The Brave web browser is hijacking links, and inserting affiliate codes | Hacker News Reader

The Brave web browser is hijacking links, and inserting affiliate codes

davidgerard.co.uk

592 pointsdavidgerard361 comments

I'm surprised people are surprised by this. Brave have said from the beginning that this is how their business model works. What I'm even more surprised about is that Brave has gotten any traction at all, as there is really no reason to use it instead of a normal browser with regular ad blockers.

> Brave have said from the beginning that this is how their business model works.

This sounded like a pretty surprising claim. I looked at the terms of use (https://brave.com/terms-of-use/) and the privacy policy for the browser (https://brave.com/privacy/) and I wasn't able to find any reference to the notion of automatically inserting affiliate or referral links. Do you have a more specific source on this? I'm really curious about when and how this has been communicated. I'm not trying to accuse you of anything, I just want to make sure I'm understanding the situation correctly.

The substance of their business model has always been "we fight advertisers because money should flow to websites through us". They changed actual terms a few times when called up on their tactics being shady, but that's always been the end goal. In that framework, hijacking referral links is par for the course.

I don't blame them - a man's gotta eat, and they're not doing anything illegal or dangerous - but I've always found very curious that some people actually believe using Brave might be an "ethical" choice. It just isn't, it's simply a better mousetrap.

> they're not doing anything illegal or dangerous

The words "dishonest" and "rent-seeking" come to mind. Also, it seems that using affiliate links without disclosure might actually be illegal.

That’s exactly how I feel about it. I’ve never doubted the legality, some pretty shocking things can be defended in TOS, but it just feels dishonest and scammy.

I would be surprised if inserting affiliate links in this manner wasn't against the TOS of the site. It's not adding value for the site if Brave is just front-running people who have already decided to go there.

Brave and Binance have a preexisting business relationship. Brave uses its own crypto funny-money and I think they even integrated a Binance-monitoring widget into the browser.

This is how much Binance stuff is already built into Brave:

https://github.com/brave/brave-core/search?q=binance&unscope...

Yikessssssssssssssssssssssssssss

Brave is really not solving any problem. People that truly want ads removed so they don’t get tracked or bothered, should simply install Firefox. It’s a brilliant browser regardless, and being developed and supported by a non for profit with a proven track record is what makes it trustworthy.

Brave can’t compete with that and Eich is not somebody anyone should rally behind in respect to ethical choices, or moral example. His personal choices to support legislation that will deny basic human rights from the LGBTQ community is a BIG clue.

>His personal choices to support legislation that will deny basic human rights from the LGBTQ community is a BIG clue.

Personal views legitimately expressed in totally distinct political matters should absolutely not be factored in.

Attempting to deny rights to an entire class of human beings should not be classified as simply “personal views legitimately expressed.”

I still fail to see how it's any different than any other moral disagreement. eg. If I were a evangelical christian, and he supported abortion rights for women, I can claim that he's literally trying to kill babies.

Right to happiness is not a moral question that needs to be debated every time someone on Fox News needs to generate mass hysteria for profit. I think the average person can differentiate between what’s moral and what’s immoral and where are the boundaries between the two. The USA is in a complete meltdown because some still insist on staying blind.

But you're describing what a large subset of evangelicals actually do, so that doesn't really help your point.

Is it fair to call an action which materially supported oppression of people "personal"? The goal of that action was to deny people the right to marry.

From a privacy perspective, Safari is pretty good too.

"non for profit with a proven track record" is not how I would describe mozilla.

> His personal choices to support legislation that will deny basic human rights from the LGBTQ community is a BIG clue.

Marriage is not a human right.

> Marriage is not a human right.

Even if it wasn't (the UDHR says it is, and the US Supreme Court has for quite some time held it to be a fundamental right), equal protection of the laws is also widely held to be.

The UDPR also says that it is your right to be arrested in order to be educated (oh hey, it is a human right for the detainees at the Xinjiang camps to be re-educated!). I can't consider this document as anything other than a joke.

> equal protection of the laws is also widely held to be

I am not against equal opportunity for both homosexual and heterosexual couples, rather, I am just anti-marriage. I think that it would be better to just remove any government support or acknowledgement of heterosexual marriage rather than make homosexual marriage official.

> The UDPR also says that it is your right to be arrested in order to be educated

Not sure what the UDPR is, but the UDHR, which I referenced, certainly does not.

I meant UDHR. Check article 26.

I have read it. It unsurprisingly does not say that it is your right to be arrested in order to be educated.

You did not do a good job at it then.

> Elementary education shall be compulsory

In addition it contains a lot of other crap that is not relevant to human rights such as "Education shall be directed to the full development of the human personality ..." or "Everyone has duties to the community in which alone the ..."

So education up until about age 12.

That doesn't sound like it has any connection to detainment camps to me.

> So education up until about age 12.

Where did you get that from?

You can believe it, they are really good at advertising and marketing. They know the arena very well. Ad Ops is their biggest dept, if I had to guess. Everything they do is intentional with an end goal of getting a market share of the ad industry. It’s huge. They want a piece of it, and you’re right, who can blame them.

Vivaldi works too...

https://vivaldi.com/download/

Collecting sh*tcoins is a reason for a lot of the crypto people. Also many many people put brave download ref links all other their web-presents to generate revenue. Even people who do not use it and openly admit that, still gladly collect the bucks form other downloading it. The whole ref thing is the classic ponzi and it always works for a while because people do whatever you want if the work/reward ratio is good.

To your point, they are collecting contributions for URLs that are not signed up on the platform. When I heard this I checked a few of my publishing URLs and sure enough they are accumulating ETH/BAT without me doing anything.

I know a while back, Tom Scott got pretty annoyed with them for collecting money for him without telling people that he wasn’t on their system

You can get paid for using the browser by being shown replacement non-targeted ads. Although it's a trivial amount.

Ah, the cornerstone of trickle down economics!

“If you buy into the idea I’m super important, lift me up unreasonably, I’ll pay you back pennies on the dollar!”

It's more profound than that; as I've pointed out on HN a few times, despite what you may think, advertisers don't make that much from you. The problem with the whole "pay people to watch ads" or "share the ad profits with people" plan is that there isn't anywhere near enough money in advertising to make it worth while. We're collectively selling out our social media for an outrage factory, our entire news industry for clickbait, our privacy for everything we do online, and all the second-order effects of all that and more for on the order of $50/year. I worked out the numbers for Facebook once: https://news.ycombinator.com/item?id=19459604#19462402

Aggregated across all of humanity it's worth it to spending millions of dollars to pick up a few more fractions of a penny per person, but if you try to "share the wealth" it just isn't nearly enough.

Perhaps such platforms aren't necessarily about selling advertising. Gold mine for big data analytics though!

The numbers I made come from basic division on the money made by Facebook. No matter how they make it, unless they're completely hiding it from Wall Street, my numbers account for it.

Does anyone use Brave on the desktop? I thought Brave was only relevant on mobile, since mobile Chrome doesn't support extensions, and for some reason unknown to me people don't want to just use Firefox there.

Unless something's changed recently, Brave mobile doesn't support extensions either.

No, but Brave has adblocking built in.

Kiwi Browser does support extensions. It's what I use.

Brave starting this month will support extensions on mobile.

https://www.xda-developers.com/brave-browser-android-dev-wou...

https://twitter.com/SergZh_/status/1262885174590791682

Good info, thanks for the links.

> for some reason unknown to me people don't want to just use Firefox there.

Initial loading of webpages on Android Firefox is very slow compared to Chromium browsers.

Not in the new versions. Firefox Beta has a new rendering engine that is as fast as Chrome. Soon they should release it into the stable, but beta has never given me any issues.

I use it on desktop primarily and have earned ~$40usd with the rewards program so far. You can import your Chrome account and use chrome extensions in Brave, it's basically a faster version of Chrome to me.

You earned that in how long?

Since late last year when I activated Brave Rewards (make sure to opt-out of auto-contributions to keep your BAT)

Firefox Beta works great and is as snappy as chrome and has built in ad blocking (but you have to turn it fully on on your own). I use it and it works great. Give it a try if this situation is weening you off brave.

I use it on iOS because its an easy solution for ad-blocking. Is there a good ad-blocker for Safari on iOS?

I use Ad Guard and it works!

I use 1blocker but its a paid one - there are a bunch of free ones as well but I got bored working out which ones were scammy and 1blocker (at the point in time I started using it) seemed not to be scammy.

I use 1Blocker on iOS and MacOS safari, which is great but costs 5$ a year. There is no full port of uBlock to safari at this time.

I used to use 1blocker, but switched to Wipr after 1blocker started charging yearly or whatever. Also, firefox focus is a free ad blocker on iOS.

I'm a huge fan of 1Blocker and I'm glad they charge $5 a year and it's someone's full time lifestyle company.

I've had a few content blocking apps on iOS and they've all been abandoned (or worse sold to ad companies).

1Blocker so far has stuck around and stayed high quality.

Ad Block fast is open source & no $

https://apps.apple.com/us/app/adblock-fast/id1032930802

There are many, Safari actually has extensions on iOS, there are no shortage of adblockers in all shapes and sizes.

Even Firefox has one.

Personally I use 1Blocker across iOS and macOS.

There's no uBlock (assumedly Origin) port to iOS, because browser extensions are not permitted on iOS, and they don't allow other browser engines so every alternative browser is a Safari skin. You can't just install Firefox to get around that restriction.

