9 ms·

Will Firefox stop copying Chrome's features that are hostile to power users at some point?

by devcpp 7y ago

ghaff 7y ago
Probably not. There's a clear conflict between what (some) power users want and what the best/safest choices are for the general public. And, in general, mainstream platforms like Firefox should default to what's best for the general public. (Yes, you could have bypass mechanisms but backdoors like that are more or less asking for trouble.) See also Apple. Added: It's not clear to me how "hostile to power users" this particular change is. But my general statement still applies.
- ptero 7y ago
  It is not clear what is best for the general public. You can aim for the "safest" choice, which seems to be what you are advocating. If so, it needs to be said explicitly and the implications of functionality reduction (that safety increases always brings) openly discussed and debated. The model of claiming "we will do what is best for users" with a freedom to replace "best" by "X" has been thoroughly compromised by googles and facebooks of this world. We need to be explicit about goals and tradeoffs. Not attacking your post, just arguing for being clear and honest on goals of non-commercial software. My 2c.
  - ghaff 7y ago
    Yes, I'd argue "safest" is usually the best default for the general public. My reasoning is that a bit more fine-grained control, performance, choice, etc. doesn't have much upside for most people whereas getting compromised can be a very big downside. Perhaps Firefox hasn't been very clear on its tradeoffs but Apple, for example, seems to have been IMO. (Yes, it tends to be wrapped in marketing rather than tech speak but I think they've been pretty consistent about their priorities.)
    - ptero 7y ago
      I personally have no objections (usually not even strong feelings) to setting defaults, as long as that's what they are -- default choices that users can change if they see fit. But an option that cannot be changed is not a default choice -- it is a hard coded design decision. My 2c.
      - ghaff 7y ago
        Firefox is open source. AFAIK you could always run a fork with your preferred behaviors. Same applies to speculative execution mitigations in Linux.
        ptero 7y ago
        And so is, for example, Android. But due to some (shady) tactics, a successful fork of either is impossible for a small group. Saying to a hungry kid in a favela "you are free to get rich" is technically correct, but ignores practicalities. You could argue that Mozilla is either a shepherd (making best decisions for most users and that's it; take it or leave it) or a partner (listen to users and try to implement features they want) but you cannot eat your cake and have it too.
        jtgeibel 7y ago
        What makes it nearly impossible to fork Firefox? Mozilla already distributes an unbranded "fork" that allows unigned extensions. It's just a build flag away. What potentially shady tactics am I missing?
        kbenson 7y ago
        What, specifically, is the feature you think Firefox is removing the option to have, that you think people want? I suspect that if we drill down to this point, you'll find the feature is still available with a trivial amount of work, or on the outside case it's the more specific thing they actually talked about, it's not a trivial amount of work, but it's just not automated for enterprise installs anymore. So, what's this feature you're referring to?
  - maxerickson 7y ago
    They have those evil metrics about what users are doing. If 1% of users are getting exposed to malicious software by a feature and 0.0001% of users are using it, it's a little more clear than you say. I've made both of those numbers up, but I think it's likely enough that very few end users are depending on the ability of other software to silently inject plugins.
    - gpvos 7y ago
      > metrics With the caveat that power users are probably the ones to have turned off metrics. Mozilla is probably aware of it, but it's still hard to compensate for that.
  - Digit-Al 7y ago
    I do agree with you to a point. I do think they have a difficult task trying to balance protecting people from their own ignorance and catering to power users who know exactly what they are doing and desire more freedom. An option that just occurred to me is to be able to start Firefox with a special flag that would give access to some extra options to allow actions that reduce security - such as sideloading for example. To help prevent innocent users being coerced into starting Firefox with that flag it could be something like "Firefox.exe -pleasehackme". Power users would know what the flag is for but even the most naive user might hesitate to start Firefox using a command inviting themselves to be hacked :-) Probably a stupid idea, but just putting it out there.
