subject:"Mozilla enabled ads in Firefox and they're active in Fedora"


On Tue, Nov 18, 2014 at 16:22:54 -0600,
 Michael Catanzaro  wrote:


Is there a bug report about this? Could you point me to it if so? i686
is absolutely a supported architecture, it's just not one that's
regularly tested.


This is the one for webkit:
https://bugzilla.redhat.com/show_bug.cgi?id=1103967

I got this partially confused with the one for xchat:
https://bugzilla.redhat.com/show_bug.cgi?id=1101811
The xchat one is where another library is the culprit.
--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Lars Seipel

On Tue, Nov 18, 2014 at 11:15:33AM +0200, Nikos Roussos wrote:
> > No, actually we don't. We promote websites because we honestly think
> > they're useful, not because we're paid to do so.
> 
> That's irrelevant. Paid or not, promoting websites through tiles or
> gnome-shell is the same form of advertisement.

I disagree. Think about it: imagine I told you as a friend how I was at
some pub yesterday and enthusiastically rave about how it was totally
awesome and that you should go there, too. Now, in the one case I told
you this because I'm honestly convinced that it would be fun for you to
go there and that you'd like it. In the other case I did it because the
owner paid me for it. Really no difference? I don't think so.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Michael Catanzaro

On Tue, 2014-11-18 at 22:22 +0100, Kevin Kofler wrote:
> That's a webkitgtk issue, look at how we handle this in QtWebKit.
> 
> (You have to build the library twice, as /usr/lib/libwebkitgtk* with
> the 
> WebKit JIT disabled and as /usr/lib/sse2/libwebkitgtk* with the JIT
> enabled. 
> The WebKit JavaScript JIT requires SSE2. The interpreter works fine
> without 
> it.)
> 
> Kevin Kofler

Hi,

Is there a bug report about this? Could you point me to it if so? i686
is absolutely a supported architecture, it's just not one that's
regularly tested.


signature.asc
Description: This is a digitally signed message part
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Kevin Kofler

Bruno Wolff III wrote:
> Why do you claim that? What requirements do you think we must provide
> for in our default browser that other browser we have packages for
> don't meet? I find Midori reasonable on x86_64. There is currently an
> i686 problem because a library it uses is compiled with an incorrect
> architecure (it uses instructions that aren't supported on hardware
> Fedora is upposed to support). So I have problems with it on i686, but
> this isn't directly a Midori problem. Seamonkey seems pretty reasonable
> as well.

That's a webkitgtk issue, look at how we handle this in QtWebKit.

(You have to build the library twice, as /usr/lib/libwebkitgtk* with the 
WebKit JIT disabled and as /usr/lib/sse2/libwebkitgtk* with the JIT enabled. 
The WebKit JavaScript JIT requires SSE2. The interpreter works fine without 
it.)

Kevin Kofler

-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora


On Tue, Nov 18, 2014 at 09:44:04 -0800,
 "Gerald B. Cox"  wrote:

I am aware of bugs you mentioned.  The fact remains that Chromium is the
only viable alternative to Firefox... 


Why do you claim that? What requirements do you think we must provide 
for in our default browser that other browser we have packages for 
don't meet? I find Midori reasonable on x86_64. There is currently an 
i686 problem because a library it uses is compiled with an incorrect 
architecure (it uses instructions that aren't supported on hardware 
Fedora is upposed to support). So I have problems with it on i686, but 
this isn't directly a Midori problem. Seamonkey seems pretty reasonable 
as well.

--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora


On Tue, Nov 18, 2014 at 18:40:02 +0100,
 Reindl Harald  wrote:


Am 18.11.2014 um 18:29 schrieb Bruno Wolff III:


Mozilla is a third party. There is no reason that they should be
contacted by default.


calling upstream "3rd party" is somehow strange
most code in fedora is from 3rd party


I am first party. Fedora is second party. I deal directly with Fedora.
Mozilla is a third party. I don't deal with them.

if you don't trust the 3rd party you *really* need to review every 
single line of code


I expect Fedora to protect my interests, so I don't have to do code reviews. 
Clearly there are limits to that, but I except some risk in order to save 
time and money.


*but* please avoid FUD and paranoia and claim upstream unstrustable 
until you can prove that instead of assume it


I made no such claim. What I don't want to have to do is to have to trust 
them to be responsible about data they have no need for in the first place.

--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

On 11/18/2014 07:21 PM, drago01 wrote:
> On Tue, Nov 18, 2014 at 6:14 PM, Nikos Roussos
>  wrote:
>> On November 18, 2014 7:08:47 PM EET, Benjamin Kreuter 
>>  wrote:
>>> On Tue, 2014-11-18 at 15:12 +0200, Nikos Roussos wrote:
>>>
 This is a moral judgment, so it's irrelevant for making a policy
 decision (from Fedora's point of view). Money or not, we need a
 consistent policy on advertisements for all upstream.
>>>
>>> How about an opt-in requirement?
>>
>> Yes, that would make more sense.
>> But I didn't opt-in to see commercial websites on gnome-shell either (and I 
>> can't even opt-out).
> 
> You can disable the search provider in Settings -> Search

I'll have to completely disable Software as search provider, which I
don't want to do. Unless I'm missing something.




signature.asc
Description: OpenPGP digital signature
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Gerald B. Cox

On Tue, Nov 18, 2014 at 9:40 AM, Reindl Harald 
wrote:

> *but* please avoid FUD and paranoia and claim upstream unstrustable until
> you can prove that instead of assume it


Exactly!  Thank you!
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Kevin Fenzi

On Tue, 18 Nov 2014 08:00:35 -0600
Bruno Wolff III  wrote:

> On Tue, Nov 18, 2014 at 14:58:41 +0100,
>   Martin Stransky  wrote:
> >
> >Another way how to promote Fedora is to set "welcome" page to 
> >start.fedoraproject.org. It appears when Firefox starts on fresh 
> >profile and can point people to the Fedora project.
> 
> We shouldn't be doing that either. Any welcome page initially
> displayed should be from a copy on the installation, not something
> fetched from a remote server.

start.fedoraproject.org is actually a dynamic page, not something that
could be repointed locally. At least as it's currently implemented.

kevin


pgpXQi2MQRjjn.pgp
Description: OpenPGP digital signature
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Gerald B. Cox

On Tue, Nov 18, 2014 at 9:25 AM, Tomas Radej  wrote:

> Based on the aforementioned, I think it's infinitely easier to fix Firefox
> than push for Chromium.


