Your paranoia is warranted. Like i replied in another thread up, there are a couple thing you can do. Use multiple browser/profiles. Keep a separate profile or two with no extensions for banking, shopping, email and other important stuff. You can be install a couple addons in your 'general browsing' profile. In general install only 'recommended' and security-reviewed addons with firefox.
- An addon like vimium shouldn't need too many updates so auditing and disabling auto-updates might be worth it.
- Firefox has 'recommended' addons. In addition some of the more popular addons are security vetted (Their addon pages doesn't come with the scary "not reviewed" warning. These can be reasonably assumed to be safe.
- Also read my other reply to gp.
> These days I just use a small handful of extensions
Same here. Resisting fomo and temptations for new shiny is the hardest part but still worthwhile imo
>My understanding is that random extension is able to read and send somewhere almost all my data when I read my email, do online banking, etc.
Depends on the permissions requested by the extension but often yes. The permission "Can read all data on any webpage" means exactly that.
> Is there a way to use browser extensions safely?
Yes. Depending on your paranoia /security standards. Here's what you can do ( ordered by importance.)
1. Use more than one browser (but stay away from proprietary or less popular browsers) and/or use multiple profiles (both firefox and chrome has them)
2. Have separate profiles for banking, personal email, work and general browsing. (Also good for productivity)
3. Banking profile should have no extensions.
4. Use only mozilla-vetted 'recommended' and 'security reviewed' extensions in firefox for less important accounts. Check the permissions carefully and see if they're sane. I don't use extensions in chrome at all since google web store does no vetting at all beyond automated scanning. It's the wild west out there.
5. You can be less careful with general browsing profiles as long as you don't log into important accounts. Use firefox containers (this is more for privacy though than security)
6. If some addon is tempting but not reviewed - i try to review the code (if its small and readable enough). after vetting, i disable auto-updates. A greasemonkey script that does equivalent functionality is often preferable since the code is usually smaller and readable. Disable auto-update there too. Otherwise resist the temptation to install too many addons.
Chrome has controls to not allow an extension free reign on all sites despite it asking for them. Allow only on specified sites. it's not a default for some reason, but if the extension doesn't have access then it can't do anything, bad or good.
Of course it doesn't help that it's a finance site that disables paste for which I need an extension to reenable, but at least I'm not letting the rest of my extensions get at my banking web session.
So the current options are
1. don't use extensions - this limits comfort and productivity, and the entire purpose of extensions
2. use extensions but lose security (are you feeling lucky today? what about tomorrow?)
This seems so dumb.
Is this the best solution from google/mozilla/etc?
I am thinking that an option to disable all extensions on a particular site/tab could solve many issues, maybe even with default on for well known email and bank providers.
This would encourage ppl to install more extensions because they don't care what happens when they just read reddit.
It says "using HTML5 and web sockets."
Does this mean the application freezes if the connection to server is disrupted?
Could developers use this to make web-based apps along-side desktop clients? If so , Desktop frameworks like GTK and Qt should focus on this idea more to reclaim the desktop from the monstrosity that is Electron.
I'm not sure how this could reclaim the desktop from Electron. If anything, this gives Electron developers another option by running a local server in the app and rendering it in Electron.
F-Droid works like the Debian repos: F-Droid builds are not built by the developer, they are built by F-Droid volunteers from source. They don't accept pre-built applications.
Many moons ago, an acquaintance sold his app account ( with apps like battery saver apps etc ) to an Israeli company. As i recall, in that case, the acquisition was for data-harvesting purposes.
Containers are useful, but it's like having a few similar terminal windows open. Eventually you'll type something on the wrong window... at least I found myself searching for personal stuff on my work Google container.
With profiles I can have different bookmarks, extensions, and even a different theme so I'm aware I'm on my personal profile, not on a work profile. Since switching profiles on Firefox + macOS is a pain in the butt, I use 2 different Firefox channels (stable + dev).
Anyway, containers are nice, but they're not a replacement for profiles.
> Anyway, containers are nice, but they're not a replacement for profiles.
This, so much. Anytime I've brought up profiles on Firefox, I'm told about this alternative that isn't a replacement for the feature.
Safari is (finally) bringing this, so maybe the folks at FF will begin to see this as a feature worth investing in. First-class profiles support is one of the main reasons I stick to Chrome, despite trying to switch.
And then to use them you have to start firefox e.g. :
firefox -P <profile-name>
Very few casual users (nor even most technical users) start Firefox from a command line, and setting up shortcuts for these is also a step that most users won't do.
