I really like what Brave is doing. I wish it was built on Firefox instead of Chromium. I just don't see myself leaving Firefox without major upheaval in the browser space.
The last thing the world needs is a predatory vendor trying to force itself somewhere it's not needed. Its non existing market share is the proof.
1. On ESR first time it loads two pages load including
https://www.mozilla.org/en-GB/firefox/60.8.0/firstrun/ https://www.mozilla.org/en-US/privacy/firefox/
You then find first party cookies are set by Google Analytics
_ga GA1.2.1671101194.1567114471 _gat_UA-36116321-1 1 _gid GA1.2.377831647.1567114471
In the EU this would breach the ePrivacy Directive - as there is neither consent or information supplied in advance. Privacy is not just about information captured about you, but about privacy of what you have stored on your electronic devices.
Note: https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... Myth 2: Analytics cookies are strictly necessary so we do not need consent
2. If you then type "privacy" into the address bar, it loads https://www.google.com/search?q=privacy&ie=utf-8&oe=utf-8&cl... directing users into the most privacy invasive service on the internet with no advance warning. I now have a wealth of Google cookies from their search domain, but there are also cookies set for DoubleClick and Adservices.
I'm now enrolled into surveillance capitalism and all I did was open Firefox for the first time, type "privacy" and press enter.
Mozilla talk a lot about privacy, but their products and websites don't live up to the privacy standards we need and if anything they're on the wrong side of the fence when it comes to acting on privacy - they still make things worse and not better; although it has to be acknowledged that they have improved a lot with the tracking protection features that have slowly been making their way into Firefox.
You might find this interesting to read https://twitter.com/jonathansampson/status/11658588961766604...
1. Mozilla only enabled Google Analytics after signing a contract with Google that that data would not be fed into Google's models. There's no reason to believe Google would violate that legal agreement.
2. The Twitter thread you linked is by a Brave employee. It should be judged by the facts it shows, but is good context to keep in mind w.r.t. their presentation.
For Mozilla to use GA instead of self-hosted Matomo is odd to me as a founder of mozilla.org (none are left at Mozilla now, FYI). We do the latter at Brave. Is it just for convenience?
Do you have a better solution? I'm not asking to be glib, I actually want a browser that does a better job of protecting my privacy.
Whilst I have reservations about Brave, from a privacy standpoint they appear to be more trustworthy and some of the actions they are involved with, like complaints to regulators are far beyond anything we've seen of Mozilla - sure they may have corporate motives, but right now they appear to align far better with consumer privacy.
There are forks of Firefox that are trying to improve on delivery of privacy
https://tracker.pureos.net/w/pureos/policy/purebrowser/
https://github.com/intika/Librefox
I am not wholly comfortable using Brave because of its dependency on Chromium, too much of a dependency on a single web rendering engine reminds me of IE days.
I would suggest to anyone, install them both and more, you might love browsing the web in emacs (someone must) - if you find a website that doesn't work on Firefox and you need Chrome, then why not use Brave instead?
Personally I'm trying both, I also bought a Librem Laptop so I have PureBrowser too and I'm not afraid to throw some of my money and inconvenience at products that are better at protecting my privacy: for techies we can all do this with relative ease. For non-techies, which is where we really need the sea of change (and who are unlikely to read this), then we can advise them towards Apple's products and make them aware of products like Brave so it can be their "backup" browser if not their first choice - not perfect, but I'd prefer my family to browse using Safari, Firefox (with privacy settings I have to sit down and sort out for them) or Brave; than Chrome.
There's a lot for me to think about in your post, and most of it I agree with, but I wanted to comment on this bit. While I agree that Firefox has made some very problematic decisions over the years, Brave is far worse in my opinion. My biggest 3 objections are here:
Would you mind inlining your biggest 3 objections? Thanks.
Looking into this only briefly, it didn't take long to find a lot of very questionable decisions made by Brave:
1. They're positioning themselves as both an advertiser and a privacy advocate[1], which strikes me as more of a strategy for bootstrapping revenue than a trustworthy moral position. The entire point of crypto micropayments is to pay for content with crypto rather than attention/privacy. Why should I view Brave's ads rather than the other ads on the internet from advertisers who also claim their ads respect privacy? The fact that Brave has decided to get into bed with advertisers at all shows they're committed to profit, not to users: micropayments are just a way to diversify for Brave, which will quickly fall to the wayside if it fails to provide the revenue they want.
2. The entire concept of a Brave Verified Publisher stinks. It positions Brave as a censor. If this system takes off, then suddenly Brave has control over who gets paid for content on the internet, and can censor content they don't like. And this isn't hypothetical, they plan to do this: their TOS[2] explicitly contains a code of conduct which contains a long list of things they will terminate your account for: they promise to use their power as censors to enforce of US copyright/patent law and also a wide variety of subjective social norms. This also shows their commitment to being an advertiser rather than an application that serves users: if you're serving users then you let them pay for the content they want to pay for, but if you're serving advertisers, then you can't let advertisers brands be seen as supporting questionable content.
