Hacker News Reader

I agree with pretty much everything you've said :)

I guess my gripe is more "Why does the world not work right" than "Firefox has done a stinker here".

And I suppose my reaction really should be "How can we work to give Firefox a leg up, while still encouraging it to intentionally fail many of the metrics most people care about".

It's a hard battle to fight. Don't suppose Google will implement these things that might hurt their user tracking businesses... yeah?... no?... no.

> thanks to the popularity of content blockers like Pi-Hole and uBlockOrigin

Unfortunately these are "block these please" which hurts all the big players for the tiny portion of web users that use them. Every time I've ever moved a feature in software I've written from "all except this" to "none except this", it has always failed spectacularly, at least for a few people. The fact that users will get an option to unblock the services they need is encouraging... the fact that they mention that users might see the dialog multiple times for the same service is not.

But yes, I will try to be hopeful - and you are right, the fact that Firefox does this kind of thing is a big part of the reason I use them in the first place.

> Regardless of Firefox abiding by the standards (or doing what Chrome does) or not, this was always going to be the case, and so it isn't that big a deal.

It's a huge deal to me as a Firefox user. This is a total anecdote, but the number of websites and apps that are broken in Firefox seem to be on the rise. I try to report bugs when I can but the task is Sisyphean.

If Firefox is increasing the friction between web developers and the browser while chrome is lowering it, the problem will only get worse.

I remember a time when Firefox didn't work for anything that required ActiveX.

I remember when Firefox didn't support Flash without a seriously dangerous plugin.

I remember when somehow enough people woke up and banded against ActiveX and Flash.

It seems popular here to make the argument that "doing what's right" poses an existential threat to the right-doer. The corollary to that argument is that in order to survive you must do what is wrong.

For some, it is better to die than to go along with what is wrong. Luckily, it often works out that those who have the courage to do the right thing survive. And when they do the world is often a better place.

Don't cave into the naysayers who predict the end of the world. Keep fighting the good fight.

"And herein do I exercise myself, to have always a conscience void of offence toward God, and toward men."

+1

Your handle "freeopinion" reminds me that although people often say "you get what you pay for," just because something's free does not mean that it's worthless.

Cool story, I still have to use Chrome to talk to my doctor, view my healthcare documents, and get my W2. While Firefox is "doing the right thing," me, the Firefox user, has to use a different browser that doesn't respect my privacy because they don't do what web developers expect.

And you can blame web developers, businesses who hire them, or Google for turning the world into this sorry state. But oftentimes the only choice I have as a consumer is what browser I use, and most of the time it's Firefox. But more and more frequently, I can't choose to use Firefox because some functionality is broken on a website I need to visit.

The more of this functionality that they break, the more often I need to use Chrome.

Your claims are suspicious. A company cannot require you to have internet access to supply you a W-2 tax form. You choose to keep your healthcare documents in some format that requires Chrome? That seems very very strange. Your doctor won't talk to you in person or on the telephone? Again, strange.

You are not forced into any of these things. You choose them as a matter of convenience, cost-savings, or some other reason. You have your reasons, but it is highly unlikely that you don't have a choice.

The choices you have purportedly made have allowed others to make poor choices with little consequence. With less effort than it took to install Chrome, you could have asked for a paper copy of your W-2. That would have put the pain of a bad decision back upstream where it belongs.

> The more of this functionality that they break, the more often I need to use Chrome

From context, "they" would refer to the party that breaks functionality. From the sentence above, I take that to be "Google for turning the world into a sorry state." Your response to this is to "need to use Chrome." Your choices seem irrational to me.

But again, they are your choices and you do have them.

Many of my documents are accessed electronically through various web services. Many of them function poorly or not at all with Firefox. I'm sure I could make a phone call and get them mailed to me, but "don't use the internet" is not an acceptable workaround to a website failing to load in Firefox.

The "they" I refer to is Mozilla's engineers. They have consistently broken or failed to implement their platform as developers expect, and since their market share is tiny, developers do not care and bug reports.

I accept that by using Firefox my experience on the web is degraded. That's a tradeoff I make. What I'm reacting to is that it seems you've put on the blinders from the high horse you're sitting on. In the real world, Firefox is technically limited by the many decisions to ignore what developers are doing.

Instead of blaming the users for following the path of least resistance, blame Mozilla for failing to make the "right thing" the path of least resistance for developers. If Firefox were easier to target than Chrome, supported more APIs and had better developer tools, then we wouldn't have this reality.

> The more of this functionality that they break, the more often I need to use Chrome.

On the other hand, if Firefox is just going to be a clone of Chrome (behavior-wise), then what's it's purpose for existing?

