Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Mozilla is trying to backtrack on Firefox's controversial data privacy update (pcgamer.com)
60 points by HelloUsername 10 months ago | hide | past | favorite | 92 comments


> We need a license to allow us to make some of the basic functionality of Firefox possible. Without it, we couldn’t use information typed into Firefox, for example.

Like - what basic functionality? Does not sound like "browsing" is that functionality and I am not interested in any other functionality. I do not want you (Mozilla organization) to use any of that information.

Moreover, what if I do not have the right to sublicense the content I enter to FF? Am I legally not allowed to use Firefox?


They literally just mean things like filling out forms. Implicitly or explicitly you have to give Firefox permission to store and reproduce the text you type in this very textarea so that it can submit the form for you.

But I agree with you that this should not require specific legal language. However, I point out that most other browsers have already added that same language, or something similar, to their own ToS. As have programs such as Microsoft Office. If you cannot use Firefox then you cannot use any of them either.


Somehow I use pens, emacs, and curl without sublicensing my IP to BIC, the GNU Project, or Daniel Stenberg.

Why does Mozilla need to be granted a license to my IP to submit form fields, but curl doesn't? These are just tools, used by me personally. I'm not hiring Mozilla. Mozilla is not a party to my use of their tool.


I totally agree with you that this is stupid. But apparently they feel that implicit permission isn’t enough.


At a guess, something to do with "hiring" Mozilla to do phishing protection in forms, perhaps in-browser, more likely mostly-in-browser.


Don't guess. Read Mozilla's Privacy Notice: https://www.mozilla.org/en-US/privacy/firefox/

There's a lot more in there than phishing protection.


Because Mozilla has a dedicated legal team and larger organizational exposure.


Bic had €2.233 billion* in revenue in 2022. Is that not large enough to matter?

* https://en.wikipedia.org/wiki/Bic_(company)


Physical products aren't relevant here.


Do you really, honestly believe that the only reason Mozilla wrote terms of use that way but cURL doesn't is that Mozilla has more or better lawyers? Do you actually find it hard to believe that the legal terms attached to cURL are entirely sufficient an that Mozilla is using different terms because Mozilla is planning to take meaningfully different actions with respect to user data?

Mozilla has "larger organizational exposure" precisely because they're tracking users and packaging up that data for sale.


> Do you really, honestly believe that the only reason Mozilla wrote terms of use that way but cURL doesn't is that Mozilla has more or better lawyers?

Yes. Well, that, and Firefox talks to backend services (updates, safe browsing, etc) to do its job for the user, whereas cURL doesn't.

> Do you actually find it hard to believe that the legal terms attached to cURL are entirely sufficient an that Mozilla is using different terms because Mozilla is planning to take meaningfully different actions with respect to user data?

I've known a lot of Mozilla folks for a long time, so, yes.


> backend services

Except when you actually read the ToU the controversial, unnecessary license doesn't even talk about Mozilla's services at all.

"It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox."


As does Microsoft, yet their VS Code does not require that.


> Because Mozilla has a dedicated legal team and larger organizational exposure

Sorry, this is BS. Nobody was going to win shit from Mozilla for typing a URL into their browser that runs locally on their machine. Where they might have gotten in trouble is with their telemetry (e.g. Pocket), but that’s sort of screaming to the problem that they’re pivoting to spyware.


That's not how browsers work. The data you put into a text field gets sent to the website.

If anyone claims they need to "store and process" this data, it is explicitly and solely so they can spy on you.

There is absolutely zero requirement of any kind for anyone other than the website to even know you're entering text. There is no reason or excuse for Mozilla to claim otherwise. If Mozilla claims they require a license for text you type into a website, they're lying so they can sell the data you're entering on third party websites.

This is extremely cut and dry. What Mozilla is implying is not how browsers work. This is not how websites work. Mozilla is trying to spy on users and there is no other technically valid explanation.