The support for profiles is there, it's just hard to use in the context of a GUI desktop.
That's part of the "problem" with Firefox's support of profiles. It feels more like an afterthought and less like a primary use case the product wants to surface. To approximate the functionality Chrome has, I had to bookmark "about:profiles" and make it my home page.
Chrome also added this nifty feature that lets you open links as a Profile, making it easy to switch.
These may seem like small issues, but the end up mattering.
If this isn't the straw that breaks the camel's back, there is never going to be one.
Google needs to be broken up.
They own the browser market.
They own the web (through Adwords).
They own Search.
They own mobile.
They own most of the video sharing market with 2.5 billion monthly annual users.
They own a good chunk of email with 1.2 billion monthly annual users.
They have amassed an incomprehensible amount of power and influence over humanity and they have proven repeatedly that they are willing to use that power to the detriment of humanity and to entrench themselves further.
To make it explicit: the only way this happens is by Americans voting for it. The FTC has been more active on anti-trust issues in the past two years than at any time in the past 30. That's a direct result of the 2020 election. Elections matter.
n.b. I've found a lot of comfort by conciously rolling away from any subject that leads me to do "They"-ing, i.e. name an enormously large group, then talk about them as a unit. The more I avoid it, the more I realize how prevalent it became and drives how a lot of us feel society shifted.
Citation? FTC against Google doesn't produce much results on Google (kind of an irony :))
Have seen FTC going against Amazon because the FTC chair had published prior work against Amazon's practices. Not defending Amazon but FB/Google are a much bigger threat than Amazon.
Citation for what, increased anti-trust activity from the FTC over the last two years? Sure, here's one article:
> Private equity deals and transactions in the healthcare and technology sectors continue to attract heightened antitrust scrutiny...
> The US agencies have also demonstrated an increased interest in challenging vertical transactions.
> In January 2022, for example, the FTC sued to block Lockheed Martin's US$4.4 billion proposed acquisition of Aerojet, which the parties subsequently abandoned.
> Increased enforcement, combined with the agencies' reluctance to approve remedies, has created an uncertain environment where commercial parties should be increasingly prepared to litigate mergers.
> The ramping up of antitrust enforcement in 2022...
> Since 2020, the Federal Trade Commission (FTC) and U.S. Department of Justice (DOJ) have filed multiple lawsuits against major tech companies...
> "The agencies have started laying the foundations for a more interventionist stance over the last two years, and this year is when we'll start to see some of those efforts come to fruition -- or be stopped in their tracks by the courts," Kass said.
And I think the biggest blow may actually come about because of the SEC lawsuit that will be heard this upcoming term at SCOTUS: https://www.reuters.com/legal/us-supreme-court-decide-legali..., which will likely heavily reign in the power of administrator judges and the ability for an agency to keep initial fights in-house (blocking litigants from taking fights to the normal courts).
Yeah. You can't expect every swing to be a home run, but you also miss every swing you don't take. My point is at least they're trying to do something now, unlike previous decades. It will take some time and effort to bring the agency back around to being effective after decades of inactivity. That's not going to happen if future administrations put the FTC back on the bench.
How much of that involves the tech industry? Are you seriously claiming that Silicon Valley and Donald Trump were besties while the Democrats and tech hate each other?
A lot. Here's a link where you can read about some recent activity in the tech industry (change it to sort by Date, I couldn't figure out how to do that in the URL): https://arstechnica.com/search/?ie=UTF-8&q=ftc You can probably find more on Google (or perhaps Duck Duck Go? :) ).
>The FTC has been more active on anti-trust issues in the past two years than at any time in the past 30.... That's a direct result of the 2020 election.
Active against Google though? Remember, Google can help a certain political party in tough times (e.g. rollout of healthcare.gov).
Yes, but Google has a strong existing relationship, the D party owes them for that one and some other favours. Can you find a link for any recent FTC action against Google (not against Google's competitors or some tiny subsidiary of Google)? I hope I'm wrong here.
I don't see anything significant from the FTC specifically regarding Google, but there is an ongoing DOJ lawsuit. Possibly they don't want to step on that? I admit I don't really understand the roles of the DOJ versus the FTC regarding anti-trust enforcement. https://www.justice.gov/opa/pr/justice-department-sues-googl...
Wake me up with they actually do something instead of making announcements of looking into the possibility of perhaps one day sending a strongly worded letter asking their tech buddies to calm down a little bit, if they're so inclined. Until then, this is campaign fodder and nothing else.
