Maybe it's because I use Brave (as a "Chrome with less Google" and with all the crypto stuff disabled), but when I look at the "shady things" they've done, it doesn't look that shady:

- The affiliate link "hijacking" was - if I remember correctly - to sites of crypto companies that partner with them. I'd prefer if this didn't happen, but most seem to be fine when other browsers (Safari, Firefox, etc) add something like "?client=safari" when searching or when their search engine (eg: DDG) use affiliate links to sites like Amazon or Ebay. It's not a new thing.

- The money collection (brave rewards)... if one doesn't understand how the system works, it looks like they are stealing money... but the money is returned to the sender after a while if the website/creator doesn't claim it. Is this that bad?

And then there's them not blocking some trackers (Google, Facebook, etc) by default, but if they did, they would break logins on many websites.

Maybe all this is bad, but I'm not sure if there's any browser out there without a history of shady behaviour. Even Mozilla has messed up a few times.

>The money collection (brave rewards)... if one doesn't understand how the system works, it looks like they are stealing money... but the money is returned to the sender after a while if the website/creator doesn't claim it. Is this that bad?

I don't think anyone ever accused them of stealing that money, but yes, hijacking people's personal brands to collect money without their explicit knowledge is a bad thing.

Imagine if I saw the icon and gave "them" money via Brave instead of joining their Patreon or some other official channel that they explicitly set up. If they don't collect, then yes, I might get my money back - nothing was "stolen". But that was money I wanted to send to the content creator in that particular moment, and that creator will probably never see it. The creator got screwed out of money that otherwise would have gone to them.

Please see the second half of this response: https://news.ycombinator.com/item?id=31086397.

Imagine I presented you with $10 (from my own pocket), and asked you where it should be spent. You told me "Doc's Pub, over on 9th." So I walked over to Doc's Pub, but found them to be closed. So I waited outside for a few hours, just incase they opened up. I later went home and wrote down "try to spend $10 at Doc's tomorrow."

Brave staked users with BAT (from our token sale). Users could direct that BAT to the sites/properties of their choosing. The BAT then went into an omnibus settlement wallet (note: the BAT originated in one Brave wallet, and was sent to another Brave wallet).

There was no hijacking of brands, or anything of that nature. I would encourage you again to please visit the aforementioned link. In it I mention our blog post on the topic, which includes screenshots and more. I hope this helps!

>hijacking people's personal brands to collect money without their explicit knowledge is a bad thing.

Brave gave users BAT to tip content creators. They tipped it, if it wasn't claimed in 90d, Brave returned the BAT to the pool. There was no collecting money. It was Brave's promotional BAT and it never actually left Brave's possession unless claimed.

The issue was that it wasn't clear if the creator had or hadn't signed up. Which was fixed within 48h.

Maybe the problem is the way it used to work and not so much how it works right now? Things seem to have changed a bit.

At least for websites I have to manually click the Brave Rewards icon (wasn't prompted to do it on a new profile) and it shows if the site is verified or not:

- My personal website (verified): https://i.imgur.com/WZykI2U.png

- Google[.]com (unverified): https://i.imgur.com/89XvzIz.png

And if we hover over the "unverified creator" text, this is displayed: https://i.imgur.com/IfKQUME.png

I guess the right way to do this is to only allow tips/donations for websites already verified... still, if you're going to use Brave Rewards, you probably have an idea of how it works.

Maybe things are different for creators on platforms like YouTube? I don't know how it works. I couldn't find a way to make a direct contribution with Brave Rewards.

> And then there's them not blocking some trackers (Google, Facebook, etc) by default, but if they did, they would break logins on many websites.

Then what should they do? It sounds like they're between a rock and a hard place

Since they want to be a mainstream browser, allowing those by default (that's what they do now) is the way to go in my opinion. The option to block them is available for more advanced users.

This is only a "problem" for some because they think Brave is actually siding with those services, when in reality there's a good reason to not block them by default.