3. BAT based in Ethereum seems to be basically a way to ride the wave of cryptocurrency hype while still positioning themselves as a central authority/middleman. If they weren't trying to position themselves as a middleman, they would just make the micropayments in Ether directly, or better yet, in a cryptocurrency that doesn't have a history of forking the blockchain to fix an bug in a major users' contract[3]. If they weren't trying to ride cryptocurrency hype, they'd just allow micropayments via a much-simpler-and-more-reliable REST API or similar since they're already the central authority anyway.
I don't think we can trust Brave with our privacy or attention. I don't think we can trust Brave with the decision of who gets paid for content. I don't think we need Brave as a middleman to pay content publishers. I don't like the state of how content is paid for on the internet, but I don't think Brave is the solution.
It's disappointing to me that Wikipedia has decided to associate their name with Brave's. A big part of why I respect Wikipedia is their long-standing policy of keeping independent from advertisers, and it seems naive of them to have not realized that Brave is an advertiser. I can understand why Wikipedia has made this decision, but I still think it is a compromise of Wikipedia's values, and I hope they'll reverse their decision in the future.
[1] https://brave.com/brave-ads-waitlist/
[2] https://brave.com/terms-of-use/
[3] https://www.coindesk.com/ethereum-executes-blockchain-hard-f...
1. Ad spend last year was over $100M in the US alone, ~$300M globally. Heading toward $1T globally. Users subscribing or paying out of goodwill won't cover this if we block it all and corner the market. We are doing anonymous and private ads (also donations and subscriptions, note well), no conflict with user in data or revenue share. Read my comments here, e.g., https://news.ycombinator.com/item?id=20841558. For you to claim a conflict, you have to show we make more than the user, cheat the user, or somehow steal or leak data to our advantage.
2. We are in the middle phase of a multiyear roadmap, where the last phase will distribute domain verification to many oracles, if we can't bake it into validators on-chain. If you know of an existing blockchain solution, please lay it on us. Also for handling OFAC and other KYC regulations (where we use Uphold today). We cannot intermediate ad revshares, and no blockchain today can either. We do not censor, our test for domain ownership or channel control is objective. If you think we won't get on to phase 3 of our roadmap, fine -- but don't use your speculations as if they were facts.
3. Here is a chart from end of 2017 showing relative volatility. BAT was 2nd least volatile above USDT, we beat Bitcoin and Ether. But we also have other advantages via BAT, including our user growth pool. If you discount that then you are arguing we should find a billionaire to replace it with Ether out of the grace of his or her charity. Who might that person be? Your argument here is cheap unless it's you.
https://twitter.com/woonomic/status/942921951252709376
I don't find these to be objections based on reason so much as misunderstandings or hostile speculations that we will fail. You aren't required to agree with us, we're not imposing any system on you. If you don't like BAT, just use Brave with its default settings. If you don't like Brave, there are lots of other browsers. If you have rational arguments against any bug or design flaw in our intentional work to replace surveillance with privacy tech for donating and advertising, I'm all ears.
A "conflict of interest" doesn't necessarily imply that you've done anything wrong yet, it merely says that the incentives are strongly in favor of you doing something wrong. In my experience, that means that when the cards are on the table you will do the wrong thing, not because you're a bad person or anything, but because you don't want to give up your funding and business.
It may just be that making a lot of money and serving users are fundamentally incompatible. And anyone who actually wants to prioritize serving users over making a lot of money needs to at least be open to that possibility. I really hope they aren't incompatible, for both your sake and mine--I'd like to be rich as much as anyone.
2. This is a non-reason. Domain ownership is already verified by certificate authorities, and there's no reason anyone should trust your centralized authority more than CAs centralized authority. In the very best case, where you do exactly what you're claiming you're going to do and allow other oracles, you've pointlessly reinvented CAs. But you haven't gotten there yet, so right now it just looks like you've created a CA system where you're the only CA, which is objectively worse.
If you want a blockchain solution, fixing the bugs in Namecoin[1] would be a start, although admittedly that technology has yet to play out in practice. It's possible a similar system could be implemented on top of BAT. The difficulty here is that you'd be reinventing the DNS system in tandem.
Let's be clear here, your TOS says you can censor people based on subjective criteria.[2] So if you claim "we do not censor", why don't you say that where it's legally binding?
3. So if you're arguing volatility is the issue, why didn't you just use USD? If you needed funding--again, that's your problem, not one users care about. You don't get a free pass on technology decisions that harm users just because they helped you get funding.
I am genuinely sad that corporations have proven themselves untrustworthy so many times that I can't trust you. As I've said elsewhere, you seem like a decent person with good intentions.
