9 ms·

Brave is doing for us all the things Mozilla promised

by agilob 5y ago

dralley 5y ago
And a lot of other shaddy things that Mozilla has never done, like the affiliate link hijacking (which yes, was supposedly a "bug" but you have to admit that it's an awfully convenient "bug"), and setting up crypto wallets for content creators without solicitation and then collecting money on their behalf.
- jonathansampson 5y ago
  Heads up: I work at Brave. As such, I encourage you to check my claims, verify my sources, and don't take anything I say for granted. Always happy to provide more context as needed :) Firefox literally sends your keystrokes to Google, right out of the box. Brave, however, was found to be the most private popular browser by reputable researchers: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf. Brave [never] hijacked links either. Affiliate Links were offered among suggested sites for relevant search input. So if you searched "Binance," the browser would offer (among other suggestions), an affiliate link for the site. Users could then choose to browse to the property with the affiliate link, and in so doing support the development of Brave. No impact to privacy or security at all. The mistake here was with input handling. Built to handle search input, this feature also mistakenly handled fully-qualified domains. While we intended the app to offer affiliate links (when relevant) to something like "what is binance?", it was also offering them for "binance.us". The latter case was corrected quickly (and the feature itself was disabled out of the box). More about that on our blog: https://brave.com/referral-codes-in-suggested-sites/ https://brave.com/referral-codes-in-suggested-sites/. To your second point, about setting up crypto wallets and soliciting donations on behalf of non-participating publishers, you're mistaken there as well. To prime the support-system in Brave (called Brave Payments at the time), we staked Brave users with tokens, inviting them to direct those tokens to creators they would like to support. More clearly, Brave gave Brave users say over where Brave ought to direct its own tokens. Unfortunately, our UI/UX wasn't very clear about which creators were verified, and which were not (we followed the Twitter approach, marking verified creators with a checkmark, but doing nothing for others). This resulted in some confusion at the end of 2018, where users were directing Brave's tokens to non-participating creators (most notably Tom Scott). We received considerably helpful feedback about how the system could be improved (both from a UI/UX side, and operationally). Frankly, I don't think I've ever seen our team work so hard, and churn out such a monumental update in so little time. We had made massive changes within 48 hours IIRC. Creators were explicitly marked as verified or unverified in all cases, the BAT that Brave stakes with users would remain in the local wallet until it could be received by a verified creator. And BAT that sat pending for 90 days would be unlocked again for the user to direct elsewhere. Tom Scott was kind enough to review our changes, and explicitly gave us his approval soon-thereafter. What is now 'Brave Rewards' wouldn't be doing so well today were it not for Tom and so many other incredible users helping us find the best path forward. More about that on our blog: https://brave.com/rewards-update/ https://brave.com/rewards-update/
  - agilob 5y ago
    Not that I'm downplaying your points, but please next time start a comment saying you're working for Brave ;)
    - jonathansampson 5y ago
      Good point. On Twitter my name is "BraveSampson," and I often forget that isn't the case here as well. FWIW, I'm Sampson, and I work in Developer Relations at Brave. I have that in my bio here, to help a bit.
      - dave5104 5y ago
        > On Twitter my name is "BraveSampson," It doesn't look like this is the case, fwiw. (Unless your HN profile lists an outdated handle?)
        jonathansampson 5y ago
