The only thing I have problems finding something that works is Google maps. As an Android user there are a few different options but Google did make a damn good maps app.

This sounded harder to do than it was in my experience. I figured the alternatives to their products would be less polished. But I switched to Firefox and honestly prefer it to Chrome. (They allow extensions on Android, meaning adblock, which is a game changer for me.) DDG for search is great. Protonmail for email is fine, etc. There isn&#x27;t much in the Google ecosystem that I miss tbh.

Google consumer software is almost universally an active full frontal attack on you. Stop using it.

Can you test it in Microsoft&#x27;s new Edge browser based on Chromium? I&#x27;m very curious about that. (I don&#x27;t know how to test such a thing myself, sorry :S)

Doesn&#x27;t look like it from my testing of version 81.0.4036.0. But in normal Chrome I do see it.

this is just a test case. It could very well be a much bigger list.

As another commenter pointed out, the list of domains the header is sent to is part of the Chromium codebase: <a href="https:&#x2F;&#x2F;chromium.googlesource.com&#x2F;chromium&#x2F;src&#x2F;+&#x2F;master&#x2F;components&#x2F;variations&#x2F;net&#x2F;variations_http_headers_unittest.cc" rel="nofollow">https:&#x2F;&#x2F;chromium.googlesource.com&#x2F;chromium&#x2F;src&#x2F;+&#x2F;master&#x2F;comp...</a>

That&#x27;s basically saying &quot;even if you opt out, we&#x27;ll still try to track you, just not as much.&quot; Very unpleasant, but then again I&#x27;m not surprised to see this attitude from Google.

They key in the wording is:
&quot;If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy).&quot;&quot;If, statistics are disabled.&quot;In chrome:&#x2F;&#x2F;version you can see the active variations.
It seems to be pretty big numbers to be significant, and so far haven&#x27;t observed duplicates.Since this header is generated server-side, you have only to believe I guess ?
Plus why Doubleclick would need it :)

It is an abuse of Chrome&#x27;s position in the marketplace. Google is using their powerful position to give themselves tracking capabilities that other online players can&#x27;t access. It is a major competitive advantage for Google.

Err yeah, because it adds loads of data that can be used to track you.

Is it because Google&#x27;s webapps will have their own a&#x2F;b tests which use experimental features only available in Chrome perhaps?I mean personally I think they should do client-side feature detection and be back to being standards compliant and not creepy. The only reason why I&#x27;d consider such a flag is because they optimize the payload server-side to return a certain a&#x2F;b test, but even with that they could do the default version first, do feature detection, and then set a session cookie for that domain only that loads the a&#x2F;b test.My other Thought was that they test a feature that is implemented across Google&#x27;s properties, e.g. something having to do with their account management.

Is there a reason for only sending this header to Google web properties and not all domains?

And Google is certainly in a position to disambiguate that uuid to an individual as soon as they login to gmail or any other Google property!

How many people will actually run chrome with a cli flag? It would be pretty impressive if every single person reading this thread did, but it probably won&#x27;t even be that. Most people don&#x27;t even touch their settings.13 bits of entropy is far from a uuid (but to get it to that you need to disable some more settings, which again very few people do), but it&#x27;s still plenty good enough to disambiguate individuals over time.

Don&#x27;t forget that just about any registration requires recaptcha these days

&gt;Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service.Wat? You mean to tell me they can identify you if you log into their service?Am I missing something here? Who cares?

&gt; &gt; Experiments may be further limited by country (determined by your IP address)&gt; They even admit to inspecting the IP address...I don&#x27;t think that sentence admits what you say? Chrome could be determining which experiments to run client-side.Of course, when you visit a Google property, they needs must inspect your IP address to send a response to you, at a minimum. That goes for any site you might choose to visit. The existence of sufficient entropy to personally identify a site visitor is not a state secret. They do not need this chrome experiment seed to identify you, if that&#x27;s a goal.

&gt; This ... header ... will not contain any personally identifiable informationExcept for everything you do on your browser. I&#x27;m so glad I haven&#x27;t used Chrome for almost three years.

Yes, if you have enough bits you can come up with a fingerprint, but that&#x27;s not what PII means.

&gt; They are not including any PII... while creating a new identifier for each installation. 13 bits of entropy probably isn&#x27;t a unique identifier iff you only look at that header in isolation. Combined with at least 24 additional bits[1] of entropy from the IPv4 Source Address field Google receives &gt;=37 bits of entropy, which is almost certainly a unique ID for the browser. Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service.Now this is interesting. If without that 13 bits of entropy, what will Google lost? Is it because of this 13 bits then Google suddenly able to track what they were not? If the IPv4 address, user-agent string, or some other behavior is sufficient to reveal a great deal of stuff, we have a more serious problem than that 13 bits. I agree that 13-bit seed is a concern. But I am wondering if it is a concern per se, or its orchestration with something else. Of course, how&#x2F;whether Google keeps those data also matters.

This is impressive doublespeak.&gt; This ... header ... will not contain any personally identifiable information&gt; a seed number which is randomly selected on first run ... chosen between 0 and 7999 (13 bits of entropy)They are not including any PII... while creating a new identifier for each installation. 13 bits of entropy probably isn&#x27;t a unique identifier iff you only look at that header in isolation. Combined with at least 24 additional bits[1] of entropy from the IPv4 Source Address field Google receives &gt;=37 bits of entropy, which is almost certainly a unique ID for the browser. Linking that browser ID to a personal account is trivial as soon as someone logs in to any Google service.&gt; Experiments may be further limited by country (determined by your IP address)They even admit to inspecting the IP address...&gt; operating system, Chrome version and other parameters....and many additional sources of entropy.[1] why 24 bits instead of 32? The LSB of the address might be zeroed if the packet is affected by Googles faux-&quot;anonymization&quot; feature ( <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=15167059" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=15167059</a> )

So they&#x27;re tracking people and using them as guinea pigs, the lack of respect for users is astounding.

Couldn&#x27;t the Chrome installations receive a request from Google that says &quot;Do you want to try out a new thing?&quot;, and couldn&#x27;t the Chrome installations say yes with a certain probability? The only difference I can see is that the subset of users that are guinea pigs couldn&#x27;t be the same in each test (if Google wanted that the subset is always the same).

So it’s just a poor excuse to send an evercookie.

How does one apply the “--reset-variation-state” flag on a chromebook?

Not endorsing this, but according to <a href="https:&#x2F;&#x2F;www.google.com&#x2F;chrome&#x2F;privacy&#x2F;whitepaper.html#variations" rel="nofollow">https:&#x2F;&#x2F;www.google.com&#x2F;chrome&#x2F;privacy&#x2F;whitepaper.html#variat...</a>&gt; We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations header (X-Client-Data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation.&gt; The variations active for a given installation are determined by a seed number which is randomly selected on first run. If usage statistics and crash reports are disabled, this number is chosen between 0 and 7999 (13 bits of entropy). If you would like to reset your variations seed, run Chrome with the command line flag “--reset-variation-state”. Experiments may be further limited by country (determined by your IP address), operating system, Chrome version and other parameters.

One click while logged into any Google property will be enough for them to permanently associate this GUID with your (shadow) account, they know it, and they know you know it too

According to <a href="https:&#x2F;&#x2F;www.google.com&#x2F;chrome&#x2F;privacy&#x2F;whitepaper.html" rel="nofollow">https:&#x2F;&#x2F;www.google.com&#x2F;chrome&#x2F;privacy&#x2F;whitepaper.html</a>&quot;We want to build features that users want, so a subset of users may get a sneak peek at new functionality being tested before it’s launched to the world at large. A list of field trials that are currently active on your installation of Chrome will be included in all requests sent to Google. This Chrome-Variations header (X-Client-Data) will not contain any personally identifiable information, and will only describe the state of the installation of Chrome itself, including active variations, as well as server-side experiments that may affect the installation.&quot;While this header may not contain personally identifiable information, its presence will make every request by this user far more unique and thus easier to track. I do not see Google saying they won&#x27;t use it to improve their tracking of people.

