6 ms·

Brave has a long way to go to build real trust. Too many reckless stuff: hijacking links, suspicious url-rewriting, crypto-token stunts, forgetting to communica

by gidam 6y ago

Brave has a long way to go to build real trust. Too many reckless stuff: hijacking links, suspicious url-rewriting, crypto-token stunts, forgetting to communicate with users about serious privacy leaks with their faulty TOR window... also it looks like they care about privacy only in their PR brochures.

lrae 6y ago
Also zero transparency for users and publishers. On one browser installation I stopped getting payouts, reached out to them via reddit (like they asked for) and provided all the information they asked for: ghosted. I'm also a publisher, for weeks now I can't login and it seems like I'm not getting payouts anymore either. Never got any mail about it. Sent them an email about it February 23rd, no answer so far. If I'd have to guess, the one client somehow got blacklisted maybe because I used too many Brave installations and they think they're fraudulent? (Though I only used like 5, Brave & Brave Beta each on a desktop & laptop, then on another desktop just one installation. Also, I still get payouts for the other installations.) Or it's just another one of the bugs that eats payouts and users' BATs. Publisher account I even have less of an idea, it's totally fine, teen-rated gaming websites with a couple of thousand organic (search traffic) uniques/month. I did sent BAT from my unconnected Browsers (you only can connect a maximum of 4 browsers to a wallet, ever) to my site to tip myself. As far as I know that isn't against the TOS either (even makes them more money because they douple dip). But, even if they don't suspend you without any notice, it's completely non-transparent as a publisher too. You get zero statistics, just a bundled payout each month. I'd never use them like this as a publisher for bigger sites, pretty sure I mailed them about that too in the past and also did not get any reply.
junon 6y ago
Also the fact that they boast "we blocked X many ads" directly above a Brave-owned embedded avertisement directly in the browser itself. Scummy stuff.
- smbullet 6y ago
  That's a feature, not a bug. The point of the Brave ad blocker is to (optionally) replace unethical ads with ethical ones so you can compensate the content creators you browse. How is this scummy?
  - drusepth 6y ago
    Because it removes a revenue stream for many sites and small businesses (oftentimes the most important or only revenue stream) and replaces it with a setup where Brave happily benefits from holding that income in escrow until you can convince them to hand over whatever percent they think is fair to share... in their crypto. That is, of course, assuming they don't ghost you, which seems like a common complaint among publishers. The company's got a long list of shady practices and "mistakes" where they haven't paid creators and/or screwed over users for their own profits. Even if you give them the benefit of the doubt and assume they just constantly make honest mistakes, no other browser dominates the news every other month with so many privacy scandals.
    - ketamine__ 6y ago
      Ads completely overwhelm my mobile and mac book pro. Sorry?
    - AndroidKitKat 6y ago
      While it is sort of a hostage situation (websites must sign up for Brave rewards to get a payout), would you rather websites get no revenue at all? If the prevailing mentality of most web users is to install their adblocker of choice, I see Brave as an approach that tries to cater to everyone.
      - bscphil 6y ago
        > If the prevailing mentality of most web users is to install their adblocker of choice This is not the prevailing mentality of "most" web users, in fact it's not even possible for it to be because the most common user agent is Chrome on Android. Brave is an attempt to funnel as many oblivious users as possible into a pipeline where native ads are automatically blocked, for the precise purpose of being able to execute the "hostage situation" that you mention. The premise that the target market for Brave is the tiny group of people who are willing to look at one kind of ad (provided by Brave) but not a different kind of ad (provided by the publisher) so that the publisher can get a fraction of what they would have received from the native ad (if they opt into a crypto scam) is laughable. Most people who want to block ads just want to block all ads.
- jeanofthedead 6y ago
  You can easily remove cards, top sites, adblock counts, and advertisements from the Brave home page. It's customizable.
  - willis936 6y ago
    Their point is not that there is an adblock counter, but that brave injects ads on their own homepage to inflate the apparent usefulness of their browser. It's similar to labeling a casino a buffet and saying you don't need to gamble.
  - stjohnswarts 6y ago
    I guess some just want everything for free. It's not like they're hiding it. It's right in front of your face. It's just some are too lazy to turn it off or simply don't care.
