5 ms·

This is great. Let's continue: remove pocket, remove hello

hartator 11y ago
I wouldn't mind these two as assumed business decisions. But please stop the hypocrisy. It's just hurting Mozilla image without fooling anyone.
glogla 11y ago
Hello is just few (hundred?) lines of Javascript giving UI to WebRTC. Unless you want to remove WebRTC and that's just stupid.
- ultramancool 11y ago
  Removing registration on Hello servers and WebRTC altogether is not stupid if you give a shit about your privacy, look at the leaks WebRTC provides, local IPs which are great for fingerprinting, real IPs from behind VPN, etc. It's one big gaping privacy nightmare so far, so it's pretty reasonable to have it disabled, until this gets sorted out at least. Fortunately it can be toggled off in about:config easily. Set loop.enabled = false to disable hello, set media.peerconnection.enabled = false to disable WebRTC. If you don't want pocket, set browser.pocket.enabled = false. You can even make yourself one big user.js file to fix the bad ideas that have been added to Firefox lately. Mozilla still has a good thing going for them, and that is user choice. However stupid the defaults get.
  - mhurron 11y ago
    It is getting annoying to have to go into about:config with every release to turn things I don't want off. Off should be default. Let those that want to use these features turn them on if they want. Or better yet, ship a damn extension.
    - ultramancool 11y ago
      It's a real pain, but they want the less sophisticated users to be able to take advantage of all the latest stuff and if Chrome or IE is shipping with it enabled, they have to compete. Well, that explains WebRTC at least. As for the other stuff... I'm a Pocket user, but I have no idea why that needed to be integrated into the browser, seems like an insane decision to me. I hope they got a good pay day out of that. Same as the history based advertising tiles. Sure, it's checked locally, it still seems creepy and annoying... but again, browser.newtabpage.enhanced = false. Unless we lose this level of user choice, I don't see a better alternative. It would be nice if someone would ship some tool to automatically update a user.js file, however, I think many of us have different opinions about what feature we do and do not want enabled in our browsers.
      - mhurron 11y ago
        Off by default lets everyone choose to turn it on if they're interested. It also might clue in Mozillas devs that if they want people to turn it on, a setting in about:config isn't the only place you should be putting the button. Off by default is neither removing user choice, nor is it preventing Mozilla from saying they ship with feature X. It is the right way to present it.
        ultramancool 11y ago
        > Off by default lets everyone choose to turn it on if they're interested. It lets more sophisticated users choose. Less sophisticated users however will more likely switch to a different browser the moment a site doesn't work before poking through settings. I think a better way than a separate setting would be to go in the direction of many software firewalls and present it to the user as a choice when an application requests it as many browsers currently do with the location APIs. This would provide individual domain-level control over what permissions sites are granted by you. I don't know why this sort of policy seems to be restricted only to the location APIs...
        mmcru 11y ago
        are there any popular sites that rely on Hello or Pocket to function?
    - Animats 11y ago
