Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox built-in spyware that cannot be disabled

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 48 posts

Re: Firefox built-in spyware that cannot be disabled

#31

Post by thisislife2 »

rasz wrote: post #17

Mozilla CEO needs this for that sweet Google payout. This is how you prove to advertisers number of active installs.

This is the right answer. (The Vivaldi browser company too say the same thing in their forums when asked why "phoning home" cannot be completely disabled). It's also a bit frightening because this means Firefox collects enough data to fingerprint and uniquely identify every browser / user.

Re: Firefox built-in spyware that cannot be disabled

#33

Post by Bender »

josephcsible wrote: post #27
andreareina wrote: post #19

Earlier quoted context omitted.

How does an application-specific configuration in firefox do anything about other devices on your network?

I think "disable DoH" there means "block all DoH servers at the router", not "configure Firefox to not try to use DoH".

Yes, I disable it using the suggested method of returning NXDOMAIN for "use-application-dns.net". I do also disable it in applications such as the browser to avoid the log entries.

    grep appli /etc/unbound/unbound.conf 
     local-zone: "use-application-dns.net." always_nxdomain
And then I have about 80 IP's that I blackhole. People often counter that with, "but DoH can run on any HTTPS endpoint and you can't block CDN's", and whilst this is true I have never run across a CDN performing front-ending DoH and I am the type of person that will block a CDN. I can route HTTPS for specific applications through my own VPN mesh if it came to that and use Squid SSL Bump MiTM proxies to sanitize URL's which I have done in the past. It would just be a couple ACL's in Squid to block DoH end-points. The only domains I can not MiTM are those still using public key pinning such as Paypal which I will never use, eff.org, and a few Google sub-domains. There are probably a few others I have not run across on my Squid proxies.

As a side note, I think PiHole should consider adding a feature for Squid MiTM proxy mode so that more people can do this, with options like peeling off specific LAN clients to use the proxy or force everything through it.

Re: Firefox built-in spyware that cannot be disabled

#34

Post by countWSS »

logicprog wrote: post #4

This is why I use LibreWolf, which is a patched version of Firefox that removes pocket and stuff like this entirely, instead of regular Mozilla Firefox with something like arkenfox to harden it. There's only so much a config, no matter how extensive, can really do for you against what's been hard-coded into a program itself, and configs need personal maintenance, whereas a patch version of a piece of software can pul…

I use libreworf and it it spends few minutes of startup connecting to some mozilla server on AWS. Then all webpages start loading. I tried removing every single setting related to telemetry, replacing servers and it still doesn't work, perhaps its indeed hardcoded somewhere deep.

Re: Firefox built-in spyware that cannot be disabled

#35

Post by JohnFen »

josephcsible wrote: post #9
Bender wrote: post #2

I noticed this as well and blocked it in my local DNS. I also disable DoH. grep firefox /etc/unbound/override/combined.conf local-zone: "firefox-settings-attachments.cdn.mozilla.net" always_nxdomain local-zone: "firefox.settings.services.mozilla.com" always_nxdomain

> I also disable DoH Why? DoH is good for privacy.

> DoH is good for privacy.

That depends on what sort of privacy concerns you. I think DoH is awful because it allows DNS lookups that I cannot observe/filter/respond to without going to great lengths.

Re: Firefox built-in spyware that cannot be disabled

#36

Post by wkat4242 »

k8svet wrote: post #16

I swear there must be one person at Mozilla with power and a massive sunk cost complex surrounding their pocket acquisition. if they actually cared, it wouldn't be built-in and so offensively un-disableable.

Yeah pocket is such a useless tool.

I love a lot of their stuff like the containers and local translation but pocket is just spam.

Re: Firefox built-in spyware that cannot be disabled

#37

Post by wkat4242 »

josephcsible wrote: post #27
andreareina wrote: post #19

Earlier quoted context omitted.

How does an application-specific configuration in firefox do anything about other devices on your network?

I think "disable DoH" there means "block all DoH servers at the router", not "configure Firefox to not try to use DoH".

Blocking DoH at the router is almost impossible because it looks exactly the same as other HTTPS traffic.

The only option is to do a man in the middle like some business firewalls (eg zscaler) do.

I don't like DoH much either because apps can use it to bypass my local pihole. But blocking it is hard when an app hardcodes its own DoH server.

DoH is really a solution for a US problem that we in Europe don't have. Here it's illegal for ISPs to use deep packet inspection to datamine their customers.

Re: Firefox built-in spyware that cannot be disabled

#38

Post by wkat4242 »

rasz wrote: post #17

Mozilla CEO needs this for that sweet Google payout. This is how you prove to advertisers number of active installs.

Hmm I wonder if it's possible to generate fake callbacks to this to mess up the data >:-] A bit like ad nauseam that tries to mess up advertisers' by taking a click on each ad without actually showing it to the user.

Re: Firefox built-in spyware that cannot be disabled

#39

Post by mkeedlinger »

thrwwycbr wrote: post #30
ilikenwf wrote: post #23

Earlier quoted context omitted.

You are incorrect. Please take a look at the default preferences that they ship, as they are a large and important part of it. Literally on the front page: https://librewolf.net You're here to astroturf for Mozilla or Google, aren't you?

The settings is literally what OP changed, and mentioned that the _source code which needs patches_ contains the URLs, which is correct. You can verify that easily by grepping the codebase. As LibreWolf doesn't patch these hardcoded URLs out, their marketing is wrong and a fraudulous statement. They don't remove these features and they are also not stubbing out the APIs (e.g. like TOR's patchset does). I'm not here t…

This is a patch file from the repo that you listed. Does it not remove the problematic hard-coded URLs?

https://codeberg.org/librewolf/source/src/branch/main/patche...

Re: Firefox built-in spyware that cannot be disabled

#40

Post by thesnide »

Bender wrote: post #15
josephcsible wrote: post #9

Earlier quoted context omitted.

> I also disable DoH Why? DoH is good for privacy.

If I do not disable it then I can not block nefarious domains for all devices on my network and I can not monitor what devices are doing DNS lookups. I do not agree that it is good for privacy. Maybe one day if ESNI is implemented everywhere then there may be some truth in the idea, but that also assumes that we are not just moving the resolver from the local ISP to the big centralized platforms like Cloudflare or Go…

One can still use a local dnsmasq and https_dns_proxy to leverage pure DNS on ones LAN but have the ISP only see DoH
Post reply on HN