10 ms·

Expected, but meaningless if we can't drive people towards Firefox and away from Chromium products. That's something of a responsibility we all have, especially

Expected, but meaningless if we can't drive people towards Firefox and away from Chromium products. That's something of a responsibility we all have, especially those of us invested in the safety and security (collectively, trust) of the web. I haven't seen anything yet on whether Brave will support it, though if I'm understanding correctly, they won't have a choice since they're using Chromium. Hopefully I'm misinformed.

paulryanrogers 3y ago
Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. Ultimately I think we must permanently return to browser ballots back by the law, like the IE bundling fallout. Otherwise friction and incentives will continue to entrench one dominant player.
- echelon 3y ago
  > Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. Mozilla, the browser, is great. Mozilla efforts, such as Rust, have been historically great. Mozilla leadership is currently awful. They focus is on the wrong things - web VR and low-quality foundational AI models. Maybe because they think the web is at risk of disappearing outright. But the true enemy is Google, and they're currently its well-behaved prisoner. Mozilla can't bite the hand that feeds it, but someone needs to point the FTC, Congress, and the EU at Google. Everything they do, buy, and work on is to point an overwhelming majority of internet users at its ad products. Chrome, Search, Android, YouTube, Apple default search engine deal, etc. Google has become inescapable. And that's rather anti-competitive if you're trying to advertise your business or selling ad tech. Nevermind that the web commons and standards are constantly in Google's blast radius for funneling everyone into their gaping maw.
  - runiq 3y ago
    Ya. All I want is to throw moneydollars at the fucking browser, not at whatever feel-good initiative of the month the Mozilla Foundation is coming up with. I don't understand the problem.
  - insanitybit 3y ago
    I can't see how Mozilla could possibly right the ship with their current CEO. If they get rid of her maybe things could improve. Until then, I'd bet on Microsoft/Apple before I bet on Mozilla when it comes to protecting the web.
    - twelvechairs 3y ago
      What has the CEO done? Microsoft and Apple dont have a good history so assuming there is something big here?
      - clipsy 3y ago
        [flagged]
        huggingmouth 3y ago
        She completely and utterly failed at her duties as the organization's leader. That over inflated compensation package that's seemingly inversely-correlated with firefox's userbase and the number of technical roles at Mozilla is most certainly not "earned". I'd personally call it embezzlement or misappropriation of funds, but that's just me.
        junofan 3y ago
        Haven’t heard about that, but even Safari is kicking their ass on desktop market share. I just visited the Firefox download page. It looks like shit. Something’s not going right over there.
        HideousKojima 3y ago
        Or it's that she's taking Mozilla down paths that lead to Chrome dominance in the future, while getting paid a hefty sum that would be better spent funding Firefox development.
        cygx 3y ago
        As far as I know, the Mozilla Corporation is owned by the Mozilla Foundation, which is a non-profit with the mission to make the internet a better place, or something along those lines. So shouldn't we look at the boards of things like the Wikimedia Foundation or the Internet Archive instead of bay area CEOs for comparison? It's also not a particularly good look when your own salary keeps rising while you're laying people off and market share keeps plummeting (in my neck of the woods, Firefox actually used to be dominant at 60%+)... That said, I haven't looked at this in any kind of detail, and all I know of Baker is what her Wikipedia article tells me, which includes writing the Mozilla Public License, managing mozilla.org on a volunteer basis for a while and being instrumental in the creation of the Mozilla Foundation.