Fixed. Sorry about that.  Thank you for letting me know!

You may give <a href="https:&#x2F;&#x2F;hackerweb.app" rel="nofollow">https:&#x2F;&#x2F;hackerweb.app</a> a try!
Aside: It is read only though.

This comment is unreadable on mobile. <a href="https:&#x2F;&#x2F;i.imgur.com&#x2F;jFusqw0.png" rel="nofollow">https:&#x2F;&#x2F;i.imgur.com&#x2F;jFusqw0.png</a>Could you please remove the four-space indent? You can wrap each paragraph in * ... * if you want to italic them.

&gt; Now, go to <a href="https:&#x2F;&#x2F;ad.doubleclick.net&#x2F;abc" rel="nofollow">https:&#x2F;&#x2F;ad.doubleclick.net&#x2F;abc</a> - andIt&#x27;s funny that the doubleclick URL was removed by my adblocker and I didn&#x27;t get what the original message was about. Now I can see it, thanks :)

Can Chrome extensions on the new proposed v3 standard remove that outbound request header?

It seems my comment may have been misinterpreted.I meant that this will be rationalized and justified BY GOOGLE.

Doubtlessly, this will be rationalized and justified as being necessary for, and in the best interest of, consumers......but inevitably, it will be used for tracking -- regardless of intent.It might also get Google in trouble. Copying and pasting from the a comment in the OP&#x27;s URL:&gt; Example:
<a href="https:&#x2F;&#x2F;www.youtube.com" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com</a> - in network headers, look for x-client-data&gt; Now, go to <a href="https:&#x2F;&#x2F;ad.doubleclick.net&#x2F;abc" rel="nofollow">https:&#x2F;&#x2F;ad.doubleclick.net&#x2F;abc</a> - and your browser also sends this magic x-client-data.&gt; It&#x27;s a unique ID to track a specific Chrome instance across all Google properties.&gt; Really curious about your opinion, especially after the GDPR explicitly forbidding such tracking. Moreover, it doesn&#x27;t make sense to anonymise user-agent if you have such backdoor.

&gt;It&#x27;s a unique ID to track a specific Chrome instance across all Google properties.&gt;Really curious about your opinion, especially after the GDPR explicitly forbidding such tracking.&gt;Moreover, it doesn&#x27;t make sense to anonymise user-agent if you have such backdoorOh, but it does make sense because with this everyone _but_ google will have a harder time tracking people :\

Not sure why this is being downvoted. It hits the nail on the head. If you are concerned about privacy around advertising then using a browser from the biggest online ad company is short sighted.

In the good old days everyone and their grandmother just sideloaded their malware toolbars with freeware crap like picasa or maps or outright bundled their bloatware with the system like Google still does for Android.

so that you don&#x27;t have to pay royalties to other browsers for being the main search engine.
I mean you have to pay one less. And if you have the most used browser, you save a lot.

Google is a total-spectrum surveillance company. Advertising is a product they offer to their clients. (No, that is not you and me.)

When Chrome was first developed, browsers and the web were relatively slow, and slowing down due to the popularization of Javascript and heavier websites.Google&#x27;s worked on a number of technologies to make the web faster; Chrome (and V8), their own DNS, image and video compression technologies, AMP, HTTP&#x2F;2 (SPDY), HTTP&#x2F;3 (QUIC), webserver plugins (mod_pagespeed), benchmark tooling (Lighthouse), and extensive guides on website speed optimization.The reason is simple; faster internet = faster browsing = more page views = more ad impressions + more behaviour tracking data points. And it&#x27;s a win-win for Google as well, because it earns them goodwill (well, except for AMP); especially at the time Chrome was a breath of fresh air compared to Firefox, and it&#x27;s taken a lot of time and effort just to keep up, with mixed results (to the point where a number of manufacturers have just given up and adopted Chrome&#x27;s renderer).

A better question is to ask why people continue to let themselves be confounded by a browser made by an advertising company.

Quite a lot of reasons. I assume you asked that because you&#x27;re thinking it&#x27;s used to gather information on its users. That could be one of the many reasons. At least initially it was because Mozilla&#x2F;Firefox didn&#x27;t want to adopt a multi-process architecture.In terms of strategic reasons, as a company that depends on people browsing on their websites other reasons are obvious: avoid lock in that could be pushed by third-party browser makers&#x2F;competitors (say IE becomes the most popular and it implements proprietary extensions that work only on their websites[1]), ensure there exists a fast secure browser so that people can keep browsing even if everyone else stops making good browsers out there.[1] Now before you go ahead and point out how Google proposes HTML&#x2F;HTTP features that get implemented in their browsers and on the server side, all such features have public specification and source code, so anyone else could implement them too. This is very different from the IE days of yore, where MS was extending IE through ActiveX. ActiveX was developed in house and they were releasing binary plugins&#x2F;SDKs to develop ActiveX plugins, effectively maintaining full control over it (one would have to develop ActiveX compatible technology from scratch if they wanted it open source, with Chrome all they have to do is fork the source code).

Just ask: why does an advertising company make a browser?

13b, if usage statistics are disabled (not the default). Otherwise, unspecified amount of entropy.

13b plus IP is already huge, but browsers leak so much more than that.

Are you talking about the same thing? Because the identifier above is claimed to have 13b of entropy.  Is there another high entropy identifier?

True. But luckily you actually have a choice. Many opt for DuckDuckGo on Firefox, for instance.

Why do people still dredge up Google&#x27;s historical &quot;don&#x27;t be evil&quot;? It&#x27;s not been applicable for half a decade now, and even in 2015 when it was officially removed from the last company documents, it was already a dead phrase.Google had already cornered the market back in 2012, when it surpassed every other browser, with an absolute majority dominance (&gt;50% market share) achieved way back in 2015.Google has been in control for a long time now.

Don&#x27;t be evil...Until we are deployed enough that users don&#x27;t have a choice...Now that Google has cornered the market for Internet browsing, they&#x27;re using that foothold to change how it works to suit their dominance. This is why they are not concerned about per-site tracking that Google Analytics does, as long as THEY as a company have direct browser-based tracking, they no longer need to provide tracking services to other private companies to know what is trending everywhere. This is also probably why they&#x27;re trying to kill ad blockers and certain browser privacy extensions.... But they won&#x27;t really matter to Google if everything is done at the browser level to begin with from now on. :&#x2F;If they make moves to scale back [free] Google Analytics, which they probably will at some point, it will only highlight this ideal... They may turn to selling their privately collected metrics and qualitative studies to companies after Google Analytics is rendered useless, and then that&#x27;s unadulterated monopolistic profit for them and shareholders...Diabolical.

I fear the factual incorrectness isn&#x27;t mine: the random string used is 13 bits of entropy only if usage statics is disabled, which isn&#x27;t the case by default. By default, it uses an unspecified entropy (and you can bet real dollars that it&#x27;ll be more then 13 bits worth).

Your comment is factually incorrect.13 bits of entropy is not an extremely unique identifier.The first three letters of your first name have more bits of entropy than that. It would be quite a trick to uniquely identify you by the first three letters of your first name.

Reminds me of this.&quot;There’s no point acting all surprised about it. All the planning charts and demolition orders have been on display in your local planning
department in Alpha Centauri for fifty of your Earth years, so you’ve had plenty of time to lodge any formal complaint and it’s far too late to start
making a fuss about it now&quot;

So, an extremely unique identifier for tracking purposes, that effectively no one knows exists, and no one knows can be changed at all?With an obscure white paper that allows Google to claim they comply with the law because &quot;they totally offer a way to change that and they even published that information to the web for anyone to find&quot;?Gotcha.

