Sinking Mozilla's firefox in favour of ladybird or brave but none of these will ever have the marketing collaterall that mozilla has/had to be anything other than niche, until they are bought by Meta or Amazon or (you get me)
Most banking websites that most people need to use don't give a fuck about niche browsers and actively agent-sniff to reduce their support and security footprint. Whining down the phone to megacorp's customer support that "you don't want to use Chrome on privacy grounds" and "they really should support ladybird" will not be the mighty hammer of resistance you think it is.
I don't have a better suggestion and so I'm willing make a deal with a bad guy it means I don't have to install Chrome on my mother's PC.
There are a number of FF forks available as well.
Which is hardly trivial, there are hundreds of open issues on Bugzilla for XUL alone. Some of the gaps include accessibility issues, which is down more to Cr better supporting APIs provided by vendors like NVDA. This is first of all, not something that is 'easy to evade' for the affected demographic, and secondly something Mozilla was an industry leader in for a long time. Obviously, Google didn't invest in this out of any sense of altruism, but it speaks to the sustainability of browser development, and what approaches thereof actually work.
(a) Ignore browser security updates
and
(b) Install some extensions to fettle with user-agent strings to match popular browsers.
Streuth.
They have changed literally nothing except the FAQ. The "selling" is describing behaviour they already do and have been doing for years. They set the default search engine to Google, this is now considered selling user data.
> There are already multiple forks for Firefox and destroying Mozilla as an organization would greatly help one or more of them take off and carry the banner of true enabling privacy for the user, which Mozilla is not doing.
You do realize that if Mozilla dies then every single one of these forks dies with it? Surely?
None of the teams working on these forks actually do any core browser engine work. Without Mozilla you are an ECMAScript update or a new web standard away from your fork of choice becoming a brick.
https://blog.mozilla.org/en/products/firefox/update-on-terms...
The actual content:
> [Given that the definition of "selling" in legal terms can be slippery, we must be aware of not falling in cases like the following:] In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners, including our optional ads on New Tab and providing sponsored suggestions in the search bar. We set all of this out in our Privacy Notice. Whenever we share data with our partners, we put a lot of work into making sure that the data that we share is stripped of potentially identifying information, or shared only in the aggregate, or is put through our privacy preserving technologies (like OHTTP)
> in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as...
And then they go on to describe what a common-sense definition of a sale is. There's nothing broad or slippery about the example, so yes, they basically say "we're going to sell your data"
If it's such an outrage worthy subject why did no one explode about this when they added the sponsored links years ago?
There was a lot of discussion and consternation about this as well.
From that perspective it's super transparent, if you bother to look.
There's no evidence they're doing anything with any data and there never was. All of this outrage is purely centered on a ToS update which they've since refactored in response.
And:
>>This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox.
So now we can use your photo of your birthday party that you sent via webmail... but don't worry, we don't own it, you just gave us a "non-exclusive, royalty-free, worldwide license".
Please read the second half of the text you quoted, where it says "for the purpose of doing as you request with the content you input in Firefox."
I cannot find a nicer way to say this, but a lot of people in these threads are essentially winding themselves up and then producing rubbish like this to fuel their own anger.
Mozilla have been clumsy sure, but this collective tantrum as a response makes zero sense especially now with given context it's clear they're not doing anything they haven't been doing for years.
The Privacy Notice says they can use your data in anyway they sit fit to make the business a success. They should close that loophole if they want to gain trust.
> This does not give Mozilla any ownership in that content.
They've since removed the reference to the privacy policy since as they said, users are clearly confused by it.
That comment is constituted from two quotes, one of them entirely fabricated, and then a hypothetical provided with no basis. If Mozilla don't own the data and their license only allows Firefox to do what you're requesting it do, then I don't see what points are being made except fearmongering.
https://www.mozilla.org/en-US/about/legal/terms/firefox/
> You Give Mozilla Certain Rights and Permissions
> You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content.
The next line does not alter the first, hence why I did not include it. I also didnt include the rest of the ToS that has no bearing on my point.
https://blog.mozilla.org/en/products/firefox/update-on-terms...