"The Federal Trade Commission sued Amazon today, claiming the online giant violated US law by tricking consumers into signing up for the $14.99-per-month Amazon Prime subscription service and making it annoyingly difficult to cancel."
"Microsoft will pay $20 million to settle an FTC complaint that its Xbox platform illegally collected and retained information about children without their parents' consent"
Why should the US break up an asset like Google? Would be completely self defeating. This isn't like standard oil or at&t, that mostly had influence and market share inside the US. It would basically be handing power to foreign competitors who would pounce at the opportunity
And I'm not American so it's not even some sort of patriotic comment. If Europe , or anywhere else, had a Google sized Behemoth, they wouldn't mess with it no matter how "anti tech" they might seem now. If anything they are anti tech because they don't want foreign big tech to have massive influence over them. You'd bet they wouldn't cripple big tech if they were European. On the other hand, as long as they are American that massive power is a feature, not a bug for the US government.
The reaction to Tiktok is a good example of how nationalism/geopolitics shape the reaction to big tech, which is why google is probably safe.
> Why should the US break up an asset like Google? Would be completely self defeating.
Because in the short term it would disrupt a major company (ala Standard Oil), but in the long term it would allow the US to remain competitive in the global market.
If we allow Google to continue abusing its monopoly power in the US, that guarantees that the US will not be the home of the future technologies of the world. Innovations will be sucked up and killed as acquisitions. Enormous energy will be focused on blatant moat-building like WEI instead of developments that benefit the world. etc.
> Why should the US break up an asset like Google?
I'm also European and I think almost pretty much 100% as you think on this, but to play devil's advocate, and how I think this should have worked in theory in a free-market economy, is that the US, by allowing companies like Google to do their nefarious and frankly evil things right now and in the near future is also, at the same time, not allowing future potential companies, more innovative than Google is now, to take Google's place.
But what happens is that the US is focusing on having a strong and national security-enhancing company (Google) on its side now and in the near future, versus having an even stronger and, potentially, even more national-security enhancing company (the one that would have taken Google's place had the free market been allowed to do its thing) in the medium to long future.
On the face of it this compromise of security now and in the near future vs security in the medium to long future looks like a decent bet, the problem is that evil colossuses like Google are actively getting rotten from the inside, and at some point in the medium to long future they'll fall almost in an instant, with no company to take their place. That will leave the US highly vulnerable at that point in the future.
But anti-trust stalled Microsoft's efforts at a critical time and allowed Firefox and Safari (like Gecko) to restore a standards-based web from an IE-based web. It's not a cure all but it worked. IE had 95% marketshare in 2002 and Firefox took a third of that from them in a few years thanks to anti-trust and the consent decree it forced on MS.
Chrome has nowhere near 95% market share so it would be hard to make the same case against them.
Given that it's open-source and anyone can roll and distribute a tweaked version of Chromium (and many have, notably Microsoft), it's really hard to see an argument here that Google is acting anti-competitively. If anything it's very pro-competitive to give away your secret sauce to your competitors.
Just because their browser is more popular than you would like, and you don't like a feature they're adding, doesn't mean a judge is going to stop them from adding it.
In which case foreign governments, the EU and the like who collectively represent the interests of the other 7+ billion people, should start levying taxes, penalties and fines on Google and haul it and the US in front of international agencies like the WTO for unfair trade practices.
That would be a desirable action but look what happen in the end of 90s to Microsoft. It was about to be broken up and in the very end it didn't. They become dormant and polite only to strike back some 10 years ago with Windows 10, its telemetry, ads and cloud services which are being pushed onto users whether they like or not. And somehow, no regulators decided to step in to clean up this company's behavior - everyone seems to be ok with what MS is doing. Whether it's the US or EU. I take that the business and lobbing goes extremely well in both markets.
And because of this, I don't believe that the US is able to break Google or the other flagship companies despite of reasons existing for such action.
Not going to happen. Rationally there should be broad political consensus about cutting Google back to size: from rabid libertarians worshiping the miraculous abundance generated by "competition and free markets" to bleeding-heart socialists keen on pushing back corporate power as the root of all evil.
Alas, these political categories no longer have any meaning. The US political system has mutated into something else (the messenger being a horned man) which will probably require some time to properly characterize and name using terminology that is appropriate to use in good company.
So the fate of Google will be more shaped by actions of external entities than as part of US regulatory efforts. Powerful countries that antagonize the US are simply degoogling and creating their own copycat panopticons.