Honestly, it&#x27;s 2020, even if your technical understanding is so low that you have no idea what a &quot;browser&quot; is, you know that Google will do anything in it&#x27;s impressive power to track down everything you do with legal or illegal means. 
Thanks to Snowden, this is no longer a conspiracy theory. It&#x27;s a fact.Google should be fined for this but they probably won&#x27;t be.

This is another instance that google doesn’t care about users privacy and track without their consent by using chrome installation Id. This probably might be against GDPR, so Chrome installed base in Europe multiplied by per day fine, hopefully runs into a years revenue of google.Another lesson don’t trust for profit companies with privacy protection especially advertising technology company like google with motto like don’t be evil or organize world’s information designed to mislead.

To give them some credit: it&#x27;s not sent when in incognito mode.

Is there a quick summary of what major site&#x2F;features that will be unavailable in Chromium vs. Chrome?  I assume, for example, that &#x27;netflix&#x27; will be prominently on that list.  Thanks.

Is there actually still a performance advantage these days? Would be curious to see some benchmarks.I will say that Gmail&#x2F;Hangouts feels faster in Chrome but that&#x27;s obviously not a fair comparison.

Is there definitive proof that all of the Google stuff is really out of a naked Chromium install? I remember reading stuff about it being impossible to wholly untangle Google&#x27;s stuff from it.

Or just use Ungoogled Chromium, and get the performance advantage of Chrome without the tracking.

Given the purpose of the x-client-data header, I&#x27;ll be shocked if Mozilla doesn&#x27;t have a similar header for feature-enable-identification to do its own tracking of bugs at scale.... and if it doesn&#x27;t, they&#x27;re developing their browser with one hand tied behind their back on quality assurance relative to alternatives.

Has Firefox fixed the bug that made it eat up resources, crank the fans and go nuts on retina MacBook Pros?

Thank you! Someone said that finally. I really tried hard to like Firefox. But it just really doesn&#x27;t replace Chrome for me. Maybe it&#x27;s the ecosystem, extensions, user experience, I&#x27;m not sure but the browsing experience is never really the same on FF.

I used FF for a couple of months. Its heart is noble but it&#x27;s just not as polished as other options.Edit:I didn&#x27;t want to expand because I&#x27;ve already banged that drum too many times on HN.See these other comments of mine:<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22177747" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22177747</a><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22059567" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22059567</a>

As someone who had repeatedly tried to make the jump to Firefox, it _finally_ stuck after quite a few attempts. (CPU and laptop heat issues were problems for a while, now they aren&#x27;t!)I second this; keep trying even if it isn&#x27;t for you after a few times, it was worth it to keep trying, officially Firefoxer :)

The one thing that keeps bugging me is the widgets in Firefox (Ubuntu 18.04) look super-dated -- reminds me of NCSA Mosaic and makes me want to close it. Can they please update their widget library?<a href="https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;JYWKhpu" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;JYWKhpu</a>

I love FF and have gone back you it for the last few months, after using chrome for years, CPU and battery usage is great now, but coincidentally I&#x27;ve been getting these weird hangups on my laptop. 
So yesterday I opened up my activity monitor with 6-7 tabs (including 1 youtube tab in a separate window) open I found FF using ~12gb of memory on my MBP. Then to get a comparison, I opened the exact same tabs in a chrome browser (separate window for youtube and all) and found it using under 1gb of memory. This may be is an exceptional case, but for now I just don&#x27;t have the memory to run FF with docker and dev environments up too.

If you haven&#x27;t used Firefox in a while you should really give it another chance. It has vastly improved in terms of CPU and battery usage. It also has a lot of great privacy-enhancing features like tracking protection enabled by default and extensions like Facebook Container make it trivial to prevent tracking even further.

It&#x27;s not a backdoor! Calling random anti-consumer behavior a backdoor is the privacy-equivalent of Godwin&#x27;s law.

Sure, the general pattern of behaviour is familiar, but I didn&#x27;t know about this specific manifestation, and now I do.  What&#x27;s the use of being so dismissive about specific information on which one can act?

&quot;Backdoor&quot; this, &quot;backdoor&quot; that. Proprietary software company releases proprietary software that allows them to spy on you, how shocking.In which they sacrifice privacy to allow their ad network to target you better.
<a href="https:&#x2F;&#x2F;www.blog.google&#x2F;products&#x2F;chrome&#x2F;building-a-more-private-web&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.blog.google&#x2F;products&#x2F;chrome&#x2F;building-a-more-priv...</a>In which they explicitly track you more under the guise of protecting your privacy.
<a href="https:&#x2F;&#x2F;github.com&#x2F;jkarlin&#x2F;floc" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jkarlin&#x2F;floc</a>For every single claim Google makes about being pro-privacy, their definition of privacy (&quot;data shared between you and Google and no one more&quot;) is implicit.It&#x27;s a surveillance company that makes proprietary software to sell you ads. As soon as you get that into your head, you&#x27;ll be much less shocked.&quot;We personally get to track you&quot; is not a unique stance, and it&#x27;s far from a backdoor. It&#x27;s just another vile move from a surveillance company that&#x27;s pretty explicit that that&#x27;s their goal.

I assume they do get quite a bit of money from Mozilla Foundation, which does.

Mozilla Corporation which makes the browser doesn&#x27;t accept donations.

&gt; their executive compensation rates are way too highJust because they&#x27;re a non-profit doesn&#x27;t mean execs should be paid far below market rates.

Also, Mozilla made donations to political entities in the past

Donations go to Mozilla &quot;the non-profit organization&quot; rather than Mozilla &quot;the corporation&quot;.Mozilla (the corporation) has the typical&#x2F;bad corporate structures and ridiculous executive compensations. Mozilla (the corporation) had the layoffs. Mozilla (the corporation) bought Pocket with money that comes from deals with search engines.That being said, though...&gt; Donate to smaller developers of software you use, it&#x27;ll go a lot further, and they&#x27;ll probably put it to better use!... is still a great point.(Updated this because &quot;Mozilla, Org&quot; and &quot;Mozilla, Inc&quot; were inaccurate)

As long as they keep Firefox available they can waste my money as much as they want. Why should they owe me anything? I am taking their browser.

Better yet, donate to Brave who doesn&#x27;t share the same conflict of interest as Mozilla does with Google, as Google is Mozilla&#x27;s #1 source of income. Best of all you get a browser just as fast, if not faster than Chrome because it&#x27;s Chrome without all the junk.

&gt; Firefox should definitely be used, but donating to Mozilla is a mistake.These seem at odds with each other. If you want Firefox to be used, how do you suggest its development be paid for?

Do you care how Apple pays its executives when you shell out 3-4k on their laptops or 1-2k on their phones? The OP just said that Firefox is a great piece of software available for free, and they deserve to be compensated (in form of donation). Now, I&#x27;m totally on board with you that they waste money, that&#x27;s not even debatable.

Firefox should definitely be used, but donating to Mozilla is a mistake. They waste a lot of it, their executive compensation rates are way too high (especially given that MoCo just laid off employees), and Mozilla still hasn&#x27;t kept up with promises they gave years ago (that Pocket is still proprietary being a notable and depressing example).Donate to smaller developers of software you use, it&#x27;ll go a lot further, and they&#x27;ll probably put it to better use!

I don&#x27;t object. Personally I&#x27;d be happy to pay for Firefox Send, or better still for tech support in self-hosting Firefox Sync and Send.

I&#x27;ve spent a lot of time considering Pocket Premium but the price point is just too high. Maybe if they roll in features from feedly and have a really nice RSS reader.I also hate spending money on news that isn&#x27;t going to journalists.

So I pay for Pocket Premium as it is wholly owned by Mozilla as a way of diversifying their income away from search and donations. I like and use pocket and get something in exchange for my money (which makes me more likely to keep a rolling payment going on). II know it’s not open source, but tbh that doesn’t hugely bother me given that Firefox itself is.Does anyone object to this indirect way of funding Firefox? Does it cause indirect harm by making them prioritise pocket over Firefox?