[2] "As a condition of use, you promise not to use the Service for any purpose that is prohibited by the Terms of Use. For purposes of the Terms of Use, the term “Content” includes, without limitation, any information, data, text, photographs, videos, software, scripts, graphics, and interactive features generated, provided, or otherwise made accessible on or through the Service. By way of example, and not as a limitation, you shall not (and shall not permit any third party to) take any action (including contributing any Content) that: would constitute a violation of any applicable law, rule or regulation; infringes any intellectual property or other right of any other person or entity; is threatening, abusive, harassing, defamatory, libelous, deceptive, fraudulent, invasive of another’s privacy, tortious, obscene, offensive, or profane; constitutes unauthorized or unsolicited advertising, junk or bulk e-mail; contains software viruses or any other similar computer codes, files, or programs; or impersonates any person or entity." -- quoted from https://brave.com/terms-of-use/ , note that later it says, "Brave may terminate your access to all or any part of the Service at any time if you fail to comply with these Terms of Use, which may result in the forfeiture and destruction of all information associated with your account."
I’m aware of Namecoin, whose Wikipedia page says
“A 2015 study found that of the 120,000 domain names registered on Namecoin, only 28 were in use.[12]
Onename co-founder Muneeb Ali on 12 September 2015 at the Blockstack Summit 2015 stated that the Namecoin network is not decentralized and the mining group Discus Fish controls 60-70% of its hashing power.”
I was at the 2015 Blockstack Summit and can vouch.
I already noted we will distribute if not decentralize publishers verification. Namecoin can’t do YouTube or other UGC accounts, as we do. Handshake might pan out for domains, we are in touch. In our current Gemini phase we have to comply with laws, but we won’t kick out or unverify a site or channel based on legal content it hosts. Our rep would be trashed if we did.
This may be where we part company. I’m well aware of conflicts of interest and the difference between intentions and outcomes from Mozilla and prior experience. Brave nevertheless has put its reputation at stake, with open source and incremental work to decentralize as much as possible. We may fail for lots of reasons, but going bad and trying to steal from our users is highly unlikely. It would be quickly defeated. This is by design.
Come to think of it, I would expect the same move from Apple as well, on Safari.
Presumably, the real problem is that this would be against Google’s terms of the agreement between google and. moz, but - at least technically - there is no reason to throw away access to google if that’s seen to be a desirable default.
Of course - I’m guessing that google is gonna add its own tracking variables to URLs, so any search result returned by google really is going to be suspect regardless of what we do.
It's nothing but opinionated. You can't honestly call this a "fact" and go on to claim that HN is hypocritical. That's... is there a word for hypocrisy about hypocrisy?
(The first point made is not even that bad, it's just that quagmire following it which dilutes the whole thing)
So the fact here is that Mozilla made that choice to be in bed with Google.
The sad irony is Chrome on Android will insist on asking users for the default search engine choice (in the EU at least https://www.techspot.com/news/81273-google-android-users-eur... ).
Maybe think about it another way. Imagine Greenpeace defaulted to offering to book supporters private planes to get to every protest. It is this nature of extreme distance from organisational values that Mozilla is expressing when it defaults to Google search.
This isn't that hard (except for doing without the big bucks, which is hard: Brave is building up small revenue to large, not profitable yet -- again, we pay the user >= what we make, 70% of gross revenue for user-private ads, 15% for publisher partnered ads [not yet launched]).
They just want the Google $$$, privacy be damned.
I commented in another thread. This is one area where Mozilla has failed. It should have been the goto engine for projects like Electron or Brave or even MS Edge instead of Chromium. But the last time I looked Mozilla was not very friendly towards developers who want to use their engine.
I don’t know if FF has changed in this regard but it takes a long time to get rid of a perception of poor performance and this should have been their first priority long ago (which seems to be the case with their Rust work and GeckoView/mobile preview browser). In addition to how far they were behind Chrome security wise for so long, such as isolated tabs.
But I agree, this should have been Mozilla's niche that they owned. Owning the early adopters is critical to mainstream success IMO. We're the ones that regular people listen to when making tech choices.
Curious: what are some of the shortfalls you see in Chromium?
Before I joined Brave, the desktop browser was originally using Gecko (from Firefox). Ultimately, there were some problems and the decision was made to move to Chromium. On iOS, Brave is forked from Firefox though
You can check out more detail on Reddit where folks asked why FF was not used (which has links to more detailed info): https://www.reddit.com/r/BATProject/comments/9jpqde/brave_br...
That it's a Google-controlled project. Seriously, that's it. I have no reason to believe Google has my best interest at heart.
Don't turn that around and say "Oh, you think Mozilla is looking out for you?" because I don't. I just trust Google less.
The question you should be asking is whether you trust Brave to vet the source code and remove anything that seems like a problem.