You wrote "link" which is an element in a page, but we never "hijacked" or rewrote any such URL-bearing element. (We do for De-AMP, now.) Please dont fall for such lies about us couched as "link hijacking".

https://news.ycombinator.com/item?id=31088549

This is the thing everyone always points to when they hand wave "a lot of other shady things" - not sure why folks generally like to FUD Brave. I was working there when this issue happened and it was a very big deal internally and was patched immediately. FWIW I got zero hint that this was some kind of shady thing someone would have been trying to sneak in.

Follow the money, there's serious money pitted against Brave.

Grassroots users should support it like the godsend it is.

People around here love to pile on Mozilla for every perceived slight or misstep but they rarely have any ideas on how Mozilla is supposed to fund itself.

Some of the ire is earned but I have yet to see how Mozilla is supposed to fund Firefox development without that google search bar.

For starters Mozilla could operate with a much smaller footprint, much less projects in parallel and less vanity projects. That would reduce the amount of money required by a lot, which is the big problem in the first place.

Developing a browser isn't easy and requires a few teams of developers, but in 2020 it spent 242 million dollars in software development costs, 137 million dollars in administrative costs and 37 million dollars in marketing and branding costs. I don't live in a lala land where I think you can develop a browser for free, but I think we can all agree that you don't need to spend this amount of money on it either. Are 100 developers enough? 200? How much does that cost? Do they all need San Francisco salaries to develop a good browser?

In terms of funding, they got 440 million dollars from royalties (what they get from setting default search engines on their browser) and 25 million dollars in subscription revenue (Pocket and VPN subscriptions type things - products they actually sell).

Now, can you develop a browser on 25 million dollars per year? Maybe it's cutting it short, but for sure there could be a strategy to invest more on this side of the equation to phase out the need to be Google's bitch in a more intentional way.

Source: https://assets.mozilla.net/annualreport/2020/mozilla-fdn-202...

> Are 100 developers enough? 200? How much does that cost?

100-200 developers probably roughly costs on the order of 25-50 million a year (assuming a made up number of 250k fully loaded cost with benefits and taxes, which might be lower or higher than their average, idk. This number seems almost too conservative to my gut). From this back of the envelope math, I don't think the royalties business is enough to support the development cost alone.

> Do they all need San Francisco salaries to develop a good browser?

If you don't want them to leave to work on safari or chrome, probably? This experiment was more or less tried by opera, right?

Brave gets away with a lot lower overhead by bascially piggybacking off chrome. Opera similarly gave up selling their own browser engine and cut their development teams while switching to another wrapper on blink. Firefox could become yet another skinning of blink and chrome code, but it's not clear to me how that's helping them with being "Google's bitch in a more intentional way".

I think there are problems with Mozilla's side project expenditures, there is definitely some bloat, and they have had some expensive failures like Firefox phone. However I don't think Mozilla could have survived without Google's funding and people vastly underestimate how expensive quality software is.

>Brave gets away with a lot lower overhead by bascially piggybacking off chrome

Chromium get contributions from a few big companies, why couldn't Mozilla create a "contributor community group" something like Java has? Oracle keeps control over Java but there is a democratic process on what gets into Java/JDK. At some point Samsung was contributing to servo when it still was experimental.

> why couldn't Mozilla create a "contributor community group" something like Java has?

Mozilla regularly accepts code from unpaid community members and has since its inception.

>Mozilla regularly accepts code from unpaid community members and has since its inception.

Yes, so it Java and Google and Microsoft... you're still missing the point I made there. Make Servo a cross-company product serving more than just Firefox. More companies contribute to it, lower costs of development.

There's good developers living in regions where 50k is a really excellent salary. Even 100k. I agree with the parent poster that SF salaries are crazy for a product like this.

Even 100k salary is like 130k with benefits and taxes, so 200 developers takes out 26 million, above the subscription revenue without counting for any overhead like infrastructure, ops and administration. And below 100k, I think you will struggle to hire enough with the skills you need, browser dev is hairy and hard, and you are competing against an extremely well funded project in Chrome.

