News: 1633691284

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Want to support Firefox? Great, you'll have no problem with personalised, sponsored search suggestions then

(2021/10/08)


Mozilla is trialling personalised advertising in its Firefox Suggest feature, along with sponsored search results, with users told that it "helps fund Firefox development."

Firefox Suggest was first introduced last month in Firefox 92, [1]billed as "a new discovery feature that is built directly into the browser."

The feature provides links as the user types in the search bar, which can be based on local browsing history, bookmarks and open tabs, or on "sponsored suggestions from vetted partners." Currently, users outside the US only see these uncontentious local prompts.

[2]

Firefox Suggest data flow, showing how data now flows to Mozilla and its partners as well as the search engine

Firefox 93, released earlier this week, adds a new dimension to the Suggest feature, called contextual suggestions. In this case, when the user clicks a link additional data is sent to the advertiser, primarily location data according to the [3]explanation .

The company said that the location is derived from the IP address of the client, and converted to a "more general location" by Mozilla before it is sent to the advertising partner. "The data we share with partners does not include personally identifying information and is only shared when you see or click on a suggestion," Mozilla [4]said .

[5]

Note the careful wording "when you see or click." Seeing something is different from clicking on it, but it is hard to understand how the feature can work unless it operates before the user sees it. If the user clicks a link, the target of the link will see the user's IP number for themselves. Mozilla also collects a notification for itself that the suggested link was clicked.

[6]

[7]

Again, only "a limited number of users in the US only" will get this feature initially. Users will be prompted with a dialog inviting them to "allow suggestions" before the feature is enabled. The dialog is an example of a dark pattern, with three options, one highlighted to encourage a reflex click, one in discouraging grey for customising settings, and sneaked in at top right, a small "Not now" link.

[8]

Users see this consent dialog – spot the 'Not now' tucked out of sight

Although the contextual suggestion feature requires this opt-in, the sponsored suggestions are on by default – the difference being the data that is sent to partners providing the suggestions. Firefox says that its "preferred partner" for sponsored results is a company called adMarketplace which [9]claims to be a "privacy-safe consumer marketplace."

[10]Did you know? Internet money lender Opera also offers a free web browser

[11]Firefox 91 introduces cookie clearing, clutter-free printing, Microsoft single sign-on... so where are all the users?

[12]In a complete non-surprise, Mozilla hammers final nail in FTP's coffin by removing it from Firefox

[13]Firefox 89: Can this redesign stem browser's decline?

[14]Firefox to adopt Chrome's new approach to extensions – sans the part that threatens ad blockers

Firefox and the work of Mozilla is important to the web community since it is an independent browser with its own engine, unlike most others which use the Google-sponsored Chromium engine. These sponsored links sit uncomfortably with Mozilla's claim to be privacy advocates – yet like many other open-source companies, Mozilla is in the position where it cannot charge directly for its products so looks for other means of monetising them. Much of its income comes from Google, which pays to be the default search engine in Firefox.

Other new features in Firefox 93 include the [15]blocking of downloads over unencrypted connections, though users will see an option to allow the download (again in a discouraging grey).

There are also new [16]privacy features including SmartBlock 3.0, which Mozilla said has "vastly improved support" for faking Google Analytics scripts to get round the problem of sites blocking content for users they are unable to track. There is also better protection against HTTP referrer headers that send too much information, and blocking of downloads in frames marked as sandboxed.

[17]

Firefox on Windows gets a new automatic tab unloading feature when memory is "critically low." Unloaded tabs will be reloaded when the user switches to them. The idea is to reduce Firefox out-of-memory crashes.

The full list of what's new in Firefox 93 is [18]here . ®

Get our [19]Tech Resources



[1] https://blog.mozilla.org/en/products/firefox/firefox-news/firefox-suggest/

[2] https://regmedia.co.uk/2021/10/07/dataflow.jpg

[3] https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/

[4] https://support.mozilla.org/en-US/kb/navigate-web-faster-firefox-suggest

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YWBrTSmquQrRvbJZCM@onwAAAM4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YWBrTSmquQrRvbJZCM@onwAAAM4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YWBrTSmquQrRvbJZCM@onwAAAM4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[8] https://regmedia.co.uk/2021/10/07/suggest.jpg

