FLoC Away from Chrome
floc-away-from-chrome.com
floc-away-from-chrome.com
Then Google Docs, Drive, Voice and a few other apps with the addition of Chromebooks started to appear and all of the sudden a few key features stopped working for Firefox. Probably the most important teachable moment was just how few features it takes to flip users.
Maybe we'll see Firefox regain browser share are users dump Chrome. Edge even has a shot at this point - a strange irony bringing us full circle.
I guess the real question is how long until we iterate on this loop again? What will compel users to jump back into the embrace of <insert not yet but eventually evil company> versus the relatively consistent arms of Mozilla.
Also, FWIW, Mozilla isn't innocent either. Despite being very much _less scummy_ they have still upped their scum factor a bit over the years. Let's not forget they are quite happy to trade millions of dollars to make Google the homepage for their users. While nowhere near as egregious they have some tracking happening ("experiments"), they aggressively push their Firefox Accounts stuff, appear to be selling spots on the homepage tabs, etc.
This is somewhat explored territory. KHTML, Webkit, Blink etc. have resulted in a lot of the "important bits" being in WebkitCore.
Microsoft has more than enough resources and engineers to continue to support or even fork Blink even if Google went full closed source (just like Google did back in the day with webkit).
I wouldn't trust Microsoft to be better than Google on privacy TBH. In fact I feel that given the opportunity Microsoft has prooven time and time again they would be worse, but they aren't as successfull with Bing so they don't have the opportunity.
WebKit came from the KDE project via Apple to Google.
Mozilla, you're like... 50/50 on this. You do awesome things like per-site containers and default off for 3rd party cookies, and then you do weird things like the Mr. Robot alternate reality game.
Like... it kills me, because I'm pretty sure you were just trying to be fun and delight your users. And I hate that the web is at the point where nobody trusts anyone. (JoCo? If you're reading this, "Solid State" was ahead of it's time. My favorite album.)
But we need you, HARD.
I'm glad there are alternatives to Chrome though.
If it turns out you cannot completely disable it, and you still want to continue using a Chromium-based browser without FLoC, you will have to use a fork. Vivaldi and Brave have already announced they will remove it, and I'm sure Ungoogled Chromium will do the same.
I don't know the current situation but I stopped considering Firefox an alternative or mozilla more trust worthy than Google at that moment.
There are still alternatives but that's more things like the default gnome webbrowser.
At heart Firefox's financing model is as broken as Google's. Yet all the real alternatives aren't investing in the actual development.
Give me a competitive browser and render engine with a patreon button or something similar as only business model and I'll switch. At the end of the day that sort of thing needs financing and Mozilla's strategies aren't at heart different. And I don't know current leadership but I haven't heard the all clear yet. Is firefox currently more privacy conscious? People just assume Firefox is a clean browser but last I checked those assumptions were still marketing and not reality.
Mozilla aren't more holy than the pope, but of course they are more trustworthy and privacy oriented than Chrome. You can see it basically everywhere: containers, cookie management, uBlock support etc. They're not perfect, but they are creating a browser, while Chrome is becoming essentially an ad delivery tool (surprise, surprise, an ad company creating an ad delivery tool).
You know, I was furious about the pocket integration and partnership when it first happened almost six years ago. I didn't like the idea of third-party integrations. I was also mad that they didn't bow to pressure from the community and remove the integration...
But now, I kind of respect Mozilla for keeping it despite the community pressure. They were making money with the partnership, and money from sources OTHER than Google is a good thing.
After two years of this, Mozilla realized that Pocket was making so much money on paid memberships that it was smarter to use some of their war-chest to buy Pocket outright.
That's right, Pocket is owned by Mozilla now and has been for 4 years. [1]
Now it's an important part of their financials. In their Auditors report covering all of 2019 [2], they say "Mozilla’s subscription revenues primarily consist of revenue from subscriptions to a service known as Pocket Premium". The subscription revenue for 2019 was over 14 million, triple what it was in 2018.
