4 ms·

> ...the little players (who users weren't worried about anyway) will still lose. The little players not having data is a win in my eyes, because those are mor

> ...the little players (who users weren't worried about anyway) will still lose. The little players not having data is a win in my eyes, because those are more likely to get breached or sell data to the highest bidder. > This only works in Google Chrome Regardless of Firefox abiding by the standards (or doing what Chrome does) or not, this was always going to be the case, and so it isn't that big a deal. > Trackers that offer a widget you can install on your server will win. This is already a thing thanks to the popularity of content blockers like Pi-Hole and uBlockOrigin. Firefox's move here is another nail in the coffin for third-party tracking through third-party servers. At least, first-party tracking with third-party "widgets" means first-party would need to shell out the cost of running that infrastructure. > The web will break. The web always has been :) > Those of us who will stick with Firefox regardless are in for a world of pain, and not a lot of gain. For me, Firefox seems to be making decisions with user's security and privacy in mind, and I see that as a net positive. As a long time user, it is the only reason I use Firefox.

undecisive 6y ago
I agree with pretty much everything you've said :) I guess my gripe is more "Why does the world not work right" than "Firefox has done a stinker here". And I suppose my reaction really should be "How can we work to give Firefox a leg up, while still encouraging it to intentionally fail many of the metrics most people care about". It's a hard battle to fight. Don't suppose Google will implement these things that might hurt their user tracking businesses... yeah?... no?... no. > thanks to the popularity of content blockers like Pi-Hole and uBlockOrigin Unfortunately these are "block these please" which hurts all the big players for the tiny portion of web users that use them. Every time I've ever moved a feature in software I've written from "all except this" to "none except this", it has always failed spectacularly, at least for a few people. The fact that users will get an option to unblock the services they need is encouraging... the fact that they mention that users might see the dialog multiple times for the same service is not. But yes, I will try to be hopeful - and you are right, the fact that Firefox does this kind of thing is a big part of the reason I use them in the first place.
hctaw 6y ago
> Regardless of Firefox abiding by the standards (or doing what Chrome does) or not, this was always going to be the case, and so it isn't that big a deal. It's a huge deal to me as a Firefox user. This is a total anecdote, but the number of websites and apps that are broken in Firefox seem to be on the rise. I try to report bugs when I can but the task is Sisyphean. If Firefox is increasing the friction between web developers and the browser while chrome is lowering it, the problem will only get worse.
- freeopinion 6y ago
  I remember a time when Firefox didn't work for anything that required ActiveX. I remember when Firefox didn't support Flash without a seriously dangerous plugin. I remember when somehow enough people woke up and banded against ActiveX and Flash. It seems popular here to make the argument that "doing what's right" poses an existential threat to the right-doer. The corollary to that argument is that in order to survive you must do what is wrong. For some, it is better to die than to go along with what is wrong. Luckily, it often works out that those who have the courage to do the right thing survive. And when they do the world is often a better place. Don't cave into the naysayers who predict the end of the world. Keep fighting the good fight. "And herein do I exercise myself, to have always a conscience void of offence toward God, and toward men."
  - picks_at_nits 6y ago
    +1 Your handle "freeopinion" reminds me that although people often say "you get what you pay for," just because something's free does not mean that it's worthless.
  - hctaw 6y ago
    Cool story, I still have to use Chrome to talk to my doctor, view my healthcare documents, and get my W2. While Firefox is "doing the right thing," me, the Firefox user, has to use a different browser that doesn't respect my privacy because they don't do what web developers expect. And you can blame web developers, businesses who hire them, or Google for turning the world into this sorry state. But oftentimes the only choice I have as a consumer is what browser I use, and most of the time it's Firefox. But more and more frequently, I can't choose to use Firefox because some functionality is broken on a website I need to visit. The more of this functionality that they break, the more often I need to use Chrome.
jerf 6y ago
"Regardless of Firefox abiding by the standards (or doing what Chrome does) or not, this was always going to be the case, and so it isn't that big a deal." The "dealedness" of this isn't a binary. One may tolerate a small amount while rejecting a large amount. I point this out more to put the idea out there (it's an important concept even in your day-to-day job) than because I disagree with the main thrust being made here; as a uMatrix use I traded security for a functional web a long time ago. Breaking trackers is a feature, not a bug, for me. If that breaks your website, goodbye.
thayne 6y ago
> For me, Firefox seems to be making decisions with user's security and privacy in mind, and I see that as a net positive. As a long time user, it is the only reason I use Firefox. I agree that that is a good thing. However, the more firefox breaks compatibility with sites people use, the harder it will be to regain marketshare. And if Firefox keeps losing marketshare it will have less ability to influence web standards, and could potentially die altogether, which would be bad for privacy and security in the long run. Fortunately, state partitioning isn't enabled by default on Firefox yet (it is part of "strict" ETP), so only people who are ok with it potentially breaking sites will turn it on.
horsawlarway 6y ago
I'm having exactly the opposite thought. As a developer, shit like "Automatic unpartitioning through heuristics" alone is enough that I won't touch this. Full stop. Firefox is now breaking the contract I expected it to fulfill as the user's agent, and it's doing it fucking at random. I happen to live in a space where I do need cross site support (both for cookies and requests) and frankly, between Google's push for SameSite, and now Firefox's selectively breaking the cookie jar, I'm pissed. I'm a bit boggled that we haven't settled on a decent solution to let a site declare how it wants to interact with other sites. This already fucking exists for mobile too, both Android and iOS support an opt-in manifest declared at a /.well-known/ path on the origin in question, why the fuck are the browser vendors so DEAD SET on removing control from the sites themselves in favor of these rushed, half assed, shoddy solutions. Let me declare the sites I want to allow to share my resources. Let me do it at a known location, with a standard manifest, with finer grain control than "Random fucking heuristic" and "strict/lax/none".
- xnzakg 6y ago
  I feel like the entire purpose of this is to take the control from the sites and give it to the users. The site owners obviously do want the cookies to be shared with trackers if they embed them.
  - horsawlarway 6y ago
    I don't mind at all if Firefox wanted to propose a standard way to declare cross site sharing, and then allows the user to overrule my settings as a dev (or even if they pick more restrictive defaults, if user opt in is a problem). There's a standard in place, so arbitrary exceptions and heuristics don't create incredible headaches, and there's a clear path to resolving the issue in support/triage with the customer if they create a rule that does actually break my site's functionality. I do mind, quite a bit, when Firefox essentially goes "Fuck the standards", and starts playing fast and loose with the rules. And I mind for two reasons 1. I expect better from them. I'm old enough to remember how much steam Firefox picked up from IE by just treating a standard as a standard. It was novel, and transformed front-end development in a great way. 2. They are not the market leader, and non-standard, site breaking bullshit only does more to sink their ship, and I desperately want a competitor in the browser ecosystem that is not Google Chrome (or a rebranded chromium port).
jsjohnst 6y ago
> The little players not having data is a win in my eyes, because those are more likely to get breached or sell data to the highest bidder. I somewhat agree with everything but the above. I’ve looked at data on thousands of breaches and have found that size of organization isn’t really correlated with “having better security”.