[9] https://www.admarketplace.com/about/

[10] https://www.theregister.com/2020/02/26/opera_fy2019_fintech/

[11] https://www.theregister.com/2021/08/11/firefox_91/

[12] https://www.theregister.com/2021/07/21/firefox_ends_ftp_support/

[13] https://www.theregister.com/2021/06/01/firefox_89_redesign/

[14] https://www.theregister.com/2021/05/28/mozilla_chrome_mozilla/

[15] https://blog.mozilla.org/security/2021/10/05/firefox-93-protects-against-insecure-downloads/

[16] https://blog.mozilla.org/security/2021/10/05/firefox-93-features-an-improved-smartblock-and-new-referrer-tracking-protections/

[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YWBrTSmquQrRvbJZCM@onwAAAM4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[18] https://www.mozilla.org/en-US/firefox/93.0/releasenotes/

[19] https://whitepapers.theregister.com/



It's as if they're designing it to lose market share

BinkyTheMagicPaperclip

Tabs should never, ever, unload as they may contain information that can't just be 'reloaded'. If it's that low on memory, refuse to load a new tab until free memory rises again. Just because apps on Android do it doesn't make it right, it's highly irritating on there too.

Couple that with the behaviour I saw on a Raspberry Pi recently where Firefox updated in the background and then refused to create new tabs until the browser was restarted. What if you're working on something important? What if there's a download that shouldn't be interrupted. Bone headed behaviour that shouldn't survive five minutes thinking about it.

I'd be happy to pay for a browser that was actually any good (Opera, you had your chance, it was awful), rather than the current situation of finding a least worst choice.

Re: It's as if they're designing it to lose market share

Tom Chiverton 1

Please let me know what can't be serialised to disk and then reloaded...

Re: It's as if they're designing it to lose market share

Anonymous Coward

It's fine if they actually do serialise to disk all half-edited form fields, JavaScript state, DOM state, etc... but it's not so good if they just forget the page and you have to reload everything with all your edits forgotten, which is what tends to happen on Android when it runs out of memory.

Re: It's as if they're designing it to lose market share

tony72

I ditched Firefox a while back, so I've got no skin in the game anymore, but you do honestly wonder what the discussion is like at Mozilla. Do they actually have a plan to regain some of their lost market share? Do they think this kind of thing fits into said plan somehow? Anyone know where their roadmap is now? [1]wiki.mozilla.org/Firefox/Roadmap/Updates says it's "No longer maintained", hasn't been updated in a year.

[1] https://wiki.mozilla.org/Firefox/Roadmap/Updates

Re: It's as if they're designing it to lose market share

heyrick

" Just because apps on Android do it doesn't make it right, it's highly irritating on there too. "

Upvote. Because of recent EU rules on banking, quite often when I buy something from a website I'm asked the switch to the bank app to authorise the purchase. If I do that, I find that upon switching back, the OS unloaded the browser and thus threw away all the order information/basket contents. So I've just authorised a purchase that got "forgotten".

What I have to do is either use my tablet and phone, or wait for the thing to time out and offer to send me a text instead (then wait more until it arrives). It's a pain in the arse, and, I suspect, just a lot of security theatre for no actual benefit (it's the same bank that replaced my longish foreign word password with a five digit PIN because this is "my trusted device" ).

Re: It's as if they're designing it to lose market share

jmch

" longish foreign word password"

Off topic.... but...given that dictionaries are surely available in any language, having a password in a foreign (by which I guess you mean non-english) language is no more secure than an english language word of similair length. The safety of a password comes from the not being brute-forceable from both length and dictionary perspective. If it's in a dictionary than the "longish" part loses its power

@BinkyTheMagicPaperclip - Re: It's as if they're designing it to lose market share

Anonymous Coward

Er, they are losing market share so they have nothing left to lose.

Pascal Monett

Well one thing is for sure : sponsored search suggestions is not going to help.

Anything "sponsored" is 99.999% likely to be something I have absolutely zero interest in.

Besides, I use an ad-blocker and NoScript. They stuff it where the sun don't shine.

Re: It's as if they're designing it to lose market share

msknight

I don't mind paying for something I'm using. Or pay a subscription for a premium feature which is actually useful... as opposed to companies turn to advertising and that sort of garbage which actually turns me off the product and ends up with me fighting the crap they're pushing in my face.

Unloading pages, though... yes... depending on how it's done it can be a nightmare for the user.

