stories about: "mozilla"

Mozilla Asks Court To Force FBI To Turn Over Information On Hacking Tool It Used In Child Porn Case

from the only-criminals-use-patched-browsers-amirite? dept

Thu, May 12th 2016 11:40am — Tim Cushing

An indirectly-involved party in the FBI's Playpen case has waded into the fray and is demanding answers. Mozilla wants to know about the security flaw the FBI exploited so it can fix it. (h/t Brad Heath, Nate Cardozo)

Mozilla now seeks to intervene in relation to the Government’s pending Motion to request modification of the Order, or in the alternative, to participate in the development of this issue as amicus curiae in favor of neither party, for the purpose of requesting that the Court modify its Order to require the government to disclose the vulnerability to Mozilla prior to disclosing it to the Defendant. Absent great care, the security of millions of individuals using Mozilla’s Firefox Internet browser could be put at risk by a premature disclosure of this vulnerability. This risk could impact other products as well. Firefox is released under an open source license. This means that as Firefox source code is continuously developed, it is publicly available for developers to view, modify, share, and reuse to make other products, like the Tor Browser. The Tor Browser comprises a version of Firefox with some minor modifications to add additional privacy features, plus the Tor proxy software that makes the browser’s Internet connection more anonymous.

With the Tor browser being built on the Firefox framework, any exploit of Tor could affect vanilla Firefox users. Not only that, but the FBI is apparently sitting on another Firefox vulnerability it used in a previous investigation to unmask Tor users. (This refers to the FBI's 2012 child porn sting, which also used a NIT to obtain information about visitors to a seized website.) The filing notes the FBI has been less than helpful when approached for info about this Firefox/Tor-exploiting NIT.

Mozilla has contacted the Government about this matter but the Government recently refused to provide any information regarding the vulnerability used, including whether it affects Mozilla’s products. Accordingly, Mozilla requests that the Court modify its order to take into account how such disclosure may affect Mozilla and the safety of the several hundred million users who rely on Firefox.

Mozilla wants to see this information two weeks before it's disclosed to the defendant so it can patch the hole. While it's not unopposed to the information being turned over to the defendant, this headstart would allow it to fix the vulnerability before it becomes public knowledge and turned into a weapon to be wielded against millions of Firefox users.

There's a Fifth Amendment implication here as well: the due process right of third parties to act on behalf of properties or interests affected by criminal investigations or court decisions.

To consider the weight of Mozilla’s interests, this Court must determine whether the Exploit to be disclosed takes advantage of an unfixed Firefox vulnerability. If it does, Mozilla will suffer harm if the Court orders the government to disclose the vulnerability to the Defendant under the existing protective order. Likewise, Mozilla continues to suffer harm by the Government’s refusal to confirm at this point whether Firefox is the target of the vulnerability. [...] Due process compels this Court to hear Mozilla’s arguments and consider its interests before rendering a decision.

The proposed protective order doesn't do enough to prevent discovery of the vulnerability, according to Mozilla.

The protective order does not contain restrictions on disclosing knowledge learned through examining NIT Protected Material. This alone marks a serious deficiency in the Protective Order as the damaging information about the vulnerability is likely something that someone can easily remember. Rather, the Protective Order’s disclosure restrictions are limited to the further distribution of the copies of information the defense receives from the government. Without more restrictive provisions, the protective order relies too heavily on the Defendant’s representations he and his defense team will not share copies, but not on any explicit agreement that they will not share or use information learned or that they will put security safeguards in place

Not that the NIT's specifics are necessarily secure if the court refuses to order disclosure to Michaud or Mozilla. The declaration entered by defendant Jay Michaud's expert witness points out that the previous use of the NIT in the 2012 case resulted in the FBI turning over information about the exploit to the defendant. So, there's precedent for disclosure, which is what Michaud's lawyer is demanding. But there's also evidence the FBI is hardly the best repository for exploits and vulnerabilities.

The Cottom case, which also involved an FBI NIT, provides a helpful comparison. In Cottom, the government agreed to cooperate with the defense's discovery requests. However, the FBI later reported to the Nebraska court that it had lost part of the NIT source code. Given the potential harms and security issues the government has raised in connection with the disclosure information, the FBI's loss of NIT code in Cottom is still hard to understand. But there at least the government did not dispute the defense's need to analyze all of the available components and code to prepare pre-trial motions, a Daubert challenge, and potential trial defenses.

Hard to understand, indeed. How does someone lose "part" of an exploit's code, especially considering the FBI's obvious interest in deploying it in other investigations? Might just be stupidity, but considering its evidentiary implications and the FBI's extreme reluctance to expose "means and methods," it also smells a bit of maliciousness.

While Mozilla's attempted intervention may force the FBI to turn over information on its NIT, it's unlikely to be much of a direct benefit to Michaud. His lawyer is opposed to Mozilla's request for exploit info and its offer to appear as an amicus in support of Michaud's motion to compel. His filing notes that while Mozilla is not opposed to the FBI also turning over this information to Michaud, he and his client have no interest in returning the favor should the court side with Michaud, rather than Mozilla.

