Recent and related:

Introducing a terms of use and updated privacy notice for Firefox - https://news.ycombinator.com/item?id=43185909 - Feb 2025 (1060 comments)

> The reason we’ve stepped away from making blanket claims that “We never sell your data” is because, in some places, the LEGAL definition of “sale of data” is broad and evolving. As an example, the California Consumer Privacy Act (CCPA) defines “sale” as the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by [a] business to another business or a third party” in exchange for “monetary” or “other valuable consideration.”

THANK YOU California for this definition of selling data, which is accurate, and representative of what people think of when discussions of selling data come up.

> In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners

Ok, so that’s pretty straightforward. According to CA and other states Mozilla is collecting and selling your data. Which is exactly what everyone is upset about and means exactly what everyone thought it meant.

They also said "Mozilla doesn’t sell data about you (in the way that most people think about “selling data”)", and I'm struggling to fathom what they could possibly think that "most people" think selling data could mean other than "giving your data to someone else for compensation", which seems pretty much exactly what the California law says. Yes, it's embedded in some legalese, but surely Mozilla has lawyers?

I think they're trying to make the distinction between "we sell your searches and clicks attached to your personal id" and "we sell derivative aggregated information like we have a lot of users of X style to advertise to". But it's kinda hard to sift through exactly what they can and can't sell under this.

Wouldn't derivative aggregated information not be included in definitions like the one quoted because they specifically about personal data?

If you sell the information how many customers you have and how many shoes you've sold last month, are you selling your customer's personal data?

> If you sell the information how many customers you have and how many shoes you've sold last month, are you selling your customer's personal data?

To make that analogy fair for the scope of what Mozilla's doing, the shoe store would have to be selling data about what color shirts people are wearing when they visit the shoe store.

That is fair. But a more accurate analogy would be that the sales representative that goes to people house is reporting to the store what color people are wearing at home.

Firefox is installed on my computer, not on a VPS owned by Mozilla. I'm not browsing Mozilla website. Why are they entitled to record and share everything I do?

CCPA/CPRA have a very broad definition of sale.

> (1) “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration.

Most people would view a sale as Mozilla getting cash back for the data. But that "other valuable consideration" (which the AG declined to clarify or create a factor-based approach for deciding) makes Mozilla vulnerable to lawyers.

The same parasites that claimed that embedding a chatbot on your website violates the California wiretapping laws and have been extracting cash from sites will figure out a way to do the same to Mozilla. see the wave of CIPA chatbot lawsuits.

For instance, suppose Mozilla partners with a search engine and could be claimed to get a discount or some other consideration for letting that search partner use search terms to improve the search engine. Something that isn't advertising related at all. That's probably a sale under CPRA.

> For instance, suppose Mozilla partners with a search engine and could be claimed to get a discount or some other consideration for letting that search partner use search terms to improve the search engine. Something that isn't advertising related at all. That's probably a sale under CPRA.

If a search engine partner wants to use search terms to improve their search engine, they only have to look at their own logs. They don't need Mozilla to collect, aggregate, and sell them any data to accomplish that. Mozilla doesn't need to worry about selling data if they never possess that data in the first place.

Your complaint about "other valuable consideration" is just a complaint that the law isn't crippled by stupid loopholes.

> Your complaint about "other valuable consideration" is just a complaint that the law isn't crippled by stupid loopholes.

That's not the law. The search engine partner using those logs is probably valuable consideration and hence a sale. Mozilla doesn't even need to keep the data; just an api passthrough will qualify.

> The search engine partner using those logs is probably valuable consideration and hence a sale.

It's not a sale when the search engine doesn't get those logs from Mozilla. When a user sends a search query to Google using a Mozilla browser, it's Google's privacy policy that applies, not Mozilla's.

> Mozilla doesn't even need to keep the data; just an api passthrough will qualify.

There is no API passthrough in this scenario. Search queries go to the search engine directly without being relayed through Mozilla servers. Anything that does hit Mozilla's servers is entirely optional and unrelated to the purpose of satisfying the user's request for search results.

You don't need to speculate about how this could all be due to innocent ordinary operation of a web browser when Mozilla has already disclosed that they're voluntarily tracking users in ways that are not necessary for the operation of a web browser.

Most people don't think about this stuff and are simply uninformed. Referring to what "most people think" is a cop-out from their side.

But I think the sense Mozilla are referring to is the more obvious and over-the-top things like selling your name, phone number, email, postal address, your Amazon purchasing history, or to ramp it up more, your passwords, your credit card info etc.

The latter is a pretty high bar. Even Google doesn't do that.

Just saying that you can stretch it pretty far with vague language like "we aren't doing [bad thing] in the sense that most people would understand [bad thing]".

Most people probably envision selling data akin to shady person trading usb stick in dark alley or hackers selling huge batches of stolen data, so that statement will be true almost by default

most people I speak to about this tend to imagine selling data to be like people cold calling you with scams, getting suspicious advertisements that happen to be about stuff you just happened to be saying in the other room (which actually happened), and stuff like that. in Mozilla's case I'm pretty sure it's whatever Pocket is, considering how difficult it is in Firefox to turn that garbage off

This is a funny case where Mozilla thought they are clarifying their position by pointing out how ridiculously CA defines "sales" only for it to blow up in their face. This is not the first time it happens to companies where in an act of desperation they issue some "apology" or explanation only to make the whole thing worse.

Now people will read even more carefully their privacy policy https://www.mozilla.org/en-US/privacy/firefox/#notice and may find things like:

> Firefox also shows its own search suggestions based on information stored on your local device (including recent search terms, open tabs, and previously visited URLs). These suggestions may include sponsored suggestions from Mozilla’s partners [...] or relevant URLs that are popular in your country.

> Mozilla processes [...] how many searches you perform, how many sponsored suggestions you see and whether you interact with them.

> Mozilla collects technical and interaction data, such as the position, size, views and clicks on New Tab content or ads, to understand how people are interacting with our content [...] This data may be shared with our advertising partners on a de-identified or aggregated basis.

> we share data across Mozilla-controlled affiliates and subsidiaries. We [...] disclose personal data as part of a corporate transaction, such as a merger, acquisition, sale of assets or similar transaction

> [...] retain personal data for more than 25 months, but actual retention periods may vary depending on the type of data and the purpose(s) for which it was collected

[Definitions]

> Technical data : Device type, operating system, IP address, ISP

> Settings: Enhanced Tracking Protection settings, cookie settings, permissions (location, camera, microphone), toolbar customization.

> Location : Country code, city.

> Precise Location: Your precise location (within a few feet or meters).

> Interaction data : How many tabs you have open or what you’ve clicked on. Click counts, impression data, attribution data, how many searches performed, time on page, ad and sponsored tile clicks.

> Browsing data: [...] websites and URLs you’ve visited. [...] (travel, shopping, social media), top level domains (example.com) or specific web pages visited.

Based on the parent, all the collected data preserves privacy:

> Firefox also shows its own search suggestions based on information stored on your local device

That data stays on your computer ...

> Mozilla processes [...] how many searches you perform, how many sponsored suggestions you see and whether you interact with them.

That description contains no user content: number of searches, number of ads, whether you interact says nothing about you - it doesn't say what you click on or see, just that you clicked.

> position, size, views and clicks on New Tab content or ads

Again, there is no content mentioned, just number of clicks and not what you click on.

> [Definitions]

This section defines terms; it doesn't say they are doing anything.

I wish this was more obvious that they don't identify what the 'clicked' New Tab content is. And for Search it could be stored local information and be tracked for suggestions. I wish they clarified the things you clarified instead of failing to mention them.

I think that's a great point. I think organizations are careful not to interpret carefully worded legal prose, to avoid undermining the legal position. But that limits understanding of these things to lawyers who can interpret the legal prose.

