| |||||||||||||
where does it says that?where does it says that?Posted Aug 12, 2009 0:33 UTC (Wed) by coriordan (guest, #7544)In reply to: where does it says that? by dlang Parent article: Ubuntu removes "multisearch" Yes, that's all fine. The important point is that privacy features would be good for users, but Mozilla doesn't include them and uses it's trademark licence to discourage distros from adding them. Mozilla does what Google wants, not what the Firefox users want. That's bad.
(Log in to post comments)
where does it says that? Posted Aug 12, 2009 0:52 UTC (Wed) by dlang (✭ supporter ✭, #313) [Link]
by the way, you need to point out that the 'privacy features' that you are advocating break some applications.
so they shouldn't be blindly applied to all sites.
at this point you are appointing someone else to select which sites you are going to be able to work with.
just like with the anti-spam blackhole lists, this can be a good thing or a bad thing depending on how closely your definition of a problem site matches the definition of the people managing the list.
remember that for all that you are complaining about them not including 'privacy' features, they do include the ability to block cookies from specific servers, or only accept them for the current session. they even give you the ability to do this choice every single time a cookie is supplied.
nobody takes it to this extreme (I'm one of the more extreme cases, but even I have many sites that I just say "allow and don't ask me" for because it is too painful to look at every cookie.)
exactly what 'privacy features' that are not blacklists of sites do you believe need to be added to firefox that google is blocking?
Mozilla, Google and privacy Posted Aug 13, 2009 22:57 UTC (Thu) by Tobu (subscriber, #24111) [Link] If Mozilla cared about privacy, they would implement a same-origin policy strong enough to block tracking by advertisers. Google is the biggest advertiser on the web, with 70% of the market since acquiring DoubleClick; and Mozilla gets almost all of its revenue from Google. In particular:
Mozilla, Google and privacy Posted Aug 13, 2009 23:28 UTC (Thu) by dlang (✭ supporter ✭, #313) [Link]
umm, as far as I know firefox only allows cookies to be set for the domain the object was fetched from.
now if you have a page fetched from one server that contains a link to an image (or other object) on another server, that other server can set a cookie that it will get the next time it is accessed.
this is what companies like doubleclick use to track you as you go to different sites, but there are also many legitimate reasons for this to happen, if you blocked all links that pointed at a server other than the one you pulled the initial page from you would break the web.
if you are referring to something else when you say 'third party cookies' please help me understand.
as far as history retrieval from css goes, the only way to block that is to disable the ability of css to do different things for links that you have visited vs ones that you have not. while doing this is a useful option to have, It's pretty valuable to be able to tell which links on a page you ahve clicked on recently, so I can see why they wouldn't want to disable that globally.
referrer data also has legitimate uses (although I don't have as solid a reason for it off the cuff, and probably not one that you would consider acceptable), and if you want to eliminate it I don't see why you would allow it for embedded content
while I agree that the two actions that you mention harm privacy, they are also features that many people want to have. so you are saying that these features should not exist, which leaves people vulnerable to phishing attacks. I don't see that as a winning approach
as for the multiple pop-ups, you do have the option to tell firefox "don't ask me again for this server". this doesn't mean that there are no problems. the fact that firefox will happily open up hundreds of duplicate pop-ups is a problem (this is problem for authentication pop-ups as well as cookie pop-ups), but I see this as a separate problem (one I would like to see them fix.
Mozilla, Google and privacy Posted Aug 14, 2009 11:43 UTC (Fri) by Tobu (subscriber, #24111) [Link] Cookies are set for the domain content was fetched from, but included content makes the distinction irrelevant. This is indeed what I meant by third-party cookies: cookies set by third-party content. I don't suggest breaking the web by refusing third-party content. Just that a cookie set on domain D via inclusion on domain A should not be the same as a cookie set on domain D via inclusion on domain B. As far as cookies are concerned, this should be enough to restore privacy.
Mozilla, Google and privacy Posted Aug 15, 2009 3:12 UTC (Sat) by dlang (✭ supporter ✭, #313) [Link]
if you refuse to allow cookies for third-party content, you run the very real risk of breaking that third-party content if it needs cookies for it's functionality.
your suggestion to add a referrer-type tag to the cookie store is interesting and I think it would be a very good thing for someone to try implementing.
however it will break some legitimate uses as well as the people you are trying to break. you won't see this breakage on most small sites, but on large sites that spread functionality across multiple URLs you make it will break portions of the site that are common.
Mozilla, Google and privacy Posted Aug 15, 2009 20:17 UTC (Sat) by Tobu (subscriber, #24111) [Link] The sites I could see being broken by this are domains that maintain user sessions across tlds, like google.tld and lastfm.tld . They could use redirects to transfer the session between the .com domain and the country domain. Most sites that run analytics or ads via just a script tag wouldn't bother.
