Fedora ain't playin' around w/Firefox 3.

[Scott Beamer]

This is new....

http://fedoraproject.org/static/firefox/

I wonder what brought this on...

Scott

[Frank Murphy]

On Wed, 2008-06-18 at 10:18 +0000, Scott wrote:
> This is new....
>
> http://fedoraproject.org/static/firefox/
>
> I wonder what brought this on...
>
> Scott
> From what I see you only get certain rights with regard to the s\w.

Maybe firefox are going the patents\proprietry route?

Frank

[David]

Scott wrote:
> This is new....
>
> http://fedoraproject.org/static/firefox/
>
> I wonder what brought this on...

That sounds like, to me, that Mozilla and Fedora are providing you with a 
reasonably safe and secure Firefox browser. If you chose to add third party 
software to Firefox, Flash for example, and it breaks your system or opens you 
up to outside attacks you get to keep the 'pieces' and the 'bugs'.  ;-)

[Kevin Martin]

David Boles wrote:
> Scott wrote:
> > This is new....
> >
> > http://fedoraproject.org/static/firefox/
> >
> > I wonder what brought this on...
>
> That sounds like, to me, that Mozilla and Fedora are providing you 
> with a reasonably safe and secure Firefox browser. If you chose to add 
> third party software to Firefox, Flash for example, and it breaks your 
> system or opens you up to outside attacks you get to keep the 'pieces' 
> and the 'bugs'.  ;-)

Those settings are not specific to the Firefox version provided by 
Fedora (I don't use the version provided by Fedora downloads...too 
messed up typically).  FireFox3 has those even with the version 
downloaded from Mozilla so I'm not sure why there would be that 
disclaimer on the Fedora site.

Kevin

[Mauriat M]

2008/6/18 David Boles :
> Scott wrote:
> > This is new....
> >
> > http://fedoraproject.org/static/firefox/
> >
> > I wonder what brought this on...
>
> That sounds like, to me, that Mozilla and Fedora are providing you with a
> reasonably safe and secure Firefox browser. If you chose to add third party
> software to Firefox, Flash for example, and it breaks your system or opens
> you up to outside attacks you get to keep the 'pieces' and the 'bugs'.  ;-)

Why does that page single out the "anti-phishing" (Suspected Forgery)
service of FF3?

I maybe totally wrong on this (someone please correct me) but it seems
more like a privacy disclosure and less to do with
3rd-party-"breakage".  Specifically in this case some 3rd party (i.e.
Google) will be receiving information about the specific URL's you are
browsing (along with cookies, etc.). See:
http://www.google.com/tools/firefox/firefox_privacy.html

-Mauriat

[bruce]

hi...

the issue of the FF security measures (and others) is that the data on the
URLs you visit might go back to a 3rd party company (IE google), which
could/would therefore have a track of the sites that you visit.

it's up to you to decide if you trust them with this kind of data and if you
value the service that it might provide to you, the user.

google claims that they're not going to do anything with the data, but
there's nothing to stop them if they do.

it would be nice if google/firefox actually would spell all of this out, as
well as make the default "off", but it's easier for them to have the user
have to opt out.

i didn't discover this, untill i was looking at the packets/traffic from my
FF browser and got curious about the "google" traffic when i wasn't using
google!!

if microsoft did this, people would scream like hell. if firefox/google does
it, it's aww... ain't that cute!!

bottom line, the user should be told what the hell is going on, without
having to have a degree in comp sci!!

peace!

-----Original Message-----
From: [e-mail]
[mailto:[e-mail]]On Behalf Of Mauriat
Sent: Wednesday, June 18, 2008 7:35 AM
To: For users of Fedora
Subject: Re: Fedora ain't playin' around w/Firefox 3.

2008/6/18 David Boles :
> Scott wrote:
> > This is new....
> >
> > http://fedoraproject.org/static/firefox/
> >
> > I wonder what brought this on...
>
> That sounds like, to me, that Mozilla and Fedora are providing you with a
> reasonably safe and secure Firefox browser. If you chose to add third

party
> software to Firefox, Flash for example, and it breaks your system or opens
> you up to outside attacks you get to keep the 'pieces' and the 'bugs'.

;-)

Why does that page single out the "anti-phishing" (Suspected Forgery)
service of FF3?

I maybe totally wrong on this (someone please correct me) but it seems
more like a privacy disclosure and less to do with
3rd-party-"breakage".  Specifically in this case some 3rd party (i.e.
Google) will be receiving information about the specific URL's you are
browsing (along with cookies, etc.). See:
http://www.google.com/tools/firefox/firefox_privacy.html

-Mauriat

--
fedora-list mailing list
[e-mail]
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

[Antonio Olivares]

--- On Wed, 6/18/08, Scott  wrote:
> From: Scott 
> Subject: Fedora ain't playin' around w/Firefox 3.
> To: [e-mail]
> Date: Wednesday, June 18, 2008, 3:18 AM
> This is new....
>
> http://fedoraproject.org/static/firefox/
>
> I wonder what brought this on...
>
> Scott
>
> --

This basically means, /usr/bin/firefox > /dev/null

In the Mozilla Firefox Website Services

http://fedoraproject.org/static/firefox/website-services-agreement.html

page provided in this thread:

This below

/***********************************************************************/
8. U.S. GOVERNMENT END-USERS. This Product is a "commercial item," as that term is defined in 48 C.F.R. 2.101, consisting of "commercial computer software" and "commercial computer software documentation," as such terms are used in 48 C.F.R. 12.212 (Sept. 1995) and 48 C.F.R. 227.7202 (June 1995). Consistent with 48 C.F.R. 12.212, 48 C.F.R. 27.405(b)(2) (June 1998) and 48 C.F.R. 227.7202, all U.S. Government End Users acquire the Product with only those rights as set forth therein.
/***********************************************************************/

is very much against Fedora's principles of Free Software.  This has to mean that Fedora will need to develop a free browser, much like Debian did and rebranded Firefox to "Iceweasel".  Debian warned others about this, and Fedora did not listen know they pulled it off on them :(

I was encouraged to write a bugzilla on when Firefox wanted me to accept a license agreement

https://bugzilla.redhat.com/show_bug.cgi?id=447661

Many users should file a bugzilla against firefox.  Or just decide not to update it or remove it altogether.  This is definitely anti-Fedora, I wonder how it got past them?