Mr. Michaud has no stake in Mozilla’s dispute with the Government. Further, the defense has no intention of disclosing any NIT discovery to Mozilla, a third party, or the public in general under any circumstances. To the extent that Mozilla is concerned that the existing NIT protective order does not provide “adequate safeguards” (dkt. 195 at 12), the defense has stated that it is amenable to any and all additional security measures and modifications to the existing NIT protective order that the Court deems appropriate.

Not an unreasonable response, as Michaud's lawyer's ultimate duty is to serve his client, not millions of Firefox/Tor users. As for the government, it's likely incredibly irritated that its super-secret tool is gaining it no traction in supposedly open-and-shut child porn prosecutions. Not only are courts finding the warrants used to perform this extrajurisdictional searches invalid from word one, but defendants are pushing back hard against the FBI's "investigative methods" secrecy and dismissive attitude towards the Fourth Amendment. I'm sure it had no idea it would be 198 documents deep into a single child porn case at this point -- much less being nowhere closer than day one to securing a conviction.

Filed Under: doj, fbi, malware, nit, playpen, tor
Companies: mozilla

Facebook's Plan To Be The Compuserve Of Developing Nations Faces Mounting Worldwide Criticism

Broadband

from the altruism-incorporated dept

Thu, May 21st 2015 12:44pm — Karl Bode

What began as some squabbling over the definition of net neutrality in India has evolved into a global public relations shit show for Facebook. As we've been discussing, India's government has been trying to define net neutrality ahead of the creation of new neutrality rules. Consumers and content companies have been making it very clear they believe Facebook's Internet.org initiative violates net neutrality because it offers free, walled-garden access to only some Facebook approved content partners, instead of giving developing nations access to the entire Internet.

Internet.org partners began dropping out of the initiative, arguing they don't like any model where Facebook gets to decide which content is accessed for free -- and which content remains stuck outside of Internet.org. Facebook so far has responded by trying to claim that if you oppose Internet.org you're the one hurting the poor, because a walled garden is better than no Internet at all. Of course that's a false choice; Facebook could simply provide subsidized access to the entire Internet, but that wouldn't provide them with a coordinated leg-up in the developing nation ad markets of tomorrow.

So far Facebook's defense of Internet.org's zero rating of some content has only made criticism louder. A coalition of sixty-seven different digital activism groups from thirty-one different countries this week penned an open letter to Facebook on Facebook, arguing that Internet.org will actually hurt the poor by cordoning off meaningful parts of the actual Internet. The groups, many of which have been pushing for increased broadband deployment far longer than Facebook has, are quick to point out that Facebook's injection of itself between users and the Internet doesn't just raise net neutrality concerns, but privacy and security issues as well:

The censorship capability of Internet gateways is well established — some governments require ISPs to block access to sites or services. Facebook appears to be putting itself in a position whereby governments could apply pressure to block certain content, or even, if users must log in for access, block individual users. Facebook would find itself mediating the real surveillance and censorship threats to politically active users in restrictive environments. The company should not take on this added responsibility and risk by creating a single centralized checkpoint for the free flow of information.

...We are very concerned about the privacy implications of Internet.org. Facebook’s privacy policy does not provide adequate protections for new Internet users, some of whom may not understand how their data will be used, or may not be able to properly give consent for certain practices. Given the lack of statements to the contrary, it is likely Internet.org collects user data via apps and services. There is a lack of transparency about how that data are used by Internet.org and its telco partners. Internet.org also provides only a handful of applications and services, making it easier for governments and malicious actors to surveil user traffic.

Facebook tried to ease concerns by recently including more content partners, but there's still an absurd number of restrictions. Content can't integrate video, VoIP, Flash, Javascript or Java applets. Internet.org is also blocking any and all encrypted sites at a point in time when encryption is more important than ever, for developed and developing nations alike. The EFF was quick to point this out in a statement of its own issued this week opposing the initiative:

Even if Facebook were able to figure out a way to support HTTPS proxying on feature phones, its position as Internet gatekeepers remains more broadly troublesome. By setting themselves up as gatekeepers for free access to (portions of) the global Internet, Facebook and its partners have issued an open invitation for governments and special interest groups to lobby, cajole or threaten them to withhold particular content from their service. In other words, Internet.org would be much easier to censor than a true global Internet.

Still, so far there's every indication that Facebook either doesn't understand, or doesn't want to understand, what critics are saying. The company recently posted a new myths versus facts release on the Internet.org site that somehow manages to talk over, under and around most of the points critics have been making. There's also this gem, in which Facebook actually denies that Internet.org has anything to do with making money:

MYTH: Facebook has launched Internet.org to help drive its own growth and revenue opportunities within developing countries.

