Hacker News Reader

Comment by wlesieutre | Hacker News Reader

Chrome is a trivially easy product to switch off of compared to other Google properties like Gmail and YouTube. Have you tried Firefox recently?

View on HN

ProtonMail has come a long way as a replacement for Gmail as well. Suuuper happy with them, they're really responsive to feature requests and support inquiries. I requested for an iOS feature to choose browsers so I could open all links from PM in Firefox. They had it implemented in a month or something... it a quick fix but that impressed me. hence me shilling here They recently added ProtonCalendar too.

Switching email isn't nearly as friction-free as switching your browser. Not only do you have to change your email in every service you've registered for, you also need to convince your friends and other contacts to use the new email.

It's a year-long project in the minimum:

1: Start up new email (for me it was Fastmail) and preferably get your own domain

2: Forward all mail from gmail to your new account

3: Create a rule that flags messages that are still delivered to gmail, go through them at your leisure and swap to the new address

I'd stress the "get your own domain" part. This is a _requirement_, or you're going to be going through the same pain again in a few years.

Also, make sure you take backups of your old emails every once in a while. Google Checkout should be able to provide those.

What’s the risk of losing your domain from a forgotten renewal?

I would assume most domain registrars send you reminder emails as your expiration gets closer.

There is always a risk of loosing an asset, that includes hijacking. However to reduce forgeting of renewal there is the recipe I have once read here on HN:

Renew your doman for 10 years now, and then every next year do 1 year renewal. If you forget it then you still have 9 years of buffer.

Some registrars let you enable automatic renewal, so in that case the only risk is to keep paying for a domain that you forgot of.

How is credit card expiration handled? Or do you suggest another payment method?

I think they sent me a notification about the expiring card once.

Another alternative is using one that accept recurring payments through PayPal; that way you would have to handle card expiration only with Paypal.

If a domain is important to you, you should have it set to autorenew.

I have all my domains on autorenew, probably many I should have let lapse now, and some of which I have regretted letting go of.

I feel your pain.. I accidentally let my main blog domain go a long while ago when I decided to drop most of the domains I was holding.

Beyond this, I've had a few pretty good ones over the years... right now, I've got about 30 of them, and just keep thinking I should let most of them go.

I've used auto-renew ... but it turned out my biggest risk was actually the expiration data on my credit cards

I loaded up credits at my registrar to last a couple years because of this.

That's we something like PayPal is nice, your cards can expire and be replaced without interruption to automatic payments. And like the email problem, you don't have to go around changing it every couple of years.

If your domain name provider is serious, almost none: there's a transition period (a few weeks) between the expiration date of your domain and when somebody else can buy it again. So if you forget to renew it, your emails stop working and you'll renew it really quickly ;).

Source: it happened to me last month (the provider being OVH).

You'd probably have to really work at it.

Most registrars are going to send you multiple emails leading up to the expiration, when it expires, and after it expires reminding you it expired. You'd have to miss a lot of emails.

And once it has expired, you have (depending on the TLD) over a month of grace period where it's not available for general registration where you can still renew it. You'd have to miss the fact that all of your services were offline for over a month.

I only work with a company who’s team I can actually call. i pay a bit more, but that direct access is great.

It’s actually hard to lose a domain if you have a good registrar. There is 90 day quarantine period even if you cross the renewal treshold. You can also domain lock, which means you need to manually unlock a domain before moving.

getting your own domain might be fine for tech-savvy people, but for the general population it isn't really an option.

The most important change you can make for your email is to own your own domain. Once you own your own domain, changing providers is much easier since it is transparent to the people that email you.

Even if you decide to keep Gmail, you should switch your email to your own domain.

One worry about tying your identity to your own domain, is the security of your identity (aka your domain) hinges on the security of your registrar. If a bad actor can socially engineer their way into controlling your domain, your entire identity is compromised.

Here's a blog post about this nightmare happening to someone: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...

I agree that that would be catastrophic, but I’m not convinced that using custom DNS changes my risk factor. If someone took over <my name>@gmail.com, they could do as much damage as they could by taking over <my name>@<my domain>.