Regards,

Antonio

[Tim]

On Wed, 2008-06-18 at 08:13 -0700, bruce wrote:
> the issue of the FF security measures (and others) is that the data on
> the URLs you visit might go back to a 3rd party company (IE google),
>
> google claims that they're not going to do anything with the data, but
> there's nothing to stop them if they do.

Like we believe that... (about a company who's stated aim was to
database everything).  I think it's more of a concern what they'd do
with it, rather than worrying *if* they'll do something with it.

Unfortunately, there's a lot of services which aren't secure (e.g. they
put *your* info into the URI, where someone else seems like you if they
use the same URI).  That's not the sort of thing you want ending up
being indexed by a search engine.  And it's not something that most of
the general public would understand.
> it would be nice if google/firefox actually would spell all of this
> out, as well as make the default "off", but it's easier for them to
> have the user have to opt out.
>
> i didn't discover this, untill i was looking at the packets/traffic
> from my FF browser and got curious about the "google" traffic when i
> wasn't using google!!

I thought it was pretty obvious what it'd have to do, to work.

I always go through the browser preferences of new installs, and most
updates.  I found an option about checking websites and it's clear that
it'd either have to come with black/white lists (not practical), or ask
some service for its thoughts on what you were about to access.

[Anne Wilson]

On Wednesday 18 June 2008 16:37:06 Tim wrote:
> > google claims that they're not going to do anything with the data, but
> > there's nothing to stop them if they do.
>
> Like we believe that... (about a company who's stated aim was to
> database everything).  I think it's more of a concern what they'd do
> with it, rather than worrying *if* they'll do something with it.

The answer's simple enough.  If you don't trust them, don't use it.

Anne

[Antonio Olivares]

--- On Wed, 6/18/08, Anne Wilson  wrote:
> From: Anne Wilson 
> Subject: Re: Fedora ain't playin' around w/Firefox 3.
> To: "For users of Fedora" 
> Date: Wednesday, June 18, 2008, 8:44 AM
> On Wednesday 18 June 2008 16:37:06 Tim wrote:
> > > google claims that they're not going to do
>
> anything with the data, but
> > > there's nothing to stop them if they do.
> >
> > Like we believe that... (about a company who's
>
> stated aim was to
> > database everything).  I think it's more of a
>
> concern what they'd do
> > with it, rather than worrying *if* they'll do
>
> something with it.
>
> The answer's simple enough.  If you don't trust
> them, don't use it.
>
> Anne
>
> --

I saw something that might be related in some way or another.

I also use Slax Linux Live CD, and I saw that firefox contained something called Trackware.Alexa,

http://www.slax.org/forum.php?action=view&parentID=11837&highlight=a...

Trackware.Alexa should only affect Windows users as the following link

http://www.symantec.com/security_response/writeup.jsp?docid=2004-062410-3624...

says, but If it made its way into Linux.  We are not safe anymore are we?

We do not need "Toolbars" and those trackware/malware/spyware stuff that exists in Windows.  We have to keep an eye out for what is coming.  Now I can say Gooooooo..........ooo Konqueror!!!! :)

Thanks for the warning, I was looking forward to update Firefox, now I'll keep it as it came with Fedora 9.

Regards,

Antonio

[Patrick O'Callaghan]

On Wed, 2008-06-18 at 08:34 -0700, Antonio Olivares wrote:
> /***********************************************************************/
> 8. U.S. GOVERNMENT END-USERS. This Product is a "commercial item," as
> that term is defined in 48 C.F.R. 2.101, consisting of "commercial
> computer software" and "commercial computer software documentation,"
> as such terms are used in 48 C.F.R. 12.212 (Sept. 1995) and 48 C.F.R.
> 227.7202 (June 1995). Consistent with 48 C.F.R. 12.212, 48 C.F.R.
> 27.405(b)(2) (June 1998) and 48 C.F.R. 227.7202, all U.S. Government
> End Users acquire the Product with only those rights as set forth
> therein.
> /***********************************************************************/
>
> is very much against Fedora's principles of Free Software.

This applies to "U.S. Government End Users". Are you a U.S. Government
End User?

poc

[Antonio Olivares]

--- On Wed, 6/18/08, Patrick O'Callaghan  wrote:
> From: Patrick O'Callaghan 
> Subject: Re: Fedora ain't playin' around w/Firefox 3.
> To: [e-mail]
> Date: Wednesday, June 18, 2008, 9:54 AM
> On Wed, 2008-06-18 at 08:34 -0700, Antonio Olivares wrote:
> >
>
> /***********************************************************************/
> > U.S. GOVERNMENT END-USERS. This Product is a
>
> "commercial item," as
> > that term is defined in 48 C.F.R. 2.101, consisting of
>
> "commercial
> > computer software" and "commercial computer
>
> software documentation,"
> > as such terms are used in 48 C.F.R. 12.212 (Sept.
> and 48 C.F.R.
> > 227.7202 (June 1995). Consistent with 48 C.F.R.
>
> 12.212, 48 C.F.R.
> > 27.405(b)(2) (June 1998) and 48 C.F.R. 227.7202, all
>
> U.S. Government
> > End Users acquire the Product with only those rights
>
> as set forth
> > therein.
>
> /***********************************************************************/
> > is very much against Fedora's principles of Free
>
> Software.
>
> This applies to "U.S. Government End Users". Are
> you a U.S. Government
> End User?
>
> poc
>
> --

I knew someone was going to respond to this one, I did not read all the way that it said 8. U.S. GOVERNMENT END-USERS. This Product is a ...

I got excited to send this mail that I did not read carefully, but still I have an answer that should clear the deal *I hope*

``This Product is a "commercial item," as ...''

So is it commercial for Government Users and not for us regular citizens?

This is taking it steps further, Is there an exception that we did not know of?