You’re forgetting that browsers store all of the text you type just in case the browser crashes or the power goes out or the website is offline. Later you can revisit the same page and the form data that you already entered will be refilled for you. It _is_ how browsers work.


This data is stored on your computer, not on anyone elses. (or if the website owner decides, it's stored there, but this would be indepdent of the browser used)


This is completely untrue. Do you work for mozilla? Text entered in forms like the one you use to write comments like this one don't get saved. Any logic to do with saving it is a matter for the developer of the website not the browser. This is like saying that ISP need to be granted license to forward the packages that make up your http request.


Have you never noticed this feature before? I’m starting to feel old. I was there, three thousand years ago. I was there when the strength of men failed. I mean, I was there when both the web and Firefox were really unreliable. We realized how much pain it was causing people to type things into the web browser only for it to crash and completely lose all of their hard work. Or for the webpage to throw up an error and cast their comment into the flames. We decided that the browser should save that text somewhere, so that if (and when) the user goes back it can be placed back into the form as if by magic.

But I agree that it’s stupid that Mozilla now feels you need to give it explicit permission to do this rather than implicit permission. But since only you own the copyright to the comments you write, maybe I can see the point.


I find this part puzzling. I don't have to give a pencil manufacturer rights of any sort to art I make with their product. A notebook seller cares not for such rights either, nor does a musical instrument company. The fact that Firefox seems insistent upon securing content rights suggests they're interested in using the content for things other than local browsing, which I find rather unfortunate. I'd gladly buy a support license for the browser specifically but Mozilla's structure seems to prevent that.


Or their legal team is incompetent. Never attribute to malice that which is adequately explained by stupidity.


If there’s a financial incentive involved I think it’s perfectly reasonable to incline towards malice.


Mozilla's legal team is probably competent, but working under unreasonable constraints where their initial advice to the effect of "don't spy on your users" has been rejected and now they need to find a way to shield Mozilla from legal consequences of a decision that their users won't like.


Or, “Lawyers will lawyer.” That said, there is room for both.


> Implicitly or explicitly you have to give Firefox permission to store and reproduce the text you type in this very textarea so that it can submit the form for you.

You don't have to give Mozilla permission to store and reproduce what you type into a textarea on a non-Mozilla web site.


But under current law you cannot grant a _program_ a license to something, only a person or an organization of people.


Firefox is not a SaaS. More so, it's Free Software so you literally own the program you run on your computer. You, the end user, are granted all the rights (well, except for the Firefox trademark) to do whatever you please with the binary or source code, under the MPL terms, essentially with the only restrictions imposed is that you have to do the same if you distribute it further (modified or verbatim).

If you legally need some license to type into a program on your computer (I don't think so, but let's say you do solely for the sake of imaginary argument) you can just give the license to yourself, no need to involve any third parties at any point here.

If Mozilla says they need a license so you can fill a form in Firefox, then they must've literally forgotten what Free Software even means. I hope this is not true, but merely a misunderstanding of some sort.


I agree that an explicit grant of a license is probably not necessary. I don’t grant `cat` or `less` a license, they just do what I tell them to do. I think an implicit grant is sufficient. If you use the software, you grant it the license to store and reproduce your copyrighted creations.

Note that the MPL grants you the user many permissions, but does not grant Mozilla any. If Mozilla feels that they need to be explicitly granted more permissions then they have to add that somewhere else. They cannot easily change the text of the MPL.


You cannot grant a program a copyright license because a program doesn't need a license. It's running on your computer at your behest, so there's no third-party involved, just you the user, and eventually the site you send that POST to.


I buy a hammer from home depot, I don't need to give Home Depot a license for me to use the hammer. I don't need to give that license to the hammer manufacturer either.


The jackhammer does not store text that you write on your behalf. Firefox does. When you type a comment here on HN, you do so in a form field. Firefox stores that text for you and reproduces it on demand. Since you and only you have copyright on that text, you and only you can legally publish it.

