Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 57 delays requests to tracking domains

janbambas.cz

Post reply on HN
Print view View original

221–230 of 266 posts

Re: Firefox 57 delays requests to tracking domains

#221

Post by jrochkind1 »

Much of this discussion is missing the point that the stated goal of this change is actually to _help_ sites that use lots of tracking scripts, not to penalize them.

It has become common to use so many tracking scripts that the perceived page load time (time to display/interactivity) is actually significantly slowed down. I actually first installed an ad-blocker myself when I realized some sites were taking like 5+ seconds to load, and loaded quicker with the ad-blocker. (But this change isn't a _blocker_ of scripts, it's trying to change order and timing of execution to speed up page load while _keeping_ the scripts).

The intent of this change is to delay load of those scripts (which are already being loaded with code that loads them async, that is, without spec guarantees of load order or timing) until after the page UI is loaded and operative, to _improve_ perceived load time.

I'm not sure if people are missing this point, or don't believe the stated goal and think it's secretly a plan to hurt these sites instead. I believe the stated goal. (whether they like or hate that idea!) As the OP says though, there are certain pages that _may_ be unintentionally harmed by the change, if they were relying on quick load of scripts that they should not have been relying on because they were already being loaded async (that is, with no guarantees of load order or timing, already).

If this ends up being a non-trivial number of pages, and those pages/tracking frameworks don't fix themselves to accomodate, then I predict the change will be considered unsuccessful and unfortunately rolled back.

It is meant to _help_ pages that use a lot of tracking scripts, not hurt them. Although I guess the assumption is that actual load time of interactivity is prioritized over making sure your tracking scripts are in immediately. If site owners actually prefer to slow down their pages non-trivially in order to guarantee tracking scripts immediately, then I guess they wouldn't see it as help. shrug.

I think the OP author is probably regretting his post title. It maybe should have been "Firefox 57 speeds up load time to interactivity of pages with lots of tracking scripts", heh.

Re: Firefox 57 delays requests to tracking domains

#222

Post by bigbugbag »

jonchang wrote: post #144
zaphirplane wrote: post #105

Earlier quoted context omitted.

Hmm doesn’t it send a do not track cookie, tracker JS is still loaded and discretionary

No, it's basically a content blocker like Adblock or noscript.

I'm convinced it's not. noscript is blocking scripts and xss and does all kinds of things, while mozilla intently removed the option to disable scripts in firefox.

I do not know about adblock as I stopped using it a long time ago and now use ublock origin a general purpose blocker, but I certainly remember how mozilla was vocal about never adding a blocker in firefox as this would be contrary to (actually their business model).

Re: Firefox 57 delays requests to tracking domains

#223

Post by bigbugbag »

sundarurfriend wrote: post #218

> To conclude on how useful the tailing feature is – unfortunately, at the moment I don’t have enough data to provide (it’s on its way, though.) I wonder if this post was rushed to publication, to manage Mozilla's public image and reestablish it as a friend to user privacy, after the 'Looking Glass' fiasco a few days ago. (I'm not exactly opposed to such PR efforts, as long as they're accompanied by actual internal c…

Much of mozilla communication is PR and marketing.

Maybe this is damage control, but somehow I think they are not well organized enough to have this kind of thing happen.

Besides how is this helping with privacy ? Trackers are still loaded and tracking.

Re: Firefox 57 delays requests to tracking domains

#224

Post by feelin_googley »

feelin_googley wrote: post #155

This raises the question: Why delay instead of block? Assumption is that user wants page to load faster but does not object to tracking . What if user wants page to load faster and objects to tracking? Source of Firefox tracking protection is list at disconnect.me? credit: eco https://news.ycombinator.com/item?id=15964393 Basic gethostbyname()->HOSTS file blocking: #!/bin/sh exec curl https://disconnect.me/trackerpro…

correction to example 2

   sed -n '//!{
   /\./s/.*/.&\
   =&:255.255.255.255:1\
   =*.&:255.255.255.255:1/;};/\./p'

Re: Firefox 57 delays requests to tracking domains

#225

Post by bigbugbag »

paulgb wrote: post #51
qwerty456127 wrote: post #47

Isn't it anti-net-neutrality? Is it ok to build it into a major browser? I actually block all the tracking, malware, ads, social networks, fraud, gambling, porn (except a couple of porn sites I like :-)) etc domains I could find information about but this is my personal conscious choice, I have manually installed extensions for this and built the lists. Shouldn't other people do the same themselves too if they choose…

For me, using Firefox is the personal conscious choice you refer to. Their brand is that the browser is on your side, I'm happy to have the defaults set accordingly. (Edit: I should add that I think you're asking a very valid philosophical question that my opinion as a user of Firefox doesn't fully address)

Branding and marketing and PR are just that, and the objective is to get a bigger market share.

