mimasama

> backend services

Except when you actually read the ToU the controversial, unnecessary license doesn't even talk about Mozilla's services at all.

"It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox."

The blog was written by product management, and most likely legal just generally told them that they got their justification from the CCPA's definition of sale, and the PR/marketing just searched for it and gave it to the blog post's author. Since Wikipedia is usually the first result in a search engine (and even has its own infobox), that's probably what they went with.

For people reading this thread, read my reply to pretty much the same comment but in another thread: https://news.ycombinator.com/item?id=43276624

TLDR: The "OR" was a drafting error that Mozilla erroneously quoted. The final text of the CCPA removed the "another business" part.

So I've read the CCPA again, and I've realized that Mozilla may have made an error in quoting the relevant part of the law in their blog. This part they quoted:

> As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”

Is actually from a draft. The final version of the CCPA removed the "another business" part which was a drafting error as covered by this article from the IAPP: https://iapp.org/news/a/ccpa-cpras-hidden-third-party-busine...

I will cut Mozilla some slack here because they probably have taken the supposed final text of the CCPA from Wikipedia's article of it: https://en.wikipedia.org/w/index.php?title=California_Consum... (and the website in the infobox still links to when it was an Assembly Bill at https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...)

This is the true final definition of "sale" in California's privacy law: https://leginfo.legislature.ca.gov/faces/codes_displaySectio...

Anyway even then I'm not sure if the Foundation would've been considered "another business", since "business" is defined first as any "legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners", which MoFo clearly doesn't do. There's the second definition might've covered the Foundation (since they control the Corporation which is covered by the first definition), but AFAIK the Corp doesn't share any consumer personal info back into the Foundation (if it does that would be concerning)

Well, I'm addressing the "real issue" part of your comment. Whether people switch over it is their choice (I've already switched to another browser as my primary years ago, and it's not Gecko, Blink, or WebKit). But just because other bad, worse stuff exist doesn't mean Mozilla gets a pass on trying to sneak in a license over people's own content as well as going back on their promise of not selling users' data. Or the history of terrible decisions they made.

Quoting from Mozilla's blog:

> The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”

How is the CCPA stupidly-worded when that's what a layman would think "selling data" means?

I do wholeheartedly agree with your sentiments about the WHATWG though, as someone who contributed to Pale Moon's development. That web browser cartel should be investigated by the US government for anti-competitive practices as they did with Google and Microsoft.

The issue is that Mozilla Corp has a license over what private videos people upload to their Nextcloud for example, which doesn't make sense because it's not Mozilla themselves processing your input but the locally installed copy of Firefox. Mozilla doesn't need my permission to use my own content I'm about to send online just to provide basic functionality present for decades.

The explicit disclaiming of ownership is definitely good (the previous version didn't have that), but it's not enough. Mozilla should just nuke that section completely like they did with the AUP part if they're doing this ToU in good faith.

See my reply to the other comment. They still have permission, and it doesn't matter how limited they try to scope it. It should be none because they have no business having a license over my own content I upload to non-Mozilla websites: https://news.ycombinator.com/item?id=43263232

"for the purpose of doing as you request" is still permission for using my own content, no matter how limited the scope they want to make it look like. It's not Mozilla Corp itself that is processing my inputs behind the scenes when I upload my photos to Imgur, is it? It's my own locally installed copy of Firefox.

> including that some things you command Firefox to do involves using your data.

Mozilla has never used the data you upload/send via Firefox to non-Mozilla websites (as it should be), and they shouldn't have that permission just as Epson the company shouldn't have the right to use for any purpose a paper marked as classified just because some fed employee sent a digital copy of it to an Epson printer.

In Windows there's an optional updater service you can install at least. But I think the reason for this is that some people want to make 100% sure the browser doesn't make any connections on its own, even if it's simply for checking if there are new updates.

The ToU is clearly referring to the browser, not the other products of the Firefox brand family. The literal first two paragraphs:

> Firefox is free and open source web browser software, built by a community of thousands from all over the world.

> Please read these Terms of Use (“Terms”) carefully because they explain important information about using your copy of the Firefox software. These Terms are a binding agreement between Mozilla Corporation (“Mozilla”) and You. For details about Firefox privacy practices, please read the Firefox Privacy Notice.

Yeah, it would be like saying everything I write and draw into my Acer laptop means I now give permission for Acer the company to use my content. It's bonkers.

Make sure the third party build you choose doesn't use official Firefox branding too.

> Does this mean these Terms of Use apply only to precompiled binaries downloaded from Mozilla, and not to copies built from source code by linux distributions?

I think it applies if the browser is "Firefox" in name and branding. So the Debian rebuilds count for example.

So recompile and remove the Firefox branding and the ToU should definitely no longer cover you.

The only ToS of a free software should be the chosen free software license (and if applicable, a trademark policy). Anything else is questionable.

> without access to mainstream security patches

They do have access to them. The lead developer and project owner has sec bug access in bugzilla.

But vulnerabilities in newer Mozilla have over time become less and less relevant in Pale Moon's codebase, which led to the latter dropping the tracking of how many Mozilla security patches have been applied in the release notes (starting with 33.0.1).

> known and unfixed security bugs

Which are..?

> They could use this for good if they tried simply from having enough momentum to kill anything bad dead by not implementing it.

Funnily enough though a lot of web developers really hate Apple for this (going as far as claiming "Safari is the new IE" which is just ridiculous). But as a former Pale Moon developer I think Apple is the "lesser evil" than Mozilla exactly because they're "slow" in implementing the latest "Living Standard". Oh and just like us they've rolled out a JPEG XL support enabled by default in their stable release before Mozilla and Google did ;)

That's because they've kept the UI from before Australis was rolled out in Firefox 29. The Australis UI revamp back then was very controversial; it's funny to see how the complaints of Firefox "becoming more like Chrome" goes way back...

Under-the-hood is an engine that is pretty modern though (at least for a vast majority of the websites I regularly use, and plenty are "Web 2.0"). It's not as updated in terms of web compatibility as Mozilla's Gecko, and I'm not going to hold my breath for that, even though I love this browser very much and have contributed code to the Pale Moon / UXP project. Trying to "catch up" in the WHATWG's "Living Standard" is just going to be an endless uphill battle because of Chrome doing implementations first before doing consultations with real stakeholders like website authors in writing the spec to see if the features they want to push to the rest of the web are really necessary and beneficial. It's amazing we're still able to make advancements on this front like getting Google's WebComponents supported or dynamic module imports.

Ah, just saw this right now. The apologies is much appreciated, thanks for that.

It seems though AFAICS, that the customer in question is not fully convinced[1] that this incident will not happen again. Are there going to be any concrete steps taken by Hetzner for this kind of error to not be repeated? While I doubt the customer is ever going to return back to your hosting at this point (and it looks like Hetzner was just going to be temporary for them either way anyway while they find a more permanent hosting service that is surely friendly to them and their kind of content, this incident just seemed to accelerated that eventual transition), it's definitely still worth considering it for others who haven't moved away and are now wary about false reports effectively taking down their sites (drawn SFW yuri/lesbian content is pretty common to be stored, whether knowingly or not, on fediverse instances hosted by your service).

[1] - https://woem.men/notes/9rdj6cc1ku7g05xy

The yuri (Japanese lesbian art) in question is obviously not CSAM as you can see in the Bluesky thread, as both women depicted in the artwork are fully clothed and don't look like children at all.

The fediverse instance being talked about (woem.men) is currently down right now due to a hasty emergency relocation, because Hetzner only gave them 24 hours to respond satisfactorily.