I am aware of bugs you mentioned.  The fact remains that Chromium is the
only viable alternative to Firefox... so if we're interested in providing
an alternative to Firefox then we need resolve the blocking bugs.
Regarding "a few packets being sent to Google"... that could be anything or
nothing.  If you're curious then I would suggest you open a bug with the
Chromium project and ask.  I'm not at all concerned about it, and FWIW
people are accusing Mozilla of the exact same thing.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Benjamin Kreuter

On Tue, 2014-11-18 at 17:14 +, Nikos Roussos wrote:
> On November 18, 2014 7:08:47 PM EET, Benjamin Kreuter  
> wrote:

> >How about an opt-in requirement?
> 
> Yes, that would make more sense.
> But I didn't opt-in to see commercial websites on gnome-shell either (and I 
> can't even opt-out).

OK, so that would also be turned off by default.  Is there some reason
why that would be a bad thing for Fedora users or developers?

-- Ben



signature.asc
Description: This is a digitally signed message part
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Reindl Harald



Am 18.11.2014 um 18:29 schrieb Bruno Wolff III:

On Tue, Nov 18, 2014 at 18:16:12 +0100,
  drago01  wrote:

On Tue, Nov 18, 2014 at 3:00 PM, Bruno Wolff III  wrote:


We shouldn't be doing that either. Any welcome page initially displayed
should be from a copy on the installation, not something fetched from a
remote server.


That's getting into the "paranoid" area .. where do you draw the line?
The fedora project (and lots of its mirros)also gets your ip when the
system checks for updates,


Mozilla is a third party. There is no reason that they should be
contacted by default.


calling upstream "3rd party" is somehow strange
most code in fedora is from 3rd party

if you don't trust the 3rd party you *really* need to review every 
single line of code



Even for mirrors, people run local mirrors. Not every installation
contacts Fedora mirrors directly.


most of them for sure not because hide the IP

typically it's done because someone has to maintain 5, 10, 20, 100 
machines and want to save time and/or bandwidth, maybe even combined 
with save ressources of the official mirrors



The cost of avoiding phoning home in tese cases is low. You can install
a copy of the file locally and use a file: reference to it. The file can
include a link to the source so that people can fetch a possibly more up
to date version if they want.


nobody said anything against that

*but* please avoid FUD and paranoia and claim upstream unstrustable 
until you can prove that instead of assume it




signature.asc
Description: OpenPGP digital signature
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora


On Tue, Nov 18, 2014 at 18:16:12 +0100,
 drago01  wrote:

On Tue, Nov 18, 2014 at 3:00 PM, Bruno Wolff III  wrote:


We shouldn't be doing that either. Any welcome page initially displayed
should be from a copy on the installation, not something fetched from a
remote server.


That's getting into the "paranoid" area .. where do you draw the line?
The fedora project (and lots of its mirros)also gets your ip when the
system checks for updates,


Mozilla is a third party. There is no reason that they should be contacted 
by default.


Even for mirrors, people run local mirrors. Not every installation contacts 
Fedora mirrors directly.


The cost of avoiding phoning home in tese cases is low. You can install a 
copy of the file locally and use a file: reference to it. The file can 
include a link to the source so that people can fetch a possibly more 
up to date version if they want.

--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Tomas Radej


Hi,

On 11/18/2014 05:46 PM, Gerald B. Cox wrote:

On Tue, Nov 18, 2014 at 7:17 AM, Tomas Radej  wrote:


I believe M$ made "good experience" with ballot screen, may be we should

implement something similar in open source spirit ;)



If we do not want Firefox as default, this seems to be much better option
than just replacing it with a specific one IMHO.



The "ballot screen" was required to be developed by Microsoft as part of
the settlement of the anti-trust case with the EU.  Mozilla's Firefox ads
don't even begin to approach what Microsoft was doing.  We don't need a


Nobody said we'd do it for the same reason.


"default-o-matic" program where people would end up choosing Firefox
anyway.  If we really wanted to provide a free alternative to Firefox, we'd
get Chromium working - it is really the only viable alternative.


While I concur that there's not much alternative to Firefox, I think in 
this context, choosing Chromium is going out of the frying pan and into 
the fire. I might have been doing it wrong, but even after I disabled 
every single call-home thing I could, wireshark still detected a few 
packets sent to Google servers upon Chromium starting, whereas with 
Firefox, nothing was sent at all until I started typing in the address bar.


Additionally, the "Google way" of open source development is arguably 
less-than-stellar, as illustrated in [1], and some of the bugs that 
prevent Chromium to be present in the mainline Fedora repositories have 
been open since 2009 without much progress (listed as blockers for [2]).


Based on the aforementioned, I think it's infinitely easier to fix 
Firefox than push for Chromium.


Tomas Radej

[1] 
http://ostatic.com/blog/making-projects-easier-to-package-why-chromium-isnt-in-fedora


[2] https://code.google.com/p/chromium/issues/detail?id=28287




--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread drago01

On Tue, Nov 18, 2014 at 6:14 PM, Nikos Roussos
 wrote:
> On November 18, 2014 7:08:47 PM EET, Benjamin Kreuter  
> wrote:
>>On Tue, 2014-11-18 at 15:12 +0200, Nikos Roussos wrote:
>>
>>> This is a moral judgment, so it's irrelevant for making a policy
>>> decision (from Fedora's point of view). Money or not, we need a
>>> consistent policy on advertisements for all upstream.
>>
>>How about an opt-in requirement?
>
> Yes, that would make more sense.
> But I didn't opt-in to see commercial websites on gnome-shell either (and I 
> can't even opt-out).