Actually it is to be the dominant browser on the market, mozilla name means mosaic killer, as in dethrone NCSA Mosaic and take its place as the n°1 browser by market share and was the internal name for netscape.

They kept the name for the continuation of the effort though the target had moved to IE who actually took over Mosaic. Now the target is google chrome and the historical meaning is lost on most people but the intent is still to have the bigger market share because monies.

Re: Firefox 57 delays requests to tracking domains

#226

Post by codezero »

notyourday wrote: post #206
codezero wrote: post #146

Earlier quoted context omitted.

Nope, happy to fall on a sword if this happens though. Also – really bummed you got downvoted – this point is very valid and other folks in my position should take note.

@codezero, my point was not about falling on a sword. Rather it was that NH has this extreme naivete related to statements coming from those that do not have any real say. How many people here think that data is removed from BI data lakes when a user deletes the account ( or at +N months )? [Edit: Downvotes on this one also?] Ask what happens to customer's data used by business intelligence when customer deletes the…

I get where you are coming from but you are also making some assumptions that are a bit broad. It’s a laudable goal to educate naive folks on HN, I support you in that, but you should try a different approach.

I’m not naive. I’ve been working in tech since 1996 when I managed a dial up ISP. I worked at Red Hat the day they IPOed and have been with Heap for almost four years. I was employee number 8, and personally wrote much of the code to remove data from our databases.

We have strict controls and logging around who can access our infra, as is necessary for SOC2 compliance. We have rolling backups (that are read only except by very specific individuals) so even if I got real mad one day and decided to ruin my career, we could restore the data, however, we don’t keep backups indefinitely so when data is deleted or removed with intent, it will eventually be gone in backups too.

I’m not on the board, but I do have influence as I am the head of our solutions and support team. I am a privacy advocate and take a firm stand on protecting my customers’ data and executing their own desires to protect their customers, and I do my best to not only instill these things in my team and company, but also to make policies and controls to make them real.

When I delete data, I don’t rely on a message being sent to a queue. I do not “soft” delete. When our customers ask for their data to be deleted, we delete it without delay.

I will say that sending a message in a queue would be pretty efficient and if we went that route I’d have the consumer of that message verify that the data was deleted.

Ultimately our backing store is Postgres, it’s not rocket science to understand how deleting that data works, we could get into a discussion about how it’s not really deleted until it’s been reallocated, at the DB and at the OS and hardware levels, but I don’t think you’re trying to make that argument.

Is everything perfect? No, that would be naive to say, but we don’t assume it is and work hard to remain accountable.

I’m happy to discuss this or about anything else here or over email, Skype, hangout, in person, etc, but I do want to say that you should challenge your own assumptions a bit more. Not every person or company is inherently bad, naive or ignorant. A lot of people on HN are extremely tenured, bright, and thoughtful, they just usually know better than to comment here, if anything, that is my most naive action.

Re: Firefox 57 delays requests to tracking domains

#227

Post by Vinnl »

dao- wrote: post #191
Vinnl wrote: post #168

Earlier quoted context omitted.

I don't think Chrome supports extensions on mobile, but Firefox does, so you could try that if you really want an adblocker.

Firefox does on Android, not on iOS. https://support.mozilla.org/en-US/kb/add-ons-firefox-ios

:(

Re: Firefox 57 delays requests to tracking domains

#228

Post by codezero »

arkh wrote: post #179
codezero wrote: post #147

Earlier quoted context omitted.

Agreed, they make a good point, however, I think the terms of service are binding, and if what we're doing changes, we _must_ update them. This, of course, does not change the fact that we've collected a lot of data and it would suddenly fall under the new terms of service. With that said, I actively delete customer data on request, and a terms of service change like this _might_ (very reasonably) prompt someone to r…

I'll have a wild guess there: all devs and most managers have access to the full data set. Any disgruntled one could ex-filtrate it anywhere with not trace. That's the kind of things which make me for the vision of data as liability.

Absolutely not. We have strict control over our data and access to infrastructure.

Every person with access can only get it via a bastion VPN with their own key. Access is logged to an external host which they do not have access to. We are SOC2 compliant (just waiting on final certification) and we have regular pen tests both against our code as well as our employees with mock phishing.

As a total aside: it would cost a serious amount of money to exfiltrate the data in bulk, and would cause an obvious strain on our infrastructure. Assuming they get by all the above protections, and are really clever, sure, never say never, but I think we can not assume the worst but prepare for it none the less.