IOS does have native content-blocking, which is reasonably effective but nowhere near uBlock Origin. It's similar to the manifest v3 stuff where Google is castrating Chrome. And yeah there are tons of them available for free, which makes sense because they're all just using pretty much just using Easylist[1].

[1] https://easylist.to/

I’ve become a fan of NextDNS.

Same here. I really like NextDNS because you can adjust it such that it also blocks network traffic inside apps.

adguard - free and open source content blocker. you need to pay premium to add custom lists, but their built-in lists are good enough that I don't need it. manually entered filters are also supported.

if you use apps, it might also make sense to get a VPN based adblocker.

AdGuard Pro adds DNS-based blocking via VPN, in addition to browser content blocking. It also logs tracker requests. The DNS-based blocking works on all apps, afaik.

A really robust option that will work on all of your devices is to setup a remote Pi-Hole and access it via VPN. (This last point is very important and I learned the hard way after my publicly available Pi-Hole instance was discovered and used for DNS amplification attacks.)

https://docs.pi-hole.net/guides/vpn/overview/

I recently went on a journey of setting up a pi hole. I eventually gave up and set up NextDNS instead. I didn't want to have to use a VPN for everything.

I was previously using Adaway on mobile. I think NextDNS produces the same result.

Firefox Focus is a good ad blocker for Safari, you just have to turn on ad blocking integration.

I use Brave because it's a "degoogled" Chrome. Having good blocking built in is a plus. Being able to use Chrome extensions is also a plus.

I've tried Firefox many times over the years, and only recently has it gotten to a point where it's fast and nice enough on macOS. There are still corners of the app I dislike (it doesn't always feel like a native app, for example), but this may be a reason to finally switch.

Same here but edge is offering the same on desktop so im switching. For mobile, brave is my daily driver.

Check out vivaldi. Edge will have various phone home random messages to Microsoft to let them know what you're doing.

Interesting. Ill have to update pihole to put a stop to that

Vivaldi is another Chromium based browser, although it's closed source.

Firefox was getting much better for a while right after the Quantum release, but recently it has fallen way behind.

I came here to suggest Vivaldi. I’ve been using it for nearly two years as my primary browser. It’s not perfect, but no browser is. However, it’s the only browser I’ve found that treats It’s users like an adult and lets them setup the browser the way they want.

Vivaldi is the true successor of Opera, more so than the Opera we have today.

Opera is run by some random company but Vivaldi is developed by the original Opera developer.

But Opera is still useful because it has a VPN (proxy really) built in so that you can reach sites blacklisted by various public Wi-Fi access points.

It's the one I used. While people complain it's not open source, it's about 99.9% viewable from the point of view as source code.

I have Brave installed for the exact same reason. I usually use Firefox or Safari for most web browsing, but unfortunately some web services requires me to use Chromium-based browsers (e.g., Paperpile).

I used to have Chrome installed for theses situations, but so many factors made me want to use Chrome less and less to the point that I simply didn't want to use it at all, even for rare occasions. For the curious, here are my reasons:

1. Deprecation of APIs that are essential for uBo

2. Phone-home features

3. Non-standard APIs (remember FIDO U2F, anyone?)

4. Constant bashing and name-calling of other browsers that doesn't implement their favored APIs (names like "the new IE")

5. Websites constantly badgering me to use Chrome

Using Brave on rare occasions is a good compromise for me. It has some weird crypto stuff, but it allows me to use an degoogled version of Chromium. I also don't have to worry about it being a vastly insecure fork like some browser forks out in the wild.

Vivaldi and the new Edge are other choices that impersonate Chrome using Chromium. If you can't stand Firefox they may the next best choice.

Vivaldi is my pick thanks to its flexibility and recently added built-in ad-block

In many cases when a website 'requires' chrome it's just because the devs were too lazy to test it in other browsers and copied the snippet that asks for chrome. I usually just switch my user-agent in Safari dev menu to chrome and the site magically starts working.

Just use Ungoogled Chromium. Why suffer rent seeking crypto shenanigans?

Last I checked, Ungoogled Chromium did not have self-updates, and installing Chrome Extensions was a bit of a chore without a special extension.

You can install extensions normally with a regular Chromium and then uninstall it and use the ungoogled.

That's quite a bit of a chore. Are those extensions ever going to update themselves when there's a security vulnerability?

Not sure if having to use an extension is a dealbreaker for you but this one allows you to

1) Install extensions from the Chrome web store

2) Update them

https://github.com/NeverDecaf/chromium-web-store

Automated updates on Windows. That said there is no shortage of Chromium forks with auto update these days.

Why would you trust those random forks? I only use Chromium from authors who have been around for a while.

> Automated updates on Windows.

So, if you want a Google-free Chromium with that...Edge?

I always figured that Edge was meant to be an ironic name.

I've been using Brave for this reason too on desktop. I installed opera for the first time in years last week, very nicely surprised. Fast, chrome based browser. The extension bar on the left is a useful add-on. I'll be removing Brave after this news and be using Firefox mainly, with opera as my 2nd browser.

Consider Vivaldi too. It is closer in spirit to the original Opera IMO.

Both are closed-source, also Opera now owns by Chinese company, which is minefield for privacy.

https://otter-browser.org is closest.

I hope you are aware of Opera's corporate parentage.

Its goal was to create a sustainable alternative to ads, not just block them. I haven't been keeping up with it so I don't know how successful that's been, but it's a noble task that nobody else is really working on.

Ill go a step further, with a likely very unpopular opinion. I think they should leave this feature in the browser, and make it one of the opt in options along with viewing ads.

If I like the product, I may not have a problem supporting them with affiliate link rewrites, if it funds technical development and engineering.

Plenty of people and dozens of companies have worked on similar things and continue to this day.

Brave is not an alternative to ads. They are just an ad network that replaces the ads on the page with their own, and then splits some of the money with you instead of sending it all to the publisher.

> I'm surprised people are surprised by this

I am thinking of creating a website with two lists of comment threads - the first to collate all the times users say "why are people surprised" at something which is surprising but which has some people already in the know and the second to collate comments about downvoting "why the downvotes", "not sure why you are being downvoted" etc

What other phrases do we use that we can add? I was thinking of also "free speech doesnt apply to private companies"

I think the main benefit is precisely that it comes with blocking of ads and trackers by default. I use Firefox myself (mostly because I love Container Tabs), but usually recommend Brave to less techy people as it requires zero post-install configuration.

From the same browser that brought you “Hey we’ll just start taking donations for everyone whose ads we block, and we won’t put any effort into contacting anyone to tell them about this - and if they do find out, the process to start getting those donations is a giant pain in the ass!”

I’m tempted to add some browser sniffing to my site just so I can block this scammy thing. I don’t even have ads on my comics any more, just a Patreon. And I fully expect at this point that anyone clicking my Patreon link on Brave would get redirected to some weird site they built that skims my Patreon posts, makes you pay in crypto, and only pays me 5¢ out of every dollar you think you’re paying me.

Nothing I've read about Brave has ever made me want to use it instead of any other browser with a basic ad blocker, and this whole "we will save the web by substituting other people's ads with our own and making them all party to our business model whether they want to be or not, also something something cryptocurrency woo" shtick was the main reason. It continues to be the main reason.

They don't substitute on page ads and viewing ads that are notifications is optin. There are also ads on new tabs. That's another chance to earn BAT. The user decides if they want to donate to a site. If the owner doesn't sign up the tips remain with the user. I have donated $10 to my favorite open source developer after convincing him to sign up. All I had to do was visit his GitHub profile and click a few times.

That Brave uses cryptocurrency is not a reason to dismiss it. There is a lot of hand waving but the hand wavers have no idea how Brave works. At least be familiar with the object of your criticism. Even the author of the blog post doesn't know the difference between a link and auto complete. How is that helpful?

A legitimate criticism of Brave is that competitors like Scroll have amassed quite a few publishers for their micropayments platform. Can Brave catch up?

From a technical perspective, if its the fastest and most efficient ad blocker, doesnt that give you some interest?

https://news.ycombinator.com/item?id=23236121

Especially since (sans this most recent incident) most/all the most disliked features are opt in.

For tips Brave would keep 5 cents and give you the 95.

I have seen a lot of commenters speculating about how Brave works. It is possible to look these things up before posting.

Why would your browser keep any instead of giving all 100 to the recipient that was intended?

Was the affiliate link thing documented anywhere? I can't find it anywhere as and Googling I attempt is clogged by the current news cycle about it, so it might be buried somewhere (or it was much more obvious and people weren't paying attention; I know I wasn't) but if it wasn't it wouldn't be completely unreasonable that they might have other undocumented revenue streams

How is this a worse situation for you than having users with ublock origin visit your site?

Users blocking ads know damn well they are not giving me anything. Some of them might decide to back my Patreon because of this, some of them will back my future Kickstarter because of this.

Users running Brave and buying their crypto will assume they are supporting me, even if all Brave has done to tell me they’re holding crypto for me was to send email to an address at my domain that doesn’t actually exist.

> However, Eich is very sorry that Brave got caught — again — and something will be changed in some manner to stop this behaviour, or at least obscure it.

No surprise there.