You can disable the search provider in Settings -> Search
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread drago01

On Tue, Nov 18, 2014 at 3:00 PM, Bruno Wolff III  wrote:
> On Tue, Nov 18, 2014 at 14:58:41 +0100,
>  Martin Stransky  wrote:
>>
>>
>> Another way how to promote Fedora is to set "welcome" page to
>> start.fedoraproject.org. It appears when Firefox starts on fresh profile and
>> can point people to the Fedora project.
>
>
> We shouldn't be doing that either. Any welcome page initially displayed
> should be from a copy on the installation, not something fetched from a
> remote server.

That's getting into the "paranoid" area .. where do you draw the line?
The fedora project (and lots of its mirros)also gets your ip when the
system checks for updates,
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

On November 18, 2014 7:08:47 PM EET, Benjamin Kreuter  
wrote:
>On Tue, 2014-11-18 at 15:12 +0200, Nikos Roussos wrote:
>
>> This is a moral judgment, so it's irrelevant for making a policy
>> decision (from Fedora's point of view). Money or not, we need a
>> consistent policy on advertisements for all upstream.
>
>How about an opt-in requirement?

Yes, that would make more sense.
But I didn't opt-in to see commercial websites on gnome-shell either (and I 
can't even opt-out).

-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Benjamin Kreuter

On Tue, 2014-11-18 at 15:12 +0200, Nikos Roussos wrote:

> This is a moral judgment, so it's irrelevant for making a policy
> decision (from Fedora's point of view). Money or not, we need a
> consistent policy on advertisements for all upstream.

How about an opt-in requirement?

-- Ben



signature.asc
Description: This is a digitally signed message part
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Gerald B. Cox

On Tue, Nov 18, 2014 at 7:17 AM, Tomas Radej  wrote:

> I believe M$ made "good experience" with ballot screen, may be we should
>> implement something similar in open source spirit ;)
>>
>
> If we do not want Firefox as default, this seems to be much better option
> than just replacing it with a specific one IMHO.


The "ballot screen" was required to be developed by Microsoft as part of
the settlement of the anti-trust case with the EU.  Mozilla's Firefox ads
don't even begin to approach what Microsoft was doing.  We don't need a
"default-o-matic" program where people would end up choosing Firefox
anyway.  If we really wanted to provide a free alternative to Firefox, we'd
get Chromium working - it is really the only viable alternative.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Tomas Radej


Hi,

On 11/16/2014 05:36 PM, Vít Ondruch wrote:

Dne 15.11.2014 v 15:06 Kevin Kofler napsal(a):

Lars Seipel wrote:

What does the community think of it? Is it okay for our flagship
applications to carry ads and report tracking data?

No!

IMHO, we should consider dropping Firefox from Fedora entirely, in favor of
Epiphany for Workstation and Midori for the Spins (except the KDE Spin which
already ships Konqueror as the browser).


With all due respect to the developers, Midori is not production ready.



 Kevin Kofler



I believe M$ made "good experience" with ballot screen, may be we should
implement something similar in open source spirit ;)


If we do not want Firefox as default, this seems to be much better 
option than just replacing it with a specific one IMHO.


Tomas Radej
--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Martin Stransky


On 11/17/2014 02:15 AM, Kevin Kofler wrote:

Ralf Corsepius wrote:

Well, how to put it ... Mozilla.com's role in fedora has many times been
subject to controvercies, but doubts have always been ruled ;)


They always get special exceptions for any and all Fedora policies that
upstream does not want to comply with, with the excuse that otherwise we
might lose the right to use the "Firefox" name (as if that were a
catastrophe – Debian has been doing fine with "Iceweasel"). I'm totally fed
up of that kind of unfair privileged treatment that NO other package in
Fedora is getting.


I don't understand what are you talking about. Firefox in Fedora tries 
to carry minimal amount of patches because it's difficult to maintain 
those patches and rebase/update them with each Firefox release. If we 
need any modification in Fedora we ship it.


All active Firefox development happens upstream anyway (gtk3 port, 
libnotify support recently) so Fedora does not need any extra patches, 
we get them from upstream anyway.


If there's any issue which breaks Fedora rules, please file a bug and 
ideally add a patch for it. I'll gladly help you to fix any issue. I 
know only about some bundled libraries, but we don't have a fix for that 
and there are more pressing issues to fix.


ma.
--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora


On Tue, Nov 18, 2014 at 14:58:41 +0100,
 Martin Stransky  wrote:


Another way how to promote Fedora is to set "welcome" page to 
start.fedoraproject.org. It appears when Firefox starts on fresh 
profile and can point people to the Fedora project.


We shouldn't be doing that either. Any welcome page initially displayed 
should be from a copy on the installation, not something fetched from 
a remote server.

--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Martin Stransky

Hi,

It looks like the recent Firefox "Adds" does not break any Fedora rules
so it's perfectly ok to ship it "as is".

The H264 codec download feature break the Fedora law and has been
removed from Fedora. When Fedora rules the Adds out of the apps it will
be removed from FF immediately. Until that it's a grey zone and may or
may not be removed/adjusted.

I understand you want to promote Fedora/Gnome on the titles instead of
some adds by Mozilla (no matter if it helps Mozilla to fund the browser
development). There's a option to pin more tabs here (on just the Fedora
start-up page) so we can provide our own set of start-up pages. Those
should be obviously well selected and confirmed by Fedora officials.
Please post your suggestions to #BZ and file a FESCO ticket for that.

Another way how to promote Fedora is to set "welcome" page to
start.fedoraproject.org. It appears when Firefox starts on fresh profile
and can point people to the Fedora project.

So let's start with this one, add the "Fedora titles" and discuss if
apps in Fedora are or are not allowed to show any Adds.

ma.