I agree with the endorsement as a FF&#x2F;TB user. However, I would stop at charity shaming, as there is always a different side to the story.<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22057737" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22057737</a>

Sorry, I can&#x27;t bring myself to trust them after pocket, mr. robot, and of course the time they fired that guy for having a fetish. I might use their browser product if it ever seems like it&#x27;ll be better for my needs but I&#x27;m certainly not giving them money.

We detached this subthread from <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22236328" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22236328</a>.

You should also donate to Mozilla because it’s an insanely good piece o software for the price!

Good point. Although I feel their hyena nature has been visible for a while now and what we are now seeing is hungry hyena :-)

i think their business model is just fine: <a href="https:&#x2F;&#x2F;www.google.co.uk&#x2F;amp&#x2F;s&#x2F;9to5google.com&#x2F;2020&#x2F;02&#x2F;03&#x2F;alphabet-q4-2019-earnings&#x2F;amp&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.google.co.uk&#x2F;amp&#x2F;s&#x2F;9to5google.com&#x2F;2020&#x2F;02&#x2F;03&#x2F;alp...</a>

More and more people are blocking ads. Google’s business model is under threat. They will turn into hyenas in order to survive.

We thought Microsoft was evil because of how they treated their partners and competitors.We didn&#x27;t consider that a greater evil would arise, and all it would take was a disregard of the sanctity of personal privacy.

Well, I&#x27;m an ex employee. Actually nothing has changed inside the company. &quot;Tracking&quot; as you put it isn&#x27;t perceived as evil, it never has been, and for good reasons. The only thing that&#x27;s changed is people&#x27;s perception of the company and - very recent post 2016 political issues aside - that was mostly driven by a sustained campaign by an angry media industry that wanted money (see: link taxes).Firstly, if tracking usage statistics or activity was actually evil then everyone would hate it, desperately try to stop it and have tons of stories about the horrors of it.In fact what Google sees is:1. Web apps are extremely popular although they all keep server side logs that reveal every button click, every message you type, every email you send, every search you do. Users routinely migrate from thick client apps that give great privacy to web apps that give none whatsoever without batting an eye.Hacker News readers in particular should understand this. It&#x27;s overrun with Silicon Valley types who build their entire livelihoods around &quot;let me run this program for you as a service&quot;. There&#x27;s nothing special about Google in this regard. The entire software industry has moved away from privacy in the last 20 years because ...2. Users rarely if ever use privacy features when they&#x27;re provided, even when they&#x27;re heavily promoted. In fact, despite all the noise, hardly anyone cares. For the vast majority convenience wins over privacy every time. But not just convenience, also ...3. Security trumps privacy. People say they like privacy, but they hate getting hacked and tend to blame the service provider if it happens. They have very little patience for explanations of the form &quot;yes this attacker was obviously not you and yes we had enough data to know that, but we didn&#x27;t use any of it ... for your own good!&quot;4. Users can&#x27;t and won&#x27;t give accurate feedback about what they value or what their actual experience of using an app is like. This means A&#x2F;B testing is critical to avoid making bad business decisions. The heavy reliance on experiments and data driven decision making is one reason tech firms tend to steamroller their legacy competitors.Google hasn&#x27;t become evil over time. It&#x27;s been doing A&#x2F;B tests, keeping server logs and writing unused privacy features since the company first began. All that&#x27;s changed is it got big and rich, so people - rightly - started to think about its power more. But the hypocrisy is strong. The world is full of companies collecting and using data for the benefit of their customers. It&#x27;s really only Google and Facebook that get the vitriol.

As an Xoogler, my experience is that one thing changed, and one thing didn&#x27;t.The thing which changed is that Google operates on a much, much larger scale than anything imaginable back in the late 90s when they first started. In 1999, nobody had any inkling about the cloud and SaaS revolution that was about to come. Nobody knew that everything was about to move into web apps and cloud services, which permit and require(?) tracking in ways, and on a scale, no one had thought possible. (Require with a question mark because - ad tracking aside - what little I know of frontend development includes that they need to be able to see certain information, like your browser type, in order to provide effective services.)The thing which didn&#x27;t change is the mindset of the engineers building the services. On average, Googlers tend to be much less concerned with personal privacy than an equally educated consumer, and much more interested in the features and services they can build for themselves and others which happen to require huge amounts of personal information to function. In other words, a typical Googler is more likely to think, &quot;Oooh, having a personal digital assistant is great! If I give Google access to my email inbox, it can suggest tasks, automatically add calendar invites, and do other cool things.&quot;The problems we&#x27;re seeing now come when the engineers working on advertising products have that mindset and access to Google-scale information. They don&#x27;t consider it a problem or a violation because they don&#x27;t mind targeted ads, they don&#x27;t mind giving up their data in exchange for services, and they don&#x27;t (want to) understand why people who aren&#x27;t them might object.It&#x27;s a lot more complicated than that because Google, while the largest and arguably most effective, is not the only player in this game. There are a lot of other corporate and social influences at play. This is just to answer the question about what changed at Google.

When I moved into IT almost 10-15 years ago, Google was one of the companies that I adored (in a kind of naive way, but nevertheless..). 
Working at that company has always been a dream of mine. They had the reputation for hiring the best of the best engineers, with great benefits and work culture.Meanwhile I&#x27;d hate to apply for them. Everything they do in terms of tracking, etc. has become so vile and almost evil that even Microsoft has a better standing among my peers..Would love to hear some insight from ex employees on what changed on the inside of that company, but from the outside it doesn&#x27;t even seem to be the same any more. 
Maybe they&#x27;re just worse at hiding it..

There&#x27;s been more than a few departures at Google recently. You have the profile departures of C-level execs; You&#x27;ve had prominent open source folks leaving projects like Angular. While some attrition is personal circumstance, you have to wonder how much is attributable to the changing identity of Google itself.

&gt; From what I see many techies are now aware and upset, and hardly anyone seems to want to defend Google anymore.From what I&#x27;ve seen is it&#x27;s like it&#x27;s always been: people are upset for a day or two and then continue to not care, and continue to (directly or indirectly) support the evil they were upset about. It&#x27;s incredibly difficult to get even geeks to support a cause if it requires more than pressing a like button or posting a comment.Also, it&#x27;s not like Google&#x27;s wrongdoing are recent news. Anyone remember Google Watch (the site)? People have been warning and predicting things since very long ago, yet the geek crowd never seems to hesitate to embrace the next soon-to-be evil company and their proprietary offering.

&gt; From what I see many techies are now aware and upset, and hardly anyone seems to want to defend Google anymore.To me, the explanation is simpler: people don&#x27;t want to defend Google on HN because they&#x27;ll get downvoted or shouted down because of it.

IIRC it&#x27;s not that long ago that trying to criticize Google here on HN was an exercise in futility.I won&#x27;t say that the current situation is perfect but I can see why. In my view Google had earned the current criticism by hard work:- mismanagement of services people loved to the point were Google always running 3 different more or less incompatible message services, while closing services east and west has become a meme,- shoving other ideas down people&#x27;s throats (hi identity and real name part of Google+)- etc

There is little point trying to correct misinformation about Google on Hacker News anymore, because people will just make up more tomorrow, and it will get hundreds of upvotes if it looks vaguely plausible.So, people who want to dislike Google will find everything they need to confirm their biases here.

&gt;From what I see many techies are now aware and upset, and hardly anyone seems to want to defend Google anymore.Be careful, most of us on HN are part of a very small echo chamber. &quot;What you see&quot; is a small, non-representative portion of &quot;techies&quot;. If it wasn&#x27;t Firefox wouldn&#x27;t be at sub-5% in general usage surveys and AMP would&#x27;ve died years ago.

