full-disclosure - Re: Bug 718066 - [meta] Add feature to submit anonymous product metrics to Mozilla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 10 Feb 2012 03:51:53 +0000
From: Nick Boyce <nick.boyce@...il.com>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Bug 718066 - [meta] Add feature to submit
 anonymous product metrics to Mozilla

On Wed, Feb 8, 2012 at 9:12 PM, . . <kerdezdmeg@...il.com> wrote:
>
> https://bugzilla.mozilla.org/show_bug.cgi?id=718066
>
> what the hell is this?!

I'll bite ...  (I know your question was rhetorical)

It's a very bad idea IMO.

>>From TFA:
(https://wiki.mozilla.org/MetricsDataPing)

  "Mozilla has a critical need to be able to understand
  the factors that cause installations of Firefox to no
  longer be used. The system must have some way to
  detect an abandoned installation."

Their proposed solution seems to be (from the bug and wiki) to include
code in Firefox to submit a lot of information to mozilla.org, on a
regular basis, about the individual FF installation ... date
installed, list of add-ons installed, with date each add-on installed,
date FF last used, OS type, FF version, whether up to date when last
used, etc.

Far too much information for comfort - sufficient to _enable_
fingerprinting and tracking of individual FF installation use (e.g.
"is this browser installation using Tor the same as that other browser
not using Tor ?"), even if that is not the _intention_.  Contravention
of EU data protection laws seems probable, or at least German laws.

OT: They should just make FF quality high and the design impeccable -
that's all they need do to win our hearts and minds (many other FLOSS
projects exist to attest to that).  The engineers know what's needed,
and the users have spoken out endlessly on the forums - metrics are
for managers.

Sigh.

Nick
-- 
public void Ballmer(Developers developers) throws Chair

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/