I think it is dumb that they want _explicit_ permission to do this, when we grant _implicit_ permission to all kinds of programs day in and day out to do the same thing. `less` doesn’t ask for permission when I tell it to display a file to me, it just does it. `curl` doesn’t ask for permission when I tell it to upload the file to a server. Etc, etc.

But check out the ToS for other web browsers, for desktop publishing programs, office suites, email clients, etc, etc. Many of them have similar language. Not all of them, but many.


That doesn’t make any sense. You’re not giving the license in the ToS to the program but to the company. But the company isn’t processing any data I enter into the browser. I run the browser myself and they never get access to the data.


Right, but under US law you cannot give a license to a program. Only to people, or groups of people that we call a company. You’re giving Mozilla permission to implement the features in Firefox, since you can’t just give permission to Firefox.


But Firefox doesn’t need a license to give me a program that I can use to do stuff on my device. They only need a license if they get access to the data.


As I've said, I totally agree. But Mozilla’s lawyers don’t.


Do you give a license to your typewriter maker? To the manufacturer of colored pencils?


Mozilla doesn’t need a license from me so that their program they give me and run myself can do something. Exactly because the program isn’t Mozilla.


If the org never sees that data why would they need a license for it?


This is not what they mean. My shell doesn't need a goddamn legal agreement to save history or let me mosh into servers (mosh doesn't need one, either), because this is absurd and not a real thing. They 100% do not need a legal agreement for you to use the software on your own machine, even if you're using the software to communicate with 3rd parties, it has nothing to do with why they added this.

> But I agree with you that this should not require specific legal language. However, I point out that most other browsers have already added that same language, or something similar, to their own ToS.

Not so you can submit forms to websites (again, this is absurd) but so they can spy on you and do whatever they want with the data they collect, same as what Firefox is trying to gain the legal cover to do (whether they use that cover or not).


So why did they feel the need to make this explicit for Firefox now?

Why was the previous state of affairs not sufficient? Hasn’t Firefox been letting me type data into a form for nearly 20 years now, _without_ this language?


Wait a minute... Did Mozilla sign an agreement with some AI model company like OpenAI or Anthropic to "help" their hapless users (for revenue like they did with Google and search)?

If so, Tsst. Bad Mozzila! No!

Seriously though, that would be a huge mistake for a supposedly free software company. Especially when people are realizing the "meh" of the value added with most applications of LLMs.

HashiCorp rug pull level mistake.


Local software does not require legal, global permission for the things you type into it.

This is a silly argument.


> They literally just mean things like filling out forms. Implicitly or explicitly you have to give Firefox permission to store and reproduce the text you type in this very textarea so that it can submit the form for you.

If they mean that they should say that.

But also it doesn't seem like they would need permission to store data locally, on your own computer. If it's a matter of using Mozilla Sync, then the TOS would apply to Sync and having a Mozilla account, not for using the browser.


Yes. Firefox. The binary that runs on the computer, not Mozilla somewhere else.


Can you quote and link the relevant part of ToS other browsers and MS Office (the one that runs on your computer, not 365 cloud) ?


Sure, here’s the one for Google Chrome: https://www.google.com/chrome/terms/?hl=en_US

It says “By using Chrome or ChromeOS, you agree to the Google Terms of Service located at https://policies.google.com/terms […]”. The Google Terms of Service at https://policies.google.com/terms?hl=en-US#scope is what you are looking for.

I don’t have the others in front of me.


Yet, Google is a lot more specific im what, how and why you license the content to Google. And it is not for anything that Firefox does.

Plus:

> Some of our services are designed to let you upload, submit, store, send, receive, or share your content. You have no obligation to provide any content to our services and you’re free to choose the content that you want to provide.


This makes no sense. Firefox has been around for ages. The need for a change in ToS makes no sense now.


Put simply, Mozilla are lying.


> Mozilla released a "Terms of Use" document for Firefox, a first for the open-source browser. That might sound like business as usual, but [...]

