that said I despised the UI redesigns and the recent FTP kill.. I want a broswer, not a fashion magazine
Also I can't for example leave Firefox alive while playong some games or it starts to create stutter in the games.
I tried profiling but the Firefox profiler just hangs all the time or uses so many resources it becomes unstable ironically
Ive been using Firefox since it was called Phoenix, and this is my biggest complaint. Stop hiding menu options, my monitor is bigger and you're suddenly trying to save real estate.
The only reason Firefox got as popular as it did is because technical people liked it, and they encouraged their non technical friends to use it. If you're going to dumb it down then technically inclined users will not feel as pationately about it.
I was personally responsible for hundreds, maybe thousands of people switching from ie to Firefox when I worked at the help desk of a small ISP. I don't think I would do the same now. It's still my main browser, but it feels like an abusive relationship.
Mozilla has a nice tool to help identify sources of "slowness and slugishness"[1], you may want to give it a try -- oftentimes it's found that the issue is not Firefox itself, but some extensions, external processes, or undesirable modifications in `about:config`.
---
I updated my user prefs file to permanently disable updates, so I'm remaining on pre-ProtonUI v88. Of course, I don't know how much longer I could sustain that because I'd also not receive security patches, but in the short term it's what I'm doing.
The new Firefox UI is incredibly frustrating, and feels like it walks back sensible UI principles. Removing icons in the main menu was celebrated as "de-cluttering" [0], when in reality icons improve ease of use. The "floating" tabs feel more distracting [1], when they claim the opposite. Heck, even user prompts no longer colorize the "primary action" button [2].
Also, what's with modern UIs becoming increasingly childish and watered down? The word I'd use to describe the new proton UI is "blurry".
[0] https://www.mozilla.org/media/img/firefox/releasenotes/note-... [1] https://www.mozilla.org/media/img/firefox/releasenotes/note-... [2] https://www.mozilla.org/media/img/firefox/releasenotes/note-...
It's arguably not the same as a sensible out-of-the box design, but far better than sticking to old versions just because of the UI.
2174 lines of CSS vs. 53 lines :-)
I don't overly care how every pixel looks or what the icon is and such; I just want my tabs to have some contrast.
Disable javascript and well... the site isn't usable any more for business transactions, but the slowness and CPU load vanishes. The website becomes snappy, highly responsive and easy to browse. The fans spin down and memory usage goes way down.
I've never used Chrome. Does chrome not ever get bogged down by javascript? Do they have a different javascript library/engine? I assume they must. Can you change the javascript libraries used by Firefox and Chrome? Apologies in advance if this is a dumb question.
Yes. This is pretty subjective as a user, but I'd classify Chrome as slightly better here. They're close enough that it doesn't usually matter unless you're playing JS based games or have a potato for a computer.
> Do they have a different javascript library/engine?
Yes, Chrome uses V8, Firefox uses SpiderMonkey
> Can you change the javascript libraries used by Firefox and Chrome?
No, not easily. It's all open source so technically you could with enough effort. But for example Chrome relies on some shared GC code between Blink and V8 [1]; I expect various feature needs like this would make swapping for SpiderMonkey infeasible.
IIRC Firefox uses their own engine called Spider Monkey. I don’t know of anything outside of Mozilla which uses it. I have a hard time imagining it being faster than V8, but I actually have no idea — will need to go look at some benchmarks.
For example, when you press ctrl+n, chrome instantly creates a new window, then spends the next second or so (depending how old your computer is) painting the UI. On Firefox though it seems like nothing is happening for an entire second, and then the window emerges fully painted. So even tho the total time is about the same, FF feels much less responsive due to this design choice.
I also noticed Firefox spent a much longer time (a fraction of a second, but perceptible, and multiply that by thousands of clicks a day) before it would even (apparently, again -- not sure whats going on inside) begin loading a page, which was frustrating.
I verified this was the case in the web inspector's network performance tab (there was an mysterious delay before the first network request).
All this to say, you might have an add-on delaying network requests to match them against a blacklist, save metadata or whatever the add-on is supposed to be doing.
Some non-Mozilla projects do embed SpiderMonkey, including Bloomberg (since 2001!), MongoDB, CouchDB, and 0 A.D.
https://discourse.mozilla.org/t/survey-where-are-you-embeddi...