I do wonder what platform Firefox are on. With all that's happened in this sphere already, I thought they'd have had more sense than to go this way.

Is it the search bar or the address bar?

Anonymous Coward

The picture shows that this will run in the address bar, not the search bar. Will there be the usual slew of entries in about:config that all have to be set in the perfect configuration to stop user-data being sent to Mozilla/advertisers/god-knows-where? Please Mozilla, just... don't.

(Was it Mozilla that tried to rename it to the Awesomebar? Just leave it for addresses, please. Keep the search stuff separate.)

Re: Is it the search bar or the address bar?

demon driver

The consent dialog shows a search bar, the data flow diagram shows an address bar – but in Firefox, both address input and search are combined within the address bar as a single input field, which might explain the diagram... (And I think you're right with the 'Awesomebar'. Hideous.)

Moz jumped the shark years ago

elregidente

Many years ago, I had cause to install FF on Windows from the standard installer.

When the browser first started, it presented a page which in every way had been made to trick the user into thinking they now *had* to make an account with Mozilla to proceed.

I was, and remain, disgusted.

I think Moz jumped the shark years ago.

The saving grace is that FF is so customizable you can turn off all the evil stuff, and of course, that there are not any obvious alternatives. You can't use Chrome, or anything from MS, or anything from Apple. Chromium, maybe, is an option, but I've been wary. I don't know exactly what it does or not contain.

As it is anyway, I use Tor, which acts to remove a lot of the evil stuff in the first place.

Pascal Monett

Ah yes, Tor. The NSA-created refuge for criminals, black marketers and intelligence agencies all over the world.

Brilliant idea.

Why do devs insist on trying this?

Irongut

> the location is derived from the IP address of the client

Which means it will be wrong 100% of the time. Every site that attempts to determine my location from my IP gets it wrong... about 300 miles away wrong and in the wrong country. They can't even decide which of my ISP's offices my IP belongs to, giving different locations at different times for the same IP.

Re: Why do devs insist on trying this?

Andy Non

I get that all the time too. Whenever I log into Amazon I get a warning text message querying that I've just logged in from London, Newcastle, Cornwall etc and I'm still in the same room on the same computer in Nottingham.

Google News is funny like that too, If I'm logged in to Google, it shows a section of news from my "Local Area" which is anywhere in the country, often from small towns I've never even heard of.

Surreptitious Advertising

demon driver

It's even worse than what the article describes. As BleepingComputer reports, "Firefox doesn't tag the ads displayed via Firefox Suggest. There is no clear way to identify what a sponsored suggestion and what a regular unsponsored suggestion should look like. The only way Firefox users will know whether a sponsored suggestion is an ad would be by looking at the URL, but, in many cases, the URL is not clearly visible." If they plan to roll this out outside of the US, such practices might even turn out to be illegal in some jurisdictions.

the blocking of downloads over unencrypted connections

Mike 137

Why? And whose decision should it be anyway? Nanny doesn't always know what I want.

Re: the blocking of downloads over unencrypted connections

Hubert Cumberdale

It's still your decision. It just (in some cases, quite rightly) advises against it. I already have automatic redirection to HTTPS switched on (with a warning if I want to bypass this for local embedded devices/dinosaur websites). I've said it before: encryption should be the norm, and there should be a good reason to NOT use it.

Don't go shouting about not needing it unless you're inputting private information – EVERYTHING you look at on the web is private information. Do you really want me to be able to collect a list of which pages on which specific websites you've visited, including a copy of all their content? I could find out a lot about you with that.

[1]We've had free certs for over six years , and any decent hosting provider will make using them seamless (if yours doesn't, then switch). Anyone who cares about privacy should insist on encryption for every website. Yet for some reason, I'm still going to get downvotes for this post.

[1] https://www.theregister.com/2015/12/03/letsencrypt_public_beta/

Re: the blocking of downloads over unencrypted connections

rg287

Do you really want me to be able to collect a list of which pages on which specific websites you've visited, including a copy of all their content? I could find out a lot about you with that.

I generally agree. Encrypt all the things. If we were developing a new system today it would encrypt by design. There's just one exception. Software Mirrors.

Encrypting those makes opportunistic/transparent caching impossible. Sure, you can do it with a trusted proxy on a managed network where clients have certificates installed, but it nukes caching by ISPs or for unmanaged devices. It would kill [1]LANCache and similar software.

