Update on Firefox Send and Firefox Notes | Hacker News Reader

Update on Firefox Send and Firefox Notes

blog.mozilla.org

228 pointsBoumTAC193 comments

Sad! Developer of `ffsend` here.

I've built `ffsend` as CLI tool for Send to securely share files from the command line. It has been a great success! Thanks Mozilla, for building and providing this amazing service!

For the interested: https://github.com/timvisee/ffsend

I'm currently hosting a public Send instance myself to ffsend keep working. Let's see how long I can keep this going (and funded).

I'm interested in knowing the infrastructure you've setup to continue this service.

It's rather simple actually. Currently hosting it on a clean DigitalOcean droplet with an additional disk, which has been running for ~2 months now.

It runs Send in Docker. I set up this configuration for it: https://github.com/timvisee/send-docker-compose

I presume bandwidth and storage are the main concerns since I doubt compute dominates in this kind of service.

You're right! Luckily files have a maximum lifetime of 1 day, which helps with storage. Almost no computing needed. Expensive en/decrypting operations are done on the client.

Do you know what you'll do when people start sharing illegal content?

Not worry about it? It's not like he can see it anyways, it's encrypted on the client.

That world certainly be the proper Silicon Valley approach: can this be used to harm people? shrug

I'm confused how much responsibility you want to put on a service provider.

If someone sends an encrypted email containing illegal content, is email then considered harmful?

I mean it's the dream, right? It's what we all wish we could build.

You design a system that gives you (the hoster) zero ability to inspect, modify, block, censor, restrict any of your users' content and in doing so you're allowed to abdicate all responsibility for how the system is used because you're literally incapable of controlling it. Pure infrastructure with none of the messy real-world bits.

Good question. Simple answer: no.

I've thought about it though, but haven't settled on anything yet. I can't inspect files. I'll add an abuse report notice soon, abuse@ is already live. I'll attempt to manually review cases. That doesn't prevent illegal sharing, but I think that's the best I can do. If things get out of hand, I might take the instance down. I don't want to support hosting illegal stuff.

A newer Send version (yet to deploy) also shows a clear warning, and requires users to tick a confirmation box, when downloading through the webpage. I hope that helps preventing malware installations.

Earlier you said the max file TTL is 1 day. That's brief enough that it seems the only meaningful action you could take much of the time would be to log the incident and report it to the proper authorities.

Between the short TTL and E2E encryption, I'm struggling to think of any legal obligations you would have in most western jurisdictions. Perhaps logging in some places? Even the DMCA permits more than 24 hours to respond to a takedown notice.

Your tool is very useful for me. Have used it since a long time.

First transfer.sh and now Firefox Send are closed. What service should I trust to send file quickly and securely.

I've honestly fallen back to HTTP/SFTP.

I just rent a VPS, temporarily host the file on there, and give whoever it is a link.

Edit: If my threat model were to include protecting the contents of the file from the VPS provider I would probably encrypt it client side with GPG or something similar.

That's awesome to hear!

You can still use ffsend for now, it still works and uses the Send instance I'm hosting (send dot vis dot ee). Some generous users started sponsoring me through GitHub, so that'll definitely help keep it alive longer.

I haven't found a great alternative myself yet.

I started to used wormhole: https://github.com/warner/magic-wormhole

There is also a Golang port: https://github.com/psanford/wormhole-william

Thank you for building this and keeping it running!

Happy to do so!

Looks like Mozilla is becoming VPN company shifting it's previous focus which was on browserware.

Mozilla VPN seems to be just rebranded resell of Mullavad VPN with Mozilla Goodies.

Mozilla Monitor seems to use https://haveibeenpwned.com/ (also as seen in Firefox desktop)

Mozilla Firefox Private Network looks like another Cloudflare Warp's rebrand (with litte good additions maybe?) seeing that it uses Cloudflare .

Mozilla Firefox is also losing it's usershare and Management division may force in future to ditch Gecko and adopt Webkit/Blink in the hope that it could bring more userbase (just my thought) to lessen maintainance and focus on revenue.

If it brings revenue for them doing this,then it is absolutely good for them , but we are slowly loosing the Original Mozilla as Company based on Philosophy.

Is Gecko open-source? If not, I hope they do open-source it before ditching it.

Ofcourse, Gecko is Open Source. There are many forks of Gecko and Firefox too.

Browsers would be forked then. But,maintainance and adding features require lot of effort which is almost impractical by single dev/group without much funding in the world of ever changing large web.

I am getting very much downvoted. Any fallacy in my reply? Please tell me so that i can correct it in future

To me your comment seems based on a misguided idea of what Mozilla is about. I recommend reading https://civilityandtruth.com/2020/08/13/mozillas-uncertain-f... for some good background.

I know it's against HN policy to complain about downvotes, but I think your response is not covered under that rule in that you are looking to learn, not to vent. You have my upvote, at least.

No idea why, I reread your post a few times and see nothing wrong with it. Likely some people see Mozilla different to others based on their perceived view on "Philosophy". Which they might disagree on.

And I dont see any of your comment about diverging into other product market a bad thing at all.

They are going through the necessary but deeply painful process of diversifying their income away from Google payments, which is much easier said than done.

