This is the same browser that did the opposite before: injecting their own referral parameter in links.
I'm reposting my comment from a few days ago: https://news.ycombinator.com/item?id=34919771#34939391
> It wasn't 'caught' with anything, as much as those spicy news articles would have you believe. It was a URL suggestion bug. It was supposed to be turned off by default, and suggest content instead of replacing it.
The bug was fixed in a day after release, the PR is on GitHub. Brave is open source, unlike Chrome and Edge. Let's stop treating FOSS like the other spyware.
This also happened when Brave was like 5 months old. The feature since then has been turned off by default and the affiliate thing was shut down a long ago.
https://brave.com/referral-codes-in-suggested-sites/
So they did intend to put affiliate links into suggestions, and the bug was that it was accidentally applied to autocomplete in the URL bar based on the first suggestion.
I think the original intention was shady enough. It's good that they changed direction on this, but the damage on their reputation is well justified in my opinion.
and I fail to see how is that a 'threat to privacy' or something so outrageous that people are still holding a grudge after years.
Firstly, the feature was off by default, so that those who wanted to support Brave could enable it.
Secondly, the affiliate thing was only supposed to suggest the link and not replace it. Hence, the 'bug'.
Thirdly, this was not a privacy risk in any way. The affiliate link were only suggested for a few crypto websites and nothing else.
Fourthly, the bug was fixed in day. Years ago. Affiliate thing was shut down instantly and since then, nothing of that sort has been tried by Brave.
> I think the original intention was shady enough
Then I guess Firefox providing Google search as default, without asking you is shady too? or Firefox installing a whole extension for Mr.Robot without asking its users was shady too? what about Pocket? Featuring articles from partners.
I still don't see the outrage.
From the same Brave response:
> We have already fixed the issue in Brave’s open source on GitHub and in the Brave Nightly, Beta, and Developer release channels, as well as in the Stable (1.9.80) release of our desktop browser that just went live, by changing the “Show Brave suggested sites in autocomplete suggestions” setting’s default to “off”.
So no, unless I read it wrong, it was not off by default.
> Then I guess Firefox providing Google search as default, without asking you is shady too? or Firefox installing a whole extension for Mr.Robot without asking its users was shady too? what about Pocket? Featuring articles from partners.
Yes, Firefox also did a lot of shady stuff. Also mistakes of Mozilla doesn't absolve Brave from their own mistakes.
Google search being the default in Firefox is blatantly obvious, they don't try to hide it. Compare it to the affiliate link suggestion screenshot:
https://brave.com/static-assets/images/optimized/referral-co...
Yeah, there is absolutely no indication that this is an affiliate link suggested by Brave. It was clearly meant to fly under the radar.
There might be no privacy concerns here, but I still think this is a bit shady.
I wrote it wrong. The feature was 'turned' off by default after that bug.
> Compare it to the affiliate link suggestion screenshot:
Suggestion is not what's wrong. The suggestion replacing the URL was what was wrong.
> It was clearly meant to fly under the radar.
Just like how the rest of the things like Brave News, Brave Talk or Brave Search do. I don't see an issue here? They don't force a lot of stuff in your face, it's evident to anyone who uses the browser. They keep most things off by default, that's what their strategy has become.
When it was not the case (when the browser was like 5 months old), it was changed. I don't see why people are still holding it against them?
> There might be no privacy concerns here, but I still think this is a bit shady.
I don't think it was shady because, as discussed, it was a bug that was acknowledged by them, and they not only removed the affiliate links but also turned the auto-suggest feature off by default. https://github.com/brave/brave-core/commit/e8fdde70a3ac2c25e...
Now, it's up to your interpretation to classify this as shady or not, but I personally don't think this was as big of a deal. People still holding on to it is the reason I cannot take these comments seriously. Edge and Chrome with all that spyware are most HN users' favorite browsers.
(disclamer: I still use Firefox and recomend you do so as well).
Seems perfectly reasonable to me and everyone over reacted so they took it off.
> 1/ We made a mistake, we're correcting
[0] https://twitter.com/BrendanEich/status/1269313200127795201
OP said "Mistake was getting caught" which to me implies that he is using the word "mistake" to reduce accountability rather than increase it. I think it's the latter: he's using the word "mistake" to take responsibility for having made a decision his users disagree with (whether or not it's objectively bad, I think is a moot point given the backlash from users).
Same clarification he makes in this tweet:
"I think you used "mistake" where you meant "accident". I never said it was accidental. We were treating it like a search query (which all big browsers do tag with an affiliate id to get paid from by the search provider). But a valid domain name is not a search query. Fixing."
https://twitter.com/BrendanEich/status/1269421487011713030?s...
