Conversation

Notices

1. Embed this notice
   Taggart :donor: (mttaggart@infosec.exchange)'s status on Thursday, 27-Feb-2025 05:19:30 JST Taggart :donor:

   Firefox now has Terms of Use! This'll go over like a lead balloon.

   You give Mozilla all rights necessary to operate Firefox, including processing data as we describe in the Firefox Privacy Notice, as well as acting on your behalf to help you navigate the internet. When you upload or input information through Firefox, you hereby grant us a nonexclusive, royalty-free, worldwide license to use that information to help you navigate, experience, and interact with online content as you indicate with your use of Firefox.

   https://www.mozilla.org/en-US/about/legal/terms/firefox/

   • Haelwenn /элвэн/ :triskell: and prettygood like this.
   • Embed this notice
     Doughnut Lollipop 【記録係】:blobfoxgooglymlem: (tk@bbs.kawa-kun.com)'s status on Thursday, 27-Feb-2025 06:33:51 JST Doughnut Lollipop 【記録係】:blobfoxgooglymlem:

     in reply to
     @mttaggart Guess I'll never be able to update Firefox again. :blobfoxgooglycry:
   • Embed this notice
     Xenotar (xenotar@mastodon.social)'s status on Thursday, 27-Feb-2025 06:46:16 JST Xenotar

     in reply to

     @mttaggart I moved from firefox to librewolf

   • Embed this notice
     Taggart :donor: (mttaggart@infosec.exchange)'s status on Thursday, 27-Feb-2025 06:46:17 JST Taggart :donor:

     in reply to

     This clause explicitly separates the information they claim license over from the data collected in the Privacy Notice. This clause is more expansive—"information uploaded through Firefox" is basically anything in a HTTP request or a websocket.

     https://www.mozilla.org/en-US/privacy/firefox/

   • Embed this notice
     Taggart :donor: (mttaggart@infosec.exchange)'s status on Thursday, 27-Feb-2025 06:46:17 JST Taggart :donor:

     in reply to

     This is the press release. I do not believe there is concord between this language and the actual policy: https://blog.mozilla.org/en/products/firefox/firefox-news/firefox-terms-of-use/

   • Embed this notice
     Taggart :donor: (mttaggart@infosec.exchange)'s status on Thursday, 27-Feb-2025 06:46:17 JST Taggart :donor:

     in reply to

     Hey FWIW, Vivaldi does not have anything like this language: https://vivaldi.com/privacy/vivaldi-end-user-license-agreement/

   • Embed this notice
     Taggart :donor: (mttaggart@infosec.exchange)'s status on Thursday, 27-Feb-2025 06:46:17 JST Taggart :donor:

     in reply to

     This is your hojillionth reminder that non-profits are corpos that figured out how to avoid taxes. When the chips are down, most will readjust the "mission" toward revenue.

   • Embed this notice
     Polychrome :blabcat: (polychrome@poly.cybre.city)'s status on Thursday, 27-Feb-2025 12:29:23 JST Polychrome :blabcat:

     in reply to
     @mttaggart looks like it means they're giving themselves the right to upload the data to the web server that you're choosing to upload the data to.
     
     In other words, they're covering their butt as to their right to do what you're actually intending to do and nothing else but.
     
     What am I missing here?
   • Embed this notice
     Polychrome :blabcat: (polychrome@poly.cybre.city)'s status on Thursday, 27-Feb-2025 12:59:17 JST Polychrome :blabcat:

     in reply to

     • LisPi
     @lispi314 @mttaggart right, because that's the legal entity behind Firefox that'll get sued for whatever. It's a boilerplate legal butt-cover that lets Mozilla's Firefox upload your data as you yourself instruct to servers of your choice as far as I can see.
     
     Not sure what I am missing that's making it dangerous.
   • Embed this notice
     LisPi (lispi314@udongein.xyz)'s status on Thursday, 27-Feb-2025 12:59:19 JST LisPi

     in reply to

     • Polychrome :blabcat:
     @Polychrome @mttaggart They're giving the right/permission to Mozilla, the organization. Not to Firefox, the user-agent program.
   • Embed this notice
     Taggart :donor: (mttaggart@infosec.exchange)'s status on Thursday, 27-Feb-2025 16:38:51 JST Taggart :donor:

     in reply to

     I have spent my night reading browser Terms and Privacy Policies. Why? Because I love you and hate myself, apparently.

     So here's the deal: that "non-exclusive, royalty-free, worldwide license" you're granting to Firefox/Moz when you upload data through it? It is boilerplate language. Pretty common actually!

     But not in browsers. In fact, not a single browser ToS has anything resembling this provision.

     Know what does?

     Facebook
     X
     Instagram

     I wonder why Mozilla would want to use the same language those platforms do.

