To be fair, seemed to be by mistake and quickly corrected. They also issued an apoogy.
(disclamer: I still use Firefox and recomend you do so as well).
(disclamer: I still use Firefox and recomend you do so as well).
Seems perfectly reasonable to me and everyone over reacted so they took it off.
Hold what data? The affiliate ID?
> 1/ We made a mistake, we're correcting
[0] https://twitter.com/BrendanEich/status/1269313200127795201
It's the same thing as when FireFox adds it's referral code when going to Google Search, I believe that's most of their revenue...
TLDR: the bug was the referral code was being added in the autocomplete. It should have only been added to the exact affiliate address, such as "binance.us".
OP said "Mistake was getting caught" which to me implies that he is using the word "mistake" to reduce accountability rather than increase it. I think it's the latter: he's using the word "mistake" to take responsibility for having made a decision his users disagree with (whether or not it's objectively bad, I think is a moot point given the backlash from users).
Same clarification he makes in this tweet:
"I think you used "mistake" where you meant "accident". I never said it was accidental. We were treating it like a search query (which all big browsers do tag with an affiliate id to get paid from by the search provider). But a valid domain name is not a search query. Fixing."
https://twitter.com/BrendanEich/status/1269421487011713030?s...
The browser injecting a referrer header seems less transparent than it being in the link, no?
I've seen too many instances like Google Chrome still tracking you in incognito where companies just come back with they were doing it "by mistake" to believe any of them were really saying the truth.
When was this?
[0] https://dockets.justia.com/docket/california/candce/5:2020cv...
[1] https://www.reuters.com/article/us-alphabet-google-privacy-l...
The lawsuit doesn't say Chrome is doing anything. It's claiming that websites, including those owned by Google, are tracking things in incognito sessions. This is because there is no flag that says "this is an incognito session" sent to the site, and the existence of any such flag would be a bug. There's a constant arms race between sites trying to detect incognito and browsers closing the holes.
https://fingerprint.com/blog/incognito-mode-detection/
Plenty of sites try to do this.
https://www.theverge.com/2019/2/18/18229124/chrome-incognito...
In any case, it doesn't look like it was a privacy issue, they just wanted the affiliate revenue from Binance.
Disclaimer: I am not a Brave user, or in any way affiliated with them.
that is not what happened.
on my google keyboard, "fuck" autocompletes to "duck" but I'm not claiming any grand conspiracy unless it was a duckduckgo keyboard.
User types a full url: binance.us -> Brave doesn't suggest shit, user goes to whatever they wrote.
User types a partial url/keyword: binance -> Brave shows a suggestion from a local list of partners that match, with the suggested url being basically binance.us/brave. Not user tracking, just IDing that the click came from a campaign.
What the mistake was:
The user wrote binance.us -> Brave suggested the partnered link when it shouldn't have. That is literally it. And it got fixed within one day.
Brendan Eich is literally the guy who normalized letting websites run code on your machine. Even if we generously assume his intentions are good, the kind of thinking that brought us JavaScript is not even capable of grokking what I want from my browser in terms of privacy, security, and respect for my attention. Even if Brave's commitments to these values is genuine and not just marketing, they simply don't know what those values mean. Even if you trust their intentions, you can't trust their execution.
They started, right off the bat, by getting in bed with advertisers. That's their revenue stream. That's not how you fund a browser that serves users, that's how you fund a browser that serves advertisers. Even if their intentions are good, they don't know how to execute them.
"Mistakes" like injecting redirects into links are exactly what I'd expect Brave to do intentionally, not something I'd assume is a mistake.
And if you don't want the JS that Eich created to run in your browser, you can turn it off... most people like to run sandboxed code instead of installing native programs.
Mozilla makes most of their money from Google Search referrals.
Chrome was entirely built to put more eyeballs on Google ads and track you.
There's a lot more privacy features built into Brave than there are in other browsers. It's user oriented, not adtech oriented.
Of Brave, Chrome, and Firefox, who has the built in ad blocker?
That's a pretty confidently wrong statement.
You're aware of Wikipedia, right? More directly relevant: Konqueror?
