What happened to Firefox Send?

Hmmm. Several of the listed feature seem like valuable improvements over Magic Wormhole. That leads me to think that maybe several people should go to the bother of an IETF working group so everybody's platform gets at least a baseline interoperable thing in this class (PAKE driven single file transfer) like with TLS or SecSH, rather than all having their own preferred option that's incompatible.

webwormhole does everything on the client via RTC IIRC? https://github.com/saljam/webwormhole

File.pizza is great! It uses WebTorrent[1] to seed files right in the browser. The downside to this is, you have to have your browser open the whole time you're sending the file, as it's direct peer-to-peer. Firefox Send was an "upload it, get the link, and they can download later" kind of service.

1. https://github.com/kern/filepizza#faq

I've been using webwormhole a lot to get photos from my iPhone to my Linux box. Works great!

I've used File Pizza to share files with friends, but it feels like the upload speed is being bottlenecked by something that isn't my ISP (I have synchronous upload) - is there an inherent speed issue with using WebRTC for this?

If you're just sending files between devices that you own, KDE Connect [1] is cross-platform and works pretty well.

[1] https://kdeconnect.kde.org/

Couldn't someone pretty easily write a native GUI or browser app that wraps Magic Womrhole?

> There's https://webwormhole.io/ and https://file.pizza/ , but can I know what they really do behind the scenes?

Also they're not very reliable. I tried to use both of those a couple weeks ago and it just didn't work. File.pizza crashed during initialization on a large file from a friend, and they both failed when I was trying to send a file that was only about 3GB.

I've started a UI for magic wormhole:

https://github.com/sneakypete81/wormhole-ui

It's GPL, cross-platform, native (Qt) and uses the same Python library as the Magic Wormhole CLI.

Just fill that field with crap. Not required to get the files sent.

Actually - I think you're right.

This doesn't imply the benefits that were weighted against the costs were monetary.

Google is giving them so much money, for such a long time, that it is hard to replace. Golden handcuffs. Donations and $10/mo "Firefox subscriptions" aren't going to make up for it.

There are ways they could make money and leverage their browser, such as becoming a certificate authority (they're literally outsourcing profit) or making their own search engine (which would probably be a bad idea for other reasons). Nothing else is going to replace $400m/year.

Their real problem is not "making money." It's too much easy money making them go soft, and then wasting it.

Half the things people criticize them for are attempts to find revenue. The criticisms are often reasonable but you can't say they're content to rely on Google.

My tabs change order.

That's a personal preference, but I prefer the way the tabs were shown in the older version, I could see more at the same time and reorganize them

Bookmarks and top sites are only visible when opening a new tab, not when placing focus in the URL bar. If I want to go to a new site I have to either type the address, or open a new tab leading to a lot of old unused tabs that need to be cleaned up.

UI is significantly changed for the worse - things like tab handling (tabs go to the top of the list which may be hidden from view), swipe controls (close tab requires some weird "must swipe across 40% of the screen" motion to be recognised) and graphical issues have all suffered badly. It's not just a case of getting used to the new design, usability is an afterthought.

But yeah, the ability to use extensions on mobile was the key feature for me switching to firefox. Now I would just like to find a non-sucky-non-chromium browser.

I've had many bugs since the URL bat went to the bottom -- it crashes on some websites and often has multi-second hangs. I had to go back to chrome (I will try it again in a month, and hope it has improved, as I prefer Firefox).

Tab ordering is messed up. Tab scrolling is bugged. Everything from before requires more taps than before. Pages randomly render blank. Normal and private mode gets stuck and next intent tab is opened on whatever mode was explicitly opened before.

I would count the bullshit extension whitelist as the single biggest regression. But it is not new, so its not counted as such anymore?

The worst part, I will still be using Firefox because of my principles. Mozilla knows that userbase like me isn't leaving, and those unlike me aren't staying. It doesn't matter how big of a screwup they cause next time. The writing is already on the wall.