      Right. It's like the "just hit delete" line from spammers, and the invisible "x" boxes to reject "shared" posts in Facebook. Firefox doesn't even predefine some of the things in "about:config" that need to be set to turn off some of these undesirable features. There's IceCat, a GNU fork of Firefox without all the proprietary extensions.[1] It may start getting more traction as Mozilla puts more junk in the browser. [1] http://www.gnu.org/software/gnuzilla/ http://www.gnu.org/software/gnuzilla/
    - Manishearth 11y ago
      You don't have to. Drag it off using the customize button. These things are lazy loaded and wont run until you turn them on. No footprint when they're off the UI (minimal footprint when they are on)
  - pjc50 11y ago
    Does Firefox Hello do registration if you never click the Hello button in a particular session?
    - Manishearth 11y ago
      Hello does nothing until clicked
  - TD-Linux 11y ago
    I agree with a lot of this, but not turning off WebRTC in general. Certainly you should turn it off (or force TURN only) if you're trying to hide your IP behind a VPN. But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. I still think WebRTC enabling peer to peer connections is better than running all of your data through a third party server.
    - ultramancool 11y ago
      > But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. Extremely few people have active IPv6, it seems unlikely to catch on now. In addition to that, IPv6 privacy extensions may allow a solution to this problem for many users, but if their link local IPs are also published that may lead to further trouble, depending on configuration. Remember though, this leaks all interface IPs, I have many virtual machines installed with their own network adapters added to my system, VPN adapters, etc which also leaks data as all of those adapters will have v6LL IPs on them even if they're not in use. Additionally, this issue is already actively being used for fingerprinting. Not some exploit of tomorrow. There was a New York Times advertiser caught doing it a few days ago. > I still think WebRTC enabling peer to peer connections is better than running all of your data through a third party server. Yeah, which is why I encourage disabling it completely. Until either they fix the privacy issues or the value of using some WebRTC application appears to trump them to you.
      - deleted 11y ago
        [deleted]
      - TD-Linux 11y ago
        >Extremely few people have active IPv6, it seems unlikely to catch on now. Except that over 20% of the United States has IPv6 connectivity. In fact, you might be using it without knowing (most mobile providers have it now, in fact some use IPv6->IPv4 translation methods) [1]. >Remember though, this leaks all interface IPs Does it? Maybe you should file a bug so that only routable interfaces and non-LL IPs are used. This does seem like a problem. [1] https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...
- Raphmedia 11y ago
  It's third party features that I will never use.
- deleted 11y ago
  [deleted]
baby 11y ago
Oh please don't remove pocket, this is one of the awesome feature of Firefox along with Tree Style Tab (and if it was just me I would add Tree Style Tab by default as well) (And of course I go against the public opinion here on HN, but I wonder how many people did actually use Pocket before trashing it?)
- chris-at 11y ago
  Pocket had an add-on that was working just fine. The old one even needed less space than the new button and didn't require a cookie. I'd reinstall the old one but "This add-on has been removed by its author".
  - baby 11y ago
    It's debatable but I think something like pocket is fundamental to a 2015 browser experience. The bookmarking system has been bad since its beginnings.
techwizrd 11y ago