> There is no good reason to use Brave. Use Chromium — the open-source core of Chrome — with the uBlock Origin ad blocker [...] or use Firefox with uBlock Origin — ‘cos it blocks more ads than the Chromium framework will let anything block.

Is this true? I assumed the functionality would be the same.

Nope! I routinely run Firefox and Chromium, both with uBO on default settings - and Google results on Chromium always have three ad-link results inserted at the top, lazy late-loading via JavaScript. Google know what they're doing there.

You need to install some filters then! I have all the top featured ones installed and haven't seen a single advertisement on Google (which I only use <20% of the time, DDG gets the rest).

The Firefox version has the ability to block third party scripts masked as first party ones through the use of CNAMEs. Chrome doesn't expose APIs to let extensions do it.

Also this: https://news.ycombinator.com/item?id=20050173

> The blocking ability of the webRequest API is still deprecated, and Google Chrome's limited matching algorithm will be the only one possible, and with limits dictated by Google employees.

Firefox + uBO + uMatrix will block everything you can reasonably block without making your internet life miserable in the other extreme (although uMatrix can be a pain sometimes).

While uMatrix may be a bit of a pain, once you have your basic rulset and whitelists setup it functions very well, and beyond that, it really helps you understand what makes the modern web so shitty, and helps you know which sites are part of that and which aren't, which I think is pretty invaluable. Like many things, it may take more upfront investment but it's worth it imho.

If I could force every webdev to browse their site with a fresh uMatrix install I would.

I was most amused when he used my site as his test example in the uMatrix manual.

https://github.com/gorhill/uMatrix/wiki/How-to-create-rules-...

Despite repeated requests, Chrome and Chromium still misclassify certain requests in order to hide them from content filters. Here is one example: https://bugs.chromium.org/p/chromium/issues/detail?id=611453

I don't get it. The ticket wants beacons/pings to be classified as the same request type as xhr, and it's marked as WONTFIX. Isn't this a good thing?

whether they get lumped in with xhr or with 'other' is immaterial; the problem is the chromium developers refuse to have a 'ping' type like other browser engines do.

How is the android scene for Chromium based browsers that either have extension support or adblockers?

I am aware only of Yandex & Kiwi as Chromium browsers that support extensions that allow you to install an adblocker. So perhaps Brave is trying to integrate itself there somehow by having it built in.

Anybody know a better breakdown than this for mobile browser market share? https://gs.statcounter.com/browser-market-share/mobile/world... It says Chromium is 61% and Yandex is 0.1% but it would be nice to see if Brave was included or not.

Yandex is the company whose sites actively fight ad-blocking more than anyone else of whom I know. Afaik Yandex is just not in the uBO lists anymore, because it was no use changing the filters again and again. So I guess Yandex might allow installing filters which can't catch it anyway, but I wonder if it won't cripple the extension somehow for good measure.

their browser doesn't affect functionality of ublock, but it's not good browser anyway, trying to show down your throat many intrusive features by default

Why is firefox on android not an option for you?

Try Firefox Preview

Brave and a couple of others are actually getting extension support in the near term because Kiwi recently went FOSS.

On Android give Privacy Browser a try.

https://f-droid.org/en/packages/com.stoutner.privacybrowser....

ungoogled chromium now supports extensions too but it's very alpha functionality

brave promises extensions by the end of June, they already shown working prototype in Twitter

so next to outdated kiwi, shady yandex and experimental ungoogled i have my biggest hopes for brave as current kiwi user who needs ublock

if you want to stay updated follow kiwi discord channel

I use Samsung Browser with Adguard and I'm very satisfied. You also have the DuckDuckGo browser. I don't know if Edge supports extensions.

Being a happy Firefox user and watching all the browser drama from the backyard. I still don't understand why people uses Chrome or Chrome variants claiming privacy things.

Agreed, I haven't seen or heard anything off kilter with Firefox in a very very long time and they have always been on the forefront of privacy and development features.

Mozilla make their fair share of fuckups and bad moves, but they're still on a different level from these niche Chromium derivatives that invariably come with ugly business models attached.

Well, there was the DNS-over-HTTPS thing and the Mr. Robot thing, and the Pocket thing and ... they're not perfect.

However, I've been using Firefox as my primary browser for about five years and have been very happy with it -- especially post Quantum. I can't even remember the last time I've had to switch to Chromium because something wasn't working.

I am personally a fan of the DNS-Over-HTTPS experiment,I think it has a lot of benefits and hope it becomes standard.

The pocket thing isn't that bad, it's legitimately just a free cloud sync bookmarking service that you can use, or not. It's basically an extension of FF Sync, and no one has problems with that.

The Mr Robot plugin catastrophe was abhorrent, I certainly won't deny that.

Agree. Not sure what else needs to happen to encourage Chromium users to finally give Firefox a try.

I still don't understand why everyone moved away from Firefox back in the day. Is it really just the fact that Google put up so many ads everywhere?

Chrome had v8, it was fast. Forefox sort of got left behind performance wise.

You could still have a million tabs open, something chrome struggled with, so it kept some users.

But it took quantum to get users back.

Yes, my experience resumes like this: breakthrough browser, adoption, bloating experience, adopt next fast breakthrough browser.

First, old firefox (pre-quantum) really started to be slow and non-competitive.

Second, Google actually were caught on making their resources work worse on firefox and other competitors with some hacks.

E.g. https://www.zdnet.com/article/former-mozilla-exec-google-has...

Assuming that literally everyone use gmail, youtube, etc - it had looked that mozilla doesn't work reliably for end users.

I switched for that exact reason - Firefox was starting to become really slow. After a few years of exclusively using Chrome, Firefox (thanks to Quantum) became my default browser again. It still sometime feels slower than Chrome, especially on Google sites (YouTube and GMail are incredibly slow). But that could just be my current pc starting to show its age.

I've heard this a lot. I use youtube fairly regularly with firefox, and have never noticed any performance problem.

Chrome was also much more secure and didn't lock up as much thanks to process isolation.

I moved because Chrome shown a nice promise in speed, standard support and features, it seemed a good move. Same move I did back in the day when Microsoft released Internet Explorer 4, it was so good in comparison with Netscape 3-4 than it was too late when i got tired of it.

The devtools really were ahead of any browser.

For the average person it was so much faster than ie 6,7,8,9 and google pushed it everywhere.

It comes default on android helps.

I can’t speak for the users of other OS, but for a long time Firefox was essentially unusable for me on OSX.

I have always liked Mozilla though so kept trying builds over time, eventually leading up to Quantum the nightlies became better and better and it was easy to switch back at that point.

What a shame it happened in the first place though.

Other than the performance, I think Mozilla changed their focus to browser based mobile operating systems and starved Firefox from developer talent.

Chrome was waaaaaay faster. It made Firefox look like a student project. I held out a lot longer than all of my laymen friends, but the gap eventually was hard to ignore.

There were also a ton of innovations that caused real quality of life improvements that it took firefox an incredibly long time to catch up to, like process isolation preventing a single misbehaving tab from crashing your entire session.

I've never used a Chromium-variant as a primary browser. Used Opera until they switched to Chromium and their Presto-based brower became untenable, then switched to Firefox.

I gave it a try tens of times, and continue trying to switch every major release, but keep going back. Too many things are just not right, and can't be fixed for me because I am not ALL of the users + not even the most vocal part of the user base + some things are just meant to be like that in Firefox and that's their "thing" that I don't like. It's pointless to list it here, but I really do continuously try it in good faith and hope to switch someday.

Have you written about your experience with Firefox somewhere else? I'm curious to hear your thoughts.

I just wrote another comment here about its performance, about how I want it to succeed, how I donate to Mozilla, and yet still use a Chromium-based browser due to the performance issues.

At this point (I mean, they've literally invented a new programming language to make it faster, and it's still slow) I think the only thing left to do is to learn C++ and Rust and fix it myself...

I have the feeling that Firefox development is a bit distanced from the real users.

It's bugzilla is quite unfriendly, and pretty much everything users wish for is already there, in a ticket that is several years old with no action taken.

An then, the next Firefox version comes with some crappy UX decision made, and it is not configurable. /r/Firefox comes up with _yet another_ userChrome.css tweak to revert it.

And the cycle continues as the user base grows thin. I wonder why.

I try it regularly but it just doesn't work for me. Here are just a few of the reasons why:

1. Chromium based browsers give me control over extensions that require access to everything. https://imgur.com/a/ENZkQyc

2. Firefox doesn't support media keys.

Edit: Turns out it does if you enable them in about:config. See bad_user's comment:

https://news.ycombinator.com/item?id=23442732

3. There are still some areas in which Firefox's performance isn't competitive. Try using it with something like Rainway and it will completely fall over.

#3 isn't that big of a deal to me. #2 I could probably adapt to. #1 makes Firefox a non starter for me.

Firefox does support media keys, but it's experimental and you have to enable them in about:config:

- media.hardwaremediakeys.enabled

- dom.media.mediasession.enabled

#1 seems nice. Note however that Firefox was safer even before they introduced their permissions system simply by having a review system that works.

The review system of Chrome Web Store is broken, there's a lot of malware on it, extensions bought and turned malware and then you've got completely legitimate extensions being banned due to some automatic process flagging them. And then it's really hard to get in touch with humans. All the while reported malware take months to be taken down.