They made simple workflows more complicated, removed features and move UI elements around for no apparent reason.

Weirdest thing is how they moved the address bar to the bottom of the screen. You can put it back to the top of the screen but it's like - why?

There was a useful list of most frequently visited sites on the homepage, which they've decided to remove.

Opening a new tab or a favourite now requires at least two taps (one on top of the screen, and the second at the bottom), or one long press, while it required only one tap before.

With their experience in software development, Mozilla should now that users mostly hate changes, although we can be fine with it when there are improvements too. But in this case, there's no improvements as far as I could see, just random changes to the UI, a few things worse, a few things different for no reason, but nothing better.

Overall it gives very little confidence in what they're doing. It seems there's no leadership or overall vision at Mozilla, just random teams making random changes just for fun.

No tab queuing means I can't open a bunch of tabs from another app without constantly having to switch back and forth (Open link in another app -> Auto-opens firefox with that tab -> switch back to origin app).

> Apart from extensions requiring whitelisting, how is it worse than the old mobile FF?

This is the most important point by far. First-class add-on support was the one differentiating feature that Firefox for Android had over every other browser on the platform. There are a handful of other browsers with add-ons on Android, like Kiwi, but they aren't nearly as seamless as Firefox was.

I'm using Fennec to write this comment because of Refined HN, I just turned off auto-updates. Not going to switch (at least for now) and I love Firefox but who knows where we'll be in a year? If we're in the same spot then I'll have to switch to Kiwi for these use cases.

I have Nightly installed and it's faster - whitelisted uBlock Origin alone solves a lot of problems in addition to GeckoView's massive speed improvements - but it doesn't fit every use case, so I have to keep Fennec installed.

The devs seem obstinate about ever allowing non-whitelisted add-ons outside of Nightly, which is... odd, it's the one feature they have over the competition. They seem similarly obstinate regarding about:config on stable.

There are other grievances (I actually disagree with the detractors on the default position of the address bar - it's far easier to use on tall devices) but this is the one thing that can't be found elsewhere, and it's gone now.

To reiterate, this feedback comes from a position of love, not hate, and I think most other people here feel the same. The devs are getting a lot of heat on places like reddit though, and the Play Store reviews for another. My limited understanding is that Fennec had to go eventually.

A huge annoyance for me personally: stored passwords are no longer applied to HTTP basic auth.

There were question marks along with the numbers.

Clearly it’s a rhetorical device, presenting a reasonable speculation that matches the evidence (number of projects, and quality), as part of the natural flow of the writer making their point.

Should not be too difficult to estimate the actual number: https://hg.mozilla.org/mozilla-central

Same deal regarding people who work on FF vs those who work on FS

How many people worked on these features vs how many are employed though?

There's a big difference between Firefox the product and the renderer.

I'd argue the parts outside the renderer have got worse even if the renderer part has got better.

As an engineer I see the value in these projects, but as a user my biggest gripe with FF is the lack of proper multilingual spellchecking.

This has been on their Bugzilla for 20 years:

https://bugzilla.mozilla.org/show_bug.cgi?id=69687

I honestly don't see these as a good sign for a browser as a tool, instead of some software development adventure.

Firefox has a much smaller team than Chrome to begin with, and they can only work on so many things. If they keep spending time in "re-inventing the wheel" (in addition to what you listed, they also revamp their mobile client quite a few times in my recent memory), what left behind is attention to details in UX and UI that users can feel, which is what Firefox was famous for.

I'm not a developer, but I've submitted or engaged in many bug tickets on Bugzilla. What I can tell from my experience is that the response to bugs (critical or not) are getting slower and slower. Not just patches, sometimes you will have tickets that took years to have someone even looking at it. My feeling is most of developers are more likely to spend their time on Mozilla's "big goals" than maintenance.

Just to give one example, there is still no full range video support in Firefox in the era of video game streaming. This alone lets me to have to use Chrome to watch Twitch.