FACT: There are no ads within the Facebook experience on Internet.org. If revenue were the goal, Facebook would have focused resources on markets where online advertising is already thriving."

This pretense on Facebook's part that Internet.org is solely about altruism is adorable, but it's not clear who, if anyone, actually believes that. To most, it's obvious Facebook wants in at the ground floor in order to dominate the ad markets of tomorrow, and what better way to do that than to position yourself as the walled-garden Compuserve of developing nations. Facebook could nip this entire problem in the bud in two simple steps. One, Facebook needs to stop acting like everyone is too stupid to see its real motives. And two, if Facebook is so very concerned about the poor, it should put its money where its mouth is and shift to a subsidized model that gets Facebook out of the way and provides access to the real Internet, free from obvious interference, censorship, privacy and neutrality concerns.

Filed Under: criticism, internet.org, net neutrality
Companies: eff, facebook, internet.org, mozilla

28 Comments

Mozilla: If Facebook Really Wants To Help Developing Nations, It Should Ignore Zero Rating And Fund Real Internet Access

Broadband

from the get-the-hell-out-of-the-way dept

Fri, May 15th 2015 6:16am — Karl Bode

Facebook's been taking a lot of heat lately for failing to understand (or pretending to fail to understand) how its Internet.org initiative spells trouble for net neutrality. As noted previously, Facebook's vision has been to deploy a "free" walled-garden service like AOL to developing nations. Critics have been dropping out of Internet.org, stating they don't like Facebook picking which companies get included in the walled garden. Things have gotten particularly heated in India, where neutrality advocates have made it very clear they think Facebook's vision hurts the open Internet long term.

Zuckerberg's response so far? You're hurting the poor if you don't like the way we're doing things, because a walled garden is better than no Internet at all. Of course that's a false choice: Facebook could offer subsidized access to the real Internet, it just wouldn't get pole position in delivering ads to billions of new users in dozens of developing nations. It's a mammoth advertising play dressed up as utterly-selfless altruism, with a dash of indignant at suggestions there's a better way.

Mozilla recently decided to jump into the conversation with a series of blog posts offering a much more intelligent, nuanced take on the problem with zero rated apps. In one post, Mozilla notes how if you let Facebook create a new definition of the Internet today, you're setting the stage for notable problems down the road:

"We understand the temptation to say “some content is better than no content,” choosing a lesser degree of inclusion over openness and equality of opportunity. But it shouldn’t be a binary choice; technology and innovation can create a better way, even though these new models may take some time to develop. Furthermore, choosing limited inclusion today, even though it offers short-term benefits, poses significant risk to the emergence of an open, competitive platform that will ultimately stifle inclusion and economic development."

That mirrors concerns by folks like Stanford Professor Susan Crawford, who have lambasted such models for "entrenching and amplifying existing inequalities and contributing to poverty of imagination." Mozilla notes there's plenty of ways to help fund Internet access to developing nations that doesn't involve building walls and cherry picking program participants. For example the company has struck a partnership with Orange to provide $40 Firefox OS smartphones with 6 free months of voice, text, and up to 500 MB per month of data. Another effort offers a small allotment of free data for watching an ad.

In short, there are options that don't turn the Internet into a glorified version of CompuServe. But rushing toward walled gardens again isn't just about today, it's about what these ideas mutate into over the longer haul. Mozilla Foundation Chair Mitchell Baker took this idea further in a second blog post:

"Selective zero-rating is unquestionably bad for the long term opportunities and inclusion for the people it is designed to serve. It pre-selects what’s available, directing people to where others want them to go. It is bad for economic inclusion. It is bad for the ability of new entrepreneurs to grow onto the global scale. It is bad for the long term health of the Internet. Zero-rating as practiced today is “selective zero-rating for a few apps and websites; exclusion for the rest of the Internet."

The correct answer is that all data is transmitted at the same price, whether that price is "zero" or anything else. This way, consumers pick the content they choose to access based on the quality of that content, not the financial power and business partnerships of the provider. This way, new entrepreneurs can still reach any and all users on the Internet, even if they are a few people working in a co-working space with no ability to subsidize data charges."

In other words, if Facebook really wants to help the poor, it can do so by using Internet.org to fund access to the "real Internet," not some bastardized version of the Internet that lets Facebook and select ISP partners play god. The conversation in India mirrors the conversation we've been having about systems like AT&T's Sponsored Data here in the States; opposition to zero rating is simply about getting massive gatekeepers out of the way and ensuring equal access to the purest version of the 'Net possible.

