View previous topic :: View next topic |
Author |
Message |
saturnalia0 Apprentice
![Apprentice Apprentice](/images/ranks/rank_rect_2.gif)
![](images/avatars/19791609105969a61f063a3.jpg)
Joined: 13 Oct 2016 Posts: 156
|
Posted: Mon Jul 15, 2024 3:11 pm Post subject: Firefox patches and privacy? |
|
|
I've recently read this blog post about a dubious opt-out feature added to Firefox 128 (current version in Gentoo):
https://blog.privacyguides.org/2024/07/14/mozilla-disappoints-us-yet-again-2/
I'm a user of firefox-bin so I don't expect it to be patched in any way, so I simply disabled it.
I was wondering, does Gentoo have any opinionated patches to www-client/firefox, like enabling or disabling certain features for privacy reasons?
Looking at the ebuild I see things like --disable-crashreporter and --disable-gpsd, though I'm not sure what the motivation is as the git history is a bit hard to navigate (can't simply git blame on those lines as a new file is created for each version, plus the history is very large). |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
CooSee Veteran
![Veteran Veteran](/images/ranks/rank_rect_5_vet.gif)
![](images/avatars/116667693650fadeb419aaa.jpg)
Joined: 20 Nov 2004 Posts: 1465 Location: Earth
|
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
Juippisi Developer
![Developer Developer](/images/ranks/rank-dev.gif)
![](images/avatars/807759109442827505b55d.gif)
Joined: 30 Sep 2005 Posts: 744 Location: /home
|
Posted: Tue Jul 16, 2024 6:03 am Post subject: Re: Firefox patches and privacy? |
|
|
saturnalia0 wrote: |
I was wondering, does Gentoo have any opinionated patches to www-client/firefox, like enabling or disabling certain features for privacy reasons?
|
Not at the moment and I'm personally very much against trying to maintain these on distro-level. I have tons of settings from https://github.com/arkenfox/user.js in my profile, and I still carry some custom-patches in /etc/portage/patches. But the more patches we add on a distro-level the harder maintaining Firefox becomes. Something breaks _every_ release, and it often takes hours just to update the current patches we're carrying. In fact I'd really like to get as close to upstream "vanilla" builds as possible. The browser development is just getting faster and faster, and the codebase more complicated. That's why it's hard to keep up and I'm _very_ reluctant adding any custom-patches that can't be upstreamed.
What I like about Firefox though is they give you the option to configure these settings. Even with this adtech mess, you can opt-out either from graphical settings or about:config. If I/we were to meddle with these settings from the ebuild, we'd have to print some message saying "these options have been set - check whether you want to change them" polluting the postinst log. People who care about that stuff, will find the settings they can change. Oh and the "telemetry" use flag does massive work on its own already - again, glad Mozilla gives this option when building Firefox.
Quote: |
I see things like --disable-crashreporter and --disable-gpsd,
|
I don't know if you threw these two just as examples or if you're really curious about them, but:
I think crashreporter depends on gconf2 that was somewhat recently removed from Gentoo. Also if I remember correctly it depends on dbug being enabled (which makes sense when you think about it). Mozilla is working on rewriting the crashreported in rust, so when that's finished it can most likely be enabled in the ebuilds. Maybe. There could be some historic reason to disable it since we may introduce some Gentoo-only bugs with our builds.
gpsd depends on libgps which - to my knowledge - has never been available in Gentoo. It uses libgps to track geolocation. But Firefox uses, and has used, built-in geoclue (I think it's built-in?) for ages now. gpsd might be a legacy thing that no one removed from the codebase, even though it's not used anywhere. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
kimchi_sg Advocate
![Advocate Advocate](/images/ranks/rank-G-1-advocate.gif)
Joined: 26 Nov 2004 Posts: 3038
|
Posted: Tue Jul 16, 2024 6:17 am Post subject: Re: Firefox patches and privacy? |
|
|
Juippisi wrote: | In fact I'd really like to get as close to upstream "vanilla" builds as possible. The browser development is just getting faster and faster, and the codebase more complicated. That's why it's hard to keep up and I'm _very_ reluctant adding any custom-patches that can't be upstreamed.