Not an official government employee if you ask, but

Aren't we all part of the U.S Government?  We pay taxes.  Our government is Government of the People, By the people for the people, for the people
 -- and that government of the people, by the people, for the people, shall not perish from the earth.

Lincoln told us that, was that a joke?

http://showcase.netins.net/web/creative/lincoln/speeches/gettysburg.htm

I guess for our government nowadays it could well very easily be.  They take away many of our freedoms that were granted back in the old days :(

Rahul,

will you encourage users to write a bug report against firefox, or just leave things as they are with the announcement on the page?

http://fedoraproject.org/static/firefox/

http://fedoraproject.org/static/firefox/website-services-agreement.html

Regards,

Antonio

[Steve Searle]

Around 07:14pm on Wednesday, June 18, 2008 (UK time), Antonio Olivares scrawled:
> Aren't we all part of the U.S Government?  We pay taxes.  Our

No we aren't.

Steve
(Muttering and humming Rule Britania)

[Antonio Olivares]

--- On Wed, 6/18/08, Steve Searle  wrote:
> From: Steve Searle 
> Subject: Re: Fedora ain't playin' around w/Firefox 3.
> To: [e-mail], "For users of Fedora" 
> Date: Wednesday, June 18, 2008, 12:51 PM
> Around 07:14pm on Wednesday, June 18, 2008 (UK time),
> Antonio Olivares scrawled:
> > Aren't we all part of the U.S Government?  We pay
>
> taxes.  Our
>
> No we aren't.

Of course, you would belong to the British Govt., others to the French Govt., There is no World Govt.  :(  You still now that Fedora is governed bu US. Government Laws right?  That is the point I am making.
> Steve
> (Muttering and humming Rule Britania)
>
> --
>
> A:  Because it messes up the order in which people normally
> read text.
> Q:  Why is top-posting a bad thing?
>
> 20:50:13 up 27 days,  1:22,  1 user,  load average: 0.08,
> 0.04, 0.03

[Patrick O'Callaghan]

On Wed, 2008-06-18 at 13:48 -0700, Antonio Olivares wrote:
> --- On Wed, 6/18/08, Steve Searle  wrote:
> > From: Steve Searle 
> > Subject: Re: Fedora ain't playin' around w/Firefox 3.
> > To: [e-mail], "For users of Fedora" 
> > Date: Wednesday, June 18, 2008, 12:51 PM
> > Around 07:14pm on Wednesday, June 18, 2008 (UK time),
> > Antonio Olivares scrawled:
> > > Aren't we all part of the U.S Government?  We pay
> >
> > taxes.  Our
> >
> > No we aren't.
>
> Of course, you would belong to the British Govt., others to the French Govt., There is no World Govt.  :(  You still now that Fedora is governed bu US. Government Laws right?  That is the point I am making.

1) None of us "belong" to the US Government except (in a loose sense)
those who actually work for it, to whom this clause is specifically
directed.

2) Being commercial doesn't mean not being free. RedHat and others make
money from free software.

poc

[Antonio Olivares]

--- On Wed, 6/18/08, Patrick O'Callaghan  wrote:
> From: Patrick O'Callaghan 
> Subject: Re: Fedora ain't playin' around w/Firefox 3.
> To: [e-mail]
> Date: Wednesday, June 18, 2008, 2:11 PM
> On Wed, 2008-06-18 at 13:48 -0700, Antonio Olivares wrote:
> > --- On Wed, 6/18/08, Steve Searle
>
>  wrote:
> > > From: Steve Searle 
> > > Subject: Re: Fedora ain't playin' around
>
> w/Firefox 3.
> > > To: [e-mail], "For users of
>
> Fedora"
> > > Date: Wednesday, June 18, 2008, 12:51 PM
> > > Around 07:14pm on Wednesday, June 18, 2008 (UK
>
> time),
> > > Antonio Olivares scrawled:
> > > > Aren't we all part of the U.S
>
> Government?  We pay
> > > taxes.  Our
> > >
> > > No we aren't.
> >
> > Of course, you would belong to the British Govt.,
>
> others to the French Govt., There is no World Govt.  :( 
> You still now that Fedora is governed bu US. Government
> Laws right?  That is the point I am making.
> None of us "belong" to the US Government
>
> except (in a loose sense)
> those who actually work for it, to whom this clause is
> specifically
> directed.

Okay :)
> Being commercial doesn't mean not being free. RedHat
>
> and others make
> money from free software.

Red Hat does not charge for the software, they charge for the services that they provide.  At least that is what I have been told many many times.  So now Firefox is not free anymore :(, is that what you are saying.  Opera is Free/but not opensource correct.  So Firefox is opensource but not free?

Regards,

Antonio
> poc
>
> --

[Ric Moore]

On Wed, 2008-06-18 at 12:24 -0430, Patrick O'Callaghan wrote:
> On Wed, 2008-06-18 at 08:34 -0700, Antonio Olivares wrote:
> > /***********************************************************************/
> > 8. U.S. GOVERNMENT END-USERS. This Product is a "commercial item," as
> > that term is defined in 48 C.F.R. 2.101, consisting of "commercial
> > computer software" and "commercial computer software documentation,"
> > as such terms are used in 48 C.F.R. 12.212 (Sept. 1995) and 48 C.F.R.
> > 227.7202 (June 1995). Consistent with 48 C.F.R. 12.212, 48 C.F.R.
> > 27.405(b)(2) (June 1998) and 48 C.F.R. 227.7202, all U.S. Government
> > End Users acquire the Product with only those rights as set forth
> > therein.
> > /***********************************************************************/
> >
> > is very much against Fedora's principles of Free Software.
>
> This applies to "U.S. Government End Users". Are you a U.S. Government
> End User?

Here's a good page about the lady in charge of Firefox security.
http://www.usatoday.com/tech/news/computersecurity/2008-06-17-mozilla-window...

Good article. Ric

[Patrick O'Callaghan]

On Wed, 2008-06-18 at 17:16 -0700, Antonio Olivares wrote:
> > Being commercial doesn't mean not being free. RedHat
> >
> > and others make
> > money from free software.
>
> Red Hat does not charge for the software, they charge for the services
> that they provide.  At least that is what I have been told many many
> times.