That's not business as usual, that's a contradiction! Open Source software doesn't impose terms of use. Criterion 6 of the OSI's Open Source Definition document: No discrimination against fields of endeavor. [0]

The FSF's Four Freedoms, analogous to the OSI's Open Source Definition, has a similar requirement: The freedom to run the program as you wish, for any purpose (freedom 0). [1][2]

It's true that Mozilla's terms of use nonsense was limited to the Firefox executable binary, and did not apply to the source-code, but still, there's a reason the community sees this as a betrayal. We shouldn't have to work around this kind of thing in the first place.

It's not 'confusion', Mozilla. The backlash from your community is because you're betraying your professed values, not because your community is stupid.

[0] https://opensource.org/osd

[1] https://www.gnu.org/philosophy/free-sw.html#four-freedoms

[2] https://news.ycombinator.com/item?id=43207456


This “nonexclusive worldwide license for the purpose of doing what you asked us to do” thing has bitten so many companies over the years, I can’t believe anyone would obliviously put it in there at this point.

I understand your IP attorney thinks you need this license to operate, but the users will definitely freak out unless you express extremely clearly what the restrictions are, and probably write a blog post explaining what it’s there for. In the current climate it will be read with the worst possible interpretation.


Yea, I actually happen to think that Mozilla doesn't have ill intent here, and that this whole drama is what happens when you hand the product over to lawyers. Lawyers will always push for broad, sweeping legalese that claim everything under the sun. Lawyers don't even get out of bed before they recite the holy "nonexclusive, royalty-free, worldwide license" prayer three times and throw salt over their shoulder. It's just second nature to them, part of their core being, to write words that give themselves everything. When you're a company and have legal counsel, you need to understand that they are just advising you, and they will always be conservative and risk-adverse. You don't have to do everything they advise.


> Yea, I actually happen to think that Mozilla doesn't have ill intent here

I could understand that if it was just the Terms of Use thingy.

But if you look at the whole picture, I cannot really come to the conclusion.

Why did they remove the "we won't ever sell your data" promise?

Why the statements about Mozilla being/becoming an AI company?


If they offer an AI feature, it will probably rely on a third party model API, so they will need a license to forward your inputs to that third party for the purpose of implementing that feature.

The selling your data thing is disturbing but not necessarily related to this.


> I actually happen to think that Mozilla doesn't have ill intent here

I can't speak for what the intent is or whether or not it's ill, but that this change came about shortly after Mozilla decided that they wanted Firefox to get in on the targeted ad game seems very suspicious to me.


Too late I’ve installed Librewolf. I’m going to either find a tool this weekend or write one tonight that will keep my bookmarks in sync with ios and that will be it for them from me.

The value is wayyyyyy too low to embrace folding. And perhaps these negative reactions are extreme but are a bit more telling.

Clearly nearly almost everyone wants Firefox out of the hands of Mozilla. They have low market share from being Google’s get out if jail free card. Now the 2.x% that remain are flocking away as well. This exit out is an attempt to “fork” Firefox in some manner. There is an opportunity to swoop in and pick up the helm.

Mozilla perhaps doesn’t see the story everyone else does:

- developed privacy stance over a decade

- updates their policy to state “actually well we’ve been selling data about you”

At this point you might as well have said, “Haha we’ve been lying this whole time about privacy.”

Regardless of truth and nuance of it all, the damage is done. The privacy promise was the only thing holding the rest of the complaints back.


Seeing all of the negative articles about Mozilla and Firefox has not influenced my decision to use Firefox as my primary browser. Firefox is the only mainstream browser that still permits add-ons to block advertising and scripts.

Privacy in Edge and Chrome are a joke compared with privacy in Firefox. Safari is a joke altogether, and would die if Apple did not force it on users.

I like Firefox and I like Thunderbird, and I will continue to use both of them.


It's been about 15 years since I've used Firefox as my main browser but I'm not sure what their value proposition is at this point. They're not faster than the best browsers, and if they're not going to be better on things like privacy I don't see where they are going to position themselves. I mostly use brave now and some chrome when the occasional site doesn't work in brave.