There is no reason whatsoever why software (especially enormous game downloads) needs to be encrypted when you can compare signatures to verify integrity. It's why all the major marketplaces encrypt everything except the software downloads. They know networks need to cache them.

[1] https://lancache.net/

You pay £60 a month to BT

Anonymous Coward

Well, you're paying up to £720 a year to BT to get a fast internet connection, and they're paying nothing towards any of the websites they resell or the software used to view those websites. They keep it all for themselves.

All of that they get free. You're not paying for the Internet, you're paying landlord-freeloader BT a rent on other people's property. None of those website they sell access to, they fund, none of that data is there's to sell.

Charge ISPs like BT a 10% tax on their domestic internet connections, give the end users credit tokens for that 10%, tokens they can spend on the internet. Make it only work for countries that support the same system. "Here's magic money you can only spent for internet services in countries that support the tax, so now spend it."

If Mozilla want the fee, they have to move operations to the UK, or convince USA to join the fee scheme. I don't think the latter will be difficult, given ATnT has been revealed as a major funder of One America Network, on condition they attack the Dems and the Net Neutrality law and be nice to ATnT. They should be happy to make ATnT pay their way, after they undermined American democracy.

All the pot of money available will naturally be spent on the limited available initial recipients, which will encourage rapid adoption.

Then you have a economy based on people paying you. NOT secretly selling their data everywhere. NOT ramming insane ads into people's faces. NOT tricking app buyers into paying more by deception. A healthy system of people paying for the goods and services they're using. Potentially a heck of a lot of money too. These ISPs and Cable companies make tens of billions in profits each year off the backs of others.

Re: You pay £60 a month to BT

Pascal Monett

No I'm not. I live in France. I pay €45/month to Orange.

I understand you have a pet peeve, but you need to understand that Firefox in not used only in the UK.

The Internet is wider than BT.

Re: You pay £60 a month to BT

Arthur the cat

The Internet is wider than BT.

Thank the deity of your choice.

Caught between a rock and a hard place

ThatOne

I understand their plight, they need money, like everyone they eat several times a day and some have even families, and they know sugar daddy Google only keeps them around to ward against monopoly accusations, he has no other use for them and definitely doesn't want them to stand in the way of Chrome's global domination.

They know they need to break free and become independent (well, as much as possible), and how do they go about it? By taking a blunderbuss and carefully aiming at their foot... Seriously guys, if there is a big no-no nowadays, it's creepy spying. Besides, what happened to that point 4 of the Mozilla Manifesto?...

I'm aware of Hanlon's razor, but I only can explain this by either suggesting blind, greedy (used cars sales grade) marketing now controls the Mozilla Foundation, or that it's yet another attempt of sugar daddy Google to prevent losing Chrome users to Firefox, by making it look even creepier than Chrome. After neutering ad blockers in Chrome, they needed to do something to prevent users switching to Firefox I guess.

Disclaimer, I've been using Firefox for 20 years now, I was using Netscape before that. I'm a staunch supporter of Mozilla, but they make it increasingly difficult to defend them. Bad decisions and a total lack of understanding for their user base do hurt them way more than the general push to use Chrome or one of its clones.

Re: Caught between a rock and a hard place

Anonymous Coward

How would you donate for their privacy aim? You'd have to hand them money and with it your id.

Or they can ram adverts down you, but then thats a slippery slope, slowly Google will drag them down.

Requiring Google Play Store to install Firefox mobile looks like Google's work to me, Firefox APK use to be simply downloadable.

So you need some simple way to pay Mozilla for their work, that rewards their privacy aims, while not violating your privacy in the process.

Do a 10% ISP tax, give customer tokens, anonymous customer pays Mozilla using the tokens.

Re: Caught between a rock and a hard place

Dan 55

[1]The Firefox APK is in three other app stores and is still downloadable .

I still think the best way forward for Mozilla would be allowing the user to tip websites to pay for content or remove ads and receive a small commission.

[1] https://support.mozilla.org/en-US/kb/install-firefox-your-phone-or-tablet

Re: Caught between a rock and a hard place

ThatOne

> You'd have to hand them money and with it your id

I'm not on the run, I have no problem handing my ID to Mozilla. Lots of people know who I am, but they are the ones I chose to identify myself to.