Correct.
> So now Firefox is not free anymore :(, is that what you are saying.
> Opera is Free/but not opensource correct.  So Firefox is opensource
> but not free?

I'm afraid you've lost me completely. I don't understand how you can
put this interpretation my comment.

First, why are you mixing RH and Mozilla? The web page you mentioned in
your original post has nothing whatsoever to do with RH.

Second, the page says that Mozilla provides FF, that Mozilla is a
company, that FF is for legal purposes a commercial product (even if
they don't charge for it) and as such certain legal stipulations are
announced, mostly to do with Mozilla's lack of liability for third-party
extensions and for its website services (note that these are separate
from the software as such, i.e. what the page calls the Product), but
also mentioning the specific case of US Government use.

Third, this latter part, section 8, seems to limit US Government users'
rights over the Product, but I presume this is in the sense of making
sure they also are bound by the same license as everybody else, which
otherwise they might not be. Someone who is familiar with the various
cited laws should probably comment here.

Fourth, in any case, since I'm not a US Government user, section 8
doesn't affect *my* rights in the slightest. I suspect you are in the
same position.

poc

[Ric Moore]

On Wed, 2008-06-18 at 17:16 -0700, Antonio Olivares wrote:
> Red Hat does not charge for the software, they charge for the services
> that they provide.  At least that is what I have been told many many
> times.  So now Firefox is not free anymore :(, is that what you are
> saying.  Opera is Free/but not opensource correct.  So Firefox is
> opensource but not free?

Who said Firefox isn't opensource?? I dealt with GSA for years. For the
government to use anything, it has to be fitted into it's category like
a square peg in a square hole in order to be utilized. Period. So, that
bit of verbiage merely qualifies it for use by any Federal program,
according to the dictates of GSA. They can't even use Charmin in the
bathrooms if it's isn't on a GSA list. That's all. If they didn't meet
some "spec" the entire Federal Government would be stuck with I.E.

That's all there is to it. No need to set off the klaxons and worry
needlessly. We spent as much money meeting USDA, OSHA, FDA. lawyers and
GSA guidelines than the product raw material costs. Some boiler plate is
just part of dealing with GovCo. Ric

[g]

Patrick O'Callaghan wrote:
> company, that FF is for legal purposes a commercial product (even if

i do believe that there is a lot of lack of understanding in use of word
'commercial' thru this posting.

i believe in this case, 'commercial' is used to indicate that product is
'in public hands', verses a product that is 'designed' or 'written'
'privately' for 'closed use'.

charging or not charging for product is not relevant.

[Antonio Olivares]

--- On Wed, 6/18/08, Patrick O'Callaghan  wrote:
> From: Patrick O'Callaghan 
> Subject: Re: Fedora ain't playin' around w/Firefox 3.
> To: [e-mail]
> Date: Wednesday, June 18, 2008, 10:49 PM
> On Wed, 2008-06-18 at 17:16 -0700, Antonio Olivares wrote:
> > > Being commercial doesn't mean not being
>
> free. RedHat
> > > and others make
> > > money from free software.
> >
> > Red Hat does not charge for the software, they charge
>
> for the services
> > that they provide.  At least that is what I have been
>
> told many many
> > times.
>
> Correct.
> > So now Firefox is not free anymore :(, is that what
>
> you are saying.
> > Opera is Free/but not opensource correct.  So Firefox
>
> is opensource
> > but not free?
>
> I'm afraid you've lost me completely. I
> don't understand how you can
> put this interpretation my comment.

No you did not lose me, firefox did :(  I understand what is going on, Why did we not know ahead of time that they might pull this kind of trick.  I was told that we do not need to click anywhere to accept a license, that software provided is here for us, but we need not accept any license(s) imposed,

This came out as soon as firefox 3.0 was released

http://fedoraproject.org/static/firefox/

which points to the license

http://fedoraproject.org/static/firefox/website-services-agreement.html

indirecty we have to accept or disable the "services".

The accompanying version of Mozilla Firefox utilizes website information services ("Services"), such as safe-browsing features, which are provided by the Mozilla Corporation and made available to you under additional terms. By using the Services, you consent to the terms of the referenced Mozilla Firefox Website Services Agreement. If you do not agree to these terms, do not use the Services and disable the Services in Edit > Preferences > Security and uncheck the options for both: "Tell me if the site I'm visiting is a suspected attack site" and "Tell me if the site I'm visiting is a suspected forgery".

We did not need to do this before.  This is all and it is simple, right.  But that does not mean that they do not have any trackware/spyware added?  Are there other things that we need to look out for?

I am just concerned now that somehow they are imposing their will on us and flexing their muscle.

* To those that also use Ubuntu,  Did firefox do the same thing on Ubuntu? or did it just happen here?  I see this with new AVG 8.0 Free Edition that it adds a Toolbar and it tries to tell you which sites are safe/not safe.  That is the price to pay if you do not want to pay $$ to Avg to protect you, you can get the product, but you will have to help out in a way or another.

Now the same can be said of firefox.  You can tell firefox, which sites are safe and which ones are not, google collects some data about which sites you visit and ..., this is the part that makes me concerned.  Otherwise, I would not have responded or asked in the first place.  We have to read carefully and the fine print that is also hard to read.

Regards,

Antonio
> poc
>
> --

[Tim]

Tim:
> > Like we believe that... (about a company who's stated aim was to
> > database everything).  I think it's more of a concern what they'd do
> > with it, rather than worrying *if* they'll do something with it.

Anne Wilson:
> The answer's simple enough.  If you don't trust them, don't use it.

I don't.  I don't trust Google not to make use of the data, though
that's not such a great concern since I am doing a lot of Google
searching - they are already databasing me, to a large degree.

More importantly, I don't trust some website to tell me that a site is
safe, when it might not be.  Nor would I rely on it warning me about
some site that mightn't be safe.

And I could do without any delays being added by waiting for a check.

I don't like the way Firefox ends up on some other OSs.  With two or
three taskbars crowding out the window, and bogging the program down
with further processing.  Firefox's none-to-nippy, anymore, without
making it do even more work.