Firefox is actually faster in practice than Chrome. It also uses less memory, often far less, to accomplish the same tasks.


Chrome's UI is written in C++/native GUI toolkit. Firefox's UI is written in JavaScript/HTML (thinly wrapped in native toolkit).


You say this as if the GUI is a major part of a browser's compute budget, and not wildly smaller than rendering the page you asked for, in >95% of the window's available space.

I wouldn't care one bit if the GUI was rendered in immediate-mode software rendering, if it worked. I interact with websites far more.


> Firefox is actually faster in practice than Chrome.

If you are going to make such a wild claim, you should back this up with data, your “feelings” are not enough.


There are benchmarks on https://arewefastyet.com. Sadly they do not go as far back in time as they used to; the absolute speed increase that Firefox has had over its lifetime is quite impressive. They’ve made progress in virtually every release since version 4.0.


Firefox is slower in pretty much every benchmark though?


It absolutely is not faster. It just isn't. I have no doubt you can find some bollocks benchmark which proves your point but in real world usage it's just not.

Memory is there to be used. Have at it.


At least on our ram limited work VMs I literally can't launch Chrome without it crashing on launch. Firefox runs with no issues dozens of tabs, although occasionally I do get a tab OOM crash, which restarting Firefox resolves.. And yes, this is even if I completely quit Firefox to ensure Chrome gets as much RAM as possible.

If I've just restarted the machine, sometimes I can launch Chrome.

Chrome print preview never renders about 90% of the time when I am able to launch it. Firefox, no issues.

On a large complex page, when Chrome does manage to launch and print preview does load, it takes tens of seconds to render. Firefox, no issues.

I pretty much just use Chrome when I absolutely have to do a cross-browser test these days.

BTW, a Chrome-tangential annoyance is that the code process in VSCode which is basically an embedded browser sometimes runs wild sucking up gigabytes of RAM on another VM dedicated pretty much just to VSCode (and a couple of other minor tools on a lightweight desktop). The irritating thing there is that due to, apparently, a limitation of the blink embed they are using, you can't restrict the RAM available to VSCode to any number (even 100% of system ram) so you basically have to wait for the oomkiller to kill it, or run a parallel monitor to kill it once it sucks up too much ram.


What you're describing is <0.1% of browser use case though.


This is not a good argument.

Many different users have many different use cases.

What you're basically saying is: It works OK for me, so the fact that it doesn't work for you is insignificant.


No, I'm saying it's working for >99% of the users.


shrug This is a Windows VM with 8GB of RAM - if 8GB is no longer enough for Chrome, that's kinda sad. But does mean it is useless for at least the longer tail of lower end hardware.


(oh, and I suspect about:memory might fix the demanding sites that OOM, but restarting is easy enough too)


Memory is there to be used by all my applications, not to be hogged by one application when it could get by just fine with less.


In my experience, Chromium can feel somewhat faster when you keep a low number of open tabs. It doesn't deal with many tabs as well as Firefox though.

That said, these days I only use Chromium occasionally, so this could have changed over the least few years.


Keep in mind that Mozilla is heavily focused on Windows. It's very fast and responsive on Windows, but I fund it unusable on Mac and Linux.


I use both and I think they are similar in speed.


The value is it has ublock origin.


As compared to Brave, that isn't much value since the built-in ad blocking in Brave works great.


Its other value is the engine not being owned by Google. Those were 2 strong value propositions for many people.


Slipped once cannot be trusted anymore.


"Slipped" by non legalese versed users reading "scary" looking legal boilerplate and totally misunderstanding it.


It does not matter, the intent is obvious no matter how they try to spin it, the damage has been done.

I am uninstalling Firefox after 16 years of sustained everyday use in dual-browser split setup alongside Safari. I will also make sure everyone I know still using FF gets the note.