How do they decide which sponsored ad to show you?

On your device: "Interests: Candles, Wooden Sculptures, Underwater Basket Weaving"

Advertiser: "Show this to users who like Candles."

Mozilla: "OK"

That's pretty standard and can be used to track people on the advertiser's side still, depending on how the ad itself is served and how clicks on the ad are processed.

Does Firefox download information about every ad that advertisers have paid for, and then match against local data to decide which ad to serve?

If not, when it queries to find out which ads to serve, what data does is sent with that query (or prior to that query)?

Firefox has done a lot of work on these problems. I don't have it in front of me, but they described in detail what they do.

I haven't been able to find any documentation of this, other than "we acquired Anonym, which claims to send the data to trusted execution environments".

I'm sure the internet police's thorough investigation into themselves has shown they are doing nothing wrong.

Usually it's the sponsor who decides. Because, for example, it's pointless to show Walmart ads in North Korea. (I'm not a mz insider)

It's a great question, and that is the tech Mozilla / Firefox have been working on and using for years.

Advertising is, unfortunately, necessary to funding most of the web, and targeting is necessary to advertising. As a result, users are surveiled and tracked heavily.

But imagine if the targeting could be done without surveillance and tracking - then users could largely use the web in private. It would be revolutionary. That's what Firefox has figured out and is investing more in:

https://www.adexchanger.com/privacy/mozilla-acquires-anonym-...

When you keep the ip address, that often gives people everything that they need, along with "fingerprinting" data. Especially governments and huge corps like facebook/google/amazon, as they have you IP @ {date}/{time} as well. Match it up and you have the golden calf.

I feel like there _is_ some daylight between what people hear when someone says "Firefox is selling your data" and, for example, Firefox using your IP address to put you in a rough country-level geoblock to determine whether to show you an ad that was sold to all users in a country.

Yet the second one, which I think would be very much considered close to harmless from my perspective (compared to an alternative of "an ad is shown to everyone across the world"), would, I think, still fit into this metric of your data being sold.

Though maybe I'm misinterpreting what the CCPA's breadth would be.

I have been a bit disillusioned by FF for some time, and would like for them to figure out some version of a business model in order to survive, and so we can know the contours of that business model. Trying to play "we do not do business things at all" with them constantly shipping weird ad-ful features and stuff like Pocket... let's see if we can make this honest!

I chose firefox because I don’t want my browser to build an ad network to sell targeted ads.

And I definitely don't want this:

> You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content. [0]

[0] https://www.mozilla.org/en-US/about/legal/terms/firefox/#you...

Exactly.

Why is my browser serving me advertising in the first place? Because Mozilla is an advertising company now.

There are only two ways to generate revenue: direct and indirect. Nobody will pay for a browser.

I don’t use Firefox and this whole thing is distasteful, but I’m not sure how they’re supposed to cover operating expenses without indirect monetization, or what for of indirect other than ads would work.

In the meanwhile, people are asking how to donate to Firefox not to Mozilla and it's CEOs whims and personal salary.

> Nobody will pay for a browser.

Speak for yourself.

Give me a browser that clearly and unambiguously does not sell my usage of it in any way, and I will give you a monthly subscription.

Horse Browser? https://gethorse.com

Well yeah and I do pay for Kagi but would still say “nobody will pay for a search engine” using “nobody” in the “not enough people to scale a mass market business” sense.

> There are only two ways to generate revenue: direct and indirect. Nobody will pay for a browser.

There's a third way: screw revenue, dump all staff not related to browser development and documentation (MDN) and look for government grants to fund that.

Especially the EU may be a target for a well-written proposal, given the political atmosphere it would make sense to have at least one browser engine that is not fundamentally tied to the US and its plethora of bullshit like NSLs.

> Nobody will pay for a browser.

I would, if they offered a payment-only access to Firefox with no added services and no telemetry whatsoever. I'd pay 50€ a year for that.

Yes, ad first company, with a browser product to capture ad audience.

It’s a weird term, but I’m not sure how “for the purpose of doing as you request” is terrible. To me that means that when you type a url, they have the right to do a DNS lookup for it.

Is there some interpretation where “for the purpose of doing as you request” means any purpose they want?

The problem is that I'm not requesting Mozilla do anything. Firefox isn't a "service" it's a web browser. When I input a seach query, _I_ am acting on my behalf, not Mozilla.

I don't want any language where they get to insert themselves into that chain of behavior. Curl doesn't need a TOS, why does Firefox?

I agree. The very fact that they added a Terms of Service is weird. I don't want Firefox to be a service in any way. It's a tool.

When I drill a hole in my wall, DeWalt don't tell anyone who I am, how large a hole it is, what material I drilled into or even the fact that I actually drilled anything. They don't know any of that, and neither should Mozilla know when my local copy of the browser makes a DNS, HTTP or any other request.

Very much this. The browser already have all the features to do what I want it to do. Why does Mozilla insists of being a middleman? It's my computer, Firefox code, and someone's server.

And they should use the system DNS services for that, not their own partners.

And I chose Librewolf because I didn't want that, either.

this is why I use librewolf

> Firefox using your IP address ... to show you an ad

Why do you imply that Firefox showing ads is acceptable ?

They have been doing for at least a decade by now (e.g Amazon). So why imply it suddenly isn’t acceptable to show ads (in any form)?

> They have been doing for at least a decade by now (e.g Amazon). So why imply it suddenly isn’t acceptable to show ads (in any form)?

Because it isn't acceptable.

The first thing I've done (for years now) when configuring Firefox is to turn off many of the defaults. Advertisements, pocket, search engine, online spell checker, translator, blah blah blah.

I mean they integrated pocket right? They sold the default search engine position for billions. That’s something! Not all money making efforts are created equal, though. We judge based on what the effort is in context!

> let's see if we can make this honest!

They're beholden to who gives them money, which is not us.

It could be us, either directly with money, or even just indirectly by “being the product” but being able to just walk away.

FF exists off of good will and the search deal. The more people stop using the browser the less they’re going to pull in from the deal.

> FF exists off of good will and the search deal

Firefox exists off of google and their antitrust deal.

Mozilla, then Phoenix, then Firefox user for over 27y or so.

If they can't stop abusing their users, I will look for another browser, goddamnit.

They are only three viable web-engines left over from the second browser-war:

  * Blink (Google): Used in everything, from Chrome, Edge, Opera, Qt-Toolkit, Electron.
  * Gecko (Mozilla): Firefox. And Waterfox? I assume Gecko is still hard to integrate.
  * WebKit and WebKitGtk (Apple and Gtk): Safari, Epiphany and Gtk-Toolkit. Easy to integrate. And the only engine where I’m aware that actually two side actively cooperate in development.

Epiphany is small and nice, but they need a lot more developers. And I think they should use ffmpeg, gstreamer seems to be a source of issues for many years. But again, they need us, every helper capable of C++ is welcome.

Ladybird an another new engine, implemented in C++. But it is in alpha-state, only for developers. Everyone else who tries to show us a new browser means “use that Google thing with another name on it”.

Though not yet ready for the public don't forget the promising https://servo.org

(It is very usable already in combination with Tauri as alternative to Electron + Chromium)

WebKit is also used in Orion, but that browser is macOS/iOS only.

They've started work on a Linux version, too.

I'm still hoping for something to come out of Servo.

I honestly think we need to shift our trusted computing base off of C/C++. There's no way a ragtag bunch of volunteers puts enough effort into security when every minor mistake is a disaster :-(

Some more:

* Librewolf, Palemoon, Falkon.

Librewolf is Firefox plus minor patches.

Palemoon is based on an outdated fork of Gecko.