Filed Under: broadband access, developing nations, internet access, net neutrality, zero rating
Companies: facebook, mozilla

20 Comments

Netflix Moving To Encrypted Streams, As Mozilla Moves To Deprecate Unencrypted Web Pages As Insecure

Privacy

from the yay-encryption dept

Wed, Apr 15th 2015 9:02pm — Mike Masnick

We've been pretty vocal about supporting the encryption of more and more web traffic. It's important for a variety of reasons, not the least of which is your privacy and security. A few months back, we were excited to see the Chrome security team suggest that it should start marking unencrypted web pages as non-secure. It appears that Mozilla is now joining in on the fun, proposing deprecating unencrypted HTTP web pages to encourage more web developers to go full on in support for encrypted HTTPS:

In order to encourage web developers to move from HTTP to HTTPS, I would like to propose establishing a deprecation plan for HTTP without security. Broadly speaking, this plan would entail limiting new features to secure contexts, followed by gradually removing legacy features from insecure contexts. Having an overall program for HTTP deprecation makes a clear statement to the web community that the time for plaintext is over -- it tells the world that the new web uses HTTPS, so if you want to use new things, you need to provide security.

It's a clever setup. Basically, if you want to take advantage of new features on the web, you'll have to encrypt.

Meanwhile, it appears that Netflix has separately announced that it is moving forward with plans to encrypt all of its infrastructure with HTTPS to better protect your privacy as well:

with our existing server infrastructure and the up to 50% capacity hit we had observed, driven by our traffic mix.

At that time, we were uncertain of the gains we could achieve with software and hardware optimization and of the timescale for those. I'm pleased to report we have made good progress on that and we presented our FreeBSD work at the Asia BSD conference. We now believe we can deploy HTTPS at a cost that, whilst significant, is well justified by the privacy returns for our users.

So, as we mention today in our investor letter, we intend to roll out HTTPS support over the coming year - for both our site and the content itself - starting with desktop browser tests at scale this quarter.

In short, yes, deploying HTTPS at that scale is expensive, but the benefit to users is tremendous and worth it.

It's still going to take a while, but we're getting closer to reaching that tipping point where an unencrypted web is a historical anomaly and that's a very good thing.

Filed Under: encryption, https, security
Companies: mozilla, netflix

97 Comments

EFF, Others Launch New Free Security Certificate Authority To 'Dramatically Increase Encrypted Internet Traffic'

Privacy

from the very-cool dept

Tue, Nov 18th 2014 12:40pm — Mike Masnick

The EFF and Mozilla along with some others, have teamed up to announce "Let's Encrypt" which is a new, free, certificate authority that is hoping to dramatically increase encrypted internet traffic when it launches next summer. The effort is being overseen by the Internet Security Research Group, which is the non-profit coalition of folks contributing to this effort. Not only is the effort going to offer free certificates, but also make it much easier to enable encryption. We've argued for a long time about the importance of increasing encryption online, so it's great to see this effort.

Filed Under: certificate authority, encryption, https, let's encrypt, security, ssl
Companies: cisco, eff, internet security research group, mozilla

30 Comments

Are Apple, Google, Microsoft And Mozilla Helping Governments Carry Out Man-In-The-Middle Attacks?

(Mis)Uses of Technology

from the and-what-can-they-do-about-it? dept

Fri, Nov 7th 2014 12:22pm — Glyn Moody

Back in September, we reported on the Chinese authorities using man-in-the-middle attacks to spy on citizens who carry out Google searches over encrypted connections. That's done by using a fake security certificate to redirect traffic to a server where the traffic is decrypted, analyzed, and blocked if necessary. A new post on the Greatfire.org Web site points out that this approach can only work if the user's computer trusts the certificate's issuing authority, in this case the China Internet Network Information Center, and that it's curious that browsers from the West do so quite so readily: Microsoft, Apple and Mozilla among others, trust CNNIC (China Internet Network Information Center) to protect your communications on their platforms by default, regardless of whether or not you are in China. CNNIC has implemented (and tried to mask) internet censorship, produced malware and has very bad security practices. Tech-savvy users in China have been protesting the inclusion of CNNIC as a trusted certificate authority for years. In January 2013, after Github was attacked in China, we publicly called for the the revocation of the trust certificate for CNNIC. In light of the recent spate of man-in-the-middle (MITM) attacks in China, and in an effort to protect user privacy not just in China but everywhere, we again call for revocation of CNNIC Certificate Authority.
Although the logic of revoking CNNIC as a trusted certificate authority might seem inarguable, the consequences of doing so are likely to be serious. For example, the Chinese government might decide to ban the use of any browser that did not include CNNIC. That's hard to police, but the threat alone would be enough to dissuade any software company from removing CNNIC's certificate from its browser.

