7 ms·

Let's not pretend Mozilla is a saint or Firefox is close. Mozilla made a huge number of questionable moves over the years ("death by a thousand cuts") I perso

Let's not pretend Mozilla is a saint or Firefox is close. Mozilla made a huge number of questionable moves over the years ("death by a thousand cuts") I personally felt that the 2014 introduction of in-browser ads (pitched as "user-enhancing") marked a huge shift. For others it was the deep integration of the proprietary Pocket extension. For still others it was the weird Mr Robot cross-promotion that was pushed via a side channel or the Cliqz in-browser tracking or the booking.com in-browser ads. At this point, it really feels like Mozilla and FF are "controlled opposition" / defense against anti-trust claims, and many of the naysayers would probably jump to a clean implementation that isn't bogged down by the lack of trust.

vord1080 5y ago
Pocket isn't proprietary. The bundled extension is OSS and maintained in-tree. It's also not deeply integrated. You can turn it off or use artifact builds to create a custom Firefox with it completely gone, and nothing will break, because it's just a WebExtension.
- TAForObvReasons 5y ago
  The controversy at the time was that it didn't need to be embedded in the browser and it was a proprietary blob. It literally took years to get to a point where the bundled parts were released as open source (see https://bugzilla.mozilla.org/show_bug.cgi?id=1343006 https://bugzilla.mozilla.org/show_bug.cgi?id=1343006 ). Obviously there are legal concerns etc, but many of the critics would have been much happier if the extension were released as open source first rather than adding proprietary code to the browser
  - vord1080 5y ago
    For what technical reason would it be a proprietary blob? The Firefox frontend has been html/xul/css/js forever. Pocket would be implemented the same. I can't see why it would need to be a binary.
    - dralley 5y ago
      Pocket was an acquisition, not something they had written themselves.
- grey_earthling 5y ago
  The open source code is only useful when paired with a proprietary network service. When Mozilla bought Pocket, there already existed a competing open source self-hostable network service, Wallabag. Pocket is to Wallabag as Twitter is to Mastodon. My complaint was not that the code in Firefox was proprietary, but that it integrated with (and promoted) a proprietary network service, while there was a viable open source competitor. At the time, Mozilla's mission included the aim “to promote choice and innovation on the internet”, which this integration seemed to go against.
d3nj4l 5y ago
I don't disagree about the fact that Mozilla makes questionable moves. I still deeply resent that they laid off the servo team, and I treat their executives with as much suspicion as the rest of HN, see their recent moves with Firefox suggest in the address bar. But I think the fundamental difference is that, at the end of the day, I think Mozilla and Firefox are still the lesser evil in the borwser war; Firefox is still the best browser to run uBlock on, they have aggressively worked to end tracking and they have a mobile browser that actually supports extensions where possible (hello, Firefox Reality!) So I prefer to try as much as possible to work with Firefox instead of just accepting Chrome's dominance, especially given that it's just a worse browser for privacy.
- grey_earthling 5y ago
  > they have a mobile browser that actually supports extensions where possible This isn't quite as simple. Firefox on Android will only install a subset of extensions from addons.mozilla.org, based on an allow-list maintained by Mozilla. But other extensions on AMO (and therefore already complying with Mozilla's policies) work satisfactorily when installed in Iceraven (a fork of Firefox on Android). So this shows that the limited list of extensions available for Firefox on Android is not limited by technical reasons (“where possible”), but by Mozilla's choice. --- But I agree with the broad point: yes, Mozilla is pretty sketchy, but Google is orders of magnitude sketchier.
  - vord1080 5y ago
    The limited extensions on Android is for technical reasons. Instead of having zero extension support on release, they focused on supporting the APIs needed for popular extensions first and are working on adding the rest. It's an entire rewrite of the browser. There's still a lot of missing APIs they need to implement. Allowing every extension from AMO to work would be almost pointless because so many would be broken.
    - grey_earthling 5y ago
      The fact of limiting the list of extensions that can be installed is indeed for technical reasons — I'm sure there are some extensions that don't work. But the list of which extensions can be installed is not restricted solely for technical reasons. I use several extensions in Iceraven — Privacy Redirect; Bypass Paywalls Clean; I don't care about cookies — that work usefully. If there are any missing APIs, I haven't noticed them. These extensions can't be installed in Firefox for Android. There's no technical difference between Iceraven and Firefox, except that Iceraven has a more generous allow-list. This isn't a technical restriction; it's a choice by Mozilla. It's a valid choice — if they're aiming to curate a set of high-quality extensions, and prevent the use of lower-quality extensions — but it's a choice nonetheless.
HeckFeck 5y ago