Falkon uses QtWebEngine, which is Blink.

> If they can't stop abusing their users, I will look for another browser, goddamnit.

This seems to go beyond "can't stop" to "are actively plotting a course to continue." I've seen a lot of missteps from Mozilla over the years, but I never thought I'd see them selling my data. From seeing the news yesterday to today, I know now I have to stop recommending Firefox, and figure out a browser that I can trust.

> I will look for another browser, goddamnit.

Well do it, i had Firefox on all my machines for about 15 years, change to librewolf took like 20 minutes on all machines...and it even feels more responsive, and i dont have have to install uBlock manually and other settings by hand, like disable those experiments mozilla can install:

https://librewolf.net/#main-features

And if you de-install firefox on windows you can even tell them why you did it ;)

Librewolf is a Firefox fork with this crap removed.

And if everyone switches to Librewolf, Librewolf will die because Mozilla will no longer make money and won't be able to devote resources towards maintaining upstream Firefox.

I use Firefox. I hate ads. I don't love that Mozilla engages in some level of affiliate deals to pay the bills, but it's the only viable alternative to Google controlling the entire web and doing much worse tracking/advertising at this point, unless Mozilla can figure out some other revenue stream.

Chromium-based "privacy-focused" browsers can only exist as long as they're not popular enough to move the needle on Google's ad business. Firefox derivatives can only exist as long as Mozilla can pay the bills, which they almost certainly can't do if nobody uses Firefox (no reason for Google to pay for search priority for an audience of zero, and no affiliate deals for an audience of zero).

The more people use Firefox forks, the sooner Google controls everything. You might personally benefit in the short term, with "complete" privacy, so I can understand why some might choose that option, but you need to accept that you're contributing to Google's dominance by doing so.

> Mozilla will no longer make money

Mozilla could have added years ago a donation or subscription to fund the development of Firefox, but they don't want that. Mozilla wants all the money for its charitable activities instead.

There will be a time when they have no money anymore, but it's only their fault.

I think it's not that they don't want it as it's difficult to mix money from commercial activities with donations. That's why they keep the two cash flows separate and are only using Google money for Firefox development, and spend donations exclusively on political bullshit very few people care about.

Although their $7 mil CEO could have found a way to handle this while not running afoul of the IRS, but she decided to play with a bunch of dead-end commercial endeavors instead. So that's on them.

> Mozilla wants all the money for its charitable activities instead.

Describing Mozilla's derailment as "charitable activities" is like describing the Mexican cartels as "self-help groups".

Never forget their "We need more than deplatforming".

I doubt donation would be anywhere close to what is needed for development even if that exists.

Na, Mozilla will die and Firefox and Thunderbird will get transferred to a community project, Thunderbird survived without Mozilla so will Firefox.

Pretty sure that community project will get overwhelmingly big donations from all over.

A web browser is much more complex software than an e-mail client, though.

A web browser doesn't need to scope of "copy every thing Chrome does".

If whole operating-systems can survive out in the open a browser can too.

Software don't need AI-hyping 6 million dollar swallowing CEO's

If even a tiny appreciable amount of user move to librewolf, Mozilla will fix their business model.

They were doing fine as a business under Eich, whatever you think of him. They make over $500M just from their search box - and frankly, that is way more than you need to make a fantastic browser. And Thunderbird.

Baker took home over $7M a year for the past six years, and though she stepped down as CEO, we don't know if they even cut her pay, or what the other top tier salaries are [1]. Mozilla is a "open" company, but they announced that they will "not be disclosing salaries" after Baker stepped down.

Kagi makes a browser with 35 employees and ~200K inn sales. And I know, they are not building from scratch - but neither is FF at this point. It is ridiculous to suggest that Mozilla will go under if they don't become spyware.

[1]: https://www.mozilla.org/en-US/about/leadership)

Yes, here too, add Mosaic and Netscape there. Switched to Waterfox, would pay for a full fork.

You're saying "will" but what are you waiting for? How many data points do you need to leave FF now they're admitting to collect data and willing to display their own targetted ads, that they make deals with Facebook in addition to making deals with Google, that they're green-washing and pushing Google's efforts to take over the web as a targetted ad medium which has resulted in abandonment of almost all browser development and their own browser share drop to low single-digit figures, with funds directed towards nebulous virtual signalling campaigns but mostly to their management and certainly not towards development or the better of the web?

there are many offshoots, zen, floorp, librewolf (if you want that classic feel), waterfox, etc

Mozilla is continuing to dig its own grave

If they would simply tell us what part of Firefox is affected by the CCPA's definition of "selling user data", there would be no room for misinterpretation and this would be over.

If it's as innocent as "Firefox has to send HTTP packets to arbitrary web servers to achieve the fundamental function of loading a page" and that web server is considered 3rd party by CCPA, then everyone would understand... this is either poor communication or they are hiding something else (which everyone should rightly assume in this day and age).

Just tell us already Mozilla!

From the article:

> In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners, including our optional ads on New Tab and providing sponsored suggestions in the search bar.

And remember, they’re citing CCPA’s definition as meaning “… in exchange for ‘monetary’ or ‘other valuable considerations’”. This is exactly what people mean by “selling”.

It’s not the innocent thing you’re contemplating, about a browser doing its job. It’s specifically about things like serving ads, making that browser “commercially viable”.

Mozilla is stopping claiming they’re never selling your data because they’ve been selling your data for the last few years.

Selling ads isn't even the problem. They could do that and still truthfully, legally claim they never sell your data.

Mozilla is helping perpetuate the illusion that online advertising necessarily includes collecting and selling data about the users who are shown the ads.

AFAIK they do the opposite: They've pioneered ways to target advertising without your data leaving your computer.

See for example,

https://www.adexchanger.com/privacy/mozilla-acquires-anonym-...

"That shared mission is predicated on the notion that advertising and privacy are not – or at least don’t have to be – mutually exclusive."

And it goes into detail on the investment and technology in that area.

If they've pioneered such technologies, they aren't using them. Their Privacy Notice enumerates many types of data that Mozilla collects and passes along to "partners"/advertisers. For example:

> Mozilla collects technical and interaction data, such as the position, size, views and clicks on New Tab content or ads, to understand how people are interacting with our content and to personalize future content, including sponsored content. This data may be shared with our advertising partners on a de-identified or aggregated basis.

There's a lot of tracking data that does leave the user's computer, and Mozilla is trying to justify it by assuring us it's sufficiently anonymized and aggregated—assurances they would not need to make if the data wasn't changing hands.

It's also silly to suggest that targeting advertising without tracking users needs to be "pioneered". It's obvious that Mozilla could have the browser download this month's list of sponsored search keywords and have the browser check search strings against that list, without going off-device. There's no innovation required to implement that. All the attempted innovation is focused on how to exfiltrate data in a form that they can get away with selling.

> There's a lot of tracking data

It's meaningless data to you: It doesn't say what you click on, just where and how big the ads are, and how many times you click. It doesn't identify you or reveal anything about you, except that you clicked on some unknown ads.

> It's also silly to suggest that targeting advertising without tracking users needs to be "pioneered". It's obvious that Mozilla could have the browser download this month's list of sponsored search keywords and have the browser check search strings against that list, without going off-device.

These are the words of someone who hasn't done it. Look at the article; what advertisers want and what the privacy-destroying competition does is much more sophisticated than what you describe. For example,

Anonym also has technology that allows ad platforms and advertisers to securely share encrypted impression and conversion data within a trusted execution environment for attribution, causal lift measurement and lookalike modeling. (A trusted execution environment is the secure area of a main processor where code can be run safely and in isolation.)

To be fair, the major ad platforms have long offered attribution and measurement solutions, Mudd said. “But they required the data to come into their system,” he added. “In this world, that doesn’t have to happen.”