Read the italicised text.
So you "Mozilla" license my data, but i am still allowed todo anything with my data..but so are you (Mozilla) right?
What are you trying to explain here?
Why do you think open source software, or any software for that matter, should have the right to put a license on MY data? You (the software) are the processor, not the creator, they want to change that by feeding a processor to create an AI creator based on wetware creations...for free.
Imagine a Mill, Lathe or 3D-Printer would do that.
This is actually more of what I was talking about, making stuff up to make yourself angrier.
Where are they doing anything AI related with your data? Where's the proof?
There's none, because they're not, it's something you've come up with just now out of literal thin air.
Let's examine the actual wording in excruciating detail because apparently that's needed
> It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox.
Non-exclusive: The right they claim doesn't stop you or anyone else from claiming the same or similar rights.
Royalty free: They won't pay you for it.
Worldwide: It doesn't matter which jurisdiction you're in.
"Doing as you request in Firefox": Carrying out operations which might mean moving your data from your local machine to a remote one, such as making web requests with requests bodies formed from data you've input.
In total: This means they have the non-exclusive right, without need for payment from you and no matter where you are in the world, for Firefox to do what you've asked it to do with your data. When you posted this comment, that was you telling Firefox to move some data to the internet for you. That is what this legal text and the right they claim provides to you.
In the old internet they didn't need to write any legalese for this, their legal team think they might need to now because the landscape has changed. That's it.
> Imagine a Mill, Lathe or 3D-Printer would do that.
If your mill, lathe or 3d printer could publish your data to the internet I guarantee you with 100% certainty they would include licensing text accomplishing roughly the same thing.
>without need for payment from you and
No need to pay YOU, you are twisting things around.
Have fun, i stop here arguing.
So you googled "mozilla ai" and clicked the first link, which does literally nothing to support the claim you made up.
Let me make a wild guess, you don't actually know what the Mozilla AI project does.
>>without need for payment from you and
> No need to pay YOU, you are twisting things around.
I notice you ignored the rest of the entire comment to yet again make something up and get mad. Why would anyone need to pay you for the data you're sending voluntarily? Should HN be paying us for these comments?
> Have fun, i stop here arguing.
Yeah I bet, have a good one. Hope at some point all of this clicks for you, because I think you fully do not understand what's going on.
Anything smaller I could use myself, but would absolutely never recommend to others. As I said, current mainstream enough options are only Firefox or Chrome.
They are not clear where/how the data is being used. For example, why are "Unique identifiers" and "Interaction data" part of "To provide you with the Firefox browser"?
From "Interaction data": "This is data about how you engage with our services, such as how many tabs you have open or what you’ve clicked on." -- Why is it necessary to track how many tabs I have open in order to provide the browser to me? -- That isn't something they need to send via HTTP to make websites function. If it is for telemetry and improving the browser, that should be a separate section.
They are saying that you give a license to Firefox to do as you request. That's all. The language is explicit and explain the relationship between you and the product when you use it. The product behaves as your agent, and would need permissions to do so. Every browser implies this, Firefox just was explicit with it.
It doesn't differentiate when that data is stored locally, when it is sent to (and collected by) Mozilla, and when it is sent/accessed by the website you are on/using.
Likewise, because "Interaction data" covers both "how many tabs you have open" and "what you’ve clicked on" (as well as ad related information in the next paragraph) it can cover things like handling anchor ping attributes (what you've clicked on) which are nec1essary for Firefox to work w.r.t. that feature vs. collecting ad related information ("Click counts, impression data, attribution data, how many searches performed, time on page, ad and sponsored tile clicks.") which is not.
With those broad information categories they are combining different use cases from using the browser, telemetry, and collecting data useful for advertising.
Another example: in the "To adapt Firefox to your needs" section they explicitly call out sending location data to websites like Google Maps but the data collected is listed is "Any data type" not "Location".
