gcp-ingestion VS browser

I don't know how many folks will see this, and of those that do I don't expect many will necessarily be moved by what I say here. I'm going to say it anyways, however, and then I may never look at this thread again. I'm the person who designed the download token scheme that is discussed in this article, and, while I understand all of the concerns and suspicions, I believe that the way we designed this and the way we handle our telemetry data means that this is not the privacy violation some of you are claiming it is. Also, to be clear, I am speaking for myself here, these are my own thoughts and opinions, and I am not representing Mozilla in any official capacity.

So, a download token is a UUID associated with a unique download event. It gets generated when you click the 'download' link, added to the installer, and then passed through to the installed browser. It is returned to us in the telemetry pings that the browser sends back to our telemetry ingestion endpoints. When the download happens, on the server side we capture the download token and the GA session ID and store those in a table. There is nothing else stored in this table.

Having access to this table means that you can correlate the user's activity on the Mozilla website that GA provides with the telemetry data that Firefox sends us. The website activity contains URLs that the user visited, so we consider this "category 3" data (see https://wiki.mozilla.org/Data_Collection#Data_Collection_Cat...), quite sensitive. For that reason this table has highly restricted access, only a small number of individuals are able to get to it.

Access restrictions offer no protection against subpoenas, of course. But I believe you can safely maintain your anonymity by opting out of our telemetry gathering, because when you opt out of telemetry we delete all of the historical telemetry data we have collected for your Firefox profile. Everything, including all of the records that contain the download token.

If this happens, all we are left with is that original record with the download token and a GA session. The download token can no longer be correlated with your telemetry data, and we have no way of associating your Firefox installation with your GA session, not even under subpoena. And this is all assuming that you haven't blocked GA, or that you haven't specified 'Do Not Track' before visiting our website. If you've done either of those things, we won't have a GA session ID for you to begin with.

Oh, incidentally, we never store any IP addresses or other PII in our telemetry data. That all gets scrubbed during ingestion.

Again, I don't expect this to have much impact, but I'm sharing what I know to counter some of the more extreme claims that this removes the ability for Firefox users to remain anonymous.

Finally, we have the obvious question: Why we would even do this? Believe it or not, understanding your user base does actually have some value in serving that user base. For most of Firefox's existence, there has been no trustable feedback loop. Sure, folks out there in the world have opinions, and share them, but opinions differ, and anecdotes are not data. If one person thinks most users will like a particular change, and someone else thinks they won't, nobody can prove their point in any meaningful way. The folks making decisions about Firefox have been flying blind. And, as many of you in this thread have pointed out, it hasn't necessarily been going that well.

In Firefox's early years, there was lots of low hanging fruit, and the competition was a poorly maintained Internet Explorer, so it was easy to win a bunch of market share. Then Chrome came on the scene with their effectively limitless budget and famously data driven product process. We'll never match their budget, but we can try to make choices based on data instead of just letting whoever has the most organizational power decide. My team has spent the last few years building out a data infrastructure that we hope will support better decision making going forward while still trying to honor user privacy and choice. This is a tough balance to strike, and we're far from perfect, but we do our best.

You can learn about or data collection infrastructure and policies in great detail on our docs site (https://docs.telemetry.mozilla.org/index.html), and you can see nearly all of the code that handles our data ingestion and processing in our public repositories (https://github.com/mozilla/gcp-ingestion and https://github.com/mozilla/bigquery-etl).

I used to work on Mozilla's data platform. That stuff is all open source. See e.g. https://github.com/mozilla/gcp-ingestion/ for the ingestion pipeline, https://github.com/mozilla/bigquery-etl for queries/ETL, and https://github.com/mozilla/looker-spoke-default/ for looker model definitions for that data.

Also go read the docs at https://docs.telemetry.mozilla.org/. Those will give you insights into every way they use data.

I've never seen a company that's more open about their data usage.