It's the same thing as when FireFox adds it's referral code when going to Google Search, I believe that's most of their revenue...
TLDR: the bug was the referral code was being added in the autocomplete. It should have only been added to the exact affiliate address, such as "binance.us".
The browser injecting a referrer header seems less transparent than it being in the link, no?
Hold what data? The affiliate ID?
I've seen too many instances like Google Chrome still tracking you in incognito where companies just come back with they were doing it "by mistake" to believe any of them were really saying the truth.
In any case, it doesn't look like it was a privacy issue, they just wanted the affiliate revenue from Binance.
Disclaimer: I am not a Brave user, or in any way affiliated with them.
User types a full url: binance.us -> Brave doesn't suggest shit, user goes to whatever they wrote.
User types a partial url/keyword: binance -> Brave shows a suggestion from a local list of partners that match, with the suggested url being basically binance.us/brave. Not user tracking, just IDing that the click came from a campaign.
What the mistake was:
The user wrote binance.us -> Brave suggested the partnered link when it shouldn't have. That is literally it. And it got fixed within one day.
When was this?
[0] https://dockets.justia.com/docket/california/candce/5:2020cv...
[1] https://www.reuters.com/article/us-alphabet-google-privacy-l...
The lawsuit doesn't say Chrome is doing anything. It's claiming that websites, including those owned by Google, are tracking things in incognito sessions. This is because there is no flag that says "this is an incognito session" sent to the site, and the existence of any such flag would be a bug. There's a constant arms race between sites trying to detect incognito and browsers closing the holes.
https://fingerprint.com/blog/incognito-mode-detection/
Plenty of sites try to do this.
https://www.theverge.com/2019/2/18/18229124/chrome-incognito...
that is not what happened.
on my google keyboard, "fuck" autocompletes to "duck" but I'm not claiming any grand conspiracy unless it was a duckduckgo keyboard.
Brendan Eich is literally the guy who normalized letting websites run code on your machine. Even if we generously assume his intentions are good, the kind of thinking that brought us JavaScript is not even capable of grokking what I want from my browser in terms of privacy, security, and respect for my attention. Even if Brave's commitments to these values is genuine and not just marketing, they simply don't know what those values mean. Even if you trust their intentions, you can't trust their execution.
They started, right off the bat, by getting in bed with advertisers. That's their revenue stream. That's not how you fund a browser that serves users, that's how you fund a browser that serves advertisers. Even if their intentions are good, they don't know how to execute them.
"Mistakes" like injecting redirects into links are exactly what I'd expect Brave to do intentionally, not something I'd assume is a mistake.
And if you don't want the JS that Eich created to run in your browser, you can turn it off... most people like to run sandboxed code instead of installing native programs.
Mozilla makes most of their money from Google Search referrals.
Chrome was entirely built to put more eyeballs on Google ads and track you.
There's a lot more privacy features built into Brave than there are in other browsers. It's user oriented, not adtech oriented.
Of Brave, Chrome, and Firefox, who has the built in ad blocker?
That's a pretty confidently wrong statement.
You're aware of Wikipedia, right? More directly relevant: Konqueror?
And as is typical of HN, you seem to be unaware that people might be motivated by things other than money. Browsers are a large enough undertaking that you need some money to make one sustainably, but when money isn't your primary motivation it turns out you can do quite a bit with less.
> There's a lot more privacy features built into Brave than there are in other browsers. It's user oriented, not adtech oriented.
Brave is literally adtech. They sell ads.
To take a step back, which browser do you use? Did it come with an ad blocker?
Do you apply these same standards to all browsers and fiercely challenge them like Brave, let's say... Firefox?
> Do you apply these same standards to all browsers and fiercely challenge them like Brave, let's say... Firefox?
Firefox doesn't claim that they're trying to address the problem of ads on the internet, so no, I don't challenge Firefox's false claims. See how that works?
"Power and privacy to the people. No need to dig into your security settings. Fierce privacy is our default."
- Firefox on a recent update. You know, a browser that defaults to Google search and having search suggestions on. I know I'd have a couple privacy settings to change.
I don't want my browser to be a "product". If we didn't have people pushing for exponentially increasing complexity because they want the web to be an app platform then we could have browsers developed by individuals or groups in their free time.
But even if you insist on full time developers, there are alternative funding methods. Donations & grants being the most appropriate for something that benefits the general public.
> And if you don't want the JS that Eich created to run in your browser, you can turn it off... most people like to run sandboxed code instead of installing native programs.