I don't doubt there are developers being paid peanuts with more talent than I will ever see, but I haven't seen them and I know a lot of people spending a lot of money looking, which suggests to me they are rare and hard to build a team out of.

And if they found them, and they fired all the senior bay area folks and rehired these 100k developers tomorrow, are those developers experienced writing fault tolerant c++ in a multi-decade codebase? And if so, how many will relocate or take remote jobs for way higher salaries after a couple years? Google, Amazon and Microsoft would be happy to have them and pay 300k+ TC for those skills, as well as countless banks and fintech firms.

I was considering 100k including everything :)

Here in Spain (which is a first-world country :) a good dev would make about 50k or so..

I think the Silicon Valley area has really skewed expectations of salary (and of course living expenses!). Familiarity with codebase is a problem indeed, but they could start setting up a hub somewhere in Europe.

I think part of the problem is that when they incorporated Mozilla they started thinking as a corporation. Multi-million-dollar-paid CEOs, top-heavy with marketing etc. They should have stayed nonprofit IMO.

> From this back of the envelope math, I don't think the royalties business is enough to support the development cost alone.

Did you mean subscription business? Like I mentioned, the royalties were 440 million which is way larger than 25-50. If you put 200 developers on this project, with fully loaded costs of 400k / year each, that's 80 million dollars per year. You add 20 million dollars for administrative and other expenses and we come to 100 million dollars per year burn rate.

In 2020 they made ~25M on subscriptions, if 50 of the 200 developers focus on improving the subscription business, at the current rate of growth they had from 2019-2020, in a few years they could totally phase out of needing royalties at all to cover their $100M / year expenses, with 200 developers earning competitive salaries.

Yes, sorry, I meant non-royalties business. I don't believe the kind of growth you mentioned is likely, but maybe I am missing things about their business. I think they bet big on diversifying with other initiatives like Firefox phone that just didn't hit, lots of browser things like you were talking about.

In 2013/2014 when Snowden started whiste-blowing we were hoping for Mozilla to monetize privacy, but they never did. They only recently made some very poor attempts at private email, VPN and integrated some DoH. They were very hesitant for any cryptocurrencies integration. I would be happy to pay for a serious VPN and email service (remember Mozilla owns Thuderbird) with promises like Tutanota or Proton have. They could have acquired them, but instead they acquired pocket. Mozilla had the perfect brand and enough userbase to do it. Mozilla started doing that work 5-7 years too late and did too little to be meaningful. I feel they are doomed now and their space is shrinking and there's no future for Firefox in the long term.

There's a lot that can be added here:

Mozilla promised to opensource pocket server and never did.

They promised to hire someone full-time for Thunderbird, but never did. afair there is a German company that has full-time developer working on Thuderbird.

They promised a VPN... yes, delivered something.

They promised anonymous email, I know they were giving access by invites, but nothing more about it.

They promised to unfork Tor browser and integrate Tor into Firefox, they were even running a few Tor nodes.

Remember how hyped everyone here was for Servo in Firefox and electron competitor?

MDN could have integration with GH or GL and educational content for web development, they literally had resources, brand and ability to join an online university and give degrees or at least serious bootcamps. Mozilla was a meaningful brand to do it.

They had a lot of opportunities to sell privacy, we literally demanded it from them, but they weren't interested in listening. Instead they delivered 6 rebrands each breaking my muscle memory.

Do you remember how they advised EU to regulate monopoly on the webbrowser market? There was time when they had all ability, but 0 will to keep it this way https://en.wikipedia.org/wiki/BrowserChoice.eu

on the other hand, colorways

wow this escalated so fucking fast i have no idea what happened

Not really, its just the epitome of blagging which is criminal!

By not spending the >$1 billion they've taken in over the last decade as fast as they got it. A billion+ is a ton of money in the open source world and had they been responsible stewards they would have been able to fund development for a very long time without short term funding concerns. The fact that they've pissed away every cent taken in is their problem.