There are a number of good options, but very few that don't further cement Google's control over the world's browser-engine code.
(Yes, I know there are some other very minor players that lag behind on features and standards support. I don't think that's what the parent commenter is looking for.)
They are of course highly relevant for their user bases, but in terms of "browsers that might break the Chrome hegemony through normal competition", there are none. You'd need to pull a Microsoft IE-on-Windows on Google and enact laws that forbid them from loading Chrome as default and only browser on all first and third devices associated with their brand. A few administrations ago, that might have still been a possibility, but it's not going to happen unless the EU does it first, and even then, the US might pull one of those idiotic "how dare the EU punish a US company for outcompeting everyone else" and instead enact reactionary laws that loosen the rules for them instead.
How about actually just making a good, competitive browser instead? Firefox is not failing because of Google's monopoly; it is failing because as a product it is unable to compete and beat Chrome where it matters. If not Mozilla, I am pretty sure somebody else will make such browser (and search engine, and email... ) eventually.
There is no "just". There is so very much no "just" anywhere near this topic.
>I want a browser that works, respects my privacy, stays out of my way and lets me get shit done. A browser built for professionals, by professionals. I want a consistent UI that remains stable over time. I'm easily willing to pay for such a browser.
>Firefox used to be it, but I no longer feel like it is. Any suggestions for what to try next?
That's my experience as well. I was using FF from v 1.0 back in 2004. Upgrade to Quantum almost gave me a heart attack because it ruined majority of addons and disabled custom themes. Upgrade to "megabar" was a final straw for me. I've spent ~ 3 hours, but finally migrated to Pale Moon ... and it's like I'm back in 2004. Even Noia theme is working again.
FF, in my opinion, went full circle: from being the most functional and the most customizable browser to being the new IE6. There are no redeeming qualities left really.
I’ve really enjoyed Brave as it is just a simple browser that works (and has lots of privacy features).
Of course, maybe it won’t work forever, but it works for now.
I’m not a crypto person and don’t use Brave’s crypto features, but I think it’s a more sustainable future than relying on Google’s largess.
That is just the browser part. The code on their servers that actually processes the data the browser collected is closed-source. In general, browser being open or closed source has no correlation with how privacy respecting it is. Chrom{e|ium} and Edge are another examples.
Pragmatically speaking there is only one thing that guarantees privacy and that is browser being zero-telemetry, regardless of if it is open source or not.
Of course, there’s nothing magical about open source that makes it more privacy respecting. It’s just that open source let’s me know what my browser is doing. For example, Chrome is reporting everything I do to Google. It’s possible to know that by looking at the code for Chrome. Brave doesn’t do this and it’s possible to know that by looking at the code for Brave.
That would be wrong. By Brave's own confession, there are 70 requests it sends "home" on startup [1]. Regardless of request payload, each of them contains your PII (IP address at the very least). There is plenty of opportunity for your data to be stored and used (not saying that it is).
If and how is that data actually used, we do not know, because this part is closed-source. When companies that are running advertising-based business models like Brave and Google are in question, this is the most important part users should be concerned with. Only way to settle this would be if the browser actually sent no requests anywhere, like you initially believed to be true. Indeed, a web browser has no business making requests anywhere without my explicit approval!
> It’s possible to know that by looking at the code for Chrome. Brave doesn’t do this and it’s possible to know that by looking at the code for Brave.
Do not want to be harsh but I assume you didn't actually look into the Brave's source code. You could have, but in reality very few actually do. Open-source "tag" on software can give this false sense of security because you rely on someone else to do the hard work and actually look through millions of lines of code.
The only way to actually trust a browser from a privacy standpoint is to check if it is indeed not transmitting any data. Instead of relying on source code, a much easier and foolproof way to check this is to use a network proxy, many are commonly available for all platforms. Then you can believe your own eyes vs marketing.
Disclaimer: I am in the business of creating a privacy respecting, zero-telemetry, browser. This topic is near and dear to my heart. More on this here [2] and here [3]
[1] https://brave.com/popular-browsers-first-run/
This is a weird assumption to make on HN. I have. I also didn’t say that viewing source code is the only part of understanding a browser’s security. It’s a useful portion. Network monitors are also good.
