"The http://mozilla.org tab discussing the importance of Privacy loads in the background, bringing along with it the Google Tag Manager and Google Analytics. Hello, Google."

Loved that part.

There is response from Mozilla's security engineer: "Thank you very much for pointing this out! We are investigating this and will report back." https://twitter.com/mozdeco/status/1166042350453497856

This is an interesting (closed) bug filed against their SSL config generator. https://github.com/mozilla/ssl-config-generator/issues/8

It demonstrates that support for Google Analytics is not unanimous within Mozilla, and even if someone removes it from a product page that action is detected by others and reversed.

Privacy aware users should block this sort of thing at their router using a hosts file, or Pi-hole, which is far more effective than calling companies out on Twitter and hoping for the best.

I think it's important to do both.

Privacy aware users should take all resonable steps to protect their on privacy, but it is also appropriate to call out Mozilla.

Mozilla (and advocates) promote Firefox as the privacy conscious browser while Mozilla repeatedly takes actions that would appear to go against that claim.

Representative comment: https://github.com/mozilla/ssl-config-generator/issues/8#iss...

> In this new era of looking for premium service opportunities I suspect there will be value in having metrics of some kind.

Yes, I was somewhat disappointed when I read that. The irony.

addons.mozilla.org also contains Google Analytics. And since addons are not allowed to act on addons.mozilla.org, you have no choice but to ping Google every time you load a page there.

Mozilla is either stupid or ill-intentioned. It's 2019 so they've lost the benefit of the doubt for me.

There is in fact a third option, which happens to be their stated position.

Part of their (written) agreement with Google is that none of the analytics data generated from Mozilla properties will contribute towards Google's tracking database.

"Mozilla has a legal contract with Google that prevents them from using our Google Analytics data for mining or from sharing it with third parties, among other privacy-protecting provisions."

"Mozilla went through a year long legal discussion with GA before we would ever implement it on our websites. GA had to provide how and what they stored and we would only sign a contract with them if they allowed Mozilla to opt-out of Google using the data for mining and 3rd parties." https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14

Great if you trust Google, not so much if you don't. Too bad Mozilla made that choice for us, and imho, the wrong one. Google has proved itself time and time again that they cannot be trusted with privacy.

"Mozilla went through a year long legal discussion with GA."

I wonder why. Implementing some basic analytics on a few pages shouldn't be that hard.

"Great if you trust Google, not so much if you don't. Too bad Mozilla made that choice for us, and imho, the wrong one. Google has proved itself time and time again that they cannot be trusted with privacy."

I believe this to be a lazy and ignorant opinion, and I think you are hoping no one will call you out for this.

"Google has proved time and time against they cannot be trusted with privacy". This is a contract between two businesses, which carries legal weight (and in some countries, carries more legal weight than just contract law), so could you source for me perhaps 2-3 (you said "time and time again", so 2-3 should be quite easy!) of your most iconic times that Google openly violated contract terms with major organizations regarding privacy controls?

Remember when they were "unintentionally" scanning and saving wifi data?

Broke the law.

If Google has a culture of "grab all the data, and use it in whatever way you can figure out to make money,"—and they do—then the real question is if they even have the institutional capability to not accidentally use this data the same way they use all the other data they have.

>"Remember when they were "unintentionally" scanning and saving wifi data? Broke the law."

I don't want to be a broken record of "this opinion sounds lazy and under-researched and I'm calling you out" but.....

