Mozilla's page talking about privacy has Google analytics enabled
shapeoftheweb.mozilla.org
shapeoftheweb.mozilla.org
Our Google Analytics premium account is set to opt-out on all of 3rd party
uses of the data and the only people who have access to the anonymous
aggregated data is Mozilla Employees. This is not the normal Google
Analytics setup that most people use on other websites.
Also, to increase privacy we flipped the anonymize flag in the Google
Analytics request...
For example, running some log files offline through AWstats is not that hard, and the AWstats output is quite good for most purposes.
You haven't done any serious web analytics at scale, have you?
1. Mozilla is one of the good, independent orgs that don't have profit as their main goal. They do fight for the interests of the community at large.
2. If they remove third-party analytics from their web properties, Mozilla instantly loses valuable actionable insights that significantly increase their efficiency as an organization. Creating a viable alternative to Google Analytics is practically impossible for Mozilla due to lack of resources.
3. If Mozilla loses operational efficiency, Google/Microsoft becomes more powerful and are able to obtain more users for Chrome/IE. They use all analytics they need. Less users for Mozilla means less income from search engine deals and less influence.
4. No meaningful privacy increase for users is achieved, Google Analytics is now installed on (billions - 1) websites.
So. You want a non-profit with proven track record of shipping great software and protecting the interests of individuals to take a significant hit in the name of hard-line ideological principle that won't really benefit the users.
I guess I am missing the point.
It's the same thought process behind 90% of the things we do that people hate Mozilla for. People think Mozilla is pure and 100% ideal by whatever standards that they make up themselves, but the truth is that Mozilla is _pragmatic_. Sometimes we do things that aren't great because to do so otherwise would hurt the greater mission.
For example, we don't exist to create 100% open source software 100% of the time. Instead, we _strongly_ believe what we say in our manifesto: "Free and open source software promotes the development of the Internet as a public resource." Sometimes, mostly when we're working with a partner (like a phone company) who can offer us significant leverage, we write some code that isn't immediately made public, and _that's okay_. Our end goal isn't to put more open source software in the world, it's to further the internet as a global public resource.
(Mozilla is also so diverse and disjointed that sweeping generalizations like the ones I just made are completely inaccurate. We make mistakes and we make bad choices. Mozilla is more like several different companies that happen to share the same name.)
Thank you for your contribution to the free/open web.
2. Well that's a bold statement to make to say that web analytics have to be third party to provide valuable actionable insights.
3. I don't care about operational efficiency, I care about my privacy. If mozilla sacrifices privacy for operational efficiency, well they do sacrifice privacy.
4. WTF are you talking about,visiting a mozilla webpage that doesn't give away analytics data to a third party gives better privacy than visiting a mozilla webpage that does. This is true whatever the rest of the world does. Besides mozilla has no reach on that billion of websites.
I tend to differ, the track record does not exactly point toward shipping great software, nor protecting the interest of individuals. As shown by bugs marked as won't solve and inclusion of controversial features while removing other.
So yup, you are missing the point because you seem blinded by your own vision.
I am ok with my views being challenged but remain unconvinced by your arguments.
Mozilla aren't selling anything on that page. They won't be making key engineering decisions off of the page.
Could you detail the gains that they could make that makes the world a better place? That justify any sort of tracking over '300, 000 people viewed this page today' that you can get from your own logs?
There is some data that might be occasionally useful, like screen sizes, but only occasionally.
- See how people get to the privacy page from where they enter the site. Useful to see if some categories are getting more traffic than others, so that we can re-balance if, for example, we think that Privacy is not getting the attention we want it to.
- See how long people are staying on this page. What if the writing or infographic don't make sense to users? We can try and improve them so that users come away with a better understanding of privacy.
- How are users interacting with those circles? If they're not hovering over any of the circles, maybe we should make it auto-switch between them to draw the user's eye over. Or maybe if they're only hovering over the first three, we should make those first three the most important aspects of privacy to make sure they're seen.
The goal of Shape of the Web is (in my eyes) to educate users about the issues that the open internet faces today, and to help give them a framework for thinking about what the web is (it's hard to think about a thing if you don't know how it's "shaped"). All of these metrics help us improve the page's ability to convey information so we can better educate users.
You don't need a 3rd party to learn the order of pages you served to any given client. That one is so simple you only need 'grep' and the server log. (aggregation into whatever statistics you want to learn is a trivial exercise left for the reader)
> - See how long people are staying on this page.