Re: Firefox 57 delays requests to tracking domains

#229

Post by bigbugbag »

j_s wrote: post #190
paulgb wrote: post #51

Earlier quoted context omitted.

For me, using Firefox is the personal conscious choice you refer to. Their brand is that the browser is on your side, I'm happy to have the defaults set accordingly. (Edit: I should add that I think you're asking a very valid philosophical question that my opinion as a user of Firefox doesn't fully address)

> For me, using Firefox is the personal conscious choice you refer to. Firefox marketing is effective but to be clear they have begun changing direction, pursuing a more practical "attracting the masses" approach (a la Signal) rather than paranoid/hyper-vigilant/engineer-style idealism (something some misinterpret Firefox marketing as still claiming), and as a result Firefox has been forced to course-correct several…

I would not be surprised if the move to opt-out spying is consequences of the dropping ALSA and adding a hard dependency to pulseaudio fiasco.

Telemetry has been held as one of the main justification for the change as it supposedly showed only a fraction of users used ALSA. It turned out to be a combination of misinterpretation of collected data (installed libpulse does not mean not using ALSA) and a complete ignorance of the real world (most linux distros disable telemetry because privacy, people using ALSA are often the same that take extra measures to protect their privacy hence disabling mozilla spying mechanisms).

As a consequence mozilla pushed hard for package maintainers to enable telemetry in linux distros and sadly most did, see: https://bugzilla.mozilla.org/show_bug.cgi?id=1233687 https://bugzilla.mozilla.org/show_bug.cgi?id=1285195 https://bugzilla.mozilla.org/show_bug.cgi?id=1285201 http://pkgs.fedoraproject.org/cgit/rpms/firefox.git/commit/?...

Compare to this from 7 years ago: https://bugzilla.mozilla.org/show_bug.cgi?id=667577

The fun part was when mozilla people started patronizing users for protecting their privacy and told them that it's their fault if ALSA got dropped and that they should relinquish their privacy instead or they will be ignored:

  Second, continuing to opt out of telemetry will just make problems
  like this worse. As was stated in this thread, one of the
  justifications for removing ALSA support was that the telemetry
  numbers showed a very little ALSA usage. If more ALSA users had
  telemetry enabled, perhaps the outcome would have been different.


  In any case, running without telemetry means not having a say in
  data-driven decisions about what configurations Mozilla should
  support. It's OK to disable telemetry (that's why it's
  user-controllable), but both users and distros that make decisions on
  users' behalf should to take into account that if don't let Firefox
  send info about your system config to Mozilla, your system config is
  invisible to Mozilla's decision making about what to support.
source: Rationalising Linux audio backend support - https://groups.google.com/forum/#!msg/mozilla.dev.platform/j...

There was no course correction here, ALSA is still out despite the issue being entirely to mozilla implementation and not ALSA abilities, despite this being an edge case for linux netflix users with a specific 5.1 setup and despite someone coming forward to offer to fix and maintain their broken code.

Did I mention that they failed to mention this change in release notes, that firefox displayed a message inviting people to click a link to learn why their browser suddenly lost the ability to play sound but the link was broken and that this was an ESR release?

So when I read some mozilla marketing PR about them pretending to champion user privacy, I'm nonplussed at best.

Re: Firefox 57 delays requests to tracking domains

#230

Post by bigbugbag »

qwerty456127 wrote: post #56
paulgb wrote: post #51

Earlier quoted context omitted.

For me, using Firefox is the personal conscious choice you refer to. Their brand is that the browser is on your side, I'm happy to have the defaults set accordingly. (Edit: I should add that I think you're asking a very valid philosophical question that my opinion as a user of Firefox doesn't fully address)

From the practical point of view, I am afraid the trackers will respond a way if such a move is made on such a global level. Nobody was fighting AdBlock+ when it was only used by geeks and now as is it has gained so much attention there are a lot of sites that won't work if you use AdBlock+. Introducing te "do-not-track" header was a great idea but it has been completely ruined by major browsers turning it on by defa…

Sites that do not work when using AdBlock+ are fighting back their money extorsion scheme (Adblock+ has this commericla program where if you pay them money they will whitelist your ads). Geeks ahve long moved to ublock origins or umatrix.

Anyways 95% of the time you just have to disable scripts from the websites to unbreak them.

do not track was never a good idea as respecting it was on a voluntary basis, meaning it was mostly an additional metrics to use to track and profile people who do not want to be tracked. It's a no brainer really that if you did not want to be tracked you should not enable it. Remember ghostery ? same thing all over again.

Post reply on HN