undecisive 6y ago

I agree with pretty much everything you've said :) I guess my gripe is more "Why does the world not work right" than "Firefox has done a stinker here". And I suppose my reaction really should be "How can we work to give Firefox a leg up, while still encouraging it to intentionally fail many of the metrics most people care about". It's a hard battle to fight. Don't suppose Google will implement these things that might hurt their user tracking businesses... yeah?... no?... no. > thanks to the popularity of content blockers like Pi-Hole and uBlockOrigin Unfortunately these are "block these please" which hurts all the big players for the tiny portion of web users that use them. Every time I've ever moved a feature in software I've written from "all except this" to "none except this", it has always failed spectacularly, at least for a few people. The fact that users will get an option to unblock the services they need is encouraging... the fact that they mention that users might see the dialog multiple times for the same service is not. But yes, I will try to be hopeful - and you are right, the fact that Firefox does this kind of thing is a big part of the reason I use them in the first place.

hctaw 6y ago

> Regardless of Firefox abiding by the standards (or doing what Chrome does) or not, this was always going to be the case, and so it isn't that big a deal. It's a huge deal to me as a Firefox user. This is a total anecdote, but the number of websites and apps that are broken in Firefox seem to be on the rise. I try to report bugs when I can but the task is Sisyphean. If Firefox is increasing the friction between web developers and the browser while chrome is lowering it, the problem will only get worse.

