17:07:08 <therube> https://www.ghacks.net/2022/03/17/each-firefox-download-has-a-unique-identifier/
17:07:24 <therube> how low will they go.  only their hair dresser knows for shure.
17:07:27 <therube> sure.
17:07:37 <njsg> let me guess, for telemetry?
17:16:15 <therube> not quite sure how/what FF downloads "by default", as in like how the stub downloader plays in, but from a page like:
17:16:17 <therube> https://www.mozilla.org/en-US/firefox/installer-help/?channel=release&installer_lang=en-US
17:16:18 <therube> sure enough you'll get a full installer, with a unique hash each time. now that's smart.
17:18:25 <therube> this part - in the binary .exe will be different:
17:18:27 <therube> __MOZCUSTOM__:campaign%3D%2528not%2Bset%2529%26content%3D%2528not%2Bset%2529%26dltoken%3D50fa1ecf-0f37-487e-8e24-b63ea7c8a077%26experiment%3D%2528not%2Bset%2529%26medium%3D%2528direct%2529%26source%3D%2528other%2529%26ua%3Dfirefox%26variation%3D%2528not%2Bset%2529
17:18:29 <therube> & more specifically this:
17:18:31 <therube> dltoken%3D50fa1ecf-0f37-487e-8e24-b63ea7c8a077
17:20:29 <therube> presumably the digital certificates of the downloads are valid.  & if one were to base "correctness" (validity) on that basis, & yet the hashes vary, i.e. the actual file content, to me, that is simply moronic.
17:23:29 <therube> 7-zip, while saying that the "archive" is correct, also says there is a checksum error:
17:23:31 <therube> 7-Zip 21.07 (x64) : Copyright (c) 1999-2021
17:23:32 <therube> Scanning the drive for archives:
17:23:34 <therube> 1 file, 53527184 bytes (52 MiB)
17:23:35 <therube> Testing archive: Firefox Setup 98.0.1.exe
17:23:37 <therube> WARNINGS:
17:23:39 <therube> Checksum error
17:26:37 <therube> you MUST answer the default browser dialog (i.e., you cannot not answer, ESC, out of it)
17:26:39 <therube> https://postimg.cc/QVqDR7B7
17:27:22 <therube> "and privacy every time you browse."
17:27:58 <therube> yep, we're attaching a GUID to your ass.  that's private!  well at least, most consider it a private part.
17:30:01 <therube> hah! you cannot even close that window/dialog from the (Windows) taskbar.  it does not close.  (you have to actually answer or kill it.)
17:30:36 <tomman> How do you generate unique .EXEs without tampering with the signature?
17:30:49 <tomman> signing EXEs on the fly doesn't sound too viable for me
17:32:05 <therube> and! and it also, during the install, automatically pinned itself to the Windows taskbar (or some such)
17:32:17 <therube> what a crock-a-doodle-do!
17:32:31 <tomman> the solution is obvious
17:32:37 <therube> not to mention installing the "maintenance service"
17:32:42 <tomman> let's raise Mozilla's CEO salary again!
17:33:06 <therube> not to mention removing .ru search engines from itself (in the name of political correctness, i suppose)
17:34:51 <therube> appear these id's are in the "header" part of the file, so outside of the purview of the digital signature, i suppose.  but if something like that can be done, then could not "anything" i.e. malware just as well be put there, & if that is the case, just what is the point of this digital certificate?