* Google was cleared of wrongdoing under the Wire Tap Act after an investigation by federal law enforcement

* The wifi data capture was a 20% time engineer project which rolled out unintentionally, was never commingled with other data, and was destroyed without being used

* The DoJ and Federal Court of Appeals disagree on the details and the Supreme Court of the United States refused a petition to clarify any parts, so any assertion that they "Broke the law" is either ignorant or malicious, IMO, because to summarize a situation where law enforcement said "No law breaking " and an Appeals court said "Maybe law breaking" as "Law Breaking" can't be considered a rational and intellectual attempt at understanding

Well, as long as it's all legal I'm happy :D

While Google does collect a lot of data, the culture is to guard it rather zealously. Google has a lot of lawyers and all projects have to get a privacy review. The privacy folks take their jobs seriously. There is mandatory training about when you need a privacy review. There are a lot of internal rules and technologies built to guard security and privacy. There are researchers looking into ways to learn from data on mobile devices without actually collecting it. The security people are probably the best in the business. And so on.

Some of the procedures were put in place after the wifi scanning incident.

And that's not to say bad things can't still happen. One thing that sounded particularly bad about the now-cancelled Dragonfly project was that they were allegedly avoiding privacy review. This project was being kept secret from the rest of the company because it's not how things are usually done.

So, my guess as an ex-Googler is that they can guard it and probably will, at least under normal conditions.

We wouldn't know, since most of the incidents would never see the light. From the incidents that did come to light (e.g. Google spying on you through its assistant), we do know that they can and will bend the letter of the law to suit their purpose. So I think that it's your opinion that sounds hopelessly naive rather than OP's.

Most of the cases of Google "spying through home assistant" (along with the other assistants, Amazon, Apple included) while obviously invasions of privacy were generally (all?) legal.

At least in the US they weren't breaking any laws. I'm not saying they would never break any laws for financial gain, just that most of the breaches in privacy aren't technically illegal (thus the need for privacy laws)

> This is a contract between two businesses, which carries legal weight.

It’s like the Snowden revelations didn’t happen. I am pretty sure US intelligence agencies have access to your Firefox GA analytics.

So where is the external audit to Google's data centers, verifying that they actually do what they claim to do?

It is pretty unlikely that a company (Google) would break a contract with another relatively large organisation (Mozilla). Yes, Google vacuum up all your data and do shady stuff with it, but only because all of it is legal.

Plus, the amount of data that they get from Mozilla must be tiny compared to the amount of data that they collect through their search engine: it's only data on mozilla.org, not data of everyone that uses the browser at all times. It is not wise to risk a lawsuit over it.

> I wonder why. Implementing some basic analytics on a few pages shouldn't be that hard.

Maybe defining a contract to prevent use of Mozilla data without loopholes is harder.

It will be "anonymised" I imagine, enough to give Google all they want and still let Mozilla get paid and _say_ they don't give up user data.

There's surely no way to tell what they do with the data at the other end? It's Google and their serf, Mozilla, I can't imagine it's wholesome.

> It will be "anonymised" I imagine, enough to give Google all they want and still let Mozilla get paid

Do you have you any basis for this assertion?

For the assertion of my assumption? The post itself is evidence of it.

You can see from the screenshot in the linked bug report that the data won't be shared whatsoever if those boxes aren't checked.

It’s not entirely one sided as you describe. Google is one of the few companies that has also fought legal requests from governments trying to spy on their citizens, when the others giants caved immediately.

One of the things Google gets right. They know that data breaches, where someone does get the valuable ad profiles or data of Google users (while usually advertisers just get to target based off the data), are one of the few things that will actually cause the masses to think about their privacy settings and why they're giving Google their life story at all.

Which requires the user to trust Google to a) honor that agreement (somewhat simple, though we don't know the actual terms, i.e. what's on the line for Google) and b) not have bugs in their systems that accidentally leak information (to their own profiling services or third parties), and if they trust them on this, why not trust them in general when it comes to "we won't use your information for anything nefarious". Anti-Ad/Tracking-Plugins being among the most popular suggests that a lot of Mozilla's users don't want to rely on trust.

My bank argues the same way and uses Google Analytics to track their visitors, including inside the online banking system. Fine, so they trust Google to honor agreements and not connect profiles, but I'd still prefer Google to simply not know when and how often I'm logging in to check my account balance.