freeopinion 6y ago
I remember a time when Firefox didn't work for anything that required ActiveX. I remember when Firefox didn't support Flash without a seriously dangerous plugin. I remember when somehow enough people woke up and banded against ActiveX and Flash. It seems popular here to make the argument that "doing what's right" poses an existential threat to the right-doer. The corollary to that argument is that in order to survive you must do what is wrong. For some, it is better to die than to go along with what is wrong. Luckily, it often works out that those who have the courage to do the right thing survive. And when they do the world is often a better place. Don't cave into the naysayers who predict the end of the world. Keep fighting the good fight. "And herein do I exercise myself, to have always a conscience void of offence toward God, and toward men."
- picks_at_nits 6y ago
  +1 Your handle "freeopinion" reminds me that although people often say "you get what you pay for," just because something's free does not mean that it's worthless.
- hctaw 6y ago
  Cool story, I still have to use Chrome to talk to my doctor, view my healthcare documents, and get my W2. While Firefox is "doing the right thing," me, the Firefox user, has to use a different browser that doesn't respect my privacy because they don't do what web developers expect. And you can blame web developers, businesses who hire them, or Google for turning the world into this sorry state. But oftentimes the only choice I have as a consumer is what browser I use, and most of the time it's Firefox. But more and more frequently, I can't choose to use Firefox because some functionality is broken on a website I need to visit. The more of this functionality that they break, the more often I need to use Chrome.

jerf 6y ago

"Regardless of Firefox abiding by the standards (or doing what Chrome does) or not, this was always going to be the case, and so it isn't that big a deal." The "dealedness" of this isn't a binary. One may tolerate a small amount while rejecting a large amount. I point this out more to put the idea out there (it's an important concept even in your day-to-day job) than because I disagree with the main thrust being made here; as a uMatrix use I traded security for a functional web a long time ago. Breaking trackers is a feature, not a bug, for me. If that breaks your website, goodbye.

thayne 6y ago

> For me, Firefox seems to be making decisions with user's security and privacy in mind, and I see that as a net positive. As a long time user, it is the only reason I use Firefox. I agree that that is a good thing. However, the more firefox breaks compatibility with sites people use, the harder it will be to regain marketshare. And if Firefox keeps losing marketshare it will have less ability to influence web standards, and could potentially die altogether, which would be bad for privacy and security in the long run. Fortunately, state partitioning isn't enabled by default on Firefox yet (it is part of "strict" ETP), so only people who are ok with it potentially breaking sites will turn it on.

horsawlarway 6y ago

I'm having exactly the opposite thought. As a developer, shit like "Automatic unpartitioning through heuristics" alone is enough that I won't touch this. Full stop. Firefox is now breaking the contract I expected it to fulfill as the user's agent, and it's doing it fucking at random. I happen to live in a space where I do need cross site support (both for cookies and requests) and frankly, between Google's push for SameSite, and now Firefox's selectively breaking the cookie jar, I'm pissed. I'm a bit boggled that we haven't settled on a decent solution to let a site declare how it wants to interact with other sites. This already fucking exists for mobile too, both Android and iOS support an opt-in manifest declared at a /.well-known/ path on the origin in question, why the fuck are the browser vendors so DEAD SET on removing control from the sites themselves in favor of these rushed, half assed, shoddy solutions. Let me declare the sites I want to allow to share my resources. Let me do it at a known location, with a standard manifest, with finer grain control than "Random fucking heuristic" and "strict/lax/none".

xnzakg 6y ago
I feel like the entire purpose of this is to take the control from the sites and give it to the users. The site owners obviously do want the cookies to be shared with trackers if they embed them.
- horsawlarway 6y ago
  I don't mind at all if Firefox wanted to propose a standard way to declare cross site sharing, and then allows the user to overrule my settings as a dev (or even if they pick more restrictive defaults, if user opt in is a problem). There's a standard in place, so arbitrary exceptions and heuristics don't create incredible headaches, and there's a clear path to resolving the issue in support/triage with the customer if they create a rule that does actually break my site's functionality. I do mind, quite a bit, when Firefox essentially goes "Fuck the standards", and starts playing fast and loose with the rules. And I mind for two reasons 1. I expect better from them. I'm old enough to remember how much steam Firefox picked up from IE by just treating a standard as a standard. It was novel, and transformed front-end development in a great way. 2. They are not the market leader, and non-standard, site breaking bullshit only does more to sink their ship, and I desperately want a competitor in the browser ecosystem that is not Google Chrome (or a rebranded chromium port).

jsjohnst 6y ago

> The little players not having data is a win in my eyes, because those are more likely to get breached or sell data to the highest bidder. I somewhat agree with everything but the above. I’ve looked at data on thousands of breaches and have found that size of organization isn’t really correlated with “having better security”.