Did they not just lay off most of the engineers who had built all of that stuff?

Quantum was a marketing name for various improvements that landed before support for old extensions was removed.

Because Mozilla keeps burning up their good will.

> evidently focusing on their existing userbase isn't viable.

I disagree.

First of all: their strategy to ignore the requests of existing users in order to focus on some potential new users doesn't work. Firefox lost around 10 percentage points of market share in last few years.

Second of all: the whole "strategy" of alienating current user base in hope of finding new users is batshit insane.

Browsers are a mature product: it is much easier to keep current users happy and grow organically. This is not some start-up that will come up with a killer feature - you evolve the product.

You can scroll a bit up, even in this thread to see people complaining about the terrible user experience in last Firefox for Android roll out. Do you see a single person praising it? Long gone are the days when tech-savy users would recommend Firefox to their friends and family. Also, why did they even roll out a half baked product? Couldnt they fix it before rolling it out?

As an user, at this point you might start to wonder if it is even worth it to update Firefox. How will the new patch break your workflow? Will some useful features be cut? It's not even about the bugs and the project seems to have them.

People go to Chrome because it is stable. No batshit insane changes to UI or workflow. [and yes, I am aware that Chrome wants to kill the address bar to introduce "AMP" - what is a terrible thing for whole internet]

(not the parent)

2) I'll concede the technical reasons. But it's been something like four years now, and you still haven't caught up with what the previous extensions could do. There's still no way to remap keys without waiting for the current tab to load, for example. This is a very important UX feature!

4) The problem is, when you force users to go through the Mozilla gatekeeper, it's all the more important to get this right and not have that gatekeeper sleeping on the job.

Second, the failure behavior was not fail-safe. Users had their previously-signed addons disabled when this struck. Many of these were necessary to protect their privacy, which was then compromised.

(Proper fail-safe behavior would have been to allow already-signed addons to keep working or put up a warning, so don't tell me it would have needed a huge investment of resources to avoid that catastrophe.)

How many other browsers have had a sudden global feature outage like that?

And, to make it worse, your leadership thought it was somehow reassuring to say, "Oh, don't worry, we broke the promises of the user experiments feature to push out a forced update that fixed this!"

>A decision to not sign addons would have consequences as well -- which we knew intimately, because they were very, very real and growing rapidly.

Mozillians keep insisting this but I have yet to see evidence. Has there been even one case of a user a) who is technically adept enough to enable unsigned add-ons, and b) sideloaded an extension, and c) suffered a security catastrophe that merited Mozilla intervention? Most of the naive users you're claiming to protect can't even get past a).

Chrome allows unsigned addons just by toggling developer mode. Where are their massive security breaches from that?

The original promise of Firefox was to give me back control of my machine. Having to go through Mozilla for my custom extension just feels like the days of getting software from shrinkwrap at Best Buy again.

My parody: https://www.youtube.com/watch?v=taGARf8K5J8

1) When I write about people working on Firefox I mean people fixing old bugs and working on the features that USERS want. Users are the most interested in the core product: the browser. They also want the browser to get the functionality that was removed (extensions!).

When you write about Firefox, you seem to write about various side projects like Firefox-Send, or Pocket that barely add any value to the actual users. Users don't want them (or even ask for them) - yet the teams are very happy to start and make some half-baked greenfield product [after all Firefox Send is a project failure - couldn't stop malware + nobody used it].

This might be a blasphemy, but IMHO even creating Rust is a bad side project. [maybe good for the world, but definitely bad for Firefox - resources are removed from browser development team]

2) Your comment makes me lose hope. Users are very clear: they want extensions. Yet you act as if XUL extensions is the only way to make extensions. Ever.

Do you mean that the whole Firefox team (probably 1000 people) cannot invent a new and secure extension model that allows to adjust the browser per user needs? I get it - creating it is hard. But it is literally your job. When you are a Firefox programmer you should work on the core product. Not on some easy side-project.

