Privacy? What is it doing? Explanation needed. #5907
Replies: 12 comments 83 replies
|
Well that was a fast-fail. Is there a Firefox fork that does NOT connect to Google by default? Like even LibreWolf had (still does?) an issue where it would connect to Google servers for "push" notifications, and when somebody filed a bug against it, they said it wasn't a problem. Like how hard can it be: you stripped all of the connect-to-Google from the browser, but you insist on leaving that one feature in by default. But then I'm supposed to trust you on everything else. |
wow! look at what you (a person who doesn't use Zen) are doing! |
I don't see any investigations leading to constructive feedback nor PRs to fix those same highlighted issues. Just comments that belittle other's work |
You're being ridiculous. The owner of the project belittled people's privacy concerns here. Who, in their right mind, would take the time to make a pull request? Constructive feedback has been provided, it was dismissed. You haven't provided an ounce of constructive feedback or argument. Just crying about how Zen is being "belittled", and spreading FUD about how it's all too complicated and connections to MozGoogle are necessary. |
that's an exact example of knowing who's belittling whom.
another example of the same.
In all my comments, I have never once said that the connections were necessary. Please read through the whole discussion once again and cite examples where I have done so. |
|
There's no point in debating the topic any more. I'm going to refrain from adding to the noise |
|
Yeah and the telemtry is not disabled either. If you go into the about:config page it all there with urls and some are enabled including pings. Seems like the privacy marketing is just that, marketing. Its not privacy focused at all. Ungoogled chrormium or maybe Orion browser seems like an option though the latter is not open source. I also raised an issue about these questions a while ago and got no response from the devs about this. So I dont trust that the developers truly are privacy focused here. Id stay away from this browser |
I was going to go with ungoogled-chromium, which ironically seems like the best "no Google" browser out there (even though chromium is a Google project), but then all my current profiles are in Firefox, it helps contribute to the chromium near monopoly, and there's the whole v3 manifest downgrade for uBlock. I'm definitely not going closed source. For now, I will stick with Firefox via Debian, with all the usual configurations to de-crapify it, but long term I'm going to start contributing to Servo, a web engine written in Rust. There's already a lot there, but it still needs a ton of work to be a daily driver. I was thinking about Ladybird, but the world doesn't need another C++ based browser. |
|
Manifest V2 for ungoogled chromium is still in discussion with some paths forward such as supporting beyond deprecation or integrating an adblocker directly into the browser. |
|
Looked into it a little bit, and some of these are due to: Some wifi stuff - probably good if you're on wifi that has a login portal before you can use it. Geo location - not sure why it needs my geo location before any site has asked for it. Firefox push services (Notifications) - again, not sure why it's enabled/sharing my data with mozilla/firefox before any site has even asked to send notifications. Login breach information This one is interesting because I've never used firefox monitor, and I do not have any of the "security"/"block dangerous content" stuff enabled. Yet it's still enabled and sharing data with mozilla/Firefox. There was another one related to firefox profiles (?) and Sync. Again, i don't use profiles, no sync, nothing so I don't know why it talks to mozilla/firefox and shares data. This list is not complete. |
|
I think the biggest fail is that default Google search box. |
|
That really put me off. I get why Google search is default, but once I switched to DDG and then it is still pushing google search when I hit Ctrl + T, that was very sketch. took me forever to figure out how to remove that. |
|
I agree that Google should not be a built-in shortcut in Zen. I have attempted to figure out how to remove it by default by tweaking configs, but was not successful, and removing the shortcut via clickGUI was the only reliable way. Please tell me or make a PR directly if you or anyone here finds a way. |
There is nothing to tell me. If you want to be a privacy-lite browser that has minor changes to what Firefox gives you, then just say you have "privacy enhancements like (blah blah)". At the end of the day, the maintainer can and will do whatever he wants, but if you come out trumpeting how privacy-focused your browser is in the very first sentence, expect people who take that seriously to challenge you.
