5 ms·

addons.mozilla.org also contains Google Analytics. And since addons are not allowed to act on addons.mozilla.org, you have no choice but to ping Google every ti

by zsrxx 7y ago

addons.mozilla.org also contains Google Analytics. And since addons are not allowed to act on addons.mozilla.org, you have no choice but to ping Google every time you load a page there. Mozilla is either stupid or ill-intentioned. It's 2019 so they've lost the benefit of the doubt for me.

jddj 7y ago
There is in fact a third option, which happens to be their stated position. Part of their (written) agreement with Google is that none of the analytics data generated from Mozilla properties will contribute towards Google's tracking database. "Mozilla has a legal contract with Google that prevents them from using our Google Analytics data for mining or from sharing it with third parties, among other privacy-protecting provisions." "Mozilla went through a year long legal discussion with GA before we would ever implement it on our websites. GA had to provide how and what they stored and we would only sign a contract with them if they allowed Mozilla to opt-out of Google using the data for mining and 3rd parties." https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14 https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14
- cameronbrown 7y ago
  Not only that, but Mozilla's Google opt-out is available to all GA customers, which is great for everyone.
  - lonelappde 7y ago
    It's not any good for users who don't have the choice to opt out.
    - cameronbrown 7y ago
      If you personally want to opt out then use a content blocker? There's also an official way to completely opt out of GA, but this basically does the same thing. Privacy isn't a zero sum game, there can be improvements.
- intea 7y ago
  Thanks for bringing that up. Im wondering why they went through all that trouble though. Are there no alternatives to GA?
  - jddj 7y ago
    According to the issues trackers, various forms of "self-hosting would be more work for a lesser product". I'm not sure that would still be the case if the decision were being made today, and would quietly hope not, but I guess we can charitably say that the reason now is "inertia". Personally, I think they may have underestimated (or failed to fully predict) the anti-google, pro-privacy sentiment in the wings, and it's clear even from this thread and the issues on bugzilla that it's probably cost them enough privacy-capital at this stage to have justified the extra work required to self-host. But hindsight is 20-20. There are sunk costs now which also must play into the decisions.
    - swebs 7y ago
      Or just don't load any "analytics" scripts at all. Do you really need to know the aggregate mouse positions of every user on your addon page?
      - jddj 7y ago
        Definitely not, but I can see how it might be useful to know aggregates of the Firefox version and locale information for people visiting that particular page.
        buildzr 7y ago
        Sure, but you can do that with just your web server log.
    - lonelappde 7y ago
      > self-hosting would be more work for a lesser product". The same argument applies to the whole of Firefox. It's more work and it's a lesser product. If Firefox can be a better product, than Mozilla Analytics could be too. At this point it's clear that Mozilla is a business (with well paid management and staff) like Google that is using Privacy as a promo like Google used Don't Be Evil. Mozilla might be better in practice today, but it's not on a principled foundation. It looks like a Google Lite - Firefox vs Chrome, Rust vs Go, etc.
- BurnGpuBurn 7y ago
  Great if you trust Google, not so much if you don't. Too bad Mozilla made that choice for us, and imho, the wrong one. Google has proved itself time and time again that they cannot be trusted with privacy. "Mozilla went through a year long legal discussion with GA." I wonder why. Implementing some basic analytics on a few pages shouldn't be that hard.
  - rhaps0dy 7y ago
    It is pretty unlikely that a company (Google) would break a contract with another relatively large organisation (Mozilla). Yes, Google vacuum up all your data and do shady stuff with it, but only because all of it is legal. Plus, the amount of data that they get from Mozilla must be tiny compared to the amount of data that they collect through their search engine: it's only data on mozilla.org, not data of everyone that uses the browser at all times. It is not wise to risk a lawsuit over it. > I wonder why. Implementing some basic analytics on a few pages shouldn't be that hard. Maybe defining a contract to prevent use of Mozilla data without loopholes is harder.
    - pbhjpbhj 7y ago
      It will be "anonymised" I imagine, enough to give Google all they want and still let Mozilla get paid and _say_ they don't give up user data. There's surely no way to tell what they do with the data at the other end? It's Google and their serf, Mozilla, I can't imagine it's wholesome.
