Is Mozilla Firefox Getting Sketchy? | Hacker News Reader

Is Mozilla Firefox Getting Sketchy?

thurrott.com

66 pointsamcclure37 comments

This sketchiness began a lot earlier. For example on mobile Firefox, the new tab screen has had suggestions from Pocket for a long time. It always felt weird to me that the browser wasn’t just strictly utilitarian. Then there’s all the actions that show Mozilla is injecting politics into their products and services. For example creating an official extension that censors disagreeable speech (https://reclaimthenet.org/firefox-introduces-extension-that-...) while banning one that enables free speech (https://reclaimthenet.org/firefox-rejects-free-speech-bans-f...). Or calling for “more than deplatforming”, which is disturbing and feels like early warning of a future where your browser manufacturer may decide what websites you can and can’t visit (https://reclaimthenet.org/firefox-maker-mozilla-calls-for-mo...). Unsurprisingly they’re also against decentralized tech for predictable reasons (https://reclaimthenet.org/mozilla-turns-its-attention-to-cen...).

We already have powerful masters in Apple and Google. If Mozilla is trying to be more of the same then I might as well use Safari and Chrome. There’s no differentiating advantage to using Mozilla’s products as they stray from their original mission. If anyone has better suggestions for a browser I would love to hear them.

Depending on your preferences you might enjoy Vivaldi, Qutebrowser or Chromium. That's just off the top of my head. There are obviously many other good browsers out there.

I've tried Vivaldi and it's great. My understanding is that it shares the same components as Chrome. Are there other 'fully independent' browsers? Does that even matter?

Vivaldi's built on top of Chromium, but they've written an inhouse UI layer, built-in ad blocker and tracking protection and run their own sync services. (Some other Chromium derivatives do, too: Brave and Edge being the most prominent ones)

Brave and Vivaldi default to privacy friendly search engines, try their damndest not to track you, have built-in adblockers and run their own sync services. Easily the best options for Chromium-based browsers.

Edge is also excellent if you don't care about privacy, but their sync service doesn't even include end to end encryption for all classes of synced data.

> try their damndest not to track you

This is questionable. Brave has injected referral codes into typed domains and other really suspect things.

I haven't heard too much controversy around vivaldi, but until 2020-ish they did assign a unique ID to each install and track that.

How does Vivaldi fund development?

By search engine deals with not-Google companies (privacy friendly engines, Bing, etc.) and from their founder. I don't remember how many users they needed to be at break even, but they're not there as far as I know.

If we are talking at least somewhat independent (not a rebasing fork) and somewhat maintained (at least getting security updates) I think it is as follows:

The only modern browser engines are webkit, chromium and gecko. The next step down would be EdgeHTML (no longer shipped by default in any major browser, but maintained for security patches) and Sciter (only geared towards building application UIs, not general browsing. Not free as in both beer and speech). The next step after that is Trident (the old IE engine, somewhat maintained for security patches). The next step after that is probably things like netsurf, lynx and other browsers that do not and do not aim to support normal browsing.

I am not entirely sure what a rebasing fork is, but it sounds like there are only three practical choices, from Apple, Google, and Mozilla. I haven't used Netsurf and the rest but it looks very interesting. My main worry is that some limitation may cause certain websites to break in unknown ways - that could be a huge problem when doing things like logging into a bank account.

To browse the modern web you have those three choices, yes. You could probably still get by on the EdgeHTML based Edge, but support will wind down over the coming years.

If you manage to even load your banks website in netsurf that's impressive. For me it crashes even loading wikipedia, and it does not support JS at all, so basically all interactivity on the web besides forms and links is not supported. I don't think anyone, even netsurfs developers recommend even trying to use netsurf as your main browser for things like banking.

A "rebasing fork" is something like waterfox and similar projects that essentially have modifications to one of the big three engines and periodically pull in all the changes the source engine did. A lot of the chromium based browsers do this to be able to include modifications to chromium in places where it is not officially supported.

A non-rebasing fork would for example be when google forked webkit (to create blink which is a core component of chromium), which took a much more divergent path.

I forgot to mention two other engines that might be interesting to read about: kHTML (the original source for webkit so it is chromiums grandfather in a sense. Not developed since 2016) and Goanna (a fork of firefox from before firefox quantum. It is developed but last I heard they couldn't keep up with new standards and security. Development seems a bit chaotic).

This is really unfortunate. For a while Firefox was really differentiating itself via the privacy space. If it's just going to be another Chrome, I might as well just use Chrome.

