I don't think that makes it better. Knowing that there's a way to get an addon installed invisibly is going to be more justification for paranoia.

There almost certainly is not a way to invisibly install add-ons, unless you are part of Mozilla, and, you know, making Firefox. If paranoia is your thing, it might be worth considering that Mozilla can do anything it wants inside Firefox core, all of it is "invisible" to you.

And this is the point where even the most Mozilla-supporting users move away. For me, this is it, I’m going to Chromium.

Fuck this shit, in the past months we had CliqZ https://news.ycombinator.com/item?id=15421708, we had Mozilla adding new telemetry, we had Mozilla force-enable toolkit.telemetry.enabled, we had Mozilla say that, if you download Nightly, that is considered opt-in to tracking, we had Mozilla put Google Analytics into the Addons menu (because it’s loaded from addons.mozilla.org: https://github.com/mozilla/addons-frontend/issues/2785 ), and we had Mozilla say that, if we don’t trust Google, we shouldn’t use Firefox.

Fuck this.

Regarding telemetry, take a look at the settings in about:config. There are several toolkit.telemetry.Ping settings which are set to true by default. In the spirit of charity I'm going to assume that those phone home pings - on startup, shutdown, update - are not enabled unless telemetry is enabled. But I have not checked...

Alternatively you can give waterfox[1] a try.

Features

    Disabled Encrypted Media Extensions (EME)
    Disabled Web Runtime (deprecated as of 2015)
    Removed Pocket
    Removed Telemetry
    Removed data collection
    Removed startup profiling
    Allow running of all 64-Bit NPAPI plugins
    Allow running of unsigned extensions
    Removal of Sponsored Tiles on New Tab Page
    Addition of Duplicate Tab option
    Locale selector in about:preferences > General

[1]: https://www.waterfoxproject.org/

Great points, thanks for compiling these..

I was using firefox because I don't trust google. ;(

Yes and a big part of this entire issue is users deciding whether we can trust Mozilla with that power or not.

And he's saying that this occurence should have no effect on this decision, not in any rational mind.

You can disable these studies under Options | Privacy and Security

I hate the fact that Firefox increasingly makes me jump through all sorts of hoops to find all the hidden options to turn off their various spyware attempts. Its the Win10 of browsers...

There's an extension for that called privacy settings[1] it exposes all the settings in one easy place.

I also recommend waterfox instead of firefox.

[1]: https://addons.mozilla.org/en-US/firefox/addon/privacy-setti... [2]: https://www.waterfoxproject.org/

Yeah, its so intuitive for the average person to type: about:config in address bar and scroll through hundreds of oddly named parameters to turn off spyware.

Comments like yours are illustrative of a certain mindset. When you encounter the complexity of domains you are not intimately familiar with (court system, law, finance, etc), and those complexities are designed specifically to make it hard for you to protect yourself, I'm sure you are just as understanding as you are now.

You're being hyperbolic, you don't need to go into about:config.

It's right in the main browser settings, under the Privacy and Security section where one would expect settings like this to be

If what you say is true, please point me to where I can find the following privacy settings in the main preferences:

  network.websocket.enabled
  network.IDN_show_punycode
  dom.event.clipboardevents.enabled
  dom.storage.enabled
  dom.indexedDB.enabled
  dom.battery.enabled
  dom.enable_user_timing
  dom.enable_resource_timing
  dom.netinfo.enabled
  layout.css.visited_links_enabled
  browser.safebrowsing.phishing.enabled
  browser.safebrowsing.downloads.remote.enabled
  browser.safebrowsing.malware.enabled
  browser.send_pings
  beacon.enabled
  privacy.donottrackheader.enabled
  privacy.trackingprotection.enabled
  dom.enable_performance
  datareporting.healthreport.service.enabled
  datareporting.healthreport.uploadEnabled
  toolkit.telemetry.enabled
  toolkit.telemetry.unified
  media.peerconnection.enabled
  media.peerconnection.ice.default_address_only
  media.peerconnection.ice.no_host
  media.eme.enabled
  media.gmp-eme-adobe.enabled
  webgl.disabled
  geo.enabled
  camera.control.face_detection.enabled
  device.sensors.enabled
  security.tls.unrestricted_rc4_fallback
  security.tls.insecure_fallback_hosts.use_static_list
  security.ssl.require_safe_negotiation
  security.ssl.treat_unsafe_negotiation_as_broken

Errr... is "dom.enable_performance" really a privacy setting?

Doing someone online searching now, not seeing an explanation for it. There is one other HN post though, also mentioning it in a privacy context, but not further info either. :/

> It's right in the main browser settings, under the Privacy and Security section where one would expect settings like this to be

If you asked me "where would you go to change settings to prevent the browser from violating your privacy and infringing on your security?", then, yes, I would go to "Privacy and Security". If, however, you asked me "what would you expect to find under 'Privacy and Security'?", my answer would be that that's where I would go to protect myself from malicious websites, not from malicious browsers.

(I know that 'malicious' is quite, and almost certainly too, strong here, but the point is that I think, and am explicitly encouraged to think, of Mozilla as being on my side against the sites I visit, and I don't think it's natural to expect that I will start thinking of how I need to protect myself from Mozilla to use their products in the way that I, rather than they, intend.)

How are you supposed to do turn the defaults to a reasonable level of privacy without launching Firefox once though?

I remember it was asking if I want participate in studies when I installed FF for the first time.

It is.

You should opt in, not opt out

Preferences/Options -> Privacy and Security -> Allow Firefox to install and run studies

that would be worse

How exactly? Whether they push out code to you by just changing the binary or by installing an extension makes no difference. In fact, pushing it out as an extension, means they actually have less control over your browser, because are bound to the restrictions that extensions have.

Every browser vendor has this control over you when you use their browser. Some have even more, because they don't even need to tell you about it when they're closed-source.