The problem isn't being able to run sandboxed programs vs. native programs, the problem is that things that are supposed to be documents can run "sandboxed" programs where the sandbox is leaky and getting more leaks addded because perfect sandboxing is not what you want for applications that are supposed to be usable and therefore need to interact with the outside world.
Pointing at other browsers and pretending that them being ad-funded and/or also doing bad things makes any thing Brave does better is ridiculous.
Brave private ads system is off by default. Users enable it voluntarily and get 70% of the gross without any data on our servers. Ad matching is done via a pushed ad catalog and local-to-browser machines learning. Impression counting for revshare payments uses a Chaumian blind signature protocol (same crypto as Privacy Pass). If I cold-read your comment here, I get the impression you think Brave's ads are on by default, or you want to leave that impression on readers. It's false.
We also do not inject ads into pages. The opt-in private ads go in your ad slots (notifications, new tab pages), not in any publisher slots.
Your last paragraph (a few other HN regulars do this too) uses dishonest language: "links" mean hyperlinks in pages, and we never added any affiliate code to those. https://news.ycombinator.com/item?id=31088549
Unbelievable. Now we're to be angry at (or at least, suspicious of) Eich for inventing Javascript? Because... it can used for evil? Is that really a path we should be going down? Is Tim Berners-Lee next? Come on.
>They started, right off the bat, by getting in bed with advertisers. That's their revenue stream. That's not how you fund a browser that serves users, that's how you fund a browser that serves advertisers.
This is similarly disingenuous. They started trying to solve the problem of facilitating an advertising model that respects privacy and rewarding creators (users) with revenue in the form of BAT tokens.
Say what you want about the execution, or the idea in general — but it's a noble goal.
I'm no fan of Eich's politics but your overall framing here is grossly misleading.
There is literally no good case for JavaScript. It's literally malware: code that runs on your machine without your explicitly installing it and does things that serves the website, not the user. The fact that it's in a sandbox to limit the harm it can cause is nice, but it doesn't really solve the fundamental problem.
Formats such as social media profiles, recipes, etc., would have been better served as document formats separate from or included in HTML.
More complex things like Google Maps could have been done as native apps--and still are, because the web app simply can't provide the same level of experience as a native app.
> They started trying to solve the problem of facilitating an advertising model that respects privacy and rewarding creators (users) with revenue in the form of BAT tokens.
If I want to reward a creator I can pay them without a middle man: BAT complicates that rather than simplifying it.
Advertising is a social harm. An advertising model that respects privacy, still disrespects attention, bandwidth, power usage, etc.
It should be clear that content creators aren't browser's target users, but since you brought it up: advertising generally creates a race to the bottom which incentivizes low-quality, low-effort content creation which creates a filtering problem: now it's hard to find the high-quality content amid the half-assed AI-generated nonsense. Publications which are high enough quality to be paid for, such as the NYT, have obviously been harmed by ad-based business models becoming the norm.
> Say what you want about the execution, or the idea in general — but it's a noble goal.
Their goal is to make money, and they've set it up so that their goal of making money is dependent on pleasing advertisers, not users.
The noble goals you're claiming simply are not true.
It's one thing to say that Javascript is massively over-relied on (I might even agree) but this is not anywhere close to a serious, well-considered argument. It's a joke.
I'm not interested in engaging further because extremist positions like this indicate that the speaker is not interested in meaningful debate.
> It's one thing to say that Javascript is massively over-relied on (I might even agree) but this is not anywhere close to a serious, well-considered argument.
Perhaps if you quoted past the first sentence you'd find the serious, well-considered argument you're looking for.
> I'm not interested in engaging further because extremist positions like this indicate that the speaker is not interested in meaningful debate.
Quoting a sentence out of context, calling it extremist, and then exiting without responding to any of the substance of my post makes it look awfully like you aren't interested in whatever you think "meaningful debate" means.
The extremist position is that visiting a website implies consent to the website running arbitrary code on my hardware. The only reason this has become accepted is that it's profitable to powerful people.
I didn't see anything you wrote that provides extra nuance to the statement. That is - nothing you wrote softens or modifies the quote. Am I right, or did I miss something? You were pretty clear. You even used "literally".
Sure... you went on to say why you see it like that, but that's not what being "quoted out of context" means. Is there some caveat, exception or nuance you were trying to express that modifies what you meant?
As for why I didn't engage further, let me ask you this — what if I tell you JS provides several good use cases for me and people I know? Will you then agree that some people do find good uses cases for JS or will you try to tell me I'm wrong? My impression so far is the latter.
You see what I mean? There doesn't seem to be any point in engaging.