Perhaps the best solution is simply making users aware of the issue, and explaining how they can remove any certificate authority they have doubts about. And not just for China: these problems can arise in any country where a local trusted certificate authority is under the direct -- or indirect -- control of the government.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: certificate authorities, china, man in the middle attacks, security, trust
Companies: apple, cnnic, google, microsoft, mozilla

48 Comments

And Here We Go: Mozilla Felt Pressured Into Adopting DRM In HTML5

(Mis)Uses of Technology

from the a-broken-system dept

Wed, May 14th 2014 1:20pm — Mike Masnick

We've written a few times about the unfortunate decision by the W3C to adopt DRM in HTML5 in an effort to keep Hollywood happy. While Tim Berners-Lee and others at W3C have tried to defend their reasons for doing so, they're all based on the faulty premise that somehow the internet needs Hollywood more than Hollywood needs the internet. The reverse is true, but Hollywood has convinced too many people of its own importance to the internet. Because of that -- along with the agreed-upon fact that today's plugin/extension system is a complete disaster from technological and security standpoints -- the W3C, pressured by a bunch of big companies, agreed to put DRM into the next generation of HTML (and don't buy their argument that it's not actually DRM -- the only purpose that Encrypted Media Extensions (EME) serves is to enable DRM).

Today there's a lot of discussion because Mozilla, makers of the popular (and open source) Firefox browser, have posted two separate blog posts about how they feel forced to adopt this DRM even though they hate basically everything about it. Mozilla's argument is not crazy. They're worried that by not adopting these standards, while all other browsers do, people will just shift to those other browsers. And beyond just losing market share, Mozilla has a point in noting that the way other browsers implement EME will be less secure than the way that Mozilla is doing it.

We have designed an implementation of the W3C EME specification that satisfies the requirements of the content industry while attempting to give users as much control and transparency as possible. Due to the architecture of the W3C EME specification we are forced to utilize a proprietary closed-source CDM as well. Mozilla selected Adobe to supply this CDM for Firefox because Adobe has contracts with major content providers that will allow Firefox to play restricted content via the Adobe CDM.

Firefox does not load this module directly. Instead, we wrap it into an open-source sandbox. In our implementation, the CDM will have no access to the user's hard drive or the network. Instead, the sandbox will provide the CDM only with communication mechanism with Firefox for receiving encrypted data and for displaying the results.

Traditionally, to implement node-locking DRM systems collect identifiable information about the user's device and will refuse to play back the content if the content or the CDM are moved to a different device.

By contrast, in Firefox the sandbox prohibits the CDM from fingerprinting the user's device. Instead, the CDM asks the sandbox to supply a per-device unique identifier. This sandbox-generated unique identifier allows the CDM to bind content to a single device as the content industry insists on, but it does so without revealing additional information about the user or the user's device. In addition, we vary this unique identifier per site (each site is presented a different device identifier) to make it more difficult to track users across sites with this identifier.

Mozilla is also making it opt-in -- so that everyone will have the choice to choose whether or not to activate the DRM implementation. Also, kudos to Mozilla for not taking the W3C path of pretending that EME isn't DRM. Mozilla is quite upfront that this is DRM and that they're uncomfortable with this. As Andreas Gal says:

we would much prefer a world and a Web without DRM...

But, Mozilla feels that users "need it to access content they want." Mitchell Baker similarly notes:

The new version of DRM uses the acronyms “EME” and “CDM.” At Mozilla we think this new implementation contains the same deep flaws as the old system. It doesn’t strike the correct balance between protecting individual people and protecting digital content. The content providers require that a key part of the system be closed source, something that goes against Mozilla’s fundamental approach.

Unfortunately, it appears that even though this is the case, Mozilla still believes that the internet needs Hollywood's locked up content more than Hollywood needs to adapt to the internet. That's too bad. Cory Doctorow has a very detailed discussion of why he thinks Mozilla made a mistake, while acknowledging all of the reasons why they did what they did. More importantly, he lists a number of additional things that Mozilla should do to improve the situation. I'll summarize those four things, because I agree wholeheartedly:

Protect security researchers: Thanks to the anti-circumvention provision of the DMCA, any security research into Adobe's DRM may be a form of infringement. As Cory notes, Mozilla should demand that Adobe issue a covenant not to sue security researchers or developers who find vulnerabilities.
Educate users: Teach everyone (including Hollywood, but mainly the public) why DRM is dangerous and harms security and privacy online. Personally, I'd add that Mozilla could also teach people why DRM is simply not necessary.
Research and publish the case for DRM: This goes back to the question of who really needs it. Hollywood thinks they do, but I don't think that's really true. As Cory says, Mozilla should look at the actual data to see if there truly is a use case for DRM.
Formulate and articulate a DRM policy: Basically don't make these kinds of decisions ad hoc -- but have a clear policy on how and when decisions like this get made.

For years, the music industry insisted it needed DRM, and folks like Apple catered to them -- and that actually just helped Apple have more power over the music industry. Finally, the music industry shed DRM and it had almost no impact. Today, the book industry has the same issue, demanding DRM... and basically handing market power to Amazon in providing that DRM. It's amazing that Hollywood still insists it needs DRM. It does not. Unfortunately, it by agreeing to implement DRM here, it means it will take much longer for Hollywood to learn this lesson.

