InformAction Forums

Hello, all, it's the self-admitted Luddite.

And the more I played with F3 (portable), and then the disaster with F4, followed by clearly rushing F5 to market (if F4 wasn't adequately tested before release, why on Earth would anyone believe that F5 was? Surely planned for later this year, *at least*, if not end of year or early next year?), the more the Luddite-ism was validated.

Finally bowed to the inevitable and installed Fx 3.6.18 on the HD. Browsing through the files to see the differences, and discovered the geolocation "feature".
Shocking level of detail.
// if we don't see anything in 5 seconds, kick of one IP geo lookup.
// if we are testing, just hammer this callback so that we are more or less
// always sending data. It doesn't matter if we have an access point or not.

// send our request to a wifi geolocation network provider:

// This is a background load
xhr.mozBackgroundRequest = true;

I don't like things loading or phoning home behind my back.

One Web article said it was "disabled by default". Looked in about:config. Nope -- enabled. Guess it was enabled later, as other Web articles said.

Easy enough to disable: about:config > geo.enabled > double-click to toggle to "false".

But a non-tech friend was absolutely shocked at the revelation. I'll bet most average home users don't know about this, either. And if they did, how to disable. And the dire warnings on about:config....

Any support here for adding "Disable geolocation" checkbox to GUI, maybe to the right of "Forbid WebGL" where there's room? Perhaps a ? "What's this?"
Simple bit of code to add, and a simple FAQ to point to for the "what's this".

Thought it best to discuss this privately, before stirring a hornet's nest on the public boards. If the RFE is not approved, is there any objection to my posting as a regular RFE in "Development", to see if there is public support, or even awareness? Of course, only a small percentage of NS users follow this forum. I don't see the harm in adding the checkbox, and in default-checking it, for that matter.

Cheers all!

It's actually opt-in, notwithstanding the geo.enabled preference value which defaults to true: you get a UI asking if a certain page is allowed to query your position, before any data is sent out or gathered around (quite like NoScript does for scripting): https://bugzilla.mozilla.org/show_bug.cgi?id=491653#c5

In the later versions you actually have an option under Tools|Option|Privacy|Tell sites that I do not want to be tracked. I personally have mine set to permanent private browsing and that option disabled. You can also hard code it through about:config in the older versions.

Giorgio Maone wrote:It's actually opt-in, notwithstanding the geo.enabled preference value which defaults to true: you get a UI asking if a certain page is allowed to query your position, before any data is sent out or gathered around (quite like NoScript does for scripting): https://bugzilla.mozilla.org/show_bug.cgi?id=491653#c5

Yes, I saw that. However, like anything else, it's another opportunity for someone to find a way to circumvent the opt-in and get the info -- much as history, cache, or css attacks -- and they weren't even supposed to be opt-in. (Giorgio, it was you who advised me to get SafeHistory and SafeCache for Fx2, for which I am grateful --proving the point that a lot of things get accessed that aren't "supposed" to be.) I agreed with the posters @ MZ and elsewhere who thought it should default to false.

I still think that even if working properly by displaying the request bar, most users might not know the level of detail. My IP is routinely geolocated by sites offering "local" weather and news, etc., but they're off by anywhere between 30 and 100 miles, which suits me fine. But street address? - which becomes a trivial lookup in various databases to ID the user, or at least, the resident and the owner. I really doubt most users know the level of detail provided, even if it works openly and asks for permission. And no matter what MZ says about "clearing old data", once it's in Google's db, it's there forever.

Also doubt most users would know how to disable it, or that it can be disabled. NS is used by those all across the tech-savvy spectrum. My "non-tech" friend in the OP spent a couple of decades as a sw engr for corp and Gov customers and contractors, but never involving Windows, much less Fx or NS (hence, "non-tech-aware" in these matters). Not everyone has the time to research every new update for every new "feature" and how to disable it. When I installed Fx 3, I received no notice of this new "feature". Discovered it only by idly browsing through the program folder. If a site had popped up the request bar, I'd have been taken quite by surprise.

GµårÐïåñ wrote:In the later versions you actually have an option under Tools|Option|Privacy|Tell sites that I do not want to be tracked. I personally have mine set to permanent private browsing and that option disabled. You can also hard code it through about:config in the older versions.

http://hackademix.net/2010/12/28/x-do-n ... -noscript/

Giorgio wrote:From now on, a web browser with NoScript installed warns every HTTP server it contacts that its user does not want to be tracked, i.e. that his data must not be collected for profiling and persistent identification purposes. I believe this is a safe assumption about the feelings of most if not all NoScript users. As stupid as it may sound (why parties who are interested in tracking you would comply?)

My opinion exactly. And as mentioned, most users won't know about the about:config method, and the dire warnings that pop up when you open it (until you uncheck that box) would scare away many.

I wasn't defending them or saying that it was the right thing to do making people have to do it this way. I was simply giving my input on the existence of some kind of method, even if its painful, to make it happen in the meantime. Also that in the later versions, they might have gotten the clue themselves, as they added a GUI for it and now Giorgio has included a backend for it, no GUI yet but still something. I agree with you that something like this should not be done to begin with, let alone by default, I share your concerns for it.

GµårÐïåñ wrote:I wasn't defending them or saying that it was the right thing to do making people have to do it this way. I was simply giving my input on the existence of some kind of method, even if its painful, to make it happen in the meantime. Also that in the later versions, they might have gotten the clue themselves, as they added a GUI for it and now Giorgio has included a backend for it, no GUI yet but still something. I agree with you that something like this should not be done to begin with, let alone by default, I share your concerns for it.

Does the do-not-track feature even apply to the geolocation "feature"? I don't know. I thought DNT was only for storing cookie and IP info, browsing history, etc.

Your wife hires a private detective to see if you are being unfaithful. You see him once, and say, "I don't want you following me". So, of course, he apologizes, says, "No problem, Sir, I'll never follow you again". Right? hahahahaha. And in our case, we're not even doing anything wrong. It's the "private detectives" - the data-miners and the profile-builders -- who are doing something "wrong", something that is probably prohibited in the EU (maybe that is why Giorgio is less concerned?), whereas as you know, US data privacy laws are less than zero.

It's not that the method of disabling is painful, it's that most users don't even know that any of it exists -- the "feature" or the method of disabling it. Hence the suggestion for a default-checked box in NS GUI. For users who "need" to be geolocated, your smartphone or your car's GPS system can give you directions or find a restaurant nearby, etc. How many are driving around with their desktops, or even their laptops, and *need* this "service"?

Made a keystroke error in splitting and moving this here -- sorry.