Hacker News Reader

Comment by AndrewKemendo | Hacker News Reader

I'm going to treat this like a product engineering discussion

User Story:

As a Private Citizen and Engineer, I want a graphical multi-input interface to load, view, interact with and post documents to remote and local HTTP servers ("web-browsing") on any personal computing device. I want web-browsing to have out of the box default security and privacy guardrails that are well documented can be disabled or modified by me the user and only me the user. I want this software to be fully modifiable by any person using tools that are easily, freely available and accessible (aka FOSS). I want this capability to be free at the time of use with no restrictions on amount scope or scale of use.

I think the above describes the product that everyone wants

It sure sounds a lot like Firefox to me

Why aren't we collectively putting our time/effort etc.. into making Firefox the singular and best FOSS browser ever?

edit: Oh I didn't realize that Brave totally abandoned their model and started taking Venture from RGA and Page One in 2019. Game has been over since then at least: https://www.crunchbase.com/organization/brave-software/compa...

View on HN

> Why aren't we collectively putting our time/effort etc.. into making Firefox the singular and best FOSS browser ever?

Because the leadership is hellbent on copying Chrome but worse and investing in utterly pointless endeavors instead of making a good browser. It's a shame. Giving money to the Mozilla Foundation is the same as throwing it to a black hole.

I hope a new truly FOSS browser shows up and catches on that does not use Blink and isn't owned by a group of human-shaped leeches.

>Because the leadership is hellbent on copying Chrome but worse and investing in utterly pointless endeavors instead of making a good browser.

Is this a hypothesis that we can specify and test? Is this how we would approach this problem?

It sounds more like a cynical write-off, not a actual strategy

>I hope a new truly FOSS browser shows up and catches on that does not use Blink and isn't owned by a group of human-shaped leeches

Cool, but that strategy clearly isn't working.

I'm suggesting, instead of writing off Firefox, we (you specifically, and me and whomever else wants to) start engaging with Mozilla to help figure this stuff out

Nothing is perfect, but at least it's got some of the hardest parts right: Organizational momentum and distribution. Technical stuff is easy to change compared to that.

The challenge now is finding competent people who can actually put the effort in, with no compensation, to make it work and that might take convincing the Mozilla folks to do something differently.

Having done this kind of thing a few times, that sounds way easier than trying to totally start over from scratch though.

> Is this a hypothesis that we can specify and test? Is this how we would approach this problem? It sounds more like a cynical write-off, not a actual strategy

There is nothing to test, it's why I stopped using Firefox. Check the Mozilla foundation page for all the crap they fund instead of the browser. Look how much the UI looks like Chrome, even little things like clicking the searchbar expanding it outside its bounds.

> I'm suggesting, instead of writing off Firefox, we (you specifically, and me and whomever else wants to) start engaging with Mozilla to help figure this stuff out

They don't listen to feedback. When Apple (the company known for telling people they were holding their phones wrong) introduced the safari tab-redesign that merged tabs with the searchbar, it was nearly universally disliked and they backtracked on the change. Apple of all companies backtracked on a bad design. Mozilla? They just keep on going.

When Nintendo was struggling due to the failure of the Wii U, Satoru Iwata took on a massive pay cut to avoid firing people. Mozilla? Fired the Servo team and raised executive compensation.

> In 2020 Mozilla announced it would cut 25% of its worldwide staff of nearly 1,000 to reduce costs. Firefox has fallen from 30% market share to 4% in 10 years. Despite this, executive pay increased 400%, with Mitchell Baker, Mozilla’s top executive, receiving $2.4m in 2018.

Firing the Servo team was probably the dumbest thing they could have done.

Yep, they’d need to fire Baker to right the ship at this point, among other things

Under section 3.5 of the Mozilla foundation Bylaws [1], Baker could be removed by the board, which consists of Mitchell Baker, Brian Behlendorf, Helen Turvey, Nicole Wong, Amy Keating, and Mark Surman [2]. Note that the directors are elected by the directors in the first place so sadly, it is unlikely to happen.