Just out of curiosity, how will removing Pocket integration and Hello (a thin UI over WebRTC) personally? Both are lazy-loaded, so the only bloat they add is "visual bloat". This behavior is seriously disappointing from the Firefox community. I've been using Pocket since it was Read It Later and I was pleased to see it integrated into the browser. Mozilla is working on a Reader mode[0] but it does not seem to be ready for public consumption yet (despite landing in 2012). Most people don't even know it exists, and it obviously does not save it for later (unless you bookmark it). The implementation is open-source (MPL license), although Pocket itself is proprietary. Hotword detection is not absolutely necessary for browser functionality, yet I hear no chorus of complaints from Chrome users. Should Mozilla be prohibited from partnering with proprietary third-parties whether or not it benefits their users? Hello is even less of an argument. Firefox Hello is a simple Javascript UI for the existing WebRTC spec supported by Firefox, Chrome, and Opera[1]. It allows people to communicate without having to set up accounts, sign-in somewhere, and works against the platform lock-in of proprietary services such as Facetime, Hangouts, and Skype. If it's disabled by default, the service becomes useless. My parents shouldn't have to enable it about:config for me to talk to them, nor should they have to download another plugin to use a technology built-in to the browser. I understand the security implications[2] in IP leakage[3], but I don't see a simple fix that doesn't neuter the functionality (although this comes close[4]). W3C has stated their position on fingerprinting[5], but at least Mozilla is actively working on the issue. 0: http://www.ghacks.net/2015/02/07/mozilla-starts-to-push-reader-mode-to-desktop-firefox/ http://www.ghacks.net/2015/02/07/mozilla-starts-to-push-read... 1: https://support.mozilla.org/en-US/kb/which-browsers-will-work-firefox-hello-video-chat https://support.mozilla.org/en-US/kb/which-browsers-will-wor... 2: https://twitter.com/incloud/status/619624021123010560 https://twitter.com/incloud/status/619624021123010560 3: https://bugzilla.mozilla.org/show_bug.cgi?id=959893 https://bugzilla.mozilla.org/show_bug.cgi?id=959893 4: https://addons.mozilla.org/en-US/firefox/addon/statutory/ https://addons.mozilla.org/en-US/firefox/addon/statutory/ 5: https://github.com/w3ctag/spec-reviews/blob/master/2015/05/fingerprint.md https://github.com/w3ctag/spec-reviews/blob/master/2015/05/f...
urda 11y ago
1) Open the menu 2) Click "Customize" 3) Drag pocket and / or hello from the tool bar into "Additional tools and features" 4) Take a breather, phew that wasn't too hard was it? https://support.mozilla.org/en-US/kb/customize-firefox-controls-buttons-and-toolbars https://support.mozilla.org/en-US/kb/customize-firefox-contr...
- makomk 11y ago
  For some reason, I keep having to do that - it doesn't stick. And every version brings more unwanted toolbar buttons I need to remove. I'm seriously considering looking into building a version of Firefox with them patched out altogether.
- lamby 11y ago
  Rebutting a claim that the default options are poor by providing instructions to change those settings seems, at best, a non-sequitur.
- stevenh 11y ago
  These need to be disabled by default, and the steps you list should be taken by people who want to enable them. If a masochistic user wants to navigate the labyrinth of dark patterns meant to confuse them into not understanding that the "Additional tools and features" category is also the "completely disabled features that run nothing in the background" category (why would anyone think that, ever?), then they can go ahead and do it. If these things are so great, then I'm sure users would be happy to put that extra work into enabling them. After all, it's 3 simple intuitive steps!
- Excavator 11y ago
  Don't even need all that. Just, right-click the icon and click "Remove from Toolbar/Menu".

