151–160 of 480 posts
Earlier quoted context omitted.
They had to serve you the file, for which they needed your IP. If they're willing to assign each downloaded client a unique ID what are the odds they are not storing the IP address associated with that unique ID?
Why would Mozilla need the IP address?
Earlier quoted context omitted.
Of course the "attack" is easy to avoid. But you first have to know about it. Mozilla should not be planting such landmines.
This isn't a landmine in any normal threat model. The average person is concerned with identity theft and perhaps their local law enforcement, not the full weight of domestic or foreign intelligence services.
If we only care about the average person, we may as well have Firefox snitch to the NSA and their Russian, Chinese, Indian, etc. equivalents, plus Microsoft, Google, Raytheon, General Electric,..
Firefox users who prefer to download the browser without the unique identifier may do so in the following two ways: Download the Firefox installer from Mozilla's HTTPS repository (formerly the FTP repository). Download Firefox from third-party download sites that host the installer, e.g., from Softonic. It's nuts and another indication Mozilla doesn't understand the reason they exist, but it's not that hard to get ar…
(In my case:)
1: https://download.mozilla.org/?product=firefox-latest-ssl&os=...
2: https://ftp.mozilla.org/pub/firefox/releases/98.0.1/linux-x8...
Earlier quoted context omitted.
Download counts dont need you to embed a unique token. At the most basic level, you can get this by doing a count over http logs.
To tell how many downloads result in an actual install http logs are not enough. You will get extra noise on top of the data you care about.
It could be obtained through other data that doesn't need to track the individual install.
I forget if Firefox has a 'welcome' page that it shows on first launch, but it could serve as the count of number of installs.
I believe Firefox also has an auto update system, so that too could serve as an Active Users count.
Lots of ways that you can derive this data without needing to track individual download to installation.
Earlier quoted context omitted.
Precisely. Firefox is never going to defeat Chrome in the "being Chrome" category. If it wants to exist as more than a tool for Google to avoid antitrust lawsuits, it can't keep playing that game. It has to differentiate. Privacy is not differentiation because it's invisible and HN commentators are 90% of the people who care about it. I want the sense of power back. I want the feeling that Firefox gave me a decade ag…
> Nowadays using Firefox feels more like holding a political demonstration in an empty room than using the finely-tuned instrument I once had. I can't think of better words to describe my feeling as a Firefox holdout. It's still my default browser, and the one I use for 97% of my work. Mozilla is breaking my heart with their floundering. Like a fantasy author who keeps getting mired in side quests and can never get b…
Package manager installations wouldn't have this problem because everybody gets the same copy of the same binary and associated files, rights?
Chocolatey and WinGet don’t. Looks like Chocolatey gets the binary from download.mozilla.org [1], while WinGet gets it from download-installer.cdn.mozilla.net [2] (which looks to be the HTTPS repository mentioned in the article, thus being exempt from tracking?) [1] https://community.chocolatey.org/packages/Firefox#files [2] https://github.com/microsoft/winget-pkgs/blob/master/manifes...
It doesn’t look to me like the tracking stuff is on the HTTPS repo links, so they’re probably telling the truth about that. They also ship a version in the Microsoft Store, that should be safe too (I don’t think Microsoft shares user identities for free apps with the developers, maybe I’m wrong?)
[1]: https://download.mozilla.org/?product=firefox-latest&os=linu...
Is this true about the x64 Linux tarball [1] that Mozilla distributes? It's difficult for Mozilla to create new tarballs for each download. [1]: https://download.mozilla.org/?product=firefox-latest&os=linu...
Non trivial but a couple hours of work to implement and test probably.
Earlier quoted context omitted.
It's not even internal justification, it's just plainly the default for practically any web server that does logging. You would have to go out of your way to disable it.
Not logging IPs or establishing controls on it is table-stakes for anyone doing anything serious about privacy.