> It's meaningless data to you: It doesn't say what you click on, just where and how big the ads are, and how many times you click. It doesn't identify you or reveal anything about you, except that you clicked on some unknown ads.

I'm not sure what you mean by "meaningless data to you". Obviously, the data Mozilla is collecting, aggregating, and selling is meaningful to the buyers. And you're straight up lying about the extent of the data, directly contradicting Mozilla's Privacy Notice.

> Look at the article; what advertisers want and what the privacy-destroying competition does is much more sophisticated than what you describe.

Obviously? What I was describing was how it's possible to target an advertisement without doing any user tracking. What the advertisers want to do and are doing is tracking users as much as they can get away with. And that includes the ad tracking company Mozilla bought.

> you're straight up lying

You are going too far in your 'pile on Mozilla' performance.

> It's meaningless data to you

I decide whats meaningless to me. Not you. Not mozilla.

Is that "obviously" true? Like if they had ad targetting and also let buyers of ads see aggregate results of impressions or something, that might already fall into user data being sold, right?

At what point does user data stop being user data? I don't think aggregation is enough in some of these discussions, but maybe I'm wrong.

> Mozilla is stopping claiming they’re never selling your data because they’ve been selling your data for the last few years.

If that's true then it sounds to me like there's some liability to sue for in California courts against Mozilla. I wonder if EFF would be interested

CCPA/CPRA has no private right of action for this kind of thing. Only the CA AG can bring forth claims, and penalties would be paid to the state, not individuals, in that case.

Most of what is collected is recorded in about:studies and about:telemetry. You can disable studies in Settings, and I think most of telemetry.

What is collected by telemetry is documented here for desktop [1].

[1] https://firefox-source-docs.mozilla.org/toolkit/components/t...

Would it have been better if Firefox/Mozilla went under as a result of never compromising on their principles for income 5 years ago, as opposed to continuing to exist in this less than optimal form today? If the business incompetence of where to put all the existing money were resolved.

I feel like the people who understand Mozilla's true principles have long since moved on by this point, and the crowd of those unaware still use Firefox as a daily driver, for better or worse. That crowd might have just moved to Chrome without Firefox as an option anymore.

Although, as I understand it Firefox and Chrome will be closer to each other in terms of 3rd-party data selling from now on with this ToS change.

> Would it have been better if Mozilla went under

Absolutely. That would have allowed Firefox to fall to better stewardship.

Mozilla died as a principled company the day they fired Brendan Eich because he had once donated to a cause they didn't agree with.

It became all about the authoritarianism of wokeness. They wasted so much money in ridiculous tangents and became extremely partisan and censorious.

It's still the best browser due to extensions and customization but it's sad to see these news making it not that better than chrome when it comes to privacy.

Mozilla had $1,006,854,000 invested at end of 2023. Drawing 5% of that annually for developer salaries would pay a lot of Firefox developer salaries, even with no incoming cash whatsoever. I'd like to believe a world exists between "Firefox is a volunteer-only effort" and "Mozilla CEO is yet another sociopath robber baron".

https://assets.mozilla.net/annualreport/2024/mozilla-fdn-202...

> the people who understand Mozilla's true principles have long since moved on by this point

Where to?

I'm really liking Orion browser, unfortunately it doesn't support Windows or Linux yet

Hasn't Mozilla gotten enough money that if they hadn't wasted it they could've been living solely off interest by now?

Yes but how could their CEO's family have possibly survived then. You don't want them and the other leadership to starve if they can't have their millions per year, do you?

$7B was not enough to be "commercially viable" it seems.

But then they would need to be given more money.

> According to CA and other states Mozilla is collecting and selling your data.

The definition requires Mozilla to do it "in exchange for “monetary” or “other valuable consideration.”". What consideration is Mozilla receiving and from who?

Personally, any application that even collects personal data is problematic for me. Personal data of a user has a value, and a large repository of personal data, of millions of users, makes the company valuable too. Any data collected can be monetised, if not immediately (as part of the company's business model) or in the future (when the company is sold).

With Mozilla, for example, displaying sponsored links using Firefox Suggest ( https://blog.mozilla.org/en/products/firefox/firefox-news/fi... ) means collecting and sharing personal data (like search keywords, browsing history or bookmarks). This data sharing, with another company, could either be the raw data or the processed data. In either case, it is a problematic issue for any privacy conscious and politically aware user because either party or multiple parties will (or can) create profiles from the data. "Anonymous" data collection doesn't have any meaning here because with enough data points from a particular user, you can reasonably identify a user (either to track them digitally or to even to identify their personhood in real life, for legal or political reasons). This is easier to do so if you also combine it with data from multiple sources. (Which is what the US NSA programs with US BigTech are doing, and why these companies are so valuable today - Data is the new oil).

I'm not sure you and they agree on the meaning of collect: If you input personal data into Firefox - e.g., an email you type in a Gmail - then they 'collect' it. Unless you use Firefox only for anonymous purposes, some data must pass through Firefox.

> With Mozilla, for example, displaying sponsored links using Firefox Suggest ( https://blog.mozilla.org/en/products/firefox/firefox-news/fi... ) means collecting and sharing personal data (like search keywords, browsing history or bookmarks).

That article says it's only opt-in, so you are safe:

As always, we believe people should be in control of their web experience, so Firefox Suggest will be a customizable feature.

We’ll begin offering smarter contextual suggestions to a percentage of people in the U.S. as an opt-in experience.

> I'm not sure you and they agree on the meaning of collect: If you input personal data into Firefox - e.g., an email you type in a Gmail - then they 'collect' it.

"They" in this context is Mozilla the organization, not Firefox the process in memory. For Mozilla to collect information, information has to leave my computer and end up on Mozilla's computer.

"That article says it's only opt-in, so you are safe:"

Funny, I never opt-in to that garbage - and yet Firefox keeps trying to auto-recommend things to me. It does this even in the Firefox Quantum mobile browser.

I don't think Mozilla is being 100% honest.

> Firefox keeps trying to auto-recommend things to me

If it's what I'm thinking, they do it without data about you ever leaving your computer. Look up how it's done - it's game-changing tech for privacy.

From their privacy policy [1]:

"we work with partners, service providers, suppliers and contractors"

But they won't disclose which partners and what Mozilla gets in exchange. Which is opaque, and probably intentionally so.

You can scroll down to the types of data and lawful bases they list for these data exchanges.

[1] https://www.mozilla.org/en-US/privacy/firefox/#how-is-your-d...

Yeah, "Calm down everyone, the only issue here is that certain jurisdictions have sensible definitions that mean we can't legally claim we're not selling data because we are" is arguably clarifying but it's not particularly comforting.

Seems safest to assume that if it can be tracked, it will be. And traded too.

If they intended to clarify wording, they would have added something in place of their original wording instead of deleting it entirely. Legal team isn't slipping like that.

Didn't they do that?

Getting $400M a year is not "commercially viable". But thanks for clearing this up that you want to sell my data. Switched to Waterfox (for now, hope for an independent fork) after 30+ years of Firefox.

There is no "independent fork," unless you consider the Chromium skins independent forks too.

This binary is known to the State of California to sell data.

> in exchange for “monetary” or “other valuable consideration.”

JFC, it's funny they try to call this out as some kind of a "weird" definition when that's just... what selling is.

I actually laughed out loud at this. “We can’t say we don’t sell your data because some places have definitions of “sell” that are legally difficult to interpret, for example”:

California was the example they chose to provide. From this, we can reasonably infer that Mozilla does not have a better example handy to illustrate what's wrong with legal definitions around selling user's data. If their best example is completely unconvincing, we should remain unconvinced.