We know the web is now so complex that it is impossible for a voluntary project to maintain a web browser, at least to a level of near-parity with Chrome. It seems impossible, but I wonder if Mozilla could be salvaged? I want a browser styled like the rugged and customisable UI of Firefox 4.x with the Gecko improvements of the Quantum releases. With desktop-to-mobile sync with real cryptography, before this nonsense of a 'Firefox account'. A browser that preserved features pleasing to techies and power users, while omitting features abhorrent to them, would be the ideal. How could such a thing be funded, and how could we get the old hacker collective style of Mozilla back? Or how would we start something new and get the full time labour necessary to develop such a browser, with an independent rendering engine and JS VM? While keeping unethical incentives as far from sight as possible. I don't pretend it is an easy question, but framing the right question is a start.
- vord1080 5y ago
  > With desktop-to-mobile sync with real cryptography Firefox Sync is end-to-end encrypted? My understanding is that Mozilla cannot actually read user sync data. https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ https://hacks.mozilla.org/2018/11/firefox-sync-privacy/
  - HeckFeck 5y ago
    > We transform your passphrase on your computer into two different, unrelated values. With one value, you cannot derive the other0. We send an authentication token, derived from your passphrase, to the server as the password-equivalent. And the encryption key derived from your passphrase never leaves your computer. Ah, looks like they still do. My mistake. I was harkening back to the old Sync protocol which just gave you a decryption key, rather than any account system. From this post it seems they've just integrated it with your password, if your link is describing the present method. What I had in mind was this: https://blog.mozilla.org/services/2014/05/08/firefox-accounts-sync-1-5-and-self-hosting/ https://blog.mozilla.org/services/2014/05/08/firefox-account.... i.e., back in the day you could self-host Firefox Sync, like a Nextcloud. It seems this is still possible, though not straightforwardly: https://discourse.mozilla.org/t/how-to-self-host-fxa-and-sync-server/78443 https://discourse.mozilla.org/t/how-to-self-host-fxa-and-syn...
glenstein 5y ago
>Let's not pretend Mozilla is a saint Okay but what's the upshot? If it's just a meandering comment to the effect of "well, Mozilla does bad stuff too", then this is exactly the kind of comment that the parent commenter was talking about. Take all of the concerns about Mozilla, add them up, and then bring them back to the larger conversation about what it means for the web to become increasingly dependent on Google. That is the second step, and that second step is the critical step, and somehow in these conversations, that piece keeps getting lost. Or worse, people decide to dig in before they get to that piece, and then, after already having been dug in, they confront this question and decide to follow it to the logically consistent but extreme conclusion that these trivial details are a sufficient reason to abandon the web to Google. I suspect that is a position that they wouldn't otherwise have consciously reasoned themselves into, but I do think it's how people respond to the challenge of reconciling their criticisms of Mozilla with the bigger picture. I don't think the Mr Robot thing was great, but I also don't think that's a reason to abandon the web to 100% dominance by Google. And is the Mr robot thing supposed to be an input into that bigger conversation about whether or not to abandon the web to Google? If yes, then I just have to say that I don't think that's a very good reason. If no, then I submit that we're losing track of the bigger question. >it really feels like Mozilla and FF are "controlled opposition" I have to admit that this is where you completely lost me. I think Mozilla is navigating some uncertain and difficult territory, and I don't think their choices are the best. But I guess I'll put it this way. If I find my brain spinning narratives like this, I take it as a sign that I need to get up and go on a walk outside.
- blihp 5y ago
  I think the 'controlled opposition' comment is pointing out that given a choice between doing the right thing for users vs. keeping Google happy (presumably to keep the search money comping in), they often seem to choose keeping Google happy. So while Mozilla has generally been less bad for user interests, it's still often far from being an advocate for them.
  - dralley 5y ago
    And yet it's devoid of truth. How many times has Google proposed some ridiculous new API that Mozilla has immediately and publicly rejected, often with strong language? I can count at least 2 off the top of my head from the past year alone. https://blog.mozilla.org/en/privacy-security/privacy-analysis-of-floc/ https://blog.mozilla.org/en/privacy-security/privacy-analysi... https://www.howtogeek.com/756338/mozilla-says-chromes-latest-feature-enables-surveillance/ https://www.howtogeek.com/756338/mozilla-says-chromes-latest... There's also this: https://blog.mozilla.org/blog/2020/08/04/latest-firefox-rolls-out-enhanced-tracking-protection-2-0-blocking-redirect-trackers-by-default/ https://blog.mozilla.org/blog/2020/08/04/latest-firefox-roll... https://twitter.com/__jakub_g/status/1365400306767581185 https://twitter.com/__jakub_g/status/1365400306767581185 And the top comment of the hacker news thread associated with that last link? >My friend who works in an adtech company: >"Protip: Use Firefox instead of Chrome. We get very little data from Firefox users"

vord1080 5y ago

Pocket isn't proprietary. The bundled extension is OSS and maintained in-tree. It's also not deeply integrated. You can turn it off or use artifact builds to create a custom Firefox with it completely gone, and nothing will break, because it's just a WebExtension.