Yes, but there's still an increase in the attack surface - it's a lot harder to convince a registrar to turn over gmail.com than <my domain>, for most values of <my domain>. It's not a deal breaker, of course, but it's something to consider when looking at the risk factor.

If you use an email provider to host your domain's email (e.g. Fastmail, GSuite, etc.), I believe you're actually increasing your risk factor.

The security of your identity will depend on your registrar, your DNS provider, and your email provider.

So, which ones are the good registrars?

I generally trust the major cloud providers a bit more than the companies focused on acting as a domain registrar.

The domain registrars are generally a race to the bottom and focused on "add-on" sales as most people are shopping on price and that's going to reflect in the overall quality of the things that most people don't really notice like, y'know, security and validation.

You don't hear a lot of stories about Amazon/GCP/Azure handing over someone's entire account based on a couple digits of a credit card number and it would be a PR nightmare if they did (hell, look at the flak they catch just for the data that people leave public on their services that ends up released... imagine if they handed it to someone). An active account with 2FA/etc enabled and a secure recovery email is probably safe enough for most people.

Spend the extra couple bucks to register through one of those guys instead of JimbosDiscountDomains.

So use Google or Microsoft to register your domain?

Doesn't that bring us back to the same potential problem though?

I think the idea is to use their "enterprise", paid offerings as opposed to relying on the "free" services that Google or Microsoft offer.

Google, Microsoft and AWS offer registrar services becuase it keeps you in their ecosystem for their higher margin products. THey generally offer competitive pricing for things like doamin registration and don't pull stunts like charging 2x as much for "privacy protection" or the even more dirty tricks like godaddy and other bottom feeders.

I recently trialed hosted email with AWS and while it is very basic it only costs 4/user/month - cheaper than my google apps service. I was also able to register a new domain at market rates and get dns automatically setup (I think?) on AWS as part of the service. Now because I tie my monthly AWS spend with my registrar I'm more confident I can get some customer service as well.

staying inside a vendor's ecosystem for very selective services can actually work out quite well, as long as the seller/customer incentives align and they are relatively commodity services.

No.

The main issue raised several comments up is portability. No provider locks you to only using their email offering/cloud offerings if you register their domain through them. Even if they did, transferring domains is trivial and well-supported everywhere.

As far as any other objections people usually raise around using hosted email and the like, a domain really has no comparable privacy implications in the real world (you're not handing Google or Microsoft a huge corpus on your life). It's also through their enterprise offerings where as long as your bill is paid they're generally not going to have some automated review suspend your account with no reason, and if they did they have actual support you can get in touch with.

This solves basically all of the problems with using an @gmail.com/@outlook.com/etc email address.

Or… use a smaller registrar which actually charges more in order to provide support which you can contact personally. Most (if not all) large registrars are indeed in a “race to the bottom”, but that does not mean that all registrars are.

(Disclaimer: I work at such a small registrar. No, I’m not going to tell you which one; we aren’t targeting the global market, anyway, only our local area.)

Google is great for this because they will never actually let anyone talk to a human in order to apply social engineering techniques ;)

But do you lose your domain if google bans your account?

The requirement is being able to switch email providers, especially google, when they lock your account. You don't secure your flow of email with a domain if that domain is managed by google, too.

So my statement was a total comedic effort not to be taken seriously, I'd never suggest anyone use a company on the basis of terrible customer support. That's what the semi-colon parentheses at the end was meant to signify.

To attempt to actually answer your question, I believe the nature of the governance around registrars would ensure you have recourse to transfer your domain in the case that Google be Google. It might not be slick. I don't know. But, it's unlikely they can override the overarching policies for such things and continue being a registrar.

I think the bigger question is how much work it is to update the DNS servers with your registrar and then change your DNS provider. If google locks you out of your email that you use to manage your domain you could be in trouble...

Sorry, that went over my head.

If you don't use your google account for anything but domain registration, what could they even possibly ban you for?