        Nice catch! I was referring to https://twitter.com/BraveSampson/ https://twitter.com/BraveSampson/. Profile updated.
  - benatkin 5y ago
    > Firefox literally sends your keystrokes to Google, right out of the box. Keystrokes in the URL bar.
    - freeplay 5y ago
      It can also be disabled in preferences if you don't like that functionality.
      - deleted 5y ago
        [deleted]
      - taneq 5y ago
- tempest_ 5y ago
  People around here love to pile on Mozilla for every perceived slight or misstep but they rarely have any ideas on how Mozilla is supposed to fund itself. Some of the ire is earned but I have yet to see how Mozilla is supposed to fund Firefox development without that google search bar.
  - devmunchies 5y ago
    > they rarely have any ideas on how Mozilla is supposed to fund itself If we’re talking about the Mozilla foundation, they should seek donations and grants and focus on being the best user web tooling. If we’re talking about the corp, they could’ve kept rust under the umbrella and pioneered the WASI runtime and built an alternative to k8s that runs webassemblies and built out a paid cloud infra. It doesn’t make sense to have a foundation that is user aligned and a corp that is user hostile. There should be aligned incentives.
  - agilob 5y ago
    In 2013/2014 when Snowden started whiste-blowing we were hoping for Mozilla to monetize privacy, but they never did. They only recently made some very poor attempts at private email, VPN and integrated some DoH. They were very hesitant for any cryptocurrencies integration. I would be happy to pay for a serious VPN and email service (remember Mozilla owns Thuderbird) with promises like Tutanota or Proton have. They could have acquired them, but instead they acquired pocket. Mozilla had the perfect brand and enough userbase to do it. Mozilla started doing that work 5-7 years too late and did too little to be meaningful. I feel they are doomed now and their space is shrinking and there's no future for Firefox in the long term. There's a lot that can be added here: Mozilla promised to opensource pocket server and never did. They promised to hire someone full-time for Thunderbird, but never did. afair there is a German company that has full-time developer working on Thuderbird. They promised a VPN... yes, delivered something. They promised anonymous email, I know they were giving access by invites, but nothing more about it. They promised to unfork Tor browser and integrate Tor into Firefox, they were even running a few Tor nodes. Remember how hyped everyone here was for Servo in Firefox and electron competitor? MDN could have integration with GH or GL and educational content for web development, they literally had resources, brand and ability to join an online university and give degrees or at least serious bootcamps. Mozilla was a meaningful brand to do it. They had a lot of opportunities to sell privacy, we literally demanded it from them, but they weren't interested in listening. Instead they delivered 6 rebrands each breaking my muscle memory. Do you remember how they advised EU to regulate monopoly on the webbrowser market? There was time when they had all ability, but 0 will to keep it this way https://en.wikipedia.org/wiki/BrowserChoice.eu https://en.wikipedia.org/wiki/BrowserChoice.eu
- pmurt7 5y ago
  Mozilla faces blowback after slipping Mr Robot plugin into Firefox: https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robot-arg-plugin-firefox-looking-glass https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robo...
- celsoazevedo 5y ago