TAForObvReasons 5y ago
The controversy at the time was that it didn't need to be embedded in the browser and it was a proprietary blob. It literally took years to get to a point where the bundled parts were released as open source (see https://bugzilla.mozilla.org/show_bug.cgi?id=1343006 https://bugzilla.mozilla.org/show_bug.cgi?id=1343006 ). Obviously there are legal concerns etc, but many of the critics would have been much happier if the extension were released as open source first rather than adding proprietary code to the browser
- vord1080 5y ago
  For what technical reason would it be a proprietary blob? The Firefox frontend has been html/xul/css/js forever. Pocket would be implemented the same. I can't see why it would need to be a binary.
  - dralley 5y ago
    Pocket was an acquisition, not something they had written themselves.
grey_earthling 5y ago
The open source code is only useful when paired with a proprietary network service. When Mozilla bought Pocket, there already existed a competing open source self-hostable network service, Wallabag. Pocket is to Wallabag as Twitter is to Mastodon. My complaint was not that the code in Firefox was proprietary, but that it integrated with (and promoted) a proprietary network service, while there was a viable open source competitor. At the time, Mozilla's mission included the aim “to promote choice and innovation on the internet”, which this integration seemed to go against.

d3nj4l 5y ago

I don't disagree about the fact that Mozilla makes questionable moves. I still deeply resent that they laid off the servo team, and I treat their executives with as much suspicion as the rest of HN, see their recent moves with Firefox suggest in the address bar. But I think the fundamental difference is that, at the end of the day, I think Mozilla and Firefox are still the lesser evil in the borwser war; Firefox is still the best browser to run uBlock on, they have aggressively worked to end tracking and they have a mobile browser that actually supports extensions where possible (hello, Firefox Reality!) So I prefer to try as much as possible to work with Firefox instead of just accepting Chrome's dominance, especially given that it's just a worse browser for privacy.

grey_earthling 5y ago
> they have a mobile browser that actually supports extensions where possible This isn't quite as simple. Firefox on Android will only install a subset of extensions from addons.mozilla.org, based on an allow-list maintained by Mozilla. But other extensions on AMO (and therefore already complying with Mozilla's policies) work satisfactorily when installed in Iceraven (a fork of Firefox on Android). So this shows that the limited list of extensions available for Firefox on Android is not limited by technical reasons (“where possible”), but by Mozilla's choice. --- But I agree with the broad point: yes, Mozilla is pretty sketchy, but Google is orders of magnitude sketchier.
- vord1080 5y ago
  The limited extensions on Android is for technical reasons. Instead of having zero extension support on release, they focused on supporting the APIs needed for popular extensions first and are working on adding the rest. It's an entire rewrite of the browser. There's still a lot of missing APIs they need to implement. Allowing every extension from AMO to work would be almost pointless because so many would be broken.
  - grey_earthling 5y ago
    The fact of limiting the list of extensions that can be installed is indeed for technical reasons — I'm sure there are some extensions that don't work. But the list of which extensions can be installed is not restricted solely for technical reasons. I use several extensions in Iceraven — Privacy Redirect; Bypass Paywalls Clean; I don't care about cookies — that work usefully. If there are any missing APIs, I haven't noticed them. These extensions can't be installed in Firefox for Android. There's no technical difference between Iceraven and Firefox, except that Iceraven has a more generous allow-list. This isn't a technical restriction; it's a choice by Mozilla. It's a valid choice — if they're aiming to curate a set of high-quality extensions, and prevent the use of lower-quality extensions — but it's a choice nonetheless.