    - ptero 7y ago
      That is a fine idea. We can make Firefox as safe as they want at startup. Just keep it as a default option -- something power users can turn off and do not make this a hardcoded choice "because those users turning it off may not know what are they doing". Inform, not restrict. My 2c.
      - floatingatoll 7y ago
        They seem to agree, approximately: https://news.ycombinator.com/item?id=21418786 https://news.ycombinator.com/item?id=21418786
    - mastax 7y ago
      So now the malware edits the firefox shortcut to start it with that argument and then installs its malicious addons. That doesn't help at all.
      - apostacy 7y ago
        Yeah, exactly. Malware could also just delete vanilla firefox and replace it with the developer edition. Just overlay ads over the browser window itself. Or anything else really. Trying to protect against hostile code already running on the same computer as the browser is futile. At best, it should warn the user if suspicious modifications were made. And it comes at such a high cost for such a narrow measure of protection.
- grawprog 7y ago
  >what the best/safest choices are for the general public. Sometimes I think tech people forget 'the general public' is made up of adults capable of learning and making their own choices if educated properly on matters.
  - ghaff 7y ago
    Sure. Most adults can learn lots of things. Most of us only care enough and have time enough to educate ourselves on a very small subset of the tools we use and tasks we perform on a daily basis. By and large, I trust the tools I use out of the box to be safe (subject to what common sense typical functional adults would be expected to have). It is often reasonable to provide the option to use tools in ways that are less safe. Sometimes that's unavoidable. You can certainly use a chainsaw unsafely although I also think it's perfectly reasonable for chainsaw manufacturers to not provide easy ways to defeat the various safety mechanisms that are built in.
    - pbhjpbhj 7y ago
      So you'd only buy a chainsaw with a codepad entry where you have to contact the manufacturer and ask them 'can I cut this log'; ooh, so much safer! But where does that leave the people who been buying that brand of chainsaw for a decade or more and don't want the restrictions? Just remove the codepad, well yes, so long as the manufacturer doesn't weld it on ... oh, and they just decided to weld it on. Such safety, much wow.
  - acdha 7y ago
    How many topics do you have time and energy to be “educated properly” on? What are the odds that learning about the issue would lead to a different outcome than what Mozilla is doing? Firefox's openness means it attracts a lot of attention from people who have relatively uncommon preferences but believe they speak for a large group of users and that group tends to portray every disagreement as a betrayal rather than reasoned decisions.
    - hqcsfvwn 7y ago
- apostacy 7y ago
  Do you really consider being able to provision your own profile a backdoor? I do it all the time. Do you think that Apple is a good example of what to do? Having a single entity control what extensions you get to install is not what is best for the general public. Personally, I think that Firefox should be the more flexible extensible alternative to Chrome. It should be to Chrome as Linux is to Windows. They need to stop chasing the demographic that is going to hurt themselves.
  - ghaff 7y ago
    >Do you think that Apple is a good example of what to do? For certain purposes and audiences, yes.
- vbezhenar 7y ago
  In the end Firefox will anger power users and general public still will use Chrome because they can't resist when it's advertised from every corner (and, honestly, just works better).
Endy 7y ago
No, I doubt they will. And thank you for voicing these concerns.
zozbot234 7y ago
Power users should probably use unbranded versions of the browser that don't have these issues. AIUI, such versions are widely available, even from Mozilla themselves.
- rndgermandude 7y ago
  >don't have these issues What issues does this change create?
- pseudalopex 7y ago
  Do unbranded builds get automatic updates now?
rndgermandude 7y ago
What exactly is hostile to power users here?
apostacy 7y ago
Can we place bets onto how long it will take for Firefox to copy Google's malware-like Keystone Agent updater?[1] Then they will have another way to wantonly steamroll over users. But Google is actually benefiting from doing this kind of evil stuff, while Firefox is not. [1]: https://news.ycombinator.com/item?id=21065504 https://news.ycombinator.com/item?id=21065504

Will Firefox stop copying Chrome's features that are hostile to power users at some point?

by devcpp 7y ago

Will Firefox stop copying Chrome's features that are hostile to power users at some point?