[1]: https://static.mozilla.com/foundation/documents/mf-bylaws.pd...

[2]: https://foundation.mozilla.org/en/who-we-are/leadership/

> Check the Mozilla foundation page for all the crap they fund instead of the browser.

Notwithstanding that, they still put out firefox. And Firefox is a far superior browser to any of the alternatives if you care about user-centric control and privacy. So to anyone who cares even a little about being able about these things, supporting Firefox is the way to go.

If a mythical even-better browser shows up, great. But here and now, it's Firefox, or completely surrender the web to commercial interests.

> Notwithstanding that, they still put out firefox

Firefox was created by pre-Baker Mozilla which was an organisation focused mostly on - to coopt the terminology used by those who coopted Mozilla later - "software justice". When Eich was ousted (for voicing an opinion he shared with people like Barack Obama [1]) and Baker took his place she set a course towards different goals: Mozilla was going to focus more on social justice because it was not enough to only build software. She clearly did not realise - or did not care - that it was through creating viable open alternatives to proprietary browsers and related software that Mozilla was in fact doing the best it could towards achieving the aim of a more just world.

Baker needs to be ousted, she can go lead some NGO somewhere if she wants to fly social justice flags. Let Mozilla be led by those who understand that software freedom is an integral part of freedom of information access and an open internet which are essential to counteract the tendency towards authoritarianism which has plagued society since the dawn of time.

[1] https://www.telegraph.co.uk/news/worldnews/barackobama/33750...

To those who feel the need to vote down instead of coming with counter-arguments I want to ask what you think is wrong in my reasoning. As far as I can see Baker has been a net-negative for Mozilla both due the politicisation of the organisation as well as her financial mis-management. Tell me where I'm wrong instead of trying to get my message greyed-out. I was there (at the IETF conference) when the Netscape source was released, was among the first to build the code, have done my part with testing and patching and still use Firefox. I see Baker's mismanagement and misdirection of Mozilla as a tragic mistake. What are your arguments?

> Firefox was created by pre-Baker Mozilla which was an organisation focused mostly on..

Yes, I'm familiar with the history (fun: I even have an original signed CD of the initial Netscape open source release, handed out at the release party in San Francisco which I attended).

Mozilla of today could perhaps be more focused on the browser.

Nevertheless, they continue to support it, maintain it and release it. If you want a browser today in 2023 that puts out user control and privacy first, this is it, Firefox.

> Nevertheless, they continue to support it, maintain it and release it.

Baker's organisation continues to release the browser which pulls in several hundreds of millions from Google. This money is for the largest part not used to improve the browser or the software ecosystem surrounding it - Firefox sync is withering on the vine, Thunderbird has been spun off, Seamonkey has been spun off a long time ago, Servo has been terminated (the project is continued by volunteers), the Rust team has been let go, etc. The money is used for political activism and to fund Baker (who again raised her own remuneration, from $2.5 million to $3 million) [1] and her organisation.

That Firefox still is being released is more despite of Baker's managerial decisions than thanks to them. Mozilla is kept alive by Google because the presence of Firefox on the market is an insurance against claims of a monopoly. That insurance is getting less effective now that Firefox has dropped to a low single digit market share so it remains to be seen whether Google will continue to shore up Mozilla for much longer.

> If you want a browser today in 2023 that puts out user control and privacy first, this is it, Firefox.

Yes, that is still true because of the work done by Mozilla developers and volunteers. Now imagine how much further the browser and related projects could have been had Mozilla been led by someone who would use the proceeds of the Google deal to further software and ecosystem development instead of what largely amounts to political virtue signalling, "color of change" and other PACs and similar activities.

Baker is not the right person to lead this organisation, she is a political activist [2] better suited for an NGO or PAC.

[1] https://techrights.org/o/2022/02/17/mozilla-salaries/

[2] https://blog.mozilla.org/en/mozilla/we-need-more-than-deplat...

