Firefox will be adding some kind of ads to the new tab screen. They call it "suggested content" or something like that, but you can be sure it will really be primarily about ads. The classic open source thing is that if someone includes an antifeature then you can just remove that part of the code, recompile and continue. I had never actually read the source code for Firefox, so this was also an interesting exercise.

While reading the code I soon ran into things related to telemetry. There's a python script in the build directory which sends telemetry data unencrypted to a static IP address. I don't want anything reporting back to the mothership, so the question then became one of whether I could remove the telemetry code, as an exercise to see what's involved in doing that.

What do I mean by telemetry, you may ask. The word is normally associated with NASA and space probes sending back images from other worlds, but in this context it means monitoring what users are doing with some software and then sending that data back to some central location for analysis.

The telemetry code which I initially found turned out to be just one small corner of a much bigger thing. The main telemetry code is complex and it's difficult to determine where it pushes out exfiltrated data onto the wire. There appears to be a substantial ecosystem around spying on Firefox users, in which arbitrary queries can be performed and bespoke requests for data can be submitted for approval. The level of monitoring by what is known as "telemetry probes" seems really detailed. It's as if the software is a sophisticated instrumentation system for monitoring users with some web browsing features also appended.

If you then start reading the associated mailing lists and bug tracker entries it gets into a new level of creepyness, in which users appear to be being talked about as if they were "inventory". A quote from here:

"It is my understanding that our advertisement clients will rely heavily on our inventory projections, to the extend of budgeting campaigns based on the number we provide. If our projections are wildly wrong, clients will under or over budget, which will corrode industry trust in Mozilla brand"

And then some stuff about experimenting on users:

"Users can only run with a single experiment at a time. We have other experiments pending, and so it really is not practical to ship this as an experiment and operate on large samples of the beta population."

On the mailing list they talk about Firefox as a "data platform", with strange surveys. It's a side of Firefox that I'd never encountered before, because I was only coming at it from a user angle. I'm not entirely sure how to feel about it, but it seems resolutely within the creepy corporate surveillance arena. Previously I had known at a high level from their financial statements that Mozilla Corporation sells user behavior data to search engines (that probably means Google primarily), but seeing how the sausage is made is another matter. It's a bit like the difference between knowling at a high level that the NSA is spying on everyone and then later reading the Snowden documents containing the gory details of how they're doing it and being a lot more disturbed.

So if you're a Firefox user what should you do about this? First of all don't panic. The derivatives of Firefox, such as the Tor browser, have all this telemetry stuff deactivated. If you are using a vanilla Firefox browser then block telemetry.mozilla.org on your firewall and maybe also add it to /etc/hosts to make sure it doesn't resolve. If you're doing software development on the Firefox code then block the IP address 52.88.27.118 where it sends build information to.