|
Thank you for trying to keep up with upstream... the amount of stuff going on inside the firefox ebuilds is quite the eye-opener. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
Hu Administrator
![Administrator Administrator](/images/ranks/rank-admin.gif)
Joined: 06 Mar 2007 Posts: 22546
|
Posted: Tue Jul 16, 2024 2:32 pm Post subject: |
|
|
With regard to patching and the maintenance burden it carries, I will note that Gentoo already applies through the ebuild quite a few default-preferences. However, since these are written to a dedicated file, if one of them goes obsolete, it will just silently stop working instead of breaking the build. I like that someone else has done the work of researching what preferences a privacy-oriented individual would want. I would prefer that there be an easy way to pull all that into Firefox, so that I can get equivalent changes on all the systems I maintain, but I recognize that supporting that - and deciding on exactly which preferences to include - could be a notable burden. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
pjp Administrator
![Administrator Administrator](/images/ranks/rank-admin.gif)
![](images/avatars/1154772887439692d88303b.jpg)
Joined: 16 Apr 2002 Posts: 20453
|
Posted: Tue Jul 16, 2024 3:04 pm Post subject: Re: Firefox patches and privacy? |
|
|
Juippisi wrote: | People who care about that stuff, will find the settings they can change. | Awareness is the main blocker there, but I can appreciate the patch burden. That they've decided to remotely change user settings is disturbing. _________________ Quis separabit? Quo animo? |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
Juippisi Developer
![Developer Developer](/images/ranks/rank-dev.gif)
![](images/avatars/807759109442827505b55d.gif)
Joined: 30 Sep 2005 Posts: 744 Location: /home
|
Posted: Wed Jul 17, 2024 5:55 am Post subject: |
|
|
Hu wrote: | I would prefer that there be an easy way to pull all that into Firefox, so that I can get equivalent changes on all the systems I maintain, but I recognize that supporting that - and deciding on exactly which preferences to include - could be a notable burden. |
/etc/firefox/syspref.js should be closest to achieving that in a safe location. You then deliver/control the file with same tool you control all these instances. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
lars_the_bear Guru
![Guru Guru](/images/ranks/rank_rect_3.gif)
Joined: 05 Jun 2024 Posts: 500
|
Posted: Wed Jul 17, 2024 7:44 am Post subject: Re: Firefox patches and privacy? |
|
|
pjp wrote: | That they've decided to remotely change user settings is disturbing. |
Have the Mozilla folks just set the controls for the heart of the Sun now?
My gut feeling is that the many (most?) people who use Firefox on a regular basis do so because they don't really trust the underhanded behaviour of the alternatives. I don't know how big a problem this PPA thing is, because I don't really understand how it works. The fact that it was sneaked in, accompanied by the patronizing attitude of the Firefox developers ("You wouldn't understand it even if we told you") has to make it a cause for concern.
This is just one in a history of worrying changes in Firefox. Assuming that everybody uses pulseaudio, and assuming that everybody uses NetworkManager are other examples. I've always supported Mozilla but -- good grief.
BR, Lars. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
sMueggli Guru
![Guru Guru](/images/ranks/rank_rect_3.gif)
Joined: 03 Sep 2022 Posts: 456
|
Posted: Wed Jul 17, 2024 9:11 am Post subject: Re: Firefox patches and privacy? |
|
|
pjp wrote: | Juippisi wrote: | People who care about that stuff, will find the settings they can change. | Awareness is the main blocker there, but I can appreciate the patch burden. That they've decided to remotely change user settings is disturbing. |
Who decided to change remotely which user setting?