Of course, it's also true that Chrome is simply the bigger target. And what Mozilla is doing now probably doesn't scale. But for now Firefox's ecosystem of add-ons is much, much safer (and arguably more useful). Has been that way for some time.

I used to complain that it doesn't have a permissions system, I then complained that you can't disable add-ons in private mode. But it keeps evolving and I'm sure it will implement your favorite too, if useful.

> Firefox does support media keys, but it's experimental and you have to enable them in about:config:

Nice! Thank you. :)

Latency. Just tested with a "hello world" page (18ms ping).

Chrome takes 102-200ms to render the page, Firefox takes 150-400ms. 1.5 to 2x slower -- and that's after all the performance upgrades they've done with Rust and Quantum.

Network inspector says Firefox is spending 150-270ms "blocked" before it even initiates the connection. On Chrome the block is 3-18ms (15-50x (!!) faster).

There's also UI lag. When I press Ctrl+N, I expect a new window to open immediately. Chrome and Chromium based browsers do that. I cannot even perceive the delay between pressing Ctrl+N and a new window appearing. With Firefox it takes about 0.5-1 seconds before anything happens at all. This seems to be another 10-20x difference (though I'd have to record my screen and measure the difference).

Curiously, Re: UI lag, I think the actual time until the navbar is usable is about the same. But Firefox waits until the whole window is built before it displays it, while Chrome opens the window immediately and fills it in. From a user experience (I do command, I expect feedback) this makes a huge difference.

I switch back to Firefox roughly once a year after reading how fast it's gotten. But I have been disappointed on this front every single time. I want Firefox to succeed, I really do. I am donating to Mozilla every month. But as it is right now, I can't tolerate such lag, for a trivial action I perform thousands of times a day.

This is useful feedback for building non browser uis. Instant feedback followed by a progressive loading rather than build it all then render.

> Chrome takes 102-200ms to render the page, Firefox takes 150-400ms. 1.5 to 2x slower -- and that's after all the performance upgrades they've done with Rust and Quantum.

How did you actually measure this? I wonder whether these small timing differences may just be differences in how the respective dev tools report the timing info.

FWIW I also don't think the relative difference will be this large for bigger sites - I'd be very surprised if a site that takes 1s to load in Chrome would take 1.5-2s in Firefox.

There was a noticeable increase in GMail loading time (when I switched to FF a while back), but once it actually loaded it was the same speed (slow af on both lol). As an aside, it's gotten even more bloated in the meantime (for some Google PM's promotion), I just use Basic HTML now. Loads instantly :)

So once the page is loaded, JS performance seems to be about on par, but page loads are faster in Chrome.

To measure I just used dev tools. But there is quite a lot of randomness involved -- sometimes the engine scheduling planets align, and sometimes they are way out of alignment. You'd need thousands of samples or more to get an accurate reading. I just refreshed a few times to get ballpark numbers.

I'm using Firefox and getting navigation times on par with Chromium when loading simple documents (tested with example.com).

From pressing enter to the browser initiating a fetch was around 16ms.

Also performance issues, especially on Linux. Fan works in ~50% of my laptop usage.

This is always the answer for me. I stayed on Firefox long after most of my friends had switched to Chrome back when it came out, but it was eventually impossible to deny the difference. Every time I've tried to switch back over the years, the difference in latency is still noticeable.

I am using Firefox now for almost 7 years as my main browser (Chrome still installed for some pages not properly working in other Browser). But the number you are mentioning here are just not true with current versions of both browsers. Overall I agree that FF still has potential to improve it’s rendering performance (like every other browser). But as an end user it’s not noticeable anymore. Quite the opposite is the case for me since FF always used way less resources than Chrome on my notebook.

Not sure what else needs to happen to encourage Chromium & Firefox users to finally give Pale Moon a try.

I'm quite happy with FF on desktops, but the mobile version is just ... overall a miserable experience compared to Brave. After using it for a while, going back to FF constantly makes me feel like useful QoL features are missing and I end up going back to Brave.

If you have Android try the new Firefox Preview, best browser I've used on mobile so far. Complete rewrite.

Which is missing nearly all of the addons that I use and which don't seem to be a priority for Mozilla. Their whole strategy regarding addons is incredibly frustrating.

True dat.

Personalization is super important (in any software), it's a shame that in general, it's not being the focus of most of them.

They are opening it up, just taking time as they are developing the appropriate API points. This is a complete rewrite, going to take awhile before all the same API is available. They have opened some major addons as they are tested and stable.

I agree that the lack of full support for add-ons is frustrating, but the alternative you end up going back to, Brave, doesn't (seem to) support add-ons at all. How is that better?

Because using Firefox nightly would signal to Mozilla that I'm fine with how they're handling add-ons. If they're not going to support add-ons properly, I'm not going to use their browser.

Sure, but Brave on Android has no extension support, so still better.

I'm not okay with how Mozilla behaves regarding add-ons. As in, they have all this addon support, but it's not in any way a priority for them so they've basically taken it all away. So I won't support them or use their browser until they do.

You don't like that one browser has poor extension support, so you use a browser with no extension support? How does that make sense?

riddled with bugs, used it for few months until I finally gave up when they introduced new build where I could not even type address in address bar, they are really doing zero testing, during those months I experienced pretty much every week new bug I could noticed and I saw literally ONE of these bugs fixed in those few months

I prefer fast stable bugfree chromium

Using FF on mobile, I have no complains.

I recently tried moving from mobile Brave to Firefox as I've used desktop FF for years, and wanted cross platform bookmarks.

The experience was incredibly sub par on Android. I tried browsing a video heavy subreddit, and FF just hung (well, all videos stopped playing, which is what I was there for).

I want to use it, but if it can't manage my base use case, I can't warrant it.

I will try again one day, I'm sure.

Firefox is the slowest mobile browser I ever seen.

On what basis do you say that?

Bromite?

I'm considering trying FF on mobile and I am curious what QoL features are missing? Thanks!

From my perspective, none of them. The browser is reasonably fast, and you can still share bookmarks and logins with other installations if you create a Mozilla account (or host your own sync server!).

But, from my perspective, just having uBlock Origin installed in the extensions is a huge differentiator, that gives most pages a lot of speedup. Stylus can also be helpful to fix some suboptimal mobile designs.

Thanks for sharing! I think I will give it a go.

One of the things that annoys me on a daily basis is how FF handles the address bar. In Brave, if I click on the address bar. It gives me a button to copy the link. If I have a link copied, there's a paste button. If I use FF, I have to go through the whole monkey dance of clicking on the address bar, tap holding the address until the copy menu shows up, then I can copy.

Then there's absolutely infuriating stuff like the address bar and tabs disappearing when scrolling, which is fine, but it can be really fucking annoying trying to get it to show up again. It doesn't respond properly, sometimes I'll have to scroll back up a whole page before it does anything and all I wanted to do was switch tabs, so I have to scroll back down when I come back. Makes me want to punch an FF developer.

Just longclick the address bar without clicking it first, it then gives you the choice to copy, and even paste&go in one click.

You could always make it not to hide when scrolling. I btw use gestures to switch tabs via an extension, works great.

Thanks for sharing your perspective. I think I will give FF a try. I can understand why the address bar / tabs disappearing while scrolling would be annoying but I'll see if it is enough for me to revert.

With Chrome taking the lion's share of the browser user market, you end up with a lot of sites that work well in Chrome but not so well with other browsers.

So even if you use Firefox as your main driver, you'll still want to have a Chromium-based browser as a backup.

Now the problem for Android users is that, in light of this news, there's now one less (seemingly) viable option if you're using Google Play services.

If you're using F-droid, however, you have Bromite and ungoogled-Chromium as prime candidates.

Somehow Samsung Internet and Vivaldi, both closed-source chromium skins available on the Play Store, have always sparked more trust in me than the seemingly open Brave ever did.

Because they don't have convoluted policies. You get what a user might expect rather than a bunch of rigamarole.

> So even if you use Firefox as your main driver, you'll still want to have a Chromium-based browser as a backup.

Nope. When something doesnt work in my FF then good bye. I cant be bothered to do extra work like switching browsers for to support their incompetence. It'been rare though.

Very rarely, I fall back to Safari because I'm on Mac. But on my laptop, I don't have anything installed from Google. It's just not necessary.

I'm the same way unless it's a company site. I even changed banks when they "upgraded" their site and it was no longer FF compatible. I figured if they couldn't stick to web standards they might not stick to security standards either. Sometimes I will change the user agent to chrome though in emergency situations and that sometimes fixes things.

> With Chrome taking the lion's share of the browser user market, you end up with a lot of sites that work well in Chrome but not so well with other browsers.

TBH the only sites where I have noticed this are Google sites like Hangouts and YouTube. But even those work fine, they just seem to use quite a lot more CPU than I think they should. I do have Chrome as a backup in case something doesn't work, but I can't remember the last time I had to use that.

"If you're using F-droid, however, you have Bromite and ungoogled-Chromium as prime candidates."

I can't seem to find bromite on fdroid. Why it not there anymore?

I've honestly never had any major problems with sites working on Chrome but not Firefox, and I use both on a regular basis.

The only cases that I couldn't trace back to an extension were: 1. a major news site thinking Firefox was in incognito mode, and refusing to display any contents. 2. Google Stadia

Are use Firefox for my primary browser, but there are certain sites (made by google primarily) which work much better in chromium based browsers.