techrat 6y ago
You forgot one. Whitelisting cross-site trackers from sites like Facebook and Twitter.
- BrendanEich 6y ago
  All browsers allow those social widgets by default, because blocking them breaks too many pages. Brave is not alone in this regard. We're working on a better default that blocks but replaces with mock objects bundled with Brave's binary that activate the real widget on click. In the mean time, you can turn them off and risk broken pages via "Social media blocking" settings.
JacobSuperslav 6y ago
Also doesn't help that Brave's CEO is a right wing guy (asked to leave Mozilla because of his radical comments) and a COVID conspiracy theorist "masks don't do anything"
- danans 6y ago
  I'm not sure what the relevance of it either way. Even though he left Mozilla due to his public opposition to marriage-equality for same-sex couples, to connect that with his current company seems like a stretch. And even being an anti-masker in the COVID19 context, however misguided that might be, isn't really related to the browser's functionality.
  - bscphil 6y ago
    Maybe some people just feel gross participating in a project to make this guy richer?
    - danans 6y ago
      I can understand that. But while I disagree fundamentally with the Brave CEO's political stances on the aforementioned topics, I just don't see a strong connection between those and his product, which is politically neutral from a left/right perspective. It's nothing like, for example, the clear connections between the political views of the execs/funders of Parler and Gab and their their products.
      - bscphil 6y ago
        I agree, there are certainly heaps of odious people who have created great things in technology. And I don't even mind using these things if the creator is not making money off of them. (There's an open source project whose author says, on the project's webpage, that he dislikes the idea of anyone who doesn't embrace white nationalism using the software. I don't think he was joking.) I suppose I'm reading JacobSuperslav's comment differently than you. You're reading them as saying (in response to a comment listing reasons not to trust Brave) "here are some additional reasons not to trust Brave", which you're saying doesn't follow. I agree that it doesn't follow, but I'm reading their comment as saying "Brave's untrustworthiness is one reason not to use it, but another reason why you might not want to use it is..."
kdtsh 6y ago
Agreed. I just don’t see why I should not continue to use Firefox, Multi-Account Containers, and DuckDuckGo, and just use Tor Browser if I want to use TOR. The whole crypto thing in Brave especially rubs me the wrong way, it feels like a Ponzi scheme.
- permo-w 6y ago
  It’s chrome with extra features, and not owned by Google. You don’t have to participate in their crypto nonsense, and you don’t have to use their TOR browser It’s basically just convenient
BrendanEich 6y ago
The only recklessness in sight is your comment repeating a complete fabrication. We never "hijacked links". See https://news.ycombinator.com/item?id=25841456 https://news.ycombinator.com/item?id=25841456. The Tor leak was already fixed in Brave Nightly when independently discovered. We were fixing as part of a HackerOne bug report, which per standard practice is not disclosed until patched in all releases. The mistake there was not forgetting to disclose, it was not airlifting the fix into Brave Stable and intermediate releases right away. We have already made process fixes; automated network leak testing is the biggest one. If you don't like crypto-tokens, don't use them. They're optional in Brave. They have no privacy impact.
- ShakeRattleRoll 6y ago
  Cliqz’s Human Web used servers from FoxyProxy to remove IP address info. Will you continue to partner with FoxyProxy (as a matter of outsourcing the “trust us, we’re not tracking your IP”) component? If not FoxyProxy, then who — this 3rd party companies’ reputation matters.
  - BrendanEich 6y ago
    We drop IP already when proxying a number of Google services, see https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)#services-we-proxy-through-brave-servers https://github.com/brave/brave-browser/wiki/Deviations-from-.... We've used Fastly in the past to drop IP, implemented using VCL. I believe we're using other vendors now as well. Unlikely to use FoxyProxy but the idea is the same. We don't log IPs and don't let them get to us or to Google or other service providers, where possible. If you are interested, https://brave.com/brave-private-cdn/ https://brave.com/brave-private-cdn/ describes how we go to even more effort to avoid seeing fingerprints as well as identifiers including IP addresses.
- user-the-name 6y ago
  > The only recklessness in sight is your comment repeating a complete fabrication This is not how a trustworthy company responds to criticism. This is, however, exactly how frauds tend to respond.