This makes me more comfortable because I don't mind, in theory, subscribing to services that actually fund Mozilla.
[1] https://blog.mozilla.org/blog/2017/02/27/mozilla-acquires-po... [2] https://assets.mozilla.net/annualreport/2019/mozilla-fdn-201...
Why anyone who considers themselves privacy conscious would deliberately ignore such red flags in favour of Moz coolaid is beyond me.
Though this doesn't mean I have no love for Firefox. It is a great browser when stripped down of all the bloat. Currently use Librewolf as the FF alternative and this gives me my peace.
This particular incidence doesn't in any way disprove the argument that just a few flashy features is sometimes what it takes to get a lot of users to flip to a new -and in some cases, inferior- product though. As software history repeatedly acknowledges, that is fundamentally true.
The biggest crime chrome made was to add a flag that enabled users to use a bottom address bar then completely remove it months later.
This felony was enough to make me export all my passwords and move them to another Chromium-based browser that had the single feature I had longed for. Funny enough it also opened up my eyes to bitwarden and haveibeenpwned. Maybe all this was sort of due.
I occasionally use vanilla Firefox for testing out ads and other links.
"Innocent Mozilla" wouldn't exist today, first because apparently there's always something to complain about, and second because those people also feed families and pay bills.
First thing every web user does, pro or amateur, is configure their browser to access Google easily. One way or another, Firefox will serve Google first, except for a loud minority of people who would use Duck Duck Go or something like that.
So why would Mozilla walk away from millions of dollars? Only to see itself bankrupt and Chrome take its already dwindling marketshare?
These millions sure are a juicy carrot. Question is, were there other revenue model options, before taking on such a huge conflict of interest? One that effectively compromises you and assures you can never take a real principled stance against your competition.
I don't understand this attitude. Is there any better search engine than Google today? No. If Firefox hardcoded Bing to the homepage, or some other such "principled stance", people would completely stop using them.
Principled stances work great for TV pundits and politicians, and in both cases because they don't care if they lie to you.
In the real world we deal with nuance and practical situations. Mozilla doesn't have to HATE or DESPISE or BAN Google, or whatever other verb implies strong enough principled stance. They can recognize them as the lead search engine, and do their part when they're in position to.
It seems in the public debate we want to reduce every situation to a pro-wrestling match.
From time to time, Bing and DDG are better at searching web than Google. Not always, but the number of times I started reaching for an alternative search engine has increased.
Hate and despise show no principle, ban is hard. How about independent, not co-opted?
Do you think companies have to be unethical to feed their families or pay bills?
If you start digging too deep, it's unethical we get up from bed in the morning at all.
The problem is it's become a cultural phenomenon to hate big corporations, as a way to offset our guilt for using their products and services. Ask anyone and they'll tell you how much they hate unethical Big Oil and they may even tell you so while using oil-produced electrical power or driving a gas-powered car.
If enough people really cared, they'd change their homepage from Google to something else. They don't. Ergo I guess we're all unethical. Or maybe we need to stop lying to ourselves and realize the world is shades of gray, not black and white.
Since we believe in choice ... the Google homepage "scum accusation" is a little harsh.
I'm very happy Mozilla / FF are still in the game.
Thanks to desire to kill Flash, and the broken support for hardware accelerated canvas and WebGL, given that as game studio you have zero control over hardware support on customer's browser, the flourishing Flash indie scene has moved into Unreal, Unity and Godot targeting native instead.
Even if WebGPU and WebAssembly ever fix what happened during the last decade, they are years away to actually replicate the capabilities Flash offered to gamedevs in 2011.
Use Firefox if you actually want to fix the web.
With FloC, we now have a test case where we will see whether or not other Chromium based browsers can make independent decisions that go against Google's interests.
I'm wondering whether this is ultimately a more effective strategy if the goal is independence from Google's business model while offering a performant browser that works on all websites.
Mozilla has to put tremendous resources into implementing browser features that are uncontroversial and unrelated to Google's business model. And those resources are paid for by Google.