Mozilla, Google and privacy Posted Aug 15, 2009 3:17 UTC (Sat) by foom (subscriber, #14868) [Link] > that other server can set a cookie that it will get the next time it is accessedIn Safari it can't. From the preferences...
Accept Cookies:
Mozilla, Google and privacy Posted Aug 15, 2009 3:21 UTC (Sat) by dlang (✭ supporter ✭, #313) [Link]
interesting to know that this is an option.
I assume that this isn't the default (that it defaults to yes)
any idea how many sites get broken by this option?
Mozilla, Google and privacy Posted Aug 15, 2009 3:36 UTC (Sat) by foom (subscriber, #14868) [Link] It is the default. I don't know if any sites get broken by it, but I certainly haven't noticed any. Not that I would have even thought to try changing that option if I did run across a broken site, so who knows.Quite a few are broken by me disabling Flash's data storage, though.
Mozilla, Google and privacy Posted Aug 15, 2009 19:30 UTC (Sat) by njs (guest, #40338) [Link]
Firefox also has this option (though AFAICT not on by default): uncheck Edit > Preferences > Privacy > Accept third party cookies.
Mozilla, Google and privacy Posted Aug 15, 2009 20:01 UTC (Sat) by Tobu (subscriber, #24111) [Link] Yeah, but it is ineffective. I have this option in Chromium and Firefox. All it does is check that the cookie setter (RFC 2965, the dom, maybe equivalents in html5 dom storageĀ ) requests a domain compatible with the current domain. Content included from another domain works around it, and here both Firefox and Chromium have a myriad of cookies from adservers (these aren't leftovers, they get removed at the end of a session through another firefox setting). The problem is that the effective way to prevent this (namespace cookies with the referer domain in addition to the cookie domain) hasn't been implemented, and these settings are just a distraction. I haven't tried Safari, but at least for the browsers I use, exposing them as "block third party/tracker/adserver cookies" is misleading. Maybe there is a reason fixing this is not that simple, but I suspect the reason is a big conflict of interest.
where does it says that? Posted Aug 12, 2009 8:05 UTC (Wed) by Los__D (guest, #15263) [Link]
AFAIK, installing a plugin by default doesn't require a name change, only changes in the main application.
That plugin could easily contain the privacy features you want/need.
where does it says that? Posted Aug 12, 2009 8:32 UTC (Wed) by coriordan (guest, #7544) [Link] Nope. Permission is needed: If you want to ship extensions, themes or plugins installed by default or as part of the same installation process as the Mozilla products (as opposed to, say, linked as XPIs from the default start page), and you plan on distributing them under any Mozilla trademarks, you must therefore first seek approval from Mozilla.
where does it says that? Posted Aug 12, 2009 8:51 UTC (Wed) by dlang (✭ supporter ✭, #313) [Link]
you are accusing mozilla of having refused permission to ship adblock (or some other 'privacy' plugins) because google tole them to.
what distro asked permission to do this and was refused?
or are you just assuming that mozilla would refuse permission for any plugin that claimed to increase privacy?
where does it says that? Posted Aug 12, 2009 11:23 UTC (Wed) by coriordan (guest, #7544) [Link] customize-google is a better example of a privacy plugin than adblock. It also can block Google ads, but the cookie privacy protection is the most important feature. Let's look at the facts:
I found this 2007 article interesting: A dangerous conflict of interest between Firefox and Google. No, I don't have a link to a communication from Mozilla saying they'd block customize-google. I haven't really looked. I hope I stumble upon something like that some day. Until then, everything indicates that Google is Mozilla's boss and privacy features are not allowed. I don't see Mozilla denying any of these accusations either.
where does it says that? Posted Aug 12, 2009 14:01 UTC (Wed) by AndreE (subscriber, #60148) [Link]
RE the article
- from the comments, it seems that a number of Mozilla developers privately contacted the author and voiced some disagreements.
-In the comments, the developer of AdBlock Plus states that he was asked my MoCo to spec out integration but declined due to his time constraints
-The XSS thing he points to is very melodramatic. He didn't even bother to correctly summarise the issue. He adds his own hyperbole to the hyperbole of the very biased reporter.
-there is an excellent comment about the inclusion of customize-google. Having a site specific extension that needs continual monitoring to verify its functionality added to the default build really doesn't make any sense at all.
Seriously, that article is just terrible.
There are some legitimate concerns about MoCo and Google, but to be so badly informed and push hype and fact ... oh wait I guess that IS modern journalism.
where does it says that? Posted Aug 13, 2009 15:50 UTC (Thu) by coriordan (guest, #7544) [Link]
Thanks for the analysis. The comment from the AdBlock author is interesting and I hadn't seen it.
