No Mozilla, I don't want to watch your seasonal streaming music concerts. I want you to get on with building a better browser and stop undermining my trust. Sadly the top management think they're running a social experiment.
Edit: just checked and their android version doesn't seem to have implemented password manager support yet. I'm excited for when they do, but its disappointing.
You should personally should choose the lesser of two evils when those are your only choices. Promoting the lesser evil is not such an easy call though.
From a practical standpoint, promoting an evil, even if it's a lesser evil, has the potential for harming your own reputation as a reliable source.
It is also fundamentally morally questionable, of course what is morally right and wrong is a matter of much debate. Suppose a psycopath calls you up and says "I'm going to do one of two things, shoot a random 5 year old named Joseph, or shoot two random 5 year olds named Kate, which should I do?". Assume for the hypothetical that you know they are telling the truth, and there is nothing you can do about the situation but choosing what you say back. In my view of the world saying "shoot Joseph" still makes you morally culpable, even though you were avoiding a worse situation.
I recommend that you look into what you're getting with software freedom -- the single most important aspect that makes Firefox different from Google Chrome, Microsoft's web browsers, Opera, or Apple Safari. All of the items on your list can be changed by using your software freedom. And this doesn't have to involve you learning to program (though that wouldn't be a bad idea). It could involve you asking programmers nicely to help you out, or hiring programmers to improve Firefox to be what you think it should be, or getting funds together with others who share your views to collectively fund programmers who work on your shared goals.
As it stands your desire reads selfishly because it is indistinguishable from you saying that you want programmers to develop a free software (free as in freedom to run, inspect, share, and modify) web browser you trust without you doing anything to help vet its trustworthiness or modify the software until it becomes software you trust. We don't have to settle for doing nothing; software freedom lets us have as much control over free software as we wish to have. The limits are on us to make things better.
I do not have the time or the money to personally develop a secure web browser for the rest of the world, nor does any other individual. Your demand is unreasonable.
Moreover, I'm not demanding that Mozilla do something. I'm explaining what would have to change for me to be able to promote Firefox and contribute to reversing the declining market share. Short of not breaking the law I make no claims that Mozilla must do anything.
PS. Chromium is also free software. The difference is how Mozilla develops it's free software.
Apparently some people do, that's why we have Firefox derivatives like the Tor browser and GNUZilla, among others. Also, I made a recommendation not a demand. I continue to recommend that you consider what software freedom grants you in light of what you say you want other programmers to do for you.
- They have telemetry turned as the default
- They are experimenting with TLS over HTTPS and use beloved Cloudflare to handle every DNS request
- They are always in the headlines about some shady 'addon' or 'extension' been sold off and taken over by shady actors
- The TorBundle which is a fork of FF ESR is always in the headlines as been unsecure and way behind FF mainline release
1. Agreed, but at least they do prompt fairly early letting you turn it off.
2. I'm only looking at things in the release version of firefox. As I note elsewhere they treat nightly/beta users much worse. Longterm TLS over HTTPS is great for privacy, and they had to choose some provider, so I'm mostly fine with this.
3. This isn't their fault, the same applies to chrome. An extension is a third party piece of software you choose to install.
4. Again, a third party piece of software, not under their control. Further they are actively working to improve this situation and bring Tor onto mainline firefox!
Sorry I meant DNS over HTTPS
Currently Tor is behind mainline Firefox in terms of security because it's a fork of Firefox ESR[1]. Pay attention to this part[2]:
> Unlike other release channels, ESRs are not updated with new features every six weeks. They are instead supported for more than a year, updating with major security or stability fixes.
[1] https://www.mozilla.org/en-US/firefox/organizations/
[2] https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Fir...
Firefox is my primary browser on Windows, and I'd love to have this stuff removed, but I'm really not at a point where I can be compiling the code myself.
[0] https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxNoNightl...
[1] https://lobste.rs/s/ri4kny/you_probably_don_t_want_run_firef...
- Public search for sources of other people's breached personal data via monitor.firefox.com (eg, you can enter anyone's email and see results, and not just your own, as there's no verification that you own the email until you sign up for continuous alerting)
That said, I love Firefox itself and think Mozilla usually try to do the right thing. Someone just lost the security vs usability debate there I guess.
Apparently informing people who won't check their email for a link but will enter their email into a form trumps protecting people who don't know the site exists from stalkers and other malicious actors.
That page is powered by haveibeenpwned.com. Mozilla just made a fantastic security tool available to user who don't know about Troy's site.
> you can enter anyone's email and see results
This data is all very easily available online anyway. It's just aggregating leaks that already public, and neither HIBP or the Mozilla page provide the _actual_ personal info that was leaked.
> Someone just lost the security vs usability debate there I guess.
That's the thing though; this _is_ a valid security tool. And a powerful and valuable one at that. HIBP has been used for years by thousands of users to secure their accounts after data breaches.
The argument of "Others are being irresponsible, so we should be irresponsible as well" does not stand up very well.
The only valid use case for providing this information is for when a user no longer has access to the email address in question.
In this case, they should still require it to be sent via email, and they should still send a notification to the email address being requested which includes details about the request like the IP it is made from and the email it would forward to, perhaps with a delay-and-prevent option so that someone who still owns the email can prevent the exfiltration by responding to the notice quickly.
Otherwise, this enables anyone to solicit unauthorized PII data about basically anyone else from Mozilla.
Even HIBP somewhat acknowledge the potential damage this can do, from the way they censor some results like the Ashley Madison data breach. They've made the decision that some personal information linked to a person's email address is more worthy of protection than other bits of personal information, which really shouldn't be up to them.
They get away with it because of weak data protection laws and the fact that this caters to individual users who are more likely to opt themselves out if they become aware of it than to file a lawsuit or otherwise apply pressure to make them change.
> Pocket, as a service being added to the default home/newtab page
Is that really worse than Mozilla allowing all of your Google searches (from the new tabs) to go through Google? At least it owns Pocket.
Mozilla needs to make money somehow. Promoting its own services doesn't seem nearly as bad as the partnership with Google, in my opinion.
Firefox now shows you ads on your home page by default. It's diabolical.
I trust a well-configured Chrome (and with that I mean using the options dialog, not the cryptic about:config) more than Firefox. Even after having a well configured about:config, they managed to remotely install the Mr. Robot advertisement addon on my computer. I freaked out when I saw it.
The Mozilla Corporation would do very well with a big change of leadership.
The unfortunate part of this is that how much weight you assign to the twos actions is subjective, so I can't tell other people "you should definitely be using firefox instead" in good faith.
- Google analytics baked into about:addons
- Sending data to Cliqz
- Pocket, as a service being added to the topbar
- Pocket, as a service being added to the default home/newtab page
- Firefox hello
- Completely banning unsigned addons
- Mr. Robot advert
- And now probably this
I want a browser that is reliable, high quality, respects my privacy, and nothing else. I don't want addons baked into it. I don't want to be spied on.