For advertising, Firefox now collects user data by default

https://www.heise.de/en/news/For-advertising-Firefox-now-collects-user-data-by-default-9801345.html

by firebaze • 2 years ago

597 486 2 years ago

wkat42426• 2 years ago

Says the site that only offers one big button "accept" to its cookies :( :( There's no "Nope".

Edit: Weird, some people seem to have received more options than me. For me there was just one option to accept (Zustimmen) and nothing else. Everything was in German but I read German anyway. I was on mobile though, perhaps this is why? I can't see it again because I already pressed it.

A practice (pay or accept cookies) which was actually ruled in breach with GDPR but many German sites seem to do this somehow.

I agree with the criticism on Firefox but this is very hypocritical. Heise used to be a good company. I even used to subscribe to C'T and iX.

Semaphor3• 2 years ago

A practice (pay or accept cookies) which was actually ruled in breach with GDPR but many German sites seem to do this somehow.

Our Data Protection Agencies ruled it okay. There was a recent court case that called it into question again, so we’ll see how things develop.

FWIW, my normal blockers manage to block the heise.de pay-or-track banner, different from, e.g. golem.

agos2• 2 years ago

what data protection agencies?

wkat42426• 2 years ago

But even then, it's a bit hypocritical writing an article slamming firefox for this at least allegedly privacy-sensitive adtracking. While requiring readers to consent to tracking from your however many ad partners :P

copywrong23• 2 years ago

These dark patterns will prevail. However, I honestly expect their reasoning to be "every single user reading heise.de should have a cookie banner blocking enabled in their Ad Blocker". Also, I think you can accept it for free when you click "Einstellungen", this is not golem.de.

Semaphor3• 2 years ago

Also, I think you can accept it for free when you click "Einstellungen"

No, this part is mandatory:

Datenverarbeitungen von Werbeanbietern einschl. personalisierter Werbung mit Profilbildung [Zustimmung erforderlich für kostenfreie Nutzung]

bratwurst3000• 2 years ago

i stopped reading golem because of this. what a shit

agos2• 2 years ago

they will not prevail, unless we collectively let them do so. they are already probably in breach of GDPR, and I don't see the EU backing down on this stuff.

lloeki• 2 years ago

Having only "accept all" and say "configure", or even a highlighted "accept all" and a very small or even just unhighlighted "deny all" is against GDPR. IIRC:

- choices presented must have the same visual weight (e.g for buttons)

- there must be no default choice preselected (e.g for radio/toggles)

- the fallback when no choice is made (e.g a dismissal or a "failure to display" a.k.a bug or nag blocker) must be equivalent to deny all

Instead we get this mess because enforcement requires litigation from users and these companies make just enough to claim "oh we thought it was Ok plus we go through a off the shelf pluggable third party so not on us" plausible deniability.

from https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...

If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

from https://www.edpb.europa.eu/sites/default/files/files/file1/e...:

Example 6a: A website provider puts into place a script that will block content from being visible except for a request to accept cookies and the information about which cookies are being set and for what purposes data will be processed. There is no possibility to access the content without clicking on the “Accept cookies” button. Since the data subject is not presented with a genuine choice, its consent is not freely given.
41. This does not constitute valid consent, as the provision of the service relies on the data subject clicking the “Accept cookies” button. It is not presented with a genuine choice.
The use of pre-ticked opt-in boxes is invalid under the GDPR. Silence or inactivity on the part of the data subject, as well as merely proceeding with a service cannot be regarded as an active indication of choice.
In the digital context, many services need personal data to function, hence, data subjects receive multiple consent requests that need answers through clicks and swipes every day. This may result in a certain degree of click fatigue: when encountered too many times, the actual warning effect of consent mechanisms is diminishing.
This results in a situation where consent questions are no longer read. This is a particular risk to data subjects, as, typically, consent is asked for actions that are in principle unlawful without their consent. The GDPR places upon controllers the obligation to develop ways to tackle this issue

amanzi• 2 years ago

I get a different banner - it's a huge square with a wall of German text that I can't understand. There are three buttons, also in German, and I have no idea which button to press. Guess I won't be reading the article.

psychoslave2• 2 years ago

My current process for "modal asking any consent when I just jumped in the page and don’t have any certainty there is something there I am looking for" is

- does reader view toggle works? if yes, consult, end here

- am I really looking for some information that might be there? if "no I just clicked a link from somewhere on the internet", then end here

- still here? Hey, what about looking at the DOM, if the information looked for is not a simple small segment of text, there are good chances a few CSS/HTML tweak will reveal this. Got it? end here, though you might consider to automate this process with Greasemonkey if this domain often fall in your research.

- no luck so far? It’s ok, you know Internet is vast, there are plenty of other page to visit. WTF are you doing here anyway, don’t you have a job, hobbies and people to cherish? And what about a small walk, you look like you need some fresh air, you know?

n3m4c• 2 years ago

https://archive.ph/RQEyA

kwhitefoot• 2 years ago

So how do we turn it off?

Found it. Go to settings, type privacy into the search box. The last item under "Firefox Data Collection and Use" is a check box labelled "Allow websites to perform privacy-preserving ad measurement".

It was already unchecked on mine when I looked just now.

wkat42426• 2 years ago

Yeah on desktop. On mobile it's a lot harder. It's still turned on and you have to use a workaround to enable about: config because they don't bother to make this option visible in settings.

chrismorgan• 2 years ago

and you have to use a workaround to enable about: config

I know of no workaround short of installing from the Beta or Nightly channel.

amne• 2 years ago

chrome://geckoview/content/config.xhtml

source: https://connect.mozilla.org/t5/ideas/firefox-for-android-abo...

zaik• 2 years ago

I can access the about:config page on mobile, but I can't seem to find a relevant option. Maybe it's already disabled for the Fennec app from F-Droid?

squarefoot• 2 years ago

On mobile you probably want to try Fennec and/or Mull, both Firefox forks, compatible with FF addons and available on F-Droid.

perryizgr82• 2 years ago

Do we know why they blocked about:config on mobile? It doesn't make any sense at all...

htiawe2• 2 years ago

I recently started using Firefox again, because of all the madness around Chrome and the change of how add-ons (mainly uBlock and similar) would work.

And it felt kinda good, i actually thought that Firefox was different and a part of "the good guys", now it doesn't feel that way anymore. Sigh.

aagha• 2 years ago

https://news.ycombinator.com/item?id=40974414

tda2• 2 years ago

on firefox mobile:

open chrome://geckoview/content/config.xhtml, set general.aboutConfig.enable to true

open about:config, set dom.private-attribution.submission.enabled to false

psychoslave2• 2 years ago

Wow, thanks for this and the parent post.

fransje26• 2 years ago

What's the difference with setting

    dom.private-attribution.submission.enabled

to false in the gekoview?

aaubry• 2 years ago

Thanks a lot for this tip. I don't know how one is supposed to find this setting.

tromp• 2 years ago

On MacOS that checkbox is in a separate section called "Website Advertising Preferences".

l0b0• 2 years ago

On NixOS, set

  programs.firefox.policies.Preferences."dom.private-attribution.submission.enabled" = false;

(https://gitlab.com/engmark/root/-/commit/bbb3ff9efb878ddda38...)

RegW• 2 years ago

Interestingly the option has a link to an explanation on how it works. Which was handy as I couldn't get past the German cookie dialogue on the original article.

I guess the question is whether the aggregation services can be persuaded by clever attribute manipulation to give the ad site a near unique report for a user across many sites.

<https://support.mozilla.org/en-US/kb/privacy-preserving-attr...>

<https://datatracker.ietf.org/doc/html/draft-ietf-ppm-dap>

<https://github.com/mozilla/explainers/tree/main/ppa-experime...>

fuzzy2• 2 years ago

Already discussed quite a few times:

https://news.ycombinator.com/item?id=40954535

https://news.ycombinator.com/item?id=40966312

https://news.ycombinator.com/item?id=40952330

https://news.ycombinator.com/item?id=40971247

https://news.ycombinator.com/item?id=40965161

...and probably a few I missed.

gala8y• 2 years ago

Thx. Nevertheless, https://xkcd.com/1053/ still applies. I'm one of lucky 10000 today.

eco• 2 years ago

The CTO of Mozilla just posted on /r/firefox about this:

https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_abo...

lopis3• 2 years ago

I think this line is very important:

First, in the absence of alternatives, there are enormous economic incentives for advertisers to try to bypass these countermeasures, leading to a perpetual arms race that we may not win.

