| Summary: | mozilla-firefox: mozilla google-search rls and moz:distributionID are privacy issues | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | niogic <niogic> |
| Component: | Current packages | Assignee: | Mozilla Gentoo Team <mozilla> |
| Status: | RESOLVED WONTFIX | ||
| Severity: | normal | ||
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
This feels a little over-paranoid. There are lots of ways others (including Google) could find out what distro you use, ripping stuff out here is really just an unneeded a drop in the bucket imo. So -1 from me. mozilla? your way to paranoid. not gonna change in main tree If you say the world "hey i'm using gentoo" (in the useragent.vendor), then they will fingerprint you. Because it restricts a lot the pool of configurations and very little entropy is enough to identify you univocally. If you have a look in mozilla bugzilla there are a lot of bugs about fingerprinting. They don't RESOLVE INVALID. This bug is distribution-level so it should stay here. When firefox-4.0 rolls out you will get your wish, I am not gonna make a change to the tree before then, any then only reason is due to fact that id has been drop'd completely from upstream. To all who said I was paranoid :-P |
This bug was originally discovered in debian (bugs.debian.org/405370). That bug is obsolete (because google parameters changed), but the problem is the same. I'm wondering: why do "/usr/portage/eclass/mozcoreconf-2.eclass" contain mozconfig_annotate gentoo [...] --with-distribution-id=org.gentoo That eclass applies to both xulrunner and mozilla-firefox. Maybe there could be a "privacy" useflag to let the user choose if to expose it's distro name (like apache has its ServerTokens config option). For example that information is used in "/usr/lib/mozilla-firefox/searchplugins/google.xml" <Param name="rls" value="{moz:distributionID}:{moz:locale}:{moz:official}"/> That line could be completely dropped. I personally suggest to remove --with-distribution-id flag and to create a patch to the default google.xml search plugin.