by gidam 6y ago

lrae 6y ago

Also zero transparency for users and publishers. On one browser installation I stopped getting payouts, reached out to them via reddit (like they asked for) and provided all the information they asked for: ghosted. I'm also a publisher, for weeks now I can't login and it seems like I'm not getting payouts anymore either. Never got any mail about it. Sent them an email about it February 23rd, no answer so far. If I'd have to guess, the one client somehow got blacklisted maybe because I used too many Brave installations and they think they're fraudulent? (Though I only used like 5, Brave & Brave Beta each on a desktop & laptop, then on another desktop just one installation. Also, I still get payouts for the other installations.) Or it's just another one of the bugs that eats payouts and users' BATs. Publisher account I even have less of an idea, it's totally fine, teen-rated gaming websites with a couple of thousand organic (search traffic) uniques/month. I did sent BAT from my unconnected Browsers (you only can connect a maximum of 4 browsers to a wallet, ever) to my site to tip myself. As far as I know that isn't against the TOS either (even makes them more money because they douple dip). But, even if they don't suspend you without any notice, it's completely non-transparent as a publisher too. You get zero statistics, just a bundled payout each month. I'd never use them like this as a publisher for bigger sites, pretty sure I mailed them about that too in the past and also did not get any reply.

junon 6y ago

Also the fact that they boast "we blocked X many ads" directly above a Brave-owned embedded avertisement directly in the browser itself. Scummy stuff.

smbullet 6y ago
That's a feature, not a bug. The point of the Brave ad blocker is to (optionally) replace unethical ads with ethical ones so you can compensate the content creators you browse. How is this scummy?
- drusepth 6y ago
  Because it removes a revenue stream for many sites and small businesses (oftentimes the most important or only revenue stream) and replaces it with a setup where Brave happily benefits from holding that income in escrow until you can convince them to hand over whatever percent they think is fair to share... in their crypto. That is, of course, assuming they don't ghost you, which seems like a common complaint among publishers. The company's got a long list of shady practices and "mistakes" where they haven't paid creators and/or screwed over users for their own profits. Even if you give them the benefit of the doubt and assume they just constantly make honest mistakes, no other browser dominates the news every other month with so many privacy scandals.
  - ketamine__ 6y ago
    Ads completely overwhelm my mobile and mac book pro. Sorry?
  - AndroidKitKat 6y ago
    While it is sort of a hostage situation (websites must sign up for Brave rewards to get a payout), would you rather websites get no revenue at all? If the prevailing mentality of most web users is to install their adblocker of choice, I see Brave as an approach that tries to cater to everyone.
    - bscphil 6y ago
      > If the prevailing mentality of most web users is to install their adblocker of choice This is not the prevailing mentality of "most" web users, in fact it's not even possible for it to be because the most common user agent is Chrome on Android. Brave is an attempt to funnel as many oblivious users as possible into a pipeline where native ads are automatically blocked, for the precise purpose of being able to execute the "hostage situation" that you mention. The premise that the target market for Brave is the tiny group of people who are willing to look at one kind of ad (provided by Brave) but not a different kind of ad (provided by the publisher) so that the publisher can get a fraction of what they would have received from the native ad (if they opt into a crypto scam) is laughable. Most people who want to block ads just want to block all ads.
jeanofthedead 6y ago
You can easily remove cards, top sites, adblock counts, and advertisements from the Brave home page. It's customizable.
- willis936 6y ago
  Their point is not that there is an adblock counter, but that brave injects ads on their own homepage to inflate the apparent usefulness of their browser. It's similar to labeling a casino a buffet and saying you don't need to gamble.
- stjohnswarts 6y ago
  I guess some just want everything for free. It's not like they're hiding it. It's right in front of your face. It's just some are too lazy to turn it off or simply don't care.

techrat 6y ago

You forgot one. Whitelisting cross-site trackers from sites like Facebook and Twitter.