Whether Google is intentionally degrading their performance in Firefox or simply doesn't care is an interesting technical detail, but from a practical standpoint I need to use these sites for my job, so I also need to keep a chromium-based browser around.

True, but unless you are a heavy Google user I don't see a cap in my performance to work with, GMail for example from time to time or using Drive, etc.

The Google Voice desktop site performs remarkably poorly on Firefox, often locking up entirely.

The Google voice desktop site is a piece of crap on chrome too... Though I totally believe it's way worse on Firefox.

If you need to use it heavily, then yes. But I don't. I think Firefox performs optimaly 99% times for everyone. There will be a point where you may switch to Chrome, or Safari, but just for specific things unless that specific is the most important one.

Firefox's performance on Linux is markedly worse than Chrome's.

How ironic

This has never been my experience, FWIW.

You may need to manually tune your configs. Often, people just forget to enable HW acceleration.

Personally, Chromium crashes too often to rely on it.

Firefox on Android has a much poorer UX than Brave, which is the only thing that keeps me from using it.

Pull to reload, tab accessibility, and other performance and rendering oddities need to be fixed before I switch back.

I'm happy with Firefox on Linux though.

Do you find that there are irritating glitches?

A lot of the web doesn't officially support Firefox anymore (Groupon, Airbnb, my organization).

A year or so ago, I occasionally found weird breakages on sites. Haven't in a while, though. The one thing I recommend when switching is installing a user agent switcher for the browser, so it presents as chrome, and websites don't throw a fit at you for using a different browser.

Try running firefox on a a53 based phone.

Its miserable, you can't quite see how badly optimized it is on a high end phone because the page load time is 1/4 second instead of 1/10 of a second. On a low end phone that becomes 2-3 seconds rather than 1/2 a second.

I have a Moto X4. At the moment it is sitting around 150USD new. It's got a snapdragon 630 in it and despite struggling on several other applications, Firefox is super snappy and far faster than any other browser I've tried using despite having several add-ons installed.

Firefox Preview runs much better on low end phones than regular Firefox if you don't mind occasional crashes after certain updates.

I only use them at work, where I have no expectation of privacy, and our SSO occasionally has issues with FF.

At home? FF all the way, plus the usual bevy of ad blockers and PiHole.

I've found that any JS-heavy sites works much better in Chrome than FF.

I'm all in Firefox too, but Brave is not just a Chrome privacy thing.

Brave goes out of its way to make money by ripping off publishers.

As a publisher myself, I respect ad blockers. If they block ads, they aren't gonna click the ads in the first place, so it's their choice. I even respect DNT header and not put my pixel tracking for the users.

Brave, on the other hand, is doing these sneaky stuff to earn from my efforts. A site that has Alexa rank hovering 10,000 accumulated about $10 worth of BAT currency (their own shitcoin) in exchange of showing ads.

Maybe this is just a function of how few users Brave has :)

I always whitelist places that I actually use. Turn off pihole and adblockers for those sites in FF

>accumulated about $10 worth of BAT currency (their own shitcoin) in exchange of showing ads.

Thats not how it works. The user receives BAT for opting into OS notification tray ads. Then the user is tipping your blog with their earnings. It may be somewhat of a moot argument, but there is a distinction. The user is accumulating BAT from having the browser open, not necessarily when they are on your site.

Firefox is STILL largely funded by Google right?

I find it odd that one of Firefox's only features, over Chrome, is privacy, but they're funded by Google who is the anti-hero right now in the privacy space.

If Firefox's mission is successful they would lose all their funding.

Mozilla is indirectly funded by Google, yes. They don't have ownership. It's the same way that the NY Times is indirectly funded by Mazda. They pay for ads.

So that’s why Paul Krugman’s latest article was making the point that Jerome Powell’s handling of monetary policy pales in comparison to the handling found in a Mazda CX-5!

Mozilla is funded by Google and also sends user data to Google:

https://news.ycombinator.com/item?id=14753546

https://threadreaderapp.com/thread/1165858896176660480.html

It would inform people better if you would be more precise here.

According to the links, the "Get Add-ons" view in Firefox uses Google Analytics to collect aggregate visitor statistics. Furthermore they note that they negotiated a special contract with Google to only collect a subset of data.

I don't believe any kind of personal or special contracts/negotiations/etc will deny Google to track analytics.google.com connection logs. So, "private browser" and Google servers aren't compatible by design.

> Mozilla is indirectly funded by Google, yes

There's nothing indirect about Google cutting checks directly to Mozilla.

As of last year, Firefox pinged telemetry every time you visit certain targeted sites, controlled by the "Recommend extensions as you browse" feature. They may actually still do this.

In 2018, Mozilla surreptitiously installed a mysterious plugin named Looking Glass to every installed browser as part of a marketing deal with the Mr. Robot TV show. Thus plugin altered websites for an alternate reality game promoting the show.

Back in 2017 Firefox Focus, one of their iOS efforts marketed as being about user privacy, collected telemetry and sent it to Adjust GMBH, a tracking/analytics company based in Germany.

Also in 2017 Firefox integrated a Cliqz plugin to recommend content in the searchbar based on your browsing history, which was sent to the Cliqz servers and theoretically anonymized. Cliqz GMBH is another German company involved in analytics/tracking, and a notoriously scummy one to boot.

I mean, I could go on. Mozilla's hands ain't clean, they make mistakes, but at least their _manifesto_ is worthy.

Well much of Firefox was done by Brendan Eich, he is a founder of both Mozilla and Brave

Firefox enables just as much telemetry as Chrome. Fortunately they provide policy options to disable them, but they are enabled by default. Chrome and Chromium also has an equal amount of policies that can be disable to better protect privacy.

Chromium was never intentionally limiting any APIs to prevent ad-blockers. I think the whole thing was blown out of proportion, although I get some of the frustration, especially when their main stream of revenue is advertising.

I personally don't use Firefox because it doesn't work as well on modern Linux. Chromium supports Wayland much better. I get weird artifacts on Firefox when running in Sway on Wayland, especially when switching between full-screen and split. Additionally, I still don't believe Firefox properly handles video hardware acceleration and Chromium does on my distro using the native package manager.

Both browsers could benefit from separating their solutions into open source protocols, for example bookmarks, password, and other sync services. This way syncing is done at file-system level like gopass-bridge and Browserpass. GPGme already has an app called gpgme-json for app integration. That way people can use Syncthing, Nextcloud, or whatever preferred cloud-sync solution. I know Firefox has tried building it's own password manager into Firefox, and Chromium has half-assed this as well, but the tools are already there they could just adopt and would provide a much safer and better overall experience.

These platforms and engineers should feel a duty to innovate—not for the sake of a paycheck, company directive, or personal enrichment—but for the community to have a piece of software that is a message of freedom. When they send URLs to remote services by default for safe search, network prediction, etc. they aren't free. When they implement their own centralized sync solution, but make it difficult for you to implement a decentralized or locally-hosted sync solution, then they aren't free. When advertisers are able to use supported JavaScript to port scan your computer, track every pixel movement, and track you around the web; then the software isn't free and neither are you.

As a long-time Firefox user, I find the constant drama over Brave rather amusing. It seems to be an intersection of internet publishers upset about Brave's ad blocking/replacing, people who hate Eich for his politics/beliefs, and cryptocurrency critics.

It's a perfect storm of drama, centered around a browser that has a very small market share from what I can tell (otherwise I'd probably find it all less amusing.)

because one version of Firefox on Android is extremely slow and the other one faster is extremely buggy? for the record I use Firefox on desktop, but all their versions on Android are unusable, so I use Kiwi browser waiting for some updated browser with extensions, ungoogled chromium doesn't really work and yandex is shady

pretty much nobody use brave on desktop

I would think the affiliate programs wouldn't like this either.

The browser isn't doing anything to drive traffic. It's just taking credit for traffic that was coming already.

They seem to have explicit deals with Binance and Coinbase - don't know about Ledger or Trezor.

Good point. Maybe brave should make affiliate-able links blink and/or respond to clicks in a wider area? (Just to be clear: this is satire. Please don't do this.)

Don't give him ideas.

They theoretically could do things to drive traffic. For example, if they surface the domain sooner than they might surface other domains, or change the way the URL is displayed.

Eg. User types "B" and whilst "bbc.co.uk" might be very popular, Brave could instead surface the less popular "binance.com" ahead of BBC, and potentially give it a different visual treatment, too.

I don't use Brave, so I'm not sure whether they do either of these things, though.

Brave's whole business model is flawed, even ignoring shenanigans like this.

They claim they want to fix everything wrong with today's web (annoying and privacy-invasive ads, etc) by replacing them their own ads backed by a shitty cryptocurrency. While this might work in the short term while the browser is niche, they will have no choice but to deploy the same techniques once it goes mainstream and ad fraud goes up, removing their only selling point.

The only real solution here is to just admit that view-based or click-based advertising on the web is flawed (and will always be vulnerable to fraud) and get rid of it, replacing it with time-based advertising where you pay for an ad to stay up for a certain period of time regardless of how many clicks or views it gets, making it immune to fraud and reducing the need for privacy-violating analytics because the only analytic that matters is "do we make more money?". Of course, this real solution wouldn't allow opportunistic middlemen to make money out of thin air, so that's why we have Brave instead.