In my current Firefox on Debian: Edit -> Settings -> Search: "Show search suggestions" is unchecked. That means Google doesn't get my every keystroke if I just want to look up a bookmark, an open tab, or a previously visited site. In the "Default Search Engine" I put "Wikipedia", because there isn't a "None" option. I never search from the address bar. When I do a search, I use a bookmark for the search engine I want to use. This is what taking privacy seriously means. Data you want to go to a search engine is explicit. If you want to give users an option for easy search at the start, then yes, you should have something like a form and have them choose. But if you value convenience over privacy, and "everybody uses Google", then just accept the Google default, but stop claiming to be privacy-focused. You cannot be serious about privacy and sending every search keystroke to Google by default. |
|
@tomoverlund
if u mean the repo readme, if it would be changed from
Its Relative depending on the person
As u explained, u are very far in the privacy scale so u have higher minimum what u browser need to do, So why are u even here if u know its not up to ur level of privacy? And to re-iterate privacy-focused is relative word, So there is not realy a solid point to be made. |
I would change that to, "a balance between speed...", because as you've said multiple times, these things are relative, and there is no "perfect". But yes, otherwise that's a good statement that doesn't claim too much and should set user expectations appropriately.
As I've already explained elsewhere in this very long thread, after the latest Firefox fiasco, I looked at browser alternatives and Zen was one of the ones mentioned, and this topic was posted at that time, probably by somebody who was doing that same as me. I'm only sticking around because the topic is relevant and I'm subscribed. I'm not hanging around other issues or topics, injecting my opinions.
There's relative, and then there's sending every keystroke to the biggest privacy-invading company on the planet by default. And I'll decide when I have no further replies to make, thanks very much. |
Updated read me should now be more acurate.
Most people dont mind that since it makes up for froductivity but ye. Think we done now ✌️ |
Thanks for doing that. I'm glad something good came out of this thread.
Yes, most people value convenience over privacy. "Everybody uses Google".
More than likely. |
|
There appears to be a lot more features that would cause firefox to make connections, and they are transparent about it. Here's what I found: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections |
I think it would be useful for the installer or base configuration to apply the concept of removing telemetry and these connections all together if you market your browser as private. Otherwise just remove that marketing line since you are asking the user to make the browser private. |
|
Some things like experiments and studies are already disabled based on betterfox configs. Zen is inherently configured to be more private than firefox. You can go ahead and disable the remaining connections, for most of them, doing this will compromise on functionality. I do not believe the developers want to compromise core functionality of a browser for added "privacy" in the form of making less connections to the internet. |
This comment was marked as off-topic.
This comment was marked as off-topic.
Lulz. Here's what the landing page on GitHub says: "Experience tranquillity while browsing the web without people tracking you! Zen is a privacy-focused browser that blocks trackers, ads, and other unwanted content while offering the best browsing experience!" That's your VERY FIRST PARAGRAPH. Now you're saying your privacy policy says "from our part". Well great, you just offload it to the defaults. Like please, justify that first paragraph when you have a Google search box as default. Hello? How do you think Google makes their money? Tracking and ads. Nevermind all the connections that are their for "good reasons", if you can't get the search box right, you aren't remotely serious about privacy. |
|
@JSGRD22 Correct. For a good discussion on what the blog post means you can read the discussion at Hacker news https://news.ycombinator.com/item?id=43213612 Fundamentally, you need to strip firefox of all telemetry, pings etc now since the announcement from mozilla if you really want to experience tranquility while browsing the web with Zen browser. Mozilla sells your data. Not really much way around that. Id recommend the maintainers look at the approach that Ungoogled chromium takes. |
""In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners, including our optional ads on New Tab and providing sponsored suggestions in the search bar. We set all of this out in our Privacy Notice. Whenever we share data with our partners, we put a lot of work into making sure that the data that we share is stripped of potentially identifying information, or shared only in the aggregate, or is put through our privacy preserving technologies (like OHTTP)." Translation: They collect your data and sell ads. But don't worry, it's just to make Firefox "commercially viable". Run away from any open source project that has a "Terms of Use". Imagine bringing that poison to the open source community, and trying to pass it off as necessary. |