I haven&#x27;t read this carefully enough to decide exactly how bad it is, but one thing seems clear to me:From what I see many techies are now aware and upset, and hardly anyone seems to want to defend Google anymore.I consider it more likely than not that Google will take some real beatings in the years to come. Kind of like Microsoft was fined by the US and EU, forced to advertise for competing browsers and ridiculed by Apple ads. On a case by case basis I think some of this will be well deserved, some less so, but few outside of employees and shareholders will cry.I also guess a lot of people, including certain owners and many in management hasn&#x27;t deciphered the writing on the wall yet, and in that case it whatever comes next will be surprising.

This seems like a cut-and-dry case of getting caught in monopolistic behavior. The code is right there. The Chrome codebase has special features for Google’s own web properties.I hope all these AGs suing google have some good tech advisors. It’s hard to keep track of all the nefarious things google has been up to over the past decade.

Security flaw? Surely some entity is squatting youtube on some TLD?!If there is a country TLD of X where Google owns google.X but entity Y owns youtube.X then entity Y gets the X-CLIENT-DATA header information. See usage of IsValidHostName() in code.

Actual list: <a href="https:&#x2F;&#x2F;cs.chromium.org&#x2F;chromium&#x2F;src&#x2F;components&#x2F;google&#x2F;core&#x2F;common&#x2F;google_util.cc?q=IsGoogleAssociatedDomainUrl" rel="nofollow">https:&#x2F;&#x2F;cs.chromium.org&#x2F;chromium&#x2F;src&#x2F;components&#x2F;google&#x2F;core&#x2F;...</a>

You can see all the domains they add the header to here: <a href="https:&#x2F;&#x2F;chromium.googlesource.com&#x2F;chromium&#x2F;src&#x2F;+&#x2F;master&#x2F;components&#x2F;variations&#x2F;net&#x2F;variations_http_headers_unittest.cc" rel="nofollow">https:&#x2F;&#x2F;chromium.googlesource.com&#x2F;chromium&#x2F;src&#x2F;+&#x2F;master&#x2F;comp...</a>Previous discussion: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21034849" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21034849</a>

&gt; are they sharing Google accounts, photo albums, or were the photos shared in the same whatsapp group?None of these. They don&#x27;t share any accounts. I don&#x27;t share any account with my father either. Me and my wife use the shared galley feature. The photos that ended up on my fathers phone were shared by me and my wife with each other on whatsapp. I suspect either mine or my wife&#x27;s gallery somehow &quot;leaked&quot; into my fathers even though none of the accounts have any connections AFAICT. Probably we clicked some share button somewhere accidentally but I couldn&#x27;t find any shared galleries on any of our phones.

Yup, that&#x27;s one of the issues you&#x27;ll get with interlinked accounts; in this case, Whatsapp backs up &#x2F; stores photos automatically to your phone&#x27;s photo gallery, and said photo gallery is automatically synchronized with the cloud.I don&#x27;t know exactly what&#x27;s going on with your wife&#x27;s &#x2F; your father-in-law&#x27;s accounts though, are they sharing Google accounts, photo albums, or were the photos shared in the same whatsapp group?

I visited my family a couple of weeks ago and was shocked when my father told me that his phone &#x27;received&#x27; some of our photos. I checked and a huge chunk of whatsapp photos that were backed up by my wife&#x27;s phone had ended up in my dad&#x27;s Google Photos account. I discounted it as my wife accidentally sharing the whatsapp folder with my dad but now I&#x27;m not so sure.

Not everything is a conspiracy. I&#x27;m not a Mozilla employee, have never been one (probably never will be one). Firefox is awesome, fast, and extensible. It&#x27;s my daily driver for all of my machines.

People who push conspiracies without solid evidence should be jailed. Or at least publicly ridiculed.

I work for Mozilla?Huh. I should ask for a pay rise...

I think most people who advocate Firefox are not Mozilla employees. I am for sure not one, I do not even like Mozilla, but they are a much lesser evil compared to Google. And I think having multiple competing browsers is vital for preventing the internet for becoming a walled garden owned by some big corporation.

It&#x27;s not odd at all. It&#x27;s what the folks at Mozilla do. They jump in to every thread to push Firefox and Rust and make people think it&#x27;s more widely used&#x2F;better than it is.

as a defense against antitrust accusations.  microsoft once funded apple too

Isn&#x27;t moz pretty much funded by google?

Could it be because people who like their browser tend to tell others about it? I have absolutely nothing to do with Mozilla but I think the internet would be a better place if more people used Firefox.

I love that Firefox exists and Quantum is an amazing step forward, but Firefox still regularly runs away with gigabytes of RAM and hung worker processes. I have no problem with long-lived Chrome sessions but I need to restart Firefox ~daily. It&#x27;s not bad memories of 10-years ago.

The difference is extremely noticable. So yes.I can open up 2 tabs and Firefox is still loading the page.

&gt; Btw, Firefox is too slow.Ahh, the good ol&#x27; &quot;Firefox is too slow for me to consider it&quot; statement. Is there any evidence that Firefox is slower then Chrome other than old lingering memories of Firefox being slow ten years ago?I have used both Firefox and Chrome and I can&#x27;t subjectively tell that one is significantly faster or slower than the other. To be fair, I only have a handful of extensions and rarely have more than ten tabs open at a time, so my use case may be atypical.

Firefox isn&#x27;t too slow, but you might be talking about how Google optimise their sites for Chrome at the expense of Firefox&#x27;s performance through browser sniffing.

Ahh the good ol HN &quot;stop using Google and start using Firefox&quot; advertisement.It&#x27;s a bit odd to see this in every Google thread.Btw, Firefox is too slow.

No, it&#x27;s what unethical A&#x2F;B testing is.

Isn&#x27;t that what most A&#x2F;B testing is?

Nowadays you are the product even if you pay. (E.g. Subscription news sites including trackers on subscribed users, smartTVs siphoning data etc)

But what about people like me that are paying google (quite a lot actually)?

&gt; If you aren&#x27;t paying for it; you are the product. Simple.This nonsense should belong into Ron Swanson Pyramid of Greatness along with: Capitalism - God&#x27;s way of determining who is smart, and who is poor.

This is a meaningless cliche. Just because users of Google products don&#x27;t pay in cash to use them doesn&#x27;t change the fact that Google has to attract the users to their platform in the first place, and keep them there.

... what?If you aren&#x27;t paying for it; you are the product. Simple.

1. It&#x27;s about the money.2. See 1.

&gt; I don&#x27;t understand why Google and some other tech companies use their users as involuntary, unpaid guinea pigs. No consent. No opt-out.It&#x27;s crazy to me to think about when I was in college (in the mid aughts), I was doing a lot of research into Native American cultures. The amount of releases, paperwork, and other hoops you had to jump through in order to just interview subjects was pretty daunting.The fact we have become involuntary research subjects without any protections as a research subject or easy way to opt out of these companies data collection (which itself is an ongoing form of research) is staggering to thing about.

&gt;Microsoft Vista was a Windows 7 beta, and was &quot;necessary&quot; to basically experiment on the entire Home market, to make the product stable enough for enterprise.That claim is directly contradicted by the fact that there&#x27;s Windows Vista enterprise edition[1]. Vista is also supported for a full 10 years just like 7, which would be strange for something that was supposed to be an &quot;experiment&quot;.[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Windows_Vista_editions" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Windows_Vista_editions</a>

Microsoft Vista was a Windows 7 beta, and was &quot;necessary&quot; to basically experiment on the entire Home market, to make the product stable enough for enterprise.Although Window 7 may have been one of the most complex software deployments in history, needing to support decades of poorly written drivers, while making the system both stable and compatible.

I still do&#x27;nt understand how people ask these questions when it&#x27;s been it since 30 years.