The question is what will be the course of action of powerful countries that are alies of the US (i.e. Europe and a few others). Will they accept that their digital society will be feudal in nature because the broken US political system cannot deliver on even basic responsibilities?
> Will they accept that their digital society will be feudal in nature because the broken US political system cannot deliver on even basic responsibilities?
The Germans, British, Australians and French are also attempting to build their own panopticons.
I think they're alluding to Waymo. I feel much better about Google tracking my taxi rides than I do with Uber, Lyft, random taxi company, my cell phone company, etc.
If this proposal becomes standard in Chrome, You can be sure Microsoft and Apple will follow Google's lead with the same or their own similar implementations.
See Microsoft Pluton and Apple's Private Access Tokens. Or read this article which provides an excellent overview of these developments. https://news.ycombinator.com/item?id=32282305
Make no mistake. If this becomes standard on Chrome, this is going to be standard on the web.
I didn’t specifically try to De-Googlefy my life for some moral reason. I think most of Google’s products are second rate - including their search page unless you use an Ad blocker. But I do find myself using ChatGPT more and Google less for coding questions since it does a better job of giving me exact answers to my problems and code is easy to verify for correctness.
As far as YouTube, I think I only use it for AWS ReInvent videos. I can’t stand ads and there are no ads interrupting the video.
My former business bank actually did this. They insisted their web app "was compatible with all modern browsers, but more compatible with Chrome" - I couldn't make transfers to other accounts with Firefox, it just hung indefinitely.
> was compatible with all modern browsers, but more compatible with Chrome
Is Animal Farm not required reading in Orwell's home country? Or was that a misquote, or maybe just something from a random support worker? It's almost too on the nose for that statement to be written by someone familiar with that book.
I was wondering the exact same thing with that wording. Maybe someone, somewhere was required to put in a notice like that (or worse, make it so that it does work better in Chrome for whatever reason) and decided to word it like that to fly under the radar. Unlikely, but I like that imaginary world.
PrivacyPass is an extension that lets you pre-solve CloudFlare CAPTCHAs if you're on a VPN. However, that was too frustrating, so CloudFlare partnered with Apple to integrate PrivacyPass into Safari.
How did they do this? Simple: iOS provides cryptographic attestation that your browser isn't a bot and isn't hacked, and CloudFlare takes that as your CAPTCHA solution. This works exactly the same way that Google proposes Web Environment Integrity work.
I don't have a Google account and don't use any Google service, still think that this libertarian message is bullshit, how do you do the free will if the web starts deciding which OS/Browser are authorised to do something? I am not sure we are talking about free will or useful idiots
I think it’s kind of naive to think a company that gets 80% of its funding from Google is going to go out of its way to protect you from the same company or that it won’t implement the same proposed DRM standard when it already implemented the older one.
But if firefox is full of tech to prevent privacy leaks? They incorporated a vpn, strict mode, containers, third party cookie block, dnt, etc.. what the fucking hell are you talking about?
Google broke itself up in 2015. What are you even asking for here?
Chrome and Android are open source, and there are several forks of both thriving in the ecosystem. Yeah it would be cool if there was a decent open source alternative to GMail and Drive, but no one else seems to have figured out how to get the incentives right for something like that.
Google broke itself up in 2015. What are you even asking for here?
No, it didn't, it restructured itself into Alphabet, with many subsidiaries. But, all the core businesses are still under that umbrella organization, with most web-related businesses remaining inside the current Google entity.
A forced divestment of the browser business might help. Same for the productivity products.
I don't think you understand what a business is. Google pays Firefox a lot of money to be the default search which means there is a lot of money in browsers. Google Search conceptually pays Google Chrome to be the default Search engine on Chrome. Except since they're both under the same company they will never take an outside offer which is why it's a monopoly. No different from any other vertically integrated company.
Sure, but on the positive side, the Chrome Company has its own incentives.
Today, Google can provide Chrome as a loss-leader, making up for the "free" browser with ad revenue.
The new Chrome Company can't operate that way. It needs to make money on its own. Perhaps MS Bing offers more money. Or they build their own ad system. Or pivot into some other business area.
Anyway, I don't think anybody is arguing Google/Alphabet must be broken up, only that it's a tool that's available in the US, should we (society) decide other regulation is insufficient.
And we still are being tracked by BigTech with the same business model that people object when Google does it.
> Or pivot into some other business area.
And what other method do you suggest for funding besides ads or people paying for the browser? The second option has never been a long term successful business for browsers?
> No one has paid for a browser in almost 3 decades and even then few did.