Mozillas initially incredible partnership with Google, from which they earn the vast majority of their income, essentially turned toxic once Google started experimenting with Chrome. On that day Google’s favourite browser to support shifted from Firefox to Chrome.

Being financially reliant on your main competitor is a deeply troubling and dysfunctional position to be in.

Regardless of how good it started, its time to move on.

This is only necessary because the company has been honorably mismanaged for so long and lacks any sort of consistent vision.

Maybe Mozilla should also look into reducing leadership compensation or at least have it reflect the performance of the company.

s/honorably/horribly/?

> lacks any sort of consistent vision

I have no insider knowledge of how well it’s been managed so I’ll leave that to other commentators.

However I’d say that their vision for openness is part of their curse.

Google in developing Chrome are not held to the same community expectations.

It’s expensive to build and maintain a modern day browser and the competitors have deep pockets to the extent of it being worth completing even at a loss due to the benefits of controlling the platform (being the browser platform).

Mozilla have to extract value somewhere. But where should it be?

I think the challenge is to reframe that Mozilla are maintaining an open commons that all are welcome to visit for free without access fees while also metaphorically “selling cool drinks nearby for a price”.

If the community won’t let them charge for anything they do, and claim “extraction/extraction!” with every move they are destined to go under.

I think the most useful framing for Mozilla fans is:

What here should be part of our global commons and needs to be freely available and what would I/we be willing to pay Mozilla for that extends or compliments these core offerings?

I think I should add part ( if not majority ) of the reason Google started developing Chrome was because the initial Firefox 4 vision, e10s, and its expected performance improvement didn't deliver.

Google was forced to do it by themselves.

>If the community won’t let them charge for anything they do, and claim “extraction/extraction!” with every move they are destined to go under.

I dont ever see that from Mozilla community. No one is bashing them for starting side business or charging for something other than the Browser. The problem is none of their side project were successful in business terms.

>Being financially reliant on your main competitor is a deeply troubling and dysfunctional position to be in.

This seems like an inherent problem with sufficiently large companies; the more areas the expand into, the harder it is not to compete.

>and Management division may force in future to ditch Gecko and adopt Webkit/Blink in the hope that it could bring more userbase (just my thought) to lessen maintainance and focus on revenue.

They laid off most people working on Servo, so the adoption of WebKit/Blink seems rather likely.

I certainly hope it doesn't come to that. Servo was really starting to show serious improvements in both memory usage and speed relative to Gecko and Webkit. It would be a shame to see Firefox devolve into just another rebranded Webkit browser, particularly since everyone loses when things devolve to a monoculture.

Servo was never actually the heir-apparent to Gecko.

Never officially. But I think once they started to migrate components into Firefox it seemed obvious that the experiment was a "success" and that it was on the path to replacing gecko (starting piece by piece and maybe eventually making a switchover).

Mozilla developer here.

The Gecko team was mostly spared from the layoffs. There is no intention to cease Gecko development.

I really hope this is true, but there as been absolutely zero clear communication from Mozilla VP and above managers about being committed to Gecko. Why is Firefox CTO not writing a blog post about that?

You sure? https://blog.mozilla.org/blog/2013/04/03/mozilla-and-samsung...

> Servo is an attempt to rebuild the Web browser from the ground up on modern hardware, rethinking old assumptions along the way.

1) That was written in 2013

2) It was an attempt to rebuild a browser engine up from the ground up on modern hardware - and large parts of that work landed in Firefox.

I've tracked their progress for quite some time. There was never a concrete plan to replace the DOM handling components of Gecko with the DOM handling components of Servo.

It was written in 2013... when Servo was announced. Servo was originally intended to replace Gecko. Anything else is a retcon.

Saying "large parts of that work landed in Firefox" is misleading. A browser engine is a huge thing, and most of Servo is not in Firefox. If you just want to replace a few parts, creating an entirely new engine from scratch is far from the most efficient way.

Why does this matter? Well, because decisions have consequences. Way back in 2013, they were feeling pressure from Chrome, and decided the best way to compete was to rewrite the browser engine (in a brand new language to boot). The original engine stagnated, and here we are 7 years later. What a colossal failure.

> It was written in 2013... when Servo was announced. Servo was originally intended to replace Gecko. Anything else is a retcon.

Here is a quote from the Servo wiki from 2014, which is the earliest snapshot present in the WaybackMachine archives.

>Servo is explicitly not aiming to create a full Web browser (except for demonstration and experimentation purposes). Rather it is focused on creating a solid, embeddable engine. Although Servo is a research project, it is designed to be "productizable"—the code that we write should be of high enough quality that it could eventually be shipped to users.

https://web.archive.org/web/20140718030420/https://github.co...

The words "Firefox" or "Gecko" do not appear a single time in the blog post you cited originally. This is because there were no plans to replace Gecko with Servo at that point in time. They did plan for that possibility, and it was probably a minor goal, but the primary goal was research, as they stated in both the blog post and the wiki entry. They were hoping that they could replace parts of Gecko, I'm sure, but it was never a given.

Thanks for taking the time to reply!

In your quote, they didn't want to create a full browser, but they did want to create a full engine. And it was designed to be "productizable." I think it supports what I'm saying.