  - gochi 3y ago
    Google is set to go on trial in 2024 with the FTC. We'll see how that goes. I don't have high hopes, primarily due to how difficult it is to expect larger reach by adhering to past laws that are quite lenient. At most I can see AdX being negatively affected, but that wouldn't result in the substantial change most want here and would just allow another like Apple to step in and repeat what Google has done. From what I understand, the arguments about self-preferencing kind of always get thrown out due to a more strict interpretation of the law. Did with Apple, and with Facebook when they were acquiring Instagram and Whatsapp.
- jauntywundrkind 3y ago
  [flagged]
  - kmeisthax 3y ago
    The list you linked includes things like: web access for bluetooth, MIDI, and USB devices. These are very fringe use cases that quite frankly shouldn't be accessible from a random website. The rest of these sound like extra bits of fingerprintable entropy here and there. Like, in no way will a website knowing how much RAM I have will improve my experience, but it'll help add a few bits of data to my web advertising fingerprints. Magnetometers and battery status would absolutely be fingerprintable; individual device characteristics would be unavoidably measurable. The page you linked to actually lists all this out, and that should be enough to convince you that these standards shouldn't be implemented.
    - jauntywundrkind 3y ago
      [flagged]
- yjftsjthsd-h 3y ago
  Mozilla gets hate because they say they're fighting for the user and then fail to live up to that standard. People expect Google to try and screw over users, so when it happens nobody is disappointed. I do agree that this results in oddly skewed reactions, but the emotional side makes sense.
  - zirak 3y ago
    How do we define "failure"? Let's say we can measure how much Mozilla fights for the user and put it on a scale: |--------------------| anti-user pro-user Where on the scale is "failure"? Let's say Mozilla is on the M, and Google is on the G: |----G-------M-------| anti-user pro-user Is Mozilla failing? The sentiment I seem to see is that anything short of perfect is failure.
    - hypertele-Xii 3y ago
      It's not about the absolute position on the scale, but the direction of change. Mozilla has been moving towards anti-user for years now.
      - zirak 3y ago
        They went from A to B (exact magnitude of change is of course part of the criticism): |------------B---A---| anti-user pro-user Is Mozilla still, currently, a failure at their job? --- These kinds of discussions are frustrating to me since it feels like we've been dealt a very bad hand. But it's not just this hand, the dealer is firmly set on us only receiving bad hands in any game we play. Like in a card game, this is the only hand that we'll get. What other corporation do we have to push these kinds of values? What other avenue do we have? It's sad that we've come to this situation, but if the choice is the currently perceived-to-be-failing Mozilla and no Mozilla, I pick the failing Mozilla.
        account42 3y ago
        > What other corporation do we have to push these kinds of values? The thing is, Mozilla shouldn't even be a for-profit corporation in the first place.
- benterix 3y ago
  > Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. They get hate only for bad or useless things (like the famous "independent voices") but a lot of love for the actual work being done, especially Firefox Containers, enormous performance improvements etc. I'm using Firefox on a daily basis and just the Containers feature make it so much superior to Chrome.
Gigachad 3y ago
The end result is that DRM and banking sites will just tell you to use chrome to continue. And users will keep migrating to chrome until Mozilla is forced to implement it.
- antod 3y ago
  I dunno about banking sites, currently they seem to be some of the worst out there in terms of caring about modern security techniques. eg SMS 2FA at best, terrible password handling etc. They don't move very fast at all. It feels weird that I'm now grateful for how crap they are.