> they rarely have any ideas on how Mozilla is supposed to fund itself

If we’re talking about the Mozilla foundation, they should seek donations and grants and focus on being the best user web tooling.

If we’re talking about the corp, they could’ve kept rust under the umbrella and pioneered the WASI runtime and built an alternative to k8s that runs webassemblies and built out a paid cloud infra.

It doesn’t make sense to have a foundation that is user aligned and a corp that is user hostile. There should be aligned incentives.

>how Mozilla is supposed to fund itself.

1. Stick to building a more private browser

2. Become a non-profit or Benefit Corp

3. Fund #1 through all of us donating and encouraging our less tech savvy connections to use it and donate

1. Why focus on privacy? The niche is already taken by brave 2. To do so, they'd have to drop their half-billion default search engine deals 3. Currently, the donation figure is about $20mil. They'd have to somehow additionally collect $1.5 from every single user annually to prevent layoffs.

> 2. To do so, they'd have to drop their half-billion default search engine deals

Yes, that is part of the reason why they should be a non-profit - sot that they can work for the public good and not for the good of their corporate sponsor.

> 3. Currently, the donation figure is about $20mil.

Donation figure for what? Currently you CANNOT donate towards Firefox development.

> Donation figure for what? Currently you CANNOT donate towards Firefox development.

To Mozilla foundation. Most people I heard donating to them don't realize their money aren't and couldn't be put into Firefox development.

It's not a small niche. It can be shared with Brave.

And Brave has things that not everyone likes like the bat token stuff. And chromium.

> 3. Fund #1 through all of us donating and encouraging our less tech savvy connections to use it and donate

They could also try to seek government funding. EU and other non-US countries should have an interest in there being a browser that is not beholden to a US for-profit corporation.

It'd be a nice start if they'd let me give them money for their product.

I say this every time it comes up. I would happily pay $5/month for a “platinum” branded Firefox browser if that $5 would go to support development costs. I’d love to have other people see it when I share my screen both inside and outside my organization.

Indeed.

And something like apple's iCloud relay. I would pay for that.

I won't pay for a Mullvad subscription that's less useful than actual Mullvad because it just works in the browser and it doesn't fix all the issues iCloud relay solves.

If they'd sell actual privacy features I'd pay for it totally. Sync too.

This has been done to death in other threads.. mozilla's raison d'etre today is as a lighting rod to prevent real competition to google. Follow the money, and why the mozilla ceo gets big bucks for performance that's against mozilla's public goals - they are instead meeting mozilla's private goals.

Your raising a discussion about mozilla in a brave thread plays right into mozilla's purpose of muddying the waters for actual competition against google. Please don't derail brave discussions with off topic stuff.

You can use the same reasoning for why Google is happy with "competition" from Chromium based browsers.

It would help if they didn't increase the board and leadership compensation and spend loads of money on social justice projects whilst at the same time cutting on development as their footprint on the browser market keeps shrinking.

Sure it's probably not going to make it but they're still not things they can sensibly afford to do.

Heads up: I work at Brave. As such, I encourage you to check my claims, verify my sources, and don't take anything I say for granted. Always happy to provide more context as needed :)

Firefox literally sends your keystrokes to Google, right out of the box. Brave, however, was found to be the most private popular browser by reputable researchers: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf.

Brave [never] hijacked links either. Affiliate Links were offered among suggested sites for relevant search input. So if you searched "Binance," the browser would offer (among other suggestions), an affiliate link for the site. Users could then choose to browse to the property with the affiliate link, and in so doing support the development of Brave. No impact to privacy or security at all.

The mistake here was with input handling. Built to handle search input, this feature also mistakenly handled fully-qualified domains. While we intended the app to offer affiliate links (when relevant) to something like "what is binance?", it was also offering them for "binance.us". The latter case was corrected quickly (and the feature itself was disabled out of the box).

More about that on our blog: https://brave.com/referral-codes-in-suggested-sites/.

To your second point, about setting up crypto wallets and soliciting donations on behalf of non-participating publishers, you're mistaken there as well.