On 11/15/2014 02:25 PM, Lars Seipel wrote:

So Mozilla has recently gone live with its advertisement tiles on the
"New Tab" page. Only newly created profiles get to see this stuff.

On a pristine F21 install using Gnome, when first launching Firefox,
users are presented with a number of tiles, depending on screen size.
One of those is a so-called "sponsored" tile chosen from a range of
available advertisements (e.g. for booking.com, there's also one for the
Snowden movie), apparently depending on geographical location.

When this "feature" got originally announced[1], there was a discussion
on -devel if this kind of stuff is really appropriate for Fedora.

Some time later Mozilla seemed to have canceled the feature, quoting
"That’s not going to happen. That’s not who we are at Mozilla." as one
of the reasons[2].

Apparently, they (again) reconsidered, pushing the feature to nightlies
a few months ago. Well, it now hit the stable branch and, therefore,
Fedora.

This is how Mozilla pitches the feature to advertisers[3]:

To support ad personalization, Mozilla created an internal data system
that aggregates user information while stripping out personally
identifiable information. Mozilla can track impressions, clicks, and the
number of ads a user hides or pins. Its advertising partners are also
privy to that data.

Personally, I don't think that showing advertisements on the free
software desktop is appropriate. Our users are supposed to be able to
fully trust our software. That's one of our most-often touted strenghts.
I don't think the ability to "track impressions, clicks, and the number
of ads a user hides or pins" is something that is compatible with that,
regardless of this data being tied to "personally identifiable
information" or not.

Firefox's behaviour is probably nothing extraordinary on the other
platforms Mozilla is targeting. Compared to the prevalent attitude of
proprietary vendors, especially on mobile, it doesn't sound that bad
anymore. I don't think that's a suitable scale for Fedora, though.

From a user perspective, it's not that hard to disable the feature. Upon
first seeing that page a tooltip is shown to hint at the possibility.
Users can choose between three modes, "Enhanced", "Classic" and "Blank".
Contrary to what is stated in the Mozilla kb[4], the only one that
actually disables the ads is "Blank", which is equal to setting the new
tab page to about:blank.

What does the community think of it? Is it okay for our flagship
applications to carry ads and report tracking data?

[1]
https://blog.mozilla.org/advancingcontent/2014/02/11/publisher-transformation-with-users-at-the-center/
[2]
https://blog.mozilla.org/futurereleases/2014/05/09/new-tab-experiments/
[3]
http://www.adexchanger.com/online-advertising/mozilla-finally-releases-its-browser-ad-product-hints-at-programmatic-in-2015/
[4]
https://support.mozilla.org/de/kb/how-do-tiles-work-firefox#w_enhanced-tiles

--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Mathieu Bridon

On Tue, 2014-11-18 at 15:12 +0200, Nikos Roussos wrote:
> On 11/18/2014 02:55 PM, Benjamin Kreuter wrote:
> > On Tue, 2014-11-18 at 11:15 +0200, Nikos Roussos wrote:
>  I'm talking about the "advertisement" part. Some people seem to be
>  bothered by this alone. Tiles feature indeed promotes some websites, but
>  we already do that.
> >>>
> >>> No, actually we don't. We promote websites because we honestly think
> >>> they're useful, not because we're paid to do so.
> >>
> >> That's irrelevant. Paid or not, promoting websites through tiles or
> >> gnome-shell is the same form of advertisement.
> > 
> > Money is not irrelevant.  Paid advertising is how we wound up with
> > pop-ups, hover ads, etc.  The question is whether or not we can trust
> > Mozilla to steer clear of such things.  So far there seems to be no
> > reason to trust Mozilla -- the ads are opt-out, they only sometimes
> > respect DNT, and they are being pushed despite the backlash from
> > Mozilla's community.
> 
> This is a moral judgment, so it's irrelevant for making a policy
> decision (from Fedora's point of view).

As a community, we can certainly decide to base our policies on moral
judgments we make, just as we can decide to base them on technical
judgments. (or even a mix of both)

For example, we don't allow nonfree software in Fedora, and I for one
certainly hope it is not **entirely** a technical decision.


-- 
Mathieu

-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

On 11/18/2014 02:55 PM, Benjamin Kreuter wrote:
> On Tue, 2014-11-18 at 11:15 +0200, Nikos Roussos wrote:
 I'm talking about the "advertisement" part. Some people seem to be
 bothered by this alone. Tiles feature indeed promotes some websites, but
 we already do that.
>>>
>>> No, actually we don't. We promote websites because we honestly think
>>> they're useful, not because we're paid to do so.
>>
>> That's irrelevant. Paid or not, promoting websites through tiles or
>> gnome-shell is the same form of advertisement.
> 
> Money is not irrelevant.  Paid advertising is how we wound up with
> pop-ups, hover ads, etc.  The question is whether or not we can trust
> Mozilla to steer clear of such things.  So far there seems to be no
> reason to trust Mozilla -- the ads are opt-out, they only sometimes
> respect DNT, and they are being pushed despite the backlash from
> Mozilla's community.

This is a moral judgment, so it's irrelevant for making a policy
decision (from Fedora's point of view). Money or not, we need a
consistent policy on advertisements for all upstream.



signature.asc
Description: OpenPGP digital signature
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-18 Thread Benjamin Kreuter

On Tue, 2014-11-18 at 11:15 +0200, Nikos Roussos wrote:
> >> I'm talking about the "advertisement" part. Some people seem to be
> >> bothered by this alone. Tiles feature indeed promotes some websites, but
> >> we already do that.
> > 
> > No, actually we don't. We promote websites because we honestly think
> > they're useful, not because we're paid to do so.
> 
> That's irrelevant. Paid or not, promoting websites through tiles or
> gnome-shell is the same form of advertisement.

Money is not irrelevant.  Paid advertising is how we wound up with
pop-ups, hover ads, etc.  The question is whether or not we can trust
Mozilla to steer clear of such things.  So far there seems to be no
reason to trust Mozilla -- the ads are opt-out, they only sometimes
respect DNT, and they are being pushed despite the backlash from
Mozilla's community.