I am going back to Chromium-based browsers that are openly "sell-your-data" from day 1 and I am willing to accept the Google monopoly if it means that dung beetles like Firefox are not able to prey on loyal supporters by bait-and-switching the ToS whenever they feel like. Hopefully their telemetry shows them a good picture of how their decisions affect their market share.

Hell, my 2011 issue about wrong handling of ::first-letter pseudoclass on bugzilla hasn't got a single meaningful update since, but I was willing to sacrifice the standards compliance for the promise of "privacy". There is no more privacy.


Your logic is completely incomprehensible.

Since Mozilla _may_ sell your data, your going to abandon it for Goggle? Who will _definitely_ sell your data?

This is irrational.

There is LibreWolf, Brave, Palemoon, just to name a few browsers that have not made the terms of use statements that the Mozilla foundation has just made, and that the goggle corps has made all along.

Supporting the "Google monopoly" is not good for user rights. People who don't understand these issues run it because they don't know any better. People who do know better shouldn't use it, at all.


Legalese heavily errs on asking too much, and maybe the possibility without bad intentions triggered users, maybe, but honestly, there's a bunch of flaws we've seen over time and this was more like the not so little drop that spilled the glass.

Instead of privacy, users have been force-fed unwanted "features" that so happen to need external services instead of others like a UI revamp that made Sidebery and Containerise unnecessary. The only recent good feature I recall is the offline translation, prior to that it's gotta be the sync server that you could host yourself, and the reading mode that helps reading the web in its increasingly bloated downfall.


From the outside, in my opinion, this reads as a strong signal that the rank and file Mozilla staffers are generally disempowered. I like to assume that if this was floated at an all-hands that it would have resulted in some strongly voiced objections. Until the leadership at Mozilla changes there remains a reason to distrust Mozilla.



Yes, a lot more discussions today:

"Mozilla flamed by Firefox fans after reneging on promises to not sell their data" https://news.ycombinator.com/item?id=43229668 182 comments

"Trust in Firefox and Mozilla Is Gone – Let's Talk Alternatives" https://news.ycombinator.com/item?id=43229378 189 comments

"What, if anything, should I do about using Mozilla's Firefox" https://news.ycombinator.com/item?id=43229267 129 comments


"Sorry we were caught"


No, because they expected some people to read the ToS. You don’t put something you are hiding into your ToS. It’s just that they didn’t expect people to freak out since other browsers already have similar language in their ToS.


"Everyone else is doing it" is not a defense. Firefox users are often using it because they didn't have that in their terms. Now they do. People are upset about the rug pull.


I know it’s not a defense for bad behavior; I didn’t say that it was. 99% of Chrome users have never read its ToS, and the same is true for Firefox users. They are not using Firefox because the ToS is better; they are using Firefox mostly for nostalgia at this point.

But I agree that people are upset, and that they think that Mozilla is taking something away from them. The reality is that we have always implicitly been giving Mozilla permission to do these things, because they are necessary for the operation of the browser. In order to comment on HN you must type some text into a form and then tell the browser to submit it. The browser saves a copy of that text for you so that it isn’t lost if the power goes out or the browser crashes or the website is offline. Here in the United States that text automatically has a copyright, you own that copyright, and you and you alone have the exclusive right to publish that text. You have to give Mozilla, or Firefox, permission to act on your behalf.

Mozilla’s lawyers have apparently decided that this requires you to _explicitly_ grant them permission to do these things for you. I think that’s stupid, but I think it’s pretty obvious that Mozilla isn’t stealing anything here. We always give the software we use implicit permission to act on our behalf.

I also think it is also very stupid that Mozilla’s leadership couldn’t predict this outcome in advance. It points to incompetence on their part. At the very least they should have kicked this back to be rewritten to be more explicit about what “operating Firefox” means, including specific examples. In fact they should have just enumerated all of the ways that Firefox stores data about you and what part of operating the browser that data is used for. History, bookmarks, form data, everything.


Which other browser demand a license to whatever content you input into them?


> a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox.

This is super bog-standard nothing-special stuff.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: