Hacker News Reader

Comment by user3939382 | Hacker News Reader

What I want from Firefox is a mode, even hidden behind about:config, even by a combination of settings, that results in 0 network traffic upon start and all traffic is associated with my UI interactions.

Even with telemetry off, all kinds of information about my browsing behavior from the myriad connections it makes upon start and exit can be gleaned. Certificate chain updates, etc can be delayed until a secure connection is requested by me.

The amount of unsolicited and virtually uncontrollable network traffic from macOS, Microsoft Office, Adobe Creative Suite, etc is bad enough, I expect more from Mozilla that never stops marketing its privacy features.

I believe I have the right to control when and for what purpose the computer and software that I own communicates with third parties.

View on HN

I understand your intention is to launch "cold" Firefox instance that does not call home, update the "safe browsing" databases etc, so this will probably not be of any help, but you may try launching it with `--offline` command line argument and uncheck the (alt) "Menu > File > Work Offline" when you are ready to "reveal yourself". For testing it with throwaway profile you can do:

    firefox --offline --no-remote --profile <path where throwaway profile folder can be created>

The `--offline` argument is quite strange for a several reasons: 1. it is quite undocumented, but works from what I've tried. It is not even exposed in `firefox --help | more`. It used to be mentioned at MDN page [1] but that is gone now. 2. From what I've tried now, offline mode lets you browse localhost, what seems super useful but I don't recall it have always been this way. 3. Also browsing properly cached pages seems to work super well; not sure it is due service workers finally caught up and works or proper HTTP headers are used nowadays. Interesting is that even the hard refresh of cached page gives you cached version in offline mode. (Again, I'm not sure it used to be this way in the past. I remember that nearly no webpage worked well in offline mode few years back.)

I have not run any network traffic audit so I cannot verify it really does not attempt to reach for something outside localhost.

[1] http://web.archive.org/web/20210530092017/https://developer.... (I have a super murky memory it might be me who added it there, but today I had to find SU answer mentioning it [2] to even try that) [2] https://superuser.com/questions/1691419/how-to-start-firefox...

(Update) And one more thing: when using Profile Manager there is a nifty "Work offline" checkbox in there. Run

    firefox --profilemanager

There is also checkbox "Use selected profile without asking" that when unchecked presumably adds

    [General]
    StartWithLastProfile=0

to the `<appdata>\Mozilla\Firefox\installs.ini`. I've found this handy to do if you occasionally mess with various Fx versions and want to be sure you will not unintentionally load "nightly" profile with "stable" executable.

"I believe I have the right to control when and for what purpose the computer and software that I own communicates with third parties."

Theoretically we already have this control. We can edit the Firefox source to disable the undesired traffic before compiling. In practice it takes me more time and resources to compile Firefox than it does to compile the kernel for the host OS (NetBSD). Most Firefox users probably use binaries and do not compile from source.

I would prefer to see a smaller, less featureful additonal version of Firefox that compiles faster and with fewer required resources. For advanced users, this would remove the friction against making source changes and compiling as opposed to using binaries. It would also potentially open up an opportunity for others to create customised versions of Firefox with, e.g., reduced attack surface, less need for "updates" and better suited to avoiding telemetry, and internet advertising-related surveillance.

The actual or effective inability to compile from source places more control with Mozilla and less control with the user. Thus we continually find Firefox users on HN pleading with Mozilla to make changes instead of making the changes themselves.

I find your demands reasonable, especially the principle where HTTP traffic is initiated if and only if carried out in response to direct user interaction.

The thing with right to control, though, is that someone, somehow has to develop a browser and make ends meet.

What if - and bear with me here - Mozilla set up a way for us to fund Firefox directly?

Shocking idea in 2022.

No, but seriously, Mozilla — I'll pay you real dollars for this.

too late for me.

they fired a ton of engineering talent working on exciting tech (servo) to chase some bundled vpn rebrand. what a misguided move, like most everything they've done in non-engineering space. sad.

before, i would have donated hundreds or more if there was a way to pay directly for firefox and thunderbird. but not anymore.

at least the CEO's salary keeps going up: https://news.ycombinator.com/item?id=24563698

There's a way to directly donate to Thunderbird: https://give.thunderbird.net/en-US/

Unfortunately, there's no such option for Firefox.

At this point, I'm starting to wonder whether or not Mozilla leadership is controlled opposition.

I don't doubt the sincerity of the individuals involved, but Google wouldn't pay Mozilla if they didn't think it was in their interests to do so.

It is controlled opposition. And their CEO is not an engineer and has no clue how to manage engineers or run a software company; she's a lawyer.

"Never attribute to Malice which can be explained by Stupidity"

They have—it’s their VPN offering.