At the very least Fedora should turn this feature off.  My computer
should only become a platform for displaying commercial ads if I
explicitly opt-in to such a feature.

-- Ben

signature.asc
Description: This is a digitally signed message part
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

On 11/18/2014 08:24 AM, Nico Kadel-Garcia wrote:
> On Sun, Nov 16, 2014 at 3:54 PM, Nikos Roussos
>  wrote:
>> On 11/16/2014 08:24 PM, Christopher wrote:
>>> On Sun, Nov 16, 2014 at 6:46 AM, Mustafa Muhammad
>>> mailto:mustafaa.alhamda...@gmail.com>>
>>> wrote:
> 
>>> This doesn't seem relevant to this discussion, unless Fedora browsers
>>> are automatically, and without the user's explicit knowledge or
>>> permission, navigating to Google's search engine, which (AFAICT) they
>>> are not.
>>
>> Same happens with these tiles. No data is sent back to Mozilla unless
>> you *choose* to click one of the promoted tiles.
> 
> Even if not sent to Mozilla, it's accessible to the advertisers. I
> could spend a long time explaining the various means, that web
> advertisers track their users, ranging from crafting URL's and
> metadata about the particular requests to 'web bugs', those little one
> pixel transparent gifs so ubiquitous on the plethora of
> ad.doublelick.net websites with fake names used to collect the data.

The tiles are coming from Mozilla. So yes please explain how the
advertisers can track me through them if I don't click them.




signature.asc
Description: OpenPGP digital signature
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

>> I'm talking about the "advertisement" part. Some people seem to be
>> bothered by this alone. Tiles feature indeed promotes some websites, but
>> we already do that.
> 
> No, actually we don't. We promote websites because we honestly think
> they're useful, not because we're paid to do so.

That's irrelevant. Paid or not, promoting websites through tiles or
gnome-shell is the same form of advertisement.



signature.asc
Description: OpenPGP digital signature
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Lars Seipel

On Mon, Nov 17, 2014 at 12:05:35PM +0200, Nikos Roussos wrote:
> True, as you also have to explicitly click a tile to send data to
> Mozilla.

Well, I don't think the act of hiding/closing an ad (by clicking on the
'x' attached to it) can be reasonably interpreted as informed consent.
Yet, it is explicitly listed among the tracked actions according to what
Darren Herman apparently told the advertiser community.

> No. We are talking about the tiles. I didn't see anyone suggesting we
> remove Google search. It's like the tiles feature crossed a line, which
> is far from truth.

I'm not sure about that. Besides the feature itself, there's also the
issue of the language used to explain it. Describing the placement of
advertisements as an "enhancement" to users, in my opinion, definitely
crosses the line to dishonesty and bullshitting of users.

Really, this stuff is communicated in a form of double-speak marketing
verbiage that I'm just not used to hear in communicating with open
source projects. Read the initial blog posts about it.

> I'm talking about the "advertisement" part. Some people seem to be
> bothered by this alone. Tiles feature indeed promotes some websites, but
> we already do that.

No, actually we don't. We promote websites because we honestly think
they're useful, not because we're paid to do so.

I don't think we should drop Firefox from the default installation. I
really like it, despite something at Mozilla going terribly wrong
lately. I do think this "feature" needs to be shipped as off by default,
though.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Nico Kadel-Garcia

On Sun, Nov 16, 2014 at 3:54 PM, Nikos Roussos
 wrote:
> On 11/16/2014 08:24 PM, Christopher wrote:
>> On Sun, Nov 16, 2014 at 6:46 AM, Mustafa Muhammad
>> mailto:mustafaa.alhamda...@gmail.com>>
>> wrote:

>> This doesn't seem relevant to this discussion, unless Fedora browsers
>> are automatically, and without the user's explicit knowledge or
>> permission, navigating to Google's search engine, which (AFAICT) they
>> are not.
>
> Same happens with these tiles. No data is sent back to Mozilla unless
> you *choose* to click one of the promoted tiles.

Even if not sent to Mozilla, it's accessible to the advertisers. I
could spend a long time explaining the various means, that web
advertisers track their users, ranging from crafting URL's and
metadata about the particular requests to 'web bugs', those little one
pixel transparent gifs so ubiquitous on the plethora of
ad.doublelick.net websites with fake names used to collect the data.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Rejy M Cyriac

On 11/17/2014 09:23 PM, Chuck Anderson wrote:
> On Sat, Nov 15, 2014 at 02:25:48PM +0100, Lars Seipel wrote:
>> So Mozilla has recently gone live with its advertisement tiles on the
>> "New Tab" page. Only newly created profiles get to see this stuff.
> 
> I started seeing the advertisement tiles on my existing profile.
> 
It looks like the 'advertisement tiles' come up even on old profiles, if
the default start page had been left unmodified. If the default
start(home) page had earlier been explicitly set to blank or to some
other site, as I had done in one of my systems, the 'advertisement
tiles' do not come up, unless you go click that 'gear' on the top right
in a tab, and select 'enhanced' or 'classic'.

By the way, anyone know why 'enhanced' and 'classic' behave the same ?

-- 
Regards,

Rejy M Cyriac (rmc)
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Gerald B. Cox

On Mon, Nov 17, 2014 at 1:27 PM, Reindl Harald 
wrote:

> forget it


Yup, that really perfectly sums it up.  The introduction of ads by Mozilla
breaks no Fedora policy, period, end of story.  Notwithstanding the fact
that they are unobtrusive and ridiculously simple to disable.  The only
viable real world free alternative is the Chromium project and it hasn't
yet made it into the official Fedora repository.  The only result from
removing Firefox would be to unnecessarily piss off a vast number of users.