  - jasonjayr 3y ago
    .... which is why if this web integrity thing gets out, you know the next move they make will be to embrace it.
  - Gigachad 3y ago
    Banking apps seem to be the main users of root detection on android. One prominent bank in Australia doesn’t have a web UI at all and only allows access via app. And I suspect it’s partially for security reasons. The average person is very likely to have malware on their computer, but not on their phone.
    - nfriedly 3y ago
      Funny story: I had to root my phone to get the Fidelity app to work. I installed lineageOS, which is passes the Google SafetyNet check out-of-the-box. So most things just work, including my local Credit Union's app. But lineageOS fails the CTS profile check on my phone. Fidelity checks this after you log in and shows a "For security reasons your account has been blocked..." message. So I had to root the phone to install a CTS profile fixer, and then more hacks to hide the fact it was rooted. After that Fidelity worked, but requested root permission every time I launched it until I figured out how to permanently disable that. Netflix was similar, but not quite as annoying.
    - 3y ago
proxiful-wash 3y ago
If the web integrity and standards depend on coherency and transparency your post does nothing but to miss inform those who know little about the subject.
huggingmouth 3y ago
As far as I know, disabling it in chromium can be as simple as commenting out the last line that returns the verdict. It'll need more work if you don't want to send data to random "trusted" parties, but brave is already doing that stuff anyway. I don't see why it would be that difficult. The issue here is with websites that want to mandate it.
- o1y32 3y ago
  Just so you know, barely anyone in the real world uses Chromium, and compiling Chromium takes hours (I have done that many times). So that's not an argument. Also, if this is ever becomes a standard or a de-facto standard, it probably will be implemented as a proprietary feature, in the same way as Widevine or more closely SafetyNet -- if anyone can easily get around this, there is no point of doing it.
userbinator 3y ago
especially those of us invested in the safety and security (collectively, trust) of the web. Note that "safety and security" has become an abhorrent phrase among many of us because it evokes the "authoritarian dystopia" that Google et.al. are creating --- we're more concerned about freedom and interoperability.
- eganist 3y ago
  What you're saying is all true, but speaking strictly, the security of the web as a whole is endangered if proposals give entities the tools they need to chip away at that freedom and interoperability bit by bit. That was the intention behind my choice of words — representing the whole web, not just components of it or companies operating on it.
Railander 3y ago
That will only happen when people can't do the things they normally could anymore on the browser. I was/am expecting it to happen with manifest v3, as I understood it it would break userscripts and make adblocking a pain, so far it hasn't happened so I still haven't bothered switching off Chrome. Assuming this gets implemented, users might start being unable to access certain websites or services because their identity is deemed "insufficient", which would move them to use a different browser that does not have this.
- yomlica8 3y ago
  My understanding was that manifest v3 implementation was delayed so I'd be surprised if it broken anything yet. It looked to me like the standard blow back management move where they see opposite boiling up so they announce a "delay" and try to sneak it in later when the heat has died down.
zarzavat 3y ago
Brave can very easily disable this. They don’t use stock Chromium.
- grishka 3y ago
  Vivaldi as well. Their stance on these kinds of user-hostile Google initiatives is pretty clear.
sir_brickalot 3y ago
One option is for sysadmins and IT shops serving SMBs to preinstall Firefox on workstations. That way users get used to the browser and might use it privately as well. Bonus: Preinstall uBlock Origin. Thats what we do, anyways.