(Cue complaints about it not being the right way to fund Firefox, because it’s not a pure donation. Before you go down that road, tell me: what evidence do you have that pure donations would get enough transactions to be worth the overhead? Have they ever worked at scale for any other software?)

Their business model doesn't have to be donation-based. It can be, (surprise!) purchase based.

I pay for lots of software I use, and do so happily if it delivers value — it would be extremely easy for me to justify paying for what's probably one of the apps I use the most. Why can't we pay for good browsers, that put the focus squarely on being the best tool to access the www? Why can't that money be used to hire back some of the talent Mozilla has been letting go? I say it elsewhere in this thread — Mozilla should let us pay for the bloody thing.

I would pay for a "Firefox Pro" which allowed greater control/modifications for power users.

Make it open source, but have the official download for builds (and source code?[0]) be payed. Bonus points if the download bundle includes source code and a simplified build process.

[0] obviously it'll be mirrored in 2 seconds, but still.

the few people who might pay for a firefox pro would probably not even pay the wages of the people required to setup the payment and infrastructure therein.

Might as well just ask for donations.

I wonder if they could do a "pay what you want" download page for Firefox Developer Edition. It's my daily driver, and I'd be happy to pay for it.

Unless I’m mistaken, Developer Edition is just Firefox with experimental features enabled and permanently-enabled telemetry.

I’m not sure what in my brain says “Telemetry? Absolutely not”, but that’s how it is for me (and why I don’t use the Developer Edition).

I don't mind sending telemetry data however, as long as I'm reasonably convinced that Mozilla isn't doing anything shady with it.

However, I respect the “Telemetry? Absolutely not” stance and can only hope and pray that Firefox PMs use telemetry as only ONE among a whole host of other signals to support decision-making.

That creates a branding risk. If the idea spreads that Firefox is a paid product you might scare people away from the free version and the net impact becomes negative.

Honestly, the real branding risk is Mozilla's brand being tarnished by firing engineering talent, bundling Pocket, adding opt-out telemetry, etc. I'll take the branding risk that saves a beloved browser and company, over the branding risk that destroys both.

I honestly think the core dev work on Firefox could be done by 6 devs. I get an impression that half their devs are doing UI tweaks, which could be left alone for a decade without any issues.

The rest, outside of core, seem to write code as you mention. Product additions which most always give zero real value, no income, and even detract from the brand.

This might be a new low point for HN discourse regarding Firefox. Wow.

No, you can't maintain an entire modern browser (25 million lines of code) with 6 people.

You probably can't even maintain a complete multi-architecture, JIT-enabled Javascript engine with 6 people. Or GPU-accelerated rendering that works across thousands of hardware / software combinations. Much less that plus all the other things a browser has to do.

Konqueror was a better browser than Firefox maintained by a much smaller team for many years.

Honestly FF VPN is a really great product. Very very easy to use. I do wish I had access to more configuration options.

This is not by any means "direct", and is not very different from if they sold t-shirts.

You have been able to for a very long time, quite possibly for all of its existence: https://donate.mozilla.org/

People always post this in reply. I don't want to donate to the Mozilla Foundation's CEO salary package, or their navel-gazing side projects, or their endless reshuffling of deckchairs. I want to fund _Firefox_, the only browser engine keeping us from an endless monopoly of Chrome reskins.

So you need to fund either individual developers or a 3rd party like Igalia to develop the features you want, including the work to ensure it will end up in the upstream repo and not in a fork.

Since that's "a donation with restrictions", you can probably set up a grant / anything with a contract instead. It may be onerous for an individual, but get enough people to be worth the effort and it should work fine.

Donations to the Mozilla Foundation support the Foundation's outreach and education efforts, not Firefox development. Firefox is developed by the Mozilla Corporation, which is a for-profit entity owned by the Foundation and is not donation-supported.

See the sections "How will my donation be used?" and "Don’t Mozilla products, like Firefox, earn income?" here: https://donate.mozilla.org/en-US/faq/#item_8

As far as I remember the problem was that you can donate to Mozilla foundation, but not the Mozilla corporation ( which is responsible for Firefox + other stuff ). There is no direct way to finance/donate for Firefox developement (without other projects).

Several thousand people would donate. Several million wouldn't care. Chrome wins.

But eventually the “need” for never-ending growth means a manager somewhere will be looking to eek out that x% growth - and their individual (professional) needs will lead to suggesting monetizing the paid user base…

Why would this be a default, or an inevitability? Sounds like a reasonable incentive structure for VC-funded companies looking to be a unicorn. But it’s far from the only option culturally. It certainly doesn’t seem like the sort of thing that makes sense for Mozilla.

>especially the principle where HTTP traffic is initiated if and only if carried out in response to direct user interaction.

How do you propose notifications for new YouTube videos or tweets to work then?