If anything, the resources and angst over Firefox ads should be redirected
to assist in cleaning up whatever mess is preventing Chromium from finally
getting into the official Fedora repositories.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora



Am 17.11.2014 um 22:25 schrieb DJ Delorie:

Not every user understands the connection between "website does not
work" -> "firewall configuration"


True, which means that we have to use words that they *do* understand


forget it

really, after working more than a decade with every sort of users from 
high technical ones to just a ordinary user: forget it, you can use 
whatever words you want - nobody will read them






signature.asc
Description: OpenPGP digital signature
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread DJ Delorie


> Not every user understands the connection between "website does not
> work" -> "firewall configuration"

True, which means that we have to use words that they *do* understand.

For extra coolness, a per-user firewall and some way of popping up a
query dialog when they violate a firewall rule.  "We detected you're
trying to access *mozilla.com, which is currently blocked due to your
privacy choices.  Would you like to enable access to *mozilla.com at
this time?"

Not that I expect such a tool to be practical, if even possible... ;-)
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora



Am 17.11.2014 um 22:16 schrieb drago01:

On Mon, Nov 17, 2014 at 9:57 PM, DJ Delorie  wrote:



Ugh .. sorry but that's the worst suggestion so far. No image the user
goes to http://addons.mozilla.org/ to install addons ... it won't
work. (just one random example but you get the idea).


I imagine the user would change the start page to about:blank, then
open the firewall, then everything works as normal.

Of course, this only works for single-user machines.  A multi-user
machine wouldn't protect the second user to run Firefox.


Not every user understands the connection between "website does not
work" -> "firewall configuration"


not a single "non-tech" user does

whatever that discussion is worth: throw away firefox because a issue 
you have on 90% of all websites and force users to use a different 
browser don't work


in the best case they download the binary from mozilla.org because they 
want it (especially users working on more than one OS trying to have the 
same software whenever possible on all of them) or ask yourself if a 
different distribution works better (better from the users point of view)


you need to outweight the win and the damage

these days you have two user groups:
 * tech users who cares: set about:blank
 * normal users -> don't care

if somebody removes Firefox from the repos i just continue to use it 
without packages - no auto updates or make the install dir writeable for 
everyone - the second option throws away security for excatly what benefit?


surely - *i can* care about that and call FF one a week for update it, 
the majority of users won't do that without any "but", "or" and "if"




signature.asc
Description: OpenPGP digital signature
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread drago01

On Mon, Nov 17, 2014 at 9:57 PM, DJ Delorie  wrote:
>
>> Ugh .. sorry but that's the worst suggestion so far. No image the user
>> goes to http://addons.mozilla.org/ to install addons ... it won't
>> work. (just one random example but you get the idea).
>
> I imagine the user would change the start page to about:blank, then
> open the firewall, then everything works as normal.
>
> Of course, this only works for single-user machines.  A multi-user
> machine wouldn't protect the second user to run Firefox.

Not every user understands the connection between "website does not
work" -> "firewall configuration"
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Stephen John Smoogen

On 17 November 2014 13:57, DJ Delorie  wrote:

>
> > Ugh .. sorry but that's the worst suggestion so far. No image the user
> > goes to http://addons.mozilla.org/ to install addons ... it won't
> > work. (just one random example but you get the idea).
>
> I imagine the user would change the start page to about:blank, then
> open the firewall, then everything works as normal.
>
> Of course, this only works for single-user machines.  A multi-user
> machine wouldn't protect the second user to run Firefox.
>

In the days of CDN's and other tricks to deal with no more IPv4 ips you
can't block *.mozilla.org without also blocking everything from CNN to your
local bank. The ips may change all the time or they may be leased to
someplace for a short time.


> --
> devel mailing list
> devel@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/devel
> Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
>



-- 
Stephen J Smoogen.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread DJ Delorie


> Ugh .. sorry but that's the worst suggestion so far. No image the user
> goes to http://addons.mozilla.org/ to install addons ... it won't
> work. (just one random example but you get the idea).

I imagine the user would change the start page to about:blank, then
open the firewall, then everything works as normal.

Of course, this only works for single-user machines.  A multi-user
machine wouldn't protect the second user to run Firefox.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread drago01

On Mon, Nov 17, 2014 at 9:32 PM, DJ Delorie  wrote:
>
>> That's also a questionable "feature". Such a text box should not send
>> anything before you confirm it.
>
> Perhaps as part of the firewall installation step, the user could be
> given a list of sites that their PC may "call home" to - including
> official repos - and let them opt-in or opt-out accordingly.  If we
> block, say, *.mozilla.com at the firewall level, there's no chance
> that firefox will call home before the user has a chance to set their
> preferences.

Ugh .. sorry but that's the worst suggestion so far. No image the user
goes to http://addons.mozilla.org/ to install addons ... it won't
work. (just one random example but you get the idea).
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread DJ Delorie


> That's also a questionable "feature". Such a text box should not send 
> anything before you confirm it.

Perhaps as part of the firewall installation step, the user could be
given a list of sites that their PC may "call home" to - including
official repos - and let them opt-in or opt-out accordingly.  If we
block, say, *.mozilla.com at the firewall level, there's no chance
that firefox will call home before the user has a chance to set their
preferences.

Of course, we'd need an obvious way to let them opt-in later, after
they've set their preferences, else "why doesn't google work?" and
"why can't I yum update?" will become FAQs.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Kevin Kofler

Florian Weimer wrote:
> And I'm sorry to say that I think the UI is still confusing and may not
> achieve the goal of obtaining informed consent.

For example, do users realize that using the retrace server means sending 
the backtrace to the server, so they have effectively uploaded it even if 
they're not attaching it to the bug report (or even not filing a bug report 
at all)?

Kevin Kofler

-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Kevin Kofler

Nikos Roussos wrote:
> And a user may accidentally start searching on the Google search box
> before she realizes that she sends data to Google "as she types" (that's
> how you get recommendations).

That's also a questionable "feature". Such a text box should not send 
anything before you confirm it.

(And I don't like separate search boxes as a UI element to begin with, I 
like Konqueror's "web shortcuts" feature, where I can just type gg: and my 
search query in the address bar.)

