On 2022-03-20 05:09, Andy Burnelli wrote:
> dillinger wrote:
>
>> So, the download link can be identified, but not you or me
>
> Thanks for also running the test.
> What matters appears to be _how_ you download it.

No.

What matters is the actual download file at the server(s), and the file
can be of course different if the link used is different, because it can
be a slightly different version.

Changing the link can not generate a different hash, because the file
itself has to be changed.

Now, if you compare what are the contents of the two downloads you did,
that could be more interesting, but for what you claim in the subject to
be true, each time you download the file from the same URL the results
would have to be different.

--
Cheers, Carlos.

On 2022-03-19 18:49, Andy Burnelli wrote:
> Dated March 17th 2022
> Each Firefox download has a unique identifier
> <https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/>
>
>
> This data will allow us to correlate telemetry IDs with download tokens and
> Google Analytics IDs. This will allow us to track which installs result
> from
> which downloads to determine the answers to questions like, "Why do we see
> so many installs per day, but not that many downloads per day?"
>
> According to Mozilla's description, the identifier is used to analyze
> downloading and installation trends among other things.
>
> The feature is powered by Telemetry in Firefox and it applies to all
> Firefox channels.

One common problem with open source software providers is to know how
many installs are made. Nothing nefarious about this knowledge; think of
the typical claim that there are, say, a million Windows installation,
and only a thousand Linux installations, so we do not need to provide
for Linux users because they basically do not exist. Windows users can
be tracked (in theory) by the number of sales - and each sale could be
tied easily to an individual, and the products can be serialized.

For example, as Linux user, I download Firefox not from Mozilla
organization, but as part of the Linux DVD I download and install.
Mozilla can not know if they have a million users (with this
distribution) or just one. And they certainly would like to know how
many users they have, it means more resources coming to pay their
developers, and they fired a lot this past year or two. The distribution
would also like to know how many installations are made, and it benefits
users if they can prove we are many people in order to get support from
companies and web sites that think that everybody uses Chrome or Edge or
Windows.

You can always disable telemetry in the configuration, anyway. No need
to get up in smoke about Mozilla people.

--
Cheers, Carlos.

Carlos E.R. wrote:

>> What matters appears to be _how_ you download it.
>
> No.
>
> What matters is the actual download file at the server(s), and the file
> can be of course different if the link used is different, because it can
> be a slightly different version.

Um, er... but that's the same thing I said.

The presumption (at the moment anyway), is
a. If you use a full offline web installer you don't get the dl token
<https://i.postimg.cc/gjyTq90w/telemetry01.jpg>
b. If you use the web stub, you do get the dl token
<https://i.postimg.cc/Pr28VPp5/my-dltoken.gif>
c. According to my brief skim of Mozilla docs, the "update" also gets it
> Changing the link can not generate a different hash, because the file
> itself has to be changed.

But that's the same thing I said, isn't it?

> Now, if you compare what are the contents of the two downloads you did,
> that could be more interesting, but for what you claim in the subject to
> be true, each time you download the file from the same URL the results
> would have to be different.

I'm not sure how many extra arguments you bought this week but what I said
above in the {a,b,c} section appears to be what we're each testing for the
team.

So far Stan, Paul, and I tested the downloads for the dl token to be
purposefully helpful to assist the team in answering the questions.

What were the results of your helpful tests of your dl token Carlos?
--
Every post to Usenet should strive to add additional value for the team.

On 2022-03-23 02:50, Andy Burnelli wrote:
> Carlos E.R. wrote:
>
>>> What matters appears to be _how_ you download it.
>>
>> No.
>>
>> What matters is the actual download file at the server(s), and the
>> file can be of course different if the link used is different, because
>> it can be a slightly different version.
>
> Um, er... but that's the same thing I said.
>
> The presumption (at the moment anyway), is a. If you use a full offline
> web installer you don't get the dl token
>   <https://i.postimg.cc/gjyTq90w/telemetry01.jpg>
> b. If you use the web stub, you do get the dl token
>   <https://i.postimg.cc/Pr28VPp5/my-dltoken.gif>
> c. According to my brief skim of Mozilla docs, the "update" also gets it
>
>> Changing the link can not generate a different hash, because the file
>> itself has to be changed.
>
> But that's the same thing I said, isn't it?

Then it was not clear to me.

>> Now, if you compare what are the contents of the two downloads you
>> did, that could be more interesting, but for what you claim in the
>> subject to be true, each time you download the file from the same URL
>> the results would have to be different.
>
> I'm not sure how many extra arguments you bought this week but what I said
> above in the {a,b,c} section appears to be what we're each testing for the
> team.
>
> So far Stan, Paul, and I tested the downloads for the dl token to be
> purposefully helpful to assist the team in answering the questions.
>
> What were the results of your helpful tests of your dl token Carlos?

I am not going to test this, it would be cumbersome for me to try. It is
you making the claim, so I'm just suggesting how to try ;-)

--
Cheers, Carlos.

Carlos E.R. wrote:

>> But that's the same thing I said, isn't it?
>
> Then it was not clear to me.

Hi Carlos,

Thanks for understanding that, based on Paul's kind-hearted helpful tests,
it "appears" to be the case that _how_ you get the Firefox installer onto
your machine (and how you _update_ Firefox at a later date) apparently
determines _which_ executable you get, only _some_ of which have the dl
token.

We "think" the simplest way to know if you have the dl token in your
particular instance of Firefox is to use Paul's purposefully helpful URI:
<about:telemetry#environment-data-tab_settings_search=dl>

We might even have to tell folks not to use the surrounding angle brackets.

>> What were the results of your helpful tests of your dl token Carlos?
>
> I am not going to test this, it would be cumbersome for me to try. It is
> you making the claim, so I'm just suggesting how to try ;-)

Having been on Usenet for decades, it's my assessment fewer than 1/2 of
1/10th of 1 percent of the people who post are purposefully helpful.

For those rare good-hearted purposefully helpful people, this URI works:
<about:telemetry#environment-data-tab_settings_search=dl>

We might have to advise folks not to use the surrounding angle brackets.
--
Every post to Usenet should strive to add additional value for the team.