Initiative

reddit上看到的。老外回复真有耐心和专业水准啊

Did you know Firefox and Thunderbird phone home once a day, even with updates disabled and can remotely disable any addon or plugin they wish?

I found this out a few days after I decided to start using Thunderbird and created strict firewall rules as a precaution.

I noticed that Thunderbird would, for no reason at all, sometimes try to contact a server over SSL. I looked up the ip address 63.245.213.32 and found it belonged to Mozilla.

On researching the problem further I found that the cause of the connection is a feature that cannot be disabled from any menu, only the about:config configuration page.

Look up extensions.blocklist.enabled for more information. It's present in Firefox also and is enabled even if all the options are disabled through the menus.

What this tells Mozilla each day:

* IP address
* What time you were using the product
* What exact version number you were using
* If you are using any of the plugins or addons sent in the disabled list
* Total number of active users of their software
This may not be that significant to most people but I think you should have a right to know when an application makes this sort of outbound connection without clearly informing you.

Here is a list of all the unrequested connections Firefox makes: http://support.mozilla.com/fr/kb/Firefox+makes+unrequested+connections

and that's excluding addons. Many addons will phone home each time Firefox or Thunderbird are launched.

Please don't downmod this item without reason as I think it's important people have a chance to see what kind of policies Mozilla follows and what kind of database they could be building in the same way people should at least be aware of the potential for misuse if Google has access to your email and search queries.

原文作者prelim

这里简单翻译下：

大家知不知道，Firefox和Thunderbird每天都要跟Mozilla服务器通信一次？即使你把所有更新和插件更新选项禁止？

我也是前几天才发现的。我刚装上Thunderbird，我有严格的防火墙规则。我发现Thunderbird，在没有任何提示没有任何征兆的情况下，某些时候会通过SSL连接一个服务器。IP是63.245.213.32，是Mozilla的服务器。

后来我发现这个“功能”选项在任何菜单里都找8到，除非手工修改about:config配置

键值是：extensions.blocklist.enabled

这个选项在Firefox里也存在，同样也不可能从菜单里禁用掉。。。

每天客户端向Mozilla发送这些信息：

* IP地址
* 使用了他们的产品多长时间
* 你的客户端版本
* 你的插件列表，和禁用的插件列表
* 软件所有活跃用户的数量

这些信息不重要，但是重要的是，一个软件在外传任何数据的时候，应该明确通知用户

这里有一个网页，展示了Firefox的“非请求连接”列表http://support.mozilla.com/fr/kb/Firefox+makes+unrequested+connections

这还不包括各种插件内建的升级机制。很多插件在启动的时候要和自己的服务器联系一次。

所以啊，下载任何软件/插件，要找够足够的理由先。重要的是Mozilla应该让用户知道他们的政策是什么？他们在数据库保存了哪些重要信息？

est评论：
1. 他妈的FF fans不要来给老子扫盲plug-in、add-on和extension的区别。反正都不是什么好东西。你以为被插得越多还真他妈越爽啊？老子衷心祝愿FF像以前IE那样插件泛滥致死。
2. Mozilla也不是什么好鸟。
3. 欢迎健康开源软件
4. 老外非常重视隐私。非常！其实隐私很重要～～～至少可以防止社工和肉搜
5. Mozilla的EULA里隐约提到了这件事情。真阴险啊。。。。其实我们装软件都不怎么看协议，都一路I Agree的说～～
6. 如果微软在IE干了这个事情。。。。哼哼。。。吼吼～～～～
7. 从官方Extensions.blocklist.enabled说明来看，这个功能貌似是防止恶意插件的