It's very likely that this arms race will lead to DRM in web publications and video feeds (which Google is already experimenting with).

CalRobert3• 2 years ago

I will begrudgingly admit he has a point here. In a few years I imagine almost all sites will refuse to serve anything without WEI, and the "open" web will be the preserve of a few hobbyists. Annoyingly you'll still need to use a compromised browser (or worse, app) to do anything with your bank, etc.

cynicalsecurity2• 2 years ago

DRM on a website = no search engine can scan the website = no users = the DRM website dies.

rwmj• 2 years ago

leading to a perpetual arms race that we may not win

So we're not even going to try.

jillesvangurp2• 2 years ago

Which will lead to counter moves by alterative browsers and websites and Google risking the loss of browser market share. If you think this is unthinkable, just look back at Microsoft's dominance of the browser market twenty years ago. Exactly like Google is doing they were pushing through all sorts of user hostile stuff via internet explorer. Before Chrome came along, Firefox was one of the few holdouts against them. Internet explorer users were dealing with all sorts of crap. Popups, popunders, all sorts of viruses, cross site scripting attacks, etc. Mostly that was just a mix of poorly designed features but there was also MS trying to get into search and advertising and they were trying to abuse their defacto monopoly to do that.

anordal2• 2 years ago

Yes, that line is important.

This has happened before. Remember the critique against Encrypted Media Extensions (https://en.wikipedia.org/wiki/Encrypted_Media_Extensions): Oh no, DRM in the browser! But remember that web video used to require Adobe Flash for the longest time, and even after a decade of HTML5 video, sites were still clinging onto Adobe Flash (and later also Microsoft Silverlight) for what turned out to be DRM purposes. At the time, these plagued proprietary blobs were not going anywhere. Except, after EME had widely supplanted this last holdout usecase, they were quietly allowed to die. The result is that we have much smaller-scoped proprietary blobs in the form of content delivery modules with a lot fewer bugs and portability issues.

mort964• 2 years ago

This move does not stop the arms race. Non-anonymous data is still better for the ad industry. Why give that up?

account4216• 2 years ago

And that DRM will likely come anyway and restric users of niche browsers like Firefox and operatings systems no matter what Mozilla does - just look how EME implementations and Websites using it treat Linux users not to mention non-x86/ARM architectures. So best is to push back now while we still can instead of giving them an inch.

thinkingemote2• 2 years ago

Some might be interested in the discussion about that too https://news.ycombinator.com/item?id=40971247

luke-stanley• 2 years ago

Key comment replying to him there which gets no reply from him: "Opt-out is NOT a consent". This is very problematic, see my last comment: https://news.ycombinator.com/item?id=40966312

close04• 2 years ago

doing something about [the massive web of surveillance] is a primary reason many of us are at Mozilla
we consider modal consent dialogs to be a user-hostile distraction from better defaults, and do not believe such an experience would have been an improvement here.

You know what's user-hostile? Doing things without the user's knowledge or consent. The new tab page of Firefox after an update often advertises features of the release Mozilla sees important (their VPN offering, Firefox on mobile, etc.). This time the new tab page told me nothing about this change. Communicating it to me was "free" and they still actively refused to do it.

"Doing something" about surveillance starts with transparency but if Mozilla's leadership doesn't see this as important they have no place leading such a company. Mozilla doesn't seem to wrap its head around the fact that their users use Firefox because they don't want the same kind of shady tactics Google or Microsoft keep pulling, they don't want their browser control to be handed over to some guy in a board room who needs a PR team to give a lengthy non-answer to the problem.

I see a lot of words spent on why they came up with this technology but barely a mention about the biggest issue here especially from a company that presents itself as a champion of user rights: they pushed the change in the dead of night and took an actively hostile decision in the users' names by enabling a clearly controversial setting without any warning or communication.

we should have communicated more on this one

This kind of PR speak for "we actively kept it hidden" is the best way to alienate the users who investigated and chose this browser for a reason.

DaoVeles12• 2 years ago

Thats just it, that they are doing this in a somewhat quiet manner is a sign that they know how this would go down.

worble• 2 years ago

Interesting comment here: https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_abo...

If you have telemetry disabled, this feature is also disabled, even though that isn't represented in the UI and looks like it's turned on.

It's not good that it exists and is on by default, but if you have already opted out of telemetry previously, you're opted out of this too.

BoredPositron• 2 years ago

Oh my... not exactly reassuring.

tgv4• 2 years ago

This phrase in particular:

I’ll do my best to address [your questions], though I’ve got a busy week so it might take me a bit.

That means: I'll answer the easy ones, and ignore the hard ones, or ask the legal team to come up with some weasel words.

nubinetwork2• 2 years ago

And nothing of value was posted.

lukan2• 2 years ago

"The devil is in the details, and not everything that claims to be privacy-preserving actually is"

Yeah, like Mozilla.

This is not the first time they silently added tracking and avertisement. The toggle with "firefox shares basic telemetry with the adcompany Adjust" has been there activated by default since a while (among other stuff). This is just more tracking from them, while claiming to defend privacy. Another day, another scandal.

latexr8• 2 years ago

It’s clear in retrospect that we should have communicated more on this one

What isn’t clear, in retrospect or otherwise, is why companies/apps/services need to keep learning this lesson. The user outcry was utterly predictable from even before the first web article was out. The fact that no one with decision power at Mozilla saw it coming is worrying: either they have zero understanding of people’s concerns for privacy or they don’t care. Neither is good.

jeltz5• 2 years ago

Especially since this is very similar to what happened with Cliqz and that there likely are many at Mozilla who were around when that happened too. And the Cliqz scandal hurt Mozilla's market share a lot in Germany.

Klonoar12• 2 years ago

The fact that no one with decision power at Mozilla saw it coming is worrying: either they have zero understanding of people’s concerns for privacy or they don’t care.

Or the third option: they feel the tradeoff of HN & co's criticism style is not a big deal in the end. Criticism of Mozilla in general is very warranted right now, but the way(s) in which everyone is doing so just feels very out of touch with the actual situation. ;P

They're - by their own words - trying to do something in a privacy preserving way because the ad industry is not going away. They might fuck it up at first, and that's why it's an experiment. It's also possible to disable it, it's not like you're trapped in it.

This thread in general feels like it leaves Mozilla no room to experiment or find any form of growth. People want them to be "just a browser" but then also expect them to be stewards of the web - and then cry foul when they actually try to find a setup that fits into the current model of the web.

rstarast• 2 years ago

Who's to say this "my bad, we'll do better next time" isn't part of the playbook?

exe34• 2 years ago

it's a classic abuse tactic: if you ask first, people will cry out and if you then do it, it'll be considered escalation on your part. so instead you do it first, and if possible, do something worse to begin with, and then when there's outcry, you take a small step back, claim to be the reasonable one, and then later on push the rest of the way.

david_draco• 2 years ago

What isn’t clear, in retrospect or otherwise, is why companies/apps/services need to keep learning this lesson.

They are trying to find a funding model that makes them independent from Google.

- Building a fast, privacy-oriented browser that keeps up with web standards and fixes security bugs takes people, organisation and therefore money. Yes, much more than that CEO salary.

- No one wants to buy for a browser.

- No one wants to pay a subscription fee for a browser.

So you are left with ads. Mozilla is trying to find a balance there between privacy and ads with a clearing house approach. People who hate ads out of principle scream. How should browser development be funded?

n_ary2• 2 years ago

Lets be honest, the number of HNish folks running Firefox is insignificant, compared to number of people using Firefox because their friends recommended it. So even if lets say 1% of the users(HN and similar folks) perform an outcry and go ahead disabling it, the other 99% of the people will still be a huge moat of data. These strategies(though I am willing to give Mozilla the benefit of doubt), had been played out many times, "ops we did this ... emergency update to fix it ... we are releasing this now officially, agree to our terms if you want to continue ... you can always opt-out ... slow boiling frog metaphore ... this is now permanent with the option to disable is gone and forgotten about".

bawolff6• 2 years ago

Honestly, having worked at companies that made unpopular product decisions (nothing like this, but still every company puts its foot in its mouth sometimes), it can be surprisingly non-obvious what gets people bothered and what doesn't.