      - shkkmo 7y ago
        > It will be "anonymised" I imagine, enough to give Google all they want and still let Mozilla get paid Do you have you any basis for this assertion?
        pbhjpbhj 7y ago
        For the assertion of my assumption? The post itself is evidence of it.
- Hitton 7y ago
  Thank God that Google is such trustworthy company on which we can depend with all our data and personal information. The company that would never deal with likes of China. The company which would never expose data of Google+ customers. The company which is always transparent with its policies and usage of user provided data.
  - oblio 7y ago
    > The company that would never deal with likes of China. This is disingenuous. They basically locked themselves out of China voluntarily many years ago. They're really scary otherwise and I agree with you, but don't lessen your point by including exaggerations, in my opinion.
    - carapace 7y ago
      Expletive deleted. Project Dragonfly. https://en.wikipedia.org/wiki/Dragonfly_(search_engine) https://en.wikipedia.org/wiki/Dragonfly_(search_engine)
- TheSpiceIsLife 7y ago
  > legal contract with Google that prevents them This misrepresents the ability of a contract. No law can prevent a thing, no written agreement can prevent cheating. Law can only set out that such cheating might be illegal in the sense that it can be argued in court that penalties should apply.
  - jddj 7y ago
    I do see the point that you are making, and clearly prevents is not absolutely true, but the beauty of open companies like Mozilla is that this information is available at all. In an issue tracker no less. We can be a little more charitable in not demanding legalese from someone who was casually paraphrasing somebody else, given the context (a bug report).
    - pbhjpbhj 7y ago
      Mozilla is open? Which manager signed off on the Pocket implementation? Where are the minutes for the meetings in which that was agreed? Mozilla make open source, they're not open like a publicly accountable body, are they?
      - jddj 7y ago
        Sorry, ironically I didn't mean to imply openness in any legal sense (although the foundation itself is publicly accountable in terms of what they spend their money on). Open companies was probably a bad term to use because it might imply something beyond most/all(?) of their products being developed in the open, but I think the point stands well enough regardless. I won't edit now, but please read my original "open" as "open source".
  - criley2 7y ago
    >No law can prevent a thing, no written agreement can prevent cheating. Law can only set out that such cheating might be illegal in the sense that it can be argued in court that penalties should apply. This is asinine stuff. Contract law is one of the oldest parts of the legal system and contracts are protected. Violating contract terms leads to a discussion of damages. It's not about illegal contracts, it's about liability and damages.
- luckylion 7y ago
  Which requires the user to trust Google to a) honor that agreement (somewhat simple, though we don't know the actual terms, i.e. what's on the line for Google) and b) not have bugs in their systems that accidentally leak information (to their own profiling services or third parties), and if they trust them on this, why not trust them in general when it comes to "we won't use your information for anything nefarious". Anti-Ad/Tracking-Plugins being among the most popular suggests that a lot of Mozilla's users don't want to rely on trust. My bank argues the same way and uses Google Analytics to track their visitors, including inside the online banking system. Fine, so they trust Google to honor agreements and not connect profiles, but I'd still prefer Google to simply not know when and how often I'm logging in to check my account balance. It's good that Mozilla goes the extra mile to get a custom contract, but I believe that most people aren't expecting a self-proclaimed privacy champion to use an anti-privacy-service by one of the largest corporate enemies of privacy. Explicit opt-in would be the right thing to do here.
- ekianjo 7y ago
  > Part of their (written) agreement with Google is that none of the analytics data generated from Mozilla properties will contribute towards Google's tracking database. Do they really think people are that naive?
- lonelappde 7y ago
  What's the point? Why does Mozilla exist? If Google is good enough mozilla.org should redirect to google.com/chrome. If Google is not going enough, Mozilla shouldn't use Google for analytics on the add-ons page when there are plenty of other options and an opportunity to do something valuable by building a site-private analytics product as part of their core mission of protecting the web.
peterwwillis 7y ago
According to Hanlon's razor, the second choice is redundant.