I'd imagine that the user could toggle a setting to connect to those things on startup if they wanted them.

Don't know, but I think one part of the solutions is to drastically simplify the web stack and separate essential (content-oriented) from incidental (app) tasks.

Do yt, twitter really have to live in the browser?

The web is an application platform. So it makes sense that yt and twitter live in the browser.

I hope they won't. All notifications I need and even more I get from my phone. I hate to ignore multiple notifications for the same event from multiple devices, I'd prefer to ignore it only once.

This makes it sound like these initial connections are there to earn Mozilla money. Updating certificate lists, checking for updates, that's all just housekeeping stuff.

I also find it very strange that so many people here disable telemetry. Really weakens complaints about removed features, if you're disabling the primary way that shows you're using it.

This comment is a deathflag which you should become attuned to, so you can stay ahead of the curve. Telemetry driven catabolism is a feedback loop which can not be halted once it's begun.

What's happening under the surface is that the project has reached the maximum complexity it ever can, after which it collapses being unable to maintain even low-maintanance features, let alone add new ones. Complexity unlike funding is fundamental, and just throwing money at it will not halt the process. Seeing rude obstructionist PR types showing up on bugzilla was the first outward facing symptom there was a cultural problem driven by an underlying material problem. An insider could probably tell you an even earlier warning sign.

As the project collapses it will grow tumors (eg Pocket). Totally random pieces of junk code which don't coherently belong to the base project. In the terminal stage it loses its ability to even remove features, or bolt on tumors. Tweaking the logo, churning the UI, and redesigning the website are the only actions the zombie project is physically able to take. So that's what it does.

I agree. It's fucking ridiculous that someone at Mozilla forgetting to renew a cert resulted in the simultaneous disabling of every single Firefox extension on earth. I wouldn't be surprised if someone (an activist, a gay person, etc) in an oppressive country died as a result of suddenly losing their VPN/privacy extensions.

I sure hope that none of the people that are in danger trust in the obscurity provided by in browser vpns.

If they do then it always was just a question of time for them to be found out, as just adding a webrtc session to the website makes their ip transparent again. Same with unique dns queries etc

This also happened to Tor Browser, the whole point of which is that you can trust it.

Is there a phrase that describes the process of taking something one thinks is bad - here, Firefox extensions being disabled - and searching for the most egregious possible negative consequence that might have occurred (here, someone being murdered), and then using that as a hypothetical? The goal is obviously to try to increase the emotional weight of the argument against... whatever... but I'm seeing this demilogical construction used more and more in the wild and would like to know its name.

Is it not useful to consider the envelop of possibilities from a widespread outage like that?

Might be this one?

"Reductio ad absurdum"

https://en.m.wikipedia.org/wiki/Reductio_ad_absurdum

Or "Logical Extreme"

https://en.m.wikipedia.org/wiki/Logical_extreme

In a word: hyperbole or adynaton.

its mainly because saying "someone could have gotten a slap on the wrist because of this mistake" isnt really worth mentioning

> searching for the most egregious possible negative consequence that might have occurred

On the one hand, stretching consequences is bad. On the other hand, thinking about a "one in a million" consequence isn't stretching when something affects a million people.

Maybe that example is closer to "one in a billion" or higher? We can hope so.

Hyperbole? I agree with your sentiment, but it's been the 'Internet rant' rhetoric for decades IME. Find a HN thread, with a moderate number of comments, without it.

IMHO, such comments are so tired, poisonous, and add so little that if I were king of HN, I would ban them. They may be hard to define, but 'no hyperole' is a start.

> Find a HN thread, with a moderate number of comments, without it.

That is quite the hyperbole and under your own rules you would be banned.

I don't think it is an exaggeration.

It's also not beyond the realm of possibility that the person responsible for monitoring this cert read your post just now, contemplated the potential gravity of their mistake, and decided that they couldn't live knowing those potential consequences.

There is no limit to what can disgusting thoughts could be posited in a hypothetical.

The person responsible for monitoring the cert was the proximal cause but not the ultimate cause. The ultimate cause was the colossal fool who decided a cert check failure should cause an immediate and nonconsensual disabling of all extensions instead of a pop-up box warning the user their extensions may be untrustworthy. That's like a car's ECU slamming on brakes because it failed to read the tire pressure.

My comment was a response to your singling out the "someone at Mozilla forgetting to renew a cert" which you referred to earlier. You are correct in acknowledging that you had only identified a proximal cause in your grandparent post.

I agree that the underlying problem is that extensions were disabled without user notification. The correct behaviour is simple enough: if any extension gets disabled for ANY reason other than manually by the user, the browser should lock out ALL network connections until the user has acknowledged this change of state. Someone should submit this to bugzilla as a high priority fix, if it hasn't already been done.

