Firefox Sync vs. Xmarks

The "Mozilla Weave" extension was recently brought out of beta testing and renamed Firefox Sync.  I decided to try it out, and compare it to the add-in that I currently use for browser sync, Xmarks. 

First, the similarities:  Both Xmarks and Firefox Sync work basically the same.  You install a browser extension, and your bookmarks, passwords, and open tabs are kept in sync across all your browser instances (each browser on each computer that you use).  This is accomplished by keeping a master copy on a server.  Both Xmarks and Firefox Sync will host your data, or, for advanced users, will allow you to set up and use your own server.

There are a number of differences between the services, however:
First off, Firefox Sync doesn't work with Chrome, MSIE, Safari, or Opera, at least not yet.  Xmarks works in pretty much any browser.   I don't anticipate that this will be the case for too much longer, but it is worth mentioning at this stage.

The major difference between the two services is encryption.  Both services encrypt the data that you send to their servers so that no one can snoop in on the traffic as it's sent over the Internet.  The difference is that Xmarks can read your data on their server, and Firefox Sync cannot.

Firefox Sync encrypts your data on the client side (before it leaves the browser), and therefore its servers have no access to the data that it stores.  The obvious advantage to this approach for the user is that you don't need to worry that they will sell your data, or analyze it, or do anything with it other than store it for you and allow you to retrieve it.  If the servers get hacked, there won't be anything usable on them.  If Mozilla turns evil and wants to snoop on you, they can't: they don't have the decryption key.  You do, and it was never sent to them.

This is not to say that Xmarks' approach is a bad one.  Yes, Xmarks can read your data.  Therefore they can enable you to easily share portions of it.  They can also provide you with easy access to your bookmarks on their website, for those instances when you don't control the browser you're using. They also keep a history of changes, so you can restore from back before you shortsightedly deleted that folder a few months (or even years) ago.

Xmarks also lets you create profiles and manage them from their website, which can contain a subset of your bookmarks, so it's possible to sync certain bookmarks with one group of browsers, but not with others.  This is useful if you have a folder or two that you only need on certain computers, or if you want to have a stripped-down set of bookmarks on your media PC or netbook.

The Xmarks approach isn't all good, though.  They have "discovery" features that I prefer to turn off, since their business model relies on "recommending" links, their extension will alter search results pages by default in order to show you their recommendations.  Still, you can turn them off, which prevents it from being a real negative in my book.

So, what am I going to use going forward?  Both, at least for now.  As you can see from the screenshots above, I have disabled password and tab syncing with Xmarks, and only use that for bookmarks.  This enables me to easily share certain content, use profiles, and manage my bookmarks from the web interface.  There's no reason for me to have my passwords on anyone else's server in an accessible form, or my currently open tabs, for that matter, so I'm using Firefox Sync for that.  Firefox Sync is also set up to sync my History, Preferences, and Settings, which is something that Xmarks can't do.

I'm syncing my bookmarks to Xmarks on my Linux box only (which is always on, and usually has Firefox open), that way it will keep up-to-date with changes that happen over Firefox Sync which is enabled and syncing everything on all of my Firefox browsers.  I'm currently not doing much with Xmarks profiles, but if I want to use them in the future, I can have Xmarks handle bookmarks sync on the browsers with non-default profiles.  I use Firefox by default, but I also occasionally use other browsers, so I have Xmarks set up on non-Mozilla browsers as well.

Google Buzz Reprieve

Yesterday I posted some of my thoughts on Google Buzz on my other blog.  Basically, I decided to disable it, because the way it was set up, it formed a connection between my full name and my online content.

I did some thinking after that post, and I believe there's a way to get what I want out of Google Buzz without discarding my mantle of online anonymity:  remove all the links from my Google Profile, and only post to Google Buzz privately.

That way, there will be a public profile with my name on it, but it won't be publicly associated with anything that I produce online.

It makes the Google Profile much less useful, but it allows me to use the service in the way that I feel comfortable with.