by zsrxx 7y ago

jddj 7y ago

There is in fact a third option, which happens to be their stated position. Part of their (written) agreement with Google is that none of the analytics data generated from Mozilla properties will contribute towards Google's tracking database. "Mozilla has a legal contract with Google that prevents them from using our Google Analytics data for mining or from sharing it with third parties, among other privacy-protecting provisions." "Mozilla went through a year long legal discussion with GA before we would ever implement it on our websites. GA had to provide how and what they stored and we would only sign a contract with them if they allowed Mozilla to opt-out of Google using the data for mining and 3rd parties." https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14 https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14

cameronbrown 7y ago
Not only that, but Mozilla's Google opt-out is available to all GA customers, which is great for everyone.
- lonelappde 7y ago
  It's not any good for users who don't have the choice to opt out.
  - cameronbrown 7y ago
    If you personally want to opt out then use a content blocker? There's also an official way to completely opt out of GA, but this basically does the same thing. Privacy isn't a zero sum game, there can be improvements.
intea 7y ago
Thanks for bringing that up. Im wondering why they went through all that trouble though. Are there no alternatives to GA?
- jddj 7y ago
  According to the issues trackers, various forms of "self-hosting would be more work for a lesser product". I'm not sure that would still be the case if the decision were being made today, and would quietly hope not, but I guess we can charitably say that the reason now is "inertia". Personally, I think they may have underestimated (or failed to fully predict) the anti-google, pro-privacy sentiment in the wings, and it's clear even from this thread and the issues on bugzilla that it's probably cost them enough privacy-capital at this stage to have justified the extra work required to self-host. But hindsight is 20-20. There are sunk costs now which also must play into the decisions.
  - swebs 7y ago
    Or just don't load any "analytics" scripts at all. Do you really need to know the aggregate mouse positions of every user on your addon page?
    - jddj 7y ago
      Definitely not, but I can see how it might be useful to know aggregates of the Firefox version and locale information for people visiting that particular page.
      - buildzr 7y ago
        Sure, but you can do that with just your web server log.
  - lonelappde 7y ago
    > self-hosting would be more work for a lesser product". The same argument applies to the whole of Firefox. It's more work and it's a lesser product. If Firefox can be a better product, than Mozilla Analytics could be too. At this point it's clear that Mozilla is a business (with well paid management and staff) like Google that is using Privacy as a promo like Google used Don't Be Evil. Mozilla might be better in practice today, but it's not on a principled foundation. It looks like a Google Lite - Firefox vs Chrome, Rust vs Go, etc.
BurnGpuBurn 7y ago
Great if you trust Google, not so much if you don't. Too bad Mozilla made that choice for us, and imho, the wrong one. Google has proved itself time and time again that they cannot be trusted with privacy. "Mozilla went through a year long legal discussion with GA." I wonder why. Implementing some basic analytics on a few pages shouldn't be that hard.
- rhaps0dy 7y ago
  It is pretty unlikely that a company (Google) would break a contract with another relatively large organisation (Mozilla). Yes, Google vacuum up all your data and do shady stuff with it, but only because all of it is legal. Plus, the amount of data that they get from Mozilla must be tiny compared to the amount of data that they collect through their search engine: it's only data on mozilla.org, not data of everyone that uses the browser at all times. It is not wise to risk a lawsuit over it. > I wonder why. Implementing some basic analytics on a few pages shouldn't be that hard. Maybe defining a contract to prevent use of Mozilla data without loopholes is harder.
  - pbhjpbhj 7y ago
    It will be "anonymised" I imagine, enough to give Google all they want and still let Mozilla get paid and _say_ they don't give up user data. There's surely no way to tell what they do with the data at the other end? It's Google and their serf, Mozilla, I can't imagine it's wholesome.
    - shkkmo 7y ago
      > It will be "anonymised" I imagine, enough to give Google all they want and still let Mozilla get paid Do you have you any basis for this assertion?