Most people here are assuming that they mentioned that one specifically because it was one of those that Mozilla feels is too broad or difficult. It could be simply read as a random example, but I think that's quite a generous interpretation.

Usually, when I point out that Google sells your data and there’s no possible way to actually opt out, someone replies to say that’s not true, then defines “sell” in some way that most people would disagree with.

"other valuable consideration" would be what I'd consider the "transfer" of personal data (DNS lookups, browsing behavior) Mozilla makes to Cloudflare by defaulting United States users to using DNS-over-https without notice.

This is the kind of clarification we need, the same way we need actual laws so that companies can't play with the definition of "purchase" to refer to what are actually rentals.

I was under the impression that selling anonymised data would also fall under this category. Either way we need more transparency here.

By that definition, wouldn’t sharing total monthly users for the basic purpose of landing some kind of deal (could be as simple as a partnership), constitute “selling data”? Stats like X million monthly users doesn’t appear to conflict with the spirit of the claim, but does conflict with that legal wording.

What part of "we have x million monthly users" is "a consumer’s personal information"? That's information about how many consumers you have, but it's not personal

But, "we have x million monthly users _in Arizona_" would be using your personal data, from a legal standpoint. And if they provide that aggregate data in exchange for money, they are selling your personal data (but not in the way many people think of it, like in a Google/FB sense of building an individualized profile and selling ads against that).

Mozilla might be doing very sketchy things with your data, but it's also very plausible that they are doing a reasonable job at anonymization of data but in a way that is still technically classified as selling personal data (in aggregate form).

I don’t think that’s true:

Per: https://thecpra.org/#1798.145(a)(6)

> Exemptions: > (6) Collect, use, retain, sell, share, or disclose consumers’ personal information that is deidentified or aggregate consumer information.

I understand that people who have a vested interest in eroding any possibility of online privacy and data protection would want us to believe these laws are vague and overreaching - but that doesn’t mean they actually are vague and overreaching.

My mistake, I missed that the data was limited to "personal" information.

I came here to quote the same sentence and ... yeah, they shouldn't be doing any of this stuff. It's an open source web browser. I type a URL into the URL bar, you send the domain name to my DNS server, then send the rest of the URL to whatever that resolves to, and then you render the content. At no point in this exchange is any oral communication or "valuable consideration" required.

Like sorry, if your selling point is "privacy" then you can't show ads on the new tab page. Debian was onto something when they called this software "IceWeasel".

Selling access to be the default search engine could count under this definition, which was Mozilla's primary revenue source for decades.

Wait, what? What part of this definition would include selling a default setting?

> selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information

Mozilla doesn't need my personal information at all to set a default search engine.

It rents making your personal data available.

Under a loose interpretation, which is what they expressed concern about.

I hate to point out the obvious, but when you collect and share with your partners, it’s obviously a polyamorous relationship. I’m appalled at this intrusion of California on the love life of companies.

> So by that definition, if I click on your profile info here, HN is "selling me your data" no?

What monetary or other valuable consideration does HN get from you when HN serves up someone's profile page to you?

Even if they did, I doubt it qualifies if the consumer intended to post it publicly. There's a difference between selling a book that I published versus selling access to a private draft of a book that I keep in cloud storage and never agreed to let you sell.

It may be relevant that Mozilla recently acquired a Meta-created ad tracking company and is now awash with Meta ad execs. [0]

It may also be relevant that Meta is recently upsetting people in Europe for tracking and targeting people in spite of Europe's data protection rules [1].

My guess (and this is just speculation at this point) is that Meta and Mozilla think they're being clever and getting away with some "private" ad tracking and are underestimating how much damage they're doing to Mozilla's reputation.

I doubt the Anonym tech has been built into Firefox yet, but it's clear that the corporate strategic direction is to bet on some concept of "acceptable ads" like Google did in the 90s.

[0] https://www.adexchanger.com/privacy/mozilla-acquires-anonym-...

[1] https://www.reuters.com/technology/digital-rights-activists-...

Mozilla mentioned their viability in this statement, but one has to wonder how much more viable they’d be had they not wasted tens of millions of dollars on acquisitions such as this, Pocket, and of course their former CEO’s salary. I would happily donate to a company that focussed on just making Firefox and Thunderbird, but the reason why I don’t and probably will not donate to Mozilla ever again is that I have no idea what hare-brained acquisition they’ll do next.

Their mission and plan for the future is so incomprehensible that it’s probably just easier to assume actual malice.

> but the reason why I don’t and probably will not donate to Mozilla ever again is that I have no idea what hare-brained acquisition they’ll do next.

You can't donate to Mozilla Corporation at all, which is the entity maintaining Firefox and running these acquisitions. You can only donate to the Mozilla Foundation, which funds other campaigns.

> You can't donate to Mozilla Corporation at all, which is the entity maintaining Firefox and running these acquisitions. You can only donate to the Mozilla Foundation, which funds other campaigns.

The Mozilla Foundation is the parent of the Mozilla Corporation.

https://en.wikipedia.org/wiki/Mozilla_Corporation

But donations to the Foundation cannot legally be spent on the Corporation's projects, of which Firefox is one.

Which means the Corporation's profits flow upwards to the Foundation. But donations to the latter can't easily flow downwards to a for-profit.

> their former CEO’s salary

There is no indicuation that their current leadership salaries is saner and the fact that their only visibile response to the cricism has been to no longer publish saralies it should be assume that it isn't.

> it’s probably just easier to assume actual malice

The easiest assumption to make is greed and foolishness.

Dishonesty in pursuit of greed equals malice.

What is their profit or loss from Pocket?

> "private" ad tracking

My guess is that they're aiming to pivot to become a Brave competitor, and either find a new (profitable) niche in the market, or just ride the business down to collapse.

Don't forget that private, hard-to-access data is now doubly valuable as AI training data.

Facebook is sort of tech’s Enron / McDonnell Douglas.

> It may be relevant that Mozilla recently acquired a Meta-created ad tracking company and is now awash with Meta ad execs. [0]

That greatly misrepresents what the article says; really Mozilla acquired a company with a mission to get user data out of the advertising industry, which happened to be founded by former Meta employees:

Two years after leaving Meta to launch their own privacy-focused ad measurement startup in 2022, Graham Mudd and Brad Smallwood have sold their company to Mozilla. ...

Mozilla had initially been talking to Anonym, which uses privacy-enhancing technologies to build measurement and targeting solutions, about a potential partnership.

“But that quickly turned into, ‘Wow, our missions are basically the same,’” Chambers said. “We realized that together we could move a lot faster.”

That shared mission is predicated on the notion that advertising and privacy are not – or at least don’t have to be – mutually exclusive.

“We both believe that privacy-preserving technologies are a critical part of the solution to the privacy problem in digital advertising,” Chambers said. ...

Anonym also has technology that allows ad platforms and advertisers to securely share encrypted impression and conversion data within a trusted execution environment for attribution, causal lift measurement and lookalike modeling. (A trusted execution environment is the secure area of a main processor where code can be run safely and in isolation.)

To be fair, the major ad platforms have long offered attribution and measurement solutions, Mudd said. “But they required the data to come into their system,” he added. “In this world, that doesn’t have to happen.”

> Anonym also has technology that allows ad platforms and advertisers to securely share encrypted impression and conversion data within a trusted execution environment for attribution, causal lift measurement and lookalike modeling.

Wow, "secure", "encrypted", and "trusted" all in one sentence. They're trying to make it sound as reassuring as possible, but they're still doing tracking.

They're not, in fact. That's the whole point of their business. Where does it say they are tracking anyone - which means recording personal information?

"impression and conversion data", "attribution, causal lift measurement and lookalike modeling". These are all terms of art in the field of tracking user behavior: collecting information, and using it to infer what you can't collect directly.