what are you talking about? What search box? This is stupid... |
As already posted: https://imgur.com/NmVcMh5 "Search with Google or enter a..." Tell me you can't be serious with this question. |
|
Just my last 2c on this topic. You guys have a built a nice browser and there is a real opportunity to build a private browser with manifest v2 support since mozilla will be keeping support for it. Ungoogled chromium now has a big discussion going on about what to do. You guys dont have that problem. If you take the approach they did however of completely stripping on out telemtry and any relation to mozilla from the browser I think you may have a a lot more people using this browser to continue using plugins like Ublock origin. I dont doubt it wont be easy or a lot of work but you guys promote and sell the browser as privacy conscious but it lacks a lot on that front. I hope you see the opportunity that exists here and go down that route. |
|
I think when I say stripping out I mean a lot more than just setting preferences. Again you can find further good examples of what I mean by looking at the patches that ungoogled chromium applies on their builds including adding things like fingerprint prevention among other things. Also you still maintain references to mozilla URIs and its clear that the browser still phones home in some instances. Definitely not saying to install extensions without permission. |
|
I completely agree with Muzzah on this one. I really love the browser, and I don’t want to stop using it or have to rice it every time I reinstall. However, after the recent events regarding Mozilla's privacy issues and telemetry, we need to do more than just change a few configs—we need to entirely strip Mozilla out of the Firefox side of Zen. A better example than Ungoogled Chromium is LibreWolf, as they have literally made a fork of Firefox and removed all privacy concerns related to Mozilla. It’s a great example of what everyone is asking for in this issue, and since your project is based on the same browser, you could even reuse parts of their code. Lastly, if you need help with anything regarding this issue, just ask. This is an open-source project, and in the end, you don’t have to do everything on your own. |
|
I don't know. Personally I would prefer if they stripped everything. But Idk if that would result in some annoyances for normies. I think it would be fair to have whatever they deem necessary turned on OTB, but have an easy way in settings under Privacy to - at the flip of a switch or two - to turn those off completely for folks who want it. Wouldn't mind if they took this approach for most things privacy really. And offered an option (at the flip of a few switches under Privacy) to go as "hardcore" as Librewolf, while informing that doing that may impact people's browsing experience. Don't know how feasible this would be from a coding POV though. |
Why exactly? The connections fail anyways and no data is stored |
This comment was marked as off-topic.
This comment was marked as off-topic.
|
Just to add here, @mauro-balades or someone from the moderators of the zen browser subreddit removed a similar post on reddit This is the kind of response and suppression of information that is being raised here. Its very concerning. Rather than have an open discussion on this topic they just want to hide it yet still claim the browser is secure |
|
Assuming the deleted reddit post is about the same issue as this one (with almost the same title), it doesnt seem to me like a big deal. Someone pointed out a pretty big flaw six months ago... And it was fixed, with the maintainer explaining why it was like that and apologizing. This very much seems like an honest mistake was made, and I'm not sure why this specific issue needs further discussion. |
|
I disagree if this was deleted by the moderators which includes the maintainers. There are legitimate concerns being raised here and the maintainer has not addressed any of them. Suppressing any discussion on this topic fuels the fire and is exactly what is being talked about here. Not sure why it should be considered not a problem. It makes no sense to do so if these issues are just mistakes or the maintainers intend to address these concerns. Its ok to mess up, as long as you accept and explain and rectify. Its not ok to supress and attempt to hide/prevent discussion. Imagine any privacy focused product with a vulnerability responding like that to a security issue raised? If you are happy with that kind of a response, sure. I dont think I am. |
|
I agree - accepting, explaining, and rectifying the mistake is necessary, but that to me seems like exactly what they did. When the issue was first raised six months ago, the maintainer very quickly merged the PR to fix the issue, explained why they had it in the first place, and apologized for their mistake. Sure, if they did delete the reddit post, they definitely shouldn't have, it already has made the problem worse than a proper response likely would have. But the issues addressed in the thread we are currently in - the connection requests - seems like where our attention should be focused, not this problem from half a year ago. This is still an active issue, but the concern over a potential backdoor is long fixed. |
|
Wild |
|
there you go. If you want to learn more about your alt accounts got removed or why they flagged as bot feel free to provide me their names I will show you. |