Firefox introduced a new option with a default value. The main question here is whether the default value is the "right" or "wrong" value. Is the default value a violation of privacy or not? Based on my understanding of privacy I dare to say that the default value is not a violation of your privacy. Because I try to share as little data as possible I opted-out. But sharing as little data as possible is not the same as "protecting privacy". |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
lars_the_bear Guru
![Guru Guru](/images/ranks/rank_rect_3.gif)
Joined: 05 Jun 2024 Posts: 500
|
Posted: Wed Jul 17, 2024 12:31 pm Post subject: Re: Firefox patches and privacy? |
|
|
sMueggli wrote: | But sharing as little data as possible is not the same as "protecting privacy". |
No. But perhaps it's a necessary first step? The problem is that 'Internet privacy' encompasses a bunch of complex, interrelated issues. I suspect that few people fully understand the implications of this Firefox change. As a matter of routine, I turn off all forms of telemetry that I can exercise any control over. Whether it does any good, I'm not sure. My gut feeling is that it does no harm.
BR, Lars. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
pjp Administrator
![Administrator Administrator](/images/ranks/rank-admin.gif)
![](images/avatars/1154772887439692d88303b.jpg)
Joined: 16 Apr 2002 Posts: 20453
|
Posted: Wed Jul 17, 2024 4:55 pm Post subject: Re: Firefox patches and privacy? |
|
|
lars_the_bear wrote: | pjp wrote: | That they've decided to remotely change user settings is disturbing. |
Have the Mozilla folks just set the controls for the heart of the Sun now? | sMueggli wrote: | Who decided to change remotely which user setting? | Code: | elog "Upstream operates a service named Normandy which allows Mozilla to"
elog "push changes for default settings or even install new add-ons remotely."
elog "While this can be useful to address problems like 'Armagadd-on 2.0' or"
elog "revert previous decisions to disable TLS 1.0/1.1, privacy and security"
elog "concerns prevail, which is why we have switched off the use of this"
elog "service by default." | https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/firefox-bin/firefox-bin-115.13.0.ebuild
lars_the_bear wrote: | My gut feeling is that the many (most?) people who use Firefox on a regular basis do so because they don't really trust the underhanded behaviour of the alternatives. | I've never had the experience of others that Chrome is faster / better. so I've stayed with Firefox. The only other option is not using the web as none of the other Chromium based browsers solve the usability problems inherent in Chrome. _________________ Quis separabit? Quo animo? |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
lars_the_bear Guru
![Guru Guru](/images/ranks/rank_rect_3.gif)
Joined: 05 Jun 2024 Posts: 500
|
Posted: Wed Jul 17, 2024 6:02 pm Post subject: Re: Firefox patches and privacy? |
|
|
pjp wrote: | I've never had the experience of others that Chrome is faster / better. so I've stayed with Firefox. |
I have the opposite experience: I find Chromium works better than Firefox for almost everything I do. And it supports ALSA audio directly, without needing to be built from source, which Firefox generally does not any more.
I stick with Firefox because I don't feel I can trust anything that's associated in any way with Google. I don't know what risks I run, using Google products and services; maybe there are none, and I'm being paranoid. And there are plenty of nasty security vulnerabilities, even in software that has always been open source, and maintained with the best and noblest of intentions.
I know I'm a zealot. I'm not proud of it; it's just the way I am. But dealing with anything Google makes me feel... icky. Like I need a hot shower. Heaven help me if Firefox goes the same way; I'll have to go back to Gopher.
BR, Lars. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
pjp Administrator
![Administrator Administrator](/images/ranks/rank-admin.gif)
![](images/avatars/1154772887439692d88303b.jpg)
Joined: 16 Apr 2002 Posts: 20453
|
Posted: Thu Oct 03, 2024 5:04 pm Post subject: |
|
|
As a reminder, firefox esr 128 arrived today with this USE flag: euse -i telemetry references 3 packages (but not firefox):
dev-python/stripe
dev-util/selenium-manager
kde-plasma/plasma-workspace _________________ Quis separabit? Quo animo? |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
Bob P Advocate
![Advocate Advocate](/images/ranks/rank-G-1-advocate.gif)
![](images/avatars/36737323419016f7c7ee5.jpg)
Joined: 20 Oct 2004 Posts: 3366 Location: USA
|
Posted: Mon Oct 21, 2024 10:45 pm Post subject: Re: Firefox patches and privacy? |
|
|
pjp wrote: | Code: | elog "Upstream operates a service named Normandy which allows Mozilla to"
elog "push changes for default settings or even install new add-ons remotely."