The entire point is that you do not have a right to that information, other than what you can infer from the client later loading another page. Applying technical methods to gain access to private information like this simply makes you the the spy invading people's privacy. Worse, as most people do not understand these technical details, you are a eavesdropper who is preying on ignorance.
> so that users come away with a better understanding of privacy.
...while you simultaneously violate the same user's privacy. Do you seriously not understand that you're making the "We had to destroy the village in order to save it" style of ends-justify-the means argument that ignores how you've started to act like that which you are supposedly fighting against.
> hovering over
Again, the entire point is that you don't get to know that information. That is a perfect example of the type of data the privacy-focused people are trying to protect. We really don't give a damn if that information is useful; if you're recording anything beyond the HTTP requests you receive (the explicit request from the client), then you are the spy and therefore the enemy. If you want to understand how effective your pages are, find another way to deduce that information. This is why traditional businesses pay people to participate in focus groups, to name one example.
1. Mozilla launches a new translation initiative for Firefox that is announced on the index page and links to the landing page for the initiative. Google Analytics(GA) allows them to understand the clickthrough rate of the announcement and conversion rate of visitors joining the initiative for all combinations of channels/geographies/mediums and optimizing them.
Benefit: Firefox users get better localization as more people join.
2. Mozilla Development Network(MDN, good) competes with W3Schools(bad) for top results in search engines for JS/HTML/CSS related queries. GA has great tools for analysis for search engine traffic and integration with Google Webmaster Tools(GWT) that provides data for MDN team to do better SEO.
Benefit: MDN team increases traffic to their high-quality educational information and attracts attention of more users, strengthening Mozilla and Firefox brand.
3. Mozilla wants to teach web technologies to people and promote collaborations with Webmaker. Webmaker team can use Google Analytics custom events tool to collect and monitor specific users actions in the product. That provides data for optimization of onboarding experience for new users. For example, after upgrading UX/UI 50% more users will remix and publish a Webmake.
Benefit: more users successfully learn web technologies and create web content for fun/profit.
4. Mozilla gets a significant amount of revenue from search engine deals. Every install of a browser directly translates in small, but measurable increase of funding for Mozilla's projects. Google Analytics content experiments is a great tool for A/B and multivariate testing for increasing conversions on their Firefox download pages.
Benefit: Increase in browser installs, therefore increase in revenue, therefore increase of cool projects done by Mozilla.
Really, this is just a tiny number of possible use cases of Google Analytics by Mozilla. The efficiency boost by using an advanced web analytics software is immense and there is no open source alternative.
It's not Kerbal Space Program advanced level of analytics-foo, this is basic day-to-day stuff for growth hackers/startup founders/marketers/bloggers.
I also think that a pragmatic organization should focus on a few very important battles that it thinks it can win, rather than trying to fight everything in the name of ideology.
You don't need a third party analytics system for them.
And none of this information will ever be used it is just gathered and sent to a third party.
So they say, but their actions, here, put them in with Google.
> If they remove third-party analytics from their web properties, Mozilla instantly loses valuable actionable insights that significantly increase their efficiency as an organization.
I disagree, and I fail to see what Mozilla needs from analytics badly enough to require them to partner with Google in such a privacy-robbing fashion.
> If Mozilla loses operational efficiency, Google/Microsoft becomes more powerful and are able to obtain more users for Chrome/IE. They use all analytics they need.
So Mozilla should feed Google more data?
> No meaningful privacy increase for users is achieved, Google Analytics is now installed on (billions - 1) websites.
You just said Google and Mozilla were in competition. Make up your mind.
The fact that something is useful doesn't automagically make it ethical. I'm sure aggregated GA provides a lot of useful information. Our point is that if you are using GA - for any reason - then you're a spy that prioritizes your addiction to analytics over the privacy the people visiting your site.
Unfortunately, given you're posts in this thread, I don't expect you to understand this. Upton Sinclair was very insightful when he said, "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!".
Have fun inspecting your analytics reports and using that data for another round of page tweaking and tuning; it maybe be more socially acceptable than the Twitter user who continually refreshes their latest post to watch their hit rate increase, but still a sign of addiction.
Funnels, Segmentation, Retention, Path Visualisation, Event Tracking.
These are basic features used by marketing teams every day.
And rolling your own solution with something like Hadoop (which would need for Mozilla sized traffic) is a big undertaking.
Among the features threeseed mentioned, funnel visualisation is probably the weakest area in the baseline version right now. There have been various plug-ins available to do it for a long time, but it's not built-in yet. That said, this area is underpowered in GA as well, and at least with Piwik you can do something about it (and people actually do).