|
While I think theres quite a few valid concerns raised in this thread, the tone has gotten a bit out of hand in my opinion. This is a browser being made largely by one dude who open sourced the whole thing. Being privacy conscious is important, and is something I very much am, but accusing the maintainer of fraud because they expect a different level of privacy is not only rude but ineffective - if people are hoping to convince the maintainer to change things, insulting them is not an effective strategy. Im also a tad concerned about these connections being made, but I'm assuming no malintent. It would be great, however, if we could get a more full response - an explanation of the connections made, why they are made, and what data if any could even theoretically be transferred through them. This would increase transparency and hopefully ease concerns a little. This whole thread has become an argument but it should be a discussion to make things better. |
|
The amount of shit-flinging in this thread, and elsewhere, is frankly absurd. As someone who's been coding professionally for well over a decade, I see no reason to assume malpractice or malice on part of the maintainers. Inexperience, perhaps, but that does not justify a tenth of the vitriol that's been spilled in this thread. First, the idea that Firefox is "spying" on you or "selling your data" is ridiculous. You don't have to trust me on that - there are great resources from far more reputable individuals explaining exactly why they were forced to change their terms (tl;dw - the state of California decided to redefine what the verb "to sell" means). There are valid criticisms of this change, but to imply that something substantial has changed in the past 6 months about Mozilla's actions is disingenuous at best, and wilful ignorance at worst. Second, and I can't believe I have to mention this in the discussion forum of a GitHub project to a community of alleged developers, if you do not want Google to know what you are doing on the internet, turn off your router. The majority of services you connect to are hosted at Google's, Amazon's or Microsoft's data centres. When you load a page it downloads fonts from Google and JavaScript from Microsoft's CDN. If you truly cared about this, instead of performative outrage at an indie dev you would have already null-routed all of these hostnames in your PiHole. Now. Should Zen auto-load X the everything app, Notion and Discord on a fresh install? No, including those tabs by default is an understandable but silly decision. Should Zen devs have noticed the remote-control thing earlier before it was pointed out in a PR? Maybe, though calling it a backdoor is likewise disingenuous. But, you should never assume security from alpha/beta software, and the issue was remedied a long time ago. Should the Zen maintainers be better at communicating issues and stating exactly what their policies are? Maybe, but you all know very well that we are talking about a handful of nerds making a Firefox mod for free that blew up over night, not a large corporation that can afford a PR team and a team of lawyers at the standby. And guess what? The code is right here. You have the agency to go into the code base, make a change, and say "hey, I noticed this issue, here's a PR that fixes it". I bet that you would be thanked and that you'd walk away happy knowing you improved the experience for everyone. Instead, you choose to be bitter and assume malice on the maintainers part. Do better. |
|
@mauro-balades I would like to apologize if my previous comments came over sounding hypercritical or malevolent to some. I initially reaffirmed the issue author's concerns about privacy and asked why the issue was closed without any explanation, but I was never given an answer. My mistake there was that I've referenced a past issue that posed a potential security risk for debugging convenience which was fixed promptly 7 months ago, as I was disappointed by what seemed like a fundamental oversight during the early stages of development. I was only trying to advise caution, because I really care about both privacy and security. After all, web browsers play a crucial role in our daily lives. If I hadn't used the same term mentioned in the PR title, maybe then it wouldn't have attracted all the contentious behavior around this topic. I now understand that Zen Browser was started as a personal project of yours and that you're learning and growing as you go, there definitely were mistakes made on both sides and I genuinely respect you for acknowledging your mistakes and going to such lengths to addressing and rectifying them while being completely transparent about it. Also, I absolutely think creating a privacy-focused browser is a challenge, especially when trying to meet the expectations of users who truly care about privacy and security. It's not easy to find the right balance with convenience, because it's always been about tradeoffs. Thank you for this project! I appreciate all the work you've done with Zen Browser. |
|
I was going to leave this topic, as I'm satisfied with the changes made to the Readme, but considering the number of upvotes and heart emojis to the post I'm about to reply to, I feel compelled to reply:
And I'm sure your post is going to be totally fair and balanced. Ha, just kidding.