      - pbhjpbhj 7y ago
        For the assertion of my assumption? The post itself is evidence of it.
Hitton 7y ago
Thank God that Google is such trustworthy company on which we can depend with all our data and personal information. The company that would never deal with likes of China. The company which would never expose data of Google+ customers. The company which is always transparent with its policies and usage of user provided data.
- oblio 7y ago
  > The company that would never deal with likes of China. This is disingenuous. They basically locked themselves out of China voluntarily many years ago. They're really scary otherwise and I agree with you, but don't lessen your point by including exaggerations, in my opinion.
  - carapace 7y ago
    Expletive deleted. Project Dragonfly. https://en.wikipedia.org/wiki/Dragonfly_(search_engine) https://en.wikipedia.org/wiki/Dragonfly_(search_engine)
TheSpiceIsLife 7y ago
> legal contract with Google that prevents them This misrepresents the ability of a contract. No law can prevent a thing, no written agreement can prevent cheating. Law can only set out that such cheating might be illegal in the sense that it can be argued in court that penalties should apply.
- jddj 7y ago
  I do see the point that you are making, and clearly prevents is not absolutely true, but the beauty of open companies like Mozilla is that this information is available at all. In an issue tracker no less. We can be a little more charitable in not demanding legalese from someone who was casually paraphrasing somebody else, given the context (a bug report).
  - pbhjpbhj 7y ago
    Mozilla is open? Which manager signed off on the Pocket implementation? Where are the minutes for the meetings in which that was agreed? Mozilla make open source, they're not open like a publicly accountable body, are they?
    - jddj 7y ago
      Sorry, ironically I didn't mean to imply openness in any legal sense (although the foundation itself is publicly accountable in terms of what they spend their money on). Open companies was probably a bad term to use because it might imply something beyond most/all(?) of their products being developed in the open, but I think the point stands well enough regardless. I won't edit now, but please read my original "open" as "open source".
- criley2 7y ago
  >No law can prevent a thing, no written agreement can prevent cheating. Law can only set out that such cheating might be illegal in the sense that it can be argued in court that penalties should apply. This is asinine stuff. Contract law is one of the oldest parts of the legal system and contracts are protected. Violating contract terms leads to a discussion of damages. It's not about illegal contracts, it's about liability and damages.
luckylion 7y ago
Which requires the user to trust Google to a) honor that agreement (somewhat simple, though we don't know the actual terms, i.e. what's on the line for Google) and b) not have bugs in their systems that accidentally leak information (to their own profiling services or third parties), and if they trust them on this, why not trust them in general when it comes to "we won't use your information for anything nefarious". Anti-Ad/Tracking-Plugins being among the most popular suggests that a lot of Mozilla's users don't want to rely on trust. My bank argues the same way and uses Google Analytics to track their visitors, including inside the online banking system. Fine, so they trust Google to honor agreements and not connect profiles, but I'd still prefer Google to simply not know when and how often I'm logging in to check my account balance. It's good that Mozilla goes the extra mile to get a custom contract, but I believe that most people aren't expecting a self-proclaimed privacy champion to use an anti-privacy-service by one of the largest corporate enemies of privacy. Explicit opt-in would be the right thing to do here.
ekianjo 7y ago
> Part of their (written) agreement with Google is that none of the analytics data generated from Mozilla properties will contribute towards Google's tracking database. Do they really think people are that naive?
lonelappde 7y ago
What's the point? Why does Mozilla exist? If Google is good enough mozilla.org should redirect to google.com/chrome. If Google is not going enough, Mozilla shouldn't use Google for analytics on the add-ons page when there are plenty of other options and an opportunity to do something valuable by building a site-private analytics product as part of their core mission of protecting the web.

peterwwillis 7y ago

According to Hanlon's razor, the second choice is redundant.