The single largest advantage of Firefox over other browsers is that despite all odds and occasional missteps they managed to respect users' desire for complete privacy.
For Firefox we want to better understand how people use our
product to improve their experience.
Sure thing. But the fact that they are unhappy that some (many?) people are opting-out from the data collection is merely a sign that they don't want to understand why people are using Firefox in the first place. By opting out from the data collection people effectively tell them over and over again that they don't want for Mozilla "to understand how they use Firefox" or "to improve their experience", not at the expense of their privacy.
No phoning home. No telemetry, no data collection. No "light" version of the same, no "privacy-respecting" what-have-you. No means No. Nada. Zilch. Try and shovel any of that down people's throats and the idea of Firefox as a user's browser will die.
> No phoning home. No telemetry, no data collection. No "light" version of the same, no "privacy-respecting" what-have-you. No means No. Nada. Zilch. Try and shovel any of that down people's throats and the idea of Firefox as a user's browser will die.
I have been using Firefox since before it was called that. I develop my apps in it, even though most of my colleagues have switched to Chrome years ago. Even though it is (or was for a while) slower than Chrome for things like Canvas.
But I use because I believe in Free Software. But Mozilla keeps disappointing. DRM, bundled 3-rd party apps, analytics, tracking... It is just so very sad. :-(
Also, I have 17 add-ons installed (11 active). At present, of these 17, only 2 will continue working after November when the switch to WebExtensions is enforced.
Mozilla fought DRM until the very end and lost. If Firefox is to have any chance at remaining a mainstream browser it needs to support Netflix and the likes. You can't seriously blame them for this, because they are damned if they do and damned if they don't.
EME is implemented as unintrusively, securely and privately in Firefox as possible. No DRM is downloaded or run on your computer until you specifically consent to it, and the DRM components run in a sandbox.
> Mozilla fought DRM until the very end and lost. If Firefox is to have any chance at remaining a mainstream browser it needs to support Netflix and the likes. You can't seriously blame them for this, because they are damned if they do and damned if they don't.
Yes I can, and I will, because they sold out. They sold out their principles for the sake of market share. (And looking at their marked share, fat lot of good that did for them anyway.)
I'd suggest you research the topic of negative and positive liberty. I'm all for a free and open source experience but what about the liberties of content creators? What about my right to as a user to be offered content with the knowledge that I won't and don't want to know its inner workings as long as it's passive non-malicious code?
I will be happy to do so, once consumers and content creators (and specifically the companies they sell rights to) are on a level playing field in terms of legal protections and lobbying powers.
This isn't about the money or power you or I have. This is about freedom to distribute content and the agreement between the user and the creator while you're asking the browser to be the ideological arbiter of this transaction. If you're all for freedom, you should logically see that not including the DRM option is inhibitive of both the user's and the creator's freedoms. As a browser, it should be ideologically agnostic to my downloading of an executable or zip file that goes against freedom, privacy and all that we hold dear and it should still be my right and freedom to download and view as I legally please. The Richard Stallman approach does have its limits.
Excuse me, but did you support Mozilla with time/money?
> They sold out their principles for the sake of market share.
12% is still better than 1%, and the thing that mostly changed the landscape was the fact that mobile Internet heavily disfavors Mozilla (e.g. Android ships with Chrome, iPhone with Safari), and Google has a heavy advantage when it comes to advertising and engineering.
Also, Firefox has been adding things like Pocket while removing simple options that have been part of Firefox since the beginning claiming that it should be part of an add-on (like the option to disable javascript) and they are also adding privacy invasive options like "Block dangerous and deceptive content"... Firefox is still my favorite but that can always change...
Even worse, in that discussion, it appears that there's a backdoor built into Firefox so that WebExtension-based ad blockers can't block Google Analytics. Only old-style add-ons can block it.
"It's as if the order to block/redirect the network request was silently ignored by the webRequest API, and this causes webext-based blockers to incorrectly and misleadingly report to users what is really happening internally."[1]
This is a specific issue with that preference page. You can easily observe that the WebExtension version of uBlock does block Google Analytics, just not on the about:add-ons page.
There are probably security reasons why add-ons can't modify about:add-ons. Imagine an add-on that could hide itself by modifying that page.
I'm not really sure what your concern is here. Let's assume for a moment that Firefox's implementation of differential privacy in this scenario is completely correct, and that as a result it's completely impossible (even in an information-theoretic sense) to learn anything about any individual user using this data; only about many users in aggregate.
In this scenario, how exactly would Firefox's actions here compromise anyone's privacy?
Why are they not letting people decide? If it is not harming anyone's privacy, and they make it clear that it isn't, then what is the problem with letting people opt-in to it?
Instead, it's telling that they are choosing to force people to opt-out. They know that their users don't want this, but don't care.
Opt-in inevitably results in data being heavily biased in favor of the small minority of users who go out of their way to opt-in. For some stuff that's fine, but for certain types of data you really do need a broad, unbiased sample of users in order for the data to be at all meaningful. (Usually to answer questions like "What percentage of users use x feature?" Or "What level of jank does the average user experience on facebook.com?")
They still _are_ planning to let people decide for themselves whether to participate (via opt-out), they're just using a default that's more likely to result in unbiased sample data.