I wouldn't mind these two as assumed business decisions. But please stop the hypocrisy. It's just hurting Mozilla image without fooling anyone.

glogla 11y ago

Hello is just few (hundred?) lines of Javascript giving UI to WebRTC. Unless you want to remove WebRTC and that's just stupid.

ultramancool 11y ago
Removing registration on Hello servers and WebRTC altogether is not stupid if you give a shit about your privacy, look at the leaks WebRTC provides, local IPs which are great for fingerprinting, real IPs from behind VPN, etc. It's one big gaping privacy nightmare so far, so it's pretty reasonable to have it disabled, until this gets sorted out at least. Fortunately it can be toggled off in about:config easily. Set loop.enabled = false to disable hello, set media.peerconnection.enabled = false to disable WebRTC. If you don't want pocket, set browser.pocket.enabled = false. You can even make yourself one big user.js file to fix the bad ideas that have been added to Firefox lately. Mozilla still has a good thing going for them, and that is user choice. However stupid the defaults get.
- mhurron 11y ago
  It is getting annoying to have to go into about:config with every release to turn things I don't want off. Off should be default. Let those that want to use these features turn them on if they want. Or better yet, ship a damn extension.
  - ultramancool 11y ago
    It's a real pain, but they want the less sophisticated users to be able to take advantage of all the latest stuff and if Chrome or IE is shipping with it enabled, they have to compete. Well, that explains WebRTC at least. As for the other stuff... I'm a Pocket user, but I have no idea why that needed to be integrated into the browser, seems like an insane decision to me. I hope they got a good pay day out of that. Same as the history based advertising tiles. Sure, it's checked locally, it still seems creepy and annoying... but again, browser.newtabpage.enhanced = false. Unless we lose this level of user choice, I don't see a better alternative. It would be nice if someone would ship some tool to automatically update a user.js file, however, I think many of us have different opinions about what feature we do and do not want enabled in our browsers.
    - mhurron 11y ago
      Off by default lets everyone choose to turn it on if they're interested. It also might clue in Mozillas devs that if they want people to turn it on, a setting in about:config isn't the only place you should be putting the button. Off by default is neither removing user choice, nor is it preventing Mozilla from saying they ship with feature X. It is the right way to present it.
      - ultramancool 11y ago
        > Off by default lets everyone choose to turn it on if they're interested. It lets more sophisticated users choose. Less sophisticated users however will more likely switch to a different browser the moment a site doesn't work before poking through settings. I think a better way than a separate setting would be to go in the direction of many software firewalls and present it to the user as a choice when an application requests it as many browsers currently do with the location APIs. This would provide individual domain-level control over what permissions sites are granted by you. I don't know why this sort of policy seems to be restricted only to the location APIs...
        mmcru 11y ago
        are there any popular sites that rely on Hello or Pocket to function?
  - Animats 11y ago
    Right. It's like the "just hit delete" line from spammers, and the invisible "x" boxes to reject "shared" posts in Facebook. Firefox doesn't even predefine some of the things in "about:config" that need to be set to turn off some of these undesirable features. There's IceCat, a GNU fork of Firefox without all the proprietary extensions.[1] It may start getting more traction as Mozilla puts more junk in the browser. [1] http://www.gnu.org/software/gnuzilla/ http://www.gnu.org/software/gnuzilla/
  - Manishearth 11y ago
    You don't have to. Drag it off using the customize button. These things are lazy loaded and wont run until you turn them on. No footprint when they're off the UI (minimal footprint when they are on)
- pjc50 11y ago
  Does Firefox Hello do registration if you never click the Hello button in a particular session?
  - Manishearth 11y ago
    Hello does nothing until clicked
- TD-Linux 11y ago
  I agree with a lot of this, but not turning off WebRTC in general. Certainly you should turn it off (or force TURN only) if you're trying to hide your IP behind a VPN. But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. I still think WebRTC enabling peer to peer connections is better than running all of your data through a third party server.
  - ultramancool 11y ago
    > But IPv6 already causes you to lose the same amount of privacy as exposing your IPv4 address behind a NAT, so it seems somewhat of a lost cause. Extremely few people have active IPv6, it seems unlikely to catch on now. In addition to that, IPv6 privacy extensions may allow a solution to this problem for many users, but if their link local IPs are also published that may lead to further trouble, depending on configuration. Remember though, this leaks all interface IPs, I have many virtual machines installed with their own network adapters added to my system, VPN adapters, etc which also leaks data as all of those adapters will have v6LL IPs on them even if they're not in use. Additionally, this issue is already actively being used for fingerprinting. Not some exploit of tomorrow. There was a New York Times advertiser caught doing it a few days ago. > I still think WebRTC enabling peer to peer connections is better than running all of your data through a third party server. Yeah, which is why I encourage disabling it completely. Until either they fix the privacy issues or the value of using some WebRTC application appears to trump them to you.
    - deleted 11y ago
      [deleted]
    - TD-Linux 11y ago
      >Extremely few people have active IPv6, it seems unlikely to catch on now. Except that over 20% of the United States has IPv6 connectivity. In fact, you might be using it without knowing (most mobile providers have it now, in fact some use IPv6->IPv4 translation methods) [1]. >Remember though, this leaks all interface IPs Does it? Maybe you should file a bug so that only routable interfaces and non-LL IPs are used. This does seem like a problem. [1] https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...
Raphmedia 11y ago
It's third party features that I will never use.
deleted 11y ago
[deleted]

baby 11y ago

Oh please don't remove pocket, this is one of the awesome feature of Firefox along with Tree Style Tab (and if it was just me I would add Tree Style Tab by default as well) (And of course I go against the public opinion here on HN, but I wonder how many people did actually use Pocket before trashing it?)