Considering NCSA Mosaic’s initial release was just 30 years ago this year and it’s considered the first browser, think you might be using a bit of hyperbole there? Twenty years would’ve been more accurate.
As someone who worked in this space at the time (Webmaster at Spry, Inc. in 1994), and we sold a web browser in the 1994-ish timeframe https://en.wikipedia.org/wiki/IBox, no, saying "almost 3 decades" isn't hyperbolic at all. 29 years is close enough.
MSIE was free, 28 years ago in late 1995, and while Netscape did take 5 years to follow suit, by 1998 Netscape was not in a healthy position because of the free competition.
But what does breaking up even mean? Separate companies, each publicly traded with their own C level staff, shareholders, etc?
Because to me it just feels like it might be legally separated, but still owned and directed by the same handful of people. And it being separated makes it safer, in that they can't forward e.g. large fines to the parent company.
Disclaimer: I don't know anything about large corporations. or economy. or governments.
Yes, breaking up a company means divesting some business units. The new businesses would have their own BoD, leadership, shareholders, etc.
The US did this with Standard Oil in 1911, Bell/AT&T in 1983. And the same laws were used against Microsoft in 2001, though the company was able to avoid a break-up.
Breaking up Google might not be the best option. Perhaps more rigorous regulation by the government would be better, similar to Microsoft. But a break up should be an option.
It's not the lack of open source, it's ease of use. Alternatives exist, but no company is going to run a charity case for you to store tons of data for free. Mail in particular is commonly known to be a hassle which has nothing to do with Gmail the software, as much as Gmail the provider.
> Google's open source projects are open in name only.
The link at the top of the page is pointing to the GitHub repo, where you can see literally over a million contributions from thousands of people working at hundreds of companies: https://github.com/chromium/chromium/commits/main
I've worked on both Chrome and Android (Chromium and AOSP) professionally, and never worked at Google.
There is the OSS vs FOSS distinction which may have been unwittingly invoked. Certainly there is nothing “free” about Chromium except its price. Google is not about to switch to a fork for Chrome and any changes to Chromium which are not approved by Google are unlikely to be in any release builds.
What I should've written is that: yes, they are open source, but there's no way to influence the direction they are going. These projects are 100% Google-run, and very few (if any) decisions are public.
For most projects there's also a significant proprietary part in the actual final product
Microsoft is exactly the kind of company that would throw its full backing behind this google proposal, seeing how they have spent the last 20 years working towards the same goal. See Windows 11, Trusted Platform Module, Pluton, Palladium, SecureBoot.
Mozilla should really double down on Mozilla VPN. Judging by all the NordVPN ads on every major youtuber's video, the profit margins must be astronomical (or their business model must be suspicious). It should provide a good income stream for Mozilla. The entire space is shady and filled with dubious actors. It is just begging to be disrupted by a trustworthy organization.
I can't think of a single candidate other than Mozilla that has the technical expertise, experience, trust, reputation, resources (not to mention non-profit structure) built over 20 years defending the open web. I don't understand why Mozilla is dragging their feet on this. They should have owned the entire VPN market by now. VPNs aren't cryogenic rockets.
VPNs are barely gonna make a dent in their income. What do you think the market is for VPNs? 99% of people don't know what VPN means.
Of the remaining 1%, most don't need a VPN for anything personal. It's literally just a handful of geeks who need VPN (mainly for secure piracy, or accessing different regional Netflix catalogs), and maybe a few dozen journalists living in dictatorships.
Mozilla needs to gut spending. Get rid of all the diversity /hr/evangelism people bloating their employee headcount and funneling people's donations to divisive causes like that org that doesn't hire white men (forgot the name but it made me cancel my monthly donation to Mozilla). They shouldn't need more than 25% non-technical staff, and the purpose of those 25% should be exclusively to support the technical staff. Instead they became another bloated Big NGO that's basically welfare for liberal arts majors in California.
Is the Mozilla organization generally responsive to social media? I have had a hard time trying to figure out where the organization responds to publicly, generally.
I would love to have a Mozilla hosted email and calendar service from them, for example. I don't understand why they aren't branching out into more common web citizen needed services.
Yes. I don't know why though. I don't understand why they can't host and run their own OpenVPN instance. Or why MozillaVPN is only available in 30 countries (mine not included), 4 years after announcement. Or why i haven't seen a single ad for Mozilla VPN anywhere on the web other than in mozilla's homepage. Or what they are doing with their 800 million dollars in annual revenue.