I've seen some anti-virus software, for instance, hook into the browser,
and give you warnings about listings you see from Google.  Google could
do that themselves, when they generate results for your searches.

[Tim]

This thread is branching out into politics, which is nearly always a
bad idea...

On Wed, 2008-06-18 at 16:41 -0430, Patrick O'Callaghan wrote:
> None of us "belong" to the US Government

Try telling them that when a government decides that they do own you,
and that you must do this and that...  You must pay us taxes or else,
you're drafted, you can't leave/enter a country without our say so,
these are the laws that will be applied to you, etc...  There's a lot of
situations where you're treated as a possession.

[Antonio Olivares]

--- On Thu, 6/19/08, Tim  wrote:
> From: Tim 
> Subject: Re: Fedora ain't playin' around w/Firefox 3.
> To: "For users of Fedora" 
> Date: Thursday, June 19, 2008, 12:00 AM
> Tim:
> > > Like we believe that... (about a company who's
>
> stated aim was to
> > > database everything).  I think it's more of a
>
> concern what they'd do
> > > with it, rather than worrying *if* they'll do
>
> something with it.
>
> Anne Wilson:
> > The answer's simple enough.  If you don't
>
> trust them, don't use it.
>
> I don't.  I don't trust Google not to make use of
> the data, though
> that's not such a great concern since I am doing a lot
> of Google
> searching - they are already databasing me, to a large
> degree.
>
> More importantly, I don't trust some website to tell me
> that a site is
> safe, when it might not be.  Nor would I rely on it warning
> me about
> some site that mightn't be safe.
>
> And I could do without any delays being added by waiting
> for a check.
>
> I don't like the way Firefox ends up on some other OSs.
>  With two or
> three taskbars crowding out the window, and bogging the
> program down
> with further processing.  Firefox's none-to-nippy,
> anymore, without
> making it do even more work.
>
> I've seen some anti-virus software, for instance, hook
> into the browser,
> and give you warnings about listings you see from Google. 
> Google could
> do that themselves, when they generate results for your
> searches.

Thank you Tim for hitting the nail right on the head.  This is what I am trying to say in the previous messages within this thread.  We need none of that.  I see the toolbars in the other OS, and I would hate ***linux any not just Fedora*** incorporate them, that would definitely make me sad :(  This is what I liked about linux and now they are invading it as well :(

My $0.02, I will have to save so I can fill my car's tank as the 
gas_prices >= $4.00, and gas_prices++) not cool :( either

$0.02 is not much lost in this case.

Regards,

Antonio
> -- 
> [tim@localhost ~]$ uname -r
> 2.6.25.6-55.fc9.i686
>
> Don't send private replies to my address, the mailbox
> is ignored.  I
> read messages from the public lists.
>
> -- 
> fedora-list mailing list
> [e-mail]
> To unsubscribe:
> https://www.redhat.com/mailman/listinfo/fedora-list

[Antonio Olivares]

--- On Thu, 6/19/08, Tim  wrote:
> From: Tim 
> Subject: Re: Fedora ain't playin' around w/Firefox 3.
> To: "For users of Fedora" 
> Date: Thursday, June 19, 2008, 12:04 AM
> This thread is branching out into politics, which is
> nearly always a
> bad idea...
>
> On Wed, 2008-06-18 at 16:41 -0430, Patrick O'Callaghan
> wrote:
> > None of us "belong" to the US Government
>
> Try telling them that when a government decides that they
> do own you,
> and that you must do this and that...  You must pay us
> taxes or else,
> you're drafted, you can't leave/enter a country
> without our say so,
> these are the laws that will be applied to you, etc... 
> There's a lot of
> situations where you're treated as a possession.

Please forgive Patrick, it was me who brought in the government into the discussion.  My BAD! :(  I agree with you and apologize to all for mixing things up :(  I am just disapointed that we have to deal with this kinds of things with the new firefox.  Lots of great things were said about it, and this is surely not one of them.

Regards,

Antonio
> -- 
> [tim@localhost ~]$ uname -r
> 2.6.25.6-55.fc9.i686
>
> Don't send private replies to my address, the mailbox
> is ignored.  I
> read messages from the public lists.
>
> -- 
> fedora-list mailing list
> [e-mail]
> To unsubscribe:
> https://www.redhat.com/mailman/listinfo/fedora-list

[Patrick O'Callaghan]

On Wed, 2008-06-18 at 23:57 -0700, Antonio Olivares wrote:
> > I'm afraid you've lost me completely. I
> > don't understand how you can
> > put this interpretation my comment.
>
> No you did not lose me, firefox did :(  I understand what is going on,
> Why did we not know ahead of time that they might pull this kind of
> trick.  I was told that we do not need to click anywhere to accept a
> license, that software provided is here for us, but we need not accept
> any license(s) imposed,

Have you installed and used FF 2 via rpm? On Fedora I recall clicking on
a licence agreement on first run. IIRC this is not new (the services
part is, see below).
> This came out as soon as firefox 3.0 was released
>
> http://fedoraproject.org/static/firefox/
>
> which points to the license
>
> http://fedoraproject.org/static/firefox/website-services-agreement.html
>
> indirecty we have to accept or disable the "services".

1) The "services" aren't the browser and thus are in no way involved
with the freeness of the software, and 2) if you disagree then simply
disable them.
> The accompanying version of Mozilla Firefox utilizes website
> information services ("Services"), such as safe-browsing features,
> which are provided by the Mozilla Corporation and made available to
> you under additional terms. By using the Services, you consent to the
> terms of the referenced Mozilla Firefox Website Services Agreement. If
> you do not agree to these terms, do not use the Services and disable
> the Services in Edit > Preferences > Security and uncheck the options
> for both: "Tell me if the site I'm visiting is a suspected attack
> site" and "Tell me if the site I'm visiting is a suspected forgery".
>
> We did not need to do this before.

You didn't need to because FF 2 didn't have these facilities. They are
new in FF 3.
> This is all and it is simple, right.  But that does not mean that
> they do not have any trackware/spyware added?  Are there other things
> that we need to look out for?