That said, there are certainly good arguments in favour of having more than one rendering engine. After all, privacy controversies are not the only reason why competition is healthy.
Google used all the scummy practices, incl. youtube, gmail, docs and all advised to switch to faster/modern/etc. browser. Android straight out comes w/ chrome that's built-in and cannot be removed (save for rooting).
With the amount of wealth and power (and interests), it's unrealistic to expect a change would happen on its right own. Firefox is effectively a slave of google ads money as well.
Back in the days Microsoft was close to get split over IE. What google does is in no way less sinister, so unless there is an antitrust process involved, I don't quite see the hegemony of Chrome ending anytime soon (or ever).
I think "the web" (search engines, youtube, social networks) are a lost cause. Too centralised, too much opportunity for tracking, privacy nightmare, security nightmare. The solution? RSS.
How you read RSS content shouldn't be that important - let's stop focusing so much on rendering pages, and more on delivery.
Do as the good old times when we showed a banner to IE users below a certain version, and suggest better alternatives.
"Redirecting people here is probably a dumb idea."
As a thought experiment, i've wondered what would happen if webdevs started to add those ugly "This website does not support Chrome, please install [Firefox](...) for the best experience."
Does Chrome have the branding to sustain it? Would the websites take the traffic hit? If trends continue as they have the last 5+ years, it may be a test worth running.
Every student in America is running a Chromebook. Why do they need branding?
I don't think sites want to risk losing users because of the the browser they use. Competition is brutal out there.
I use Chrome for exactly one reason: adding shortcuts to websites as an app. Firefox at one point had (very broken) support for this, but they've since removed it (on desktop, it's still possible on the mobile app).
It is simply untrue that Firefox gives me the best experience. If you're going to block Chrome because of web privacy ideology, then just say that. Don't lie to your visitors. Telling me Chrome "isn't supported" is obvious hogwash. Instead you should tell me that you have blocked it, and why you have blocked it, and maybe then I would consider opening your page in another browser.
Strong arming users with false pretenses is deplorable, no matter which side is doing it.
That's one of the most unique reasons for keeping using certain browser I've even seen.
It is a much better user experience. With things like Gmail or WhatsApp Web I don't want them to be another browser tab, I want to be able to switch to it and control the windows with my window manager. I am never closing these windows, and trying to find them among open browser tabs in different browser windows is not fun.
Browser tabs are a not a good replacement for desktop window management.
Frankly the same problem exists in PCM’s, Apple’s proposed solution to allow private tracking from ad clicks: https://github.com/privacycg/private-click-measurement/issue...
However, both of these are solutions to help web developers of third-party sites and ad networks track end users anonymously. All would argue that they’re better than third-party cookies, though in reality, users might want to turn off or opt out of both of these anonymize tracking devices.
Another way of putting it: I don’t mind sharing my data with Apple when Apple says to trust them. I also don’t mind sharing data with Google when Google says to trust them. I do both on a regular basis with iCloud and Google Drive for example.
What I have a problem with is when people try to “solve” third-party cookies in a way that doesn’t increase privacy but simply pretends to.
I’m not against first party telemetry data, I love it as an engineer and I know that bugs found and reported with it can be fixed, thus improving my experience with products.
What I dislike is when advertising companies can sign deals with Google or Facebook and gain access to lots of info about how well their campaigns are working, or when I don’t know when my data is being used, or when companies start messing with DNS so third-parties look like first-party just to increase revenue.
To me it says it all that Google apparently turns off FLoC when inside GDPR zones. Only stronger laws will actually prevent bad behaviour on legitimate rule-abiding services. Only providing less and less means of tracking can we truly start to prevent it technically. Looking for replacements to tracking to support existing business models is doomed to failure as long as people can keep voting, literally and figuratively, for privacy-preserving alternatives and policies.