  Maybe it's because I use Brave (as a "Chrome with less Google" and with all the crypto stuff disabled), but when I look at the "shady things" they've done, it doesn't look that shady: - The affiliate link "hijacking" was - if I remember correctly - to sites of crypto companies that partner with them. I'd prefer if this didn't happen, but most seem to be fine when other browsers (Safari, Firefox, etc) add something like "?client=safari" when searching or when their search engine (eg: DDG) use affiliate links to sites like Amazon or Ebay. It's not a new thing. - The money collection (brave rewards)... if one doesn't understand how the system works, it looks like they are stealing money... but the money is returned to the sender after a while if the website/creator doesn't claim it. Is this that bad? And then there's them not blocking some trackers (Google, Facebook, etc) by default, but if they did, they would break logins on many websites. Maybe all this is bad, but I'm not sure if there's any browser out there without a history of shady behaviour. Even Mozilla has messed up a few times.
  - dralley 5y ago
    >The money collection (brave rewards)... if one doesn't understand how the system works, it looks like they are stealing money... but the money is returned to the sender after a while if the website/creator doesn't claim it. Is this that bad? I don't think anyone ever accused them of stealing that money, but yes, hijacking people's personal brands to collect money without their explicit knowledge is a bad thing. Imagine if I saw the icon and gave "them" money via Brave instead of joining their Patreon or some other official channel that they explicitly set up. If they don't collect, then yes, I might get my money back - nothing was "stolen". But that was money I wanted to send to the content creator in that particular moment, and that creator will probably never see it. The creator got screwed out of money that otherwise would have gone to them.
    - w0ts0n 5y ago
      >hijacking people's personal brands to collect money without their explicit knowledge is a bad thing. Brave gave users BAT to tip content creators. They tipped it, if it wasn't claimed in 90d, Brave returned the BAT to the pool. There was no collecting money. It was Brave's promotional BAT and it never actually left Brave's possession unless claimed. The issue was that it wasn't clear if the creator had or hadn't signed up. Which was fixed within 48h.
- BrendanEich 5y ago
  You wrote "link" which is an element in a page, but we never "hijacked" or rewrote any such URL-bearing element. (We do for De-AMP, now.) Please dont fall for such lies about us couched as "link hijacking". https://news.ycombinator.com/item?id=31088549 https://news.ycombinator.com/item?id=31088549
- xtat 5y ago
  This is the thing everyone always points to when they hand wave "a lot of other shady things" - not sure why folks generally like to FUD Brave. I was working there when this issue happened and it was a very big deal internally and was patched immediately. FWIW I got zero hint that this was some kind of shady thing someone would have been trying to sneak in.
  - hackerfromthefu 5y ago
    Follow the money, there's serious money pitted against Brave. Grassroots users should support it like the godsend it is.
huhtenberg 5y ago
There's an irony there somewhere. I can feel it.
coldpie 5y ago
I like having more than one browser engine in the world, but I do hope Brave pushes Mozilla to do more.
- alanh 5y ago
  To be fair, Brave doesn’t really have their own browser engine (it’s Chromium), but it is good to have browser choice, so I agree with the sentiment. (I am a Brave user.)
  - devmunchies 5y ago
    Agree, but at least brave has the expertise and interests ($$) that if chromium goes off the rails, they could fork and maintain an alternative.
reflexco 5y ago
Except building the only modern alternative rendering engine on desktop, which is necessary to keep web standards serving the users instead of Google!
wintermutestwin 5y ago
Everytime I read this kind of hyperbole, I install Brave and try to replicate my Firefox browsing experience and realize that Brave/Chrome extensions suck. Specifically none come close to replicating the functionality of: Multi-Account Containers Temporary Containers Sidebery
- wussboy 5y ago
  The triple threat that keeps me on Firefox. Can’t live without Sidebery
MomoXenosaga 5y ago
Brave is a Chromium browser. Mozilla is still the only one fighting Google- and Apple with Safari I suppose.