If you are worried then download the source and look at it. Rebuild it
if you want. That's the ultimate guarantee of free software.
> I am just concerned now that somehow they are imposing their will on
> us and flexing their muscle.
> To those that also use Ubuntu,  Did firefox do the same thing on
>
> Ubuntu? or did it just happen here?

I installed FF 3 on Ubuntu yesterday and can't honestly remember.
> I see this with new AVG 8.0 Free Edition that it adds a Toolbar and it
> tries to tell you which sites are safe/not safe.  That is the price to
> pay if you do not want to pay $$ to Avg to protect you, you can get
> the product, but you will have to help out in a way or another.

What has this got to do with FF? Is AVG free software (i.e. libre, not
just gratis)? BTW your mention of Opera earlier on is also off base.
Opera is gratis but not libre.
> Now the same can be said of firefox.  You can tell firefox, which
> sites are safe and which ones are not, google collects some data about
> which sites you visit and ..., this is the part that makes me
> concerned.  Otherwise, I would not have responded or asked in the
> first place.  We have to read carefully and the fine print that is
> also hard to read.

Once again, if this worries you then disable it. At least Mozilla
clearly states up front what is involved, which cannot be said for a lot
of other crapware out there.

poc

[Antonio Olivares]

--- On Thu, 6/19/08, Patrick O'Callaghan  wrote:
> From: Patrick O'Callaghan 
> Subject: Re: Fedora ain't playin' around w/Firefox 3.
> To: [e-mail]
> Date: Thursday, June 19, 2008, 6:55 AM
> On Wed, 2008-06-18 at 23:57 -0700, Antonio Olivares wrote:
> > > I'm afraid you've lost me completely.
>
> I
> > > don't understand how you can
> > > put this interpretation my comment.
> >
> > No you did not lose me, firefox did :(  I understand
>
> what is going on,
> > Why did we not know ahead of time that they might pull
>
> this kind of
> > trick.  I was told that we do not need to click
>
> anywhere to accept a
> > license, that software provided is here for us, but we
>
> need not accept
> > any license(s) imposed,
>
> Have you installed and used FF 2 via rpm? On Fedora I
> recall clicking on
> a licence agreement on first run. IIRC this is not new (the
> services
> part is, see below).

No, I did not install FF2 vith an rpm, it was installed by default when I installed Fedora many moons ago.
> > This came out as soon as firefox 3.0 was released
> >
> > http://fedoraproject.org/static/firefox/
> >
> > which points to the license
>
> http://fedoraproject.org/static/firefox/website-services-agreement.html
> > indirecty we have to accept or disable the
>
> "services".
> The "services" aren't the browser and thus
>
> are in no way involved
> with the freeness of the software, and 2) if you disagree
> then simply
> disable them.

If I can convince myself to use it, then yes definitely I will do 2)
> > The accompanying version of Mozilla Firefox utilizes
>
> website
> > information services ("Services"), such as
>
> safe-browsing features,
> > which are provided by the Mozilla Corporation and made
>
> available to
> > you under additional terms. By using the Services, you
>
> consent to the
> > terms of the referenced Mozilla Firefox Website
>
> Services Agreement. If
> > you do not agree to these terms, do not use the
>
> Services and disable
> > the Services in Edit > Preferences > Security
>
> and uncheck the options
> > for both: "Tell me if the site I'm visiting
>
> is a suspected attack
> > site" and "Tell me if the site I'm
>
> visiting is a suspected forgery".
> > We did not need to do this before.
>
> You didn't need to because FF 2 didn't have these
> facilities. They are
> new in FF 3.

Great!
> > This is all and it is simple, right.  But that does
>
> not mean that
> > they do not have any trackware/spyware added?  Are
>
> there other things
> > that we need to look out for?
>
> If you are worried then download the source and look at it.
> Rebuild it
> if you want. That's the ultimate guarantee of free
> software.

Just to use firefox, no I do not want to waste time.  I can use konqueror and it works.  No need to agree to anything.
> > I am just concerned now that somehow they are imposing
>
> their will on
> > us and flexing their muscle.
> > To those that also use Ubuntu,  Did firefox do the
>
> same thing on
> > Ubuntu? or did it just happen here?
>
> I installed FF 3 on Ubuntu yesterday and can't honestly
> remember.

Sad, Maybe them (Ubuntu) do not worry their users :), is this version of Firefox rebranded, i.e, Iceweasel from Debian?
> > I see this with new AVG 8.0 Free Edition that it adds
>
> a Toolbar and it
> > tries to tell you which sites are safe/not safe.  That
>
> is the price to
> > pay if you do not want to pay $$ to Avg to protect
>
> you, you can get
> > the product, but you will have to help out in a way or
>
> another.
>
> What has this got to do with FF? Is AVG free software (i.e.
> libre, not
> just gratis)? BTW your mention of Opera earlier on is also
> off base.
> Opera is gratis but not libre.

I just was making a point that to use it, you have to agree to something.  Kind of like Firefox you have to agree with the "services", and if you don't you have to uncheck the boxes that they provided.
> > Now the same can be said of firefox.  You can tell
>
> firefox, which
> > sites are safe and which ones are not, google collects
>
> some data about
> > which sites you visit and ..., this is the part that
>
> makes me
> > concerned.  Otherwise, I would not have responded or
>
> asked in the
> > first place.  We have to read carefully and the fine
>
> print that is
> > also hard to read.
>
> Once again, if this worries you then disable it. At least
> Mozilla
> clearly states up front what is involved, which cannot be
> said for a lot
> of other crapware out there.

Is there any crapware out there that made its way into Linux that I need to be concerned about?
> poc
>
> --

Regards,

Antonio

[Mauriat M]

On Thu, Jun 19, 2008 at 9:55 AM, Patrick O'Callaghan
 wrote:
> > indirecty we have to accept or disable the "services".
> The "services" aren't the browser and thus are in no way involved
>
> with the freeness of the software, and 2) if you disagree then simply
> disable them.

1. The "Services" are built into the browser provided by the company(+
its partners) that produces the browser. They are coupled, no?
2. Perhaps they should not be enabled by default in Fedora?
> > This is all and it is simple, right.  But that does not mean that
> > they do not have any trackware/spyware added?  Are there other things
> > that we need to look out for?
>
> If you are worried then download the source and look at it. Rebuild it
> if you want. That's the ultimate guarantee of free software.

