This is a follow-up post on the sad state of Mozilla

[dazo@infosec.exchange]

This is a follow-up post on the sad state of Mozilla

First, notice the date of the commit identified (as highlighted in a few posts below that toot referenced above).

Secondly, Mozilla has done further changes to their Privacy policy since this initial change. I am not fully convinced about them - since the Privacy FAQ at the same time is not aligned. The reason for my continued mistrust to Mozilla is that they have gradually, over many years, moved in a direction I do find privacy unfriendly. And they have ties/agreements/contracts/partnerships to companies who does not have a good track record on privacy topics. I generally trust people and organisations actions more than their words of what they want to do.

Thirdly, it should be fairly clear to most that AI/LLM is not preserving privacy well when data is sent to a remote server to be processed there. And even running parts of the LLM engines locally does not fully disentangle the privacy aspects fully - data is still being exchanged with a remote server (otherwise there would not need to be "AI service provider URLs" in about:cofig). Mozilla did force AI/LLM unto users, enabled by default with the only way to disable that in the beginning via about:config. And it took several releases before more user friendly approaches to disable it arrived. Due to this delay, I really wonder "does these new knobs really fully disable AI/LLM?". I have that doubt, because of how Mozilla has behaved over many years.

On top of this, the Mozilla leadership is extremely well paid while they have reduced their engineering teams working on Firefox and other products. That is a too strong indication for me to ignore, that profit and leadership compensation seem to be way more important than the core mission of making Internet a better place.

I have little trust in Mozilla for the time being. And I doubt I'm alone, due to the traction this toot thread triggered. Currently, I believe trust can be built up again. But it will take a lot of efforts now to repair what has been broken. For that to improve for me, I will need to see a lot of actions from Mozilla, where they clearly does changes in the whole organisation and communicates them clearly and that the communication is aligned across all aspects - including policy documents, FAQs, source code. Until that happens, I will use some of the Firefox forks. And leadership compensation need to be completely transparent and come down to a level which is not in an astronomic level comparable to large for-profit enterprise companies who generally cares little for anything than their own egoistic wealth.

If a person taking a leadership role in an organisation claiming working for a better Internet and fighting for its users is getting uninteresting unless there is a million dollar yearly compensation when the people doing the grunt work, delivering code resulting in a real product, has a 5th or 10th of that compensation, then I do question the values this person holds. And I will especially highly question the leadership when they need to reduce cost and choses to cut among the engineers doing the grunt work while the leadership not considering their own compensation.

So basically, I find the Mozilla organisation fairly rotten currently. It preaches the nice words but ends up doing something completely different.

#mozilla #firefox #privacy #foss #opensource

[rq@river.group.lt]

@dazo, I second this entirely.
Except I'm not even sure there is a way for Mozilla to redeem itself anymore.

[dazo@infosec.exchange]

@rq Yeah.

What might convince me is when Mozilla begins to "walk the talk", admit their wrong moves and wrong doings - and that those bad moves gets real consequences in how Mozilla is organised and managed. Full transparency is definitely needed.

[asgardius@social.asgardius.company]

@dazo This is the reason why i use librewolf instead

[mcslibinas@mastodon.social]

@dazo i looked into about:config for "provider" and found https://safebrowsing.googleapis.com/v4/…
Is that mean that all my browsing pages are sent to google live?! 👀

[dazo@infosec.exchange]

@mcSlibinas I believe this is related to this feature: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_how-does-phishing-and-malware-protection-work-in-firefox

The main about:config setting is here:
https://kb.mozillazine.org/Browser.safebrowsing.remoteLookups

Where the URL you found is related to these entries: https://kb.mozillazine.org/Browser.safebrowsing.provider.*

[mcslibinas@mastodon.social]

@dazo it's just tracking. Thank you!

[dazo@infosec.exchange]

@mcSlibinas This is LibreWolfs reasoning for disabling it by default: https://librewolf.net/docs/faq/#why-do-you-disable-google-safe-browsing

[ohir@social.vivaldi.net]

@dazo I concur. Except I personally am sure that Mozilla Fundation can not be saved. There is no precedent, not even in sci-fi, where a greedy clique focused on personal profit rescinds. The way forward is to build a real independent financing vehicle for the FF fork to survive.

[mcslibinas@mastodon.social]

@dazo thank you! 🍻

[raymaccarthy@mastodon.ie]

@dazo @rq
There is too much Google stuff and tracking by default.

I'd also rather not have the Browser do its own DNS, but have it use whatever my system / router is setup. That's a wrong privacy lacking default too.

I have Qwant as search and a search box, no search in URL box. That's a stupid idea copied from Google?

[dazo@infosec.exchange]

@ohir I do fear you are right.

Right now it's quite some muddy waters, where several forks appearing. And some have even disappeared. These muddy waters need to calm down at some point.

For a fork to be sustainable, it need to have enough contributors and users. Contributors need to cover development, needed infrastructure, support and (what you mention) finances to keep things rolling.

I don't think it's sustainable that we have so many forks appearing these days. The strongest ones of them should unite and setup a non-profit organisation, which others could join as well. Perhaps using a similar model as Codeberg.

With such a joint effort, the marketing towards end users can be much more uniform and targetted, which would be easier for users to relate to. Just as Firefox managed to take over the position of Netscape (even though Firefox was spun out of Netscape, so not directly comparable).

I would truly encourage @librewolf, @zenbrowser, @Waterfox, @konform and other forks to get together and look at the possibilities to collaborate on a broader scale. I don't say they should abandon their own "uniqueness", but that they can find a way to help contribute to a more healthy and sustainable environment for important forks to actually survive and be sustainable. Have something "shared" at the core across all forks, where they can build their own uniqueness from. Have a shared vision and mission statement, have a united front for a privacy respecting browser family.