> by replacing them their own ads backed by a shitty cryptocurrency

This is not true at all, and it has been talked enough here but I figured I'd explain it again. The Brave ads are opt-in, for people who would like to earn "shitty" cryptocurrency by clicking on them.

They are fixing the ad issue by blocking the ads and letting you "pay" the sites with BAT tokens. This can be done by a one-time donation or automatically each month (based on your attention). Reason for the Basic Attention Token name.

Thought I should point out you receive BAT for viewing the notifications. Not for clicking on them.

https://support.brave.com/hc/en-us/articles/360026361072-Bra...

I am an enthusiastic Brave user - but seeing stories like these make me wonder if I'd be better off configuring Firefox to be more secure/private and using that.

As a privacy and transparency advocate, it disappoints me to see Brave fail to pass the test, especially considering that privacy and transparency are supposed to be the browser's MO.

Yes, you would be much better off doing that.

What makes you think brave is better for privacy and transparency in the first place?

Everything I've seen about brave sounds like something that can be done better with extensions within firefox, just with some added crypto/privacy hype BS added on top.

The fact that it is built-in makes me think the browser vendor (Brave) cares more about this issue. Does that not seem like a reasonable assumption?

Presumably it's not built-in to Firefox because if it was, Google might pull the lucrative default search engine deal that they have.

Not too difficult to configure Firefox imo. My recommendations on plugins:

* HTTPS Everywhere: https://addons.mozilla.org/en-US/firefox/addon/https-everywh... * DuckDuckGo Privacy Essentials: https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-fo... * uBlock Origin Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...

I'd also suggest DeventralEyes, it's a nice quiet extension but works fantastic.

Privacy Badger[0] too. Multi-account containers[1]. I also agree with the Decentraleyes[2] suggestion.

[0] https://addons.mozilla.org/en-US/firefox/addon/privacy-badge...

[1] https://addons.mozilla.org/en-US/firefox/addon/multi-account...

[2] https://addons.mozilla.org/en-US/firefox/addon/decentraleyes...

Firefox is too slow for me, so I'm stuck with Brave

De-Googled Chromium with an adblocker is the correct choice, in that case.

Brave has to pay salaries - I suppose this is better than selling user data. Chrome is subsidized by search and Firefox gets money from Google.

The revenue model for browsers is fucked up.

Countdown till some Chromium-based browser pops up with adblock enabled, but a $10/mo usage fee?

(i jinxed it, didn't i)

fuckin linux is free where the entire business lives serving trillions of dollars. $10/mo for a web browser? guess its time for another FOSS on browsers this time.

So I take it you won't be signing up for Adobe® CloudBrowser™ any time soon...?

Ironically there’s only one browser with a sane business model and it’s Safari. You have to buy an Apple product to use it. Simple.

That’s probably why it’s the only mainstream browser, outside of obscure open source browsers like Falkon and Gnome Web, that doesn’t have any built-in ties to third party services.

I think Apple still get revenue from Google (and probably Bing?) searches.

Could be wrong but I thought I remember details about Google paying Apple for this. But it was years ago I last seen it

Edit: quick search for “safari google search revenue” got me a few links from prior years about Google paying to be the default search engine. Last mention was 2019 so who knows how long that contract is or whatever

Safari is also mainstream because you have no choice but to use it on iOS. Even if you manually install another browser (which can't be made default), you're still using the underlying Safari engine.

Apple gets billions and billions each year to make Google the default search engine in Safari on iOS and Mac OS. (reported to be 12 billion in 2019 [1])

Apples privacy efforts and signaling are motivated by differentiation to Android/Google and are mostly just marketing targeted at increasingly privacy-aware consumers. Not some value judgement. (in my opinion)

[1] https://fortune.com/2018/09/29/google-apple-safari-search-en...

Also increasingly apple is moving to compete in services. Every incentive in the world will be to adopt the practices the other guys do. Putting your trust in apple right now on the privacy issue seems pretty misguided.

>there’s only one browser with a sane business model and it’s Safari.

Also consider Edge, its Microsoft counterpart.

Most comments here are blowing things way out of proportion. Links are in no way getting modified by the browser. The issue is that when someone types binance.us(or a few other brave affiliate sites) in the address bar, the top recommended link comes to be one with the referral link appended. When enter is hit that link is automatically selected(normal chromium behaviour) and page opens with the url with referral code. This sure is problematic. As Brendan has said[1] it sure was not the right way to do it. Again, the links in pages are in no way modified as people are trying to portray.

[1] https://twitter.com/BrendanEich/status/1269317625915400192

OP here. Brendan Eich is now publicly calling me a liar, though he's inexplicably failed to detail the claimed lies. I've asked him to do so. https://web.archive.org/web/20200606232839/https://twitter.c...

You clearly have some personal vendetta against Eich and I don't think HN is the best place for it.

> You clearly have some personal vendetta

How so? I cannot see any evidence.

A few months back typographer/programmer/lawyer/acerbic writer Matthew Butterick wrote an, ah, let's say pointed critique called "The Cowardice of Brave," in which he argued that Brave is neither innovative nor particularly honest: "It's just substituting one set of ads for another... for publishers, it's the same old shakedown, but run by Brave instead of Google or Facebook; for users, Brave is still going to collect data about you." It's worth a read, even if one ultimately disagrees with it.

https://practicaltypography.com/the-cowardice-of-brave.html

Anyway, I bring it up because I linked to it from my Twitter and got a cranky response from Brendan Eich about how Butterick was wrong. Eich's response to Butterick was, like the one to you, not really a rebuttal of any of the critiques beyond "this is all wrong and inaccurate." I looked back at Eich's Twitter feed and discovered he was clearly searching for links to Butterick's article and tweeting links to his non-response.

And sure, responding to criticism is normal, but that "must find all who referenced this critique and CORRECT THEM" approach is... just... it is sure a thing.

Your title is, at the very best, poorly phrased. At worst, intentionally misleading. Whether or not you approve of what they are doing, and regardless of whether what they are doing is moral - they are not "hijacking links". That practice of "hijacking links" specifically means re-writing/modifying existing links on pages that you don't control (hence the term "hijacking" - or taking what belongs to someone else).

A URL typed in an address bar is not "a link". It's a typed URL.

Curiously, your article seems to describe what is happening pretty accurately so it's hard to see why you chose the title you did (other than to be clickbait-y and sensationalist - you are selling a book on the topic after all).

Again, that's not to excuse what they are doing. At all. But link hijacking has come to have a specific meaning and this isn't it.

TL;DR - Link is short for hyper-link. There are no hyper-links involved here.

I know I'm not supposed to reference downvotes on HN. But I would like to kindly ask downvoters to explain why what I've written is incorrect.

Regardless of whether the terminology is technically correct, it's easily understood what the meaning is. Modifying links and modifying typed URLs are equally bad, so your claim that it is sensationalist doesn't make sense. Your post is pure pedantry that does not make any substantive contribution.

If he operates within a technical space (as he clearly does) surely correctness isn't too much to ask.

I assumed from the title that Brave was adding affiliate codes to links on the page. That is not the case and now the author feels that he is a victim because Eich pointed this out.

The author also added an inflammatory HN comment from this thread to his blog post. This doesn't make any substantive contribution and is sensational.

>Modifying links and modifying typed URLs are equally bad

Sorry, but you're plainly wrong.

"Modifying links" implies another victim in the scheme: The party who authored the link in the first place. It implies that a third party is being deprived of their affiliate revenue because the link they wrote was "hijacked".

That's not what happened. No one is having anything stolen. If that distinction is not important to you.... then I don't know what to say.

Words matter. Never more so than when making serious accusations.

They are equally bad because in both cases the user is taken to a place that they did not intend to go. They are not bad because something is getting "stolen", they are bad because the user is no longer in control. That is a significantly more concerning aspect than someone not receiving affiliate revenue, which to be completely honest, I couldn't care less about.

So a third party also being wronged does not change anything because... you don't like the third party? Classy.

Do you have an actual argument or is that it?

Edit: This has got to be the first time I've seen an HN'er defend someone adding a clickbait title to their submission. A submission that points to their own marketing website. The guy is selling a book. Don't be so naive.

The accusation stands on its own without sensationalizing it.

I simply don't believe that mistakenly saying "links" instead of "URLs" is sensationalist. The author is not engaging in clickbait by substituting that word. A layman understanding of the web will not make a distinction between a URL and a link. The issue is clearly the fact that the browser deceives the user, whether it is changing a link in a page or changing the URL typed in the address bar, these are both equally deceptive from the user's point of view.

Hell, I have a reasonably good knowledge of the terminology and I will regularly ask people to "send me links" or "send me URLs" interchangeably. It's just needlessly pedantic.

He's a technical writer (by profession) directing traffic to his blog dedicated to marketing his technical book. Don't be naive, he knows exactly what he's doing.

Furthermore, I responded directly to the OP when he pondered aloud why he would be accused of lying. I explained. Then you jumped on me for being pedantic and posting non-substantive comments? Okay, seriously?

Speaking of which, why did the OP post the comment to HN about Eich calling him a liar, if not to stir up controversy (and traffic)? That's highly unusual. Did you ever consider that Brave is not the only one selling something?

>The issue is clearly the fact that the browser deceives the user, whether it is changing a link in a page or changing the URL typed in the address bar, these are both equally deceptive from the user's point of view

That's simply not true. They are not equally deceptive.... at all. A web browser surreptitiously re-writing third party web-content is next level evil. The implications would be absolutely astronomical.