HeckFeck 5y ago

We know the web is now so complex that it is impossible for a voluntary project to maintain a web browser, at least to a level of near-parity with Chrome. It seems impossible, but I wonder if Mozilla could be salvaged? I want a browser styled like the rugged and customisable UI of Firefox 4.x with the Gecko improvements of the Quantum releases. With desktop-to-mobile sync with real cryptography, before this nonsense of a 'Firefox account'. A browser that preserved features pleasing to techies and power users, while omitting features abhorrent to them, would be the ideal. How could such a thing be funded, and how could we get the old hacker collective style of Mozilla back? Or how would we start something new and get the full time labour necessary to develop such a browser, with an independent rendering engine and JS VM? While keeping unethical incentives as far from sight as possible. I don't pretend it is an easy question, but framing the right question is a start.

vord1080 5y ago
> With desktop-to-mobile sync with real cryptography Firefox Sync is end-to-end encrypted? My understanding is that Mozilla cannot actually read user sync data. https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ https://hacks.mozilla.org/2018/11/firefox-sync-privacy/
- HeckFeck 5y ago
  > We transform your passphrase on your computer into two different, unrelated values. With one value, you cannot derive the other0. We send an authentication token, derived from your passphrase, to the server as the password-equivalent. And the encryption key derived from your passphrase never leaves your computer. Ah, looks like they still do. My mistake. I was harkening back to the old Sync protocol which just gave you a decryption key, rather than any account system. From this post it seems they've just integrated it with your password, if your link is describing the present method. What I had in mind was this: https://blog.mozilla.org/services/2014/05/08/firefox-accounts-sync-1-5-and-self-hosting/ https://blog.mozilla.org/services/2014/05/08/firefox-account.... i.e., back in the day you could self-host Firefox Sync, like a Nextcloud. It seems this is still possible, though not straightforwardly: https://discourse.mozilla.org/t/how-to-self-host-fxa-and-sync-server/78443 https://discourse.mozilla.org/t/how-to-self-host-fxa-and-syn...

glenstein 5y ago

>Let's not pretend Mozilla is a saint Okay but what's the upshot? If it's just a meandering comment to the effect of "well, Mozilla does bad stuff too", then this is exactly the kind of comment that the parent commenter was talking about. Take all of the concerns about Mozilla, add them up, and then bring them back to the larger conversation about what it means for the web to become increasingly dependent on Google. That is the second step, and that second step is the critical step, and somehow in these conversations, that piece keeps getting lost. Or worse, people decide to dig in before they get to that piece, and then, after already having been dug in, they confront this question and decide to follow it to the logically consistent but extreme conclusion that these trivial details are a sufficient reason to abandon the web to Google. I suspect that is a position that they wouldn't otherwise have consciously reasoned themselves into, but I do think it's how people respond to the challenge of reconciling their criticisms of Mozilla with the bigger picture. I don't think the Mr Robot thing was great, but I also don't think that's a reason to abandon the web to 100% dominance by Google. And is the Mr robot thing supposed to be an input into that bigger conversation about whether or not to abandon the web to Google? If yes, then I just have to say that I don't think that's a very good reason. If no, then I submit that we're losing track of the bigger question. >it really feels like Mozilla and FF are "controlled opposition" I have to admit that this is where you completely lost me. I think Mozilla is navigating some uncertain and difficult territory, and I don't think their choices are the best. But I guess I'll put it this way. If I find my brain spinning narratives like this, I take it as a sign that I need to get up and go on a walk outside.

blihp 5y ago
I think the 'controlled opposition' comment is pointing out that given a choice between doing the right thing for users vs. keeping Google happy (presumably to keep the search money comping in), they often seem to choose keeping Google happy. So while Mozilla has generally been less bad for user interests, it's still often far from being an advocate for them.
- dralley 5y ago
  And yet it's devoid of truth. How many times has Google proposed some ridiculous new API that Mozilla has immediately and publicly rejected, often with strong language? I can count at least 2 off the top of my head from the past year alone. https://blog.mozilla.org/en/privacy-security/privacy-analysis-of-floc/ https://blog.mozilla.org/en/privacy-security/privacy-analysi... https://www.howtogeek.com/756338/mozilla-says-chromes-latest-feature-enables-surveillance/ https://www.howtogeek.com/756338/mozilla-says-chromes-latest... There's also this: https://blog.mozilla.org/blog/2020/08/04/latest-firefox-rolls-out-enhanced-tracking-protection-2-0-blocking-redirect-trackers-by-default/ https://blog.mozilla.org/blog/2020/08/04/latest-firefox-roll... https://twitter.com/__jakub_g/status/1365400306767581185 https://twitter.com/__jakub_g/status/1365400306767581185 And the top comment of the hacker news thread associated with that last link? >My friend who works in an adtech company: >"Protip: Use Firefox instead of Chrome. We get very little data from Firefox users"