Someone should submit this to bugzilla as a high priority fix, if it hasn't already been done.

Not gonna happen. These days Mozilla doesn't even pretend to give a damn about user control. "We know better than you" has been the watchword for a while now.

That's not an argument, that's just emotional guff. Sure, they change the UI around every now and again. But they also maintain a firehose of improvements which keep users in control of things which actually matter, like Firefox's highly configurable enhanced tracking protection.

Not gonna happen? If you refuse to partake in the most minimal of engagement with the process, don't complain if you don't like the outcome.

things which actually matter, like Firefox's highly configurable enhanced tracking protection.

What's your criteria for things that actually matter? For example, as an adblocking, scriptblocking person, whether or not a company tracks me has no impact on my life whatsoever. What does have an impact on my life is my web browser being half-crippled and my mobile browser being a pile of half-working shit that soft-locks if I open it too quickly after closing it.

Is this to say you want zero page-loading of existing tabs on startup (if in fact you save your tabs across restarts)?

Actaully, yes. They could replace the content of the page with a message box containing the page's title and URL, and a "click to reload" button.

It seems this could be accomplished by extensions - at the very least for tab-related requests, as far as I know - since uBlock Origin has a setting that holds every request until it can update the filter lists.

I do not save tabs and I do not want anything to load at startup: just one window with one completely blank tab, please!

Similarly, I have developed a habit of opening a new tab that loads about:home before I exit. That way, the other tabs act as active bookmarks. I'm not immediately faced with any given one of them when I start a new session. I don't know if anyone else does this, but it also saves me from loading any pages unless I really want to see what it is.

I actually keep a pinned tab at the default page about:home for this purpose, and select it before closing the browser.

In combination with tabs defaulting to unloaded in a new instance of the browser, this adds some control over memory consumption and network activity.

As a many-tabs saver and reloader, chapeau to you. Good luck, I'm pulling for you!

Actually yes, I'd prefer the browser to restore the page it had already loaded before instead of whatever is served there now.

I feel you, but the browser-cache train left the station years ago. :/

Devils advocate…

How should auto-updater work then?

It shouldn’t?

Here it updates when I run pacman -Syu. If I were to use Firefox built-in update, I would want it to show me a popup asking me whether to update

Well a popup asking if it okay to check for updates which would run every x times the browser is launched or on a schedule. The popup should have an option to not ask again for those that get annoyed. Otherwise the browser would need to call home to see if an update is available before asking if you want the new version of course.

It shouldn't. Users should be using a package manager to manage software. Windows fucked up users expectations by not including a sane one by default... ever. And no, Windows Store doesn't count.

> Users should

Users should and regular people should:

* not smoke

* not drink

* eat healthy food in moderate amounts

* ...

"Should" almost never works, especially at scale.

Package managers are a necessary evil on systems where installing software scatters a bunch of files all over because of a dogmatic adherence to an obsolete FHS. It’s a huge burden on either the distro maintainers or the developers to produce new packages for already-written software, which often results in outdated or broken releases available in the package repos.

And now every language ecosystem has one or more package managers for development libs - pip, conda, cargo, npm, opam, dub, etc. - and then optional package managers like choco, homebrew, and probably some others I missed. It’s a huge mess. So instead we throw up our hands and just bundle everything we need in a container and duplicate the _whole distro_ because the “package” ecosystem is such a disaster.

The sane way to handle software installs and uninstalls would have been cp/rm.

One more addition to my rant here - could we pick even more ridiculous, unintuitive names for package manager binaries? zypper? apt-get? yum? xbps-install? pacman at least kind of reminds you of “package manager”. This isn’t meant to dump all over the hard work that goes into all these. I suppose too that “install” is taken by a command which copies files with certain flags (anyone ever use this?).

Every one of these uses different flags too, so for someone who uses a number of different distros it’s a huge pain to remember them and switch back and forth.

FreeBSD at least uses the eminently sensible “pkg” command with flags like “search” and “add.”

>software that I own

You don't own Firefox. You have a license to use it. Background network traffic is not a big deal. Ignoring downloading important updates the bandwidth the requests use is not significant. In such a large and complex piece of software as a web browser I do not understand why traffic should be associated with UI interactions. How is the browser supposed to show a notification when someone tweets? Would you prefer to hit a "Check for Notifications" button or would you prefer to just get a notification. The latter option has a million times better UX.

> Would you prefer to hit a "Check for Notifications" button or would you prefer to just get a notification. The latter option has a million times better UX.

I would a love a button for every action. Particularly for things like check for notifications. The current problem is that someone else believes they know what a better UX is, any by better they mean better for the company for whatever reason.

GP's needs are not invalid just because they differ from yours.

Reply on news.ycombinator.com