It's not the same and you know it.

It's as if Brave is performance art put on by Mozilla's advertising department.

he updated the article and quoted you in it :D

Nice catch, wouldn't have noticed otherwise.

Wow. They appear to have a death wish.

If your entire raison d'etre is privacy and clear stated model then one covert shady move like this can wreck trust irrevocably.

If they had just declared that their model includes inserting affiliate codes then that would all be fine.

The codes aren't the issue here its a violation of trust. If I'm OK with mystery monetization stuff happening behind the scenes I'd be using Chrome.

I think the privacy angle was just a side-benefit for people who mainly cared about crypto currency. I don't see how someone could care about privacy and use a browser funded in part by the Palantir guy. If someone cared that much about privacy, they would look into the funding, and run screaming from that.

Except mystery monetization is a pre-req for heavily maintained software that you don't pay for.

I'd rather the mystery be "affiliate deals" than "selling my data".

Mozilla's mystery monetization is getting paid lotsa dollars to make Google the default search engine in Firefox. And Google can only afford that because of ads. If Firefox integrated ad-blocking by default like Brave did, Google might be inclined to pull that deal, as it is paid for with ads.

I trust the company with that conflict of interest less than I trust Brave.

Very valid point :)

You know how Firefox has a deal with Google where if you use Firefox and do a Google search and click on an ad, Firefox gets a cut of the ad money? This is sort of like that: Binance and Brave have a deal[1] where Brave promotes Binance from an in-browser widget[2], and in return Brave gets affiliate money whenever a Brave user signs up for Binance (whether by clicking on the widget or not).

In cases of affiliate hijacking, the company (and not the user) is the victim because the company is made to pay referral money when the hijacker didn't actually refer the customer. This didn't happen here because, again, Brave and Binance have a deal and Brave is operating according to that deal.

I suppose editing URLs out from under people is a little weird, so now that there's been an outcry they'll probably change it to identify Brave users by UserAgent or by injecting an HTTP header or something.

[1] https://twitter.com/BrendanEich/status/1269289242905042944 [2] https://cointelegraph.com/news/brave-browser-brings-binance-...

This is similar to when Pinterest did this back in 2012 and very quickly made large amounts of money but were crushed by public opinion and quickly shut the practice down. It’ll be interesting to see how Brave responds.

1. https://www.google.com/amp/s/www.theverge.com/platform/amp/2...

Ironic that you posted an AMP link

https://www.theverge.com/platform/amp/2012/2/8/2783807/pintr...

That's still an AMP link

Non-AMP link: https://www.theverge.com/2012/2/8/2783807/pintrest-skimming-...

Tumblr implemented this about two years ago, not sure on revenue but I imagine it's been very effective for them.

(You can disable this for your personal blog posts in settings)

Interesting discussion. I'm probably not the only one who started using Brave (on the side) because it's being put forward as one of the fastest/leanest browsers around. And I need something like that for the hybrid Win10 PC I chose as a cheap tablet alternative that will also run desktop software. I can't attest to "leanest", but it is indeed the only browser that works reasonably well with something like Facebook on that tablet. Anything else becomes unbearably sluggish after a short while, an MS Edge just has a too much crippled UI (and general incapability to function with my filtering proxy, Privoxy).

I see lots of remarks about FF being slow. It's a memory hog indeed (can't use it on my tablet because of that), but so are Chromium-based browsers, and FF is the only one I know where you can trigger a GC run that actually has some effect. I combine that with "The Great Suspender" extension to keep things manageable. Funny enough it was by far the fastest a year or 2 ago on what seemed a reasonably representative HTML5 benchmark that has been taken offline since. It's also the only option to have an up-to-date browser on my Mac that I've been keeping under OS X 10.9.5. That alone earns them my support...

I do wonder why WebKit2 isn't been used more; outside of the Apple universe (where it's sadly linked to the OS version) the only "official" browser I know of that uses it is Gnome's epiphany which isn't exactly cross-platform. My tests with the rebooted QtWebkit suggest that the older (but maintained, AFAIK) WebKit codebase superior in performance and resource use to Chromium ("WebEngine") for sites that don't require newer, unsupported features (and as an embedded HTML renderer).

This article is highly inflammatory.

These are not random websites they are hijacking for affiliate money like the article purports. These are all advertisers / partners that appear on the new tab landing page when you sign up for Brave rewards...This is affiliate tracking for advertisements baked into the browser itself not some nefarious scheme to skim off someones else's traffic.

This is not on the new tab page, this is hijacking links typed directly into the address bar. “If you’re using Brave and try to go to the Binance crypto exchange, Brave hijacks the Binance link you typed in, and autofills with its own affiliate code.”

There’s an animated screen capture of this happening here: https://twitter.com/cryptonator1337/status/12692014801055784...

Hate it when people do this. Have you actually even tried it ? It just shows the referral link suggestion at the top, it doesn't hijack the link you typed in. You're still free to open the original link. Of course the twitter post cleverly hides this by hiding the list of suggestions. Now we have this long flaming thread for something that's totally normal and perfectly acceptable.

Firefox: type in Binance.us and immediately press enter - no referral code.

Chrome: type in Binance.us and immediately press enter - no referral code.

Brave: type in Binance.us and immediately press enter - yes referral code.

Looks like their plan for resolving the outrage is an opt-in setting.

https://twitter.com/BrendanEich/status/1269404443818119168

Hahah, when you delete ref code and enter Binance.us again it loads without ref.

This experience sucks, but at least the refs aren't fully hardcoded.

Github issue: https://github.com/brave/brave-browser/issues/10129

Part of the problem here is with terminology.

You don't "type a link" into an address bar. You "type an address" (a URL).

Hijacking links has a specific meaning and this isn't it (edit: this remains true no matter how much you downvote me without explaining)

I can see how Brave's practice can be considered bad/deceiving though, especially if it hadn't been disclosed.

https://github.com/brave/brave-core/blob/master/components/o...

The list of suggested sites have embedded referral links.

Don't they understand they're undermining the entire point of affiliate codes?

This would never be sustainable long-term, it's just dumb and awful for very short-term gain.

> “In short run, without sounding Nietzschean, will matters. Patreon’s is weak or corrupt. Ours is not“

What is he, a ‘Silicon Valley’ character?

Life imitates art.

Given the Total Information Surviellance from Google this is relatively a non-issue. Nearly anything that meaningfully restrains Google is a net good at this point. Getting bent over this is like people who dismiss Signal for not having perfect e2e- purists that are oblivious to what is actually happening in the world.

How could they not realise this would turn away their target audience?

What IS their target audience, though? I always vaguely thought it was the crypto people, who as a community are quite accepting of weird slightly shady stuff. I could never really figure out who this product was for tho.

People that are too lazy to install add-ons or that want some pocket change in tokens?

The shills say "privacy", but it's not any better than Firefox with add-ons (and worse because using it adds to the Chromium ecosystem which Google ultimately controls), and you have to KYC if you want to withdraw the tokens.

I use and love Brave (since beta). As usual HN making a bigger deal out of nothing. They gotta make money, and it's not like they are stealing from anyone else (replacing ref links).

Chill out.

This. HN is so entitled - I want the perfect thing, then complain about them trying to be sustainable.

Bummer! I got the Tracking Token Stripper [1] to help remove stuff like this. Wonder what the result is if I use this and Brave — which one wins?

1: https://chrome.google.com/webstore/detail/tracking-token-str...

Vivaldi is my "third" browser. I have it setup with maximum privacy settings and extensions.

https://vivaldi.com

"Vivaldi is a freeware, cross-platform web browser developed by Vivaldi Technologies, a company founded by Opera Software co-founder and former CEO Jon Stephenson von Tetzchner and Tatsuki Tomita."

I seem to collect browsers like some people collect pokemon. Right now I am typing this in firefox and have twitch open in chrome in my second monitor. I use Edge for work accounts, Waterfox for times when I want to use a couple old addons that were never ported over, and opera and vivaldi around just to see how they measure up.

Filed under "Things people do that are 'perfectly legal' and reprehensible at the same time."

I get that this is a bad look but practically speaking it's not that different from Google paying Mozilla for every search query that comes in with a FF User-Agent. Article reads more like personal beef

Typing this on Brave for iOS. What is the best browser for iOS from a privacy standpoint? Firefox doesn’t have uBlock Origin. I don’t trust Microsoft Edge or Chrome. What do you suggest?

Um Firefox not only has uBlock origin, it's way better than Chrome's version. FF is definitely way better.

Apple doesn't let it's users have the freedom to install add-ons.

I use Firefox on iOS, in combination with ad blocking via NextDNS. Works pretty good.

You can install Firefox Focus[1] on iOS and enable it as a content blocker in safari settings. It works really well as an ad-blocker.

[1] https://apps.apple.com/us/app/firefox-focus-privacy-browser/...

Safari, as it has a built in cross-site tracking blocker. Optionally add an ad-blocker, such as AdGuard.

please brave dont f this up. we really need you!

Project plan for a new browser:

1. Copy Brave. 2. Remove everything except the part about paying monthly and supporting websites you visit

Who's with me?

Micropayments have failed many times before. I can earn BAT with Brave and donate it to sites without having to sign up and deposit money with a credit card. There is much less friction compared to solutions that came before it.