chris-at 11y ago
Pocket had an add-on that was working just fine. The old one even needed less space than the new button and didn't require a cookie. I'd reinstall the old one but "This add-on has been removed by its author".
- baby 11y ago
  It's debatable but I think something like pocket is fundamental to a 2015 browser experience. The bookmarking system has been bad since its beginnings.

techwizrd 11y ago

Just out of curiosity, how will removing Pocket integration and Hello (a thin UI over WebRTC) personally? Both are lazy-loaded, so the only bloat they add is "visual bloat". This behavior is seriously disappointing from the Firefox community. I've been using Pocket since it was Read It Later and I was pleased to see it integrated into the browser. Mozilla is working on a Reader mode[0] but it does not seem to be ready for public consumption yet (despite landing in 2012). Most people don't even know it exists, and it obviously does not save it for later (unless you bookmark it). The implementation is open-source (MPL license), although Pocket itself is proprietary. Hotword detection is not absolutely necessary for browser functionality, yet I hear no chorus of complaints from Chrome users. Should Mozilla be prohibited from partnering with proprietary third-parties whether or not it benefits their users? Hello is even less of an argument. Firefox Hello is a simple Javascript UI for the existing WebRTC spec supported by Firefox, Chrome, and Opera[1]. It allows people to communicate without having to set up accounts, sign-in somewhere, and works against the platform lock-in of proprietary services such as Facetime, Hangouts, and Skype. If it's disabled by default, the service becomes useless. My parents shouldn't have to enable it about:config for me to talk to them, nor should they have to download another plugin to use a technology built-in to the browser. I understand the security implications[2] in IP leakage[3], but I don't see a simple fix that doesn't neuter the functionality (although this comes close[4]). W3C has stated their position on fingerprinting[5], but at least Mozilla is actively working on the issue. 0: http://www.ghacks.net/2015/02/07/mozilla-starts-to-push-reader-mode-to-desktop-firefox/ http://www.ghacks.net/2015/02/07/mozilla-starts-to-push-read... 1: https://support.mozilla.org/en-US/kb/which-browsers-will-work-firefox-hello-video-chat https://support.mozilla.org/en-US/kb/which-browsers-will-wor... 2: https://twitter.com/incloud/status/619624021123010560 https://twitter.com/incloud/status/619624021123010560 3: https://bugzilla.mozilla.org/show_bug.cgi?id=959893 https://bugzilla.mozilla.org/show_bug.cgi?id=959893 4: https://addons.mozilla.org/en-US/firefox/addon/statutory/ https://addons.mozilla.org/en-US/firefox/addon/statutory/ 5: https://github.com/w3ctag/spec-reviews/blob/master/2015/05/fingerprint.md https://github.com/w3ctag/spec-reviews/blob/master/2015/05/f...

urda 11y ago

1) Open the menu 2) Click "Customize" 3) Drag pocket and / or hello from the tool bar into "Additional tools and features" 4) Take a breather, phew that wasn't too hard was it? https://support.mozilla.org/en-US/kb/customize-firefox-controls-buttons-and-toolbars https://support.mozilla.org/en-US/kb/customize-firefox-contr...

makomk 11y ago
For some reason, I keep having to do that - it doesn't stick. And every version brings more unwanted toolbar buttons I need to remove. I'm seriously considering looking into building a version of Firefox with them patched out altogether.
lamby 11y ago
Rebutting a claim that the default options are poor by providing instructions to change those settings seems, at best, a non-sequitur.
stevenh 11y ago
These need to be disabled by default, and the steps you list should be taken by people who want to enable them. If a masochistic user wants to navigate the labyrinth of dark patterns meant to confuse them into not understanding that the "Additional tools and features" category is also the "completely disabled features that run nothing in the background" category (why would anyone think that, ever?), then they can go ahead and do it. If these things are so great, then I'm sure users would be happy to put that extra work into enabling them. After all, it's 3 simple intuitive steps!
Excavator 11y ago
Don't even need all that. Just, right-click the icon and click "Remove from Toolbar/Menu".