A&#x2F;B testing as implemented in industry is 
-evokes emotional responses eerily similar to those evoked when gaslighting is noticed
-uncompensated
-inconsistent with any semblance of established research ethics
-generally non-consensual
-completely undermines trustI&#x27;m not normally one to make a big deal about this sort of thing, but there is a reason research ethics exist. If one can&#x27;t be trusted to even attempt to follow ethical research protocols, one damn well shouldn&#x27;t be trusted with anything important.Your user&#x27;s time and information is not yours to share. Whether you bury it in the fine print or not.

Google employees are not a random sample of their user base, so such experiments would be meaningless.This is a lazy argument. Google isn&#x27;t some scrappy tech startup where 90% of the employees are programmers. Google has legions of lawyers, mailroom clerks, accountants, travel coordinators, janitors, cafeteria workers, middle managers of all stripes, and so much more. Thousands and thousands of people it can test on without violating the privacy of the general public.

Google employees are not a random sample of their user base, so such experiments would be meaningless.See the fiasco where they broke Terminal Services last year as an example of what can go wrong even when doing experiments on the whole user base.Also consider how to measure the usage of web features Google&#x27;s own websites don&#x27;t use, but are popular on e.g. intranets in Korea.A&#x2F;B testing isn&#x27;t bad, it&#x27;s a good thing. People are notoriously not very good at giving feedback. Experiments and usage statistics let you get the ground truth about what they really value, and what&#x27;s really working.

&gt; Do you understand what licensing is?Nope, no one understands licensing. Which means that arguments grounded on &quot;The user accepted the terms!&quot; has a shaky ethical foundation. Not necessarily a shaky legal foundation, although that wheel seems to be turning.

&gt; No consent. No opt-out.Do you understand what licensing is? That&#x27;s one of the underlying aspects that&#x27;s important with software and why you can&#x27;t treat it like other things you buy. I&#x27;d add it&#x27;s also why things that adopt software-style licencing models are bad too.A company creates a licence with terms and you agree to use the licence under those terms by using the software. The terms are difficult to change unless you have leverage. The only party other than the company is often the regulatory authority. Regulation is limited in the US at best when compared to the EU. If you are from the EU then you probably assume the US works similarly, but most Americans don&#x27;t recognize issues like this one. When they do, it&#x27;s hard to fight the incumbents and make something opt-in, or ban it outright.&gt; What&#x27;s the motivation? Is it simple laziness because they don&#x27;t want to deal with wetware? (the start of your first paragraph applies here too)It&#x27;s fairly simple. The motivation is making correct decisions based on the gold standards of decision-making that some people aspire to. The model is not dissimilar to clinical trials where a treatment is given to some individuals and not to others. The hope is that this form of experimentation removes bias and let&#x27;s the product manager make the best decisions.Based on this thinking it is not possible to test with just Google&#x27;s employees. For many decisions, the bias will be significant, and ultimately the belief is that worse decisions will be made for users.I&#x27;m trying to convey that in as neutral way as possible. I think this can be a useful technique, but I think that there is little discipline and accountability in the wider software world compared to medicine. You have PMs who&#x27;ll routinely just run an A&#x2F;B test longer to collect more data (that&#x27;s better, right?), but invalidate their results, just to please management.If anyone is going to implement this approach then I&#x27;d trust Google to implement it effectively to meet their needs. They do it on a large scale across their products and have many layers of people to ensure it&#x27;s effectively meeting their needs. As stated in the previous paragraph, this doesn&#x27;t mean that other people do it right, or that everyone in Google does it right every time. I&#x27;m sure they&#x27;ve had a fair share of failed experiments.

It&#x27;s because most people don&#x27;t care and if it means that they have a better product at the end of it, they&#x27;ll take the trade.

I don&#x27;t see how this is involuntary. You are choosing to use the productIt&#x27;s involuntary because it&#x27;s not informed consent. Google doesn&#x27;t tell people up front or in any meaningful way that this is happening.That&#x27;s like saying &quot;Oh, that steak was covered in the chef&#x27;s experimental hot sauce that we didn&#x27;t list on the menu? Well, too bad, you chose to come to this restaurant.&quot;

If I use a bunch of older Chromes from portableapps, are those affected by feature testing, provided I&#x27;ve disabled google update but I&#x27;m not behind a firewall?In other words, is feature polling just hard-coded or it is bound to a specific installation?

Bias up front: I work at Google but am not speaking for Google.&gt; involuntary, unpaid guinea pigs.I don&#x27;t see how this is involuntary. You are choosing to use the product. If you choose to use the product, yes, you may be exposed to features that the product has. If you don&#x27;t want to be exposed to those features, the way to opt out is to not use the product.&gt; What&#x27;s the motivation?It lets the company incrementally roll out and test features in real-world network configurations at scale. As far as I know, almost all tech companies do this.Let&#x27;s say you&#x27;re Fapplebooglezon and you have an idea to put kitten emojis on the &quot;Buy Now&quot; button. Before you ship that, you want to make sure that:1. The feature works correctly. It doesn&#x27;t crash or have significant performance problems.2. Users, in aggregate, like the change. No one wants to ship a &quot;New Coke&quot; debacle. It&#x27;s bad for the company (they lose money) and bad for users (they don&#x27;t like the product).3. Your servers and network can handle the consequences of that change. Maybe users will be so excited that they all click &quot;Buy Now&quot; twice as much. You need to make sure your servers don&#x27;t crumble under the increased load.These are reasonable things that benefit both the company and users. So the way features and changes are usually shipped is like:1. The feature is implemented behind some kind of flag. [0]2. &quot;Fishfooding&quot; [1]: The team developing the feature starts using it. This gives you some feedback on &quot;does the feature work correctly&quot; but that&#x27;s about it. The team owns the feature, so they are biased in terms of its usability. And they are on a privileged network and not a large enough population to verify how this affects the distributed system.3. &quot;Dogfooding&quot;: The entire company starts using it. This starts to give you some usability feedback because now people who don&#x27;t have a stake in the feature are being exposed to it. But it&#x27;s still skewed since employees are likely not a representative user population.4. &quot;Canary&quot;: The feature is enabled for a randomly selected small population of external users. Now you start getting feedback on how the feature performs in the wild on real-world machines and networks. The percent of users is kept small enough to not crush the servers in case anything goes awry, but you can start getting some performance data too.5. &quot;A&#x2F;B testing&quot;: Now you start collecting data to see how behavior of users with the feature compares to users without it. You can actually start to get data on whether the feature is good or not.6. Assuming everything looks OK, you start incrementally rolling it out to a larger and larger fraction of users. All the while, you watch the servers to make sure the load is within expected bounds.7. Once you get to 100% of users and things look good, you remove the flag and the feature is now permanently enabled.&gt; Is it simple laziness because they don&#x27;t want to deal with wetware?Google, like most other companies, also does lots of user testing and user surveys too. But that doesn&#x27;t give you insight into the technical side of the question — how the feature impacts the behavior of your distributed system.You may not be aware of this, but this kind of in-the-wild product testing is something almost all businesses do, all the time. Food companies test new products in grocery stores in selected cities [2]. Car manufacturers drive camoflaged prototypes on the road [3]. Restaurant chains tinker with recipes to see how sales are affected. There is absolutely no guarantee that the Coke you&#x27;re drinking today has the same ingredients as the one you had yesterday.You seem to think this is some nefarious scheme, but it&#x27;s just basic marketing. You want to make a thing people like, so you make two things and measure which one people like more. People &quot;opt in&quot; and &quot;consent&quot; by using the product. If you don&#x27;t want to be a &quot;guinea pig&quot; when McDonald&#x27;s changes their French fry recipe, don&#x27;t buy the fries. If you don&#x27;t want to test out new Chrome features, don&#x27;t use Chrome.[0]: <a href="https:&#x2F;&#x2F;martinfowler.com&#x2F;articles&#x2F;feature-toggles.html" rel="nofollow">https:&#x2F;&#x2F;martinfowler.com&#x2F;articles&#x2F;feature-toggles.html</a>[1]: <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;google&#x2F;comments&#x2F;3qpdnn&#x2F;anyone_knows_what_these_dogfood_fishfood_google&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;google&#x2F;comments&#x2F;3qpdnn&#x2F;anyone_knows...</a>[2]: <a href="https:&#x2F;&#x2F;smallbusiness.com&#x2F;product-development&#x2F;best-u-s-cities-to-test-market-a-national-product&#x2F;" rel="nofollow">https:&#x2F;&#x2F;smallbusiness.com&#x2F;product-development&#x2F;best-u-s-citie...</a>[3]: <a href="https:&#x2F;&#x2F;www.cnbc.com&#x2F;2017&#x2F;01&#x2F;20&#x2F;camouflage-the-incognito-way-car-makers-test-drive-new-prototypes.html" rel="nofollow">https:&#x2F;&#x2F;www.cnbc.com&#x2F;2017&#x2F;01&#x2F;20&#x2F;camouflage-the-incognito-way...</a>

Do you get the consent to observe everyone you interact with?