Apple ad targeting:
- collected from device info, purchases made from Apple (apps, shows, movies, books, etc.), and app store searches
- used to serve ads in Apple apps (App Store, Stocks, News), so while Apple knows what segment you're in, it's hard to see how that's any worse than what they already know about you (assuming you trust Apple with your info, which I assume you mostly do if you use Apple devices)
Google Floc:
- collected from all of your browsing history in Chrome, not just on Google properties
- your Floc ID is available not just to Google, but to every site you visit because Chrome serves it up. This means any site would have immediate access to your interests and demographics. Say you sign up for a site with your name or other identifying information, now they can link your personal information with your interests and browsing habits. So now you don't only have to trust Google, but you have to trust every entity you interact with on Chrome.
That's not the same thing as having it on by default and hiding the setting in a menu somewhere. But that's how your comment reads.
You probably just ignored the questions and closed the window. There's a lot of things you can fault Apple for, but I wouldn't consider that one of them.
I'm not saying this is particularly egregious. I just find it slightly annoying that they keep trying to make me opt into this after I explicitly opted out. Not a big deal though.
I've tried to look up which header that would be. The only thing I could find was a github issue, but only containing a request for such a header, not actually describing one. https://github.com/WICG/floc/issues/13
So I understand it correctly, currently publishers can't opt out from this tracking? What if you process sensitive data, e.g. protected by HIPAA, or attorney client communication?
Permissions-Policy: interest-cohort=()
add_header Permissions-Policy interest-cohort=();
> The browser uses machine learning algorithms to develop a cohort based on the sites that an individual visits. The algorithms might be based on the URLs of the visited sites, on the content of those pages, or other factors.
Also interesting if GDPR applied.
Basically, this would make it extremely risky for companies NOT to opt out of Floc.
Which might be the way to kill it
People think they are getting more tracked by this but in reality it is trying to make them be less tracked
FLoC: try to make out an individual among thousands of people by correlating various info
Do you not realize how much easier it becomes to track individuals?
No, it's try to make out an individual among 1 person who shares the same cookie.
If this hasn't happened yet, and this isn't just a false flag to cover the state of the art level tracking that's happening now.
The floc is based on your browsing history. It is sort of a hash of the sites you visited and can be requested via a Js call by any (!) site you visit.
The floc is shared by a group of users not sure how that works but it is stated that those are a few 1000 large.
Combine that with other tracking stuff like fingerprinting and ip and you can easily identify a user (especially if you are google and your adds hang around everywhere in the net).
> Google says FLoC is privacy preserving compared to sending third-party cookies. But this is a misleading baseline to compare against. Many browsers don’t send third-party cookies at all; Brave hasn’t ever. Saying a new Chrome feature is privacy-improving only when compared to status-quo Chrome (the most privacy-harming popular browser on the market), is misleading, self-serving, and a further reason for users to run away from Chrome.
Most regular users wont install a blocker. But most other browsers block 3rd party cookies by default. Meaning, Chrome's market share will be the only reason FLoC will ever succeed. On top of that Chrome is known to shift the goal posts for blockers. You shouldn't be surprised if FLoC cannot be blocked on Chrome in the future.
Probably start with "What are some of those privacy concerns with FLoC?"
> "So do I," said Gandalf, "and so do all who live to see such times. But that is not for them to decide. All we have to decide is what to do with the time that is given us."
It looks bleak... but hey. Hobbits toppled the Eye of Sauron.
> “Father, if you are willing, take this cup from me; yet not my will, but yours be done.”
But the net now contains the general populace, and as such significant power has been amassed by controlling it. I don't believe the internet as we know it is in the hands of the netizens anymore, and I have to doubt that the majority of the netizens would even care.
Google and Amazon have both showed continued behavior showing that they'll eat, buy or smother anything that comes a little too close to them, why should we expect that it would be any different if we tried to kick their behaviors off the network?
> Nearly every browser is based on open source code
"We lost the war, haven't we?"
What's stopping you, or anyone else, from forking code and making it privacy focused?
Microsoft got complacent and IE lost to Mozilla.
Mozilla got bloated, lazy and they lost their focus after several missteps, several of which alienated the fuck out of the FOSS community. (Forcing several distros to fork and rebrand to something like Iceweasel? Seriously? Way to dilute your own branding.)