It's good that Mozilla goes the extra mile to get a custom contract, but I believe that most people aren't expecting a self-proclaimed privacy champion to use an anti-privacy-service by one of the largest corporate enemies of privacy. Explicit opt-in would be the right thing to do here.

Not only that, but Mozilla's Google opt-out is available to all GA customers, which is great for everyone.

It's not any good for users who don't have the choice to opt out.

If you personally want to opt out then use a content blocker? There's also an official way to completely opt out of GA, but this basically does the same thing.

Privacy isn't a zero sum game, there can be improvements.

What's the point? Why does Mozilla exist? If Google is good enough mozilla.org should redirect to google.com/chrome.

If Google is not going enough, Mozilla shouldn't use Google for analytics on the add-ons page when there are plenty of other options and an opportunity to do something valuable by building a site-private analytics product as part of their core mission of protecting the web.

Thanks for bringing that up. Im wondering why they went through all that trouble though. Are there no alternatives to GA?

According to the issues trackers, various forms of "self-hosting would be more work for a lesser product".

I'm not sure that would still be the case if the decision were being made today, and would quietly hope not, but I guess we can charitably say that the reason now is "inertia".

Personally, I think they may have underestimated (or failed to fully predict) the anti-google, pro-privacy sentiment in the wings, and it's clear even from this thread and the issues on bugzilla that it's probably cost them enough privacy-capital at this stage to have justified the extra work required to self-host.

But hindsight is 20-20. There are sunk costs now which also must play into the decisions.

Or just don't load any "analytics" scripts at all. Do you really need to know the aggregate mouse positions of every user on your addon page?

Definitely not, but I can see how it might be useful to know aggregates of the Firefox version and locale information for people visiting that particular page.

Sure, but you can do that with just your web server log.

> Personally, I think they may have underestimated (or failed to fully predict) the anti-google, pro-privacy sentiment in the wings, and it's clear even from this thread and the issues on bugzilla that it's probably cost them enough privacy-capital at this stage to have justified the extra work required to self-host.

Or maybe the "anti-google, pro-privacy sentiment" isn't really all that big. Could be a relatively small but vocal set of people.

> self-hosting would be more work for a lesser product".

The same argument applies to the whole of Firefox. It's more work and it's a lesser product. If Firefox can be a better product, than Mozilla Analytics could be too.

At this point it's clear that Mozilla is a business (with well paid management and staff) like Google that is using Privacy as a promo like Google used Don't Be Evil. Mozilla might be better in practice today, but it's not on a principled foundation. It looks like a Google Lite - Firefox vs Chrome, Rust vs Go, etc.

>Are there no alternatives to GA?

There is Matomo (formerly Piwik): https://matomo.org/

We use this one, paid version. Sometimes it's a slower load, the UI is less good than GA, other little issues but we still get the core data, and can trap page-level-events.

> legal contract with Google that prevents them

This misrepresents the ability of a contract.

No law can prevent a thing, no written agreement can prevent cheating. Law can only set out that such cheating might be illegal in the sense that it can be argued in court that penalties should apply.

I do see the point that you are making, and clearly prevents is not absolutely true, but the beauty of open companies like Mozilla is that this information is available at all. In an issue tracker no less.

We can be a little more charitable in not demanding legalese from someone who was casually paraphrasing somebody else, given the context (a bug report).

Mozilla is open? Which manager signed off on the Pocket implementation? Where are the minutes for the meetings in which that was agreed?

Mozilla make open source, they're not open like a publicly accountable body, are they?

Sorry, ironically I didn't mean to imply openness in any legal sense (although the foundation itself is publicly accountable in terms of what they spend their money on).

Open companies was probably a bad term to use because it might imply something beyond most/all(?) of their products being developed in the open, but I think the point stands well enough regardless.

I won't edit now, but please read my original "open" as "open source".