And as is typical of HN, you seem to be unaware that people might be motivated by things other than money. Browsers are a large enough undertaking that you need some money to make one sustainably, but when money isn't your primary motivation it turns out you can do quite a bit with less.
> There's a lot more privacy features built into Brave than there are in other browsers. It's user oriented, not adtech oriented.
Brave is literally adtech. They sell ads.
To take a step back, which browser do you use? Did it come with an ad blocker?
Do you apply these same standards to all browsers and fiercely challenge them like Brave, let's say... Firefox?
> Do you apply these same standards to all browsers and fiercely challenge them like Brave, let's say... Firefox?
Firefox doesn't claim that they're trying to address the problem of ads on the internet, so no, I don't challenge Firefox's false claims. See how that works?
"Power and privacy to the people. No need to dig into your security settings. Fierce privacy is our default."
- Firefox on a recent update. You know, a browser that defaults to Google search and having search suggestions on. I know I'd have a couple privacy settings to change.
I don't want my browser to be a "product". If we didn't have people pushing for exponentially increasing complexity because they want the web to be an app platform then we could have browsers developed by individuals or groups in their free time.
But even if you insist on full time developers, there are alternative funding methods. Donations & grants being the most appropriate for something that benefits the general public.
> And if you don't want the JS that Eich created to run in your browser, you can turn it off... most people like to run sandboxed code instead of installing native programs.
The problem isn't being able to run sandboxed programs vs. native programs, the problem is that things that are supposed to be documents can run "sandboxed" programs where the sandbox is leaky and getting more leaks addded because perfect sandboxing is not what you want for applications that are supposed to be usable and therefore need to interact with the outside world.
Pointing at other browsers and pretending that them being ad-funded and/or also doing bad things makes any thing Brave does better is ridiculous.
Unbelievable. Now we're to be angry at (or at least, suspicious of) Eich for inventing Javascript? Because... it can used for evil? Is that really a path we should be going down? Is Tim Berners-Lee next? Come on.
>They started, right off the bat, by getting in bed with advertisers. That's their revenue stream. That's not how you fund a browser that serves users, that's how you fund a browser that serves advertisers.
This is similarly disingenuous. They started trying to solve the problem of facilitating an advertising model that respects privacy and rewarding creators (users) with revenue in the form of BAT tokens.
Say what you want about the execution, or the idea in general — but it's a noble goal.
I'm no fan of Eich's politics but your overall framing here is grossly misleading.
There is literally no good case for JavaScript. It's literally malware: code that runs on your machine without your explicitly installing it and does things that serves the website, not the user. The fact that it's in a sandbox to limit the harm it can cause is nice, but it doesn't really solve the fundamental problem.
Formats such as social media profiles, recipes, etc., would have been better served as document formats separate from or included in HTML.
More complex things like Google Maps could have been done as native apps--and still are, because the web app simply can't provide the same level of experience as a native app.
> They started trying to solve the problem of facilitating an advertising model that respects privacy and rewarding creators (users) with revenue in the form of BAT tokens.
If I want to reward a creator I can pay them without a middle man: BAT complicates that rather than simplifying it.
Advertising is a social harm. An advertising model that respects privacy, still disrespects attention, bandwidth, power usage, etc.
It should be clear that content creators aren't browser's target users, but since you brought it up: advertising generally creates a race to the bottom which incentivizes low-quality, low-effort content creation which creates a filtering problem: now it's hard to find the high-quality content amid the half-assed AI-generated nonsense. Publications which are high enough quality to be paid for, such as the NYT, have obviously been harmed by ad-based business models becoming the norm.
> Say what you want about the execution, or the idea in general — but it's a noble goal.
Their goal is to make money, and they've set it up so that their goal of making money is dependent on pleasing advertisers, not users.
The noble goals you're claiming simply are not true.
It's one thing to say that Javascript is massively over-relied on (I might even agree) but this is not anywhere close to a serious, well-considered argument. It's a joke.
I'm not interested in engaging further because extremist positions like this indicate that the speaker is not interested in meaningful debate.
> It's one thing to say that Javascript is massively over-relied on (I might even agree) but this is not anywhere close to a serious, well-considered argument.
Perhaps if you quoted past the first sentence you'd find the serious, well-considered argument you're looking for.