I’m not talking about startup telemetry, I mean browsing history and activity. Chrome reports this, Brave doesn’t.
I don’t think Brave is perfect, I just think it’s better than Chrome and Firefox.
Honestly, this is not what I expected from the "privacy respecting, zero-telemetry, browser" that you've been heralding here.
The Google Form alone is far more alarming than Brave's P3A (which is not connected to any Google Account, doesn't feed the data to a third-party, restricts user answers to category/range values, breaks up and temporally offsets delivery of feedback to prevent fingerprinting, etc.).
2) Perhaps you missed that we are in beta. You are opting-in your email in exchange for being invited to become a beta tester. You do not need to do that. And if you do, we are going to use your email only to send you the invite.
And the reason why there are so many questions in the form is that we want to deter as many people as we can, and get only the most determined beta testers. If somebody finds a 10 question form intimidating, their value to us as an active, contributing beta tester is likely to be small.
When we are out of beta you will be able to download the browser without submitting anything, and enjoy a zero-telemetry browser out of the box. Makes sense?
However we are OK to share it with die-hard fans who actually took the time to complete a non-trivial form, hence invite-only private beta. When we move to public beta, there will be no signup requirement.
> Bullish on macOS?
Yes we believe it is an OS and a platform with a bright future. Personally I enjoy it using a lot as a consumer, and I think it makes for a wonderful host platform for a new browser. Note that we also opted to use the WebKit rendering engine (fastest and most power efficient, at least on macOS) and built the rest of the browser from scratch.
"Confession" is a curious choice of words. You're correct that Brave issues requests on startup; this is necessary for a secure application. If your browser isn't updating its internal list of suspected-malicious domains and more, it isn't doing "security" properly.
> There is plenty of opportunity for your data to be stored and used (not saying that it is).
To what "data" are you referring? You cited my review of our (Brave) network activity, and that of many other browsers; which data/requests do you find to be worrisome?
A similar review was conducted in 2020 by Trinity College Dublin, which also found Brave to be the "most private" browser tested (even with these startup requests): https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf.
> …each of them [network requests] contains your PII (IP address at the very least).
An IP address is rather unavoidable. But whether or not an IP address constitutes PII is debatable—many users can (and do) share common IP addresses.
That said, we drop the IP address when and where possible. For example, usage requests are routed through a CDN which replaces the user's IP address with their inferred country.
Brave has no interest in trying to remotely monitor anybody's browsing habits; if we did, you (and/or those who actively monitor our project, looking for faults) would see clear signals in our network activity.
Instead, everything we do is designed from the outset to preclude this type of abuse. That's the case with our Privacy-Preserving Product Analytics (https://brave.com/p3a), our Private CDN (https://brave.com/brave-private-cdn/), and more. Brave isn't interested in your personal information; we have built a business model that doesn't rely on the harvesting of user data.
> The only way to actually trust a browser from a privacy standpoint is to check if it is indeed not transmitting any data.
This is a great point. Please review our network requests, and let me know which items give you concern. We're genuinely interested in your feedback.
> Disclaimer: I am in the business of creating a privacy respecting, zero-telemetry, browser. This topic is near and dear to my heart.
I'm curious how your product handles security; do you not maintain a client-side list of suspected-malicious domains (so that you can warn a user who might be stumbling into something harmful), or check for updates to patch zero-day vulnerabilities in the wild, etc.? Both of these (and more) require routine network requests if they are to offer any effective defense for the user.
"A privacy respecting browser has no business sending data on its own anywhere without the user being OK with it first."
This is true by the very definition of what privacy is.
If you want to check for updates - let the user initiate/opt-into automatic updates. If you want to update your malicious domain list (is that useful at all?) - let the user initiate/opt-into it. And so forth.
If you want to make these choices on the behalf of the user, and enable this and other things you do in those 70 requests you do on startup - that is of course fine. But you lose the right to call yourself a privacy-respecting product because Brave client just sent data to Brave servers without user knowing/consenting to it.
> which also found Brave to be the "most private" browser tested
A statement like "Brave is most private of the tested browsers" implies that privacy is somehow an analogue measure between 0 and 1, where Brave is for example 0.6 and Chrome is 0.4 or something.