While I am aware that Google tends to have quite a few false positive account bans, it is one of the most extremely unlikely things to happen, if all you do with it is pay for your domain registration.

I've been happy with Joker and AWS Route 53. I've used Joker for years and years; at the time they seemed sane both technically and as a business, and that's how it still feels. Route 53 is more recent, but it's been solid and reliable for me. And it's been very nice to control it declaratively with Terraform.

I use namecheap which has two-factor authentication, domain locks, and support pins.

I use Namecheap too, but they took forever to add 2FA (it was added a few months to a year ago, maybe?) and I don't have any faith they'll add FIDO2/U2F any time soon.

EDIT: Oh daaamn it looks like they did it! Huh, faith restored. jgc, CloudFlare should follow!

EDIT 2: I'm just full of failures today, CloudFlare supports U2F as well. This is great news all around.

EasyDNS (https://easydns.com), based in Canada has been around for years, and has a good reputation for not blindly actioning DMCA requests (which can be important for some). :)

owning your domain and having control of a domain through a trusted registrar is better than relying on the worlds largest advertising company to manage your digital identity (email), which is offered as a free service, that's subject to a catch-all ToS.

The article is literally about a user who was attacked because Twitter, Facebook ad GoDaddy have bad security, while his Google account was safe.

An isolated fail in 2014 by one vendor, primarily due to poor support processes, is not a convincing argument to keep all digital identities in Google's possession.

There's also the risk of Google shutting down your account because you do something they don't like. This will lead to a similiar outcome and you won't have any recourse.

I think that GP's point is that "safe" is a tricky word to use when your data is in the custody of the world's largest non-governmental surveillance network with a a catch-all TOS.

Google Domains exists.

I know some will reject the idea.. but if Google is your domain registrar, they'll do email forwarding without an extra charge.

I've started using @mydomain where the is the website/service I've registered for... doesn't help with my existing stack though.

You can just do forwarding. I’ve run my own mail service since the 80s, and when I need a google login to work with someone I just create it and forward my mail. When the project is over, just delete it. Easy-peasy.

Unless a client wants to use google docs I‘ve never found an account to add any value anyway. I don’t use google search much any more but when I do it works fine without cookies.

And I try chrome occasionally (it’s needed to use google docs) but it uses too many resources to use as any kind of default. It’s also harder to enforce privacy with it.

I was referring to google hosting the mail service, so no need to diy or pay for another server, and you don't need to use gmail with it.

Oh, ok. In my case some of my servers are over 20 years old, though I run less critical services on them. My newest machines is about 4 months old. My buddy in the rack next to me is a few servers from the same batch as my 20 year old ones. Obviously the most critical stuff runs on the newest hardware but when you’ve had a machine running uninterrupted for a decade or so why mess with it? Annualized cap ex + the op ex is negligible at this point.

As personal servers of course “critical“ is pretty idiosyncratic, though I have used them to start and host various companies overnthe years until it was worth giving them their “own” hardware and identity.

I admit the age of managing a rack full of servers in a colo has largely passed.

Google Docs works fine in Firefox and Safari.

A bunch of features like context menu, many key shortcuts don’t work under safari but do under chrome. Dunno about ffx

> Even if you decide to keep Gmail, you should switch your email to your own domain.

Do you pay for Google Domains, or just have some other thing forwarding to gmail, and gmail configured to send with that as a 'from' address, which I think is possible? What's your advice?

I recall seeing this recently on another HN post, where they had set up a blanket forwarding rule from their Gmail to another email account. Their Gmail later got dinged but the forwarding rule continued to work.

I did that years ago. The only downside is that every 2-3 years some email gets stuck in gmail’s spam folder.