As for the rest - I have no interest in debating BAT, or the advertising world. We largely agree. My point was simply that you misrepresented their value proposition by insisting there was never even a theoretical benefit to users and creators. It's a non-starter for having a useful conversation IMHO.
Another Firefox user
* "Allow Firefox to make personalized extension recommendations"
* "Allow Firefox to install and run studies"
* "Block dangerous and deceptive content"
* "Pocket" add-on installed by default.
I don't recall opting in to any of these things when I installed firefox. This isn't some conspiracy or hard to understand concept. They are right there in the settings page, not in the config flags, and I don't understand why it's so difficult to believe this or just look yourself.
Anyway. why does the installation of the Pocket seem so shady to you? There are a number of other features in the program you just installed that you probably weren't aware of. I mean, I didn't read the full source of Firefox before installing it, so there are many features now on my computer that I didn't know I was getting into when I installed Firefox. Is it the fact that Pocket (which Mozilla bought) has a premium tier that causes you to classify it as "shady"?
By my measure, any telemetry sent back that wasn't explicitly opted into is shady. Once data has left my machine, it's out of my control and anything can happen to it.
We may not have time to fully audit the source, but individuals and groups I trust have, and have made forks that cut out this telemetry as well as other potentially unsavory features. One can also monitor network traffic in and out of an a browser app to understand what is being sent.
I'm using Bromite on my phone right now to type this.
So there are five settings that you believe are set to the wrong default. This causes you to mistrust firefox in total and want to use a fork that you deem more trustworthy but haven't mentioned any fork or how you decided that they are more trustworthy.
That is all 100% totally and utterly reasonable and we can take it on board and use it to adjust our views or not now that we know what you're talking about.
Thanks for posting it clearly that is worth the time it takes. The inital comment is mostly noise and in my view, not worth posting.
Would I prefer Firefox had different defaults? Yes. But, I will reserve the word shady for the products actually doing shady things like telemetry in Windows that requires jumping through hoops to turn off.
It is shady because new settings appear with updates. Surely you don't expect users to trawl through all settings for each browser update to see if Mozilla didn't sneak anything in there that undoes part of their previous choices?
No, it was a mistake. We fixed it. If you expect perfection, stop using Firefox too because Mozilla has made mistakes, including some similar ones. (I don't think they are reasons to stop using Firefox, I'm just applying your fake standard.)
Of course there are real mistakes, but this one was quite difficult to make…
I often manually scrub campaign-level stuff when sending links to friends just to have nicer, shorter URLs
For my part in such comments (I think I even managed to catch a snippy reply from Eich once), I believe the Web3 vision is toxic to the possibility of a truly pro-user web, and Brave as a company is up to its eyeballs in the stuff. I've seen a rot of siloing, appropriation, and pervasive monetization consume the web in the past 20 years, and Web3 is basically about "democratizing" that rot instead of stopping it. It's a bit like offering sharecropping as an alternative to serfdom: one can argue all day that it's better (credibly, even!), but it's a far cry from being pro-farmer.
So when Brave stakes out the position of being pro-user and pro-privacy, I don't think it's meant in the ways that matter to me, and that feels like a kind of dishonesty. It's not that I envision the Brave C-suite gleefully rubbing their hands together like mustachioed cartoon villains at the prospect of deceiving people like me, but neither do I feel like they're being fully candid about the aims and implications of their project. In short, one might reasonably accuse me of viewing Brave's initiatives through thorn-colored glasses, but I think I came by it honestly.
Yet the bug was not an privacy issue.
Brave still is the most private mainstream browsers. Bugs that were fixed do not reflect the present reality: https://privacytests.org/
Perfect is the enemy of good and all that jazz. It's basically impossible to try to be a good actor/explain a good thing without HNers throwing whataboutisms at you.
Of course maybe Brave is actually a bad actor, but none of the things people are calling them out for are meaningful evidence of that. The thing they did wasn't a tracking mechanism, it was just a sponsorship deal.
Now an incumbent, that gives hope and disappointment.
The argument is that Brave should be considered referring users if you get to Binance (or other sites) via the Omnibox.. but it's disingenuous when it was suggested by the query "Binance", since the user already had the intention to visit and likely sign up for Binance. It would've been more acceptable if the omnibox only injected the referral code if you clicked 'Binance' when you tried to search "crypto exchange".
https://privacytests.org/ is created by a Brave employee, so that doesn't count
For example; complaining about privacy, (which was entirely unaffected) or complaining that they couldn’t have possibly done it by mistake (which is not what they said happened).
When I see repeated comments saying wrong things emphatically, it certainly sets off a bit of a radar.
Source: I work in the same office as one of these companies. They don't work for Google but for another big, well known social platform.