>No law can prevent a thing, no written agreement can prevent cheating. Law can only set out that such cheating might be illegal in the sense that it can be argued in court that penalties should apply.

This is asinine stuff. Contract law is one of the oldest parts of the legal system and contracts are protected. Violating contract terms leads to a discussion of damages. It's not about illegal contracts, it's about liability and damages.

No one before you was talking about "illegal contracts". You misread what you replied to. Contracts don't prevent things. Contracts determine (sometimes indefinite, but not infinite) prices for actions.

If you trust Google to always uphold its contract, than by the same logic you should trust the government to never abuse your encryption keys. But we don't, because insider access is (eventually) outsider access. Bits don't have color.

And I'm explicitly rejecting the theoretical discussion of "contracts not preventing things", a somewhat useful model of legal thinking for first year law students to understand one aspect, but an absolutely atrocious model for a layperson to understand general contract law.

This is like saying criminal law doesn't prevent crime, which again under some literalist and pointless definition sure a murderer isn't physically prevented from murder by a law, but the punishment of murderers does prevent many people from becoming murderers.

Similarly, contract law influences the behavior of people who agree to them by establishing damages and liabilities for various situations, and these incentives influence and control normal actors in predictable ways. A summary of the influences and controls on normal actors in contract negotiation could be "contracts prevent things".

My contract with my ISP prevents me from reselling my bandwidth to my neighbors. It doesn't physically prevent me, but it establishes a liability for me that I want to avoid.

My contract with my car insurance company prevents me from working for Uber. It doesn't physically prevent me from clicking Sign Up in the Uber app, but it establishes limits on my coverage such that I would be driving illegally if I were to continue, and I want to avoid that, so the contract prevents me from doing it.

Unless they believe they can get away with it.

Let's not be naive. The Big Brother agenda of Google didn't happen in a vacuum. They have government support and protection from some factions of our intelligence agencies to this day (although, perhaps not for much longer). The whole original concept of "Google" as a search engine (and tracking app) was originally a program of DARPA (same for Facebook - originally called "LifeLog"). Do you really think they cut all ties with the government when they went public? Neither Google or Facebook are what they appear to be.

"Privacy" in the sense that it pertains to selling your info to advertisers is just a sideshow; i.e. not the real problem.

> Violating contract terms leads to a discussion of damages.

No, being found in a court of law to have done so does, but when the contract terms are easy to violate without the other party being aware it is especially inaccurate to portray this as the violation itself leading to this result.

Thank God that Google is such trustworthy company on which we can depend with all our data and personal information. The company that would never deal with likes of China. The company which would never expose data of Google+ customers. The company which is always transparent with its policies and usage of user provided data.

> The company that would never deal with likes of China.

This is disingenuous. They basically locked themselves out of China voluntarily many years ago. They're really scary otherwise and I agree with you, but don't lessen your point by including exaggerations, in my opinion.

Expletive deleted. Project Dragonfly.

https://en.wikipedia.org/wiki/Dragonfly_(search_engine)

> Part of their (written) agreement with Google is that none of the analytics data generated from Mozilla properties will contribute towards Google's tracking database.

Do they really think people are that naive?

According to Hanlon's razor, the second choice is redundant.

Thanks for investigating. For comparison, I'd suggest trying something older --- perhaps IE6, Firefox 3.x, and Opera 9.x? For something newer, Dillo and NetSurf might make good contrasts too; I believe they don't make any network requests and just sit there with a blank window and the cursor focused on the address bar, which is IMHO the way a browser should behave the first --- or any --- time you run it. No further adverts or other attempts to get "promotional" material in your face, just a program that waits for and goes to whatever URL you choose.

(I really hate the "first-run experience" of a lot of "modern" apps these days. I don't need to be told "thanks for using our product" or anything similar, I'm already using your product --- just shut up and let me use it!)