You don't have to switch overnight, i simply forwarded all my incoming Gmail e-mails to my new account, and then reply to all my Friends (etc.) from my NEW e-mail address. That way they will all, eventually, automagically update me in their address book. It worked very well :)

Have to respectfully disagree here...we tried protonmail for ages and it wasn't good. Wet feature adding it sounds like you got lucky but we ask for several features over the course of a year - ranging from simple things such as HTML signatures (that they fully support, they just hide the button on their editor) to more enterprisey user management 2fa enforcement style features and it just didn't hold up in the slightest. No features got added and we ended up going back to o365..for a personal email it's ok though but I wouldn't tout them as responsive to feature requests as this wasn't our experience at all. We were a sma the on their visionary package if that makes a difference.

You can set up forwarding rules and switch gradually. It's pretty much painless.

I have happily paid for ProtonMail for the past couple of years. I moved all my important email (i.e. anything involving money) off of gmail.

I as well. Gmail is now my spam account. Very happy with ProtonMail.

ProtonMail user for years too. And non-tech people who get my e-mail immediately like (and ask about) the protonmail.com domain, which opens up an avenue to discuss privacy and the upside of non-Google products.

I really wish they'd merge this, or implement it themselves (I wrote it, full disclaimer):

https://github.com/ProtonMail/ios-mail/pull/16

As I understand it (and don't quote me on it) they're in the middle of a refactor, so I guess I get it.

I used protonmail for a week, but i got tired of waiting hours and days for some emails to arrive. some we so late the verification links were no longer active. ugh, if only proton mail was up to par with Gmail.

I had similar issues early on but have been happy with Protonmail for the last year or so.

Is there a provider that lets you send emails from free format users on your domain? With catch all addresses the mail goes into my other@domain account. I use a different email address per site. Now with gmail if I want to reply with that account I first need to create it as an alias. If I want to reply from my phone it even needs to be a full account. Is there any way to fix this? Short of using mutt and write the from header myself?

I can do this with fastmail, though fastmail is a subscription (like $5/month? IIRC, mine auto renews every 2 years so not sure). I have my primary email setup as <firstname>@<lastname>.org. If you set your dns records correctly with them, that allows you to use without any ahead of time setup <randomtag>@<firstname>.<lastname>.org. Setting a different tag where I have <firstname> is can be done too, but you need to set those up individually.

replying to emails, I can change <randomtag> to whatever I want.

They also offer random domains that you can setup burners under, though that does involve some ahead of time setup.

Fastmail lets you create wildcard identities like this so you can send from any username at any domain you have with them, but if you are sending from a third party app you usually still need to set up the sending identity in the app itself, which is annoying. The email programs I've tried haven't let me type arbitrary addresses into the 'from' line.

Many programs won't even automatically reply from the same alias the message was received at.

I think most people are never going to choose ProtonMail, but it can be good for people who like simplicity and consistency. I don't need a million bajillion options, "plugins" or "apps" for my web mail. Just show me my emails, let me load attachments, and I'm good. That's why I pay for ProtonMail instead of Gmail. Well, that and all the other reasons to distrust Google.

I'm a paying customer (paid for 2 years upfront), and I only found out after paying that ProtonMail has an incredibly poor implementation of 2FA. All it supports is app-based authentication[1].

No support for U2F (FIDO) keys[2].

No support for sending SMS to phones.

In comparison, my Google account is protected with: (a) three distinct U2F FIDO keys that are stored safely in different countries, (b) three separate phones for SMS authentication (my phone, dad's pone, mom's phone), (c) lastly there's the authenticator app which I rarely use. This is so much more versatile and reassuring that ProtonMail's extremely-mininal 2FA implementation.

Also, ProtonMail has no excuse for not supporting SMS-based 2FA. They can send a SMS to your phone, when you setup a new account -- but for some reason can't do this for 2FA. Despite being a paid service, they trying to save on the SMS charges that SMS-based 2FA would incur?

[1] https://protonmail.com/support/knowledge-base/two-factor-aut...

[2] https://en.wikipedia.org/wiki/Universal_2nd_Factor

Not sure about the other stuff, but SMS 2FA is generally frowned upon for auth.. though obviously they've decided it's fine for the one time setup just as a verification on signup (not used as 2fa in that case, more like crude proof of identity). U2F has been a challenge for everyone from what I've seen.

How does ProtonMail compare to FastMail these days?