To prime the support-system in Brave (called Brave Payments at the time), we staked Brave users with tokens, inviting them to direct those tokens to creators they would like to support. More clearly, Brave gave Brave users say over where Brave ought to direct its own tokens.

Unfortunately, our UI/UX wasn't very clear about which creators were verified, and which were not (we followed the Twitter approach, marking verified creators with a checkmark, but doing nothing for others). This resulted in some confusion at the end of 2018, where users were directing Brave's tokens to non-participating creators (most notably Tom Scott).

We received considerably helpful feedback about how the system could be improved (both from a UI/UX side, and operationally). Frankly, I don't think I've ever seen our team work so hard, and churn out such a monumental update in so little time. We had made massive changes within 48 hours IIRC. Creators were explicitly marked as verified or unverified in all cases, the BAT that Brave stakes with users would remain in the local wallet until it could be received by a verified creator. And BAT that sat pending for 90 days would be unlocked again for the user to direct elsewhere.

Tom Scott was kind enough to review our changes, and explicitly gave us his approval soon-thereafter. What is now 'Brave Rewards' wouldn't be doing so well today were it not for Tom and so many other incredible users helping us find the best path forward.

More about that on our blog: https://brave.com/rewards-update/

> Firefox literally sends your keystrokes to Google, right out of the box.

This is a touch of FUD. Firefox sends what you type into the search/address bar to google for search suggestions by default, yes. Your perhaps unintended implication here is that all keystrokes are being logged and sent to google.

> Brave, however, was found to be the most private popular browser by reputable researchers: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf.

This is a bit of a misstatement of the research; Rather they found that Brave doesn't tag users' installs with persistent IDs by default in startup telemetry or update requests, while most of the rest of the competition do. This means Brave has a superior initial privacy state but says nothing about the overall usage posture. Is it better? Possibly but that's not the conclusion the researchers actually came to.

Here's an example of why the first line of FUD is dangerous: "Brave's BAT is basically just a way for users to be tracked as they go about navigating the web."

This is an easy throw-away statement with little substance and likely little to no truth behind it.

A more concrete example might be that the so-called "Privacy Preserving Product Analytics API" that collects data on Brave users' installs gets enough data to pretty easily fingerprint a user if you wanted to. You don't need many data points to identify an individual from a large group.

Not that I'm downplaying your points, but please next time start a comment saying you're working for Brave ;)

Good point. On Twitter my name is "BraveSampson," and I often forget that isn't the case here as well. FWIW, I'm Sampson, and I work in Developer Relations at Brave. I have that in my bio here, to help a bit.

> On Twitter my name is "BraveSampson,"

It doesn't look like this is the case, fwiw. (Unless your HN profile lists an outdated handle?)

Nice catch! I was referring to https://twitter.com/BraveSampson/. Profile updated.

> Firefox literally sends your keystrokes to Google, right out of the box.

Keystrokes in the URL bar.

Yeah, I don't like that this is the default, but "Firefox literally sends your keystrokes to Google" could easily be interpreted by many people to mean all of your keystrokes (not just the ones typed in the URL bar).

It would have been better to say "by default Firefox literally sends every keystroke you type in the URL bar to Google".

In my opinion it is a user-hostile "feature", and should be pointed out, but not in way that could be so wildly misinterpreted.

> In my opinion it is a user-hostile "feature", and should be pointed out, but not in way that could be so wildly misinterpreted.

I agree. I don't like a lot of what Mozilla does but I don't like Brave at all, so I'll gladly defend Mozilla against hyperbole coming from Brave. Brave isn't even a browser, so I just ignore it most of the time.

Which is how instant search works, right?

Describing the cost without explaining the why is really putting a spin on things.

It can also be disabled in preferences if you don't like that functionality.

Keep an eye on it though because they periodically re-enable it for you. So helpful.

I appreciate this respectful, thorough, evidence-backed response to criticism that makes claims you dispute. It's so rare on HN and the wider world.

Mozilla faces blowback after slipping Mr Robot plugin into Firefox:

https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robo...