Do Ungoogled Chrome next: https://github.com/Eloston/ungoogled-chromium

And if it's relevant Tor Browser

He's not going to do that because https://news.ycombinator.com/item?id=20806265, and it wouldn't fit his agenda. tl;dr: he works for Brave, has two personal Twitter accounts, both browser-related, yet posts these reviews from the account which magically has zero mentions of him being on Brave's payroll! The level of propaganda is simply unbelievable!

tinfoilhat.gif

sleep $((5 * 24 * 60 * 60)) && chromium-review > /dev/null

Chromium vs Chrome would be really interesting.

Yeah, supposedly some but not all of the calling-home is only added in Chrome, not in chromium. I would also be curious to see just how google vanilla Chromium is.

Of course there's ungoogled-chromium, but I had some issues building that recently.

How about links?

http://links.twibright.com/ http://www.jikos.cz/~mikulas/links/

What happens when there is no internet connection on first launch?

What if there is no DNS?

Does the program keep trying on every launch?

Does the program have hard-coded IP addresses or an internal DNS client?

Interesting how one of the main selling points of Brave, the slightly-shady crypto currency thing, is not initialized on first start (unless it's hidden deep inside some JSON or done using a different kind of network protocol).

I suppose this is because they put it behind another layer of privacy agreements and terms of service. This is an improvement from the last time I tried it. They also added confirmation that a website is actually open to receiving tokens now, that's nice as well.

If Brave wasn't Chrome-based, I would've tried it. Sadly, the world seems to be converging on Google's One True Browser Engine and I don't want to support that.

You shouldn't see communication with ledger services until you opt-in to Brave Rewards. I did this last night, and monitored network activity. We run a tight ship

Do you plan on running a series on update cycles and what each browser does when it phones home to check for patches/updates?

I could. Those bits are fairly simple though. Often a small payload is sent to a server containing the version of the browser (and often the OS). The server responds with a link to download the newer bits (if necessary). A couple of the threads I shared touch on this briefly. The only difference, if I recall correctly, was that some of the browsers would check for updates to the updater too.

Why no Safari?

Proximity, mostly. I'm a Windows user. That said, I am planning on setting up a proxy connection to test Safari on my MacBook.

Isn't there a Safari for Windows? I remember ending up with it after installing iTunes a few years back.

Discontinued after May 9, 2012.

It's no longer supported, and the last released version is so old it's likely unsafe.

Here's the review of Safari: https://twitter.com/jonathansampson/status/11664627007943884...

Thank you!

here's plain (in a good way:) webkit: https://surf.suckless.org

First launch: 0 bytes.

The note at the top of surf's page about the lack of tabs is missing some context, surf is composable, so if you want tabs, it comes with a script to use tabbed. Each window (or tab) runs in it's own process (skipping some details). It's also easy to enable/disable JS (per process) out of the box with it's keybindings.

Manpage: http://dpaste.com/1R3Q242.txt

I tried to use suckless software at some point but stopped in the end. In theory the idea is good, but sadly the software is not up to par. For a lightweight WebKit browser with minimal UI and vim mode included I’d recommend QuteBrowser https://qutebrowser.org/

Qute's realy nice. I should try it again just for the py-ness. Using Gentoo's -9999 ebuilds for dmenu and surf, both are solid and maintained.

Is there any way to easy run webkit on Windows?

I wouldn't say easy, but definitely possible to run the official nightly build.

https://news.ycombinator.com/item?id=20708905

I'm guessing because it's damned hard to run.

You have to have Apple hardware to run Safari.

Or a virtual machine

That, too, is hard without Apple hardware. KVM is probably the only virtual machine software that runs macOS with minimal fuss and patching outside of Apple hardware and it still requires a fair bit of work (though scripts exist to automate all of it.)

Many guides to creating Hackintosh setups hinge on having at least one existing Mac. The only saving grace for KVM is that people have developed tools to download macOS directly from the Mac App Store CDN and deal with the DMG image.

Thanks, these are the scripts I was thinking of. They’re really great.