We always see the decisions that blow up, but we dont notice the thousands of decisions nobody cares about. Sometimes it really does look like just another minor feature request at coding time.

mihaaly2• 2 years ago

Acting stupid and being uninformed, clueless, incompetent CTO/CEO/CXX is less prone to lawsuits than admitting intent of harm.

ta988• 2 years ago

They don't care. It is not the first time, always the same excuse and blame the user to not be intelligent enough to understand (this is what communicated more means in their broken by profit minds).

pndy3• 2 years ago

What isn’t clear, in retrospect or otherwise, is why companies/apps/services need to keep learning this lesson.

Please. This is never about learning and better communication. This is universal corporate English for: "you got us, but we really don't give a flying ef and we will fulfill our goals step by step - no matter what you say".

account4216• 2 years ago

Companies know this but they don't care because there are rarely any consequences that cannot easily be mitigated with cheap PR tactics. Even now you are responding to a PR statement that is trying to reframe the issue as users simply not understanding what Mozilla is doing when in reality Mozilla knows full well that this goes agains the explicit wishes of a large part of their userbase but have chosen to enable this anyway. This isn't a communitcation issue. This is a fundamental "who does Mozilla serve" issue.

a4isms• 2 years ago

It’s clear in retrospect that we should have communicated more on this one

Oh maaaaaaaaaaaan do I despise hearing variations on this "non-pology."

It's never "Wow, we fucked up by doing something harmful to you." It's always, "My bad, I failed to explain exactly why you're wrong to think this is harming you. I take total responsibility for not explaining why this is actually good for you. I'll try again."

munksbeer2• 2 years ago

What isn’t clear, in retrospect or otherwise, is why companies/apps/services need to keep learning this lesson. The user outcry was utterly predictable from even before the first web article was out.

One possibility is they knew there would be an outcry but estimated that the loss in user support because of it would be limited enough that the upside of having the majority of users with the setting left on wins.

qwertox5• 2 years ago

Most users just accept the defaults they’re given, and framing the issue as one of individual responsibility is a great way to mollify savvy users while ensuring that most peoples’ privacy remains compromised. Cookie banners are a good example of where this thinking ends up.

The problem we currently have with cookie banners is thanks to the browser vendors not caring about it.

An API could exist which a page can query, where the user has already pre-selected how they want to deal with cookies. For example reject all but the essential ones, reject none at all, reject some, according to certain criteria.

Even more, the browser could check if the page is adhering to the user's expectations, and if it doesn't, block it for a period of time, like a week or a month, and publish the fact that they ignored the user's wishes.

Possibly also give the user a signed document which claims that this page did not respect the user's privacy expectations, so that the user can use it in court.

These should be solvable problems.

cqqxo4zV46cp• 2 years ago

What!? What’s the benefit of this from a site’s POV? Your technical solution is completely out of touch with real goals and incentives.

remedan• 2 years ago

This was already tried with the Do Not Track header. Websites simply ignore it. They don't want an easy way to get the user's preference. Because they know that most users would set it to decline tracking. Sites would rather annoy every visitor for the chance that they click 'accept'.

htiawe2• 2 years ago

Wow, that really was a wall of text.

Is it just me that sometimes get the feeling that when companies have to explain them selves with this amoubt of text, they actually know that they are doing something wrong but are trying to cover it up by these long and unnecessary explanations?

pndy3• 2 years ago

they are doing something wrong but are trying to cover it up

That's what most of folks says in this sub-tree

deskr• 2 years ago

First there's a justification based on current anti-tracking system being bypassed:

"there are enormous economic incentives for advertisers to try to bypass these countermeasures"

Then:

We’ve been collaborating with Meta on this

Given Meta's track record with scooping up just about any personal data they can find, it's pretty obvious that this is just going to be yet another datapoint in Meta's collection.

robertlagrant• 2 years ago

I imagine Meta like this because most of their tracking is done behind a Facebook login anyway, and it reduces the fidelity of Google ads.

dist-epoch• 2 years ago

TL;DR: sorry, we're not sorry. we will go ahead with it and explain it to you better why it's a good thing in your interest.

Juliate• 2 years ago

What is really concerning (and enlightening) is that it is the CTO that's posting, and not the CEO.

It shows that the topic is merely now considered as a technical point, rather than a principal-based one.

justinclift4• 2 years ago

The Mozilla CEO would be very unlikely to receive a positive reception.

JoosToopit• 2 years ago

That's just the most brain dead rot I've read in a while.

Mozilla is a joke nowadays.

Retr0id• 2 years ago

Wow. This represents a profound misunderstanding of the advertising industry.

Data is their edge. It's how they compete with each other.

The privacy "arms race" isn't just between the browser vendors and the trackers, it's also between tracker a and tracker b.

Giving them a new data point (no matter how """privacy preserving""" it is) is just that, another data point. It's not going to make them give up on the others.

raxxorraxor2• 2 years ago

To be honest, I would have used a different approach and browsers would very well be capable to give erroneous data and contaminate data from tracking users. This would be going on the offensive, and I don't believe there are any legal barriers that prevent users from "ad fraud".

I don't believe in cooperation with an industry that has shown no remorse with tracking users at all. That will not be successful. Advertisers will employ this and still track. And it is possible to not get tracked and deliver false data, even today.

AlexandrB• 2 years ago

Maybe I'm cynical, but the rationale given seems extremely naive. There's nothing stopping advertisers from using this new attribution mechanism and tracking users as much as possible. In fact that's probably exactly what they'll do since it's likely that not every browser will support this kind of attribution.

The arms race will continue as it does today, but advertisers will have yet another avenue to exploit in the form of the attribution API.

Zefiroj• 2 years ago

It shows that their interest is in a "sustainable ad-driven economy model with privacy deemed acceptable by Mozilla", and an "agent of the user".

I suppose it shows who's paying Mozilla.

nabla9• 2 years ago

But how does the PPA actually work? There is an aggregation server between the advertising provider and the users or their data, which anonymizes the information from the individual app browsers. Only then does it make the data available to the participating advertising customers.

Ygg24• 2 years ago

Question is, how do we know that? What proof do we have of that?

dpwm• 2 years ago

The article links to Mozilla’s press release / blog entry about the acquisition of Anonym [0]. It’s pretty dystopian reading. The last three paragraphs and the summary of Anonym are more worrying than anything else I’ve read on this so far:

This acquisition marks a significant step in addressing the urgent need for privacy-preserving advertising solutions. By combining Mozilla’s scale and trusted reputation with Anonym’s cutting-edge technology, we can enhance user privacy and advertising effectiveness, leveling the playing field for all stakeholders.

I can only interpret this as the urgent need is money, and wants to sell its "scale and trusted reputation". Mozilla has been down this road before. It was not good for them.

Anonym was founded with two core beliefs: First, that people have a fundamental right to privacy in online interactions and second, that digital advertising is critical for the sustainability of free content, services and experiences. Mozilla and Anonym share the belief that advanced technologies can enable relevant and measurable advertising while still preserving user privacy.

This is some pretty weak wording for a press release. The economics of the situation are that advertising will always trump privacy. Researchers have successfully de-anonymized anonymised data sets, including medical records. Why would these data be any different?

As we integrate Anonym into the Mozilla family, we are excited about the possibilities this partnership brings. While Anonym will continue to serve its customer base, together, we are poised to lead the industry toward a future where privacy and effective advertising go hand in hand, supporting a free and open internet.

Anonym’s customers are advertisers, right? The same people who for decades poured money into eroding that free and open internet that we had…

About Anonym: Anonym was founded in 2022 by former Meta executives Brad Smallwood and Graham Mudd. The company was backed by Griffin Gaming Partners, Norwest Venture Partners, Heracles Capital as well as a number of strategic individual investors.

Well, it seems Anonym, Smallwood and Mudd had a nice piece about them written in the Wall Street Journal [1]. From the second paragraph:

Graham Mudd and Brad Smallwood each spent more than a decade building Meta’s advertising system, which allowed the company to offer granular data about how ad campaigns worked with individual users, often by tracking their web and mobile activity.

[0] https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-t...

