Even if they don't (currently) feel that they need them, they could be compelled by law enforcement to retain logs and forbidden from revealing this fact publicly. Or their network could get infiltrated.

How do you propose to prevent a user from leaking their home IP address to Mozilla without undermining the ability to: * Download the browser * implement a safe browsing mechanism * support automatic updates (which are a critical security feature)

If the updates are signed, then there is no danger in downloading them from a third party mirror. As for finding a mirror, Mozilla could put locations as TXT records in the DNS.

There would still be the problem that someone would have a log of your IP address downloading a Firefox update, but it wouldn't be Mozilla. Also, with a big enough list of mirrors, across 100 different jurisdictions, the probability of any given mirror being subpoenaed and having data on any given user is very small.

As for how to bootstrap the whole thing by letting the user securely download Firefox in the first place, that is of course difficult, but it should be an infinitesimally rare event compared to checking for browser updates. A user could therefore take special care to use public Wi-Fi when doing the initial download.

What part of Mozilla's behavior makes you assume they don't? It's easy to come up with some dubious internal justification to store IPs (like to determine where to focus internationalization efforts).

It's not even internal justification, it's just plainly the default for practically any web server that does logging. You would have to go out of your way to disable it.

Not logging IPs or establishing controls on it is table-stakes for anyone doing anything serious about privacy.

Yeah, kind of like not embedding each download with a unique ID. Oops...

Yeah, it definitely is. But that doesn't automatically mean they actually did it.

"Best practices" are moot unless they're implemented, and since the default is to log these things, then something (even a blog post from them claiming it's been done) has to exist to show it's there and doing the right thing.