Probably not. There's a clear conflict between what (some) power users want and what the best/safest choices are for the general public. And, in general, mainstream platforms like Firefox should default to what's best for the general public. (Yes, you could have bypass mechanisms but backdoors like that are more or less asking for trouble.) See also Apple. Added: It's not clear to me how "hostile to power users" this particular change is. But my general statement still applies.

ptero 7y ago
It is not clear what is best for the general public. You can aim for the "safest" choice, which seems to be what you are advocating. If so, it needs to be said explicitly and the implications of functionality reduction (that safety increases always brings) openly discussed and debated. The model of claiming "we will do what is best for users" with a freedom to replace "best" by "X" has been thoroughly compromised by googles and facebooks of this world. We need to be explicit about goals and tradeoffs. Not attacking your post, just arguing for being clear and honest on goals of non-commercial software. My 2c.
- ghaff 7y ago
  Yes, I'd argue "safest" is usually the best default for the general public. My reasoning is that a bit more fine-grained control, performance, choice, etc. doesn't have much upside for most people whereas getting compromised can be a very big downside. Perhaps Firefox hasn't been very clear on its tradeoffs but Apple, for example, seems to have been IMO. (Yes, it tends to be wrapped in marketing rather than tech speak but I think they've been pretty consistent about their priorities.)
  - ptero 7y ago
    I personally have no objections (usually not even strong feelings) to setting defaults, as long as that's what they are -- default choices that users can change if they see fit. But an option that cannot be changed is not a default choice -- it is a hard coded design decision. My 2c.
    - ghaff 7y ago
      Firefox is open source. AFAIK you could always run a fork with your preferred behaviors. Same applies to speculative execution mitigations in Linux.
      - ptero 7y ago
        And so is, for example, Android. But due to some (shady) tactics, a successful fork of either is impossible for a small group. Saying to a hungry kid in a favela "you are free to get rich" is technically correct, but ignores practicalities. You could argue that Mozilla is either a shepherd (making best decisions for most users and that's it; take it or leave it) or a partner (listen to users and try to implement features they want) but you cannot eat your cake and have it too.
        jtgeibel 7y ago
        What makes it nearly impossible to fork Firefox? Mozilla already distributes an unbranded "fork" that allows unigned extensions. It's just a build flag away. What potentially shady tactics am I missing?
        kbenson 7y ago
        What, specifically, is the feature you think Firefox is removing the option to have, that you think people want? I suspect that if we drill down to this point, you'll find the feature is still available with a trivial amount of work, or on the outside case it's the more specific thing they actually talked about, it's not a trivial amount of work, but it's just not automated for enterprise installs anymore. So, what's this feature you're referring to?
- maxerickson 7y ago
  They have those evil metrics about what users are doing. If 1% of users are getting exposed to malicious software by a feature and 0.0001% of users are using it, it's a little more clear than you say. I've made both of those numbers up, but I think it's likely enough that very few end users are depending on the ability of other software to silently inject plugins.
  - gpvos 7y ago
    > metrics With the caveat that power users are probably the ones to have turned off metrics. Mozilla is probably aware of it, but it's still hard to compensate for that.
- Digit-Al 7y ago
  I do agree with you to a point. I do think they have a difficult task trying to balance protecting people from their own ignorance and catering to power users who know exactly what they are doing and desire more freedom. An option that just occurred to me is to be able to start Firefox with a special flag that would give access to some extra options to allow actions that reduce security - such as sideloading for example. To help prevent innocent users being coerced into starting Firefox with that flag it could be something like "Firefox.exe -pleasehackme". Power users would know what the flag is for but even the most naive user might hesitate to start Firefox using a command inviting themselves to be hacked :-) Probably a stupid idea, but just putting it out there.