I know there are other cases, but the specific wording is vague and unclear. For example that section mentions being able to "clear your browsing history". As a developer I can infer that that is related to JavaScript APIs being able to access your browsing history, but that isn't called out in this section so it is unclear that this is what they are referring to.
Anyway, you can disable that telemetry in the prefs UI with a single click.
As leaders, they need to be held accountable for their poor decisions. Which means they need to fuck off, and let new people come in and rebuild trust.
obviously something needs to change here procedurally, but micromanagement across the entire board is not the answer
and therefore firing management for this is not really solving anything other than satiating the bloodlust of the mob
> For instance, Mozilla said it may have removed blanket claims that it never sells user data because the legal definition of “sale of data” is now “broad and evolving,” Mozilla’s blog post stated.
> The company pointed to the California Consumer Privacy Act (CCPA) as an example of why the language was changed, noting that the CCPA defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”
mind you, I sincerely doubt this ever even came across the desks of leadership—if it's legalese compliance bullshit, why would it?
In one, my argument is an overreaction. In the other it is reasonable, given they have been misleading consumers. A strategy which clearly would be oversighted by senior management.
but I honestly think that's a totally unreasonable conclusion to draw based on this kerfuffle alone
the important question is, how many people left?
in my case i've been using firefox for more than 20 years, through the crashes, the memory leaks, the incompatible sites... and i disengaged, (uninstalled and deleted my account). i am not particularly gung-ho on privacy, all and all a pretty run-of-the-mill middle of the road guy. i wouldn't be surprised if they lost a high 1-digit or low 2-digit percentage of their user base with that debacle...
with the drop in image i fear they lost a lot of potential new users too... that might be the hardest hit. this might accelerate their slow descent into irrelevancy...
to oversimplify into a couple points:
* people make mistakes, especially in communication—it happens! I misspeak (or often don't fully consider how people with different POVs will interpret what I say differently) all the time, personally
* nearly mozilla's entire remaining userbase has stuck around because of mozilla's independence and focus on privacy. everyone with a brain knows full well that selling all user data entered into the browser is the single biggest possible violation of that. therefore, how would mozilla continue to exist as a company in any capacity if that were actually the case? they would have zero users
finally, I'll leave you with hanlon's razor: "never attribute to malice that which is adequately explained by stupidity"
Even now, Firefox still doesn't consider what they do "selling data", and they are forced to change the wording only because the laws are weird.
Frankly, I just don't see how sharing data to partners to make yourself commercially viable can be construed as not selling data. In their own words, what Firefox does is:
> In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners, including our optional ads on New Tab and providing sponsored suggestions in the search bar.
We could argue about whether the laws are slippery or over-reaching, or how responsible or not Firefox has been handling user data. We could argue about how much anonymization and aggregation of data reduce privacy concerns.
But to argue that the above action is not "selling data" is in my view not a reasonable position.
Despite all the justified doubts and concerns, it's also worth noting that Mozilla runs one of the few independent browser engines left, with limited ways to actually fund it.
When they're not here anymore, there aren't many parties left to argue about web standards in favor of a free web.
So I'd keep watching them as always, without painting them as evil just because of some misstep...
"The Firefox Browser is the only major browser backed by a not-for-profit that doesn’t sell your personal data to advertisers while helping you protect your personal information."
Now just says.
"The Firefox Browser, the only major browser backed by a not-for-profit, helps you protect your personal information."
This is not some misstep, it is the breaking of a promise.
They are now at 2.6% market-share, I can imagine that revenue-stream is making it hard to keep the lights on.
It's sad that it came to this, but somewhat understandable as they don't really have these other lucrative side-businesses of Google, Apple, Microsoft.
FWIW, the change is that the new wording allows them to build a revenue-stream based on telemetry data, while the original wording prohibits them from such a financing model at all.
Outside of Europe this might be significant, but in European legal context the difference is that they could now ASK you if you allow them to use your telemetry to create revenue, and only do it IF YOU AGREE (small nudge to push for privacy-friendly laws).