Servo was the last big plan from Mozilla to turn things around. Since then, we've just gotten Pocket, random bundled add-ons, etc. It seems like they are mostly just content to slide into irrelevance. And I am very sad about that. I do honestly wish Servo had succeeded, although I thought it was pretty obvious it wasn't going to.

Also, while I'm airing grievances, I think it's very likely that having a few big chunks of Firefox/Gecko be written in Rust is going to be a maintenance burden that will slow down development even more. Now that Mozilla has laid off the Rust and Servo people, what are they going to do?

>Here's the thing though: What this Servo dev thought of as "production ready" and what the Gecko team thinks is "production ready" are very different things. In Gecko-land, it's not enough to do best-practice things like continuous integration, regression tests, error handling, etc. For Gecko, it's also about compatibility -- both with 25+ years of web content (much of it malformed) and a wide range of supported combinations of operating systems and hardware.

>If you're working on Servo, you can be much more strict about what hardware combinations you support and what kind of content renders well. Look, there's a reason that the lineage of all widespread web engines go back 20+ years: it's much easier to incrementally improve that engine while ensuring that you're not breaking anything than it is to start over from scratch.

>I would also like to point out that you don't have to take my word for it: It has taken at least 3 years (probably closer to 4 years) to get WebRender ported over to Gecko from Servo and get it running well enough to the point that we can start saying that it will likely reach 100% deployment within months instead of years.

>My point is that, while Servo was great for demonstrating new ideas and producing eye-popping demos, it was not going to replace Gecko anytime soon, regardless of what those few Servo developers thought. In all the time I've worked at Mozilla, I have never once heard anybody in charge of Firefox say that we were going to do a wholesale swap out of Gecko with Servo.

https://web.archive.org/web/20200815135321/https://tildes.ne...

Thanks for that link!

We might be arguing past each other. He says this:

> Unfortunately a narrative kind of built up around all this stuff that Gecko developers were a bunch of bumbling idiots who were just maintaining a bunch of outdated bloatware, while the Servo project was where all the action was.

This is precisely my complaint. Firefox really did need some sort of strong direction to save it, and Servo was all they came up with. I don't think it was just a few self-important Servo devs, I think (at least part of) management was in on it too. In fact, the blog post above was signed by Brendan Eich, which I find really disappointing (I thought he, at least, was smarter than that...).

Anyway, once Servo sucked all the other oxygen out of the room, Firefox was really doomed. Now Servo is dead and we have... a few incremental improvements to Gecko to show for it. I definitely feel bad for the guys working on Gecko the whole time. That said, they could've came up with some "response" to Servo, but they didn't.

If they switched to webkit there'd be no more reason to use it over degoogled chromium.

I mean, a WebKit-based Firefox would at least be a distinct engine, and a cross-platform one at that. (WebKit isn't very well-represented on Windows in particular.)

Contrast a Blink-based FF, which would basically just be Brave.

Unless there are very significant differences that are noticeable to mass user base, the engine is not a relevant factor in browser market share. When chrome came charging in, Microsoft had let IE fall so far behind that even to my 74-year-old opa, chrome was noticeably better.

People largely don't choose firefox over non-degoogled chrome today. All browsers on iOS are reskinned safari with different accounts for synced bookmarks and tabs, and yet people choose to use different iOS browsers for various reasons, the browser's engine not among them.

It pains me to think about, but from a realpolitik perspective it makes zero sense for Mozilla not to slap an orange fox on chromium and call it a day,

For me, and everyone I know personally that uses Firefox, the primary motivation for using Firefox is because it uses a non webkit/blink engine, and we want browser diversity. If that goes away we there is a lot less reason for us to stick with Firefox.

Although I suopose there is still manifest v3...

I fear that if Firefox switched to webkit or blink, they might lose a significant number of existing users without a clear way to win back more.

I wonder what the future is for Rust?

https://blog.rust-lang.org/2020/08/18/laying-the-foundation-...

The writing is on the wall at this stage. The current Mozilla have no will to keep maintaining Gecko, which in their eyes is seen as burning money which could be spent on "Product".

Calling a service that launched only 17 months ago "legacy functionality" is troubling. Why should I engage with any new Mozilla product or service if they're going to cut it off at the knees after a year?

this question is why i haven't engaged with any new Mozilla product in years. They just KEEP making cool things that you want to integrate into your workflows and then killing them.

Are you using Chrome? If so https://killedbygoogle.com/. Google is guilty of the same.

And so if Microsoft. https://pastebin.com/PMQwd8Q0

Most of these are offline software programs that you can continue to use indefinitely, or physical buildings that are very expensive to run.

Nokia has to be the biggest one.

Not long ago I worked in a lab that was still using Microsoft Windows 95 for one workstation that was a host for a microscope that had a very expensive license tied to that specific set of hardware.

The system has worked great for decades. Data is automatically gathered via a hardware datalogger accessory that has a ethernet interface. Is there any google product with anything close to that useful lifespan?

And this is why we all should have shouted louder when Google set this precedent five years ago. This is going to become the status quo.

If Google can do it why can’t we?