I don&#x27;t understand why Google and some other tech companies use their users as involuntary, unpaid guinea pigs. No consent. No opt-out.What&#x27;s the motivation? Is it simple laziness because they don&#x27;t want to deal with wetware? Is it afraid that if people knew what was happening they wouldn&#x27;t be happy? Google has eighty brazillion employees it can test new features on.

I was fooled by Google for a while, thinking it was less evil than FB. They&#x27;re just a little smarter about their shittiness.

I noticed this when doing work with Puppeteer lately.  I thought about reporting it but didn&#x27;t exactly know what I was looking at.

Safari as well. Almost anything but Chrome. Both Safari and FF are good. Im only using these 2 myself

Some of my front-end colleagues like to tell me that Safari is the new
IE 6. Not in terms of the market domination (that&#x27;s Crhome for you),
but in terms of dragging the front-end back with unimplemented features,
quirks, and bugs. The amount of hacks they have to add just to
support Safari is uncomfortable.

Safari is horrible for HTML5 games. Dealing with all sorts of issues to the point where I&#x27;ve more or less given up and just tell my Safari players to use something else.

I&#x27;m not sure what you mean by forbidden? Chrome and Firefox (and other browsers too) are readily available through the iOS app store.

Safari has the same kind of AdBlock limits that Chrome team wants to implement. Also it&#x27;s kinda behind the curve on iOS when it comes to features.Not to mention the fact that iOS users are forbidden from using any competitive browser, including Firefox.

For non-developers, which is most people, those are non-issues. Safari is excellent for the things that matter: speed, power usage, and integration with the rest of the Apple ecosystem.

Have you tried Safari Developer Previews? It&#x27;s been a while since I&#x27;ve used them myself.[0] <a href="https:&#x2F;&#x2F;developer.apple.com&#x2F;safari&#x2F;download&#x2F;" rel="nofollow">https:&#x2F;&#x2F;developer.apple.com&#x2F;safari&#x2F;download&#x2F;</a>

Safari on iOS is great. Safari on Mac is underwhelming and sucks.My biggest gripe is I can’t update it without updating the entire OS. Also, dev tooling is really bad. God help you if you ever need to unregister a service worker.

+1. Safari is great. Super fast, great on battery life, and has most, if not all, of the extensions you would look for.

I see people recommending Firefox, but I&#x27;ll say that for mac users Safari is a very usable browser too. It&#x27;s quite fast, and to my knowledge is not collecting&#x2F;sharing my personal data with apple. <a href="https:&#x2F;&#x2F;www.apple.com&#x2F;privacy&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.apple.com&#x2F;privacy&#x2F;</a>These days I only use chrome for the g-suite tools that seem to require it to avoid mid-meeting crashes.

There are certain sub-domains that block certain things that keep most of the bad guys at bay, but to some extent yes. This is a fringe case of those activities, but being paranoid is not a bad thing these days, considering the level of red team activity and bad actors probing your network &#x2F; computer &#x2F; devices.Short of putting on the tin foil hat, mind you.

So are you suggesting people should DNS block google.com and gmail.com?

Not sure, but my chrome will send the additional `x-client-data` header even when i&#x27;m on eg. `google.de`

Yes, you can if you are willing to block google.com, android.com and youtube.com.doubleclick.com might not be terrible for most, though.Interesting enough, it does not add headers when accessing a country specific google domain in the EU - such as google.de or google.fr.
Is that GDPR kicking in - with a nod the the brexiteers given that google.co.uk gets these headers... ?

With that said, one can simply filter out these analytics with a c:\Windows\Systems32\Drivers\etc\hosts -&gt; pointing to 0.0.0.0 or PiHole solution (<a href="https:&#x2F;&#x2F;pi-hole.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;pi-hole.net&#x2F;</a>), yes?I mean, this is probably not the holistic solution, but this is why we have a firewall, vpn, antivirus, filters to just keep DNS in check, yes?

&gt; Who&#x27;s going to raise this issue though?I&#x27;m sure there is someone out there who takes these kind of things seriously. Not me. I use firefox for that matter.&gt; And what if they put this in the browser&#x27;s T&amp;C?Then the rest of GDPR applies: a clear message about the browser sending this info has to be shown, explaining why, with who they&#x27;ll share it, the time they will keep this info, plus no auto opt-ins, the possibility of asking Google (or whatever) all the info relative to this ID and the option to cancel all the data, etc.

I thought they needed explicit consent. T&amp;Cs ain&#x27;t that.

Who&#x27;s going to raise this issue though? And what if they put this in the browser&#x27;s T&amp;C?

Me too. Then a breach happens and someone with a straight face tells you: &quot;we take your privacy very seriously&quot;, asking apologies, because the breach used some of your data to push some political campaign or to bother you with spam&#x2F;extortions because that night you were watching some porn.Programmers should stop pushing buggy or incomplete software as is, and start releasing software that works. Otherwise upper levels have an excuse to do all this &quot;experience&quot; telemetry, and we all are smart enough to see the consequences of a data breach.

&gt; This is why I consider the GDPR to be unrealistically broad in its definition of PIIAnd I consider it far too narrow.&gt; If I&#x27;m given a forced choice between &quot;more privacy&quot; and &quot;better software quality&quot; I&#x27;m going to lean towards &quot;better software quality.&quot;Fair enough. I would go for &quot;more privacy&quot;, personally. There is no technical reason why both of our preferences couldn&#x27;t be honored.

This is why I consider the GDPR to be unrealistically broad in its definition of PII; it denies even innocuous feature-mode-distinguishing headers intended to allow for bug-identification of massively-distributed software installs.If I&#x27;m given a forced choice between &quot;more privacy&quot; and &quot;better software quality&quot; I&#x27;m going to lean towards &quot;better software quality.&quot;

PII concept is not the same for everyone&#x2F;everywhere. For GDPR we have:&gt; Article 4(1): ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;If this chrome browser ID is matched against a (for example) google account, then they can track every single person. And that is just a couple of IDs, let alone all the quantity of data they have.It&#x27;s against GDPR to not be clear about this kind of ID. If my browser has an unique ID that is transmitted, then this ID can be coupled with other information to retrieve my identity and behavior, so it should be informed (in the EU).EDIT: TD;LR, hiding behind &quot;there is no PII in that ID&quot; is not enough.

Yes, But they tested Yahoo of all websites to make sure they don&#x27;t send tracking data, and not an unrelated website like wikipedia or archive.org. The only non-google test case too I might add.

FWIW, it looks like that&#x27;s a test case -- it is not part of Chrome itself.  They most likely just wanted an example of a third-party website, and could have used any non-Google site there.