[1] https://archive.is/17c0f#selection-5751.0-5751.246

jeltz5• 2 years ago

Mozilla has been down this road before. It was not good for them.

Yes, this is Cliqz all over again and that scandal cost them most of their German userbase.

se0• 2 years ago

And which browser are using the German now ?

mrweasel3• 2 years ago

The whole acquiring Anonym thing is almost guaranteed to go wrong. Either Mozilla just wasted a lot of money buying the company as it fails to be profitable or privacy will be eroded as Mozilla starts profiting from ad sales.

The companies buying ads aren't keen on privacy, at least not if it comes at the cost of optimizing sales, so I don't see anyone but small "do good" niche companies would buy into what Anonym is selling. Alternatively Mozilla will make money and start relaxing privacy restriction in order to extract even greater profits. I don't see them stopping half-way. The Mozilla leadership has again and again shown that they do not understand their user base.

Firefox is a great browser, but so it all Chromium based browsers. Mozilla apparently never considered why someone might stick with or switch to Firefox, when Chrome, Edge, Safari and other browsers do the exact same thing, sometimes perhaps better. I really want to ask the Mozilla CTO and upper management what they think their product is, because I got a in increasing hunch that Firefox isn't the first thing that would come across their lips.

Personally, right now the only reason I'm not switching to something like Vivaldi is my desire to ensure that rendering engines beyond Blink is represented in statistics.

DaoVeles12• 2 years ago

So where can I donate to Ladybird browser development?

Before anyone tries to respond with it. It is https://donorbox.org/ladybird

prox3• 2 years ago

They really need to start adding windows as a build target at some near point in the future. As a webdev, that’s the only way I can convince the public to switch.

DaoVeles12• 2 years ago

I mean for a long while even the GNU project provided Windows builds for Icecat browser. Probably to much Stallman grumbling.

EDIT : Actually they still update it. Last version is 115.

lukan2• 2 years ago

"that’s the only way I can convince the public to switch."

It is not ready, to be a public browser.

master-lincoln• 2 years ago

Maybe Ladybird can be a good reason to convince the "public" to switch away from Windows in the near future

leshenka2• 2 years ago

It's already too hard to convince public to switch from chrome to another chromium browser or firefox and you're talking about switching to browser that is at least several years away from feature parity

Sammi3• 2 years ago

They want to be able to run more websites well before they invite the unwashed masses from windows XD

nektro• 2 years ago

it would be very silly for them to add windows support

Ygg24• 2 years ago

Why Ladybird? Why not Servo?

different_base• 2 years ago

I appreciate Ladybird's initiative. But if they work with Servo, Ladybird can build the browser and Servo can focus on the engine. Also we can avoid C++ nightmare. Everybody wins.

remram2• 2 years ago

Isn't Servo a new rendering engine for Firefox? How does it fix all of Firefox's problems, that are not engine limitations?

You can make a free web browser from Firefox's current engine just as easily as from Servo, I would fund the person who does that.

tgv4• 2 years ago

Don't hold your breath. It takes ages to develop a browser that's as fast as Firefox. CSS and JS are no joke.

switch007• 2 years ago

Slow is the price we'll have to pay. Just like how VPNs slow down your connection

Or, if one dreams for a moment, if slower becomes the norm, web apps will have to become less complicated. Fast seems to just enable more and more ad tech

quaintdev• 2 years ago

Maybe it's time to move away from whole html/css/js, http and browsers?

Let's build something that is Ad resistant from the start. Something that uses native technologies.

Edit: We need something that does not need backing of large corporations or huge funding to access the web.

Internet was always simple. We have become over dependent on browsers and http stack.

Sammi3• 2 years ago

Ladybird more than doubled their js performane in five months between january and may and are now about 2x as slow as Safari: https://x.com/awesomekling/status/1790098727081836697

Things are progressing faster than you'd think.

ethagnawl• 2 years ago

Thanks. I just donated to Ladybird and Servo.

Here's the Servo link: https://servo.org/sponsorship/

remram2• 2 years ago

Is there any reason to believe that the Servo project will produce a full independent browser, rather than a browser engine as their website states? The only likely outcome is that it be used in Firefox...

bachmeier• 2 years ago

How would that solve the problem? Years down the road, if they actually finish their browser, what guarantee do you have against it being enshittified in some way? The only option I see is a project that exists to deshittify an open source browser.

DaoVeles12• 2 years ago

So far the core idea is a sort of constitutional foundation to try and ensure it doesn't get absorbed into that think. Mind you, that was Mozilla 20 years ago.

Short term, deshittify Firefox. Mid term move to some like Lady bird. Long term, if Lady bird is corrupted, start on browser replacement number 2.

Alternatively, the hardest step of just walking away for heavy internet usage I guess.

sph• 2 years ago

What do you expect from a company indirectly owned and controlled by Google money?

I can't wait for Ladybird to get good, in a decade realistically, swimming against a massive current of Google pushing its unstandardised nonsense on Chrome, and web developers jumping on the bandwagon, making web standards more and more complex by the day so no one ever is able to catch up.

You can add to the dead internet theory the fact that the Web is now maliciously impossible to recreate and access from scratch if you are unable to compete with the billions Google spend to maintain their hegemony. Heck, even Microsoft found it was more efficient to join Google rather than to try and direct what they laughably call "an open standard." There is more competition to build reusable space rockets than in web browsers.

A sad day, and sadder days await us. Shame of Mozilla, and on the CTO trying to sell this feature as a good thing.

berkes7• 2 years ago

They aren't owned nor controlled by Google. And certainly not directly.

I presume you refer to the fact that most income of Mozilla comes from Google paying a fee to have their search be the default. While that is worrysome, it's not control nor ownership. Let alone direct control. At most it gives Google leverage.

cdrini• 2 years ago

The previous post said "indirectly" controls; maybe a misread?

newzisforsukas• 2 years ago

I can't wait for Ladybird to get good

I don't see that happening in a decade. What makes you so optimistic?

thinkingemote2• 2 years ago

A user in another thread said that disabling this via config made their user agent also change. Can anyone confirm? Seems unrelated I imagine?

https://news.ycombinator.com/item?id=40959723

JonChesterfield• 2 years ago

Firefox mobile also won't let me into about:config. So I guess that's the end.

Opera? Other recommendations?

justinclift4• 2 years ago

Which OS are you using?

Ygg24• 2 years ago

Firefox mobile is only on Android. The iOS version is a reskin, so it's not affected.

DaoVeles12• 2 years ago

Elinks via Termux? /jk

For those that don't know, Elinks is a text only terminal browser.

brettermeier2• 2 years ago

Lol, nobody wants that.

Recommend Mull or something else sensible.

Edit: Whoopsy, oversaw your /jk

mrweasel3• 2 years ago

While the jokes is appreciated, I'm also half-serious in considering just using Links/Elinks or w3m and just use whatever is the default browser on my OS for those cases where I need to book ticket or do banking.

I'm sadly falling out of love with the web. So much fun and enjoyment have left the web in the past 20 years and I don't enjoy or to some extend even benefit from the modern hellscape of modern commercial web.

quikoa• 2 years ago

As mentioned elsewhere in this thread:

Go to: chrome://geckoview/content/config.xhtml then enable about:config after that dom.private-attribution.submission.enabled can be set to false.

gkbrk• 2 years ago

If you need to do that much hacking around to plug a deliberate privacy hole, you might as well use another browser.

brettermeier2• 2 years ago

It is possible, see here: https://news.ycombinator.com/item?id=40974112#40974414

mananaysiempre2• 2 years ago

Not Opera, for all that is holy[1].

Fennec[2], the F-Droid build of Firefox, does have about:config enabled.

[1] https://news.ycombinator.com/item?id=39816429

[2] https://f-droid.org/en/packages/org.mozilla.fennec_fdroid

justinclift4• 2 years ago

As an alternative, if you're using macOS (or iOS) then Kagi's Orion Browser seems decent:

https://kagi.com/orion/

ranguna• 2 years ago

https://librewolf.net/

And fallback to Firefox when things don't work. Which is usually on sketchy websites, websites that have heavy bot protection and fingerprinting or ones that use gpu APIs.

MrAlex9410• 2 years ago

A few criticisms of LibreWolf:

* There is no legal entity behind the project. Should anything ever happen with the project (it can happen, even if unlikely), there are no legal ramifications.