It's absolutely amazing how some people can find new ways to blame Google for something they had nothing to do with. Just Incredible. Additionally, if it had not been for the money given to Mozilla by Google the development of Firefox would have severely been in decline and possibly abandoned.

>And this is why we all should have shouted louder when Google set this precedent five years ago.

Do you also shout loud when Microsoft set a precedent for shutting down products and services? Of course you don't. You just confine your rage to Google. Let's have a look at all of the products and services Microsoft has cancelled:

https://pastebin.com/PMQwd8Q0

Let that sink in next time you do a drive by on a Google related topic and post one of those lame "I wonder when it will be cancelled" worthless posts.

Microsoft is the anti-example. They discontinue something and then support it for years. Sometimes way longer than they should.

I took it to include the EEE era, probably because the question doesn’t track unless you do.

Mixer sends its regards...

Your argument would be stronger if that list was actually products and services. Listing every MS store ever closed and every platform or every version of a no-longer-sold product line makes it meaningless.

I mean, that list has MS-DOS. To which we still have backwards compatibility. And it's twice as old as Google.

Also, tone.

> Do you also shout loud when Microsoft set a precedent for shutting down products and services?

Relentlessly. If you get me talking about MS you won’t be able to get me to shut up.

They’re a bully who was never broken and that just invites more bullies.

Whatever tiny power I have to prevent another Microsoft from ever happening again, I will happily use it, and proactively. I think you’ll find that some of the “unfair” venom FB, Google and Amazon get is from people who feel the same way. Take them down a notch while they’re still in arm’s reach.

Boy that list brings back memories. Front page, bob, zune...

I think perhaps the answer is that you shouldn't. You are clearly not early adopter material. So don't early adopt.

that's why I came to rely only on things

a) I pay for. An amount of /money/, both service and I can sustain with, or

b) I host myself.

Hm, been spending a while creating a 'Firefox Send' copy, attempting to host files. Check out a new verison at:

- https://v2.femto.pw/

Looking for some help if anyone can, :)

- https://github.com/femto-apps/web-file-uploader

The old copy (https://femto.pw/) has been used over 100 million times and sent over 13PB of data!

https://github.com/femto-apps/web-file-uploader is the non-typoed url

Check out this project as well: https://github.com/kern/filepizza

Last time I looked, FilePizza failed on large files, seemingly because it wanted to pull them entirely into RAM. Has that changed?

I don't believe so. It's definitely still got some stability issues.

This is really cool and will probably fill the void that Firefox Send left for me.

Out of curiosity, how do you deal with all that bandwidth? Are you self-hosted?

We are self-hosted, I'd _hate_ to think of the costs of hosting this service through AWS or similar who charges for ingress / egress.

We have 5gbps of bandwidth and 12TB of storage that I've dedicated to the service (costing me ~£30/mo, so a fairly trivial sum).

I'm hoping that if we ever exceed 12TB / 5gbps, others will similarly host their own versions of the application. I've heard of half a dozen people already who have just decided to host their own.

>5gbps of bandwidth and 12TB of storage that I've dedicated to the service (costing me ~£30/mo, so a fairly trivial sum).

I assume you're using hardware you own and the thirty pounds are just networking costs?

Yeah, pretty much. Some of the storage & networking is stolen from other projects of mine which lowers the cost significantly. Almost all of my servers for home projects come with 4TB hard drives which I never use anywhere near the full capacity of.

Well, not exactly a copy. Firefox Send encrypts/decrypts files client-side if I remember correctly. Your service receives the files in plaintext thus theoretically allowing you (or anybody who is able to gain access to the servers) to snoop on the contents.

Why not create a Firefox+ subscription service (for like $10 per month) and then make Send, Notes, VPN, and more exclusive to that service?

Some people over here are dying to start paying for Firefox.

(Mozilla donations go to the much smaller non-profit part of Mozilla and are unrelated to Firefox.)

I am in this same boat. I recently signed up for Firefox Private Network and I'm in the process of switching over to Mozilla VPN. I think both of these services are great (even if they're essentially white-labels of other companies products) and they're the kinds of things I associate with Mozilla and Firefox. I would also pay for their password manager if it were a little more robust (and if they charged for it) just to get the tight browser integration.

Mozilla's deal with Google is worth 500M per year. For Firefox to be independant of Google, you'd need around 4M people subscribing to Firefox, with your $10/mo suggestion.

Now, whether Firefox NEEDS 500M per year is a different matter, but the whole idea of 'some people want to pay for Firefox' seems rather naive as a suggestion for how Firefox can be viable without Google.

I didn’t suggest that the subscription could replace the Google deal. I merely said, why not make the services paid instead of closing them.

Perhaps because of opportunity cost. Compared to how dependant on Google they are currently, maintaining a comparatively low-revenue service whose existance must be justified to a board, may be worse than doing the 'startup' thing of just pivoting _again_ and using those same developers to try and find something that _can_ sustain Firefox; something that can be a core offering and keep Firefox relevant in the market, rather than a small add-on subscription service.

Wrong title, Mozilla; title should have been "Firefox Send and Firefox Notes to be discontinued soon", or something like that.

Don't hide behind the fact. Tell the fact in the title.