> For me, Firefox seems to be making decisions with user's security and privacy in mind, and I see that as a net positive. As a long time user, it is the only reason I use Firefox.

I agree that that is a good thing. However, the more firefox breaks compatibility with sites people use, the harder it will be to regain marketshare. And if Firefox keeps losing marketshare it will have less ability to influence web standards, and could potentially die altogether, which would be bad for privacy and security in the long run.

Fortunately, state partitioning isn't enabled by default on Firefox yet (it is part of "strict" ETP), so only people who are ok with it potentially breaking sites will turn it on.

> The little players not having data is a win in my eyes, because those are more likely to get breached or sell data to the highest bidder.

I somewhat agree with everything but the above. I’ve looked at data on thousands of breaches and have found that size of organization isn’t really correlated with “having better security”.

"Regardless of Firefox abiding by the standards (or doing what Chrome does) or not, this was always going to be the case, and so it isn't that big a deal."

The "dealedness" of this isn't a binary. One may tolerate a small amount while rejecting a large amount.

I point this out more to put the idea out there (it's an important concept even in your day-to-day job) than because I disagree with the main thrust being made here; as a uMatrix use I traded security for a functional web a long time ago. Breaking trackers is a feature, not a bug, for me. If that breaks your website, goodbye.

I'm having exactly the opposite thought.

As a developer, shit like "Automatic unpartitioning through heuristics" alone is enough that I won't touch this. Full stop.

Firefox is now breaking the contract I expected it to fulfill as the user's agent, and it's doing it fucking at random.

I happen to live in a space where I do need cross site support (both for cookies and requests) and frankly, between Google's push for SameSite, and now Firefox's selectively breaking the cookie jar, I'm pissed.

I'm a bit boggled that we haven't settled on a decent solution to let a site declare how it wants to interact with other sites.

This already fucking exists for mobile too, both Android and iOS support an opt-in manifest declared at a /.well-known/ path on the origin in question, why the fuck are the browser vendors so DEAD SET on removing control from the sites themselves in favor of these rushed, half assed, shoddy solutions.

Let me declare the sites I want to allow to share my resources. Let me do it at a known location, with a standard manifest, with finer grain control than "Random fucking heuristic" and "strict/lax/none".

I feel like the entire purpose of this is to take the control from the sites and give it to the users. The site owners obviously do want the cookies to be shared with trackers if they embed them.

I don't mind at all if Firefox wanted to propose a standard way to declare cross site sharing, and then allows the user to overrule my settings as a dev (or even if they pick more restrictive defaults, if user opt in is a problem).

There's a standard in place, so arbitrary exceptions and heuristics don't create incredible headaches, and there's a clear path to resolving the issue in support/triage with the customer if they create a rule that does actually break my site's functionality.

I do mind, quite a bit, when Firefox essentially goes "Fuck the standards", and starts playing fast and loose with the rules. And I mind for two reasons

1. I expect better from them. I'm old enough to remember how much steam Firefox picked up from IE by just treating a standard as a standard. It was novel, and transformed front-end development in a great way.

2. They are not the market leader, and non-standard, site breaking bullshit only does more to sink their ship, and I desperately want a competitor in the browser ecosystem that is not Google Chrome (or a rebranded chromium port).

Isn't that pretty much exactly what this accomplishes? It means sites first have to request your permission in a popup.

I thought the article made it pretty clear that the heuristics are only intended as a temporary stop-gap measure to prevent every current SSO service from breaking.

> I thought the article made it pretty clear that the heuristics are only intended as a temporary stop-gap measure to prevent every current SSO service from breaking.

That sentence alone is mind boggling - Hey, Mozilla is breaking every standard that previously allowed cross domain authentication, or 3rd party authentication services, but don't worry, it's only temporary... until what exactly?

Either every site under the sun is suddenly asking the user to accept unpartitioning because critical features are broken and a user literally has to click yes to continue, in which case all you're doing is training users to always click yes (EU cookie popups, take two, lovely...)

Or users move away from Firefox because sites are just broken.

They don't even have a long term solution for how SSO services are expected to work here, other than "use this other API that happens to cause the behavior as a side effect, and oh, btw, the global market leader (chrome) doesn't support it yet! Enjoy!"

Where the fuck is my RFC. Where is real planning I'd expect from a from the company that I only know the name of because they actually gave a shit about standards when IE was doing this kind of crap left and right?

I like Firefox precisely because they normally don't do this bullshit (and their standards based docs on MDN are literally some of the best around).

---

My take is that this is essentially security advertising and social signaling, and is another death blow to Firefox from Mozilla trying to push privacy focused paid services.