Piwik has been in development for nearly a decade, has been downloaded millions of times, and is in active use by high-profile, high-volume sites. It's every bit as production-ready as Google Analytics.
However, it isn't really comparable in advanced features with GA:
* advanced funnel analysis, such as multi-channel funnels
* attribution models and analysis
* advanced visualization and analysis tools
* age/gender demographic and interest reports
* custom dimension and custom metrics
* mobile android/iphone SDK for apps
and many other features including content experiments, webmaster tools integration, social data hub(though this one is mostly useless) etc.
It's true that GA claims to offer demographic reporting. The reliability and usefulness of that reporting is a different matter, of course.
Other than that, Piwik might be less capable if you just install a standard baseline and never customize it, but when integrated with a little custom logic it can do some pretty impressive (and, in particular, tailored) analysis and visualization. GA is more the other way around. You have more tools available as standard, but then it has limited scope for useful customisation beyond its built-in toolset (edit: without resorting to building completely bespoke systems via APIs, that is).
For example, I've seen quite simple situations that seem enough to confuse GA's funnel tools. A common one is a non-linear sign-up funnel where some steps may be skipped or changed, or where a visitor may come in part-way through the process. These often happen in practice because of something that visitor has already done before starting to sign up, where they are located, how they choose to pay, or other factors. My experience has been that anything remotely unusual like that immediately seems to confuse GA's entire funnel toolset, rendering it all but useless. With a more flexible tool like Piwik you can generate a custom visualization of the whole process you actually use with a reasonable amount of effort.
As we speak police vans are en route to round up visitors to that Mozilla page, in co-ordination with Google's security division...
The information google gathers will never go away. If google collapses, that data will be slurped up by governments and the private sector alike, and there's absolutely no way for you to predict how it will be used in 40 years time.
The optimum strategy is to never let them get an ounce of information about you.
If it had been implemented in a robust way that required companies like google to remove all data about you, I'd be making an annual request, on general principals.
Given unlimited political power, I'd probably boil it down to the trifecta of "collecting data about someone, even in anonymised form, constitutes opening an account for them. Accounts are always wholly owned by the person they are about. In the event of multiperson accounts each individual has controlling influence over the account's deletion (see rule three)", "when an account is created the owner or owners must be notified", "upon an account owners request, you must completely delete an account and all associated data, working in good faith to delete it as fast as possible, even if deleting that data will affect other accounts".
It probably needs some refining, but the goal is to punish deliberately obfuscatory system designs where data or account information is deliberately entangled to make data deletion impractical, and give people control final control over the gathering of personal data about them.
Ultimately, I really liked the Gevulot system from the quantum thief (really worth reading, it's an amazing series). It'd be nice to have an internet based version of the same system.
> .. "web" ..
This is an issue that is not merely limited to networks, much less simply "web".
Or are you suggesting that they should do no analytics at all.
Knowing 24/7 where you are is one thing, and knowing everything you search is another, but if you combine these two, it already becomes very scary.
Google knows so much more. It is a wet dream of spying agencies.
What can we do about it? I think most people don't understand technology enough to see what happens, so education might be the first step.
I personally avoid Google.
They could, but honestly, it's questionable whether Piwik would even work for their use case & scale, and even if it does, it's debatable whether it would be the best use of their limited resources.
This situation makes for a really catchy headline, but the page is primarily talking about privacy in the context of government surveillance. In that context, Piwik is just as vulnerable to NSLs (active surveillance) or NSA snooping (passive surveillance) as Google Analytics is. There is a marginal harm to using Google Analytics instead of a self-hosted service, but it's quite possible that the benefits (of being able to reach more people and better educate people about those evils) outweighs those harms, especially given that the target audience for this site is already being tracked by Google on the vast majority of their web browsing anyway[0][1].
Furthermore, we could just use this as an opportunity to underscore the importance of the problem itself: it's a rather damning statement about the effectiveness and pervasiveness of digital tracking that Mozilla feels that Google is its best (or only) option[1] for educating as many people as possible about the evils of online surveillance.
[0] http://w3techs.com/technologies/details/ta-googleanalytics/a...
[1] This isn't even counting the other ways that Google tracks web users: Google's CDNs for JQuery and web fonts, people who use Google's DNS servers, etc.
[2] I'm making the assumption that someone at Mozilla has made this decision consciously, which is not an unreasonable assumption for this discussion - it's rather unlikely that the people building the website about digital surveillance and working at the company partnered with EFF and Tor are unaware that Google Analytics is digital surveillance.