Isn't that because Firefox itself basically makes no money? I know about Google's deal with them but it seems like Mozilla is trying to diversify away from them.

I'd say it's because it is the nature of bureaucracy to expand. An open source browser doesn't need to make money, but a foundation tends not to maintain an unerring focus on a single specific goal.

The only thing Firefox users hate more than Mozilla taking money from Google is Mozilla making money from other sources. Why can't the Mozilla team just be ascetic hairshirts who make exactly the browser they want and bring XUL back while they're at it. /s

The Mozilla Foundation is a non-profit that owns the for-profit Mozilla Corporation.

Step 1 is get rid of the for-profit corporation that pays its CEO 2.4 million dollars a year to lose market share. That's 24 well-paid developers, or double that from lower-income countries.

The foundation had a revenue of $441 million in 2020. We know that in 2014 ~90% of their revenue come from its search-engine deal with Google. That means that without Google they'd have ~44 million to work with these days (or more).

That's a lot of devs, before even considering non-search-engine sources of revenue. Personally I don't mind ideas like the VPN. I do mind the stupid grants the foundation does unrelated to a web-browser or acquisitions like pocket.

> That's 24 well-paid developers, or double that from lower-income countries.

That's a stretch even if we don't count the additional overhead.

For a non-profit that (already) runs a mass of volunteers? Surely you jest. The CEO of the blender foundation makes around 100k. They develop one of the greatest open source success stories on 2 million a year. That's less (for the whole project) than Baker makes (2.4 million). There's no excuse for the shitshow that is Mozilla, none.

Couldn't they take the Google money, invest it, and pay developers purely from the interest? Like a university endowment?

How many years of Google money would it take to support ~500 staff purely for making Firefox in perpetuity? That's maybe ~$50 million/year?

This[1] says endowments target ~7.5% annualized returns. So a very conservative 5% return could pay for ~500 staff with ~$1 billion in Google bucks.

[1] https://www.nacubo.org/Press-Releases/2023/Higher-Education-...

> 2.4 million

Try > 5.6 million. https://assets.mozilla.net/annualreport/2021/mozilla-fdn-990...

Firefox is the only thing that makes money. The problem is that the money made by Firefox was not invested back into Firefox. As a result market share fell. Less market share leads to less money from search deal.

https://browser.kagi.com/

Once it supports other platforms it can definitely be a good alternative!

It doesn't have any builds for any open OS.

I just donated $5.65 so, that's something

Just curious, would you need something completely new to show up, or would a well-funded, openly-governed fork of Firefox work?

Firefox (the underlying tech) is fine, the problem is the management. Fork away.

Firefox have no way to support Tab Groups like any Chrome does by default. So is a no-go for me.

Any suggestion that Firefox do support Tab Groups will be met with ridicule. It just doesn't.

> Why aren't we collectively putting our time/effort etc.. into making Firefox the singular and best FOSS browser ever?

[disclaimer: former Servo team member]

Mozilla had a chance to advance browser tech with Servo and fumbled it.

Is that sufficient reason to abandon the entire project?

Not to be negative, but what value would Servo exactly bring to users and the web after all the engineering effort? I'm sure it was technically impressive.

Chrome, when it came, was stupidly faster than any other competitor, including Mozilla Firefox.

What would Servo bring to make web a big jump forward for us users, beyond ideology and fun work for its developers? (Ideology doesn't sell software, as opensource efforts have proven repeatedly over last 3 decades).

Same selling points as Chromium originally: faster and safer. The premise of Servo is that it'd make better use of multicore and would be safer because it was written in a memory-safe language. For modern users the big one is probably battery usage, though, which Safari excels at but would be harder for an open source player that has to support every device.

> What would Servo bring to make web a big jump forward for us users

The biggest advantage would be having a memory-safe browser engine.

As someone with almost no knowledge of Servo, and personally not having a good opinion of the Mozilla foundation, your comment tells me all I need to know why they stopped support of Servo development.