* The binaries aren't signed. Yes, code signing is a bit of a racket, but there is some merit in it.

* There is no auto-update mechanism. Might not seem like a big deal, but IMO it is, especially on Windows where you're recommended to rely on 3rd party client to update the browser for you. You've now added a middle man, and since the binaries are not signed... well there's no guarantee you aren't downloading a malicious binary.

MiddleEndian2• 2 years ago

There is no auto-update mechanism. Might not seem like a big deal, but IMO it is, especially on Windows where you're recommended to rely on 3rd party client to update the browser for you. You've now added a middle man, and since the binaries are not signed... well there's no guarantee you aren't downloading a malicious binary.

To me, this seems like a plus. If you want users to update, provide them with something worth updating to. This tracking suddenly being enabled for a ton of users is the very result of automatic updates.

itscrush• 2 years ago

Have you spent time with Waterfox as an alternative or have some thoughts when comparing against Librefox?

In app update prompts work for me, they have a TOS / Legal Entity it seems. They broke away from Startpage in recentish years.

Plenty of feature trade offs to compare though with Librefox.

michael9423• 2 years ago

You know perfectly well that point 1 is completely irrelevant in the world of open-source.

A UK Ltd. is less transparent than Librewolf, an open-source project run by many volunteers without the incentive to make any money.

Point 3 is no longer true, the installer comes with the option to enable auto-update and on Linux, it also auto-updates, depending on distro, etc.

The risks you are talking about are not inherent to Librewolf, but to Linux and open-source, and thus are not legitimate criticisms of Librewolf.

poidos• 2 years ago

Installed it a couple days ago and it works great, haven’t had any problems yet. Nice to have it through Brew.

INTPenis• 2 years ago

I wish the article showed us how to disable PPA.[1]

1. https://support.mozilla.org/en-US/kb/privacy-preserving-attr...

xyproto• 2 years ago

Will we see a comeback from IceWeasel?

whoisthemachine• 2 years ago

I recently became aware of LibreWolf (https://librewolf.net/installation/linux/), going to see how it works. So far I like that I can install it via AppImage!

st_goliath• 2 years ago

While the Wikimedia Foundation is often quoted as having cancer[1], I guess the Mozilla Foundation has Alzheimer's, constantly forgetting who they are and why they are here in the first place.

[1] https://en.wikipedia.org/wiki/User:Guy_Macon/Wikipedia_has_C...

jeltz5• 2 years ago

And the scandals they have been involved in the past. Cliqz was another attempt by Mozilla to invest in privacy preserving technology (that time search, this time ads) where they did a stealth launch without user consent.

hulk_• 2 years ago

Just installed Chrome again. I loved everything about the idea behind Mozilla but the browser is quite not useable these days. Really sad.

moontear• 2 years ago

How is your personal story related to the story? I don’t believe Chrome is better than Firefox on terms of ad tracking.

linuxandrew• 2 years ago

Out of the frying pan and into the fire. With regards to privacy and tracking Chrome/Chromium is so much worse than Firefox. Whether it be terrible defaults, exceptions which allow Google to see your system info, or an incognito mode which is a misnomer, Chrome just doesn't do privacy at all.

I can sympathise about general usability concerns but they don't really relate to the OP.

I personally run Ungoogled Chromium for anything that doesn't work in LibreWolf, which is fortunately not too much.

TimCTRL• 2 years ago

Do you guys like or trust Vivaldi?

mrweasel3• 2 years ago

I've been looking at it and they are fortunately very open about how they are funded (search engines and bookmarks). Opera was my browser of choice, back in the days of Presto, so I trust the Vivaldi CEO/CTO who also ran Opera. My main annoyance with Vivaldi is that it's Chromium based, I really don't like the idea of a monoculture of rendering engines.

toofy2• 2 years ago

vivaldi is not open source, they’re almost certainly more invasive than Mozilla.

silcoon• 2 years ago

By offering sites a non-invasive alternative to cross-site tracking, we hope to achieve a significant reduction in this harmful practice across the web.

The value of words is leaving the web.

qwertox5• 2 years ago

Firefox should integrate a tracker-blocker which blocks all ads which rely on executing Javascript as well as profiling-related 3rd-party code snippets, but leaves ad images which are integrated into the page, served exclusively by the owner of the page, and are based on the content offered by the page. Like magazine ads.

Everything else is just agreeing with the advertising industry on their idea that profile-building is fine.

These advertisers nowadays think they have they are entitled to everything, and Firefox just helped them.

alex_duf2• 2 years ago

By this logic wikipedia wouldn't be able to load any image

qwertox5• 2 years ago

They could offer a deal to Toyota and tell them they're offering image-only ad space on all car-related pages. For example images with deals. Toyota would know from the referrer that the click came from Wikipedia.

All the other images are hosted by Wikipedia themselves and are not ad-related, so I don't see where's the issue here.

albeva• 2 years ago

And there goes my trust in Firefox out the window...

Safari seems to be the only decent, privacy-focused browser left on the market.

Until the Ladybird arrives.

sumuyuda• 2 years ago

The fact that Apple killed any real third party extensions ended my use of Safari.

MrAlex9410• 2 years ago

Safari seems to be the only decent, privacy-focused browser left on the market.

Safari has Private Click Measurement: https://webkit.org/blog/11529/introducing-private-click-meas...

And AFAICT, Mozilla's implementation is technically superior?

Tarq0n• 2 years ago

Safari also has attestation, as far as I know without user consent.

stebalien4• 2 years ago

This works by adding noise. Can't an attacker bypass it by boosting the signal? Assuming the attacker can create sybil advertisers/browsers, this should be totally doable:

1. Define some baseline set of M impressions with various ad identifiers and from various sybil advertisers.

2. For each target user, define some set of M marker impressions, also with various ad identifiers and from various and sybil advertisers.

3. Save all impressions (marker + baseline) on a bunch of sybil browsers to get above the reporting baseline with some probability.

4. If/when a target user visits a target website, request a conversion report for each ad/advertiser.

You now have a baseline signal (from the baseline ads/advertisers) and a marker signal (from the marker ads/advertisers). If this is one of your target users, you'd expect their "marker" signal signal to be stronger than the baseline.

MrAlex9410• 2 years ago

Technical docs are here: https://github.com/patcg-individual-drafts/ipa/blob/main/IPA...

Might be worth opening an issue if you believe there's merit to the attack?

stebalien4• 2 years ago

I can try. But I'm pretty sure what they're trying to do is fundamentally impossible without some kind of sybil protection.

stebalien4• 2 years ago

Those docs look out of date and appear to be designed for "app" ecosystems. The latest proposal from Mozilla is https://docs.google.com/document/d/1QMHkAQ4JiuJkNcyGjAkOikPK...

And I'm now quite sure this system is insecure. Fundamentally, either:

1. There is some magical sybil protection: An attacker can only spend their own privacy budget without affecting the rest of the system.

2. The system can be saturated: An attacker can spend everyone's privacy budget.

3. The system is not private: An attacker can exceed the "safe" privacy budget by combining information from multiple sybils.

Piraty• 2 years ago

If 1% of regular Firefox users just donated the equivalent of 10USD per year to mozilla, they would not have the need to find ...eyebrow-raising... ways to earn money.

n_plus_1_acc• 2 years ago

On the other hand, people would be more inclined to donate money if they could trust Mozilla to value the privacy of their users, which is one of the biggest reasons people choose FF in the first place.

lawn• 2 years ago

Nah, they'd just increase the already ridiculous salary to their CEO.

justinclift4• 2 years ago

Mozilla CEO Salary was US$7 million in 2022. It's beyond taking the piss:

https://en.wikipedia.org/wiki/Mitchell_Baker#Negative_salary...

No idea how much the new CEO is being paid. Probably just as bad.

bondarchuk4• 2 years ago

Only if they'd also spin off the browser from all the political activism and NGO cash grabbing, and let people choose themselves to which of the two their money goes.

mardifoufs• 2 years ago

0% of donations go towards financing the Firefox project. Donations to Mozilla are explicitly not used for Firefox, they say so in the donation page.

slowhadoken• 2 years ago

An app that alerts you to invasive content in updates like this would be cool.

uyzstvqs• 2 years ago

What's dumb is that Firefox is not the freedom browser people think it is. Mozilla is a crappy organization. Firefox has extension signing, it's as restrictive as installing apps on iOS where only approved apps can be installed, without a setting to easily disable it. Mozilla can also remotely install extensions by default (opt out) called "experiments" or something. Their anti-tracking is purposefully weak because of their dealings with Google. Now this data collection for ads. They didn't enable DNS-over-HTTPS by default specifically in the UK. And Mozilla leadership is associated with radical left politics, just as an extra.