It was “Mozilla gives up on …” before IIRC, the mods probably over-corrected the editorializing

Actually was “Mozilla give up Firefox send and Firefox notes”

https://hackernewstitles.netlify.app/

Firefox Send was effectively shut down months ago due to it being used to spread malware, but you could find messages saying that they're working on bringing it back.

I interpret this news as "it's not coming back".

> I interpret this news as "it's not coming back".

No need for interpretation, they state it flat out:

"In the intervening period [since the temporary shutdown], as we weighed the cost of our overall portfolio and strategic focus, we've made the decision not to relaunch the service."

Why couldn’t they make send work and make money while https://wetransfer.com/ is flourishing?

Because all those side projects are not made to make Firefox, or Mozilla foundation better, but to have nice greenfield projects that allow to boost CV and find a job elsewhere.

All those side projects is the reason while Firefox is dying. They completely ignored their core product: they made a worse copy of Chrome that killed all extensions.

But old Firefox extension model (when an extension could patch any part of browser's code) did not guarantee that the extension would stay compatible forever. It was more quick and dirty hack rather than a proper standartised extension model.

Mozilla had 1000 well paid people, maybe they should have tried to figure this out.

But instead of focusing on their core product, like 50 people dealt with Firefox and 950 did various side projects that nobody used.

I get it, hard projects are hard. But it doesnt help that nobody is interested in Firefox development and most people focus on useless side projects used to boost their CV.

Those side projects or the various other 20% time random walk policies push the innovation envelope. It allows the garden approach where a hundred flowers grow, untended, weeds and all. It might be messy but it is supposed to be. It might be uneconomical in the short term sense and therefore first into to the lawnmower during a cash crunch; but it is supposed to be like that also.

I personally have had great, highly individualized, product-market fit with a two year old beta android app out of Mozilla Indonesia of all places [1]. It provides on device unbelievable OCR search for my massive screenshot inventory unique to my personal workflow and it just works.

I have no idea of its future in the new Mozilla but will keep using it until it dosen't work anymore and then find another way.

[1] https://mozilla-next.com/eng/firefox_screenshotgo_beta#first...

I'll bet they got gunshy dealing with abuse and illegal uses of the service. A real shame as it's a no-brainer service to have in their software suite, and a great complement to the browser

True but I’m not sure if when I think about the various ways to send a file on my computer that my web browser really comes to mind.

Super neat service, makes total sense in Mozilla’s portfolio but I don’t see it as a natural part of the browser.

I feel like that might be true for a technical audience who may be more aware of alternative transfer avenues, but i think for regular users it's a frequent use case during the course of business, online learning, etc. especially with the rise of web apps

especially when both sides of the political coin gunning for Section 230, I can see how they were concerned about it.

Yea, for easy github forking! :) Firefox Send was such a great and simple tool for sharing those >10MB (anything that won't fit in an email) files with literally anyone.

Now that we'll be maintaining our own fork (https://github.com/plyint/send), if anyone has any thoughts on features or fixes you'd like added I'd love to hear from you. Just send us a message from our website (https://plyint.com), open a github issue or contact me through my HN profile. I can't promise will implement it, but we'll definitely give it a serious look.

The value of firefox send for me was that 1) it was hosted 2) it was free 3) I trusted mozilla

As a developer, I am already aware of similar open-source packages like magic-wormhole. The code/tools themselves don't solve the problem, though. I had my non-techincal mom exchange sensitive documents through Send but I'm never going to get her to use magic wormhole, and self-hosting is too much hassle for one-off documents.

I'm aware of dropbox etc but if my both me and my mom don't already use them, there's friction to create an account and pay.

I'm not sure whether there's a business model for a standalone hosted version if Mozilla themselves couldn't make it work (and I presume they gave it thorough thought)

I wouldn't presume they gave it thorough thought.

Getting rid of Send is so disappointing. That was a hugely useful tool.

Why not add a Report button and start charging for the service?

Indeed, it was so useful, they could simply tie Send uploads with Firefox accounts and block the abusers. It's so sad to see this amazing service die.

Perhaps someone else can pick up https://github.com/mozilla/send? Not sure how much of this is the production code or not.

The implicit problem is you have to know the download is sketchy in order to report abuse. For your average consumer, that will be after they downloaded it.

Having a consumer download a sketchy file from what should be a trusted service (it's firefox! they're the good guys!) is not good for your company image, either.

And unfortunately, charging for a service is no guarantee that these issues will go away. I have seen fraud links from many b2b services presumably caused by credential misuse. If you operate a file sharing service, please be sure that there is a way to report a file either on the download page or on the contact us page. I'm the guy with too much time on his hands and actually follows up on reported phish emails and I've seen many services with no reporting mechanisms. Also, give your customers their own subdomain so I can selectively allow them in the palo alto.

> Having a consumer download a sketchy file from what should be a trusted service (it's firefox! they're the good guys!) is not good for your company image, either.

I just don't understand this kind of logic. I can send mail bombs with the trusted postal service and people will open them. Does anyone blame the postal service?

> Does anyone blame the postal service?

Yes?

Do you think the USPS does nothing to detect bombs in the mail?

You can’t earn trust by saying “that’s not my problem.”