That data only exists in encrypted form and in a trusted execution environment, based on the evidence. I mean, everything you do on the computer is also in RAM - is that tracking too?

There is no evidence of risk. A general freakout is not evidence of anything besides maybe some bad acid.

> That data only exists in encrypted form and in a trusted execution environment, based on the evidence.

First of all, please don't try to pretend that claims that the data remains encrypted and secure and only in trusted environments are claims that should carry any weight. The data cannot only exist in encrypted form. The entire goal of these systems is to mangle and aggregate the data "enough", then share that result as plaintext with the highest bidder.

> I mean, everything you do on the computer is also in RAM - is that tracking too?

No, not everything I do on my computer is tracking. Most software doesn't keep a long-term record of detailed interaction data. I don't expect my window manager to log how much time each app spends in the foreground. But even for the stuff that is logged, you should be able to understand that the real concern comes from when that information is exfiltrated from my computer, processed by a third-party, and sold.

How exactly would you suggest one looks for "evidence of risk" in this scenario? We already don't have any clear visibility into what companies do with our days (which is kind of the whole reason everyone is upset about the changes to the privacy policy that everyone is discussing here in the first place), so if a new company comes in and also starts doing _something_ with data that we also have no visibility into, we should just assume that they aren't doing anything sketchy because they didn't happen to say anything incriminating? What would you expect a company that _is_ doing something sketchy to say in this scenario? You don't think that's a company might just lie about something that they know no one can disprove?

Your "no evidence of risk" is my "no evidence of a lack of risk", and at the end of the day, I don't see any reason to blindly trust any company on their claims of being benevolent, let anyone one operating in such a historically sketchy one like adtech.

> I mean, everything you do on the computer is also in RAM - is that tracking too?

Uh... what do you mean? It's not like every programs has free access to the RAM and can just whatever that's in it, there are boundaries. Just because something exists in RAM doesn't mean it can be read, collected and analysed by someone else.

Also, data existing in "encrypted form" and being executed in a "trusted execution environment" mean nothing either. People whose goal is to collect the data can still decrypt it and read it, and a "trusted execution environment" basically means nothing if they whatever they get by analysing that data in that "trusted execution environment" is going to be disseminated to third parties who may or may not have the capability to use that data to identify you.

It's not nice to accuse people of freaking out over "maybe some bad acid". Even if it's "freaking out", in this case it's actually safer to "freak out" and avoid it than taking your ill-reasoned advice.

Ahh, the Unity game engine special.

> Whenever we share data with our partners, we put a lot of work into making sure that the data that we share is stripped of potentially identifying information, or shared only in the aggregate, or is put through our privacy preserving technologies (like OHTTP).

But if the data was fully stripped of potentially identifying information, then it should not count as "personal information" under the California Consumer Privacy Act, therefore it should not trigger the "sale of personal information" requirement, regardless of how it's transmitted or what kind of compensation is involved.

The CCPA defines "personal information" as follows:

> “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

(It also includes a list of examples [1], but the examples are conditional on the same "linked, directly or indirectly, with a particular consumer or household" requirement.)

So, which is it? Is the data deidentified or is it not?

Is Mozilla just trying to reduce risk in case someone argues their deidentification isn't good enough? If so, I'd call that a cowardly move.

[1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

How about don't send ANYONE's personal information, anonymized or not, to anyone including themselves? I think that's what people want. But that will never happen because you can't make money from it.

Nor should you make money from data transfer.

Tax this, and give the tax back as reverse income tax to individuals.

How will Sync or their VPN operate, for example?

This is about Mozilla's Terms of Use for Firefox, not Firefox Sync and Mozilla VPN. Those services need their own Terms of Use that doesn't apply to using Firefox without using those add-on services.

I dunno, if legal recommends wording for your TOS you should probably listen to them.

Then comes the question: would it also obviously expand their domain of allowable actions to trespass on their users?

Since that is a resounding "yes" and they also have the extremely obvious finance incentive to do so...

Legal is there to advise you. Sometimes what legal tells you is not in the best interests of your company. A good legal team will work with you to identify when maximal risk-averseness is not the right strategy.

A normal legal team (as opposed to a good one) will always recommend whatever is virtually guaranteed not to come back to bite them.

Yes, so you claim you can do whatever you want with everything you can get your hands on and then social media blows up because it's batshit insane, but don't worry because you're _legally in the clear_.

You're acting like they didn't have the 2nd option of just not selling the data so the current wording is accurate...

On the other hand, if legal recommends that they reword their TOS, their users also should probably listen to them.

> You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox.

You don't need a license for data you never see. When I use Firefox to type a comment on HN, that comment goes from me to HN. It doesn't go to Mozilla. Mozilla does not need a license. (And no, Firefox doesn't need a license either, because licenses are granted to people and organizations, not software.)

The only possible reason for Mozilla to need a license to the data I type into Firefox is if Mozilla intends to have Firefox send that data to them.

Right. Some people want Sync, Pocket, oneline translation, etc. Others like me just want a browser. There should be a simple option to choose between a browser and some multifunction beast that some people and even more managers at Mozilla are dreaming of.

Those things are Mozilla services. If they spoke of operating Mozilla services and data you input into Mozilla services, it'd be fine and expected. But instead they speak of operating Firefox and data input into Firefox, which is much more broad, and just happens to give them coverage for all kinds of data collection and abuse.

The fact they've issued this update and not clarified the scope as Mozilla services is disturbing.

Thanks for the terminology clarification. So ideally the services would be used by an extension that users are offered to download. Next best would be a simple choice do you want any services or not. If yes, all of them or customize.

I thought they removed the reference to Firefox?

From TFA:

> Here’s what the new language will say:

> You give Mozilla the rights necessary to operate Firefox. This includes processing your data as we describe in the Firefox Privacy Notice. It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox. This does not give Mozilla any ownership in that content.

They're still broadly referring to "Firefox" with alarming language.

Thanks.

> They're still broadly referring to "Firefox" with alarming language.

"alarming" is a low standard - people get alarmed because they see everyone else throwing a fit.

They say it's only for "doing as you request with the content you input in Firefox" - how is that alarming?

> They say it's only for "doing as you request with the content you input in Firefox" - how is that alarming?

Nothing that I intend to do with Firefox requires any such statement. The mere existence of the statement is evidence that Mozilla's intentions are drastically out of line with what a web browser should be doing.

> Nothing that I intend to do with Firefox requires any such statement.

So what? Millions of people use Firefox. Lots of things in Firefox and their ToS don't apply to me, of course. None of my personal info will be collected at all, based on what I've read.

Mozilla is telling you they can collect the data. Whether or not they are right now is not relevant. Mozilla is informing you that you have agreed to them collecting all of this data. They now have the right to collect and transmit said data at any point.

"There should be a simple option to choose between a browser"

Less money, not going to happen.

While I agree with folks that this is a step backwards in privacy, I think it’s a good exercise to zoom out and understand Firefox’s position.

The browser market is highly competitive, and Mozilla’s competitors have orders of magnitude more resources at their disposal. As we all know Firefox’s market share has been dropping over the past years and unfortunately the revenue supporting all of Mozilla comes predominantly from their Google deal (which itself has been risked by the ongoing case against Google)

Unfortunately as well - unfortunate for Mozilla, but fortunate for its mission and users :) - the Mozilla corporation is wholly owned by the foundation, so there is no easy way to raise funds (donations amount to so little compared to its Google revenue). Given no access to traditional fundraising, Mozilla has limited options on sustaining its business.