I see https://news.ycombinator.com/item?id=18008062 from 2018 where the jury seemed to overall favor FastMail.

I transitioned to FFox myself. I occasionally have to use Chrome for work, and it's nothing I find myself missing. If Chrome is messing up your day, it's really easy to cut it out.

I've found the exact opposite to be true in my very specific experience. Five years ago I used every Google product under the sun, today the only Google product I use at all (even search) is Chrome because it's the only one I haven't been able to replace.

I try Firefox with a fresh install on nearly every major release and I keep it installed as a secondary browser, but I can never manage to use it as my daily browser. For whatever reason, none of my company's (major tech company but not a competitor to Mozilla in any way) internal web pages load in Firefox. No error, no warning, nothing in the console, just zero content. Blank page. I've tried it on two computers with the same result and just nothing. No extensions installed, nothing I've installed on my network or computer to block anything. It just doesn't load anything.

On the other hand I keep Firefox installed because Chrome refuses to load my dev environment with a self-signed certificate. Firefox will let me click "I accept the risk" but Chrome just refuses to load with a self-signed cert.

I'd love to use just one (preferably Firefox) but I guess the web is still hard to get right.

You can bypass the Chrome dialog by typing "thisisunsafe" in the error page.

That's a stupidly hidden way to go about it.

IIRC, the intent is that no one should be doing this and anyone doing it should be at least technical enough to figure out what they're doing and be reminded that it's a bad idea.

And instead many people will just do a Google search for "Chrome [insert error here]" and run the first command they find, while people like me will say "okay I'll just Firefox where I can click past this warning".

For what it's worth I've always been able to click straight through a self-signed cert on Chrome - in fact I just did it right now to log in to something internal. I am a nearly 50-50 split Firefox/Chrome user.

Are you sure you aren't sending HSTS headers that demand the site be TLS in some way?

Also, have you considered the slightly-saner way of doing it, which is making an internal self-signed CA, trusting that internal CA, and then having it sign the rest of your "self dev stuff" certs?

If it was HSTS it wouldn't load in Firefox, would it?

If it was HSTS it would not load in both, with no button to bypass.

If it was not HSTS you can click through a non-obvious button in both.

Well Chrome has no button and Firefox has a button, so...

Yeah, I actually think these sorts of strategies are clever. They're a way to protect normal users without outright barring power users from doing as they wish.

macOS operates in a similar way. I really like how the difficulty increases depending on the task:

• Want to allow one app through Gatekeeper? Instead of double-clicking the app icon directly, right click it and select "open".

• Want to turn off Gatekeeper for all apps? You need to open the Terminal and execute a command.

• Want to turn off System Integrity Protection? You need to reboot your computer into recovery mode and execute a Terminal command there.

Except for those of us who are finding out about it only via a Hacker News comment. As happened with this user, who seems, you know, sufficiently a power user to need that info. Even a "if you know this site to be safe, please read this knowledge base article (link)" and buried in that, amidst all the reasons you shouldn't use untrusted certs, are the instructions.

If you keep up to date with commits on the chromium code repo, you'd see them change it from time to time. For a while it was 'youshallnotpass'.

You probably shouldn't be using an opensource project without at least a cursory glance at the code anyway, especially as a power user.

You're kidding right? You look at every commit of every open source app you use, or that a closed source app is built atop? For me, off the top of my head, that would mean, yes, Chrome, Firefox, the Linux Kernel, Libre Office, Android, VLC...probably plenty more that I am unaware are open source, and that's not even considering the dev tools to do my job. When would I actually have time to have a life?

Exactly. Reading the source of every program you used was certainly possible back in the 80's when the FOSS movement started; but nowadays, with every program being millions of lines of code, it's implausible to get through all that and still have time to actually use the software.

Not to mention background updating. I don't even know when Chrome has updated half the time, unless something stops working.