Brave is doing for us all the things Mozilla promised

by agilob 5y ago

Brave is doing for us all the things Mozilla promised

And a lot of other shaddy things that Mozilla has never done, like the affiliate link hijacking (which yes, was supposedly a "bug" but you have to admit that it's an awfully convenient "bug"), and setting up crypto wallets for content creators without solicitation and then collecting money on their behalf.

jonathansampson 5y ago
Heads up: I work at Brave. As such, I encourage you to check my claims, verify my sources, and don't take anything I say for granted. Always happy to provide more context as needed :) Firefox literally sends your keystrokes to Google, right out of the box. Brave, however, was found to be the most private popular browser by reputable researchers: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf. Brave [never] hijacked links either. Affiliate Links were offered among suggested sites for relevant search input. So if you searched "Binance," the browser would offer (among other suggestions), an affiliate link for the site. Users could then choose to browse to the property with the affiliate link, and in so doing support the development of Brave. No impact to privacy or security at all. The mistake here was with input handling. Built to handle search input, this feature also mistakenly handled fully-qualified domains. While we intended the app to offer affiliate links (when relevant) to something like "what is binance?", it was also offering them for "binance.us". The latter case was corrected quickly (and the feature itself was disabled out of the box). More about that on our blog: https://brave.com/referral-codes-in-suggested-sites/ https://brave.com/referral-codes-in-suggested-sites/. To your second point, about setting up crypto wallets and soliciting donations on behalf of non-participating publishers, you're mistaken there as well. To prime the support-system in Brave (called Brave Payments at the time), we staked Brave users with tokens, inviting them to direct those tokens to creators they would like to support. More clearly, Brave gave Brave users say over where Brave ought to direct its own tokens. Unfortunately, our UI/UX wasn't very clear about which creators were verified, and which were not (we followed the Twitter approach, marking verified creators with a checkmark, but doing nothing for others). This resulted in some confusion at the end of 2018, where users were directing Brave's tokens to non-participating creators (most notably Tom Scott). We received considerably helpful feedback about how the system could be improved (both from a UI/UX side, and operationally). Frankly, I don't think I've ever seen our team work so hard, and churn out such a monumental update in so little time. We had made massive changes within 48 hours IIRC. Creators were explicitly marked as verified or unverified in all cases, the BAT that Brave stakes with users would remain in the local wallet until it could be received by a verified creator. And BAT that sat pending for 90 days would be unlocked again for the user to direct elsewhere. Tom Scott was kind enough to review our changes, and explicitly gave us his approval soon-thereafter. What is now 'Brave Rewards' wouldn't be doing so well today were it not for Tom and so many other incredible users helping us find the best path forward. More about that on our blog: https://brave.com/rewards-update/ https://brave.com/rewards-update/
- agilob 5y ago
  Not that I'm downplaying your points, but please next time start a comment saying you're working for Brave ;)
  - jonathansampson 5y ago
    Good point. On Twitter my name is "BraveSampson," and I often forget that isn't the case here as well. FWIW, I'm Sampson, and I work in Developer Relations at Brave. I have that in my bio here, to help a bit.
    - dave5104 5y ago
      > On Twitter my name is "BraveSampson," It doesn't look like this is the case, fwiw. (Unless your HN profile lists an outdated handle?)
      - jonathansampson 5y ago
        Nice catch! I was referring to https://twitter.com/BraveSampson/ https://twitter.com/BraveSampson/. Profile updated.
- benatkin 5y ago
  > Firefox literally sends your keystrokes to Google, right out of the box. Keystrokes in the URL bar.
  - freeplay 5y ago
    It can also be disabled in preferences if you don't like that functionality.
    - deleted 5y ago
      [deleted]
    - taneq 5y ago
tempest_ 5y ago
People around here love to pile on Mozilla for every perceived slight or misstep but they rarely have any ideas on how Mozilla is supposed to fund itself. Some of the ire is earned but I have yet to see how Mozilla is supposed to fund Firefox development without that google search bar.
- devmunchies 5y ago
  > they rarely have any ideas on how Mozilla is supposed to fund itself If we’re talking about the Mozilla foundation, they should seek donations and grants and focus on being the best user web tooling. If we’re talking about the corp, they could’ve kept rust under the umbrella and pioneered the WASI runtime and built an alternative to k8s that runs webassemblies and built out a paid cloud infra. It doesn’t make sense to have a foundation that is user aligned and a corp that is user hostile. There should be aligned incentives.
- agilob 5y ago