But privacy is a binary measure, you (company/product) are either respecting privacy of the user or you are not. You can not respect it 'a little'. You look at your friends the same way - one has propensity to leak information and the other one doesn't. There is no category for friends who leak 'a little' information. Either they do or they don't. And frankly being called 'most private' in the company of those browsers is like saying a dog is 'most likely to fly' in the company of an elephant, dinosaur and a rhino. Be cool and be a bird to begin with.
> An IP address is rather unavoidable. But whether or not an IP address constitutes PII is debatable.
Kahm. IP address is rather avoidable - just do not send data without user's consent. It is that simple. We are doing it, so I know.
It is also not that much of a debate whether IP address is PII. It is.
Multiple court rulings such as State vs Reid [1], and Breyer vs Germany [2] as well as California CCPA act of 2018 [3] define IP address to be PII (w/ or w/o caveats) or at least a part of PII.
> That said, we drop the IP address when and where possible.
I never implied otherwise. What I did was to state the fact that Brave client sends data to Brave servers and that we can not tell for sure what is being done with this data because Brave's server code is closed-source.
Is this potentially a concern for the users? Yes. Can it be avoided? Yes - just become zero-telemetry by default. No need for discussion then.
A good relevant example is that Google advertises Chrome as a privacy respecting browser. Do you believe that based on what they say? Why not? Are there ways you could believe this? Yes, if no data ever left Chrome to Google servers without user explicitly allowing it first (by 'allowing it' I do not count accepting Terms&Conditions as those are never read by anyone and do not count as explicit/informed consent in this context).
> do you not maintain a client-side list of suspected-malicious domains
No we do not (could change in the future, in which case it will be opt-in of course). These lists in the current form are arbitrary, this hardly counts as security feature and there is very little chance the user will end up on a malicious website intentionally. Plus browsing the web is the responsibility of the user. The job of the browser is to stay out of your way, not make arbitrary decisions for you.
> check for updates to patch zero-day vulnerabilities in the wild
In Orion, user can check for updates manually or opt-in into automatic updates. So the feature is there. The key is however in "opting-in" because we want to have the right to call Orion a privacy respecting browser.
Orion does not even set a default search engine - otherwise the moment you start typing into address bar you would be leaking information (including IP address) to the search engine provider for suggestions.
To recap, Orion sends zero data to our servers or anywhere else for that matter (unless user first opts-in into it), on the first run, on any run or ever really. We call this "zero-telemetry by default" and we invite Brave to adopt this. Privacy is a serious matter, so let's treat it seriously.
[1] https://en.wikipedia.org/wiki/State_v._Reid
[2] http://curia.europa.eu/juris/document/document.jsf?text=&doc...
> "…you lose the right to call yourself a privacy-respecting product…"
I obviously disagree here. The problem is not _requests_, but rather the nature of the requests. You can certainly choose to not make any requests, but I feel doing so puts your users at considerably higher risk. I'd be curious how consistent you can be with this too; does your operating system and router also issue no requests on their own? Are users supposed to be capable of tracking security threats on those fronts too, as well as locate and install updates?
> "It is also not that much of a debate whether IP address is PII. It is."
It can be. I don't think this is a legal question, but rather an engineering one. You and I both know that this space is complicated by networks, NAT routers, and more.
> "Brave client sends data to Brave servers and that we can not tell for sure what is being done with this data"
What data? I understand that you have limited visibility into the server-side of things, but you can see clearly what data is being sent to Brave's services to begin with. What sorts of concerns do you have with what is being transmitted today?
> [Re: security lists] "Plus browsing the web is the responsibility of the user."
This is where we diverge even more. It sounds as though you're targeting super users who are very technical, and comfortable with monitoring threats, applying patches, etc. That expectation works for niche software, but not for software intended for _all users_. Brave absolutely should protect users from known threats. As we saw this past week, malicious ads on Google's search engine results were sending users to malware sites. Fortunately, we were able to get those URLs added to the SafeBrowsing service, and protect users of Brave, Chrome, Edge, and more.
> "Orion does not even set a default search engine - otherwise the moment you start typing into address bar you would be leaking information (including IP address) to the search engine provider for suggestions."