If you're on OSX/macOS (what a silly rebrand) then if you look in ~/Library/LaunchAgents (and possibly /Library/LaunchAgents and /Library/LaunchDaemons) for any .plist from Google (or Keystone) in there and add

    <key>Disabled</key><true/>

under the first <dict> and then unload each file, e.g.

    launchctl unload ~/Library/LaunchAgents/com.google.keystone.*

The auto-updating stops and stop them reloading after a reboot/logon.

Im not sure a cursory glance at the 25 millions lines of code will do much if you dont already know what to search.

> Even a "if you know this site to be safe, please read this knowledge base article (link)" and buried in that, amidst all the reasons you shouldn't use untrusted certs, are the instructions.

I don't think that's a bad way to go about it either, if it's sufficiently buried.

I'm primarily just thankful there's a workaround, hidden or not, given how many tech companies seem to respond to these things by disallowing them completely.

> I don't think that's a bad way to go about it either, if it's sufficiently buried.

Just put it in the manual. If experience has taught me anything, it's that "normal users" never read the manual.

On the other hand these stupid dialog tricks are why I stopped using Chrome. I'm not an idiot and I know what I'm doing. It's pretty arrogant to assume that I shouldn't be visiting my router's configuration page just because it uses a self-signed certificate. I don't care to set up an X.509 infrastructure at my house, thank you. Please stop mollycoddling me.

Firefox continues to do a good job of just letting me visit the damn website after warning me.

I'm confused - Firefox and Chrome act completely identically to a self signed cert for me. Both let me click through after looking at the cert or expanding a section. I have never been "blocked" by some hidden modal unless the site chooses to be HSTS-enforcing, and in that case Firefox does not allow a clickthrough either.

Both examples on latest current, taken right now:

Firefox: https://i.imgur.com/4VMjDZ4.png

Chrome: https://i.imgur.com/YosvXEu.png

For HSTS, both Firefox and Chrome act identically and do not allow clickthrough: https://i.imgur.com/WPCTep1.png

Youre confused because you're not using Chrome on OSX: on osx there's no "Proceed to <website>" option.

https://support.google.com/chrome/thread/23226743?hl=en

I'm now even more confused: https://i.imgur.com/jl9agwG.png

You’re right to be confused because I’ve never seen a rhyme or reason to it either. I generated a cert using OpenSSL’s command line tools and told Django’s manage.py to use my self-generated cert and it works in Firefox but not Chrome.

It did work in Chrome. And then after an update it didn’t work anymore. I don’t know why and it seems like no one else here does either.

I was literally going to say that at one point that screen didn't look like that, and it appears it still doesn't but only sometimes.

Your router's self-signed cert can be imported into your browser and trusted from thereon — that will also stop any potential attacks from someone pretending to be your wifi ap nearby because I am pretty sure you are not double-checking the cert fingerprint every time you visit the router's admin interface. Provided you were not MITMed once you added the cert in the first place :)

At least Chrome lets you use that trick to bypass an hsts error message. Firefox won't let you.

Reminds me of the default admin password for an app I've worked on... "You should change me."

> No error, no warning, nothing in the console, just zero content. Blank page.

Have you tried disabling the tracking protection, maybe it's mistakenly blocking some JS?

Try sending your company's internal sites a Chrome User-Agent from Firefox. There are extensions that let you do this.

I was doing that but it does break things so you need to remember you're doing it. For weeks I wondered why Slack wouldn't work via my browser until I found it was loading some Javascript only when UA was set to Chrome, and that was breaking something.

Assuming you are on a Windows domain, since they are able to control your Chrome. Chrome uses all the built in Windows settings. Have you check for proxy settings in internet options? Firefox I believe still uses standalone settings, and will need to be configured manually.

Other thing they could be doing is adding certificates to the Windows certificate store, that Firefox does not trust. Though I expect you would see an error about invalid certs in that case.

When I worked at a company Firefox worked then didn’t. I think the web proxy needed to use the company installed cert or some such weirdness:

https://security.stackexchange.com/questions/133254/how-does...

Wouldn't the fact that your company's site doesn't work on Firefox need to be filed as a bug on your site's bug tracker?