  In 2013/2014 when Snowden started whiste-blowing we were hoping for Mozilla to monetize privacy, but they never did. They only recently made some very poor attempts at private email, VPN and integrated some DoH. They were very hesitant for any cryptocurrencies integration. I would be happy to pay for a serious VPN and email service (remember Mozilla owns Thuderbird) with promises like Tutanota or Proton have. They could have acquired them, but instead they acquired pocket. Mozilla had the perfect brand and enough userbase to do it. Mozilla started doing that work 5-7 years too late and did too little to be meaningful. I feel they are doomed now and their space is shrinking and there's no future for Firefox in the long term. There's a lot that can be added here: Mozilla promised to opensource pocket server and never did. They promised to hire someone full-time for Thunderbird, but never did. afair there is a German company that has full-time developer working on Thuderbird. They promised a VPN... yes, delivered something. They promised anonymous email, I know they were giving access by invites, but nothing more about it. They promised to unfork Tor browser and integrate Tor into Firefox, they were even running a few Tor nodes. Remember how hyped everyone here was for Servo in Firefox and electron competitor? MDN could have integration with GH or GL and educational content for web development, they literally had resources, brand and ability to join an online university and give degrees or at least serious bootcamps. Mozilla was a meaningful brand to do it. They had a lot of opportunities to sell privacy, we literally demanded it from them, but they weren't interested in listening. Instead they delivered 6 rebrands each breaking my muscle memory. Do you remember how they advised EU to regulate monopoly on the webbrowser market? There was time when they had all ability, but 0 will to keep it this way https://en.wikipedia.org/wiki/BrowserChoice.eu https://en.wikipedia.org/wiki/BrowserChoice.eu
pmurt7 5y ago
Mozilla faces blowback after slipping Mr Robot plugin into Firefox: https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robot-arg-plugin-firefox-looking-glass https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robo...
celsoazevedo 5y ago
Maybe it's because I use Brave (as a "Chrome with less Google" and with all the crypto stuff disabled), but when I look at the "shady things" they've done, it doesn't look that shady: - The affiliate link "hijacking" was - if I remember correctly - to sites of crypto companies that partner with them. I'd prefer if this didn't happen, but most seem to be fine when other browsers (Safari, Firefox, etc) add something like "?client=safari" when searching or when their search engine (eg: DDG) use affiliate links to sites like Amazon or Ebay. It's not a new thing. - The money collection (brave rewards)... if one doesn't understand how the system works, it looks like they are stealing money... but the money is returned to the sender after a while if the website/creator doesn't claim it. Is this that bad? And then there's them not blocking some trackers (Google, Facebook, etc) by default, but if they did, they would break logins on many websites. Maybe all this is bad, but I'm not sure if there's any browser out there without a history of shady behaviour. Even Mozilla has messed up a few times.
- dralley 5y ago
  >The money collection (brave rewards)... if one doesn't understand how the system works, it looks like they are stealing money... but the money is returned to the sender after a while if the website/creator doesn't claim it. Is this that bad? I don't think anyone ever accused them of stealing that money, but yes, hijacking people's personal brands to collect money without their explicit knowledge is a bad thing. Imagine if I saw the icon and gave "them" money via Brave instead of joining their Patreon or some other official channel that they explicitly set up. If they don't collect, then yes, I might get my money back - nothing was "stolen". But that was money I wanted to send to the content creator in that particular moment, and that creator will probably never see it. The creator got screwed out of money that otherwise would have gone to them.
  - w0ts0n 5y ago
    >hijacking people's personal brands to collect money without their explicit knowledge is a bad thing. Brave gave users BAT to tip content creators. They tipped it, if it wasn't claimed in 90d, Brave returned the BAT to the pool. There was no collecting money. It was Brave's promotional BAT and it never actually left Brave's possession unless claimed. The issue was that it wasn't clear if the creator had or hadn't signed up. Which was fixed within 48h.
BrendanEich 5y ago
You wrote "link" which is an element in a page, but we never "hijacked" or rewrote any such URL-bearing element. (We do for De-AMP, now.) Please dont fall for such lies about us couched as "link hijacking". https://news.ycombinator.com/item?id=31088549 https://news.ycombinator.com/item?id=31088549
xtat 5y ago
This is the thing everyone always points to when they hand wave "a lot of other shady things" - not sure why folks generally like to FUD Brave. I was working there when this issue happened and it was a very big deal internally and was patched immediately. FWIW I got zero hint that this was some kind of shady thing someone would have been trying to sneak in.
- hackerfromthefu 5y ago
  Follow the money, there's serious money pitted against Brave. Grassroots users should support it like the godsend it is.

huhtenberg 5y ago

There's an irony there somewhere. I can feel it.

coldpie 5y ago

I like having more than one browser engine in the world, but I do hope Brave pushes Mozilla to do more.

alanh 5y ago
To be fair, Brave doesn’t really have their own browser engine (it’s Chromium), but it is good to have browser choice, so I agree with the sentiment. (I am a Brave user.)
- devmunchies 5y ago
  Agree, but at least brave has the expertise and interests ($$) that if chromium goes off the rails, they could fork and maintain an alternative.

reflexco 5y ago

Except building the only modern alternative rendering engine on desktop, which is necessary to keep web standards serving the users instead of Google!

wintermutestwin 5y ago

Everytime I read this kind of hyperbole, I install Brave and try to replicate my Firefox browsing experience and realize that Brave/Chrome extensions suck. Specifically none come close to replicating the functionality of: Multi-Account Containers Temporary Containers Sidebery

wussboy 5y ago
The triple threat that keeps me on Firefox. Can’t live without Sidebery

MomoXenosaga 5y ago

Brave is a Chromium browser. Mozilla is still the only one fighting Google- and Apple with Safari I suppose.