Firefox Installs non-free binaries from Cisco and Google again (2018)

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=915582

115 80 7 years ago

bugs.debian.org

see also this cluster-fudge: "firefox: Safe Browsing updates fail due to insufficient quota on the Google API key" https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895147

both issues are still open after more than 1 year! There seems to be a disconnect in how FF security is perceived by tech savvy users and how security/privacy critical bugs get prioritized by Mozilla.

edit:

Just recently I discovered DoH was activated by default now and bypassing my /etc/hosts block list without any warning. This opened me up to tracking from sites I thought I had blocked (discovered it only by accident and after several months when I actively looked into DoH and the network.trr.mode setting).

In all above cases the failure-modes are insecure. It's like a firewall that suddenly switches its enforcement policy from a deny-all+whitelisting to allow-all+blacklisting without properly informing users.

Totally unacceptable!

otterlicious• 7 years ago

The linked bug appears to be waiting on action from the Debian maintainers. The Mozilla devs in that thread seem very responsive.

EwanToo• 7 years ago

Yes, the linked bug (from the comment) appears to be entirely between Debian and Google (Chromium is affected too) with Mozilla offering to facilitate, with no (public at least) response from debian?

pbhjpbhj2• 7 years ago

Thank you for that note on DNS-over-HTTP .. it might explain a weird event for me recently where a blacklisted site wasn't blocked (opendns + pihole).

Are FF sending all my DNS data to a private third party now then? Doesn't sound a very FOSS thing to do?

byuu4• 7 years ago

Yes, they are sending all of your DNS requests to Cloudflare.

You can of course change it, but it's opt-out and not communicated to users that this is happening.

zaarn6• 7 years ago

If you have an up-to-date PiHole, firefox should automatically disable DoH since PiHole now ships the necessary canary.

mosselman2• 7 years ago

Thanks for this. What should I do to disable this? Set network.trr.mode in about:config to 0?

shakna• 7 years ago

Doesn't have to be so arcane. Network Settings -> Untick "Enable DNS over HTTPS"

DyslexicAtheist3• 7 years ago

set network.trr.mode to 5: https://wiki.mozilla.org/Trusted_Recursive_Resolver

also if you have unbound or local dnsmasq caching you could set a canary domain (https://support.mozilla.org/en-US/kb/canary-domain-use-appli... ). To set it up with dnsmasq just add the line for the canary to /etc/dnsmasq.conf:

  address=/use-application-dns.net/

esarbe2• 7 years ago

I guess you want your money back?

DyslexicAtheist3• 7 years ago

no I want people who call themselves "devs" to actually care about security or stay away from production code. These are violations of very basic security principles.

rovek• 7 years ago

My DoH in 71.0 and 72.0 is off by default, I haven't changed those settings.

glyxbaer• 7 years ago

Seems to be automatically enabled for users in the US [1] if I understand correctly.

[1] https://support.mozilla.org/en-US/kb/firefox-dns-over-https

AnIdiotOnTheNet2• 7 years ago

Mozilla likes to talk a good game about caring about privacy and user control, but it's mostly just marketing. These are the same people who integrated Pocket and did that stupid Mr. Robot thing.

zaarn6• 7 years ago

DoH is only activated by default in the US and if you use PiHole or similar there is a DNS canary that prevents FF from using DoH. Additionally it shouldn't be ignoring your /etc/hosts block list as DoH simply replaces DNS not the host list.

judge20204• 7 years ago

Just recently I discovered DoH was activated by default now and bypassing my /etc/hosts block list without any warning

It reads your /etc/hosts before going to DoH I believe.

vmchale• 7 years ago

that's why I use chrome

SmellyGeekBoy• 7 years ago

This doesn't even make sense, Chrome is non-free to begin with.

pedrogpimenta• 7 years ago

It's a joke.

paulintrognon• 7 years ago

Can someone here please explain to me what the issue is? Firefox downloads non-free binaries in order to read some codecs by default, and this issue states that firefox should not download the codec by default because it is non-free, which is against debian's philosophy, is that correct?

Wowfunhappy2• 7 years ago

Yes, although notably this is about black-box DRM systems, not just your run-of-the-mill video codecs.

Standard versions of Firefox include non-free components by default because most users expect Netflix to work. ("Free" means "open source" in this context.)

Debian repositories (that aren't named "non-free") are supposed to contain only free software, so the Debian-packaged version of Firefox needs to be stripped of any non-free components. Should any slip through, that's a critical bug as far as Debian is concerned.

I don't think there's an issue here, it's just two projects with different goals proceeding as they're supposed to. We can have a discussion about all the things wrong with Encrypted Media Extensions and the like, but it's somewhat beside the point unless Firefox gains way more marketshare.

suprfsat• 7 years ago

What technical reason is there for Firefox to dynamically download these libraries instead of bundling them at built time? It leads to bugs such as this one.

TD-Linux• 7 years ago

Note the two binaries are downloaded for two different reasons. OpenH264 is actually free and open source software in terms of copyright, the binary is simply downloaded from Cisco's servers rather than Mozilla's to comply with the H.264 patent license. It's worth noting that in general, Debian disregards patent licenses - they ship ffmpeg with many patent encumbered formats enabled, for example.

On the other hand, Widevine is actually proprietary DRM.

romaaeterna3• 7 years ago

It's worse than that. Firefox will download non-free javascript and html from pretty much every website you visit. Debian team needs to get on it, fast!

nikeee• 7 years ago

Actually there is an extension for that:

https://www.gnu.org/software/librejs

bobongo• 7 years ago

I do not think the sarcasm is deserved here. Debian is committed to free software. You can find a set of guidelines they implement in their social contract website under the heading "The Debian Free Software Guidelines (DFSG)" at https://www.debian.org/social_contract#guidelines

A substantial user and developer base prefers Debian precisely because of these Guidelines. Inclusion of free software (as-is) that automatically installs non-free binaries would violate almost all of these guidelines.

romaaeterna3• 7 years ago

I'm not sure that these guidelines make a distinction between a call to install a codec on-demand versus a call to download and run (and even cache) a minified Javascript library.

madacol• 7 years ago

Why is this relevant if it's from DEC 2018?

paulie_a• 7 years ago

Next week will be entertaining when someone takes a baseball bat to the pinata and 50;security vulnerablities fall out. thanks Cisco for your continued dangerous and terrible software.

I wonder if the devs get a bonus for everyone they fix.

Firefox Installs non-free binaries from Cisco and Google again (2018)

Related Stories