Here

emerge --infoPortage 3.0.45.3 (python 3.11.3-final-0, default/linux/amd64/17.1/no-multilib/hardened, gcc-12, glibc-2.36-r8, 6.1.22-gentoo-dist x86_64)=================================================================System uname: Linux-6.1.22-gentoo-dist-x86_64-AMD_Ryzen_7_7700X_8-Core_Processor-with-glibc2.36KiB Mem: 64950064 total, 50016344 freeKiB Swap: 0 total, 0 freeTimestamp of repository gentoo: Thu, 08 Jun 2023 16:00:01 +0000Head commit of repository gentoo: 542a08aa11a48d3724f90c64729ad80cd0e2bfa4Head commit of repository librewolf: d5cc5c9ec8f029c7f095a93a78baaba925e6838bTimestamp of repository zugaina: Tue, 19 Jul 2022 00:31:49 +0000Head commit of repository zugaina: d71b224f2cf0478022f7e13d54f1751cc7148c74sh bash 5.1_p16-r4ld GNU ld (Gentoo 2.39 p6) 2.39.0app-misc/pax-utils: 1.3.5::gentooapp-shells/bash: 5.1_p16-r4::gentoodev-lang/perl: 5.36.0-r2::gentoodev-lang/python: 3.11.3::gentoodev-lang/rust: 1.69.0-r1::gentoodev-util/cmake: 3.26.3::gentoodev-util/meson: 1.1.1::gentoosys-apps/baselayout: 2.13-r1::gentoosys-apps/openrc: 0.46::gentoosys-apps/sandbox: 2.29::gentoosys-devel/autoconf: 2.13-r7::gentoo, 2.71-r5::gentoosys-devel/automake: 1.16.5::gentoosys-devel/binutils: 2.39-r5::gentoosys-devel/binutils-config: 5.5::gentoosys-devel/clang: 15.0.7-r1::gentoosys-devel/gcc: 12.2.1_p20230428-r1::gentoosys-devel/gcc-config: 2.10::gentoosys-devel/libtool: 2.4.7-r1::gentoosys-devel/lld: 15.0.7::gentoosys-devel/llvm: 15.0.7::gentoosys-devel/make: 4.4.1-r1::gentoosys-kernel/linux-headers: 6.1::gentoo (virtual/os-headers)sys-libs/glibc: 2.36-r8::gentooRepositories:gentoo location: /var/db/repos/gentoo sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 volatile: False sync-rsync-verify-metamanifest: yes sync-rsync-verify-jobs: 1 sync-rsync-verify-max-age: 24 sync-rsync-extra-opts: librewolf location: /var/db/repos/librewolf sync-type: git sync-uri: https://gitlab.com/librewolf-community/browser/gentoo.git masters: gentoo volatile: Falsezugaina location: /var/db/repos/zugaina sync-type: git sync-uri: https://github.com/gentoo-mirror/zugaina.git masters: gentoo volatile: FalseACCEPT_KEYWORDS="amd64"ACCEPT_LICENSE="@FREE @BINARY-REDISTRIBUTABLE"CBUILD="x86_64-pc-linux-gnu"CFLAGS="-march=znver4 -O2 -pipe"CHOST="x86_64-pc-linux-gnu"CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt"CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"CXXFLAGS="-march=znver4 -O2 -pipe"DISTDIR="/var/cache/distfiles"EMERGE_DEFAULT_OPTS="-A --jobs=16 --load-average=16"ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GDK_PIXBUF_MODULE_FILE GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR XDG_STATE_HOME"FCFLAGS="-march=znver4 -O2 -pipe"FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs binpkg-multi-instance buildpkg-live candy config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch parallel-install pid-sandbox preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"FFLAGS="-march=znver4 -O2 -pipe"GENTOO_MIRRORS="ftp://ftp.ntua.gr/pub/linux/gentoo/ http://ftp.ntua.gr/pub/linux/gentoo/"LANG="el\_GR.UTF-8"LDFLAGS="-Wl,-O1 -Wl,--as-needed"LEX="flex"MAKEOPTS="-j16"PKGDIR="/var/cache/binpkgs"PORTAGE_CONFIGROOT="/"PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"PORTAGE_TMPDIR="/var/tmp"SHELL="/bin/bash"USE="X acl amd64 btrfs bzip2 cet cli crypt dbus dri elogind fortran gdbm gnome gtk hardened hwaccel iconv ipv6 libtirpc ncurses nls nptl openmp pam pcre pie readline seccomp split-usr ssl ssp test-rust unicode xattr xtpax zlib" ABI_X86="64" ADA_TARGET="gnat_2021" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2 aes avx avx2 avx512bw avx512cd avx512dq avx512f avx512vbmi avx512vl f16c fma3 pclmul popcnt rdrand sha sse3 sse4_1 sse4_2 sse4a ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="efi-64" INPUT_DEVICES="libinput" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-4 php8-0" POSTGRES_TARGETS="postgres12 postgres13" PYTHON_SINGLE_TARGET="python3_11" PYTHON_TARGETS="python3_11" RUBY_TARGETS="ruby30 ruby31" VIDEO_CARDS="amdgpu radeonsi" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq proto steal rawnat logmark ipmark dhcpmac delude chaos account"Unset: ADDR2LINE, AR, ARFLAGS, AS, ASFLAGS, CC, CCLD, CONFIG_SHELL, CPP, CPPFLAGS, CTARGET, CXX, CXXFILT, ELFEDIT, EXTRA_ECONF, F77FLAGS, FC, GCOV, GPROF, INSTALL_MASK, LC_ALL, LD, LFLAGS, LIBTOOL, LINGUAS, MAKE, MAKEFLAGS, NM, OBJCOPY, OBJDUMP, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, RANLIB, READELF, RUSTFLAGS, SIZE, STRINGS, STRIP, YACC, YFLAGS

LibreWolf Portable and the LibreWolf WinUpdater by @ltguillaume are now included optionally in the windows installer. If you have any problems or feedback please leave it here.

I'm not sure what's going on with that, as I've never used it. I filed a ticket #352.

For the build changes and changes to the source code we have a very infrequent and non-exhaustive change log here https://gitlab.com/librewolf-community/browser/bsys6/-/releases, changes to the browser settings are documented in a better way in https://gitlab.com/librewolf-community/settings/-/blob/master/docs/Changelog.md