What I do have problems with is some shady fly-by-night marketing (tautology!) company spying on my computer.

.

> So you need some simple way to pay Mozilla for their work

Yes, and that's the whole problem. Netscape has proven that a to-pay browser has no chance against a free and ubiquitous one. Donations are not a solution either, Mozilla has them already.

No, I don't have the solution either, but we need one, else we're all lifers in ad-infested Googleland, sliced and diced and sold wholesale.

karlkarl

Can we as a community not think of a way to drop Mozilla some pennies so they stop trying on stupid shite like this?

How about in their binary builds reduce the feature set unless you buy a "pro" version. So disable:

- WebGL

- Snippets

- Firefox Account

- Firefox Sync

- etc...

... although I am sure many of us will actually prefer this version of the build. haha.

OK, lets try the other way, perhaps Mozilla can charge money for a stripped down build? Perhaps even a patched source tree that they charge access to with the nonsense stripped out? This could actually be something I would personally be interested in. It would also make a few headlines.

babaganoush

I agree. Charging for a stripped-down, no-nonsense version that gets an update maybe every 5 years is the way forward. I'd pay for it.

The irony...

Eric Olson

After I did the update so I would remember to disable to feature, the typical "new version" tab was advertising their VPN and proclaiming how your privacy matters.

Never mind that the VPN would make the localized suggestions pointless, but it also means they aren't being upfront about a rather huge privacy change.

I will also note the setting indicates it "Helps fund Firefox development and optimization," so at least they are being upfront on why they've included it.

Practical Alternatives

Anonymous Coward

The Firefox fellas & fems need to eat and are in an invideous situation. Currently the market is massivly unballenced and is therefore not functioning as Google has a massive share, it sponsers Firefox, whilst sharpening the axe in the background as a threat and it has as a client Microsoft. Thus it has a disproportionate share of the market.

I can't beleive that I am suggesting this but it would be a much healthier situation if Microsoft were to use Firefox technology. This would rebalance the market and give Goo gull some competition.

In the corperate space Firefox should sell itself as the secure option with a corporate IT friendly focus. By corporate I also include governmental customers.

In the domestic space give the users a real option between an adds based service but with a secure twist (as much as you posibly can) and a cheap non-ads service, say £5 or £10 per year.

Do it all and this would give them a distinctive product and reaason for existence in a more functionaly competative market and if ised more corporately a greater profile amongst the masses who currently are unaware of their existance.

Re: Practical Alternatives

rg287

In the domestic space give the users a real option between an adds based service but with a secure twist (as much as you posibly can) and a cheap non-ads service, say £5 or £10 per year.

I don't think that'll be enough though. Not unless you can massively grow market share.

Firefox has something under 260 million desktop installs. If you can convince 1% to cough up £10 for a "pro" or ad-free version then that's £26m. If another 1% cough up £5 for a middle-version that's another £13m.

For sure it's diversity of income and makes then less reliant on Google, but Mozilla run on an annual budget of >$300m (granted there's the Foundation/Corp angle of it). So they'd need significant additional income.

Now maybe I'm being pessimistic. If you can get 2-3% to pay then you'd be getting there. In principle £1/install would more than do the job. Micro-transactions? On iOS the mobile version will always be Safari under the hood, but can they find a killer feature that's worth £1.50? People are more than happy to pay money for flappy crush saga. But they need to step up their market presence and push whatever USP they have. Realistically people will just use Safari, Edge or Chrome.

Of course Mozilla do things which aren't Firefox, so it might be possible to do a paid-version of those. Presumably they make some money out of reselling Mullvad VPN. Maybe develop a support package for corporates to pitch in a few quid. Or charge £10/yr for the FF Dev Edition.

And they could also not pay Mitchell Baker $3m/yr. Executive pay at Mozilla is starting to make some bankers look modest (albeit there are no stock options). She's added half a million dollars a year to her salary whilst laying off hundreds of staff.

Blackjack

Honesty while I am poor I would have prefered a donate button.

There is a reason I am using Icecat and Iceraven and is because default Firefox had been getting worse over the years.

If the automobile had followed the same development as the computer, a
Rolls-Royce would today cost $100, get a million miles per per gallon,
and explode once a year killing everyone inside.
-- Robert Cringely, InfoWorld