Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What happened to Firefox Send?

support.mozilla.org

Post reply on HN
Print view View original

261–267 of 267 posts

Re: What happened to Firefox Send?

#261

Post by davisoneee »

rvba wrote: post #259
davisoneee wrote: post #152

Earlier quoted context omitted.

Regarding 2) ...evidently focusing on their existing userbase isn't viable. So often these comments like "they are ignoring their user base" and "why won't they let us donate to firefox" miss the point (even if true / beneficial)...they don't want to double down on their existing user base; they want to expand their userbase to go with their mission of bringing more trust to the web Firefox was the better extension p…

> evidently focusing on their existing userbase isn't viable. I disagree. First of all: their strategy to ignore the requests of existing users in order to focus on some potential new users doesn't work. Firefox lost around 10 percentage points of market share in last few years. Second of all: the whole "strategy" of alienating current user base in hope of finding new users is batshit insane. Browsers are a mature pr…

To self quote, "Firefox was the better extension platform...and didn't entice users away".

Firefox's share has been declining for years, and I wouldn't say it's become a significantly worse browser in that time. They aren't showing any signs of growing organically. They are trying to get away from Google, and for that, they need to grow their base and bring in much more revenue from users, or just accept being a small side player in the browser market.

You mention tech-savy...but is 'tech savy' what the public wants, or needs? Firefox has always been the more tech-savvy browser I would say, and yet they are losing ground to Chrome. The tech-savy browser is the one that's trying to push the boundaries; they are trying to do more technical stuff, which gives more opportunity for problems, such as workflow breaking.

I don't know if Firefox _can_ compete with Google, given how badly their market share is declining. I think a lot of that isn't even due to Firefox, it's in my view partly driven by Web Devs no longer caring about ensuring Firefox is supported, and also just that "Google" is the average users' doorway to the internet. I think it's also partly because the Chrome way just works for your average consumer...click the browser, search, job done. Again, the HN crowd seems to conflate 'what I want' and 'the reviews I see', and fail to really think about what _the market_ wants, or how the average consumer interacts in ways that may be wildly different than the way a current firefox user interacts. Chrome is stable because they don't really seem to do much from release to release, and that _works_ for the average user.

Re: What happened to Firefox Send?

#262

Post by fireattack »

hiq wrote: post #256
fireattack wrote: post #229

Earlier quoted context omitted.

Might be a stupid question, but why server can't see the secret key? You said that "note that URL fragments are never sent to the server", which is true when uploading the file. But when someone is downloading the file, they need to use this full URL with secret key right? By then, the server will get the key and can decrypt the file themselves.

See the post that OP linked: > Note that URL fragments are never sent to the server. They are often used for page anchors, and sometimes to keep track of local state in SPA. Also see: https://en.wikipedia.org/wiki/URI_fragment#Basics

Thank you for the info. I thought it's setup specific, didn't know anchor string is never sent to servers in general.

Re: What happened to Firefox Send?

#263

Post by rvba »

davisoneee wrote: post #261
rvba wrote: post #259

Earlier quoted context omitted.

> evidently focusing on their existing userbase isn't viable. I disagree. First of all: their strategy to ignore the requests of existing users in order to focus on some potential new users doesn't work. Firefox lost around 10 percentage points of market share in last few years. Second of all: the whole "strategy" of alienating current user base in hope of finding new users is batshit insane. Browsers are a mature pr…

To self quote, "Firefox was the better extension platform...and didn't entice users away". Firefox's share has been declining for years, and I wouldn't say it's become a significantly worse browser in that time. They aren't showing any signs of growing organically. They are trying to get away from Google, and for that, they need to grow their base and bring in much more revenue from users, or just accept being a smal…

The loss of users happened when Chrome came out. At that time Firefox was eating tons of memory and getting buggy with more tabs open. Chrome was also marketed very aggressively by Google.

Firefox partially removed those problems with later versions: it stopped eating so much RAM.