Ok, fine, they scan for bombs. So people shift to mailing sealed anthrax envelopes (which has happened). A public service is also going to be used by criminals, yet we do not expect the service to be shut down.

> So people shift to mailing sealed anthrax envelopes (which has happened).

Which they also scan for?

The USPS does try to keep the mail safe, and generally does a good job.

Mozilla cannot make the same guarantees about Send so they shut it down.

Ok, I googled a bit. According to this[0] they're running PCR tests on samples from the air around the mail processing. I.e. outside the mail. In a sufficiently sealed package/enveloped that wouldn't be detected.

Well, and with encryption the files going through mozilla are always properly sealed and they can only rely on external indicators such as reports or IP blacklists. So they're doing no worse than USPS.

https://www.cidrap.umn.edu/news-perspective/2003/06/postal-s...

The USPS literally detects anthrax too as a result of that happening.

Because it’s a public service funded by the government.

We absolutely expect public utilities be shut down temporarily when danger exists. This happens with gas, fire, electric. In 2001, when USPS first encountered the 'sealed anthrax envelopes' problem, they shut down lots of post offices for quite some time.

Your framing suggests that Firefox Send was a 'public utility', held to the same standard as a power company or a gas company, required to provide service to all who seek it. Firefox Send was not a 'public utility', though, and so it need not be temporary to shut it down in the face of attackers. Apparently the Firefox group decided to make it permanent.

What if Gmail was shutdown without notice tomorrow? Would any lawsuit have standing if refunds were issued that same day? Would free users have any recourse whatsoever? It isn't a public utility, right?

usps does scan packages though...

Charging a nominal amount for send seems like it would solve the malware problem and help their finances...

A Freemium model seems like the way to go for Mozilla. Is there any reason it wouldn't work that I'm not seeing?

Firefox gets 500M/year from Google (whether they _need_ that much is a different question). You'd need basically the entire current Firefox userbase to pay some amount monthly, or have a smaller subset donate massive amounts, to enable Firefox to operate independantly from Google. That seems wildly unrealistic to me.

Another disappointment from Mozilla. Some of the tools that were kinda of unique from a browser and company that values privacy. I actually thought one of the strategies from Mozilla was to actually build an ecosystem around the browser to bring new users and to have something unique to fight chrome. It seems they have lost completely all focus have no strategy after killing the Servo and Rust Team. What is next killing the Gecko Team and use Blink ?

Unfortunately, that seems like exactly the direction things are heading. What is the point developing arguably the single most complex type of application when not even an entity with the resources of Microsoft can't make the numbers work?

A few months months ago I would have argued that there were clear non-monetary motivations behind Mozilla and Firefox. I don't think that is as true today.

That's progress. I just want the browser, not a "cloud service".

Now to lose "Pocket" and bring back a bookmarks toolbar that lets you find things locally.

Everyone in tech circles keeps saying this, and I agree, but until Mozilla finds a killer app Firefox’s only value is as an ad for Google Search.

Which is honestly super depressing so I will applaud any attempt they make at an actual sustainable income stream.

>until Mozilla finds a killer app

I hate to say it, but that killer app could be ... a directory. A more portal like, tree like way to browse the web. Search has become so unruly. A person new to the web sits at a blank search box, and it might be hard to learn all the great places there are to visit. With the paradox of choice, people get so overwhelmed they just fall back to infinite feeds because browsing is so endlessly open ended. Everyone needs a "start page" of some sort, and I wouldnt mind if the msn's and drudge reports of the world had some nice fresh competition.

Shopping leading you to wirecutter type things, in a slowly refined way. Recipes organized in a mildly coherent way. Crafts, ways to find local home contractors. Wikis of the best way to browse the web. Best practices for life. Promote financial literacy, web surfing literacy, comparison shopping literacy, seo avoidance literacy. Make it easier to navigate the plague the modern web has become, and get people directly to useful things. In a way, designed with purpose and experience in mind.

There are so many service that Mozilla could charge money for that tons of people would use because we are paying someone for those service already so it might as well be Mozilla because they are trustworthy and open source. Stuff like file hosting, photo hosting/sharing, password management, blog/site hosting, etc etc. I just don't understand how Mozilla can be this bad at monetization while sitting on top of a gold mine in terms of reputation, developers and organization.

I completely agree about this, but arguments about how we should be more like a public utility and less like a vc funded startup fall on deaf ears in management. I just don't get it. Providing essential services in a trustworthy way is just too boring, I guess.

The recent Firefox Android change ("upgrade") added "bookmark collections" whatever those are, so hopefully some work is being done on that front?

What do you mean, "bring back"? The bookmark functionality is still there, so are bookmark toolbars and search. The awesomebar searches your local bookmarks as well. Both on desktop and on mobile. This irrational Pocket hatred needs to stop.

I'm crushed to see Firefox Send go away. It was an amazing tool.

In the "This is why we can't have nice things category" it's sad to see yet another encrypted file-sharing service that is inevitably shut down when someone starts abusing it to host malware or child porn.

I've found croc[1] to be a good alternative, but not ideal for async unless you have a NAS.

1 - https://github.com/schollz/croc

It's the one service of the new wave of Mozilla products I actually liked.

Well, maybe lockwise might be ok, but I already have a password manager.