Only social initiatives get feel good money to waste on nice to haves. This "Servo" thing does not sound like it.

I want to draw one's attention to the (at this point impressive) number of CVEs related to memory issues in Chromium's C++ codebase: https://chromereleases.googleblog.com/search/label/Stable%20... and control-f for CVE

Even granting that some of them come from dependent libraries, if the world's arguably best funded software engineering organization can't keep C++ footguns out of an application that runs untrusted code on the regular ... one may want to have a think about whether C++ is the best tool for that purpose

So what's the monetary value of not having those CVEs? How did any of that actually touch users beyond having to wait a bit for Chrome to autoupdate?

https://search.brave.com/news?q=chrome%20exploit%20in%20the%...

I'm delighted to hear that you (and I) were not personally impacted by those but to say "I didn't get in a crash, who cares about seat belts working" is comically misguided

Also your "for Chrome to autoupdate" perspective makes me wish I could search for every single red Update screenshot I've seen in presentations or Zoom meetings

Again, how did that materially affect users to the point they'd switch?

The point is that all this is not seen as valuable by users and market leaders. You don't gain marketshare in b2c by saying "my gizmo is more memory-safe than other gizmos", you have to show features. Chrome's process-separation was a feature: you could easily dispose of non-responsive pages, which other browsers couldn't do as well. Even then, it wasn't really why Chrome took off - it took off because of deep integration with Google's ecosystem, incessant marketing efforts, and monopolistic behaviour (Google "unwittingly" breaking GMail and other G products on other browsers, on a regular basis).

So what feature would full memory-safety actually enable? I suspect that's the bit that the Servo folks couldn't articulate well enough.

> but what value would Servo exactly bring to users and the web after all the engineering effort?

Servo was a much more modular effort.

1. we would get a lightweight (modular) electron alternative. This would have helped rust gui ecosystem a lot, just like wgpu helps rust gamedev scene.

2. Probably have more variety in browsers as everyone can now reuse servo components to make their custom version of firefox. Imagine all the linux distros which reuse gnu/linux, but have their own philosophy of package management, updates, mutability etc.. We could have had the same sort of varieties in browsers for different usecases.

Plus it'd let people use a JavaScript engine other than v8 and JSCore, and one which (in theory) would be memory safe.

> Chrome, when it came, was stupidly faster than any other competitor

Wasn't it just using WebKit initially? IIRC you could actually use Safari on Windows back then.

Are they not using any Rust in the codebase at all? My impression was that they abandoned Servo but still rewrote parts in Rust.

Some big chunks of servo got moved into firefox, so it wasn't a complete loss. But it would have been better if servo kept going, even if it never became something you would daily drive and instead it just kept generating good ideas to be subsumed into firefox.

Servo is active again thanks to Igalia allocating a handful of full time engineers. They are making good progress especially on layout, so keep an eye on it!

Firefox is getting many things right, but maybe we need something like some community fork with a leadership that's able to create a constructive effort to bring back the focus on what was once the spirit of this browser.

There are many non-aligned efforts with various directions, some focused on privacy, some on UI config, etc. maybe getting these people together to create something common where something can be integrated into one.

Just to keep rambling, I'd add that maybe a online conference independently run to get some important conversion going in the community, with the various firefox-fork maintainers and other important contributor, and try to layout some common roadmap, outline the main issues and get people exited again about the product would be a relatively low-hanging fruit to this started.

You’re in the right mindset. I’d recommend a pivot from the “private citizen” persona to the “CTO persona”. As a CTO, I want a web browser based on open standards so that my company’s portfolio of products and internal business apps are protected from monopoly behavior by browser vendors.

Mozilla may have forgotten the CTO persona. CTOs can donate engineering hours to Mozilla. Companies can donate money. If companies in the Fortune 500 aren’t using Firefox internally and companies like Netflix aren’t recommending Firefox to users, then Mozilla will continue to struggle to get market share and sustain funding.