paulryanrogers 3y ago

Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. Ultimately I think we must permanently return to browser ballots back by the law, like the IE bundling fallout. Otherwise friction and incentives will continue to entrench one dominant player.

echelon 3y ago
> Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. Mozilla, the browser, is great. Mozilla efforts, such as Rust, have been historically great. Mozilla leadership is currently awful. They focus is on the wrong things - web VR and low-quality foundational AI models. Maybe because they think the web is at risk of disappearing outright. But the true enemy is Google, and they're currently its well-behaved prisoner. Mozilla can't bite the hand that feeds it, but someone needs to point the FTC, Congress, and the EU at Google. Everything they do, buy, and work on is to point an overwhelming majority of internet users at its ad products. Chrome, Search, Android, YouTube, Apple default search engine deal, etc. Google has become inescapable. And that's rather anti-competitive if you're trying to advertise your business or selling ad tech. Nevermind that the web commons and standards are constantly in Google's blast radius for funneling everyone into their gaping maw.
- runiq 3y ago
  Ya. All I want is to throw moneydollars at the fucking browser, not at whatever feel-good initiative of the month the Mozilla Foundation is coming up with. I don't understand the problem.
- insanitybit 3y ago
  I can't see how Mozilla could possibly right the ship with their current CEO. If they get rid of her maybe things could improve. Until then, I'd bet on Microsoft/Apple before I bet on Mozilla when it comes to protecting the web.
  - twelvechairs 3y ago
    What has the CEO done? Microsoft and Apple dont have a good history so assuming there is something big here?
    - clipsy 3y ago
      [flagged]
      - huggingmouth 3y ago
        She completely and utterly failed at her duties as the organization's leader. That over inflated compensation package that's seemingly inversely-correlated with firefox's userbase and the number of technical roles at Mozilla is most certainly not "earned". I'd personally call it embezzlement or misappropriation of funds, but that's just me.
      - junofan 3y ago
        Haven’t heard about that, but even Safari is kicking their ass on desktop market share. I just visited the Firefox download page. It looks like shit. Something’s not going right over there.
      - HideousKojima 3y ago
        Or it's that she's taking Mozilla down paths that lead to Chrome dominance in the future, while getting paid a hefty sum that would be better spent funding Firefox development.
      - cygx 3y ago
        As far as I know, the Mozilla Corporation is owned by the Mozilla Foundation, which is a non-profit with the mission to make the internet a better place, or something along those lines. So shouldn't we look at the boards of things like the Wikimedia Foundation or the Internet Archive instead of bay area CEOs for comparison? It's also not a particularly good look when your own salary keeps rising while you're laying people off and market share keeps plummeting (in my neck of the woods, Firefox actually used to be dominant at 60%+)... That said, I haven't looked at this in any kind of detail, and all I know of Baker is what her Wikipedia article tells me, which includes writing the Mozilla Public License, managing mozilla.org on a volunteer basis for a while and being instrumental in the creation of the Mozilla Foundation.
- gochi 3y ago
  Google is set to go on trial in 2024 with the FTC. We'll see how that goes. I don't have high hopes, primarily due to how difficult it is to expect larger reach by adhering to past laws that are quite lenient. At most I can see AdX being negatively affected, but that wouldn't result in the substantial change most want here and would just allow another like Apple to step in and repeat what Google has done. From what I understand, the arguments about self-preferencing kind of always get thrown out due to a more strict interpretation of the law. Did with Apple, and with Facebook when they were acquiring Instagram and Whatsapp.
jauntywundrkind 3y ago
[flagged]
- kmeisthax 3y ago
  The list you linked includes things like: web access for bluetooth, MIDI, and USB devices. These are very fringe use cases that quite frankly shouldn't be accessible from a random website. The rest of these sound like extra bits of fingerprintable entropy here and there. Like, in no way will a website knowing how much RAM I have will improve my experience, but it'll help add a few bits of data to my web advertising fingerprints. Magnetometers and battery status would absolutely be fingerprintable; individual device characteristics would be unavoidably measurable. The page you linked to actually lists all this out, and that should be enough to convince you that these standards shouldn't be implemented.
  - jauntywundrkind 3y ago
    [flagged]
yjftsjthsd-h 3y ago
Mozilla gets hate because they say they're fighting for the user and then fail to live up to that standard. People expect Google to try and screw over users, so when it happens nobody is disappointed. I do agree that this results in oddly skewed reactions, but the emotional side makes sense.
- zirak 3y ago
  How do we define "failure"? Let's say we can measure how much Mozilla fights for the user and put it on a scale: |--------------------| anti-user pro-user Where on the scale is "failure"? Let's say Mozilla is on the M, and Google is on the G: |----G-------M-------| anti-user pro-user Is Mozilla failing? The sentiment I seem to see is that anything short of perfect is failure.
  - hypertele-Xii 3y ago
    It's not about the absolute position on the scale, but the direction of change. Mozilla has been moving towards anti-user for years now.
    - zirak 3y ago
      They went from A to B (exact magnitude of change is of course part of the criticism): |------------B---A---| anti-user pro-user Is Mozilla still, currently, a failure at their job? --- These kinds of discussions are frustrating to me since it feels like we've been dealt a very bad hand. But it's not just this hand, the dealer is firmly set on us only receiving bad hands in any game we play. Like in a card game, this is the only hand that we'll get. What other corporation do we have to push these kinds of values? What other avenue do we have? It's sad that we've come to this situation, but if the choice is the currently perceived-to-be-failing Mozilla and no Mozilla, I pick the failing Mozilla.
      - account42 3y ago
        > What other corporation do we have to push these kinds of values? The thing is, Mozilla shouldn't even be a for-profit corporation in the first place.
benterix 3y ago
> Judging by all the hate Mozilla gets around here, it would be nice to at least see some credit given where it is due. They get hate only for bad or useless things (like the famous "independent voices") but a lot of love for the actual work being done, especially Firefox Containers, enormous performance improvements etc. I'm using Firefox on a daily basis and just the Containers feature make it so much superior to Chrome.