Andrew Mason is forking Brave and doing some of what you describe. Being associated with Gab and Andrew Mason isn't for everyone.

Always a balance with a tradeoff, I'm not sure if to uninstall here or come to terms with the business model.

Copied my wallets and removed Brave off all my devices. It only lasted a couple weeks, lol.

They began sucking pretty fast. Good riddance.

who even use brave on desktop? author completely misses point with alternatives

for Android he recommends only Firefox which is either slow or buggy, but nowhere close to stability and speed of chromium browsers

if you want chromium browser for Android with ublock your only options are Kiwi browser with outdated chromium, shady Russian yandex browser, ungoogled chromium pretty much in alpha or brave which promises extensions by the end of June

i'm done with brave.

This is a nothingburger. Brave adds its own referrer code to a handful of crypto-related websites, if you type them into the address bar. It doesn't modify other affiliate links, as far as I can tell.

You have become the very thing you swore to destroy!

Yeah, that’s the thing with trust: you shouldn’t.

bit overblown. It's not all "links", they did the redirect for the autocomplete of "binance.us" and they are correcting it.

https://twitter.com/BrendanEich/status/1269313200127795201

It's not just "binance.us", it's common terms like "bitcoin", "btc", "ltc", "eth", etc.

https://github.com/brave/brave-core/blob/master/components/o...

Eich's tweet worsens things as it omits that fact.

I see there is already a user submitted PR to remove this code: https://github.com/brave/brave-core/pull/5759/files

We'll see how that goes.

Wow... that looks to me like they're injecting their affiliate code to some URLs which the user would have to type in manually, like "binance.com", "coinbase.com/join", or "trezor.io/product/trezor-one-metallic". That's affiliate fraud -- Brave is not responsible for referring the user to those URLs, so it's inappropriate for them to claim credit for the referral. I'd be shocked if the parties involved didn't terminate Brave's affiliate account upon discovering this.

>and they are correcting it.

Only after getting caught. It's not like you can 'accidentally' write a bunch of code and push it out.

He says "We are a Binance affiliate, we refer users via the opt-in trading widget on the new tab page, but autocomplete should not add any code."

Charitable interpretation: It is possible that he told the development team to add the affiliate code on the new tab page, and someone in the development team decided to add it to the autocomplete code as well, without him realising. I've certainly seen it happen when developers are told to do X and then they decide "oh since we are doing X we should do Y too". It isn't even always a bad thing, but sure sometimes it is.

Of course, the charitable interpretation could be wrong. Maybe he is actually being deceitful here. But, I prefer to assume the best of people rather than the worst.

It was the co-founder & CTO that authored the commits, not a rouge engineer:

https://github.com/brave/brave-core/commits/master/component...

https://github.com/bbondy

Two possibilities:

(1) CEO tells CTO to do something nefarious. CTO does what he's told. CEO gets caught out. Publicly, CEO spins it as an innocent mistake.

(2) CEO tells CTO to do something more innocent. CTO decides to do something more nefarious instead (maybe entirely intentionally, maybe simply by misunderstanding the ask.) Either way, the doing something more nefarious wasn't intentional by the CEO.

Which of the above two possibilities is true? I don't know. But I don't think you know either.

Two possibilities now since your last hypothesis was proven wrong with a simple git blame?

But sure, maybe the CTO/co-founder went rouge, lol.

What's the difference at that point? Both are leaders/founders of the company.

Either way, I don't want to use a browser that either someone is implementing affiliate links in the omnibar because they were stupid, or because they want $$$$.

The traffic and 99% of the browser code isn't theirs, why do they deserve affiliate money?

Btw there's a difference between being charitable and being naïve. It's obvious this was intentional.

What really happened was the CEO and the CTO sat down with these crypto companies and sketched this deal out to the T.

They hijacked the search terms "btc", "ltc", "bnb", etc. and herded users to those sites for a fee.

Could you imagine your scenario though? The CEO just woke up and was like WHOA where'd all this money come from, so the CTO says well I accidently added too many affiliate links, but the CEO was like ehhh keep it like that for a few months until people make a big deal about it, then I'll act surprised and remove it.

I really don't care. I don't use Brave, never have, probably never will.

I just feel like people may be jumping to conclusions with little information to go on.

Maybe that feeling is justified, maybe it isn't.

Who cares which C-level exec is doing something nefarious?

I don’t think number 2 is the amazing improvement you seem to think it is...

The commit creates a new class "SuggestedSitesProvider" which looks like a generic system for detecting pageloads and automatically inserting affiliate IDs. So perhaps this is a nascent revenue stream for Brave that will be applied to more sites than Binance in the future.

Following it further we can even see the pull request and the requirements. https://github.com/brave/brave-browser/issues/9302

Interesting as I didn’t realize Brave did all their development out in the open like this.

“ Similar to top site suggestions, we'd like to add Crypto Widgets and Binance related suggestions based on what a user types in the URL bar. This is mostly an experiment to see if it's useful. It could be expanded in the future to involve BAT or even be used if the user has Brave ads turned on.”

I'm going to have to switch browser AGAIN? Dammit.

Is Opera safe or what shady shit have they done? I haven't used Opera since Opera back in 2006. God I miss the Presto engine and dragonfly.

Can I go back to them or they doing shady stuff?

Opera is still proprietary, and, uh, also they got caught doing some stuff involving predatory short-term loans to the impoverished in African countries, not to mention their CEO was also involved in an entirely different Chinese conglomerate that was also involved with fraud and some lending thing.

Oh yeah and if you haven't used it since 2006: Opera is Chromium now, and the company behind it got sold a time or two.

what the fuck, whats happening in the tech scene :(

what should I use if I _dont_ want to be in the botnet or scammed and outside of google's mesh

Firefox, like always.

I used Opera from 5 to 12, then Firefox till v37, and it's been Pale Moon ever since. Check out the latest release notes. I know I'm not the only one that likes things such as,

>Removed more telemetry code

>Removed the in-browser speech recognition engine and API

>Removed support for the obsolete and unmaintained NVidia 3DVision stereoscopic interface.

Palemoon is Firefox if it were still Firefox instead of feature-for-feature chrome copy for watching encrypted netflix.

I would love to be able to use Palemoon, but I just can't get over the fact that it's a single main developer trying to maintain an entire web browser.

That seems like a security nightmare waiting to happen. If I'm wrong about this, please let me know, I really like the idea.

Except they don’t “maintain the entire browser,” rather, they “maintain” a trimmed-down build.

Thanks for the clarification, that makes more sense. I'll download it and give it a shot.

I'm not sure what distinction you're trying to draw here. The fact that Moonchild has removed some a few features they don't like from Palemoon doesn't make the remaining codebase meaningfully easier to maintain. They're still left with what is effectively an orphaned codebase, increasingly unable to use patches from mainline Firefox, and subject to unknown vulnerabilities in portions of the codebase which no longer exist upstream.

Maybe we're touching the same elephant but we're obviously on opposite ends of it. That's how I perceive Firefox security with all it's crazy new features, old experiments left in, black box DRM that's literally unauditable, etc.

Dosen't pale moon use https://start.me/ by default still? From reading https://start.me/privacy that does not seem encouraging.

> they got caught doing some stuff involving predatory short-term loans to the impoverished in African countries, not to mention their CEO was also involved in an entirely different Chinese conglomerate that was also involved with fraud and some lending thing

Ooh juicy. Any links to read on this?

Previous coverage on HN because I'm very indecisive and don't like giving links myself:

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

You can also find more if you check Opera Software's Wikipedia page.

Thanks!

When it turned to shit, Yngve and Jon got out and did their own thing: https://vivaldi.com https://news.ycombinator.com/item?id=8952517

They were sold to a chinese consortium, so take that as you will.

Vivaldi is an excellent alternative, and the latest versions of Firefox are far superior imo.

Vivaldi is essentially Old Opera 2.0 in terms of features, focused on power users, created by the same guy as the original Opera, and runs on Chromium.

Still putting my vote in Firefox though.

I keep Vivaldi as my "test in Chrome" browser, but their business model is not the most transparent from a privacy perspective (at one point it looked like they were aggregating browsing stats to resell).

Firefox is still my main driver. They make the occasional bad choice but their overall business model is basically the best we can hope for in a browser, these days.

Just use Firefox (or one of the forks that removes builtin extensions and the like). For all of its problems, Mozilla is still probably the best bet we have at building a web browser that won't do shady things (it will do some annoying things, like having Pocket built in by default, but for the most part they still try to protect your privacy, don't force you into creepy payment models and things like Brave tries to do, etc.)

May I suggest using Vivaldi browser? https://medium.com/@Priem19/how-to-use-the-web-properly-f98f...

Are we supposed to “trust” this one now?

Their code for the full browser isn't open source. Only the chromium code is. Although it's mostly UI related code that you can inspect but just be aware.

What is wrong with firefox?

Oh, let me count the ways... or let me just refer you to waterfox's website: https://www.waterfox.net/

Only advantage I see is "No telemetry" option, which you can disable in firefox.

Waterfox sold-out to an ad company (which “has developed a pre-targeting platform that identifies and unlocks consumer intent across channels including social, native, email, search, market research and lead generation rather than relying solely on what consumers enter into search boxes.”)

The founder also claimed that Waterfox was never pivoted as a privacy-focused product.

Reply on news.ycombinator.com