Chrome explicitly having a line [1] of code to not send the `x-client-data` header to Yahoo made me laugh.[1] <a href="https:&#x2F;&#x2F;chromium.googlesource.com&#x2F;chromium&#x2F;src&#x2F;+&#x2F;master&#x2F;components&#x2F;variations&#x2F;net&#x2F;variations_http_headers_unittest.cc#47" rel="nofollow">https:&#x2F;&#x2F;chromium.googlesource.com&#x2F;chromium&#x2F;src&#x2F;+&#x2F;master&#x2F;comp...</a>

What does tor do with it? Maybe pass it along in packet timing intervals, or something ... ;o)

Chromium doesn&#x27;t seem to read that file.

Which (among many other things) can be faked with firejail, if you absolutely have to run Chromium (e.g. for testing):<pre><code> --machine-id
 Spoof id number in &#x2F;etc&#x2F;machine-id file - a new random id is generated inside the sandbox.
 
 Example:
 $ firejail --machine-id</code></pre>

When puppeteer first came out I was nervous to use it for scraping because I could totally see Chrome pulling tricks like this to help recaptcha in identifying the bots. I’m still not convinced they aren’t.

In fairness, the guidelines they reference suggest you do exactly what the comment says they&#x27;re doing (assuming they&#x27;re keying the hash). The guidelines seem explicitly written with the idea that unique identifiers _derived from_ this value are not similarly quarantined, provided that you cannot take the derived value and &quot;reverse&quot; it back to the original identifier.Quoting from <a href="https:&#x2F;&#x2F;www.freedesktop.org&#x2F;software&#x2F;systemd&#x2F;man&#x2F;machine-id.html" rel="nofollow">https:&#x2F;&#x2F;www.freedesktop.org&#x2F;software&#x2F;systemd&#x2F;man&#x2F;machine-id....</a>:This ID uniquely identifies the host. It should be considered &quot;confidential&quot;, and must not be exposed in untrusted environments, in particular on the network. If a stable unique identifier that is tied to the machine is needed for some application, the machine ID or any part of it must not be used directly. Instead the machine ID should be hashed with a cryptographic, keyed hash function, using a fixed, application-specific key. That way the ID will be properly unique, and derived in a constant way from the machine ID but there will be no way to retrieve the original machine ID from the application-specific one.

&gt; which is why we hash it first and then encode it in base64 before transmitting it.This made me chuckle. &quot;As per the rules, we&#x27;ll put on a boxing glove before we punch your lights out&quot;. You wont get privacy, but at least there is some security!

That really is a cynical comment. It almost bothers me more than this header.

&quot;Tracking purposes&quot; is such a weasel word, when we&#x27;re really talking about device management in an enterprise setting, and this code only gets activated if the root&#x2F;administrator user has installed a token file on your computer.

First I thought reading &#x2F;etc&#x2F;machine-id would be expected if Chrome uses D-bus or pulseaudio libraries which depend on D-bus, and &#x2F;etc&#x2F;machine-id is part of D-bus. But no, they really use it for tracking purposes.And in a sick twist they have this comment for it:<pre><code> std::string BrowserDMTokenStorageLinux::InitClientId() {
 &#x2F;&#x2F; The client ID is derived from &#x2F;etc&#x2F;machine-id
 &#x2F;&#x2F; (https:&#x2F;&#x2F;www.freedesktop.org&#x2F;software&#x2F;systemd&#x2F;man&#x2F;machine-id.html). As per
 &#x2F;&#x2F; guidelines, this ID must not be transmitted outside of the machine, which
 &#x2F;&#x2F; is why we hash it first and then encode it in base64 before transmitting
 &#x2F;&#x2F; it.</code></pre>

True, more precisely - 16 bytes, 32 hex characters. Your link is in agreement &quot;The machine ID is usually generated from a random source during system installation or first boot and stays constant for all subsequent boots.&quot; And See <a href="https:&#x2F;&#x2F;wiki.debian.org&#x2F;MachineId" rel="nofollow">https:&#x2F;&#x2F;wiki.debian.org&#x2F;MachineId</a> at least one distro uses it for the DHCP ID.

That&#x27;s not a correct description.* <a href="http:&#x2F;&#x2F;jdebp.uk.&#x2F;Softwares&#x2F;nosh&#x2F;guide&#x2F;commands&#x2F;machine-id.xml" rel="nofollow">http:&#x2F;&#x2F;jdebp.uk.&#x2F;Softwares&#x2F;nosh&#x2F;guide&#x2F;commands&#x2F;machine-id.xm...</a>

If you strace chrome on linux it also picks up &#x2F;etc&#x2F;machine-id (or it did back when I looked), which is a 32 byte randomly generated string which uniquely identifies you and on some systems is used as the DHCP ID across reboots.

Can browser plugins control what headers go out?  If so then a simple browser plugin could put a stop to this.

Got this from google white paper: 
&quot;run Chrome with the command line flag &quot;--reset-variation-state&quot; to reset the value.&quot;I tried this and my &quot;x-client-data&quot; header changed.

It seems like a reasonable time to bring up the reformer project &#x27;ungoogled-chrome&#x27; [1]. I have used it and new versions of Firefox for over 3 years and have seldom had to jump back to `Googlified Chrome.` Do know that installing via `brew` [2] means no - standard browser auto-update. Which in this case, makes sense to me.Aside: It seems to me the realist punk &#x2F; anti-the-man software one can work on is a user respecting browser. I don&#x27;t work on these, but I am very grateful for those out there who do.-------- [1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;Eloston&#x2F;ungoogled-chromium#downloads" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Eloston&#x2F;ungoogled-chromium#downloads</a>- [2]: Brew install via: `brew cask fetch eloston-chromium &amp;&amp; brew cask install eloston-chromium`Enjoy old school browsing with new school development benefits.

This is why I use firefox for personal browsing, and edge for work.Now that Edge &#x2F; Chromium is out of beta, even better.

I use (sometimes&#x2F;often) mitmproxy and remove or change suspect headers. It is also nice to remove all the fb, google and more crap from the html. And much more. It is a lot of work not to break a website. I don&#x27;t know whether I am more trackable or not - this is the &#x27;only browser&#x27; without x-client-data header.

Well when the browser is created by an advertising company...

&gt;This comment was sadly written in Chrome, since I need it for testing...You realize you can have multiple different browsers installed, right?

This it outrageous. Browsers are user-agents, not advertising accelerators. They should hide as much personal identifiable information as possible. This is exactly why using a browser from an advertising company is not a good idea. They use it to improve their service... The lie gets old...This comment was sadly written in Chrome, since I need it for testing...edit: pretty much exactly 10 years ago they already tried their shit with a unique id. We should have learned from that experience.

I dropped chrome a long time ago and switched to Brave. Does Brave have these same issues, considering it uses webkit for it&#x27;s rendering engine? Am I just being paranoid?What a tumor google has become.

Obviously! What else to expect from Google! In the user personalization...

Just in time for their announcement that they plan to abolish third party cookies by 2021. Talk about monopoly.

Doubleclick ads were, originally, what prompted me to seek an adblock extension.I think it was around 2006 that I got the extension for Firefox; Google bought them about a year later.

I can only speak for myself, but myself from 15 years ago would not have cared so strongly about the choice of browser. I believe I was using the newly-ad-less Opera at the time, and new&#x2F;cared little about the company making it.

My 15 year ago self would have taken a double helping of DoubleClick if my only choices were that or Internet Explorer 6.

I always believed that tech-savvy people using Google Chrome are morons. It&#x27;s the perfect blend of Google being evil trying to force it to everyone, the browser being dumbed down to masses so much it&#x27;s missing the most basic features, and I guess privacy concerns too when using browser from advertising company.

Everybody imagine going back 15 years and tell yourself that you&#x27;re using a web browser made by the parent company of DoubleClick. Your 15 year ago self would think you&#x27;re a moron (assuming that 15 years ago you were old enough to know what DoubleClick was).

Google tracks individual users per Chrome installation ID