I run VMWare for cross-platform development and I can tell you I have no problems running Apple OS'es since Mountain Lion 10 years. I have around 20 VM's with different MacOS'es that I use/used for testing/development. No Apple hardware at all, only my good old custom PC that houses all of them

Ah, I also have used VMware Workstation to run macOS, although my Workstation 15 license has mostly collected dust thanks to KVM.

Since you’ve been doing this for a while, perhaps you’ve simply forgotten that running macOS natively on VMware outside macOS actually requires patching? Granted, there is a tool[1] for this that is pretty popular and easy to use. But it’s still required when running without hacks.

Finally, where are you getting your installation media? Apple only allows downloads of macOS installation media via the Mac App Store.

I suspect you may possibly be referring to using pre-configured Hackintosh VMs that use EFI emulation and FakeSMC instead of running natively. Frankly, I just don’t trust OS images from random sketchy third parties.

[1]: https://github.com/DrDonk/unlocker

Actually I got an official Mountain Lion image from Apple way back 10 years ago, and ever since a new MacOS was out, I just copied my latest VM and run that one as a complete update. Couple hours later I was having their latest OS in new VM. So all my VM's have official Apple software, no 3rd party included. And yes, you are right, every time a new update for apps I use appear on store, I get hit with the message to update what I have. I simply just cancel and go on with my work. XCode is the most updated, I get hit with messages for it at least several times per week.

Oh, I see. Unfortunately I think it’s not as easy to bootstrap anymore. Having an existing Hackintosh VM obviously is a useful starting point, but getting one today is probably not super easy. So I can sympathize with folks who are having trouble.

AFAIK, MacOS licensing requires running on Apple hardware.

Notice that you'll find cloud providers offering Linux and Windows, but almost never MacOS virtual machines.

Thanks for the indepth information! Very interesting to see what is going on.

This was very interesting, thanks for posting your findings!

And to read the above a bit easier:

Google Chrome https://threadreaderapp.com/jonathansampson/status/116549320...

Microsoft Edge (Chromium) Beta https://threadreaderapp.com/jonathansampson/status/116613869...

Opera https://threadreaderapp.com/jonathansampson/status/116535321...

Vivaldi (Same thread as Opera) https://threadreaderapp.com/jonathansampson/status/116535815...

Dissenter https://threadreaderapp.com/jonathansampson/status/116537706...

Brave https://threadreaderapp.com/jonathansampson/status/116539121...

Mozilla Firefox https://threadreaderapp.com/jonathansampson/status/116585889...

If someone needs a version without ads or fake news promotion (Disclaimer: I'm a Threader co-founder)

Google Chrome: https://threader.app/thread/1165493206441779200

Microsoft Edge: https://threader.app/thread/1166138692509065218

Opera: https://threader.app/thread/1165353213308129281

Vivaldi (Same thread as Opera): https://threader.app/thread/1165353213308129281

Dissenter https://threader.app/thread/1165377063932637184

Brave https://threader.app/thread/1165391211999518720

Mozilla https://threader.app/thread/1165858896176660480

I didn't realise there was a competitor.

I wasn't promoting one over the other - just unaware alternatives existed.

Also didn't know it had ads, because all ads are blocked in my browser.

Last time I checked ThreadReader is an indie app developed by one or two developers. I've had no issues with them in the past.

The truth is, this service was acquired last year by a US company. They didn't mention it or share the news with their users and they keep marketing themselves as "indie developers", including on their patreon https://www.patreon.com/ThreadReaderApp. In addition to that the original creator left, he is not working on the product anymore.

With ads between the tweets? BS

I use an adblocker and support the developer of ThreadReader. So I don't see the ads.

> I use an adblocker and support the developer of ThreadReader

That sounds like a contradiction. If he uses ads it's so that his development gets supported this way.

View it in Brave ;)

I won't use this shady software.