Filed Under: drm, eme, firefox, hollywood, html5
Companies: mozilla

84 Comments

Mozilla To FCC: Hey, There's Another Way To Protect Net Neutrality

Broadband

from the have-you-thought-of-this? dept

Tue, May 6th 2014 11:06am — Mike Masnick

With all the hand-wringing over the FCC and net neutrality, the folks over at Mozilla have jumped into the fray, offering the FCC another possible path. Much of the fight is over whether or not the FCC should "reclassify" broadband providers under Title II of the Telecommunications Act, thereby making them "telco services" (subject to common carrier rules) or leave them under Title I as "information services" (not subject to common carrier rules). The problem is that even though they almost certainly should be telco services, the political shitstorm it would create to reclassify means that no one in the FCC seems to have any interest in kicking off that particular political battle (not to mention that the FCC would be required to have a very good reason for why it's changing the designation -- beyond just "we think it's better.")

Mozilla's plan is a somewhat crafty attempt to avoid the worst of the political mess that reclassification would cause, by arguing that there are two separate markets: the markets for broadband providers to end users (i.e., our own broadband bills) and then a separate market for the relationship between internet companies (what Mozilla is calling "edge providers") and the broadband providers. Mozilla is saying that since these are separate markets, the FCC could reclassify just the connection between internet companies and broadband providers as telco services, and leave the last mile setup unchanged as an information service. Thus, it's arguing that the transit market more accurately reflects a telco service, and thus would be much easier to reclassify. In a sense, this would also be a way to attack the interconnection problem, which is where the net neutrality debate has effectively shifted.

As Stacey Higginbotham notes, this is a way that Mozilla is more or less calling FCC boss Tom Wheeler's bluff concerning his willingness to use Title II reclassification -- opening up a way to do so with (just slightly) less political fallout (and probably a more legally defensible argument in court for why it's reclassifying). Karl Bode is reasonably skeptical that Wheeler or the FCC would ever actually go this route, given the general "lack of spine" the FCC has shown for years on these issues. On top of all that, Wheeler himself still doesn't seem willing to admit (publicly, at least) that the fights over interconnection and access are related to the net neutrality problem, so he'd have to make that leap before necessarily agreeing to try this path.

Still, that doesn't mean it's a bad idea. In fact, by making it just slightly more feasible both politically and (importantly) legally, there's a chance that maybe, just maybe, the FCC will seriously look at this option. I'll agree that the probability is still quite low, but it's not zero. There do appear to be folks in the FCC who have been desperately seeking alternatives to the current, unpalatable options on net neutrality, and Mozilla's suggestion offers a path that is less politically and legally fraught than full reclassification. It would still be a massive leap, and would require an FCC with a spine (which makes it unlikely), but it's just that much more likely than full reclassification to make things interesting.

Filed Under: broadband, competition, fcc, interconnection, multiple markets, net neutrality, open internet, title ii
Companies: mozilla

Mozilla Pretends New Firefox Ads Aren't Ads, Will Somehow Revolutionize Browsing

Business Models

from the you'll-take-this-improved-user-experience-and-like-it dept

Wed, Feb 19th 2014 9:09pm — Karl Bode

Mozilla has angered a significant chunk of the non-profit's userbase by announcing that they'll be implementing ads. More specifically, Mozilla says that the non-profit is developing something they're calling "Directory Tiles," which will present new Firefox users with sponsored thumbnails (aka ads) alongside of recommended or frequently-visited websites in the new tabs page of the browser. Visually the shift is minor; that page will go from something like this, to something more like this. It's also worth noting up front that it's a "feature" that users will be able to rather easily turn off with the push of one button.
A Mozilla blog post explains the new effort as such:

"Directory Tiles will...suggest pre-packaged content for first-time users. Some of these tile placements will be from the Mozilla ecosystem, some will be popular websites in a given geographic location, and some will be sponsored content from hand-picked partners to help support Mozilla’s pursuit of our mission. The sponsored tiles will be clearly labeled as such, while still leading to content we think users will enjoy."

The change isn't very exciting, it's not very major, and can be easily disabled. So why are a lot of Firefox users annoyed? It appears that a lot of the problems start with Mozilla being intent on refusing to call the ads what they are, while insisting the changes are somehow a great innovation in browsing. Mozilla's general counsel Denelle Dixon-Thayer, for example, tells CNET that the company is tired of being a "window into the web" -- insisting that these ads (without calling them ads) will bring more value to the end user:

"We wanted to get away from being this window into the web that doesn't bring value," to users, she said. "We looked at it from the perspective of how much value are we bringing to the user? We're not focused on bringing the most revenue into Mozilla," she said."

Mozilla VP Darren Herman takes things a step further by insisting that previously Firefox was a "dumb window," and the practice of throwing a few ads on a page will somehow make for a completely improved and smarter browsing experience:

"Late last year it made a big hire in former kbs+ Ventures chief Darren Herman, who joined as VP, content services, who will lead Mozilla's ad and content efforts. "Mozilla is moving from a dumb window to the internet to a smart agent on behalf of the user, putting the user first," Mr. Herman said."