On a related note, here are two posts from LifeHacker that I found very helpful:

• Hide/Remove Google Buzz Updates from Your Gmail Inbox
• Stop Google Buzz From Showing the World Your Contacts

I don't want Google Buzz in my Gmail inbox.  In fact, I would prefer it to be in a separate page, like Google Reader, so the first article was especially helpful.  I don't think I would continue to use it if it kept filling my inbox with other people's imported posts.

Anyway, I'm going to try enabling it again, after I have purged all of my content sources from my Google Profile.  All of my sharing will be private, and my name will show up publicly on other peoples' public posts that I comment on (which is just fine).  If it annoys me (or distracts me too much), I'll turn it off again, but that will be on preference, not on principle.

Facebook's Beacon: It's Easier to Ask Forgiveness Than Permission

Facebook recently released a new feature that it calls Beacon. Basically what this feature does, is when you shop online (or interact with a website in some way, such as posting a review, etc.) at a site that has signed up with Facebook, that site sends information about what you do to Facebook, and Facebook updates all of your friends. The idea being, that the sites that send your information to Facebook get referral business from people learning that you visited their site, and Facebook gets to hone its consumer profile of you, and serve you more relevant ads, and collect better market research about you. (Facebook is big on data mining.) Sounds great, right? In order to placate your privacy concerns, Facebook gives you two opportunities to opt out:

• Before the site sends your information to Facebook, a small pop-up appears in the window. If you don't click it, or if you wait too long (20 seconds), it assumes you have no objection, and sends the data to Facebook.
• The next time you log in to Facebook's site, it presents you with the opportunity to not display the information to your friends. If you don't exercise this opportunity (like, say, you simply go and do what you went to Facebook to do in the first place), the information is added to your feed for all your friends to see.

Do you feel violated yet? You should. First of all, under no circumstances (except in cases where I specifically opt-in) do I want any information whatsoever sent to Facebook about any of my online activities external to Facebook. I do not want them to know my Amazon.com shopping habits, nor do I want them to know that I even have an Amazon.com account, unless I tell them specifically, and then I want explicit control over exactly what information is sent, when, and how. The opportunity to opt-out is unacceptable. This should be an entirely opt-in system. Amazon should not be sending any information to Facebook, until I permit them to do so by telling Amazon that I want the information sent. I have strong objections to Facebook's "it's easier to ask forgiveness than permission" philosophy (think Application invitations/notifications/annoyances), especially when it comes to collecting user data. Any site that tries to send its users' data to Facebook without their express "opt-in" consent will not be getting any of my business, and I intend to tell them exactly why they are not getting my business. Second, automatically displaying a user's online activities for all their friends to see is just a bad idea. We can all imagine situations where this would be a bad thing, from buying gifts, to embarrassing purchases, to information that you simply don't care to broadcast to your entire acquaintance. Now, there are times when I want the whole world to know that I bought a ticket on Fandango, or wrote a review of a product, or joined this-or-that forum, or participated in this-or-that discussion. In fact, the RSS/Atom feed to this blog is automatically posted to my Facebook profile as notes. There are certainly things that I have chosen to publish to all of my Facebook friends, including the information on my public profile. The point is that I took the initiative: I specifically chose to share these things. They are under my control, by my choice. So, what is my course of action? Any website that participates in Beacon, and does not do so with the users' explicit permission and control (i.e., they ask whether or not to contact Facebook in the first place, before Facebook's servers are contacted) will not get any of my business. I will not shop/participate there, and I will in stead send them a short e-mail message telling them exactly why I refuse to do so until they allow the user to control when and if Facebook is contacted. Also, I am using Firefox's AdBlock plug-in to block "facebook.com/beacon/*", which should prevent the servers from being accessed in the first place. If Facebook continues its cavalier attitude towards user privacy, I will delete my account and tell them to remove absolutely all data associated with my account (because, apparently, deleting one's account does not accomplish this).

---

Update: Apparently, Facebook has responded to the consumer backlash regarding their Beacon service, and so they will be requiring a user's "opt-in" consent on a site-by-site basis. However: they are still collecting all of this information for themselves. This is still an unacceptable solution, and is designed to get sites not to prompt a user before sending the information.