All this is to say, Mozilla seems to be trying to diversify its revenue hard, and its previous on-brand attempts (Firefox OS, VPN, etc) haven’t yielded the return they expected from them, so I’m not surprised Mozilla is trying to make money off of ads and selling data. I disable data collection, though if it came to it, I trust Mozilla a tad bit more than its competitors to protect my data - initiatives like ohttp give me a sign that at least they’re trying

Mozilla were pulling in ~$500M/year on those search deals. So on year one, spend $15M on a team of 20+ highly competent full time developers for Firefox, put $450M into a trust to fund future development, and find something to waste $35M on. Then for the next 15 years, find something to waste $500M on.

The amount of money they've squandered is mind-boggling. If their goal had been to develop Firefox/Thunderbird/Mozilla Suite, and they had focused on how to sustainably do that, they never would've needed to diversify income sources.

Yes, this is how I see it, too. They’ve been operating as if their money hose from Google was (a) infinite and (b) cost-free. Turns out neither is the case, and now they’re dependent on it Google owns them.

They could have funded Firefox development for the next 100 years but they’ve pissed it away, and now they’re selling us out. It’s gross.

They've not developed the suite for... between 15 and 20 years I believe; and Thunderbird for over 10 years. For the past several years, Thunderbird is back under the MZLA Technologies Corporation, but - it is funded by donations (and doing rather well in that respect it seems).

So - Firefox is the "only" thing they need to develop.

>spend $15M on a team of 20+ highly competent full time developers

Implies that the browser is the mission, not some social cause is the mission

It implies maintaining the browser would better fund the mission in the long run than selling user data to adtech now as the user count continues to decline.

Google pays Apple 18 billion dollars per year to be the default search engine on Safari. If Firefox had managed to stay just as popular imagine how much more money they'd have been making on search deals these last 5 years and how much of that could have went to whatever mission they wanted. Instead they've got a whole lot of noise adding up to about nothing for income + a much smaller search deal than they should have. That's why "having a social mission" isn't inherently the issue, it's all about the management around balancing how the investment for the social mission is done.

I think GPs numbers are off by an order of magnitude or so though. I remember reading something like Mozilla spending 200 million/year on software development (not all Firefox) so it might take 300+ million/year just on Firefox to really have a big impact from status quo. Someone with the real numbers is invited to correct me on that. Browsers have huge teams of people, even Ladybird is using large components like Skia developed by other browser teams.

Firefox can't compete with iOS or Android for what should be obvious reasons - it is structurally impossible. Also, the competing browsers are way better today than in Firefox's heyday. There is very little reason to use Firefox today outside of ideological.

Firefox (and its derivatives) is swiftly becoming the only place you can run full uBlock Origin. That's a good reason right there.

Ignoring adblock, I think you could flip it. Chrome and Firefox are basically interchangeable, so if there's little reason to choose Firefox, there's also little reason to choose Chrome.

This is exactly it, millions spent on the product, but no noticeable changes? The money is going elsewhere.

Wikipedia is doing the same.

If they've had any non-code projects that had costs in the millions, they were catastrophic failures, so they shouldn't have had such a mission.

Their weird org structure is their own fault. Millions of dollars squandered on things most people simply do not care about, while neglecting Firefox for a decade.

When Firefox/Firebird/Phoenix first came out, the org structure wasn't that weird yet. The hybrid structure came a few years later, and even then it was fine for a while, but somehow mission creep set in and they became this ginormous org that did nothing useful, but padded exec salaries at the expense of their only service that people actually cared about, the Firefox browser. They kept adding more and more ads and intrusive partnership and lost marketshare year after year until it became completely irrelevant.

Meanwhile, the Mozilla org tried to become some sort of EFF-wannabe, but heavy on the virtue signaling and low on producing anything of actual value.

At this point, I think Firefox would be better off spun off and managed by another FOSS entity altogether, not whatever the husk of Mozilla is today.

I too wish they would have spent money only on the improving the browser, obvious things like sync, and probably web standards, that's all they really need to do. They don't need to be doing stuff like "social equality" or web DEI or any of that. They don't need to be dabbling in a dozen side businesses.

"donations amount to so little" is very misleading stated like that because Mozilla just doesn't give us any way to donate to Firefox development or even just their FOSS efforts in general. Mozilla is one of the very few companies I've donated to even when I had little in the way of discretionary income, and is one of the first options people think of when they think of FOSS software they want to donate to. But then I learnt that any donations like this are highly unlikely to be spent on the software we're donating it for, and at that point I might as well donate to a random local charity instead.

I'm not gonna claim that donations would have rivaled the Google revenue otherwise, but they will certainly be many many times higher than what they are. Lots of people are willing to and even want to set up a regular donation to Firefox as the lone non-Chrome bulwark in the FOSS space. There would have been grassroots efforts to get more people to donate on the regular, hell I would have put in serious work on such efforts if we actually had a way to donate to keep Firefox alive and healthy.

It doesn’t help that they make it hard to donate to a specific product’s development. I’d donate to Firefox. I wouldn’t give a penny to anything of their other distractions.

(And others would support exactly the opposite, I’m sure. But no one gets to sponsor what they personally care about.)

(Would others? I don't think I have ever seen anyone defend that part of the equation. With Wikipedia's similar insanity--begging for donations to keep their servers on when they don't spend the money on that--I have at least seen some people who like what they do spend their money on as important to them, but I don't think I have ever seen anyone actively want to donate money to Firefox's random side projects instead of Firefox.)

You don't need to go far. Just look at the Thunderbird. People are donating to support it.

I believe saurik is talking about Mozilla's spending on "advocacy" and other non-product causes, not actual products like Thunderbird. While there are a few actual products other than Firefox (like Thunderbird), most of the "distractions" kstrauser speaks of are of a much less tangible nature that basically amount to "whatever catches Mozilla management's fancy that month".

Probably not, but you know if I left that out, someone would claim the opposite just for contrariness.

Reasonable people want people running the product they love to succeed, too. But when the equation involves obscene executive salaries, back tracking on _promises_, terrible decision that lost money, and overall just too much money to justify what's being done. The end result is what you see now: a lot of upset people and there is nothing _unfortunate_ for Mozilla.

I have a lot of trouble seeing what you are trying to defend here -- I really tried but couldn't. I find it pretty hypocritical to say that you disabled data collection while you trust them over your competitors to protect your data -- so you are saying that you trust them but you won't adjust your bottom line to help them succeed anyway?

I really mean well: sometimes you just shouldn't try to appear to be reasonable to a situation that isn't, it actually makes things worse for everyone. I used to do that and have learned some hard lessons.

> donations amount to so little compared to its Google revenue

“Interesting to note that the Mozilla CEO earned nearly as much ($5.6 M) as Mozilla received in donations ($7 M)” [1].

[1] https://lunduke.locals.com/post/4387539/firefox-money-invest...

> The browser market is highly competitive

And that's exactly the problem: treating it like a market. I don't want browsers to be a competitive market, in the same way that I don't want libraries, primary schools, firefighters or healthcare to be a competitive market.

In modern society, they're essential needs, which need to stop catering to the capitalist overlords and need to focus on the needs of the many.

But that ignores the reality. Chrome is implementing new (often privacy harmful) features and because the Chrome market share is high enough websites depend on them. Then the average user has to pick Chrome because "Firefox is broken".

The network effects between website and viewers make the market real and failing to gain a significant market share results in you effectively being cut out and failing to serve the needs of most of your users (unless you can match Chrome's insane pace of development bug-for-bug).

Firefox isn't broken, I literally use it all day long as my browser for work and home usage. Rare occasions I pull out brave, maybe once a month, for something that has an issue, and usually that's not it, it's an extension or something.

I also use it almost exclusively, but sites that don't support it (or more often that just don't test against it and have various broken features) are becoming more common. As the market share shrinks this will become more and more common.