I use Lockwise since I'd been using Firefox Password manager for years. I keep my important passwords (Financial, etc) in Keepass, but for the myriad websites I use that require logins, Lockwise is a great solution. I'm also very impressed by it's iOS integration.

There is no way around it. Either [insert technology name] works for bad guys and good guys alike, or it does not work for bad guys and good guys alike. You can't make technology follow morals.

The moral panic almost inevitably tilts the scales towards [insert technology name] not working for anyone, rather than allowing bad guys use it publicly. So bad guys use it privately, and good guys... well, they can also use it privately, if they are tech-savvy enough. Otherwise, tough luck.

Like it’s a pseudo-public file storage system. If you’re not going to put up the moderation effort and block the spread of malware, cp, phishing attempts, and spam then the people who would get kicked off of, say Dropbox, will migrate to your service and now you’re the company whose links are inherently sketchy.

It’s not really a moral panic so much as it’s damaging to Mozilla’s reputation.

You're missing the point. Dropbox isn't E2E encrypted. Send was. The technology is E2E encrypted file transfer via a central server.

It doesn't matter whether the response is due to a moral panic or an attempt to protect their reputation. The end result is the same - reduced public availability of <insert technology here> while the bad guys generally continue using it the same as before.

The parent comment had a good point, though: trust. If you run a public file sharing service, trusting a link shared through it becomes hard if it's overfilled with phishing and virus-laden fakes pretending to be legitimate things. Often you don't want the risk as a user, and definitely you don't want an association with a cesspool as a brand.

Until trust is solved, running and using such a service remains problematic. It needs not be solved via content inspection, though; if I could verify the sender, I won't care about phishing links (and such links would cease to be useful for scammers and disappear). But this is a separate significant undertaking.

I used Firefox Send for deliverables on a commission. It was so easy. I could send updated versions and set a date for the download to expire to make sure both sides were on the current version. That was worth money. They could have charged for it.

Yes. Yes, we should have charged money for it.

Sigh.

Do you still work for Mozilla?

I see you worked on Send, and am surprised that you'd comment on here in such fashion about the decision-making to not charge for Send.

You can always send files using the WebTorrent protocol, over at https://instant.io

No file size limit.

encrypted and private?

Sort of; the underlying WebRTC protocol WebTorrent uses encrypts the data in transit, and the data never hits the server.

Downside is that the sender, or someone else who has completed the torrent download, must keep the page (or their WebTorrent client) running for the share link to work.

Hate to say it, given that I've been using Firefox as my browser since before it was called Firefox, but I think Mozilla is done if they can't find a way to monetize these services. There's just a complete of leadership. I hope there's a non-Mozilla fork of Firefox that keeps it going. A big challenge I know but Google gets all your data once Firefox is dead.

We have Edge from a major vendor, and it’s good. We also have Vivaldi which has the features I want but is from a much smaller vendor but is also very good.

A couple of good options.

Send was the only reliable tool I'd found to date. I'm really disappointed by this. Hopefully, they'll have better luck finding a profitable product.

they were using s3 for file storage. This was likely just burning incredible amount of cash and had absolutely no monetization angle in play.

We had the monetization angle in place from before Send shipped. Charge a small monthly fee. Management didn't care.

What was the angle they were after then...people will use it so much and love it that they will use FF?

Was there any angle at play other than releasing it? It was a great feature and even a small fee would've been more viable than freemium only.

No, it was just fumbled through three generations of management changes.

It's a shame to hear that. Send was a very good product that saw adoption in my circle, especially among creatives. It was used to share files with clients and replaced WeTransfer for some. I believe a monetization strategy among those lines could have been successful.

And in nearly the same breath they announce a net nanny service to help people maintain their YouTube recommendations bubbles.

I like Firefox, but I worry about the direction the Mozilla Foundation are taking. At least it's Free Software.

Keep in mind the YouTube work is from the foundation, and Send and Firefox are from the corporation.

I've been bookmarking point-to-point file transfer tools. These are not file hosting services like Firefox Send; both endpoints must be online at the same time. Nevertheless, I suspect they might be useful to some other folks here. Please post corrections or more detail on any of these if you have it. I haven't had time to try most of them yet.

WebWormhole: WebRTC encryption, direct data transfer, large file support, browser and command line. Looks more versatile than the others. Has not undergone security review yet.

https://github.com/saljam/webwormhole

https://webwormhole.io/

Magic Wormhole: Data relay required (public relay is often slow), mainly command line.

https://github.com/warner/magic-wormhole

https://magic-wormhole.readthedocs.io/

croc: End-to-end encryption, data relay required (I think), command line only.

https://github.com/schollz/croc

https://schollz.com/blog/croc6/

File Pizza: WebTorrent, seems to load entire file into RAM, browser only.

https://github.com/kern/filepizza

https://file.pizza/

Snapdrop: WebRTC encryption, local sharing only (I think), browser only.

https://github.com/RobinLinus/snapdrop

https://snapdrop.net/

While sad to see Notes go, I've been pretty impressed with the continued support of the free Simplenote https://simplenote.com from Automattic. It's basic but nice, and I've actually gotten help from them the few times I've had issues.