BrendanEich 6y ago
All browsers allow those social widgets by default, because blocking them breaks too many pages. Brave is not alone in this regard. We're working on a better default that blocks but replaces with mock objects bundled with Brave's binary that activate the real widget on click. In the mean time, you can turn them off and risk broken pages via "Social media blocking" settings.

JacobSuperslav 6y ago

Also doesn't help that Brave's CEO is a right wing guy (asked to leave Mozilla because of his radical comments) and a COVID conspiracy theorist "masks don't do anything"

danans 6y ago
I'm not sure what the relevance of it either way. Even though he left Mozilla due to his public opposition to marriage-equality for same-sex couples, to connect that with his current company seems like a stretch. And even being an anti-masker in the COVID19 context, however misguided that might be, isn't really related to the browser's functionality.
- bscphil 6y ago
  Maybe some people just feel gross participating in a project to make this guy richer?
  - danans 6y ago
    I can understand that. But while I disagree fundamentally with the Brave CEO's political stances on the aforementioned topics, I just don't see a strong connection between those and his product, which is politically neutral from a left/right perspective. It's nothing like, for example, the clear connections between the political views of the execs/funders of Parler and Gab and their their products.
    - bscphil 6y ago
      I agree, there are certainly heaps of odious people who have created great things in technology. And I don't even mind using these things if the creator is not making money off of them. (There's an open source project whose author says, on the project's webpage, that he dislikes the idea of anyone who doesn't embrace white nationalism using the software. I don't think he was joking.) I suppose I'm reading JacobSuperslav's comment differently than you. You're reading them as saying (in response to a comment listing reasons not to trust Brave) "here are some additional reasons not to trust Brave", which you're saying doesn't follow. I agree that it doesn't follow, but I'm reading their comment as saying "Brave's untrustworthiness is one reason not to use it, but another reason why you might not want to use it is..."

kdtsh 6y ago

Agreed. I just don’t see why I should not continue to use Firefox, Multi-Account Containers, and DuckDuckGo, and just use Tor Browser if I want to use TOR. The whole crypto thing in Brave especially rubs me the wrong way, it feels like a Ponzi scheme.

permo-w 6y ago
It’s chrome with extra features, and not owned by Google. You don’t have to participate in their crypto nonsense, and you don’t have to use their TOR browser It’s basically just convenient

BrendanEich 6y ago

The only recklessness in sight is your comment repeating a complete fabrication. We never "hijacked links". See https://news.ycombinator.com/item?id=25841456 https://news.ycombinator.com/item?id=25841456. The Tor leak was already fixed in Brave Nightly when independently discovered. We were fixing as part of a HackerOne bug report, which per standard practice is not disclosed until patched in all releases. The mistake there was not forgetting to disclose, it was not airlifting the fix into Brave Stable and intermediate releases right away. We have already made process fixes; automated network leak testing is the biggest one. If you don't like crypto-tokens, don't use them. They're optional in Brave. They have no privacy impact.

ShakeRattleRoll 6y ago
Cliqz’s Human Web used servers from FoxyProxy to remove IP address info. Will you continue to partner with FoxyProxy (as a matter of outsourcing the “trust us, we’re not tracking your IP”) component? If not FoxyProxy, then who — this 3rd party companies’ reputation matters.
- BrendanEich 6y ago
  We drop IP already when proxying a number of Google services, see https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)#services-we-proxy-through-brave-servers https://github.com/brave/brave-browser/wiki/Deviations-from-.... We've used Fastly in the past to drop IP, implemented using VCL. I believe we're using other vendors now as well. Unlikely to use FoxyProxy but the idea is the same. We don't log IPs and don't let them get to us or to Google or other service providers, where possible. If you are interested, https://brave.com/brave-private-cdn/ https://brave.com/brave-private-cdn/ describes how we go to even more effort to avoid seeing fingerprints as well as identifiers including IP addresses.
user-the-name 6y ago
> The only recklessness in sight is your comment repeating a complete fabrication This is not how a trustworthy company responds to criticism. This is, however, exactly how frauds tend to respond.