Is there any way for anyone else to verify that?
Obviously, people care how much they care, hence a reason to lie.
Web analytics for most serious sites are managed by dedicated marketing teams so features are to meet their requirements.
Yes, anybody can change the startpage, delete all cookies and restart the browser. How many users will do this? And does forcing every user into google surveillance comply with this privacy marketing of mozilla, or is it just a zynical fake campaign?
There should be a startpage explaining what cookies are, describing the difference between temporary and permanent cookies and how these help to track your web usage, and provide one single, visible button to delete all cookies.
After this I should be asked if I would like to help mozilla funding by redirecting me to a google web search which will set a permanent cookie.
I'll also add that there is a button that lets you delete all private info (cookies, history, etc.) acquired in a certain period of time: the Forget button [1].
If you're looking for something more advanced, you'll have to use something like this addon [2]
[1] https://support.mozilla.org/en-US/kb/forget-button-quickly-d... [2] https://addons.mozilla.org/en-US/firefox/addon/selectivecook...
If so then it shouldn’t be present in current versions. Did you accidentally import cookies from another browser? Probably worth filing a bug if not.
This is what I see at launch[1]:
http://clients1.google.com/ocsp
https://safebrowsing.google.com/safebrowsing/download?...
https://dxr.mozilla.org/mozilla-central/source/netwerk/base/...
https://dxr.mozilla.org/mozilla-central/source/toolkit/compo...
https://dxr.mozilla.org/mozilla-central/source/toolkit/compo...
It's also another one of these single-page-apps that require JavaScript to display any content at all.
I think with such a design they're clearly not targeting the sort of privacy levels that more users on HN than the Internet in general expect.
There are other extensions that do a similar job, including a volunteer effort to continue the original extension, but right now none of them seems quite as neat and reliable as the original.
https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-de...
Say I open a youtube.com and it wants to load cross-origin content from google (and thus sends cookies to google) then it can use different cookies than those used when I browse google search directly.
But I can't find it anymore.
I will take this opportunity to remind people that uMatrix is now available for Firefox (works on Nightly): https://addons.mozilla.org/en-US/firefox/addon/umatrix/
This seems like a much bigger issue than the NSA copying entire datastreams from American internet hubs.
If we cannot pick our battles, then we will just lose because of the dissipation of all of our efforts across everything "that is still a problem".
When I weigh out the benefits vs the costs, I dont see why moz would pick any other option, everything else is more work, and google already tracks you across most of the internet.
Whether or not you showed up on a mozilla page is not going to change their understanding of your habits by much.
Preaching water and drinking wine, eh?
If they’d really want some kind of tracking, they could have used a locally installed system like piwik, as the largest issue with tracking comes when the data from many sites is combined.
See section 7 "Privacy" here for the full text. http://www.google.com/analytics/terms/us.html
https://www.mozilla.org/en-US/privacy/websites/
Third party Services We use third party services such as Google Analytics and Optimizely. They use cookies, IP addresses, and online data tools.
I suppose they would argue that's the same but I don't think it is good enough (especially for a site preaching privacy values). It should be down in the footer, or even better they should be using Piwik and skipping GA completely.
To me, this feels like a website built by a pro-privacy team who had some marketing or PR person slap the GA code in there with no comprehension of irony at all.
EDIT: Also to note that mozilla.org uses UA-36116321-1 tracking and shapeoftheweb.mozilla.org uses UA-49796218-22, which indicates to me that they are aware that these are two distinctly different sites.
It's on the same subdomain, and it includes link to mozilla.org which has link to privacy policy which also applies to shapeoftheweb.mozilla.org:
>This privacy notice applies to Mozilla operated websites, which include the domains mozillians.org, mozilla.org, firefox.com, openbadges.org and webmaker.org. This includes, for example, bugzilla.mozilla.org, reps.mozilla.org, careers.mozilla.org, developers.mozilla.org, support.mozilla.org, addons.mozilla.org, and wiki.mozilla.org.
I find it frankly shocking so many sites use it without any seeming consideration at all, its essentially completely selling out your users for a slick analyitics package.
Where exactly do they suppose such precise and accurate data comes from when they open the management pages.
In my case, I am doing it because the users are happy about it.
The users satisfaction with how the product works is my pay for spending all my weekends coding – and it’s definitely worth it.
you should really use it sometime, or at least familiarise yourself with its capabilites.