   • Embed this notice
     Taggart :donor: (mttaggart@infosec.exchange)'s status on Thursday, 27-Feb-2025 16:38:51 JST Taggart :donor:

     in reply to

     Mozilla has updated their press release with the following clarification:

     UPDATE: We’ve seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of the basic functionality of Firefox possible. Without it, we couldn’t use information type into Firefox, for example. It does NOT give us ownership of your data or a right to use it for anything other than what is described in the Privacy Notice.

     https://blog.mozilla.org/en/products/firefox/firefox-news/firefox-terms-of-use/

     That is good to hear, but their reasoning makes no sense given that no other browser uses that language.

   • Embed this notice
     Brodie Robertson (brodieonlinux@mstdn.social)'s status on Thursday, 27-Feb-2025 16:38:51 JST Brodie Robertson

     in reply to

     @mttaggart For all the shit that Brave gets, not even Brave has this in there TOS

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 27-Feb-2025 20:48:57 JST Rich Felker

     in reply to

     • Aaron Williamson

     @copiesofcopies @mttaggart But they are not doing it. Your computer, directed by you, running free and open source software that just happens to be published by them, is what's uploading. They are not party to that transaction. And their incompetent and/or malicious legal department doesn't understand that, or wants to pretend they are for nefarious purposes.

   • Embed this notice
     Taggart :donor: (mttaggart@infosec.exchange)'s status on Thursday, 27-Feb-2025 20:48:59 JST Taggart :donor:

     in reply to

     • Aaron Williamson

     @copiesofcopies If I upload my artwork to anywhere via Firefox, have I just granted a royalty-free license to that intellectual property to Firefox, if they deem use of it is in my best interest in "interacting with online content?"

   • Embed this notice
     Aaron Williamson (copiesofcopies@social.coop)'s status on Thursday, 27-Feb-2025 20:48:59 JST Aaron Williamson

     in reply to

     @mttaggart as I read it, you give them a limited license to use that content as needed to do what you’re using Firefox to do. I.e. if you’re uploading an image to a website, you authorize them to do so as you directed.

   • Embed this notice
     Aaron Williamson (copiesofcopies@social.coop)'s status on Thursday, 27-Feb-2025 20:49:01 JST Aaron Williamson

     in reply to

     @mttaggart not seeing what’s objectionable about the quoted section

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 27-Feb-2025 21:30:41 JST Rich Felker

     in reply to

     • Aaron Williamson

     @copiesofcopies @mttaggart I don't think this is reasonable unless you're publishing an "app" not an application - that is, something that's giving you access to the user's device rather than operating entirely at the direction of the user.

   • Embed this notice
     Aaron Williamson (copiesofcopies@social.coop)'s status on Thursday, 27-Feb-2025 21:30:42 JST Aaron Williamson

     in reply to

     • Rich Felker

     @dalias @mttaggart GDPR Art. 4: “‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data….” App publishers are (imo reasonably) interpreting this to apply to apps that deal with personal info, because the app developer arguably “determines the purposes and means of the processing.”

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 27-Feb-2025 22:25:27 JST Rich Felker

     in reply to

     • Aaron Williamson

     @copiesofcopies @mttaggart Are you trying to claim that authors of FOSS are data controllers for any data the user enters with the software they made? In the absence of any channel of control? Or only that something particular Mozilla has done makes that so?

   • Embed this notice
     Aaron Williamson (copiesofcopies@social.coop)'s status on Thursday, 27-Feb-2025 22:25:29 JST Aaron Williamson

     in reply to

     • Rich Felker

     @dalias @mttaggart that’s really not relevant to the text of the regulation.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 27-Feb-2025 23:31:36 JST Rich Felker

     in reply to

     • Aaron Williamson

     @copiesofcopies @mttaggart I guess that's plausible, but I see it as incompetence: rather than reducing exposure, it's made them a more likely target for regulators by claiming entitlement to access something they clearly have no right to, and without the necessary GDPR means to opt out.

   • Embed this notice
     Aaron Williamson (copiesofcopies@social.coop)'s status on Thursday, 27-Feb-2025 23:31:37 JST Aaron Williamson

     in reply to

     • Rich Felker

     @dalias @mttaggart I’m saying the text of the GDPR is intentionally broad and could be read that way by regulators. Mozilla has more potential exposure than an average FOSS developer, which may be why they’re taking a conservative approach to that risk.

   • Embed this notice
     agaric (agaric@social.coop)'s status on Friday, 28-Feb-2025 00:49:18 JST agaric

     in reply to

     • Rich Felker
     • Aaron Williamson

     @dalias @copiesofcopies @mttaggart

     Whatever legal language may or may not give cover, the *spirit* of GDPR is to say precisely what information you collect and for what reason, and if you do not have a good reason, do not collect. Not "use everything everywhere for anything" just in case.