One key use case: Firefox used to make it easy to create corporate intranet apps (the apps teams at companies use to do work). However, Firefox security changes started breaking intranet apps by returning the “your connection is not secure” error and giving workers no way to override. This hurts CTOs so CTOs switch their companies to Edge & Chrome.

Ugh, the self signed cert “error” scare page is such a dark spot in general purpose computing history

What is the difference between Brave taking Venture and Mozilla being subsidized by the ultimate enemy of privacy, Google?

Mozilla has defunded Firefox, allows for no way to directly donate to Firefox development, and now writes activist blogs.

History

We know what Mozilla will do with it - not ideal but it's the devil we know

We have no idea what Brave will do with it

My personal heuristics around VC backed companies (Having been a CEO with venture backing, an LP in a venture fund, a director in a publicly traded company etc...) is the following:

There do not exist PE backed companies that will take actions that conflict with an even theoretical reduction in potential ROI.

Leaders lose long term control of their companies to VC the moment they sign the term sheet

So I have zero faith that anyone who aligns themselves to profit making, will not harm either the customers or the employees that are involved in favor for the people providing the capital.

I think for a lot of people Firefox does tick those boxes, but the way Mozilla has been run is... less than ideal. I'm sure many commenters here will have strong opinions about it, personally I'm not convinced that modern Mozilla is the right organization to pour this time and effort into.

There is SerenityOS and their Ladybird browser

God bless Andreas Kling but I don't think they have the community support to stand up to the Chromes and IE/Edge of the world unfortunately

That seed stage investment is a tiny slice of the cap table and has no control, just ride-along preferred shares. Your aversion to VC is something I share, but not to this IQ-lowering degree.

Brave is fully open source, and actually defends its users privacy by default.

While firefox still uses google, allows google ads and tracking, and just talks about doing something but does nothing

Also chromium is just a superior engine, in security and speed, using firefox won't change Chromium dominance at all.

That's the same Brave that replaced links with their own profit bringing ad links? Riight.

This never happened as far as I can tell.

It didn’t. They did append their affiliate id to type-ins for a single crypto exchange once. They quickly retracted and apologized.

That’s bad, but not nearly as bad as what the parent commenter described.

>They did append their affiliate id to type-ins for a single crypto exchange once

They didn't do this either. There was an omnibox site suggestion that included an affiliate id. Nothing got appended and people were able to see the affiliate id before hitting enter to visit the site. These site suggestions could also be disabled in the settings.

Thats nearly exactly what I said? - If you typed the domain into the address bar, and pressed enter (obviously) the affiliate id got appended. I'm not clear what distinction you're making here.

It's like saying that if I type news into the omnibar and hit enter the browser appends .ycombinator.com

That isn't really what is happening. It shows a preview for news.ycombinator.com and hitting enter confirms that option. The distinction is one is clear to the user and the other is a modification that happens behind the scenes.

I never implied it was hidden. I’m not sure why you’re arguing with me.

Brave collected crypto donations on behalf of unsuspecting online creators and pocketed them. As far as I'm concerned that's as bad as fraud.

Because the product engineering isn't as important as the community and organization. I got excited about Firefox when it forked from Netscape, but since then I have been unimpressed.

From a user story perspective you skipped the most important “so that” part that describes your needs separate from the functional spec masquerading as a user story.

Although I think I agree with you, if your “so that” is so you can visit a particular website, those features you are specifying may demonetize and eliminate the website you want to go to causing it not to exist.

How much are you willing to pay for such a product?

I'm willing to give 100% of Mozilla's CEO salary and move money from unrelated project over.

Fire Baker for cause and claw back any bonuses / extra compensation. That would indeed be a good start for freeing up some budget

Brave's CEO (Brendan Eich) used to be co-founder and CEO of Mozilla. They kicked him out because in 2008 he donated $1000 of his money to an unapproved political cause. Can't put time/effort into something that is more interested in virtue signalling than improving.

Shouldn't be a dead comment; this is exactly what happened.