From outside perspective it looks that nobody wanted to deal with the difficult problems. Management just let the developers to ignore them and create new, sexy, greenfield side projects.

Another user pointed out that the new extension model does not even allow to remap keys immediately (personally haven't tested it) - most computer games allow this, so don't act as if this was some impossible programming challenge.

3) When you release unfinished, buggy products you alienate your user base. Most users understand that software can have bugs. But why does Mozilla constantly release things that break the users' work-flow? From user perspective it feels like change for the sake of change. You start to wonder what feature will the new patch remove or break.

At the same time your competitor is reliable. They can change the inside, but they don't touch the outside: the user interface stays constant.

4) The problems with extension signatures is a complete fiasco of the Firefox project management. It shows that inside you have zero control over the process - no tools to track workflow, critical tasks and what needs to be done? (are you still stuck on mailing lists?)

This one is 100% on Mozilla and please dont come up with some excuses, because they sounds pathetic.

I repeat: from user perspective it looks like a very small part of Mozilla deals with the actual Firefox and everyone deals with other, random stuff. Some gatekeeper had one job: sign the extensions once per year - and failed.

Also when you sign the extensions using some strange side channels, you sound like hypocrites when you claim that Firefox does not spy on its users.

5) Instead of focusing on core product, old bugs, user requests - the teams prefer to make "sexy" greenfield projects.

Proving proper Firefox installers to companies, means higher market share and consequently more money from Google. It's like someone at Mozilla was sabotaging the company from inside. Sorry, your argument that providing installers cost money is just absurd. Why you dont use the same argument about Firefox-Send, Pocket, or 20 other side-projects that are leeching development time/money from the actual browser? Browser is the one that earns money, but it is stripped from resources that are used for "adventures" of developers. Like the Firefox Send "adventure" that was a failed idea from the start, failed at the end. That money could have been spent working on your core product.

Also, when we speak about installers for corporate multiple people claim that inside Mozilla, there was a stubborn idiot that didnt want it to happen. It is a complete failure of management who didnt identify that person and fire on the spot.

Which is, of course, exactly why they couldn't use any of the normal methods of dealing with malware.

Technically, there are ways of scanning files without necessarily having access to them [1], but they're not production-ready yet.

[1]: https://blog.cryptographyengineering.com/2019/12/08/on-clien...

I don't have any specific knowledge, but my general impression was that malware was a very real issue that nobody could come up with a realistic response to. Other than that, it seems like Send was a breakout success.

(I work for Mozilla, but mostly on the JS engine.)

blackhole.run is a neat FOSS encrypted service similar to FireFox Send. I'm not affiliated at all just thought i'd mention it

Why would it be mozillas fault? If someone sends cp via snailmail, will the postal service get sued?

I wonder if renaming the domain from send.firefox.com to fileshare.com or something like that would have helped with that

A person abusing the privacy features of a file sharing platform to send unwanted files that damage people's computers is in fact, a bad thing

That is not an argument against privacy but it does make it harder to provider private services

Thank you for the info. I thought it's setup specific, didn't know anchor string is never sent to servers in general.

Let me spin up a $5 vps on some random company, setup next cloud, and then send a link to my friend so he can download a song? Silly!

I'm not sure about any audits or anything they might have had, but they're not a random fly by night. Used pretty heavily by a lot of people involved in media production.

Keep in mind that if security is important, you can still self host Send.

AFAIK they don't have a "security" approach. Files are stored on their servers unencrypted. It's a completely different situation than Firefox Send was - you need to be encrypting the files yourself if keeping your files secure from WeTransfer is important to you.

I used to work there, security was mostly decent with the exception of not encrypting files client side. We advocated for it many times but the founders wanted to keep the UI as simple as possible for users, which means that forcing users to send the encryption keys to the receiver via a secondary channel (ie not via WeTransfer, which would defeat the purpose as we would be able to MITM it) was a no-go. You can always encrypt the files yourself with the method of your choice and then send the encryption key over Telegram/Signal/whatever. The company has existed for over 10 years now and is profitable, so it's not going to disappear overnight or anything.