ETA: Setting Google as their default search engine in exchange for funding from Google has been cited as an example of "selling user data to Google", if you'd like a concrete example of what I'm talking about.
No it doesn't.
Please read.
...yeah? That's pretty straightforward.
In objective reality it's a bit of much ado about nothing, but in today's world it's optics and perception that rules. It's subjective.
As another comment says it takes forever to gain trust and a moment to lose it all. Trust is subjective.
It's insane to think Firefox would ever have gone this route? How disconnected is management? The move would be suicide! A major reason people use Firefox is because of privacy. The other major reason is because a user's privacy conscious child or grandchild installed it for them. That's your whole fucking userbase!
It's a shame too because they had the opportunity to double down on privacy. What with Apple caving to governments.
I was a fanboy who's been with you for nearly two decades You can check my comment history. I defended you through tough times, I've donated, and for what? A slap in the face.
You had it going with the rust rewrite and just floundered on every opportunity. You made Thunderbird pretty good and gave many hope, then floundered. You have some great devs, let them make great software
So where do we go now? What browser that isn't just a different color of chrome? Safari? No. Ladybird? Sea Monkey?
_Exactly_ as you say, like a virus, whenever I visit family I will be switching out their browsers from Firefox to the next best thing.
> The company pointed to the California Consumer Privacy Act (CCPA) as an example of why the language was changed, noting that the CCPA defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”
Wow, I'm actually stunned that Mozilla straight-up admits that they're selling user data here and that's why they removed that language.
Good for them for being honest. Bad on them for selling user data.
Firefox and Thunderbird are two of the last bastions of functional, accessible FOSS software in their respective spaces. The software landscape would be a lot more bleak without them.
It's important to hold Mozilla to account given their role (and this TOS roll-out was clearly a screw-up whatever way you look at it) but the amount of people jumping in saying that they are irredeemable now, that we must now stop using their software even if they backtrack on this, is counterproductive. And honestly I suspect a lot of the people saying that have also been saying it for years before any of this happened.
I've been deeply studying "trust" for the past year, as part of a project around "Zero Trust". It's a core pillar in cybersecurity. Trust is very complex. Extremely hard won, easy to lose, practically impossible to rebuild.
Mozilla have blown it and there's no going back for that company. This is what happens when you let morally defective people take the reigns. My advice would be, dissolve it and use whatever money is left to start new projects for free-software browsers.
Mozilla's core major malfunction is that they are deceptive, as an organisational culture. No amount of hard work, careful words, money spent on PR will hide that odour, and whatever goodwill they show now will naturally be undone as they return to business as usual.
This makes it harder to trust messages about not trusting ie. Firefox.
From where I stand, Mozilla have done little to deflect that, everything to encourage it and generally been been their own worst enemy.
Taking on an operation like running Mozilla is not just running some random tech company that makes a browser. Standing up for software freedom is an ideological stance (in the best possible sense) and requires more capable people who are prepared to dig deeper, work harder, take risk, and stand up for what is right.
I do not see those people at Mozilla. Correct me if I'm wrong (and let's have their email) so I can apologise and invite them to discuss why Firefox is no longer a browser that I can trust.
(IANAL, corrections welcome if you can actually point to a law that says otherwise)
This looks like a deja-vu of Apple CSAM scanning.
"We didn't mean it".
At least, that's how I read it. IANAL.
You actually do. It's implied that by using the software you give it to the software to act to your agent, but you actually do have it. In court you would have to establish this behavior using context. Mozilla avoids all of that by making it explicit.
> only a license if they are also sending it to themselves or on behalf of themselves
Which again, the license still doesn't allow.
Under what law? As far as I know neither copyright nor the various privacy laws care about what an executable on the user's machine is doing, as far as the liability of the company goes. They only care about what the company sees.
>Which again, the license still doesn't allow.
Which is why it doesn't make sense, especially when their privacy policy does spell out that they are selling data collected from the browser (not very much, but there certainly is some)
If they acquired Tailscale, I'd stop using it.
If they endorsed ChaCha20, I'd question if it is backdoored.