  - ptero 7y ago
    That is a fine idea. We can make Firefox as safe as they want at startup. Just keep it as a default option -- something power users can turn off and do not make this a hardcoded choice "because those users turning it off may not know what are they doing". Inform, not restrict. My 2c.
    - floatingatoll 7y ago
      They seem to agree, approximately: https://news.ycombinator.com/item?id=21418786 https://news.ycombinator.com/item?id=21418786
  - mastax 7y ago
    So now the malware edits the firefox shortcut to start it with that argument and then installs its malicious addons. That doesn't help at all.
    - apostacy 7y ago
      Yeah, exactly. Malware could also just delete vanilla firefox and replace it with the developer edition. Just overlay ads over the browser window itself. Or anything else really. Trying to protect against hostile code already running on the same computer as the browser is futile. At best, it should warn the user if suspicious modifications were made. And it comes at such a high cost for such a narrow measure of protection.
grawprog 7y ago
>what the best/safest choices are for the general public. Sometimes I think tech people forget 'the general public' is made up of adults capable of learning and making their own choices if educated properly on matters.
- ghaff 7y ago
  Sure. Most adults can learn lots of things. Most of us only care enough and have time enough to educate ourselves on a very small subset of the tools we use and tasks we perform on a daily basis. By and large, I trust the tools I use out of the box to be safe (subject to what common sense typical functional adults would be expected to have). It is often reasonable to provide the option to use tools in ways that are less safe. Sometimes that's unavoidable. You can certainly use a chainsaw unsafely although I also think it's perfectly reasonable for chainsaw manufacturers to not provide easy ways to defeat the various safety mechanisms that are built in.
  - pbhjpbhj 7y ago
    So you'd only buy a chainsaw with a codepad entry where you have to contact the manufacturer and ask them 'can I cut this log'; ooh, so much safer! But where does that leave the people who been buying that brand of chainsaw for a decade or more and don't want the restrictions? Just remove the codepad, well yes, so long as the manufacturer doesn't weld it on ... oh, and they just decided to weld it on. Such safety, much wow.
- acdha 7y ago
  How many topics do you have time and energy to be “educated properly” on? What are the odds that learning about the issue would lead to a different outcome than what Mozilla is doing? Firefox's openness means it attracts a lot of attention from people who have relatively uncommon preferences but believe they speak for a large group of users and that group tends to portray every disagreement as a betrayal rather than reasoned decisions.
  - hqcsfvwn 7y ago
apostacy 7y ago
Do you really consider being able to provision your own profile a backdoor? I do it all the time. Do you think that Apple is a good example of what to do? Having a single entity control what extensions you get to install is not what is best for the general public. Personally, I think that Firefox should be the more flexible extensible alternative to Chrome. It should be to Chrome as Linux is to Windows. They need to stop chasing the demographic that is going to hurt themselves.
- ghaff 7y ago
  >Do you think that Apple is a good example of what to do? For certain purposes and audiences, yes.
vbezhenar 7y ago
In the end Firefox will anger power users and general public still will use Chrome because they can't resist when it's advertised from every corner (and, honestly, just works better).

Endy 7y ago

No, I doubt they will. And thank you for voicing these concerns.

zozbot234 7y ago

Power users should probably use unbranded versions of the browser that don't have these issues. AIUI, such versions are widely available, even from Mozilla themselves.

rndgermandude 7y ago
>don't have these issues What issues does this change create?
pseudalopex 7y ago
Do unbranded builds get automatic updates now?

rndgermandude 7y ago

What exactly is hostile to power users here?

apostacy 7y ago

Can we place bets onto how long it will take for Firefox to copy Google's malware-like Keystone Agent updater?[1] Then they will have another way to wantonly steamroll over users. But Google is actually benefiting from doing this kind of evil stuff, while Firefox is not. [1]: https://news.ycombinator.com/item?id=21065504 https://news.ycombinator.com/item?id=21065504