That said, the thing that apparently killed Mozilla Send (becoming a hub for spam and child abuse material) was much easier to handle. The last big project I was involved in was an automated photoDNA scanner to detect suspected child abuse material. It would pull in various lists of hashes of known bad material and flag any matches for manual verification by the department of the Dutch police that handles such things.

Ssh with tar is handy for multiple files. Just be careful you're sending and receiving from the right place. Similar for rsync.

(cd /right/place && tar -cf - patt*) | ssh remote '(cd /dest && tar -xvf -)'

Of course, you can also use the compression flags with tar.

It does require having an account on both machines though. I've used nc in situations where one machine is owned by someone else.

Look again. :) That's how I have it.

>The wormhole send file mode shares the IP addresses of each client with the other (inside the encrypted message), and both clients first attempt to connect directly. If this fails, they fall back to using the transit relay.

From https://magic-wormhole.readthedocs.io/en/latest/welcome.html...

> There's no good UI to make the key stronger: you can either use, say, "--code-length 16", which makes the receiving code ridiculously long

So you want short, high-entropy keys in a restricted alphabet? That might be tough.

Anyway, if it’s not brute-forceable and/because attacks are visible, it’s not really an issue.

> By default, authentication key has only 16 bits of entropy. (I wish I was making this up…)

It's a PAKE being used for Socialist Millionaire-style interactive authentication. So that key needs to be successfully guessed by the attacker. If they guess wrong they don't get any further attempts, game over, all three participants (the sender, receiver and this attacker) learn it didn't work. That's just not an attractive attack.

I've written on HN before that I think this is too few bits on balance, but that's because of social effects (a million people use it, one person gets very unlucky, that impacts take up for the same reason people don't review products that were fine, they're either 5/5 best in class or 0/5 this product killed my cat)

Setting code length 16 means you want a 128-bit PAKE. You've noticed that 128-bit secrets aren't very convenient for humans. But you don't seem to have thought any further than that, just convinced it should be "fixable" without introspecting about the core problem.

> 5) If the interception fails, the attacker still ruined the transfer. (DoS)

Worse, because MW is so happy to reuse channel ids, with some amount of luck, one can ruin multiple transfers in one go:

• Alice runs "wormhole send foo", which generates code "1-revenue-hamlet".

• Mallory runs "wormhole receive 1-bad-code-haha", ruining Alice's transfer.

• Bob runs "wormhole send bar", which generates code "1-enchanting-drunken". (Channel id 1 is now technically free, so why not.)

• Alice's friend, unaware of Mallory's malfeasance, runs "wormhole receive 1-revenue-hamlet", inadvertently ruining Bob's transfer.

To specify the port number explicitly:

    python3 -m http.server 8080

(Listening on port 80 may require more privileges.)

(To answer the various questions, here's the --help. Also the docs are at https://docs.python.org/3/library/http.server.html#http-serv...)

---

$ python3.7 -m http.server --help

usage: server.py [-h] [--cgi] [--bind ADDRESS] [--directory DIRECTORY] [port]

positional arguments:

  port                  Specify alternate port [default: 8000]

optional arguments:

  -h, --help            show this help message and exit

  --cgi                 Run as CGI Server

  --bind ADDRESS, -b ADDRESS

                        Specify alternate bind address [default: all interfaces]

  --directory DIRECTORY, -d DIRECTORY

                        Specify alternative directory [default:current directory]

Chrome style profiles that are a 1st class feature; that isn't accessed with a secret url, doesn't require multiple instances of Firefox in my dock, can be toggled between profiles easily, can be easily identified with a icon in the top corner of the browser.

I heavily use the firefox containers feature which is awesome.

My experience across several devices is that Firefox's performance is much better on Linux and much worse on macOS. Not sure why.