Sadly after version 56 the "batshit insane" strategy started. It's like a set of terrible decision after terrible decision. (1) alienating users by killing extensions (2) constant changes to UI, workflow (3) 1 year later forgetting to sign extensions so everything stopped working (4) patching everything via strange side-channels that shouldn't exist (5) even more batshit insane changes to browser, killing extensions AGAIN and chaing extensions again

If all those things simply did not happen and Firefox was simply maintained like a normal program, their unique selling point would be "our product is similar, but offers you your favorite extensions and also we don't spy on you". That would be their secure niche, from which they can expand and which they cannot lose.

But they do everything they can to lose their users.

> Chrome is stable because they don't really seem to do much from release to release, and that _works_ for the average user.

What is the value add of constant shifts of Firefox? Definitely not security.

Re: What happened to Firefox Send?

#264

Post by sfink »

rvba wrote: post #258
sfink wrote: post #199

Earlier quoted context omitted.

I hesitate to reply to this, because it's such a caricature of negativity. It's kind of a rollup of all of the crap that HN comes up with to fling at Mozilla. Everything has some kernel of truth in it, but it's pretty heavily buried. 1) The majority of developers at Mozilla are working on Firefox. Many more than 50. It is true that we have fewer staff than Google has working on Chrome (Mozilla is less than half, I he…

1) When I write about people working on Firefox I mean people fixing old bugs and working on the features that USERS want. Users are the most interested in the core product: the browser. They also want the browser to get the functionality that was removed (extensions!). When you write about Firefox, you seem to write about various side projects like Firefox-Send, or Pocket that barely add any value to the actual user…

You assume that "side projects" are taking up a substantial proportion of development resources. They really, really aren't. Experimental projects are mainly small groups exploring possibilities. Initially 1-2 people, growing when (and if) they seem to be getting somewhere. At various points in the history of the project, it's been more developers vs product people who come up with the initial ideas.

The rest of us are working on stuff like: Fission (process-per-tab, roughly). Pageload performance. Memory usage. Printing. Moving stuff to the GPU. The never-ending treadmill of new web APIs. Porting to new platforms. Fixing bugs.

As for extensions: there is no intention to regain 100% of the power of XUL extensions. Never has been. Many extensions used to get the source code of an internal function, search and replace to update the code, and reinstall it. We're not going to return to that level of power. (Yes, XUL extensions don't have to do it this way; I'm using an extreme example to illustrate the former power.)

But that's not to say that Mozilla doesn't want to increase the power of WebExtensions. I'm not really privy to the decisionmaking there, but look -- we just laid off 250 people. I hope that's adequate proof that we have to make some hard resourcing decisions. And most of the "why don't you just..." requests are not as trivial as they seem, even when the requester's exact use case would be fine. Any extension API that allows deceiving the user or subverting their intentions must be handled carefully to maintain the security of users, and people are pretty darn good at finding unexpected ways to exploit seemingly innocuous capabilities.

I'm not going to debate the history or correctness of all the decisions that bother people. I agree with some, disagree with some, and aligning my views with yours or anyone else's isn't going to have much of an effect on anything. We've screwed up. I'm sure we haven't properly admitted to some screwups. People's experiences and workflows are different, and I know I'm always surprised to discover that 99% of users are not seeing something that bothers me. My intuition of what is or isn't important is not as good as I expect it to be.

Re: What happened to Firefox Send?

#265

Post by jwilk »

tialaramex wrote: post #232
jwilk wrote: post #204

Earlier quoted context omitted.

Magic Wormhole is a security disaster. Do not use if you have other options. 1) By default, authentication key has only 16 bits of entropy. (I wish I was making this up…) 2) There's no good UI to make the key stronger: you can either use, say, "--code-length 16", which makes the receiving code ridiculously long, or provide your own code with "--code", in which case it's visible to other local users via ps(1). 3) Betw…

> By default, authentication key has only 16 bits of entropy. (I wish I was making this up…) It's a PAKE being used for Socialist Millionaire-style interactive authentication. So that key needs to be successfully guessed by the attacker. If they guess wrong they don't get any further attempts, game over, all three participants (the sender, receiver and this attacker) learn it didn't work. That's just not an attractiv…

> You've noticed that 128-bit secrets aren't very convenient for humans.

Meh. Even if you have to retype the secret, 128 bits in not a big deal. The time spent on typing is trivial in comparison to the time you're gonna waste when you fall victim to DoS. I'm speaking from experience.

Post reply on HN