You’re assuming I have access to my huge mega tech company’s website’s bug tracker. I do not.

Sure, and I use it daily. But my frustration isn't about me particularly, it's about Google's increasingly hostile behavior. They're the 800-pound gorilla of the internet, and the way they behave affects all of us.

I've been using Fastmail for more than a decade and I don't know why someone would trust something as important as email to a company like Google.

Mailbox.org here. Happy customer so far.

I second the Fastmail vote. I have been a happy user for... maybe 3 years now? A while at least. The web UI on mobile and desktop is second-to-none (I love not having an app) and the spam filtering is as good or better than gmail and the other big players.

My current yearly subscription to Fastmail was about to expire today. Didn't think about it for a second before I renewed it for the third year.

Because when it first was released, they were one of (if not the only) (free) email providers to give every user over a gigabyte of storage. At the time, most email providers only allowed mailboxes in the dozens of megabytes range.

Nowadays, everywhere gives you plenty of space, but for me personally, it’s just been the fact that I’ve been using it for so long and switching is a hassle. I’m sure it’s the same for a lot of other people, and for the majority, they probably also don’t care enough.

Dozens of megabytes?

Pretty sure Hotmail (which at the time was like 20% of all web traffic) was still offering a whopping 2MB of space when Gmail launched. It was only after Gmail came out that they started bumping the quota from where it had been since the mid-90s.

Gmail was a HUGE deal. People were going nuts over the invites.

I am not sure why would one trust something as important as email to any company. Register and use your own domain. Then you are totally free in your choice and switching is no problem

Downvote for expressing reasonable opinion? Google is that you?

I have fastmail bookmarked waiting for me to find some time to switch over my gsuite admin and some cname redirects off of Google's platform. It's definitely past time for me to get a little less dependent on them.

I switched from Pushbullet to Join and one of the hurdle the dev is having is that something regarding push messaging was severely lacking in Firefox compared to Chrome, hence the lack of an extension for it on Firefox.

Do you know any more details about what's lacking?

The only Google product I still use is Android. I won't switch to iOS, that's like cutting off your nose to spite your face. Sadly, the FOSS alternatives do not support Blackberry phones, and for physical reasons I _greatly_ prefer a real keyboard.

Maybe check the Fxtec Pro1:

https://www.fxtec.com/pro1

It has a full QWERTY keyboard and reasonably well working Sailfish OS port.

Interesting, thank-you!

I switched when Google killed of ublock origin in Chrome. Firefox is quite nice these days. I just use chrome for development because I'm more familiar with their dev tools.

I will very occasionally find a site that's broken in Firefox and works in Chrome though.

Check out Vivaldi, never looked back (chromium based so same dev tools, though admittedly I do.my dwv in edge these days just to keep stuff separate)

uBlock Origin isn't killed. Some changes are proposed, however.

It's nerfed into uselessness. Last I checked it's restricted to just url blacklists.

Firefox is actually a significantly better browser on GNU/Linux. Chrome is pretty awful.

I have a firewall appliance at home.

One day I noticed that some of the stuff I blacklisted (mostly ads) started showing up again.

Why? Firefox's new DNS over HTTPS was bypassing all my firewall DNS rules.

> Firefox's new DNS over HTTPS was bypassing all my firewall DNS rules.

A misstep by Firefox, though it was done with genuine intent to safeguard users (as opposed to just being spun that way). Though they've walked it back it still needs to be opt-in or be trivially easy for average users to opt-out.

Firefox’s security is a lot less than that of Chrome.

Firefox gives me much more control than Chrome and that makes it much more secure.

Here is a button. You may now decide if you want to push it.

Hard to quantify, but neither Firefox nor Chrome were compromised at Pwn2Own this year. The sandbox architectures are very similar now. Chrome's still ahead in having a slightly tighter sandbox and already shipping process-per-site, while Mozilla is working hard to catch up on those. Firefox gets a slight advantage from using Rust in some places instead of C++. I'd say Firefox security is still behind Chrome but in practice not by "a lot".

Reply on news.ycombinator.com