I still think Mozilla's lack of efforts to improve online privacy is disappointing (and their financial dependence on Google is the only realistic explanation), and that they go too far in using their trademark to prevent others from integrating privacy features.
exactly what privacy features do you want? Posted Aug 13, 2009 15:57 UTC (Thu) by dlang (✭ supporter ✭, #313) [Link]
you complain that mozilla/firefox are not doing enough to protect privacy.
exactly what is it that you want to see happen?
and please don't respond 'ship privacy modules by default', state what you want the privacy modules to do.
In my opinion, 'protecting privacy' is like 'blocking spam', everyone agrees that it's a good idea, but when you get down to the nitty-gritty of exactly what to do people can't agree on what is a reasonable trade-off between protection and false-positives breaking something that you want to work.
exactly what privacy features do you want? Posted Aug 13, 2009 17:57 UTC (Thu) by coriordan (guest, #7544) [Link] > exactly what is it that you want to see happen? Despite Mozilla's massive amount of funding, large developer team, and proven ability to innovate, I suspect you're going to reject any suggestion I offer that would require them to invest more than one programmer-day of work. So I'll start dead simple: How about blocking cookies that are known to be of no use to the user? Even just one. Pick one single cookie that tracks users and provides no benefit, and block it. This would be better than nothing, but they don't do it. By putting in more than one programmer-day of effort, this could be well done. Maybe maintain a very conservative list of bad cookies (I think there's already a similar feature about a list of phishing sites to avoid, so maybe this idea could be implemented similarly), and block them. Maybe block DoubleClick's cookie? When I search mozdev for "privacy", I get 215 hits. Most aren't about online privacy, but there must be some ideas in there that aren't too hard to implement or adapt.
exactly what privacy features do you want? Posted Aug 13, 2009 18:16 UTC (Thu) by dlang (✭ supporter ✭, #313) [Link]
I actually don't care how much effort it is to implement something, if that something can be fully agreed to.
however, your example is exactly what I feared it would be.
you want someone to appoint themselves the arbitrators of what cookies should be allowed and what ones should be blocked (either by name or by server)
I have _no_ objection to people creating such lists and allowing users to opt to use such lists.
however I have a very strong objection to building such blacklists into the application by default.
the history of blacklisting should prove this. if blacklists were so obviously good and infallible they would be built into every mail server and every mail client. they aren't (although support for them is common in mail servers), precisely because different people have different opinions on what should be blocked.
firefox already _has_ extensive privacy features, they just aren't configured the way that you want to force everyone to have them configured out of the box.
firefox has per-domain controls over cookies (to deny cookies from that domain), all that someone would have to do is to pre-populate that file, no mozilla programming time needed.
as for the 215 hits on "privacy", I don't care how many ideas there are, or how hard to implement. what I want to know is if they are something that _nobody_ objects to (not just none of the privacy advocates object to)
where does it says that? Posted Aug 13, 2009 4:08 UTC (Thu) by rqosa (subscriber, #24136) [Link] It's easy for distributors to not use the trademarks on Mozilla programs -- just build them with the "branding switch" off. This is what Arch Linux already does. Debian also uses their custom branding on Mozilla programs.(Incidentally, is there some reason why Debian uses their custom Iceweasel/Icedove/etc. branding instead of just building with the branding switch off?)
where does it says that? Posted Aug 13, 2009 18:20 UTC (Thu) by coriordan (guest, #7544) [Link]
The technical steps are indeed trivial, but the user confusion cost is high.
When using the trademark, you can't make changes without Mozilla's permission - i.e. you can't apply security patches. Despite this, distros such as Ubuntu have accepted the trademark restrictions, so they've obviously estimated very highly the user overall cost of removing the trademark.
I don't know the whole Debian story but I think it's that they switched to their branding before the "unbrand" feature was added to the Firefox compile process. You might find the answer on http://en.wikipedia.org/wiki/Mozilla_Corporation_software...
where does it says that? Posted Aug 13, 2009 23:40 UTC (Thu) by rqosa (subscriber, #24136) [Link] > the user confusion cost is highI don't agree with that. It's obvious that a rebranded Firefox is really Firefox. > When using the trademark, you can't make changes without Mozilla's permission - i.e. you can't apply security patches. Which is yet another reason why distributors should not use the official branding.
where does it says that? Posted Aug 14, 2009 20:56 UTC (Fri) by coriordan (guest, #7544) [Link] I wish you were right about changing the name not being a big deal, but if you were right, why did Ubuntu agree to those extremely restrictive terms?
|
|||||||||||||