Again though, what's your actual concern? Provided this feature doesn't compromise anyone's privacy even _if_ its enabled, what's wrong with having it be opt-out?
I have no way of knowing how this may or may not compromise my privacy without a deep understanding of the techniques being used. I am meant to trust Mozilla and hope that they haven't overlooked some weakness in the algorithms used. The obvious security choice is to not add this feature in. The 'Provided this feature doesn't compromise anyone's privacy' is a fantasy, because no-one can be sure of that.
But that's true of _any_ new feature that gets added to Firefox. Anytime you change code, there's a chance you could be creating a new vulnerability that compromises users' privacy or security in some way.
If, as some commenters here [have suggested][1], this telemetry would help improve Firefox by significantly reducing the amount of time it takes Mozilla to fix bugs and performance issues in the browser, what makes you think that's not worth the risk when other features (such as the performance fixes themselves) are?
It's obviously far, far more likely in code that is designed to send my browsing habits to a 3rd party (in whatever encoding). Do you not see this, or are you just trying to extend out these arguments to some ridiculous extreme for the sake of it?
I don't know what level of risk this implementation carries with it. Probably more than a performance fix to the JavaScript interpreter, yes, but is it really a significant enough risk to make this feature not worth implementing? Maybe it is, maybe it isn't; I honestly don't know.
You just seemed to be arguing that _any_ amount of risk would be too much, which in my view is ridiculous since, as I said, all new features carry with them some amount of risk.
> In this particular instance, I think the risk and the unknowns are clearly too much.
But why? I don't claim to know enough about RAPPOR to say for sure that the risk _is_ worth it, but it seems a little presumptuous to claim it isn't without knowing _anything_ about the project or Mozilla's proposed use of it.
That's why I assumed you were arguing that _any_ amount of risk would be too much; you didn't include any sort of analysis of the risk/reward in your previous comments, and without knowing the risk the only way to conclude this feature is definitely _not_ worth it would be if you already considered the acceptable level of risk to be zero.
Well, the alternative is not a Firefox without telemetry, it's Chrome. If Firefox can't do what it needs to do to stay relevant it's going to die. Developers are already treating Firefox as a second class browser, so this is not an abstract threat.
It would, however, be useful data for the common user behaviour of people who opt in to tracking.
This doesn't really seem unreasonable to me. Obviously part of the inherent cost if not wanting to be tracked is going to be not having your raw user data included in evaluations of what people want.
Differential privacy does not ensure complete information theoretic security as you say. There is a parameter ε that determines the amount of privacy, and in this case you do not get to set it, somebody else does.
Interesting point. Admittedly, my understanding of differential privacy is very rudimentary, but isn't that only a risk under the assumption that you can ask the same user the same question multiple times, and get a new, independently chosen answer every time? If you can only ask each question once and every subsequent time you ask you just get the same answer, is that not secure in the information theoretic sense? Perhaps there's some other factor I'm missing?
> in this case you do not get to set it
Nothing's been decided yet. If this is something you want to advocate for, maybe consider suggesting that in the thread linked in the OP?
You are speaking of perhaps Google's RAPPOR protocol specifically, in which answers are sent through a series of BSC-like channels. These channels introduce noise, meaning the input signal is degraded, but by no means is it gone -- otherwise no statistics could be collected. Multiple independent reads would be an obvious attack; actually it's a form of repetition coding; but there are many other coding strategies against noisy channels -- there is an entire field dedicated to that task alone. To contrast, encrypting with a one-time pad is information theoretically secure.
Attacks aside, the point is really that in this age of statistical machine learning we should be vigilant against even this sort of data collection. A leak is a leak. Ideally people can opt into providing just enough information for the statistics they want to participate in and no more; realistically, more is always collected.
Ah, fair point. I guess it's incorrect to say it's impossible to learn _anything_ about a user as an individual using data generated using differential privacy. Just that what you do learn is more of a small statistical possibility than a sure thing. (E.g. "The user visited this site." vs "There is a 5% higher than average chance the user visited this site.") And that's even assuming you already know who "the user" is (which certainly isn't a given).
Fair point. What would you accept as sufficient proof that their implementation is correct?
If your answer is "nothing" then I think you're being unreasonable. Firefox risks compromising security/privacy with _every_ new feature they implement, not just this one, and it's clear from [other comments][1] in this thread that this feature is just as important for the overall functionality of Firefox as any other feature would be.
It's not even that not enough people are opting in, it's that the people opting in are "people that would opt-in", i.e. they match a certain profile that makes them not representative of the average user, and thus less good sources to draw conclusions from. Because presumably, the users who opt-in are tech-savvy users who actually read dialog windows presented to them, and thus behave very differently from the average user.
It's more that a lot of people really don't care one way or another, and will neither go out of their way to opt-in or opt-out.
Additionally, it's not that Mozilla just disregards user privacy here: differential privacy being used would mean that no user has to reveal their private information, but looking at all the data in aggregate would still allow Mozilla to gain useful information on how to make Firefox better.
No phoning home. No telemetry, no data collection. No "light" version of the same, no "privacy-respecting" what-have-you. No means No. Nada. Zilch. Try and shovel any of that down people's throats and the idea of Firefox as a user's browser will die.