> I'm not interested in engaging further because extremist positions like this indicate that the speaker is not interested in meaningful debate.
Quoting a sentence out of context, calling it extremist, and then exiting without responding to any of the substance of my post makes it look awfully like you aren't interested in whatever you think "meaningful debate" means.
The extremist position is that visiting a website implies consent to the website running arbitrary code on my hardware. The only reason this has become accepted is that it's profitable to powerful people.
I didn't see anything you wrote that provides extra nuance to the statement. That is - nothing you wrote softens or modifies the quote. Am I right, or did I miss something? You were pretty clear. You even used "literally".
Sure... you went on to say why you see it like that, but that's not what being "quoted out of context" means. Is there some caveat, exception or nuance you were trying to express that modifies what you meant?
As for why I didn't engage further, let me ask you this — what if I tell you JS provides several good use cases for me and people I know? Will you then agree that some people do find good uses cases for JS or will you try to tell me I'm wrong? My impression so far is the latter.
You see what I mean? There doesn't seem to be any point in engaging.
As for the rest - I have no interest in debating BAT, or the advertising world. We largely agree. My point was simply that you misrepresented their value proposition by insisting there was never even a theoretical benefit to users and creators. It's a non-starter for having a useful conversation IMHO.
Brave private ads system is off by default. Users enable it voluntarily and get 70% of the gross without any data on our servers. Ad matching is done via a pushed ad catalog and local-to-browser machines learning. Impression counting for revshare payments uses a Chaumian blind signature protocol (same crypto as Privacy Pass). If I cold-read your comment here, I get the impression you think Brave's ads are on by default, or you want to leave that impression on readers. It's false.
We also do not inject ads into pages. The opt-in private ads go in your ad slots (notifications, new tab pages), not in any publisher slots.
Your last paragraph (a few other HN regulars do this too) uses dishonest language: "links" mean hyperlinks in pages, and we never added any affiliate code to those. https://news.ycombinator.com/item?id=31088549
Another Firefox user
* "Allow Firefox to make personalized extension recommendations"
* "Allow Firefox to install and run studies"
* "Block dangerous and deceptive content"
* "Pocket" add-on installed by default.
I don't recall opting in to any of these things when I installed firefox. This isn't some conspiracy or hard to understand concept. They are right there in the settings page, not in the config flags, and I don't understand why it's so difficult to believe this or just look yourself.
So there are five settings that you believe are set to the wrong default. This causes you to mistrust firefox in total and want to use a fork that you deem more trustworthy but haven't mentioned any fork or how you decided that they are more trustworthy.
That is all 100% totally and utterly reasonable and we can take it on board and use it to adjust our views or not now that we know what you're talking about.
Thanks for posting it clearly that is worth the time it takes. The inital comment is mostly noise and in my view, not worth posting.
Would I prefer Firefox had different defaults? Yes. But, I will reserve the word shady for the products actually doing shady things like telemetry in Windows that requires jumping through hoops to turn off.
It is shady because new settings appear with updates. Surely you don't expect users to trawl through all settings for each browser update to see if Mozilla didn't sneak anything in there that undoes part of their previous choices?
Anyway. why does the installation of the Pocket seem so shady to you? There are a number of other features in the program you just installed that you probably weren't aware of. I mean, I didn't read the full source of Firefox before installing it, so there are many features now on my computer that I didn't know I was getting into when I installed Firefox. Is it the fact that Pocket (which Mozilla bought) has a premium tier that causes you to classify it as "shady"?
By my measure, any telemetry sent back that wasn't explicitly opted into is shady. Once data has left my machine, it's out of my control and anything can happen to it.
We may not have time to fully audit the source, but individuals and groups I trust have, and have made forks that cut out this telemetry as well as other potentially unsavory features. One can also monitor network traffic in and out of an a browser app to understand what is being sent.
I'm using Bromite on my phone right now to type this.
No, it was a mistake. We fixed it. If you expect perfection, stop using Firefox too because Mozilla has made mistakes, including some similar ones. (I don't think they are reasons to stop using Firefox, I'm just applying your fake standard.)
Of course there are real mistakes, but this one was quite difficult to make…