elog "While this can be useful to address problems like 'Armagadd-on 2.0' or"
elog "revert previous decisions to disable TLS 1.0/1.1, privacy and security"
elog "concerns prevail, which is why we have switched off the use of this"
elog "service by default." |
|
Normandy? Why would someone name a service like that after the greatest invasion in the history of mankind? What were they thinking? Hmmm.
Switching off a hostile service like that is not good enough. That kind of service is overtly hostile and it's mere existence on someone's PC places the user at risk. It's existence implies a hostile motive being reserved for future deployment. It is a ticking time bomb and it's only a matter of time until the service gets switched on "accidentally." |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
Bob P Advocate
![Advocate Advocate](/images/ranks/rank-G-1-advocate.gif)
![](images/avatars/36737323419016f7c7ee5.jpg)
Joined: 20 Oct 2004 Posts: 3366 Location: USA
|
Posted: Mon Oct 21, 2024 10:53 pm Post subject: |
|
|
On a related note, I have encountered perf problems with firefox that forced me to use chrome against my wishes. So I tried using the Brave Browser, which is ostensibly a safer version of chrome that has (some of) chrome's spyware features deactivated. Don't believe it.
After painstakingly configuring my version of Brave to honor my seucrity needs to the greatest extent possible, I found after a system update that all of my preferences were reset to promiscuous values and I had to go through everything all over again. (Fedora 39 and Brave v1.71.114 (Oct 17, 2024))
Concerns like those mentioned in this thread are why I don't trust any browser anymore. I think it's a good idea to sandbox them in a VM. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
Hu Administrator
![Administrator Administrator](/images/ranks/rank-admin.gif)
Joined: 06 Mar 2007 Posts: 22546
|
Posted: Mon Oct 21, 2024 11:08 pm Post subject: Re: Firefox patches and privacy? |
|
|
Bob P wrote: | Switching off a hostile service like that is not good enough. That kind of service is overtly hostile and it's mere existence on someone's PC places the user at risk. It's existence implies a hostile motive being reserved for future deployment. It is a ticking time bomb and it's only a matter of time until the service gets switched on "accidentally." | Upstream ships the code for the service. Gentoo disables the service, and shows a message telling you this. If upstream one day makes a change that bypasses Gentoo's change and reenables the service, then that would be an accident on the part of the Gentoo maintainer for not catching that the attempted disable ceased functioning. Given that Gentoo specifically disabled this, I cannot see a Gentoo maintainer reactivating it maliciously. If the Gentoo maintainer wanted it on, he could simply have done nothing and let upstream's default prevail this whole time. Therefore, while your concern about the existence of the service seems reasonable, your implications about motives seem unfounded.
What do you propose be done differently, particularly in light of your own observations that Chrome and its derivatives are actively pursuing an even more anti-privacy policy? |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
Bob P Advocate
![Advocate Advocate](/images/ranks/rank-G-1-advocate.gif)
![](images/avatars/36737323419016f7c7ee5.jpg)
Joined: 20 Oct 2004 Posts: 3366 Location: USA
|
Posted: Tue Oct 22, 2024 11:16 am Post subject: |
|
|
My concern isn't about what Gentoo is doing, it's about what's being done upstream. I appreciate what all of the Gentoo package maintainers are doing, but this is the sort of thing that oculd have catastrophic consequences if it slips through the cracks. Remember heartbleed?
The problem is that when malware like this is incorporated upstream by design, all users are placed at risk, and become dependent upon a single point of protection downstream. No matter how good a job the second tier people may do in preventing the problem, there's still risk associated with that model.