CTO would've been appropriate, but not CEO. Mozilla could not keep a CEO donating to ban gay marriage. I rather doubt even Microsoft would've kept him. It's divisive and distracting, especially for a public benefit organization. They made the right call.

7 million people voted in favor of Proposition 8. Would you ban all 7 million from any position of authority? What of the 6.4 million who voted against, are they "divisive"?

It's fine if he voted against it. But a donation disqualifies him from that position if for no other reason than it's distracting from Mozilla's purpose. Whether good or bad, the foundation has a strong human rights focus.

Gervase Markham was a dedicated outspoken fundamentalist at Mozilla until his death and was very influential, but he wasn't in a leadership position. Big difference.

Would you have the same opinion if he had donated to the other camp? Does the timing of the donation also matter, in your view?

> improving

ah yes my favorite important improvements that I totally use daily like adding crypto tokens to chrome and crypto spam notifications on android

Firefox browser and engine is technical obsolete joke. Their sand-boxing security model, multi-threading, graphical libraries... Remember cancelled Servo rewrite, or the whole "multi-threaded" saga?

Try to actually compile that bloody thing, before you write "software to be fully modifiable by any person using tools that are easily, freely available and accessible"

Even Ubuntu team gave up on compiling their software, and are serving mainstream binaries from Mozilla!

Brave has some shady stuff, but that is easy to disable in configuration. And under-hood they follow security patches pretty well, have good security and stuff like 3D acceleration just works!

And you do not need 10 browser extension from some shady authors, that has full access to your browsing data!!!

That's due to trademark restrictions. The Gentoo community regularly builds Firefox from scratch, it's not the slowest package to build.

As someone who has built and lightly studied Firefox codebase out of pure curiosity this technical joke doesn't really ring remotely true. Sure it's an older codebase and Mozilla doesn't have enough funding manpower to do big rewrites but I don't remember Firefox crashing on me in recent times and I use it exclusively on Mac/Linux and Windows. No site compat issues either. So stop blowing smoke I guess and provide actual details on how it is a joke?

It is not about crashing, but security. Chromium based browsers have multiple layers of sandboxing and hardening. Webpage rendered basically runs in several virtual machines that are very hard to breach.

Mozilla had process based isolation (mainly due old code base). That is far less effective. Some things like GPU access are not sandboxed at all!

>Google remains the default search engine provider inside the Firefox browser until 2023 for an estimated $400 million to $450 million per year.

Mozilla is a multibilion corporation. They DO have resources for proper rewrite in Rust. How they spend their money is another thing!

Old code base was good excuse in 2016! Brave Software Inc is much smaller company, and they do advanced stuff like their own search engine!

GPU sandboxing landed in 110 on Windows. https://wiki.mozilla.org/Security/Sandbox/Process_model#GPU_... says it will be likely added to OSX and Linux with Webrender. Web Content processes are already sandboxed so I wouldn't say it's a joke ;) - sure they lag behind Chromium but Google has way more resources than Mozilla.

<< And you do not need 10 browser extension from some shady authors, that has full access to your browsing data!!!

Which extension authors are shady? I am mostly sticking to ublock origin, but this is the first time I hear that accusation.

Most extensions are single person projects run on GitHub. Imagine if their Gmail account, or phone SIM gets breached and backdoored version reaches Extension Store.

Plus several extensions were just sold to highest bidder!

Sure, but it does not address the question I have placed for you. Can you name the extension you consider shady? A lot of projects on github are one man operations.

Sure!

Ublock Origin installed from Firefox Extension Web Store. I have no idea how this was verified and distributed. I do not trust webstore as a channel. Also user may easily click on "Unblock" or "Unlock" and get something completely different.

If this extension came from my Linux distro package, or bundled into Firefox binary, I would trust it.

With Brave I have no need to use extensions. Everything is bundled and can be enabled via about:flags.

https://packages.debian.org/sid/webext-ublock-origin-firefox

Reply on news.ycombinator.com