Except you threw a few paid ads on a launch window, you didn't revolutionize recombinant gene technology. The kind of rhetoric Mozilla's using is the sort you'd expect from a cable company, which love to insist that the new $5 monthly fee on your bill isn't to make money, it's to "improve the customer experience." Mozilla is a nonprofit organization, and for more than seven years around 85% of their funding has come from Google for being the browser's default search engine. While most people wouldn't fault them for wanting to have a broader revenue stream, refusing to call a spade a spade clearly isn't helping the sales pitch.

Filed Under: advertising, browser, firefox
Companies: mozilla

69 Comments

If 'Just Metadata' Isn't An Issue, Why Can't Tech Companies Reveal 'Just Metadata' About NSA Surveillance?

Privacy

from the simple-questions dept

Thu, Jul 18th 2013 12:02pm — Mike Masnick

You may have heard the news today that a bunch of big tech companies -- including Google, Facebook, Microsoft, Apple, Twitter, Mozilla, Reddit, Tumblr and others -- have sent a strong letter to a variety of government officials, both in the administration and Congress, demanding greater transparency, and the ability to reveal more information about the government's various surveillance programs that compel the tech companies to participate:

We the undersigned are writing to urge greater transparency around national security-related requests by the US government to Internet, telephone, and web-based service providers for information about their users and subscribers.

First, the US government should ensure that those companies who are entrusted with the privacy and security of their users’ data are allowed to regularly report statistics reflecting:

The number of government requests for information about their users made under specific legal authorities such as Section 215 of the USA PATRIOT Act, Section 702 of the FISA Amendments Act, the various National Security Letter (NSL) statutes, and others;
The number of individuals, accounts, or devices for which information was requested under each authority; and
The number of requests under each authority that sought communications content, basic subscriber information, and/or other information.
Second, the government should also augment the annual reporting that is already required by statute by issuing its own regular “transparency report” providing the same information: the total number of requests under specific authorities for specific types of data, and the number of individuals affected by each.

As an initial step, we request that the Department of Justice, on behalf of the relevant executive branch agencies, agree that Internet, telephone, and web-based service providers may publish specific numbers regarding government requests authorized under specific national security authorities, including the Foreign Intelligence Surveillance Act (FISA) and the NSL statutes. We further urge Congress to pass legislation requiring comprehensive transparency reporting by the federal government and clearly allowing for transparency reporting by companies without requiring companies to first seek permission from the government or the FISA Court.

This follows on a somewhat somewhat similar letter from Reps. Jim Sensenbrenner and Zoe Lofgren to Attorney General Holder and Director of National Intelligence Clapper, urging them "to authorize U.S. companies to release information regarding national security requests for user data."

Both letters point out that they're just looking for the ability to reveal specific numbers about orders received and user accounts impacted, but obviously not further information that might reveal the details of any investigations. Basically, they're asking for "just the metadata."

You may have spotted the irony, pointed out by Ashkan Soltani: Defenders of many of the government's surveillance programs have repeatedly trotted out the "just metadata" argument for why all of this surveillance is no problem, claiming that mere metadata doesn't reveal anything important. Yet, when it comes to their own metadata about their own surveillance programs, suddenly it will reveal all their secrets? (And I won't even get into the fact that only some of the surveillance programs are "just metadata").

So, which is it, feds? Is "just metadata" nothing too important, or does it reveal everything?

Filed Under: jim sensenbrenner, metadata, national security letters, nsa surveillance, surveillance, tech companies, zoe lofgren
Companies: apple, facebook, google, microsoft, mozilla, reddit, tumblr, twitter, yahoo

The Techdirt Greenhouse

Read the latest posts:

read all »

Techdirt Deals

Report this ad | Hide Techdirt ads

Techdirt Insider Discord

The latest chatter on the Techdirt Insider Discord channel...