Kevin Kofler

-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Gerald B. Cox

People keep bringing up policy violations, but when asked you either get
"crickets" or the subject slightly changed.  The only policy that I could
find that might apply would be Fedora Forbidden Items
 and if
you read it, you'll find that it absolutely does not apply in this
situation.

Now, let's be somewhat pragmatic here... you're going to get rid of Firefox
(which doesn't violate any Fedora policies) and replace it with exactly
what? Konqueror, Web (the browser formally known as Epiphany), Midori,
etc.?  Really?  Does anyone seriously believe that these products would be
embraced by our user base?  Someone mentioned IceCat earlier... I installed
the current version in the Fedora 20 repository and let's just say that it
had a few formatting issues and leave it at that.  The vast majority of
folks are just going to roll their eyes and install Firefox or Google
Chrome.

On Mon, Nov 17, 2014 at 11:00 AM, Matthew Miller 
wrote:

> On Mon, Nov 17, 2014 at 07:08:36PM +0100, Ralf Corsepius wrote:
> > >>So Mozilla has recently gone live with its advertisement tiles on the
> > >>"New Tab" page. Only newly created profiles get to see this stuff.
> > >So, here's a (genuine) question: how is this behavior different, from a
> > >Fedora policy point of view, than if the default for new tabs were to
> > >go to , and Mozilla ran advertisements on
> > >that page?
> > IMO, the default of https://start.mozilla.org violates fedora
> > policies and ought to be changed.
>
> Ralf, what policies are you referring to here?
>
>
> --
> Matthew Miller
> 
> Fedora Project Leader
> --
> devel mailing list
> devel@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/devel
> Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
>
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

On Mon, Nov 17, 2014 at 07:08:36PM +0100, Ralf Corsepius wrote:
> >>So Mozilla has recently gone live with its advertisement tiles on the
> >>"New Tab" page. Only newly created profiles get to see this stuff.
> >So, here's a (genuine) question: how is this behavior different, from a
> >Fedora policy point of view, than if the default for new tabs were to
> >go to , and Mozilla ran advertisements on
> >that page?
> IMO, the default of https://start.mozilla.org violates fedora
> policies and ought to be changed.

Ralf, what policies are you referring to here?


-- 
Matthew Miller

Fedora Project Leader
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Ralf Corsepius


On 11/17/2014 09:35 AM, Florian Weimer wrote:

On 11/16/2014 06:31 AM, Ralf Corsepius wrote:

On 11/15/2014 11:41 PM, Johannes Lips wrote:


I don't really understand the issue at all.



We have a "no-phone-home" and "no-spy" policy in Fedora.


I don't think we do.

It's should be to be part of the FPG ;)

We (FPC) were fighting packages phoning home since the earliest days of 
FPC - You might recall the discussions on phone-home and data-privacy in 
smolt, abrt and packages wanting to add "3rd party repos".


I also believe to recall FPC once having discussed how to handle 
packages which distribute ads, but I don't recall us having taken a 
decision - I personally, would be very strongly opposed to this, because 
this would open a can of worms in many areas.



It's certainly an area, which in the ages of espionage, big-data, ads 
and virus-infected ads needs to be clarified.



Anaconda, for example, phones home even before you select the
installation media.
What does it transmit? IIRC, the only permitted "phone-home" was 
accessing "yum metadata" and mirrorlists.


Ralf


--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Ralf Corsepius


On 11/17/2014 04:14 PM, Matthew Miller wrote:


On Sat, Nov 15, 2014 at 02:25:48PM +0100, Lars Seipel wrote:

So Mozilla has recently gone live with its advertisement tiles on the
"New Tab" page. Only newly created profiles get to see this stuff.


So, here's a (genuine) question: how is this behavior different, from a
Fedora policy point of view, than if the default for new tabs were to
go to , and Mozilla ran advertisements on
that page?


IMO, the default of https://start.mozilla.org violates fedora policies 
and ought to be changed.


It's a phone-home function, which can only be opted out by digging into 
preferences.


Ralf


--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

On Sun, Nov 16, 2014 at 06:31:39AM +0100, Ralf Corsepius wrote:
> >I don't really understand the issue at all.
> We have a "no-phone-home" and "no-spy" policy in Fedora.

*Is* there a formal, written policy somewhere? (And, while related to
the advertising issue, this seems separate in many ways.)


-- 
Matthew Miller

Fedora Project Leader
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Chuck Anderson

On Sat, Nov 15, 2014 at 02:25:48PM +0100, Lars Seipel wrote:
> So Mozilla has recently gone live with its advertisement tiles on the
> "New Tab" page. Only newly created profiles get to see this stuff.

I started seeing the advertisement tiles on my existing profile.
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

On Sat, Nov 15, 2014 at 02:25:48PM +0100, Lars Seipel wrote:
> So Mozilla has recently gone live with its advertisement tiles on the
> "New Tab" page. Only newly created profiles get to see this stuff.

So, here's a (genuine) question: how is this behavior different, from a
Fedora policy point of view, than if the default for new tabs were to
go to , and Mozilla ran advertisements on
that page? 

-- 
Matthew Miller

Fedora Project Leader
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

On Mon, Nov 17, 2014 at 02:32:39PM +, Richard W.M. Jones wrote:
> Also having the Fedora policy be clear and unambiguous.  Who would
> deal with that?  FESCO?  The Board (or whatever it's called these days)?

FESCo for the technical side, board for high-level guidance.