Be sure to backup those notes. Heard some horrorstories back in the day about unrecoverable notes. simplenote is nearly integrated in nvalt.

I'm glad Mozilla are focusing more on their core product (Firefox the web browser) instead of trying to compete in overcrowded markets like file transfer (WeTransfer, MEGA, Google Drive, Dropbox, ...) and notes (Notion, Workflowy, Google Drive, Microsoft OneNote, ...).

The announcement doesn't mention the browser but does mention focusing on Firefox VPN, Firefox Monitor and Firefox Private Network.

Yes. Quite an omission. :-/

Not true:

> While saying goodbye is never easy, this decision allows us to sharpen our focus on experiences like Mozilla VPN, Firefox Monitor, and Firefox Private Network.

Seems pretty clear by now that Mozilla is on a path to just slowly transform Firefox into Chrome or try to abandon it 'to the community' like they did with Thunderbird. Either way they've clearly signalled that they could not give a shit about Firefox any more.

Since Edge is basically Chrome with Microsoft's telemetry baked in that means that your browser choices will either be the one made directly by an ad company or Chrome repackaged by some other company that just wants to pipe the browser telemetry back into their already egregious OS telemetry pipeline.

It is definitely time for a fork or a fresh start with actual privacy, security and simplicity in mind.

I suggest we all write to Firefox and suggest charging $1/month for Send.

Yes, please do this. This was the proposal from the engineers behind it (I had a small part) all along.

Services relevant to data sharing are going to be abused. This should have been expected. On the other hand Notes is being deprecated because isn't used much? It can be handy as an extension.

If you want a minimal setup that does similar job with all encryption done in browser and absolute no plaintext, password send back to server, i just wrote https://www.relaysecret.com earlier this week. It is opensource, with minimal footprint on aws (1lambda, 1 gateway, 1 s3), deploy using terraform and should be very cheap to run. It's a pet project so i limit the filesize to 30mb but you can change that easily if you roll your own. :)

Looks nice!

I've build cryo for end-to-end encrypted p2p file transfers without cloud or signal server components.

Imho all solutions which require a webserver somewhere are doomed to fail at some point, or as in this case can be discontinued.

P2P tools should be client only with no servers at all to survive time and provide independency. Tools on their own don't matter either, but protocols like BitTorrent do.

https://cryonet.io

I LOVED Firefox Send. This saddens me...stupid malware abusers

I've started using https://transfer.sh/ as a replacement

> As of October 30th 2020, Storj Labs will discontinue support for the transfer.sh service.

Popup on the website

https://github.com/dutchcoders/transfer.sh/ fork and works just as fine

It's very confusing. The README there says:

> This project repository has no relation with the service at https://transfer.sh that's managed by https://storj.io. So far we cannot address any issue related to the service at https://transfer.sh.

But the popup on transfer.sh suggests emailing hello@dutchcoders.io.

Someone put together a list of instances: https://adrian.simionov.io/general/2020/02/25/transfer-sh-al...

This is inevitable. Mozilla should focus on their browser tech and monetization, instead of creating competing services to other consumer focused startups.

Listen to the developers and implement API. Firefox web API implementation is so far behind from Chrome. It is saddening.

Sell and bring values to developers. They are your most likely customers, not the general public.

Weird that they mentioned three products this helps them focus on, and Firefox wasn't one of them... I'm afraid that internally, they've already given up on Firefox.

There are some good alternatives out there like https://encl.io/ , pretty much a faster Firefox Send alternative for sending 1GB files for 7 days

At GoSecret.io you can use our upload feature (similar to Firefox Send). We haven't open sourced our code but we definitely are considering it in wake of Firefox Send getting shutdown. Please ping me if you're interested

I worked on blackhole.run as a more advanced version, but it is sad to see such a cool and secure service shuts down; there is a need to have more secure tools, not less. Thanks to the Mozilla team for a great job.

As a Firefox notes user, baiting me in with an "Update" title is cruel.

Oh man, send was great. I think I would have paid to use the service just fine.

Sad to see Firefox Send being discontinued, it was a great service.. In wondering if they'll keep updating the source code and simply stop hosting an instance? Because I wouldn't mind hosting my own.

Damn, I didn’t know they already taken Send offline. I don’t use it much, but it’s great in a pinch for just getting a file to a stranger quickly and without much fuss. I’ll have to explore the alternatives.

Darn, Firefox Send was excellent. end-to-end encryption, user-friendly, backed by a reputable privacy-focused company.. Anyone know a decent alternative?

https://send.tresorit.com

SendGB.com is good way for file transferring up to 20GB. No needed registration or verification.

They are dropping things I might actually pay for to focus on products I never will...

118 comments at this point, at least 5 complaining about Mozilla management. Hmmm

~ $500M funding a year.

man that sucks I loved send. I generally used magic-wormhole with people who were comfortable setting it up but as far as ease of use went send was great.

Still true: https://xkcd.com/949/

Now do Pocket integration! :D

>Unfortunately, some abusive users were beginning to use Send to ship malware and conduct spear phishing attacks.

Isn't it absurdly incompetent of them not to foresee this?

Yes. The engineers that worked on it foresaw it, but for some reason management didn't care.

That's good.

Reply on news.ycombinator.com