Maybe check out Brave Browser, LibreWolf or Vivaldi.

3l3ktr42• 2 years ago

And Mozilla leadership is associated with radical left politics, just as an extra.

Do you have proof for this? I'd be curious. I also fail to see how is that related to the collecting data by default thing. Is that a leftist thing now?

bawolff6• 2 years ago

Personally i'd rather judge people by the things they do (or fail to do), not who they are associated with.

V__• 2 years ago

Maybe they mean this statement, however I don't see why their proposed changes are radical.

[1] https://blog.mozilla.org/en/mozilla/we-need-more-than-deplat...

mightyham• 2 years ago

Whether you agree or disagree with what the Mozilla foundation does, it seems fairly matter of fact to say that they are pursuing liberal policies and that posts from the leadership, like the couple below, employ a good bit of leftist rhetoric.

https://blog.mozilla.org/en/mozilla/first-steps-toward-lasti... https://blog.mozilla.org/en/mozilla/leadership/mozilla-racia...

bionsystem• 2 years ago

I daily drive Vivaldi, for about 2 years now. I was a bit concerned with the closed source part but the experience is great, it's fast and with plenty of features. I don't know how good they are with regards to privacy but on the other hand I do not need to install any plugin as everything is integrated so at least my data is contained with them.

kiviuq• 2 years ago

communists and anarchists have been dominating the ad industry for decades :p

jasonlotito• 2 years ago

And Mozilla leadership is associated with radical left politics
Maybe check out ... LibreWolf

GNU says hi.

ManBeardPc• 2 years ago

Maybe I don't fully understand the technical implementation, but as far as I have read about the implementation this gives personal information to a third-party. This should automatically mean that Firefox would violate European GDPR laws, they clearly need to get consent from the user before collecting anything. Not just a moral issue, but can quickly become a legal one as well.

genezeta• 2 years ago

I've been wondering about this whole affair. The thing that got me wondering is this: Is this really interesting for advertisers?

I mean, let's imagine this works as explained -whatever, let's imagine it does and with no downsides even-. Now as far as I can understand this aggregate information ends up producing something like "this particular ad placed here ends up producing this number of conversions". Is this really something an advertiser wants to know? Maybe to some extent, but to me it sounds a lot more like something an advertising platform would want to know. Which is why I'm not surprised by Meta's interest.

To me this feels like a good tool to avoid paying small websites at all for just having ads. Impressions would be finally and completely discarded as something payable. Now for the ads on your site to earn you something at all you need conversions that you can now reliably track. For a site owner to be paid, they'd need to increase the CTR; they can't just "provide ad space", they have to work to earn clicks.

So maybe -probably- I'm way off here. Maybe someone can correct me. But as I see this, this tool seems very specifically made for the big advertising platforms.

temporarely2• 2 years ago

Enough of this waiting for virtuous entities to address legitimate concerns of the public.

The "ad industry" is a cancer and we need legal protection against this "industry". The solution is political not technical and definitely can not be left to "the market".

Haven't you had enough?

berkes7• 2 years ago

How would that legal "protection" work in practice? What would it protect against? Who would it protect?

What you say sounds reasonable. And I'm not trying to say "well, it's impossible because of some current status quo", because we could change that.

What I'm trying to say is that we need this "industry" to work out the practicalities. Otherwise we are "protected" in a same way the GDPR protects us against 3rd part trackers (you don't need a cookie banner if you don't allow 3rd parties to track your users. Yet here we are...)

talkin• 2 years ago

Legal: “it’s forbidden to target ads at specific users”

Done.

bondarchuk4• 2 years ago

We don't necessarily need the ad industry to work out the practicalities if we simply do away with the whole ad industry. We could quite easily outlaw receiving payments from a third party in exchange for displaying information to your users.

alemanek2• 2 years ago

Full liability for secondary harms caused by the leak of data that wasn’t directly required to provide a service to those same end users. Selling of data to third parties doesn’t transfer this liability but expands it to include any leaks or misuse coming from the entities the data is sold to. No statute of limitations.

So if company X sells data to company Y and then Y sells to company Z then company X has full liability for leaks or misuse from all entities in the chain.

No more free credit monitoring. Banks, credit card companies, and end users get to directly sue these companies. May not completely solve it but you can try to make it so expensive to mine data you don’t truly need that it ends the whole industry.

I am sure there are holes in this but we can at least try to kill the data brokers and bad actors.

eleveriven3• 2 years ago

I think legal protections can effectively safeguard user data

ho_schi• 2 years ago

Yep. One of the things which the FSF did right was the GPL. They didn’t tried like programmers hack against bad things which never works in long term.

The bad people will change the API, lock the bootloader, implement a problematic standard (ACPI, SecureBoot) or add more DRM.

We cannot solve political issues (law) with technical solutions (programming). If we don’t like locked iPhones, the solution is a law. If we don’t like tracking, the solution is a law. But the EU Cookie-Directive of failed? Because malicious compliance, they made a business case out of it instead of ending it (cookies for logins are fine). And if we want public APIs, local computing and open-source the solutions are laws.

The FSF uses the law :)

Let us go a step further, change it.

DyslexicAtheist• 2 years ago

I was with you until secureboot.

At least on my Debian I retain full control using the shim and my own enrolled keys. So seems less an issue with the technology but perhaps with how some vendors (that are already locking you in anyway) use secureboot?

from https://wiki.debian.org/SecureBoot

> Shim then becomes the root of trust for all the other distro-provided UEFI programs. It embeds a further distro-specific CA key that is itself used for as a trust root for signing further programs (e.g. Linux, GRUB, fwupdate). This allows for a clean delegation of trust - the distros are then responsible for signing the rest of their packages. Shim itself should ideally not need to be updated very often, reducing the workload on the central auditing and CA teams.

gjsman-10003• 2 years ago

One of the things which the FSF did right was the GPL

And the GPL is dying. Every year fewer projects are maintained under the GPL standard. Violations abound anyway. The MIT License and other permissive licenses; or commercially restrictive licenses like the SSPL, are the new go-to; because the GPL didn’t think about SaaS or “Tivoization” until it was too late.

jellykid• 2 years ago

When it comes to the internet... I'd prefer it to stay like the wild west. Least amount of regulation beyond something like net neutrality. People forget that the reason we have all of these "free" services is because of ads and that's coming from someone who hates ads. Every streaming subscription I have, I pay for the ad-free service. Let the people who don't know how to install a browser extension or change a few settings pay for these things for the rest of us.

otachack• 2 years ago

I have a feeling that is most people out there.

I observed a friend of mine click on a malicious ad link recently in front of me when driving a presentation for a community meeting. It was shown as an overlay for a seemingly harmless site I found. In my home with a pihole I didn't see any of the ads.

I felt terrible that I was partially responsible for her clicking it. This knowledge and habit of ad-blocking and secure computer usage takes factors of time, effort, and money to learn, and not everyone is going to, or is capable of, devoting what's needed.

account4216• 2 years ago

People forget that the reason we have all of these "free" services is because of ads and that's coming from someone who hates ads.

People forget that before ad-supported "free" services took over we had community-run actually free services.

The internet does not need ads.

btylke• 2 years ago

You may not see the ads in that content, but your data will still be collected and sold. This is where we lack fundamental protections.

eleveriven3• 2 years ago

Agree, interventions are needed to protect consumers

8jef2• 2 years ago

Yes, that's why I've donated to the LadyBird project.

ajdude2• 2 years ago

It's just weird that ladybird is picking ideological hills to die on, such as "no gender neutral pronouns"[1]

[1] https://github.com/SerenityOS/serenity/pull/6814

hilbert42• 2 years ago

"ad industry" is a cancer and we need legal protection..."

Absolutely true, but how do you expect that to happen or come about?

Rampant advertising is similar to the copyright law problem. The majority of users may not like what's happening but their opposition and or dislike is but mild so when it comes to political action it collectively amounts to little more than nought.