Regarding your question about what needs to be done differently, I already mentioned that I'm sandboxing my browsers. Maybe you missed that. This news (to me) about Normandy makes me think that I'm doing the right thing ... I'm just not sure that I'm doing enough. And knowing what I know, I know that I don't know enough to know that I'm doing enough. Really, I'm not sure that any of us are truly capable of protecting ourselves when the hostile threat is incorporated by design into devices that people are dependent upon.
We're at a stage where phones and browsers are designed to work against us. I don't have all the answers. I'd like help from those who know more than I do. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
Hu Administrator
![Administrator Administrator](/images/ranks/rank-admin.gif)
Joined: 06 Mar 2007 Posts: 22546
|
Posted: Tue Oct 22, 2024 11:44 am Post subject: |
|
|
I saw your comment about sandboxing, but that is something you are doing, locally. I was asking what it is you think the Gentoo maintainers should be doing differently. Are you advocating that Gentoo should ship a pre-sandboxed browser, so that merely running gentoo-firefox-wrapper provides out-of-the-box all the protection that the Gentoo community knows how to provide, be that through seccomp, containers, virtual machines, etc.?
I only see that Normandy warning in the firefox-bin ebuild, where Gentoo cannot patch out the code because the ebuild is just a download of a blob. I see in the firefox ebuild that the default prefs disable Normandy, but no mention of Normandy in the ebuild text itself. Perhaps this means that the Normandy code is present, but disabled. I can see that deleting the Normandy code outright would be safer, but it would also make the ebuild more fragile. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
Bob P Advocate
![Advocate Advocate](/images/ranks/rank-G-1-advocate.gif)
![](images/avatars/36737323419016f7c7ee5.jpg)
Joined: 20 Oct 2004 Posts: 3366 Location: USA
|
Posted: Tue Oct 22, 2024 11:46 am Post subject: |
|
|
Hu wrote: | Are you advocating that Gentoo should ship a pre-sandboxed browser, so that merely running gentoo-firefox-wrapper provides out-of-the-box all the protection that the Gentoo community knows how to provide, be that through seccomp, containers, virtual machines, etc.? |
Please stop imagining words into my mouth. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
Hu Administrator
![Administrator Administrator](/images/ranks/rank-admin.gif)
Joined: 06 Mar 2007 Posts: 22546
|
Posted: Tue Oct 22, 2024 12:16 pm Post subject: |
|
|
Bob P wrote: | Hu wrote: | Are you advocating that Gentoo should ship a pre-sandboxed browser, so that merely running gentoo-firefox-wrapper provides out-of-the-box all the protection that the Gentoo community knows how to provide, be that through seccomp, containers, virtual machines, etc.? |
Please stop imagining words into my mouth. | That was a question, not imagination. However, it was a question derived from your own words up thread: Bob P wrote: | Switching off a hostile service like that is not good enough. That kind of service is overtly hostile and it's mere existence on someone's PC places the user at risk. It's existence implies a hostile motive being reserved for future deployment. It is a ticking time bomb and it's only a matter of time until the service gets switched on "accidentally." | If you think "Switching off a hostile service like that is not good enough", then what is good enough, and who should be doing the work that is good enough? I then offered a specific example of work that might be good enough: the Gentoo maintainers providing a pre-sandboxed browser. I also speculated that a related bit of potentially "good enough" work (deleting all the Normandy code from the build) would be useful, but too fragile to justify the burden on the volunteer maintainers who currently handle this ebuild. |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
szatox Advocate
![Advocate Advocate](/images/ranks/rank-G-1-advocate.gif)
Joined: 27 Aug 2013 Posts: 3384
|
Posted: Tue Oct 22, 2024 12:25 pm Post subject: |
|
|
Bob, that was a very reasonable question.
Mainstream is doing its thing, which admittedly sucks, but if disabling it is not enough of a solution, what else would you like implemented?
Meanwhile, I'm waiting for Ladybird project. Making a browser from scratch is a crazy endeavor, but they have a bunch of crazy people on the team, so might actually pull it off.
It should be to Chrome what Firefox used to be to IE. _________________ Make Computing Fun Again |
|
Back to top |
|
![](templates/gentoo/images/spacer.gif) |
|