> The browser market is highly competitive

I disagree. There's one dominant player with ~66% of the market, a distant secont place at ~18%, an embarrassing third place at 5%, and then a bunch of also-rans making up the rest [0]. This doesn't look like a particularly healthy, nor competitive, market.

[0] https://gs.statcounter.com/browser-market-share

I wonder how much success would have some subscription option (at least for small amount) like maybe $5 per year?

would that be more than my data are worth?

I really like Firefox and u would like it to improve over time and as this is one of my main tools for my work I could consider to spend a little on it

Or, hear me out, surprising, crazy, I know: Sell the browser!

Opera did that for a while, but in a different era. I'd pay for Firefox today though, just to keep someone fighting Google's vision of the Internet (ugh) alive. :/

> It also includes a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox.

I really struggle to understand what legal team believes this language is necessary in downloaded software. There is a lot of precedent for this kind of language in online hosted services, but not downloaded software.

> This does not give Mozilla any ownership in that content.

Yes, it’s a license. Nothing changes. There is no ambiguity about ownership in a perpetual nonexclusive worldwide license, but this doesn’t explain why this license is suddenly necessary now and wasn’t before.

Clearly the legal team at Mozilla is struggling with multiple issues in this update. Why are these changes being made now, and what is driving them?

Others have discussed the data sale issue, but I don’t see a reasonable explanation for the license issue, and the changing text doesn’t inspire confidence.

> I really struggle to understand what legal team believes this language is necessary in downloaded software.

Exactly. Even if nothing is changing at Mozilla, their legal team has invented a new interpretation of copyright law. That’s a huge deal from a legal perspective—Apple, Google, Microsoft, etc need to be rushing to add corresponding terms to their applications.

Mozilla PR is dropping the ball completely by trying to sweep this under the rug as ‘standard legal boilerplate’ because it’s not a clause in any other application I’ve ever seen.

Since I use FireFox at work, I don’t even have permission to give Mozilla a license to the content I create on the clock, so I will be switching browsers.

Switching to what? Honest question, not asking for a friend.

Not OP, but we had a waterfox thread yesterday: https://news.ycombinator.com/item?id=43205110

I switched to https://librewolf.net/

Is it a reputable project? What credentials does it have?

Well it's part of the Debian Main-repo, FreeBSD-Ports, FlatHub and brew on MacOS:

https://librewolf.net/installation/

It does not seem to be part of the official Debian repositories; searching for librewolf returns no results: https://packages.debian.org/search?suite=default§ion=all...

They have their own external repository indexed by extrepo, but "no warranty is made by the Debian project as to the security or quality of the software in these third-party repositories."

Both of your examples are cloud services, not software run locally on users' own hardware. If they intend the license to be limited to cloud services like Firefox Sync, then they should say so.

You can't download Google.

They have for example recently added AI chat sidebar via Firefox Labs. So in effect, the browser itself is collecting and sending information to third parties. And I imagine Mozilla is or will get some money for these integrations. I would guess this is how they will try to diversify their income away from Google Search integration.

Of course the question then shifts to, do we need AI in the browser sidebar?

> This does not give Mozilla any ownership in that content.

I actually disagree, fundamentally.

This is digital content, so "ownership" isn't the same as for physical stuff.

Lets look at analogies: "piracy isn't theft" (because the original owner still keeps their copy!). Also, surely if Mozilla can sell your data, they must have owned it first! But you also keep your data!

So clearly, to "own" digital stuff is different from "owning" physical stuff.

Then, how do we define "own" for digital stuff? I'd say a sufficient definition would be, "possess and can do whatever".

So when Mozilla says "nonexclusive, royalty-free, worldwide license [...] necessary to operate Firefox", and then in subsequent paragraphs argue that selling ads is necessary to operate Firefox... Yes, we can add two and two together.

Now, apologists will claim that the literal statement in new terms is "nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content you input in Firefox", but obviously, the DO NOT NEED A LICENSE for doing as you request in Firefox (i.e. sending POST requests directly to third parties), so clearly there's some shady business involved.

> not downloaded software

Tbf, any softwares that send your input to an external (like browsers...) should disclose like this too. The thing that sends those data is your software, not you. Otherwise, after you click on the button "Purchase" with your credit card information, the only way to not grant your software the rights to send that information is you driving to the stores and give them your credit card by yourself.

The problem here is that Mozilla has used language that is what you'd expect if the browser is sending data to Mozilla; there's no need for such language if the browser is acting purely as a user agent and sending data to the address you put in the URL bar.

Yeah, legal words are frustrating like that. When the law comes to their house, using "acting purely as a user agent and sending data" will just help them on reddit but not on court. And no, you don't always send the data to the "address in URL bar", there can be services that are in iframes or with other add-on services like their Pocket, VPN, AI chats (ChatGPT...), similar to any client softwares sending data to other services that are not their own.

That's why they use these words, which actually can include more activities inside browser

> for the purpose of doing as you request with the content you input in Firefox.

There's a reason I won't interpret serious things by myself if I face legal entities without a proper lawyer.

I feel like you're deliberately ignoring the crux of the issue: a web browser's job does not require anything remotely resembling a copyright license from the user to the browser vendor.

Yes, Mozilla has been developing and acquiring a host of other services, many of which do involve Mozilla taking possession of user data and processing it. Those services need legal policies that cover Mozilla doing stuff with your data. A web browser does not, because the vendor of the web browser does not need to know what you're doing with your copy of the browser.

Mozilla the legal entity that can be the recipient of a nonexclusive, royalty-free, worldwide license is not the same as Firefox with PID 3808 on my machine. PID 3808 does not need, and cannot need, and cannot receive a nonexclusive, royalty-free, worldwide license to anything. PID 3808 is not a legal person. This fundamental distinction between code I'm running on my machine and services provided by Mozilla is why the legal terms of use for Firefox should not be lumped in to the same document as the terms of use for Mozilla's various services.

Mozilla the legal entity does not need a nonexclusive, royalty-free, worldwide license to the comments I post to HN using my copy of Firefox, any more than Netgear the legal entity needs a license to those comments because a Netgear box is transmitting those packets.

> a web browser's job does not require anything remotely resembling a copyright license from the user to the browser vendor.

Yes, I know that, you know that, we all know that. This has always been our implicit agreements between us and the softwares. The thing is, are you sure your argument would help Firefox and Mozilla in the court? Can you be Firefox' lawyers when other legal entities approach them nowadays? I don't see any laws that specifically allow those implicit agreements automatically in browsers. Like Epic founder said:

> The license says that when you type stuff, the program can use the stuff you typed to do the thing you asked it to do. This is what programs ordinarily do, but nowadays lawyers tend to advise companies to say it explicitly.

https://x.com/looking5452/status/1895458253854711854

Firefox is made by Mozilla Corporation (https://www.mozilla.org/en-US/firefox/faq/), the codes that run the browser are made by Mozilla Corporation, a taxable subsidiary of Mozilla Foundation. It integrates other services like Password Manager (which includes "Alerts for breached websites" feature), Autofill payment method, Deceptive Content and Dangerous Software Protection, Query OCSP for certificates validation, DoH, DRM, their up-coming AI Chats... All of these would potentially be targeted in legal confrontations. And where would those legal disputes be sent to? Mozilla Corporation, even when those activities are in your Firefox PID 3808. The activities do not limit in just sending data.

If I just make a program for myself or for others but without any big entities behind, I won't need to think about anything. But if my program is backed by a taxable company, any implicit agreements between my program and other users would leave legal concerns for me and my company for sure.

why can't they let you opt into those services and agreements at the opt in part? There's a middle ground they are completely ignoring. The only way around it is to install a fork of firefox that doesn't have any of it.