On the other hand, advertisers, like copyright holders, have strong vested interests thus are highly motivated to ensure politicians act in their favor (one only has to look at the lopsidedness of lobbying interests to see that).

The real enemy is indifference, as a whole the citizenry is not motivated enough for things to change. Simply, we have ourselves to blame.

temporarely2• 2 years ago

Absolutely true, but how do you expect that to happen or come about?

In the same manner through which legal protection for various other matters have come about. By raising awareness, sharing thoughts and solutions, and organizing.

_heimdall14• 2 years ago

Anyone bothered enough by advertising can stop using whatever product has been ruined by ads, or find ways to remove the advertising.

More laws and larger governments doesn't have to be the answer to all problems. If consumers care enough they'll change their usage, if they don't change their usage they likely don't care enough.

dspillett• 2 years ago

Anyone bothered enough by advertising

I don't particularly have an issue with advertising itself. If adverts get on my nerves on a product or page I just leave, as you suggest: problem solved.

The actual issue is the stalky tracking of me throughout my life that is currently inseparable from the advertising. I can't just walk away from that: it happens behind my back, it has happened before I get the chance to walk away.

can stop using whatever product has been ruined by ads

Which will not stop the stalky behaviour of the ad industry. They'll still track me if I happen to click the wrong thing, or track me through my connections to other people. I suppose I could walk away from life and become a hermit, but that would be just a little extreme.

or find ways to remove the advertising.

Which is, while I do take part, an ultimately fruitless task. Every block we make for the stalky behaviour, be it technical or legislative (other than outright banning the tracking of personal data except with explicit opt-in without exceptions, and properly enforcing punishments for breaking the ban), they'll find a way around. Removing it is not a long term solution, it is a war or attrition where we have to have our guard up all the time and they only have to get lucky, or just be particularly sneaky, every now and again.

More laws and larger governments doesn't have to be the answer to all problems.

This has often been said by companies and their shills. Oddly, they are all in favour of extra laws and government reach when it is, for example, to protect what they consider to be their intellectual property.

sloowm2• 2 years ago

If I walk outside I'm bombarded by ads. Almost all websites have been tailored to include ads and hide information. You're tracked on all devices you touch.

Vaguely referencing more laws or larger government doesn't mean anything. We're not talking about all problems but a specific one. There is an obvious imbalance between the power and information an individual consumer can use to shield themselves from activities by companies that are detrimental to them. We are also not expected to test our own food for toxins.

More platitudes and soundbites doesn't have to be the answer to all problems.

A4ET8a8uTh04• 2 years ago

We can, but, as OP noted, the change is only temporary, while political change is harder, but also tends to last longer. I still remember when pihole worked on most things. These days it is just a part of adblocking approach for me.

tldr: Some of us are tired of fiddling with things where were we shouldn't have to.

<< More laws and larger governments doesn't have to be the answer to all problems.

If market participants can't behave ( and they clearly can't help themselves ), it is the only real answer.

<< If consumers care enough they'll change their usage, if they don't change their usage they likely don't care enough.

Or.. options for consumers are limited, which affects what they do. In all seriousness, streaming execs seemed to admit the ads simply bring more money for them so they don't care if non-ad version is profitable. It is not enough.

My household dropped Netflix and Prime over their silliness. We currently still have Disney until they get too greedy. And that is just streaming. Regular net is soooo much worse without a way to scrub the ads away.

throw109203• 2 years ago

More laws and larger governments doesn't have to be the answer to all problems

More laws and larger governments are generally undesirable (for obvious reasons) but saying that we shouldn't make any laws at all is throwing the baby out of the bathwater.

If you're thoughtful and deliberate about how you write your legislation, you can have a disproportionately positive impact with a very small amount of additional weight.

For instance, instead of trying to enumerate every single way that data could be leaked and forbid that (see: HIPAA), you should just make the end state (PII in the hands of someone the user didn't explicitly authorize it to be in) illegal and mandate a fine per unit of information (e.g. 1% of the median US salary for SSN) to every entity in the leak chain (because a chain of custody for personal information is just about mandatory at this point).

Details will vary, but this general approach is vastly better than the crazy laws we have in other areas that attempt to "enumerate badness" in the intermediate rather than the end state.

sneak• 2 years ago

What is happening today that you don’t want to happen in the future?

What would these political solutions achieve that aren’t achievable instantly today via technical solutions?

Most people don’t care about what the ad industry is doing.

pyinstallwoes• 2 years ago

Only legal form of advertising should be in public marketplaces, that is it.

throw109203• 2 years ago

Please don't engage in this blatant political activism and flamebait here. This is anti-intellectual and not what I want to see on HN.

I agree that something needs to be done about the ad industry and rampant data collection, but your emotionally manipulative comments are not it, and actively make it harder to discuss solutions to the problem.

dartos• 2 years ago

How so?

gaoshan• 2 years ago

"The market" needs to be checked in so many ways. You'd think that by now we could learn to take what works and modify the rest but apparently everything has to be black and white and even a concept like "the market" ends up bound by dogma.

dfxm12• 2 years ago

There's an election in a few months. Now is the time to write to the candidates and tell them to do something about it.

3l3ktr42• 2 years ago

I wonder why they claim they need this... Tor seems to be doing fine as an organization without collecting user data? Why maintaining Firefox is much more expensive? I guess the codebase for Firefox is much larger and in the end Tor is a fork of Firefox, right? So maybe they do need much more resources? Not to say I'm not disappointed with Mozilla once again.

berkes7• 2 years ago

Tor is (was?) heavily subsidised by secret services in a.o. the US.

likewise, agencies within the U.S. government variously fund Tor (the U.S. State Department, the National Science Foundation, and – through the Broadcasting Board of Governors, which itself partially funded Tor until October 2012 https://en.wikipedia.org/wiki/Tor_%28network%29?wprov=sfla1

toofy2• 2 years ago

While it has had funding from some sources we don’t necessarily trust, it’s still entirely open source and the code has been combed through repeatedly.

When it comes to privacy apps, I’d place significantly more trust in something like that than literally anything closed source or unscrutinized to that degree.

8jef2• 2 years ago

Please give to LadyBird project and be done with it.

eleveriven3• 2 years ago

I think Mozilla Firefox has long been positioned as a browser focused on user privacy and data protection... This decision is indeed a significant breach of trust

anordal2• 2 years ago

I see this as an attempt at a lesser evil, and I would support that (see my EME DRM comment), but I have one concern:

Does this new "privacy preserving attribution" feature respect multi-account containers? Or is it somehow not considered necessary, because it's meant to be less invasive than the tracking cookies it's supposed to replace? Call me skeptical for now.

I'm a happy user of multi-account containers, which lets me separate my cookie identities in Firefox. Before, I had to use different browsers for work and private, and yes, it solves this problem, but the best part is that I don't have to worry about tracking cookies, because they aren't tied to my personal accounts: In my experience, I can to a great extent escape the echo chamber I'm in, and the ads I see in it, by just deleting the cookies of my sacrificial default container.

Other than that, considering the status quo – that the web is already an unfriendly GDPR nightmare, I'm positive to the initiative. And because of the power of the default, I can understand that the feature wouldn't likely take off if it was opt-in, so I won't criticize Mozilla for that move either.

southernplaces72• 2 years ago

One of the few things about Firefox that made me attempt to tolerate its repeatedly slow, shitty performance and tendency to slow my whole device down, was the privacy angle. With that gone, why bother? Might as well use Chrome. At least it's light and fairly quick.

rc_mob• 2 years ago

Eh? Chrome is famously bulky and a memory hog

lolinder4• 2 years ago

There are a lot of people who still think of Firefox from 5 years ago. Whatever else you can say about Mozilla (and I have a lot to say about Mozilla) they have actually really improved performance to where I'm not convinced it's any worse than Chrome. Browsers are just doing more than they used to.

acdha• 2 years ago

Firefox’s reputation got hit a decade or so ago by performance problems in popular extensions like AdBlock Plus, and it was common to see people mistake switching to a new browser as the reason for the speed up because the initial performance would be notably better before they loaded the new one up with extensions, too.

southernplaces72• 2 years ago

Sorry folks but though i'm just speaking from personal experience, it's what I noticed time and time again. I've given Firefox multiple chances as my default browser over several years right up until maybe a year ago and the same problem presented itself across different laptops and FF versions (many after in those cases someone told me that FF was FINALLY fixed, oops). Were these laptops heavy duty models with serious CPU, GPU, RAM and etc power? Nope, but they shouldn't have to be for just running a browser.