Why can't they read? "In order to make Firefox commercially viable, there are a number of places where we collect and share some data with our partners, including our optional ads on New Tab and providing sponsored suggestions in the search bar. We set all of this out in our Privacy Notice. Whenever we share data with our partners, we put a lot of work into making sure that the data that we share is stripped of potentially identifying information, or shared only in the aggregate, or is put through our privacy preserving technologies (like OHTTP)." Also, they introduced a Terms of Use, which was completely unnecessary, and included some very odious terms, in complete contradiction to the spirit of open source. But the sheep will keep defending Mozilla.
Mozilla receives monetary compensation from third parties for consumer data. Reasonable people see that as selling. California didn't just recently redefine these terms.
What's true is that Mozilla has been crap for years on privacy, and this latest change is just another big turd on top of the already big pile of turds.
Sheep gonna sheep.
So two out of three aren't Google, and when it comes to hosting, Amazon and Microsoft are both bigger than Google. There's also more hosting services than you can shake a stick at. So why would I just bend over for Google and give them all my data when I can just use a different search engine, not use their browser, not use their services like Gmail, and use plugins like uBlock? Do that and you've wiped out the vast majority of their data collection on you, at least on desktop (I use my cell phone as a phone, not a daily driver). But sheep gonna sheep, and bah-bah at the sheep leaving the flock.
Not for me. I use uBlock in hard mode.
Router blocking is a poor solution. You have to keep up with an ever-evolving blacklist. And sometimes I do want to use Google. Much better to just default-deny 3rd party connections with uBlock, and whitelist was is necessary. But yeah, you have to actually care about privacy, and value it over convenience. This isn't for most people, even among nerds, and as I've said, I'm satisfied that Zen is no longer marketing itself as a "privacy-focused" browser. |
You've got the cause and effect reversed. Most people don't know what DDG is because Google is on by default. I mean, most people also don't know Zen Browser is a thing, either. Does that mean you should, like, just give up on trying to promote your project? Well I wouldn't think so -- you'd make sure to promote it to people, especially those of us who are most likely to recommend it! One thing I know, "past me" would've been extremely enthusiastic about recommending Zen to everyone I meet. Presently? Not so much. First of all, making this implicit assumption that the users are ignorant and unwilling to learn is poor taste. Having switched to a fork of Firefox means they are able to make an informed choice just fine. At least when they are offered one and nobody is bullshitting them across an interface boundary (or ten). Which is what the contemporary tech industry very much relies on, in a way so ubiquitous that it remains unacknowledged. Be the exception! By now, a lot of people have become aware of the power differential between them and Google, and that Google is not some magical cloud in the sky that grants your wish. Sure, they don't like to think about it, because they don't know what to do about it, and feeling powerless makes people feel like shit. Yet... here you are, not helping one bit. Why is that, @mauro-balades? People don't know the right questions to ask not because they're stupid, but because of the industry pulling the wool over their eyes for what, has it been three generations already? "But we exalted programmers, so wise and powerful, we simply cater to your convenience!" Well why not help a little where it counts then? For starters, be the first browser in the family, in a long long time, that doesn't just go ahead and do a bunch of shit behind the user's back as soon as you start it up. Can't hurt, right?