Chrome took over because it simply was the better browser. It brought a lot of new things to the table that made Firefox look stale in relatively short amount of time. Is it still the better browser? I don't think that's quite as clear cut these days... but unfortunately, browsers like "Brave" aren't doing anyone any favors with their misleading presentation, sketchy tactics and meme like spamming from users who don't look beyond bitelines. So when it comes down to it, every Chromium fork that currently exists still has a business, with business motives, behind it.
The source is there. Does somebody want to make an effort to fork it and let it be the true privacy focused browser or are we just going to complain about losing a war that nobody's really fighting?
Widevine, for starters. It's also licensed by, you guessed it, Google.
Google didn't invent that particular DRM, but now that it's widespread, they have bought it outright.
I don't know if their purchase included the rights to open source it in the near future, but it wouldn't surprise me.
However, Amazon Prime Video, BBC, Hulu, Netflix, Spotify and Disney+ all use widevine, so I imagine there are more companies at play in this scenario than just google.
Google bought widewine in 2010
>Google didn't invent that particular DRM, but now that it's widespread, they have bought it outright.
It invented most of it, in the last 10 years it owned widevine.
As for how open widevine is:
>I'm sorry but we're not supporting an open source solution like this
https://blog.samuelmaddock.com/widevine/gmail-thread.html
Or as Brian Bondy, of Brave, put it:
>This is a prime example for why free as in beer is not enough. Small share browsers are at the mercy of Google, and Google is stalling us for no communicated-to-us reason.
https://github.com/brave/browser-laptop/issues/10449#issueco...
So yeah, you can fork chromium and make your own nifty browser. But do not expect being able to play any video from any paid streaming service any time soon or ever.
Off the top of my head? My rent. Someone has to pay it, and if I wanted to dethrone Chrome, I'd have to quit my 9-5. Also, my 9-5 is using my most productive hours.
What's stopping you from forking taj mahal?
https://vivaldi.com/blog/no-google-vivaldi-users-will-not-ge...
1. It is unfriendly and hostile.
2. It doesn't say what alternatives there are. Many people don't know about alternatives.
3. The biggest point of all: sites will lose the majority of their visitors if they redirected away chrome users.
That says it all. It's like the redirector wanted to hurt you.
After all this site claims "The website you WANTED to visit redirected you here." and yet it doesn't give any clues how to do that properly. And no, I'm not trusting user agent values.
If I find a valid and good way I'm completely onboard for redirecting.
<script> window.location.href = ´//whateverurlyouwant.com' </script>
Of course you can just do it server side as well with a simple header set by your webserver or by a backend language.
I'm using FF myself and never had a problem with it
But most people are not aware of the choice they make when they use Chrome, or its consequences for their privacy.
And web developers designing for Chrome first and Firefox second means it's more convenient for users to use Chrome to visit their websites.
s/Chrome/Internet Explorer
Similarly for Chrome all of the Google account stuff is very deeply integrated. Google goes through a decent amount of trouble to trust the shit out of those cookies too. I had a laptop that was unused for 18 months with Chrome on it, when I opened it back up it was still able to access everything without any kind of re-authentication. Firefox on the same laptop needed to be re-authorized.
EDIT: Not making the argument that these are valid reasons, just that users are super risk adverse/lazy.
Stuff like net-neutrality, and legality of reverse engineering protocols and APIs are key to this. The Ad-war is far from over, so long as people still own their own things - this is why I see the cloud, or at least the monopolisation cloud, and the monopolisation of certain hardware (chip fab etc) as at-least as important as software.
Oh come on.
Yeah, sure. It isn't.
If you redirect people to that site you can also serve them a 404.
I don't think you'll convince any non-technical users with such language.
I mean they could stop use of their TLD, but you could move to another one, or publish an IP address.
Putting things in the open is better than not. This is not a problem than can be solved by technical means, in my opinion. America doesn't even have GDPR.
Ohhh, I feel so dirty now.
Or not.