Brave is (and you are) saying I should trust Brave because they're going to rip out Google's tracking and insert their own instead. No thank you. I'll stick with Firefox and whatever chicanery Mozilla is up to.
Brave Ads are opt-in and client-based. There is no server side tracking of users or data in the clear. I can say more on how all this works, but I will pause here. Search for "catalog" elsewhere to find another comment explaining it a bit more.
The page goes over (high level) how the project is built and links to patches where functionality was disabled or modified (ex: proxied, etc)
I would trust a closed source project that has been thoroughly and extensively vetted by a third-party auditor I trust far more than an open source project that has no audit for me to reference.
As I am not a professional security auditor, my ability to understand the minutiae of developer decisions (intentional and unintentional) in some multi-million-LOC project is basically a limit approaching zero. My looking at the source code to give myself a false sense of security would only increase my risk, IMO.
It's like a restaurant tells you "yeah we have a clean kitchen, you can go take a quick look yourself!" and it's like, do you know to check that water and disinfectant buckets can't be within x feet of each other? To temp every fridge and warmer to ensure no danger zones? To monitor glove usage and hair net usage? And a thousand other things?
Being open source basically means that a nice auditor could do some audit work for free to help the community, but that's about it from my perspective.
Unless some of you are actively code reviewing the entirety of Chromium prior to launching any build of it ???
LetsEncrypt is an example of a non-profit open source based CA.
Before you could argue that the open source Chromium was largely immune to Google's various small bad behaviours, but when they make such a large close-minded move, at a certain point you can't keep supporting the platform as a whole when they are so hostile to the open internet. Even if it's indirect support.
Also, it can't be ignore that Firefox's recent move towards parity with Chrome has played a big role in giving people the option to even switch.
You mean the platform that specifically disallows competing browser engines, making Firefox just a shell over a Safari-enabled web view and that can't even access Safari's content blockers? The only Firefox that's not running a Firefox engine under the hood? That Firefox?
Given you're a developer for Brave, it's not possible for you to not know this, therefore your statement is misleading at best.
The pitfalls of Chromium are obvious... it gives Google the power to impose on the market whatever engine feature they want, they are the ones defining the web standards and there's nothing Brave can do about it because Brave does not have the capacity to maintain a full fork, or to fight for web standards, just like it doesn't have the capacity to build a browser without piggybacking on somebody else.
Don't get me wrong, nowadays even Microsoft admitted total defeat, but then Brave should recognize its total dependence on Google and its continued goodwill.
We do have upstream contributions to Chromium. Nowhere near as many as Microsoft (we may only have a few), but we do try to contribute back when possible
What do you mean? Brave is based on Chromium, which is open source. Google can't stop people from using it.
(Disclosure: I work for Google)
[1] Your categorization doesn't match what I've seen. Microsoft has been driving substantial changes as Edge moves onto it.
Basically, you guys are in a weird space where your decisions aren't looked at purely from a technical lens, but also an ideological one.
But don't let browsers pretend to be neutral runtimes for the terrible third party scripts on which surveillance advertising depends. They are not neutral. The big-4 browsers in the west apart from Apple are partly or fully captured by $100B ad businesses.
We are all in a weird space. Best to fight back at the endpoint with the right browser. Could be Safari, Firefox, or Chrome with opt outs and uBO and other defenses (but risks remain in Chrome especially), if you are not game for Brave.
In my mind, considering the push you’re making, you’d validate that vanilla chromium meets the requirements to achieve said push. If it didn’t, it’d be a non-starter and you’d have went a different route (leveraging aspects of Firefox’s stack maybe if, again, it met requirements).
but they don't anymore ? So if someone lives and breathes policeman life and then becomes a drug dealer, is it just like buying drugs from a policeman ?
Chromium without Google tracking is dominant, this is just a fact (it will change some day; not soon). The best way to counter this is not to die on the wrong hill (engine wars) right now -- it is to go a level up and fight for privacy and user sovereignty where Google cannot defend: blocking all tracking, paying users 70% of user private ad revenue.
This is a spreadsheet I'd be interested to see. Was this compiled before or after Firefox supported WebExtensions?
IE was also free as in beer.
We don't do third party ads. We block third party tracking which takes out third party and most first party ads. We also block fingerprinting, cryptomining, and other threats.
Are the ads hosted by the websites your users visit? If not, they're third-party ads, with you being that third party.
> Lotta green handles fibbing about us here.
Oh don't worry, I'd make the exact same comment from my other (non-green, thousands of karma) profile, I just like to occasionally switch aliases.
If you insist on a reductionistic definition that rules out anything other than a static ad on the same site as the publisher, you will get stuck trying to improve the Web and how it is funded. I understand objecting to all ads other than static images that click through into same origin forms, or whatever, but that won’t pay the bills for most publishers.