Hacker News Reader

Comment by kibwen | Hacker News Reader

It's interesting to think of this as a nuclear option for Firefox. The only incentive they have not to turn it on immediately is that it could poison relationships with site owners such that they stop testing their sites on Firefox or outright block Firefox users, but if Firefox market share ever diminished to the point where site owners were already neglecting Firefox then I see no reason why Mozilla wouldn't damn the torpedoes, start aping Chrome's UA, and turn this on by default. It would be a compelling value proposition at the expense of a lot of mysteriously broken sites (though I wonder how many of those sites would be just as broken for Chrome users running AdBlock). It's also literally the only feature that Chrome can never, ever, ever, ever gain, due to obliterating Google's revenue model (which, actually, makes it intriguing to entertain the notion of Microsoft and Apple following suit for precisely this reason).

View on HN

Mozilla could also implement shims, to make sites continue to work. So if a site breaks because it makes a call to a tracking library but that's now throwing an error, just provide that same tracking library's functions, but obviously they won't do anything.

This would at least fix sites that aren't going out of their way to break things.

While the shim idea is interesting, I suspect we could get a lot of privacy and working websites by hard-caching anything that even remotely looks like jquery and all the other well-known js libraries. (and do the same thing for fonts).

It's trivial to implement - just ship a list of hashes for every published js library on all the popular CDNs (+ anywhere else that comes to midn), and if a HTTP request returns a file that matches one of those hashes, put that URL on a hard cache list. (it would be worht experimenting if wildcarding all query strings is feasible)

The only UI change needed would be a menu option to flush the cache for any files associated with current page, so the user can simply reload any website that hasn't figured out how to version their js files.

This method wouldn't fix everything, of course, but it would cover a lot. Additionally, it's easy to use, no copyright is violated (the user still downloads any cached file at least once - firefox would only ship hashes). and it would be trivial to extend in the future.

Wouldn't lying be a better option to protect from finger printing ? Like: "what font's do you have" and just return a generic list ?

There isn't much to fingerprint when you cache a font or javascript library approximately forever. Of course it is a huge data leak to ever let the remote server enumerate fonts, but my ideas is attempting to accommodate the idea that interesting fonts can be used, while the only extra network traffic should be the font down load on first request.

I acknowledge that it isn't perfect. Someone who is really determined could (and will) send HTML with unique URLs for every javasscript/css/whatever, effectively making a cache useless. That takes proactive effort on their part, though, and in the meantime there is a lot of low-hanging-fruit.

For example, currently Google can track those of use that ban google-analytics at the router when we load any non-Google page that requests jquery fron Google's CDN. Limiting that to "about one" load to fill the cache would be easy and help in the short term..

That's a cat-and-mouse game, and the Firefox release cycle is bound to be much slower than any website interested in tracking users. The owners of the site can tweak the JS slightly, the FF devs have to get notified that the website stop working, go back to see what changed, and stage the necessary changes for the next update. And then wait for users to update, of course.

It's very impractical.

It's not an arms race for the sites that aren't purposefully breaking. Shims would fix accidental breakage, and reduce "mysteriously broken" sites. Intentional breakage, at least in my limited experience, is accompanied by some warning text about adblockers.

I also wonder how ad providers with a greater scope than just advertisements would react to this. For instance, take Facebook—their ecosystem encompasses ads, social features, and login/identity management at this point. If we get into an arms race at some point, I could see this getting ugly if these other features become collateral.

The idea of the "new" Microsoft standing by user rights and privacy is interesting...

They would gain a lot with such a move, but I still doubt they'd do that, because I think they still believe they can become big players at the advertising industry.

Reply on news.ycombinator.com