Chrome on the other hand (and believe me I despise Google in so many different ways) has consistently been okay. Not great, but okay, and certainly better than Firefox. This while having the same browsing, tab and extension habits in both browsers.

With comments like my original above I've always seen a bunch of people come out with all sorts of caveats defending or justifying FF, but personal experience has consistently shown me differently.

NayamAmarshe• 2 years ago

https://privacytests.org

pbronez• 2 years ago

huh. Maybe I should try Brave again.

pfzero• 2 years ago

I wish there was a serious conversation on how a browser can be productivized and make actual profits. I think that model has the best chances of working out over the long-term in guarding user's privacy - at least for those users willing to pay for it.

Most (all?) companies which developed a browser have lax policies on data privacy. At most those are inline with major directives like GDPR. However, it's not in their best interest to protect / not leverage user data. So the real discussion should've been about the set of features that would attract a sufficiently large user base who would pay ~10$ per month subscription in order to make the model sustainable on the long-term.

alabhyajindal• 2 years ago

Greeted by a cookie banner in a different language when I open. I swear cookie banners are the biggest problem facing the internet. We need to do something about this!

lexicality• 2 years ago

honestly it's got to the point that any time I get a cookie banner more complicated than yes/no I immediately revoke JS privileges for that website.

At least ublock origin makes that easy, but it's still ridiculous.

On the bright side, French courts have ruled that this kind of cookie popup is illegal under the GDPR so maybe they'll slowly be destroyed

belorn• 2 years ago

EU created a task force in 2021 to address the cookie banner, which gave a report last year that basically said that all current form of cookie banners are practically not legal in terms of giving consent.

As with this kind of regulations, we now have to wait for the law suits to target a few select large companies, then the courts to reconfirm that the regulations says what it says, and then appeals, and then finally the large companies will pay a large fine and then comply, followed then by the industry in large.

Delay, delay and then delay some more has been the response from the data collection industry for the past 10 years. Same for right to repair regulations and smartphones.

matheusmoreira• 2 years ago

Reminder: Mozilla has billions of dollars in the bank. They don't need to do this. They want to.

seanhunter• 2 years ago

If you want to disable this, instructions are given here[1] but

1) Hamburger menu -> Settings -> Privacy & Security

2) scroll down to the new section entitled "Web Site Advertising Preferences".

3) Make sure the box marked "Allow web sites to perform privacy-preserving ad measurement" is not checked.

[1] https://support.mozilla.org/en-US/kb/privacy-preserving-attr...

kevincox2• 2 years ago

And of course this setting doesn't sync to new devices by default. So you need to remember to opt-out on every device.

The underlying pref is dom.private-attribution.submission.enabled. I'm going to force this off in my policies.

blueflow2• 2 years ago

How do you sync these settings across devices? I need such a thing, too.

defulmere2• 2 years ago

Thanks for providing these instructions. My usual way to get to some setting in Firefox is to use the search box but it seems that Mozilla is actively hiding this one by excluding it from search, ie if you type "advertising" into the settings search box then there are no results.

rascul2• 2 years ago

It seems the search matches on the text of the option, not the section text. The text of the option is "Allow websites to perform privacy-preserving ad measurement" and the search for me brings up the option (and of course anything else that matches) when I search for any of that.

noisy_boy• 2 years ago

That is because "Allow web sites to perform privacy-preserving ad measurement" doesn't have the word "advertising" in it. Granted the current phrasing a bit awkward and may have a certain degree of deliberateness behind it.

1vuio0pswjnm7• 2 years ago

Is everything typed into the search box sent to Google by default.

Y_Y3• 2 years ago

    sudo rm $(which firefox)

ryandrake2• 2 years ago

It's great that there is a way to turn it off, but the root problem, again and again, is that it is on by default without obtaining the user's opt-in consent. The company (again) made a unilateral decision about what the software should do, without asking the user. This is such a common, terrible practice of Silicon Valley.

I don't care if the feature cures cancer or gives me a free puppy. I don't want a feature running without my explicitly commanding it to run.

tiffanyh• 2 years ago

Firefox needs to update their Mission.

Because it's very confusing now.

account4216• 2 years ago

I always think it's ironic when these things are reported on by websites that force you into accepting their ad tracking which really should be illegal under the GDPR.

sotix• 2 years ago

Can companies not see how their ads are performing by looking at their income statements? An ad campaign costs x dollars. Widget sales increase by y dollars. Companies were able to run this method for a long time. I think ads have gone way too far. It’s shocking we’ve gotten to the point of this discussion on data collection to fuel ads.

tyree731• 2 years ago

In the aggregate, yes, but in the specific, no. Companies nowadays want to see which advertising channels and specific ads, over a given period of time, are performing, so as to decide how to better invest their ad spend

EADDRINUSE• 2 years ago

`sudo echo "127.0.0.1 push.services.mozilla.com incoming.telemetry.mozilla.org" >> /etc/hosts`

irq-1• 2 years ago

Our hope is that if we develop a good attribution solution, it will offer a real alternative to more objectionable practices like tracking.

There is no negotiating with the advertising industry. No system will stop them from acting unethically to gain an edge.

My idea for such a system: random GUID added to each ad. Browser plugin collects GUIDs. Client protects itself with random GUIDs removed and new random GUIDs added. Client sends GUIDs to a Collector they choose. Collectors run client GUIDs against Advertisers lists (bloom filters). Advertisers pay Collectors, and Collectors give to orgs.

Edit: replace GUIDs with 6 random bytes, so the existence of an id is not proof of it's being viewed. it needs to be plausible that the client added an id randomly, and that's not the case with a GUID.

Archelaos• 2 years ago

Years ago I had a "Download Firefox" button on my Web-site. I have removed it because of similar incidents in the past. And I stopped recommending Firefox to friends and relatives, because I can no longer do it wholeheartedly. I am not even sure myself, whether it makes a big difference which browser you use nowadays. More out of tradition I am still using Firefox myself, but I know other technologically competent people who shifted away from it. I can only assume that this was for similar reasons: It is felt that Firefox gives no less cause for annoyance than other browsers. When Firefox gradually loses more and more dedicated supporters who become indifferent, I see a rather bleak future for it.

ChrisArchitect2• 2 years ago

[dupe]

More discussion among others: https://news.ycombinator.com/item?id=40952330

https://news.ycombinator.com/item?id=40966312

https://news.ycombinator.com/item?id=40954535

Dwedit• 2 years ago

How does using uBlock Origin affect this?

peanut_worm• 2 years ago

I don’t think Mozilla is trustworthy anymore.

Timber-6539• 2 years ago

At this point Firefox is just a brand for Mozilla to do with as they please. All the talk about a non-Chrome browser with defacto privacy features was just bait to get loyal followers and later on down the road sell them something. Seems ads is just their newest offering.

AlecSchueler• 2 years ago

Anyone else feel done with the web? I can't remember the last time I enjoyed a browsing experience. I think this new default might be the end for me.

jandrusk• 2 years ago

Not a good strategy for keeping an already very small user base.

ChrisArchitect2• 2 years ago

[dupe]

Since this is days old news with lots of discussion (https://news.ycombinator.com/item?id=40952330 and more)

the more recent development is Firefox CTO posting thoughts: https://old.reddit.com/r/firefox/comments/1e43w7v/a_word_abo...

(https://news.ycombinator.com/item?id=40971247)

Yawrehto• 2 years ago

I kind of like how this has dominated the 'active' section ever since it started and it's, barely a news story everywhere else.

Honestly I don't have much to add to the conversation. Mozilla made a bad move, Firefox's big thing was privacy and not being Chromium and it's lost the first thing.

eburuschkin• 2 years ago

Apple enabled the same thing in Safari.

Settings -> Advanced -> Allow Privacy-Preserving Measurement of Ad Effectiveness

yamumsahoe• 2 years ago

how do i donate to the mozilla foundation to support this amazing development?

For advertising, Firefox now collects user data by default

Related Stories