That's unrealistic to the average user don't you think?

Some people believe there is some implicit "trust" in using open
source software. I disagree, the only thing you are guaranteed with
open source software is the agenda of the developers (in all fairness
this most often aligns with the users desires). However seeing that
Mozilla Corp is 85% (?) funded by Google, is it unreasonable to
question their intentions?
> > To those that also use Ubuntu,  Did firefox do the same thing on
> >
> > Ubuntu? or did it just happen here?
>
> I installed FF 3 on Ubuntu yesterday and can't honestly remember.

Well it would have helped if you noticed.
Someone using Ubuntu - I would ask if these "Services" are enabled by default?
> > Now the same can be said of firefox.  You can tell firefox, which
> > sites are safe and which ones are not, google collects some data about
> > which sites you visit and ..., this is the part that makes me
> > concerned.  Otherwise, I would not have responded or asked in the
> > first place.  We have to read carefully and the fine print that is
> > also hard to read.
>
> Once again, if this worries you then disable it. At least Mozilla
> clearly states up front what is involved, which cannot be said for a lot
> of other crapware out there.

Well seeing as Fedora doesn't ship with so-called crapware that
comparison is meaningless.

While I agree some people maybe over reacting - seeing as they can
totally disable this (as I do), but I disagree that everything is
clearly stated. It did seem a bit confusing on this rather unusual
start page, as well as having to accept any agreements.

-Mauriat

[Patrick O'Callaghan]

On Thu, 2008-06-19 at 11:43 -0400, Mauriat wrote:
> On Thu, Jun 19, 2008 at 9:55 AM, Patrick O'Callaghan
>  wrote:
> > > indirecty we have to accept or disable the "services".
> > The "services" aren't the browser and thus are in no way involved
> >
> > with the freeness of the software, and 2) if you disagree then simply
> > disable them.
> The "Services" are built into the browser provided by the company(+
>
> its partners) that produces the browser. They are coupled, no?

The browser provides access to the Services. The Services are not part
of the browser and they can be disabled without losing any browser
funcionality that doesn't relate specifically to them.
> Perhaps they should not be enabled by default in Fedora?

Agreed. My only quibble about all this is that the Services are enabled
by default, but against that you do get asked the question before
proceeding so it's not like it's behind your back. I imagine that
enabling by default is hand-holding mostly for the Windows crowd (I'm
not justifying it, but I can understand the argument).
> > > This is all and it is simple, right.  But that does not mean that
> > > they do not have any trackware/spyware added?  Are there other things
> > > that we need to look out for?
> >
> > If you are worried then download the source and look at it. Rebuild it
> > if you want. That's the ultimate guarantee of free software.
>
> That's unrealistic to the average user don't you think?

As it always is for free software, but you can be sure that if you don't
do it someone else will. The ability to read the source is important not
because the vast majority are going to do it because they aren't. It's
because it keeps the producers honest.
> Some people believe there is some implicit "trust" in using open
> source software. I disagree, the only thing you are guaranteed with
> open source software is the agenda of the developers (in all fairness
> this most often aligns with the users desires). However seeing that
> Mozilla Corp is 85% (?) funded by Google, is it unreasonable to
> question their intentions?

It's entirely reasonable and I don't question it.
> > > To those that also use Ubuntu,  Did firefox do the same thing on
> > >
> > > Ubuntu? or did it just happen here?
> >
> > I installed FF 3 on Ubuntu yesterday and can't honestly remember.
>
> Well it would have helped if you noticed.

I would have if I had thought of it. Since I didn't think of it, I
created a new virtual machine and installed Kubuntu on it. I then
installed FF3 using apt-get. The only difference I can see with the
Fedora version is that Ubuntu doesn't present the Web Services page, but
the options are all enabled exactly as with the Fedora version.
> Someone using Ubuntu - I would ask if these "Services" are enabled by default?
> > > Now the same can be said of firefox.  You can tell firefox, which
> > > sites are safe and which ones are not, google collects some data about
> > > which sites you visit and ..., this is the part that makes me
> > > concerned.  Otherwise, I would not have responded or asked in the
> > > first place.  We have to read carefully and the fine print that is
> > > also hard to read.
> >
> > Once again, if this worries you then disable it. At least Mozilla
> > clearly states up front what is involved, which cannot be said for a lot
> > of other crapware out there.
>
> Well seeing as Fedora doesn't ship with so-called crapware that
> comparison is meaningless.

Antonio mentioned something called AVG, which AFAIK is not a Fedora
package either (maybe I'm wrong), so that's why I brought it up.
> While I agree some people maybe over reacting - seeing as they can
> totally disable this (as I do), but I disagree that everything is
> clearly stated. It did seem a bit confusing on this rather unusual
> start page, as well as having to accept any agreements.

The page in question opens in a tab and you don't have to click on
anything. It's a not a click-through dialogue.

poc

[Ric Moore]

On Thu, 2008-06-19 at 16:34 +0930, Tim wrote:
> Try telling them that when a government decides that they do own you,
> and that you must do this and that...  You must pay us taxes or else,
> you're drafted, you can't leave/enter a country without our say so,
> these are the laws that will be applied to you, etc...  There's a lot of
> situations where you're treated as a possession.

No kiddin', nor do you want to be there, either. Almost 1% of our total
population is incarcerated, probationed or paroled.

Think of it as being a "parenthood" issue. A functional family lives to
meet the needs of their children. A dysfunctional family is where the
children meet the needs of the parents. So, decide where the Power and
Authority lies, and what is done with it ...functional or
dysfunctional.

But, once Power and Authority is assumed, it contains equal and
attendant Responsibilities towards those subjugated. So, if we don't
exercise our Power and Authority, someone else shall by our default. Ric

[Joe Smith]

bruce wrote:
> the issue of the FF security measures (and others) is that the data
> on the URLs you visit might go back to a 3rd party company (IE
> google), which could/would therefore have a track of the sites that
> you visit. ...

