Hello,
some time ago I read about a creepy feature [1][2] of Mozilla Firefox that
seems to be enabled by default and can only be disabled in the advanced
configuration page (about:config).

[1] http://www.zdnet.com/blog/hardware/firefox-and-thunderbird-phone-home-daily/2143
[2] http://cybernetnews.com/yes-firefox-does-phone-home-everyday/

It seems that Firefox sends a bunch of user data (including IP address,
used browser version, browser usage times, number of users and list
of enabled extensions) to a Mozilla-Foundation-controlled server.
Daily!

It seems that this is used to disable extensions which are deemed to
be "dangerous" by Mozilla. But I think that this poses at least two issues:

 * the user should not be silently induced to trust Mozilla on which
   extensions are OK and which are "dangerous"

 * the data sent to Mozilla seem to be unnecessarily detailed and thus
   are a privacy issue (after all, the same purpose could be achieved
   by _downloading_ a list of "dangerous" extensions from Mozilla,
   without _sending_ any data to them!)

Hence, I am convinced that this feature should be disabled by default
in Debian's Iceweasel, unless the user explicitly re-enables it.

This feature is reportedly controlled the about:config
extensions.blocklist.enabled value (true enables the feature,
false should disable it).

Now, I checked in Iceweasel's about:config page and it seems to me that
the extensions.blocklist.enabled value is in its default state, that is
"true". This is confirmed even when starting Iceweasel in safe-mode.

Please modify Iceweasel so that this creepy feature is disabled by default
and can be re-enabled only when the user explicitly decides to so desire.

Thanks for your time!
Bye (and season's greetings).

(Zack, question for you at the end)

No list of extensions is sent.

They should be instead lured into installing malware.
No list of extensions is sent to Mozilla. The only information sent is:
- APP_ID
- APP_VERSION
- PRODUCT
- BUILD_ID
- BUILD_TARGET
- OS_VERSION
- LOCALE
- CHANNEL
- DISTRIBUTION
- DISTRIBUTION_VERSION
- PING_COUNT
- TOTAL_PING_COUNT
- DAYS_SINCE_LAST_PING

Only the first two are strictly required. APP_ID is
{ec8030f7-c20a-464f-9b0e-13a3a9e97384} (the guid for Firefox),
APP_VERSION is self describing, PRODUCT is "Iceweasel", BUILD_ID is the
BuildID found in /usr/lib/iceweasel/application.ini, BUILD_TARGET is
roughly `uname -s`_`uname -m`-gcc3, OS_VERSION is roughly `uname -sr`,
LOCALE the locale the UI is in, CHANNEL is "default", DISTRIBUTION and
DISTRIBUTION_VERSION come from preferences (resp. distribution.id and
distribution.version, both currently not set), PING_COUNT is the number
of times the blocklist has been downloaded from the same version of the
application, TOTAL_PING_COUNT is the number of times the blocklist has
been downloaded ever (with the given profile), and DAYS_SINCE_LAST_PING
the number of days since last time the blocklist has been downloaded.
The IP address is thrown away and replaced with a geographic location (I
think it's only the country)

I'm not very much concerned by this kind of data being sent by default,
first, because it doesn't expose much of anything, and second, because
the server-side code is also open-source.

https://github.com/mozilla/zamboni/blob/master/lib/urls_base.py#L24
https://github.com/mozilla/zamboni/blob/master/apps/blocklist/views.py

Hence, I am not convinced this feature should be disabled by default,
especially since this is a useful malware protection (and yes, it's
pretty easy to encounter such malware, there have been some spreading
through facebook a few months ago, for instance).

Arguably, we could remove most of the information sent, but I'm not
convinced either. But then, I could be seen as biased, since I'm also a
Mozilla Corporation employee. So I'll defer the decision to touch the
downloaded url to someone else. Which makes me wonder, do we have
specific people in Debian dealing with such privacy concerns?

Mike

On Wed, 2 Jan 2013 08:25:21 +0100 Mike Hommey wrote:

[...]
[...]

Mike, first of all thanks a lot for your prompt response.
That's really appreciated, indeed.

The fact that no list of extensions is sent is a (partial) relief,
thanks for clarifying.
Mozilla Corporation is doing anything nasty with the few data which are
silently sent to them.
I am implying nothing of the kind.
I apologize, if I was not clear enough on this.

It's just that, being a bit paranoid, I am always suspicious about
programs that phone home.

And I think that Debian users should *not* be forced to trust Mozilla
Corporation without even being informed about this "feature"...

This is less creepy than depicted, then.
Thanks again for clarifying.

Well, then I wonder why the other information is sent at all...

[...]

I am under the impression that some partial info about usage habits
may be inferred by the three *PING* values.

[...]

That's true, but, once again, users must trust Mozilla Corporation
that the publicly known server-side code is actually what is being
run by the Mozilla-controlled server.

I guess it actually is, I have no special reason to think that Mozilla
Corporation is telling lies, but, nonetheless... believing this
requires trusting Mozilla Corporation, something that not all Debian
users are necessarily comfortable with...

I personally try as much as possible to avoid installing extensions
from within Iceweasel for my regular user: I strongly prefer to install
packaged extensions for the entire system through aptitude.
But I acknowledge that several users will sure install extensions
from within Iceweasel.

Hence, I am *not* saying that this may not be a useful malware protection.
Indeed it may be.
But users must trust Mozilla Corporation that it will not be abused for
nasty purposes.

That's why I think it should not be *silently* enabled by default
and buried in some obscure about:config setting.

I hope I clarified my opinion.
Thanks for understanding.

[…]

Not that I'm aware of, unfortunately.  (I've been thinking for quite a
while about encouraging the formation of a "debian privacy team", that
could have a cross-cutting view on privacy issues in stock Debian, but I
don't think we have anything close ATM.)  I'd suggest contacting the
security team, as a potential approximation. Also, discussing this with
the popcon maintainers might be useful, given they have surely faced
similar issues in the past and might have developed a useful "culture"
on the matter.

FWIW, I did find your explanation of what is sent quite reassuring. But
I'm still torn between the need of defending users against malware-ish
extensions and the need of not doing anything that might remotely
resemble "phoning home" by default.

Not sure if I've helped much...,
Cheers.

src:iceweasel has been superseded by src:firefox-esr in version
45.0esr-1 in March 2016. Transitional packages to ease upgrades were
provided in the wheezy, jessie, stretch and buster releases. The
transitional packages have been removed finally before the bullseye
release in August 2021.
After regular security support for buster ended in August 2022 and LTS
support ended in June 2024, I'm closing the remaining bug reports now.

Andreas