It’s just like Apple’s privacy emphasis and then hashing every image with iOS 15. Privacy is just a slogan for a lot of people, unfortunately

Call it what you want, but there absolutely needs to be a balance between privacy and not creating a platform that allows sexual exploitation to occur without detection.

How would you feel if your global image storage platform was being used to store child imagery? As a good organisation, would you not want to create a way that this could be detected.

> there absolutely needs to be a balance between privacy and not creating a platform that allows sexual exploitation to occur without detection.

There already is. It's called go 'ole fashioned policing, and in most western countries there are well-established protocols like search warrants, probable cause, etc. that weigh and balance the rights of the individual with the important work of catching criminals.

Use Chromium. Use Vanadium.

I had never hear of Vanadium before. Thanks!

There's also Bromite

https://www.bromite.org/

https://www.bromite.org/fdroid

https://github.com/bromite/bromite

Bromite is only for Android but is a must-have. While you're at it, if your Android is rooted and you are comfy with Magisk, replace your stock Google Webview with Bromite System Webview by installing Magisk's Webview Manager module. Optionally, it might be possible to replace Webview using TWRP.

or Vivaldi

I had to restart my browser today because when opening a new tab I was prompted with: "Firefox has updated in the background and needs to restart".

I had no idea the latest version did this. No program should ever self-update without telling the user.

This is a multi faceted issue: Browsers are the most used pieces of Software, so vulnerabilities are critical to your systems health. I think if Updates were disabled by default, there would be insecure browsers nearly everywhere because I would not likely click a "Would you like to update?" popup. But this comes with the catch of changed functionality and in this case changed data behaviour.

AFAIK this only happens on Linux if your package manager updates Firefox in the background, which of course Firefox has no control over. On other OSes, it will only update when restarting Firefox (if auto-updating is enabled) or by explicitly prompting you to update.

That’s really what happens though, the update is prepared and installs when you restart. Unless it’s a packaged Linux version and the files are updated while the app is running of course. But there is little Firefox can do about that.

* edit *

Actually this is the same as what you typed

For vast majority of users, auto-update is the best way of handling updates. They don't have to think about keeping the browser, their most used software, the tool used to download and execute untrusted content, up to date.

As far I know, Firefox has an option to turn the auto-update off.

For me that was obvious when it started showing sponsored content in my "new tab" page (in the speed dial-like list of sites). I just needed a reason to switch to Qutebrowser, so I did.

No good intention is able to hold up for too long against the necessity to make money to simply survive if not to thrive

Dupe?

https://news.ycombinator.com/item?id=28812243

Imho, another point for the European GDPR - it says its US only, and I think this is the reason. Otherwise, this should be off by default.

> Imho, another point for the European GDPR - it says its US only

As an American, I find it really embarrassing that the Europeans are doing such a better job at protecting individual privacy in this space.

Does the average American really care that they are constantly being bombarded with ads and sales calls? It seems to me they can live with it.

Is “care” the right word? I would be curious about the number of people who don't like it but feel that they do not have much ability to change it or that it's lower priority than other problems.

I think that's it. After a certain amount of feeling helpless, people just throw up their hands and say, "f-- it, I guess this is just how things are".

I switched to Google Voice a decade ago, and it took me years to realize the degree to which everyone else was getting spammed with robocalls. I probably get one a month.

I know they don't have Google's technical chops, but I wonder why carriers don't do this?

Unless it's not down to spam filtering, and it's simply that it costs more for automated systems to interface with Google Voice (once in a blue moon, entering my GV number into an automated system gets rejected).

Interesting. I started with my number as a google voice number and then switched it over to real cell phone service a few years later and I never get spam calls. I wonder what is different about gv numbers.

> Europeans are doing such a better job

Are they though? Or is it lip service? Seriously asking.

Is there a place I can find the tangible effects of GDPR in fines or actual better behavior? I have no existing opinion either way.

From where I sit, only change from GDPR I can actually see is ever website now annoying me to click a “yea whatever we use cookies” banner.

Before the GDPR almost no company gave me the option to delete data collected on me, download the data they collected and companies did not have to disclose what third parties they share info with or why.

That's a big difference. I've worked at companies with large web presences and I can honestly say that having the GDPR meant that we collected a lot less data about visitors since we had to justify it before collection rather than just seeing if something interesting came out of it.

This is just a facade. If GDPR will be enforced a lot of "data collecting" corporations will have no way to do business in Europe. But like in the land of the free, we have also corruption ( lobbying).

Reply on news.ycombinator.com