-- 
Matthew Miller

Fedora Project Leader
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora



Am 17.11.2014 um 15:28 schrieb Bruno Wolff III:

On Mon, Nov 17, 2014 at 15:06:21 +0100,
  Reindl Harald  wrote:

Am 17.11.2014 um 14:41 schrieb Bruno Wolff III:

The referer header is sent by default. It isn't obvious how to disable
that


please don't propose disable the Referer globally
a samrt default would be
https://addons.mozilla.org/DE/firefox/addon/smart-referer/ to send it
only to the same domain


Having to install a third party package to do this doesn't make it
simple. This feature should be built in.


agreed - please try to convience Mozilla for that change instead propose 
send none at all



Some people may not want to supply referer headers when moving around
within sites. For that there should be a per domain override similar to
cookies.


everytime when people come out with "how to disable referrer,
javascript and the useragent" they have no clue what harm they are
doing for sane websites wich try to protect themself and their owners
from automated attacks / junk


Web sites should work just fine without a supplied user agent. If they
don't, they are broken. bots can forge common user agent strings easily,
relying on checking for user agent for security purposes is silly


i really do not need here to explain over a lot of text how you can 
*improve* the security of froms meaning "make it harder to submit them 
automated"



number of sites think there are only 3 or 4 different browers and refuse
to work if you aren't using one of them. Other web sites aren't designed
to handle the optional user agent header not being supplied and will
break needlessly


and a number of sites works around horrible browser bugs of old client 
software which sadly exists (the more business related a website is that 
more stone old clients are coming you can't refuse)


it would be way off-topic to explain what workarounds i needed to 
implement based on the user-agent to not hurt standard conform browsers 
and if it is only for image silders *only and really only* for MSIE8 add 
a ?random=time() to URL's because the cached ones break while other 
browsers happily can cache them instead load again and again the same stuff


if you ever worked more than 10 years in producing standard conform 
websites working on *any* browsers you would know what i mean




signature.asc
Description: OpenPGP digital signature
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Bruno Wolff III


On Mon, Nov 17, 2014 at 15:06:21 +0100,
 Reindl Harald  wrote:


Am 17.11.2014 um 14:41 schrieb Bruno Wolff III:

Firefox is really not set up with privacy as a high priority. Some bad
things it does from a privacy perspective are:

If you type a name in the url bar and send, if the name dosn't match a
domain google is contacted. (And it is google even if you have some
other search engine set.)

OSCP is used to check for certificate revocations. For some threat
models this cure is worse than the disease. There should be an easy way
to disable this.


not such problem if more sites would be configured properly
http://en.wikipedia.org/wiki/OCSP_stapling


That does sound like an improvement, but I haven't run across an easy way 
to enable that while disabling normal OCSP.



Javascript is not easy to disable without installing a third party
plugin, and the way that plugin works still leaves some exposure to
javascript related issues.


and everytime a newspaper recommends to disable it weeks later we got 
complaints that some forms don't work because tech to make it harder 
submit them automated until analyze what JS actions are expected


javascript is way too powerful to leave on for any old web site. Most 
web sites way over use it. Yes it is needed for web sites that are 
really applications, but most websites could be set up so they are 
usable without it. They just don't bother.



The referer header is sent by default. It isn't obvious how to disable
that


please don't propose disable the Referer globally
a samrt default would be 
https://addons.mozilla.org/DE/firefox/addon/smart-referer/ to send it 
only to the same domain


Having to install a third party package to do this doesn't make it simple. 
This feature should be built in.


Some people may not want to supply referer headers when moving around 
within sites. For that there should be a per domain override similar 
to cookies.


everytime when people come out with "how to disable referrer, 
javascript and the useragent" they have no clue what harm they are 
doing for sane websites wich try to protect themself and their owners 
from automated attacks / junk


Web sites should work just fine without a supplied user agent. If they 
don't, they are broken. bots can forge common user agent strings easily, 
relying on checking for user agent for security purposes is silly. 
A number of sites think there are only 3 or 4 different browers and refuse 
to work if you aren't using one of them. Other web sites aren't designed 
to handle the optional user agent header not being supplied and will 
break needlessly.

--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora

2014-11-17 Thread Richard W.M. Jones

On Mon, Nov 17, 2014 at 07:41:22AM -0600, Bruno Wolff III wrote:
> On Mon, Nov 17, 2014 at 12:05:35 +0200,
>  Nikos Roussos  wrote:
> >
> >No. We are talking about the tiles. I didn't see anyone suggesting we
> >remove Google search. It's like the tiles feature crossed a line, which
> >is far from truth.
> 
> Firefox is really not set up with privacy as a high priority. Some
> bad things it does from a privacy perspective are:
> 
> If you type a name in the url bar and send, if the name dosn't match
> a domain google is contacted. (And it is google even if you have
> some other search engine set.)
> 
> OSCP is used to check for certificate revocations. For some threat
> models this cure is worse than the disease. There should be an easy
> way to disable this.
> 
> There is not a way to disable fetching all offsite references that
> aren't whitelisted. There is a hard way to do this for images, but
> there does not appear to be a way to do this for other object types.
> 
> The initial initial page is not set to about:blank, so that some
> site will be contacted (I think it is a Fedora page now.) before you
> have a chance to set it to about:blank in firefox. (It is possible
> to change this outside of Firefox, but it is hard.)
> 
> When firefox has a version update mozilla is contacted to present
> you with the release notes for the new version. It is possible to
> disable this, but it isn't really obvious how. (Even if you have
> done it before.)
> 
> Javascript is not easy to disable without installing a third party
> plugin, and the way that plugin works still leaves some exposure to
> javascript related issues.
> 
> There is a safe browsing feature that also will phone home.
> 
> If you look at the about:config menu you will see lots of URLs and
> it isn't clear when these URLs are used in many cases.
> 
> The referer header is sent by default. It isn't obvious how to disable that.
> 
> It isn't obvious how to disable remotes sites storing data locally.
> This feature can be used like cookies and should be easily
> controllable.

This is a good analysis.  However I hope people don't take away from
it "OMG there's nothing we can do".  We can work on making it better
incrementally, and fixing this advert tabs thing is a good place to
start.

Also having the Fedora policy be clear and unambiguous.  Who would
deal with that?  FESCO?  The Board (or whatever it's called these days)?

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v
-- 
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

Re: Mozilla enabled ads in Firefox and they're active in Fedora