Older Stuff

Tuesday
06:22	15 Years Late, The FCC Cracks Down On Broadband Apartment Monopolies (31)
Sunday
12:05	Funniest/Most Insightful Comments Of The Week At Techdirt (11)
Saturday
12:00	This Week In Techdirt History: February 13th - 19th (1)
Friday
19:39	Letter From High-Ranking FBI Lawyer Tells Prosecutors How To Avoid Court Scrutiny Of Firearms Analysis Junk Science (25)
15:52	Nintendo Is Beginning To Look Like The Disney Of The Video Game Industry (44)
13:49	Seattle Public Radio Station Manages To Partially Brick Area Mazdas Using Nothing More Than Some Image Files (44)
12:13	Thankfully, Jay Inslee's Unconstitutional Bill To Criminalize Political Speech Dies In The Washington Senate (8)
10:52	How Our Convoluted Copyright Regime Explains Why Spotify Chose Joe Rogan Over Neil Young (136)
10:47	Daily Deal: The Complete Blocs Website Builder Bundle (0)
09:33	Arizona Prosecutor Who Brought Bogus Gang Charges Against Protesters Files Ridiculous Defamation Suit Against Her Boss (12)
05:10	FTC Promises To Play Hardball With Robocall-Enabling VOIP Providers (23)
Thursday
20:30	FOIA Lawsuit Featuring A DC Police Whistleblower Says PD Conspired To Screw Requesters It Didn't Like (7)
16:06	Senator Blumenthal: Dismissing All Critics Of EARN IT As 'Big Tech Lobbyists' Shows Your Unwillingness To Recognize The Massive Problems In Your Bill (14)
13:43	California Sheriff, US DOJ Sued For Seizures Of Cash Generated By Legal Pot Businesses (33)
12:05	The Josh Hawley Mug: It Makes Him An Asshole, But Shouldn't Make Him A Copyright Infringer (42)
10:48	Blackburn & Blumenthal Introduce Terrible, Dangerous Bill To Make Sure Children Are Constantly Surveilled Online (21)
10:43	Daily Deal: The GameCreators Mega Maker Pack Bundle (0)
09:37	Whatever Problem EARN IT Is Trying To Solve, It Doesn't (12)
06:32	Gift Of Sight Stolen As Medical Implant Company Implodes (41)
Wednesday
20:13	Auguste Rodin's Sculptures Are In The Public Domain; 3D Scans Of Them Should Be, Too (34)
15:32	Content Moderation Case Study: YouTube Doubles Down On Questionable 'graphic Content' Enforcement Before Reversing Course (2020) (9)
13:42	NASA Says 2nd Gen Starlink Satellites Will Cause Headaches For NASA, Hubble (9)
12:09	Alabama Speed Trap Town's PD Called Out On Its Bullshit By Nearby Sheriff, Limps On Without Most Of Its Officers (17)
10:45	Senator Klobuchar's Next Unconstitutional Speech Control Bill: The NUDGE Act (37)
10:40	Daily Deal: The Complete 2022 Microsoft Office Master Class Bundle (0)
09:33	Nonprofit Forced To Delete Thousands Of Court Documents Obtained With A Fee Waiver Because PACER Is Greedy And Stupid (19)
05:45	Judge And Jury Say Sarah Palin Failed To Prove 'Actual Malice' In Defamation Case Against The NY Times (41)
Tuesday
20:09	DC Comics Goes To UK High Court Over Trademark Granted To Unilever For 'Wonder Mum' (7)
15:57	Some Senators Are Freaking Out Because The White House Is Pitching Some Extremely Minor Police Reforms (26)
13:30	Techdirt Podcast Episode 311: EARN IT Is Still Bad (5)

Mozilla Asks Court To Force FBI To Turn Over Information On Hacking Tool It Used In Child Porn Case

from the only-criminals-use-patched-browsers-amirite? dept

Facebook's Plan To Be The Compuserve Of Developing Nations Faces Mounting Worldwide Criticism

from the altruism-incorporated dept

Mozilla: If Facebook Really Wants To Help Developing Nations, It Should Ignore Zero Rating And Fund Real Internet Access

from the get-the-hell-out-of-the-way dept

Netflix Moving To Encrypted Streams, As Mozilla Moves To Deprecate Unencrypted Web Pages As Insecure

from the yay-encryption dept

EFF, Others Launch New Free Security Certificate Authority To 'Dramatically Increase Encrypted Internet Traffic'

from the very-cool dept

Are Apple, Google, Microsoft And Mozilla Helping Governments Carry Out Man-In-The-Middle Attacks?

from the and-what-can-they-do-about-it? dept

And Here We Go: Mozilla Felt Pressured Into Adopting DRM In HTML5

from the a-broken-system dept

Mozilla To FCC: Hey, There's Another Way To Protect Net Neutrality

from the have-you-thought-of-this? dept

Mozilla Pretends New Firefox Ads Aren't Ads, Will Somehow Revolutionize Browsing

from the you'll-take-this-improved-user-experience-and-like-it dept

If 'Just Metadata' Isn't An Issue, Why Can't Tech Companies Reveal 'Just Metadata' About NSA Surveillance?

from the simple-questions dept

The Techdirt Greenhouse

Tuesday

Sunday

Saturday

Friday

Thursday

Wednesday

Tuesday

More

Tools & Services

Company

Contact

More

from the only-criminals-use-patched-browsers-amirite? dept

from the altruism-incorporated dept

from the get-the-hell-out-of-the-way dept

from the yay-encryption dept

from the very-cool dept

from the and-what-can-they-do-about-it? dept

from the a-broken-system dept

from the have-you-thought-of-this? dept

from the you'll-take-this-improved-user-experience-and-like-it dept

from the simple-questions dept

Techdirt Daily Newsletter

The Techdirt Greenhouse

Tools & Services

Company

Contact

More