You bring up a good point, one that I hadn't thought too much about before.

Except that isn't what's happening--at least according to Moz:

http://www.mozilla.com/en-US/firefox/phishing-protection/
> What information is sent to Mozilla or its partners when Phishing and
> Malware Protection are enabled?
>
> There are two times when Firefox will communicate with Mozilla's
> partners while using Phishing and Malware Protection. The first is
> during the regular updates to the lists of reporting phishing and
> malware sites. No information about you or the sites you visit is
> communicated during list updates. The second is in the event that you
> encounter a reported phishing or malware site. Before blocking the
> site, Firefox will request a double-check to ensure that the reported
> site has not been removed from the list since your last update. In
> both cases, existing cookies you have from google.com, our list
> provider, may also be sent.
>
> The Mozilla Privacy Policy expressly forbids the collection of this
> data by Mozilla or its partners for any purpose other than
> improvement of the Phishing and Malware Protection feature. The
> Google Privacy Policy explains how Google handles user cookies.

This would be easy to verify, either through the FF source, or by 
sniffing the traffic.

If Mozilla was feeding Google browsing history, even under a "we won't 
peek" promise, it would be a huge scandal. Since it would be easy for 
anyone to check if it was happening, I feel pretty sure that it's not 
happening and that I don't even have to trust Google not to peek: they 
don't have the data to peek at.

<Joe

[Mauriat M]

On Fri, Jun 20, 2008 at 11:24 AM, Joe Smith  wrote:
> bruce wrote:
> > the issue of the FF security measures (and others) is that the data
> > on the URLs you visit might go back to a 3rd party company (IE
> > google), which could/would therefore have a track of the sites that
> > you visit. ...
>
> You bring up a good point, one that I hadn't thought too much about before.
>
> Except that isn't what's happening--at least according to Moz:
>
> http://www.mozilla.com/en-US/firefox/phishing-protection/
> > What information is sent to Mozilla or its partners when Phishing and
> > Malware Protection are enabled?
> >
> > There are two times when Firefox will communicate with Mozilla's
> > partners while using Phishing and Malware Protection. The first is
> > during the regular updates to the lists of reporting phishing and
> > malware sites. No information about you or the sites you visit is
> > communicated during list updates. The second is in the event that you
> > encounter a reported phishing or malware site. Before blocking the
> > site, Firefox will request a double-check to ensure that the reported
> > site has not been removed from the list since your last update. In
> > both cases, existing cookies you have from google.com, our list
> > provider, may also be sent.
> >
> > The Mozilla Privacy Policy expressly forbids the collection of this
> > data by Mozilla or its partners for any purpose other than
> > improvement of the Phishing and Malware Protection feature. The
> > Google Privacy Policy explains how Google handles user cookies.
>
> This would be easy to verify, either through the FF source, or by sniffing
> the traffic.
>
> If Mozilla was feeding Google browsing history, even under a "we won't peek"
> promise, it would be a huge scandal. Since it would be easy for anyone to
> check if it was happening, I feel pretty sure that it's not happening and
> that I don't even have to trust Google not to peek: they don't have the data
> to peek at.

Sorry to drag this on, but just to be clear that I am reading this correctly:

If I enable this anti-phishing, then I have automatically downloaded
from Google "lists of reporting phishing and malware sites". Everytime
I happen to visit one of these sites on the list, then automatically
that url AND google cookie information is uploaded back to Google.

So, I can safely say that if I use google (i.e. I have a cookie from
Gmail), then google knows that it was me specifically who visited that
malware site.

So while Google cannot track me for every possible URL, in the least
Google now can track me for every site in these "lists". And Google is
the "list provider". Curious: How do I know what sites are on these
lists?

The Google Privacy Policy which blanket covers cookie usage pretty
much says they can do whatever they want with that information from
the cookie. Curious: Why does Google need a cookie to double check
these lists of for that matter to download these lists?

If I do not use any form of google service (mail, reader, etc.) then I
guess there isn't much info google can connect with cookies, but most
people (myself included) use many google services. While it may not be
too much of a big deal, I think there is enough ambiguity to be
confusing. I do wish though that a completely open non-profit group
would provide this service instead of Google.

-Mauriat

[Bill Crawford]

2008/6/20 Mauriat :
> If I enable this anti-phishing, then I have automatically downloaded
> from Google "lists of reporting phishing and malware sites". Everytime
> I happen to visit one of these sites on the list, then automatically
> that url AND google cookie information is uploaded back to Google.

If you're logged into gmail, for example, you have a cookie for
Google. That will be sent (by design) with any request to google.com
for a page, due to the way the browser is designed; that's not in
itself sinister at all. Google can already track every time you visit
google.com ...
> So, I can safely say that if I use google (i.e. I have a cookie from
> Gmail), then google knows that it was me specifically who visited that
> malware site.

Quite possibly, but we'd have to redesign the browser to not send the
cookie, I suspect. Or there could be a non-google.com domain to
download these lists from, which would sidestep the issue. Someone
want to contact Google and suggest this (as a way to allay the privacy
concerns)?
> So while Google cannot track me for every possible URL, in the least
> Google now can track me for every site in these "lists". And Google is
> the "list provider". Curious: How do I know what sites are on these
> lists?

You could ask them to show you the list?
> The Google Privacy Policy which blanket covers cookie usage pretty
> much says they can do whatever they want with that information from
> the cookie. Curious: Why does Google need a cookie to double check
> these lists of for that matter to download these lists?

It probably doesn't, but if you're downloading from their domain via
HTTP then the cookie will be sent, by the browser, without any
intervention, because that's the way it works.
> If I do not use any form of google service (mail, reader, etc.) then I
> guess there isn't much info google can connect with cookies, but most
> people (myself included) use many google services. While it may not be
> too much of a big deal, I think there is enough ambiguity to be
> confusing. I do wish though that a completely open non-profit group
> would provide this service instead of Google.

Sure, but most non-profit groups will have fewer resources for a start
... even the hosting bandwidth for the list would probably cripple
most people. Think slashdot effect, but a hit for every user that has
this enabled whenever they download the list, plus the hits to check
the urls when they're encountered.