You don't have to perform live lookups. Brave doesn't send keystrokes for this very reason; users have to opt-in to that. Firefox defers sending keystrokes until 2 characters have been input. Most others just send the keystrokes (or pasted content) behind the scenes—not cool.
> "Privacy is a serious matter, so let's treat it seriously."
Expecting your users to opt-in to basic privacy features suggests privacy takes a backseat, IMHO. But then again, we may be targeting very different demographics with our software. It sounds like you're targeting power users who are okay with elevated risk. We're building Brave for everybody.
Thank you! If by power users you mean users who want to have their privacy on the web respected, then yes, we are building Orion for them.
> I obviously disagree here. The problem is not _requests_, but rather the nature of the requests.
But the problem _is_ requests, because each request at the very least carries IP, and IP is PII as ruled in multiple court rulings. I respect your decision to disagree with that, but that is the state of things.
> I don't think this is a legal question, but rather an engineering one.
There is no debate with court rulings.
It is also reasonable to assume that each court ruling involving this question involved dozens of engineers on both sides, probably more knowleadagable than you or me in this matter. And each ruling was made after careful consideration of evidence and with a lot at stake.
> It sounds like you're targeting power users who are okay with elevated risk.
I do not think you made a case that there is an elevated risk assigned with choosing to respect user's privacy in a browser. And if there is, and Brave has chosen not to respect user's privacy to include what it perceives as security features, I think you owe your users at least an explanation on your home page about that choice that you made for them.
Brave is a formidable competitor with devoted following and relevant and increasing market share. I enjoy the opportunity to discuss these important issues with you in a public forum.
Is that firefox or Google pulling a Shadow Dom v0 where they use an API only Chrome implements and fall back to software emulation on everything else?
(The few times I’ve had perf issues in Firefox were all either addons or sites designed to work only in chrome)
Not entirely, unfortunately.
I think this drives many people off Firefox. I am willing tinker with Firefox's internal CSS to tame some of the UI nonsense, but the rest of people just want a browser to get their work done; not to spend a couple hours every month to get rid of Firefox's new UI overhaul.
It is behaviour that has earned many recent one star reviews.
https://play.google.com/store/apps/details?id=com.android.ch...
2 column tabs sadly no more...
Why they think this is better UX is beyond me
I don't get it, why they force the grouping instead of making it optional. Without tweaking it's impossible to just open a link in another tab.
I'm in the same boat as you -- a Firefox user (and evangelist) from the beforetimes. But Firefox stopped meeting my needs when the revamp occurred.
I haven't really found a modern browser that is acceptable, though, but it's not for lack of looking. In the meantime, I stick with an older release of Waterfox.
At least on Linux it gets out of my way quite nicely. Things like easily accessible Profiles help me quite a lot with my workflow.
If you're really strict about privacy there are browsers like ungoogled-chromium, Bromite (Android) and Orion Browser (only on Mac, iOS) which promise 0 telemetry, connections against their services, etc. Brave is nice but has connections against their services (internal addon updates, safe browsing, updates).
I really miss Firefox but the memory leaks were just a deal breaker.
[1] https://www.mozilla.org/en-US/firefox/90.0/releasenotes/
My old uni laptop, an Intel T4400 with 4gb RAM.
Both chrome and Firefox have adblock.
Never ran in to a problem with Chrome, despite the wider internet calling it a memory hog.
Firefox struggled after 4/5 tabs, couldn't even playback video on YouTube or Vimeo reliably..
Don't run into these issues on desktop, and the Android version seems somewhat competent. But I've lost a lot of trust in Mozilla the last few years thanks to middle management.
Atleast with Google I know their motives and I'm not locked in to their platform relying on any particular proprietary thing they have.
My experience with Firefox over the last 2-3 years in particular leaves me very disappointed and frustrated.
The constant nonsense UI redesigns that come about with every new update. The instability, and ridiculous resources consumption. The slowness and slugishness.
I want a browser that works, respects my privacy, stays out of my way and lets me get shit done. A browser built for professionals, by professionals. I want a consistent UI that remains stable over time. I'm easily willing to pay for such a browser.
Firefox used to be it, but I no longer feel like it is. Any suggestions for what to try next?