How is Brave shady? Or are you just trolling?

I think that it's shady too. I don't know much about Brave and don't want to know. To me a huge red flag is that Brave tries to push its Basic Attention Token (BAT). BAT is a token of low quality because of the following reasons.

1. The developers try to make up a reason to create another coin for something, that doesn't need a coin; 2. The relationship between the browser and the coin is not cryptographically strong and will never be — it's impossible to prevent fraud when their system is just a program that checks for certain condition (an ad viewed) and communicates to its backend, instructing it to give some address a coin. 3. The developers created a billion of tokens out of thin air and now try to give it some value. And traders do believe that it has some value.

I personally don't tolerate shitcoins even the slightest. Thus, I see Brave as nothing, but a browser engine with a content filter and a shitcoin embedded.

I completely agree with all your points.

However, to me Brave is the least-worse browser because at least it has a step inside the territory of blockchain-based browsing. It's the first browser that will add an integrated wallet by default (mainstream will never accept using the weird developer-centric MetaMask extension).

I hoped at one point Brave would follow more of a patreon-like model - block ads on pages and give the site my money in exchange. Unfortunately they've gone for showing me different ads.

Brave does follow this patreon style model. There's a section in the Brave Rewards panel that mentions "Auto-contribute" which does what your describing.

You can also easily enable and disable Brave Ads while still contributing (though you'd need to fund your browser wallet)

Doesn't every single website have to opt in for this to receive any payment?

This is really hard to do because it involves a myriad of ad networks and payment systems. Others have tried to solve it but maybe Brave can? Dunno.

That'd be a really nice feature

It sounds like you have something against cryptocurrencies as a whole and not their tokenomics as to me it seems the reasons for creating your own token for this case is fairly clear.

Brave has a history of acting shady.

For a while they would take BAT "donations" for any website, and would just keep them unless the site owner signed up to receive them. This stopped a few months ago.

The whole monetization model of replacing a site's ads with their own is questionable.

The whole BAT thing seems like a scam, they offer ways to buy them but no way to sell them.

Really anything that uses a cryptocurrency for funding has that "con stink".

"The whole monetization model of replacing a site's ads with their own is questionable."

Just to be more concise, they are not exactly "replacing" ads on the site. The built-in adblocker remove all ads irrelevant of the sites and if you enable Brave Ads (the coin thing, opt in), you get up to 5 per hour (configurable) OS native notification. The notification contains a text ad with a link. Even if you don't click on the notification, you get the coin.

We are not replacing ads on any site right now, and we won't do it without the publisher as partner, getting 70% of the gross revenue.

You can sell BAT via any crypto exchange or website. Coinbase, Uphold, Binance, etc. You can even choose to have BAT automatically convert to USD, Euro, etc.

Probably the built-in cryptocurrency mining.

I think it's unfair to call it mining. You're simply able to be rewarded in their token if you allow ads. That is completely different from mining.

Brave and stunning.

“We value your privacy”

Always a good sign that they don’t.

Oh, but they do. The same way a group of muggers does when they stop you in a dark alley and say, "we value your money".

(Hell, they'll likely offer you an option to consent or proceed without consent to receive reduced experience.)

We value your privacy in much the same way fleas value dogs.

That's a nice analogy, can extend it a bit by offering a "reduced experience due to broken limbs"

Exactly:

"We value your privacy"

Click "Options" or whatever. Almost everything seems turned of (I guess it is an attempted dark pattern where they want me to believe it is off by default.)

Click "Third parties". See an somewhat complete list of shady "mainstream" tracker companies - or so I hope -there are literally hundreds of companies on that list, I counted by copying and pasting into a spreadsheet :-]

So much for valuing my privacy. Then again I guess it can be read to mean they value taking our privacy away.

"Your private information has value to us" would be a more honest wording.

They really do value it, though, at the price of the highest bidder.

Doesn't feel it's much different from original Twitter UI TBH.