Gigachad 3y ago

The end result is that DRM and banking sites will just tell you to use chrome to continue. And users will keep migrating to chrome until Mozilla is forced to implement it.

antod 3y ago
I dunno about banking sites, currently they seem to be some of the worst out there in terms of caring about modern security techniques. eg SMS 2FA at best, terrible password handling etc. They don't move very fast at all. It feels weird that I'm now grateful for how crap they are.
- jasonjayr 3y ago
  .... which is why if this web integrity thing gets out, you know the next move they make will be to embrace it.
- Gigachad 3y ago
  Banking apps seem to be the main users of root detection on android. One prominent bank in Australia doesn’t have a web UI at all and only allows access via app. And I suspect it’s partially for security reasons. The average person is very likely to have malware on their computer, but not on their phone.
  - nfriedly 3y ago
    Funny story: I had to root my phone to get the Fidelity app to work. I installed lineageOS, which is passes the Google SafetyNet check out-of-the-box. So most things just work, including my local Credit Union's app. But lineageOS fails the CTS profile check on my phone. Fidelity checks this after you log in and shows a "For security reasons your account has been blocked..." message. So I had to root the phone to install a CTS profile fixer, and then more hacks to hide the fact it was rooted. After that Fidelity worked, but requested root permission every time I launched it until I figured out how to permanently disable that. Netflix was similar, but not quite as annoying.
  - 3y ago

proxiful-wash 3y ago

If the web integrity and standards depend on coherency and transparency your post does nothing but to miss inform those who know little about the subject.

huggingmouth 3y ago

As far as I know, disabling it in chromium can be as simple as commenting out the last line that returns the verdict. It'll need more work if you don't want to send data to random "trusted" parties, but brave is already doing that stuff anyway. I don't see why it would be that difficult. The issue here is with websites that want to mandate it.

o1y32 3y ago
Just so you know, barely anyone in the real world uses Chromium, and compiling Chromium takes hours (I have done that many times). So that's not an argument. Also, if this is ever becomes a standard or a de-facto standard, it probably will be implemented as a proprietary feature, in the same way as Widevine or more closely SafetyNet -- if anyone can easily get around this, there is no point of doing it.

userbinator 3y ago

especially those of us invested in the safety and security (collectively, trust) of the web. Note that "safety and security" has become an abhorrent phrase among many of us because it evokes the "authoritarian dystopia" that Google et.al. are creating --- we're more concerned about freedom and interoperability.

eganist 3y ago
What you're saying is all true, but speaking strictly, the security of the web as a whole is endangered if proposals give entities the tools they need to chip away at that freedom and interoperability bit by bit. That was the intention behind my choice of words — representing the whole web, not just components of it or companies operating on it.

Railander 3y ago

That will only happen when people can't do the things they normally could anymore on the browser. I was/am expecting it to happen with manifest v3, as I understood it it would break userscripts and make adblocking a pain, so far it hasn't happened so I still haven't bothered switching off Chrome. Assuming this gets implemented, users might start being unable to access certain websites or services because their identity is deemed "insufficient", which would move them to use a different browser that does not have this.

yomlica8 3y ago
My understanding was that manifest v3 implementation was delayed so I'd be surprised if it broken anything yet. It looked to me like the standard blow back management move where they see opposite boiling up so they announce a "delay" and try to sneak it in later when the heat has died down.

zarzavat 3y ago

Brave can very easily disable this. They don’t use stock Chromium.

grishka 3y ago
Vivaldi as well. Their stance on these kinds of user-hostile Google initiatives is pretty clear.

sir_brickalot 3y ago

One option is for sysadmins and IT shops serving SMBs to preinstall Firefox on workstations. That way users get used to the browser and might use it privately as well. Bonus: Preinstall uBlock Origin. Thats what we do, anyways.