Well, that means if you provided a saner default (e.g. literally any search engine which is not Google), they'd always have the option to change it back to Google, no? I know I've switched between Google and DDG a fair bit. My friend is not a computer person or an environmentalist, someone who's all about the productivity and growth and maximizing value, but searches with Ecosia out of sheer principle. Continuing with the anecdotes, just the other day I ran into someone I hadn't talked to in literal years, what did they do? -- they thanked me for recommending Brave, just because it blocks the ads -- even though Brave isn't even all that good, just some cryptobros' pipe dream that happened to feature a working adblocker. There's your social proof, there's your user stories! Besides, you really don't see how your arguments very obviously cut both ways, yet you still act as if they somehow legitimizes the choices that the project makes for the user? This is irresponsible and disingenuous reasoning, and remains such even if condoned (or ignored) by some presumed majority. I find that sort of sloppy thinking disgraceful to the profession -- but, one would hope, far from incorrigible! I don't want to make this into a "sides" thing. I don't think Google actually had any choice other than to become evil. I don't think Firefox seriously had any choice in this matter, either. Incentives gonna incentive. But you, you have a choice. And, as far as anyone is able to make the distinction, the cards are on the table, and the choice is now very simple: you're either on the side of the users, or you're on the side of the abusers. Simple as that. As a fork of Mozilla Firefox, Zen Browser is in position to build goodwill -- not to mention do actual good -- simply by providing a piece of software configured in a way that doesn't immediately feed its users to the surveillance capitalism hellmaw. And if you're honestly about innovating and making the browsing experience more productive for people, now is the time to get creative! Same way Zen was the first browser to finally figure out that users might actually like their tabs in a sidebar by default! 👏 Now "just" do the same, but beyond surface level. You'll find it more challenging -- and more fulfilling. OTOH, if the endgame here is to sell this project after 1 year to a sketchy borderline-APT for somewhat less than you had hoped for (like it happened with some other "but it's open source" projects not too long ago), then the best thing you'd ever do with that money would be to buy me a beer! 🍻 You know, just for the sake of my own slightly less than 20 years worth of experience, which it unfortunately took me slightly longer than 7 months to acquire -- and with quite a few fuckups along the way, maybe some of them even worse than the one you've committed by keeping the blatantly user-hostile defaults, but at least not as public! |
I think it's a good time to lock this thread now. |
This comment was marked as off-topic.
This comment was marked as off-topic.
|
The only "privacy-focused" (your words) thing is like mozilla telemetry being disabled by default? Or am I missing something? There's countless connections sharing your data without interaction as soon as you start the browser. For example: Geo location: It's on by default and sharing your data OCSP Push notifications: For some reason this one connects and shares data with mozilla before you even let any site send push notifications. I don't need their extensions blocklists. I don't want to share my data with mozilla. These are just a few examples off the top of my head. At the very least, opt-out during install / first run before any automatic connections are made would be nice. You have the potential to be the only browser in the world with zero automatic connections when starting up on a blank page! Other concerns like google being default search is less of an issue to me, since you can change it before your data is shared with them if you want to. Keep up the good work! |
Yeah but there's nothing we can do about that realistically |
The suggestion here is to not have those web pages loaded automatically upon completing installation or at least to not connect to those pages based on a stricter privacy configuration that a user could opt-in during the on boarding process. |
|
I'd do that if it where random websites, but we also have to think about new users and legal documents. We can't just not load the privacy policy |
Can you elaborate, I'm not sure what you mean by this. Users can access the Privacy Policy by going to Maybe you're confusing it with Terms of Service (ToS) agreements or End-user license agreements (EULAs) ? |
Oh sorry, I thought we where talking about https://zen-browser.app/welcome/ and https://zen-browser.app/privacy-policy/. Im personally losing track of what's going on in this thread. Could perhaps open a new empty issue and lock this one out? |
This comment was marked as off-topic.
This comment was marked as off-topic.
|
Quickly just responding to your criticism of my earlier comparison between privacy and customizability - that is entirely fair, my comparison was flawed. Privacy is much more important and should be regarded to a different degree. I said it because some people in this thread seem to regard privacy as an all or nothing, but I agree the privacy aspects of Zen should be made more clear and that the way this whole thing was handled was poorly done. |
Uh oh!
There was an error while loading. Please reload this page.
Why does Zen connect to multiple google IPs, Akmai IPs, and GitHub IPs upon startup, and remains connected to them throughout the session.
I thought this browser was privacy focused, no telemetry?
Just started browser, no tabs open, no extensions.
Query OCSP servers off.
Block dangerous and deceptive content off.
Check for updates off.
I just don't understand what feature I have enabled that warrants these connections.
What is it doing and why? Please clarify and be specific.
And can I turn it off somehow?
Example:
https://i.imgur.com/EPGrCjZ.png
https://i.imgur.com/NmVcMh5.png
https://i.imgur.com/tqwNDXw.png
Sample IP list:
34.107.243.93
34.149.100.209
184.51.252.197
34.107.221.82
34.107.243.93
184.51.252.176
185.199.111.153
34.107.221.82
All reactions